Ourcana Online

Identity requirements

estate, bind and online use the configured remote, not --store. For an existing Ourcana app namespace, the current implementation needs a readable app.keychain identity on macOS. A new local.device identity has a different namespace and will not reveal the app's data.

The pairing flow stores E2E keys and a grant, but online currently opens an owned enrolled namespace and derives its keys from that identity. It does not use the paired namespace and stored pairing keys. Do not expect pairing alone to make these browsing commands work for your app system.

estate

or estate
or --json estate
or estate --all

estate asks gate about the active identity's entitlement, paid-through time and linked estate members. --all surveys every readable identity in the app's macOS keychain, not every local keystore entry. It sends requests in sequence. JSON contains gate and an identities array. A failed request appears as an error on that identity's row, so check row errors even when the command exits successfully.

bind

or bind

This performs gate's bind ceremony for the active owned identity and saves the entitlement token. It does not buy, renew or create a paid entitlement. Keep the configuration containing that token private.

online ls

or online ls
or online ls /n
or --json online --timeout 10 ls /n

ls lists entries with decrypted paths where this identity's keys fit, optionally filtered by a path prefix. Terminal output includes path, size, timestamp and subspace. JSON rows contain path as a component array or null, sealed, subspace, timestamp in microseconds, and payload_length. An empty listing is [] in JSON mode. Undecryptable paths are marked sealed, not silently discarded from an unfiltered listing.

online cat

or online cat /n/member-42
or --json online cat /n/member-42

Use a real path from your listing. Payloads are checked against the signed entry's digest before decryption. JSON payloads are pretty-printed in JSON mode; non-JSON text becomes a JSON string. Plain mode prints lossy UTF-8 text, so this is not a raw-binary download command.

--no-verify bypasses the payload digest check. It is a diagnostic escape hatch, not a fix for corrupt data; leave verification enabled for normal use.

online rm

# Inspect before deciding whether to delete anything.
or online ls /a/front
# This asks for confirmation before pruning that subtree.
or online rm /a/front

The prompt asks you to type the number of listed entries. --yes or -y skips that prompt; --everything explicitly requests the whole namespace. Passing / without --everything is refused. --json does not disable the prompt: without --yes, confirmation text goes to stdout before the JSON report. Only use --yes after deliberately choosing the target and scope.

The success report contains prefix, pruned, bytes and timestamp; an empty match reports prefix and pruned: 0. pruned counts the listed matching records, not proof of an erase across every device.

Select a different app identity

online --namespace <hex-prefix> acts as that readable app-keychain identity without changing the active one. It mints a gate token for that identity during the command and leaves the stored token alone. --timeout defaults to 30 seconds per request. See exact CLI help.