Module visibility 

mkit visibility set (WP-2.14, R-156): switch a repository between public and private (SPEC-WRITE-GRANTS §9.1).

Two modes, chosen by --statement:

• Envelope (default): a signed auth v2 write of SetRepoVisibility with the repository signing key, so it needs transport_auth = envelope and a trusted remote, like mkit push. A grant never authorizes it.
• Statement (--statement): an owner-signed mkit-repo-visibility:v1 statement, sent with no envelope and with X-Repository. It signs with any owner scheme, including a wallet or passkey by import.

Either way the server may answer unavailable + Retry-After while a change to private takes effect everywhere; the command waits.

Functions

run