@kodycodes/cli 1.26.1 → 1.26.3

package/dist/chunk-TIL35OWA.js

@@ -0,0 +1,1959 @@
+import { createRequire as __createRequire } from 'node:module'; const require = __createRequire(import.meta.url);
+import {
+  assertLocalExecuteNodeEngine
+} from "./chunk-SMURF26I.js";
+import {
+  isPublishedPackageInvokeSpecifier,
+  resolveExecuteInvokeCode
+} from "./chunk-75RZUXQL.js";
+import {
+  formatToolResult
+} from "./chunk-46IJPEID.js";
+import {
+  hostIds
+} from "./chunk-PDWCKWQF.js";
+import {
+  resolveOrgSlug
+} from "./chunk-OVGXPRSY.js";
+import {
+  resolveLocalExecuteBearer
+} from "./chunk-VQS5YSCI.js";
+import {
+  authBootstrap,
+  authBootstrapWithScopes,
+  bootstrapMintLifetimeFields,
+  cliCredentialBootstrapOperationId,
+  parseCliLifetimeSecondsFlag,
+  parseCliScopesFlag,
+  refreshGitCredentialHelperPinIfNeeded,
+  resolveCliTokenLifetime
+} from "./chunk-EOCV74B2.js";
+import {
+  parseCredentialFlags
+} from "./chunk-R4IUV5P5.js";
+import {
+  redactError
+} from "./chunk-CASGRYOF.js";
+import {
+  orgEnvVar,
+  orgSlugFromFlag
+} from "./chunk-CWWHR4FH.js";
+import {
+  readPackageVersion
+} from "./chunk-G6LJWROP.js";
+import {
+  cliBootstrapMintCall,
+  deleteStoredApiToken,
+  hasExplicitTokenFlag,
+  loadStoredApiToken,
+  requireApiToken,
+  resolveScopedApiToken
+} from "./chunk-RTWUNV76.js";
+import {
+  deleteCredentials,
+  listStoredOrgs,
+  loadCredentials
+} from "./chunk-RM34N3KI.js";
+import {
+  apiTokenEnvVar,
+  defaultApiUrl,
+  defaultMcpUrl,
+  modernMcpProtocolVersion,
+  onboardingUrl
+} from "./chunk-IHP6PV6X.js";
+
+// src/cli.ts
+import { parseArgs } from "node:util";
+import { readFile } from "node:fs/promises";
+
+// src/help.ts
+function formatOrgsHelpBlock(orgs, indent = "  ") {
+  if (orgs.length === 0) {
+    return `${indent}Not logged in. Run \`kody login\`.
+`;
+  }
+  const lines = [`${indent}Logged-in orgs:`];
+  for (const org of orgs) {
+    const mark = org.active ? "*" : " ";
+    const pending = org.pending ? "  (slug pending \u2014 run any authenticated command)" : "";
+    lines.push(
+      `${indent}  ${mark} ${org.slug}${org.active ? "  (active)" : ""}${pending}`
+    );
+  }
+  return `${lines.join("\n")}
+`;
+}
+function buildUsage(input = {}) {
+  const mcpUrl = input.mcpUrl ?? defaultMcpUrl;
+  let orgs = input.orgs;
+  if (!orgs) {
+    try {
+      orgs = listStoredOrgs(mcpUrl, input.backend, input.resolution);
+    } catch {
+      orgs = [];
+    }
+  }
+  const orgBlock = formatOrgsHelpBlock(orgs);
+  return `Kody CLI ${readPackageVersion()}
+
+Install Kody as a remote MCP server in local agents, or use this CLI as a local client.
+
+Usage:
+  kody login [--mcp-url <url>] [--org <slug>] [--no-browser]
+  kody logout [--org <slug>] [--mcp-url <url>] [--api-url <url>]
+  kody org list [--json] [--mcp-url <url>]
+  kody org use [<slug>] [--mcp-url <url>]
+  kody status [--mcp-url <url>] [--api-url <url>]
+  kody auth bootstrap (--code <kody_bc_\u2026> | --scopes <list>) (--lifetime short|long | --idle-ttl-seconds <n> --max-lifetime-seconds <n>)
+                      [--token <token>] [--mcp-url <url>] [--api-url <url>]
+  kody auth setup-git [--lifetime long|short] [--scopes <list>] [--token <token>] [--mcp-url <url>] [--api-url <url>]
+  kody auth remove-git [--mcp-url <url>] [--api-url <url>]
+  kody git-credential <get|store|erase>
+  kody whoami [--org <slug>] [--target prod|mock] [--mcp-url <url>] [--token <token>] [--api-url <url>] [--json]
+  kody search [query] [--org <slug>] [--entity <ref>] [--domain <id>] [--limit <n>] [--target prod|mock] [--token <token>] [--api-url <url>] [--json]
+  kody api <operationId> [--org <slug>] [--params <json>] [--token <token>] [--api-url <url>] [--json]
+  kody package publish [<@owner/leaf|package_id>] [--org <slug>] [--params <json>] [--token <token>] [--api-url <url>]
+  kody package collaborators <package> [--org <slug>] [--json] [--token <token>] [--api-url <url>]
+  kody package grant <package> (--team <slug> | --user <username>) [--preset use|contribute|manage] [--org <slug>] [--json]
+  kody package revoke <package> (--team <slug> | --user <username> | --grant <grant_id>) [--org <slug>] [--json]
+  kody execute [--org <slug>] [--invoke <ref> | --code <esm> | --file <path>] [--params <json>] [--conversation-id <id>] [--json]
+               [--credential <key=name>]\u2026 [--target prod|mock] [--token <token>] [--api-url <url>] [--local] [--allow-private-network]
+  kody dev [serve] [--org <slug>] [--target prod|mock] [--reset-storage] [--port <n>] [--app-base-path <path>] [--allow-private-network] [--no-live-reload] [--json] [--ready-file <path>]
+  kody dev fetch <path> [--method <verb>] [--body <file>] [--target prod|mock] [--json] [--no-attach]
+  kody dev job <name> [--target prod|mock] [--dry-run] [--json]
+  kody dev webhook <name> --body <file.json> [--target prod|mock] [--dry-run] [--json]
+  kody dev emit <event> --body <event.json> [--target prod|mock] [--dry-run] [--json]
+  kody dev check [--target prod|mock] [--json]
+  kody install [--mcp-url <url>] [--clients <ids>] [--yes] [--project] [--json]
+  kody skill install [--project]
+
+  kody install configures running local MCP clients (Cursor, Claude Desktop,
+  VS Code, Goose, and others). For web-based clients (ChatGPT, Claude.ai, Grok),
+  see ${onboardingUrl(defaultMcpUrl)}
+
+Orgs (local store, offline):
+${orgBlock}
+  --org <slug>
+             For \`kody login\` / \`kody logout\`: only the flag counts
+             (${orgEnvVar} is ignored). Login binds the browser grant to
+             this organization (adds/replaces that org's stored login;
+             other orgs stay). Example: \`kody login --org acme\`
+             Omit and the server picker binds one org.
+             For org-scoped commands (whoami, search, api, execute, \u2026):
+             run as this org for one call. Precedence: flag, then
+             ${orgEnvVar}, then the active org (\`kody org use\`).
+
+  kody org list
+             Show logged-in orgs and mark the active one. \`--json\` for agents.
+
+  kody org use [<slug>]
+             Switch the active org. With a slug (agents), switches directly.
+             With no slug on a TTY (humans), opens an interactive chooser.
+             Without a TTY, pass a slug.
+
+  kody logout
+             Without \`--org\`, removes the active org login only (or the
+             pending legacy session). With \`--org <slug>\`, removes just
+             that org. Other org logins stay. Also clears a stored
+             bootstrap/API token when present.
+
+  --clients  Comma-separated ids: ${hostIds.join(", ")}
+
+  auth bootstrap
+             Redeem a one-shot \`kody_bc_\u2026\` from MCP \`cliCredentialBootstrap\`
+             (POST /v1/tokens/bootstrap/redeem, no Authorization header).
+             Lifetime is required: \`--lifetime short|long\` (\`short\` = 1h
+             idle / 24h max; \`long\` = 14d idle / 3mo max), or both
+             \`--idle-ttl-seconds\` and \`--max-lifetime-seconds\`.
+             Single-task agents should use \`--lifetime short\`.
+             Stores the resulting \`kody_at_\u2026\` for \`execute --local\`,
+             search, whoami, api, and token-auth cloud execute without
+             printing the token. Prefer this over tokenCreate for agents
+             already on MCP. Interactive humans can use \`kody login\`
+             instead. Do not call \`kody api cliCredentialBootstrapRedeem\`
+             \u2014 that would print the token.
+
+  --scopes <list>
+             Opt in to scopes beyond the cliCredentialBootstrap defaults
+             (comma- or space-separated, e.g.
+             \`--scopes org:execute,org:read,package:read,package:write\`).
+             The list replaces the defaults, so include every scope you
+             need. Instead of \`--code\`, the CLI mints the code itself by
+             passing \`scopes\` to cliCredentialBootstrap, then redeems and
+             stores it. It mints with \`--token\` if given, else the
+             \`kody login\` session (any scope your org role grants), else
+             ${apiTokenEnvVar} / a stored token (only scopes that token
+             already holds). A bootstrap code's scopes are fixed when it is
+             minted, so \`--code\` with \`--scopes\` is an error. Defaults
+             stay least-privilege; \`insufficient_scope\` errors print the
+             exact \`--scopes\` command to run.
+
+  auth setup-git
+             Install a Git credential helper for HTTPS clones/fetches/pushes
+             at \`https://kody.codes/@owner/name.git\` (see guide:auth_setup_git).
+             Uses a \`kody login\` session (or \`--token\` / ${apiTokenEnvVar} /
+             stored bootstrap token) to mint a user-owned \`kody_at_\u2026\` with
+             at least \`package:read\` and \`package:write\` (default
+             \`--lifetime long\`; reuses a suitable stored token). That token
+             authorizes every repo you can access across all orgs \u2014 login
+             \`--org\` only scopes the MCP mint session, not git. User-wide:
+             one setup covers every org. Requires a server that advertises
+             \`org_binding\`. Configures a stable
+             \`credential.https://<host>.helper\` (global \`kody\` only when
+             its version supports \`git-credential\`, else
+             \`npx -y @kodycodes/cli@<exact>\` \u2014 never a major-only range or
+             ephemeral npx cache path) + \`useHttpPath\`. Re-run (or any
+             newer CLI command) rewrites stale helper pins. Undo with
+             \`kody auth remove-git\`. Does not change \`kody login\` /
+             existing auth flows.
+
+  auth remove-git
+             Inverse of \`auth setup-git\`: removes every
+             \`credential.https://<host>.*\` helper entry setup-git may have
+             written (global and local; including stale \`~/.npm/_npx\` and
+             major-only \`@1\` pins), revokes the stored API token on the
+             server (\`token:delete\` / DELETE /v1/tokens/current), and
+             deletes it from the OS keychain. Idempotent when nothing is
+             set up; prints what it removed. Leaves \`kody login\` sessions
+             alone.
+
+  git-credential
+             Git credential helper invoked by git after \`auth setup-git\`
+             (\`get\` returns username=x / password=kody_at_\u2026 for the Kody
+             host with no network while the stored token is still valid;
+             silently remints via \`kody login\` only when expired or near
+             expiry; \`store\`/\`erase\` are no-ops). Not meant for interactive
+             use.
+
+  api        Call one Open API operation by operationId + flat --params
+             JSON (same shape as the MCP \`api\` tool). Uses scoped API
+             auth only (\`--token\` / ${apiTokenEnvVar} / stored bootstrap).
+             Prints JSON. Example: \`kody api usageGet --params '{}'\`.
+             Unknown operationIds error clearly; see
+             ${defaultApiUrl}/openapi.json. tokenCreate / tokenRotate
+             responses include a one-time token value \u2014 prefer env storage
+             over pasting into chat.
+
+  package publish
+             Thin wrapper for Open API \`packagePublishExternalPush\` (same
+             auth as \`kody api\`). Optional positional is a \`package_id\`, or a
+             name (\`@owner/leaf\` or bare leaf) resolved to its package_id
+             via \`packageList\` in the current org. Extra fields
+             via \`--params\` JSON (e.g. \`allow_force\`). Prints JSON.
+
+  package collaborators | grant | revoke
+             Who can use one package, and add or remove teams and members of
+             the org (\`--org\`). \`<package>\` is \`@owner/leaf\`, the kody id,
+             or the package id. \`grant\` adds a team or org member or changes
+             their preset (default \`use\`) via \`packageCollaboratorSet\`;
+             people outside the org are refused. \`revoke\` removes one by
+             team, user, or grant id via \`packageCollaboratorRemove\`. Needs
+             Manage on the package and a token with
+             \`package:manage_access\` (\`auth bootstrap --scopes \u2026\`); same
+             auth as \`kody api\`. Prints a short summary, or the API JSON
+             with \`--json\`.
+
+  --token / ${apiTokenEnvVar}
+             Scoped API token (preferred via env). With no \`kody login\`
+             session, search / whoami / api / execute use the Open API and
+             CapabilityProxy \u2014 including cloud execute without --local.
+             Auth priority matches \`execute --local\`: \`--token\` /
+             ${apiTokenEnvVar}; stored bootstrap/API token from
+             \`auth bootstrap\`; then \`kody login\` where applicable.
+             Prefer \`cliCredentialBootstrap\` then \`auth bootstrap\`
+             (\`--lifetime short|long\`). CI/headless: \`tokenCreate\` with
+             \`org:execute\` plus the capability scopes you need.
+             For \`execute --local\`, a valid \`kody login\` session can also
+             supply Bearer when no scoped token is available (no tokenCreate
+             exchange). User-owned tokens (\`org_binding: user\`) honor
+             \`--org\` / ${orgEnvVar} as \`?org=\` on API calls.
+
+  --local    Run the execute module on this machine (workerd, Linux/macOS).
+             Requires Node.js 22 or newer. \`--file\` entries are bundled
+             (relative imports and npm packages; \`kody:*\` stays external)
+             before workerd loads them \u2014 same shape as hosted execute /
+             publish. Unresolvable imports fail with a clear bundle error.
+             \`--invoke kody:@scope/pkg/export\` (or \`@scope/pkg#export\`)
+             works with \`--local\` / \`--target mock\` \u2014 mints the same thin
+             passthrough as a \`--code\` import wrapper. From a package
+             directory, \`--invoke ./export\` runs a local package.json#exports
+             key. Auth: \`--token\` /
+             ${apiTokenEnvVar}, else stored \`auth bootstrap\` token, else
+             paired \`kody login\` credentials. Static kody:@\u2026 imports are fetched via POST
+             /v1/local-execute/package-graph and embedded in local workerd
+             (CapabilityProxy only for per-call kody:runtime hops \u2014 never a
+             whole-module cloud kody.execute defer). Fails clearly when that
+             package-graph API is unavailable. Cloud token execute (no
+             --local) uses CapabilityProxy \u2192 kody.execute for every module.
+
+  --credential <key=name>
+             ADR 0068 call map: pick which credential each \`credential(key)\`
+             / \`credentials(key)\` call gets. Repeatable.
+             \`--credential github=work\`, \`--credential x=org:work\`
+             (or \`personal:name\`), \`--credential github=\` for none on
+             purpose. With \`--local\`, sent as CapabilityProxy top-level
+             \`credentials\` (code never sets the map) after a
+             \`credentialClientCheck\` preflight. With a \`kody login\` MCP
+             session (no token), passed as MCP execute \`credentials\`.
+             Token-auth cloud execute (CapabilityProxy \u2192 kody.execute)
+             rejects the flag \u2014 use \`--local\` or MCP.
+
+  --allow-private-network
+             Allow execute --local / \`kody dev\` code to fetch private and
+             local network addresses. Default is public-only.
+
+  --target prod|mock
+             Where server-side calls go (storage, credentials, kody:*,
+             execute, invoke, search). Same meaning on \`dev\`, \`execute\`,
+             and \`search\`. Defaults: \`mock\` for \`kody dev\`; \`prod\` for
+             execute/search (unchanged). \`--target mock\` starts the
+             built-in CLI mock (no kody-celld); scratch storage; fake or
+             local credentials so unpublished packages never touch real
+             secrets. Unimplemented mock routes refuse with
+             \`not_implemented_in_mock\`.
+
+  --reset-storage
+             With \`--target mock\`, wipe the mock session's scratch storage
+             before the command.
+
+  --dry-run  With \`kody dev job|webhook|emit\`, print the module path and
+             params that would run without invoking (safe against prod side
+             effects). Does not apply to serve/fetch/check.
+
+  --passthrough <host,\u2026>
+             With \`--target mock\` and a package \`.kody/mocks.ts\`, allow
+             listed hosts to use the real network (credentials stay fake \u2014
+             never carries real secrets). Unmatched hosts fail with
+             \`unmocked_request\` plus a paste-ready MSW handler stub.
+             Ignored on \`--target prod\`. On mock, outbound fetch always
+             goes through the Node gateway: with \`.kody/mocks.ts\`, unmatched
+             hosts (and all \`createAuthenticatedFetch\` / credentialed hops
+             without a handler) fail closed; without the file, public hosts
+             passthrough and private hosts need \`--allow-private-network\`.
+
+  kody dev   Local testing for unpublished packages. Serves \`kody.app.entry\`
+             on localhost via workerd with hot reload (mount-stripped path;
+             packageContext.hostedUrl / appBasePath point at localhost).
+             Rebuilds swap to a new workerd only once it listens (requests
+             wait; no 503 or stale bundle). Build errors (file:line:col +
+             code frame) and uncaught handler errors (stack mapped to your
+             .ts sources) are served as dev-only 500 pages until fixed. App
+             console.* streams to the terminal tagged by request. HTML pages
+             live-reload after each rebuild and show an error overlay
+             (SSE at /__kody/dev/events; \`--no-live-reload\` disables).
+             Stable default port per package (4100-4999, next free port
+             if taken); \`--port <n>\` is exact (\`--port 0\` = any).
+             Serves \`kody.app.client\` at /_assets/client.<hash>.js
+             (packageContext.clientModuleUrl), \`kody.app.assets\` under
+             /_assets/, and /_assets/__version.json. \`kody.dev.prebuild\`
+             (shell command, run before every build) regenerates assets;
+             \`kody.dev.ignore\` lists watcher path prefixes to skip.
+             Agents: \`--json\` streams NDJSON events (ready, rebuild_start,
+             rebuild_ok, build_error, runtime_error, log); GET
+             /__kody/dev/status returns build id + last error;
+             \`--ready-file <path>\` writes { url, port, basePath, pid } once
+             ready. \`kody dev fetch\` attaches to a running \`kody dev\` for
+             the same package and target (\`--no-attach\` boots a one-shot
+             server).
+             Bundles with the same esbuild path as publish (\`local-bundle\`).
+             Four surfaces: exports (\`execute --invoke ./export\` or
+             \`--file\` against the local package), webhooks
+             (\`kody dev webhook\`), schedules (\`kody dev job\` \u2014 runs once,
+             never schedules locally), subscriptions
+             (\`kody dev emit <event> --body event.json\`). \`kody dev check\`
+             bundles + light publish validations without running; when the
+             package uses credentialed fetch and \`.kody/mocks.ts\` is
+             missing, check soft-suggests adding that file. On
+             \`--target mock\`, \`kody:@\` deps resolve from this package's
+             exports, \`.kody/deps.json\` / \`package.json#kody.localDeps\`
+             path maps, then published package-graph when a login/API token
+             is available (storage/credentials stay on the mock; local-only
+             deps need no login). Optional \`.kody/mocks.ts\` exports MSW
+             \`handlers\` for outbound fetch mocking (Node gateway; not
+             published with the package) \u2014 \`createAuthenticatedFetch\`,
+             \`credential().fetch\`, \`gatewayFetch\`, and
+             \`gatewayFetchStream\` all match against them. Unmocked
+             requests fail closed with a ready-to-paste MSW handler stub
+             pointing at \`.kody/mocks.ts\`. Share previews are out of scope.
+
+Environment:
+  KODY_MCP_URL        Override the default MCP URL (${defaultMcpUrl})
+  ${orgEnvVar}             Default org slug for org-scoped commands (overridden by --org)
+  ${apiTokenEnvVar}      Scoped API token for token-auth search / whoami / api / execute
+  KODY_API_URL        Override the Kody API URL (${defaultApiUrl})
+  KODY_TARGET         Default \`prod\`|\`mock\` (overridden by --target)
+  KODY_MOCK_SESSION_ID  Scratch storage key for --target mock (default: default)
+  KODY_CACHE_DIR      Where execute --local caches workerd (default: user cache dir)
+  KODY_WORKERD_PATH   Use this workerd binary instead of the pinned download
+`;
+}
+
+// src/package-collaborators.ts
+var packageCollaboratorPresets = ["use", "contribute", "manage"];
+var packageCollaboratorActions = [
+  "collaborators",
+  "grant",
+  "revoke"
+];
+function isPackageCollaboratorAction(value) {
+  return packageCollaboratorActions.includes(value);
+}
+var packageCollaboratorUsage = [
+  "Usage: kody package collaborators <@owner/leaf|kody_id|package_id> [--org <slug>] [--json]",
+  "       kody package grant <package> (--team <slug> | --user <username>) [--preset use|contribute|manage] [--org <slug>] [--json]",
+  "       kody package revoke <package> (--team <slug> | --user <username> | --grant <grant_id>) [--org <slug>] [--json]"
+].join("\n");
+function readFlag(value, name) {
+  if (value === void 0) return void 0;
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`--${name} needs a value.
+${packageCollaboratorUsage}`);
+  }
+  return value.trim();
+}
+function readSubject(values, allowGrant) {
+  const team = readFlag(values.team, "team");
+  const user = readFlag(values.user, "user");
+  const grant = allowGrant ? readFlag(values.grant, "grant") : void 0;
+  const given = [team, user, grant].filter((value) => value !== void 0);
+  if (given.length !== 1) {
+    throw new Error(
+      `Pass exactly one of ${allowGrant ? "--team, --user, or --grant" : "--team or --user"}.
+${packageCollaboratorUsage}`
+    );
+  }
+  if (team) return { kind: "team", slug: team.replace(/^@/, "") };
+  if (user) return { kind: "user", username: user.replace(/^@/, "") };
+  return { kind: "grant", grantId: grant };
+}
+function readPreset(value) {
+  const preset = readFlag(value, "preset") ?? "use";
+  if (!packageCollaboratorPresets.includes(preset)) {
+    throw new Error(`--preset must be one of ${packageCollaboratorPresets.join(", ")}.`);
+  }
+  return preset;
+}
+function parsePackageCollaboratorCommand(input) {
+  const packageId = input.positionals[0]?.trim();
+  if (!packageId || input.positionals.length > 1) {
+    throw new Error(packageCollaboratorUsage);
+  }
+  switch (input.action) {
+    case "collaborators":
+      return { action: "collaborators", packageId };
+    case "grant": {
+      const subject = readSubject(input.values, false);
+      if (subject.kind === "grant") throw new Error(packageCollaboratorUsage);
+      return {
+        action: "grant",
+        packageId,
+        subject,
+        preset: readPreset(input.values.preset)
+      };
+    }
+    case "revoke":
+      if (input.values.preset !== void 0) {
+        throw new Error(`--preset is only for grant.
+${packageCollaboratorUsage}`);
+      }
+      return { action: "revoke", packageId, target: readSubject(input.values, true) };
+    default: {
+      const exhaustive = input.action;
+      throw new Error(`Unhandled package action: ${String(exhaustive)}`);
+    }
+  }
+}
+function describeSubject(subject) {
+  return subject.kind === "team" ? `team ${subject.slug}` : `@${subject.username}`;
+}
+function collaboratorLabel(collaborator) {
+  if (collaborator.subject_type === "team") {
+    return collaborator.team_slug ? `${collaborator.team_slug}${collaborator.team_name ? ` (${collaborator.team_name})` : ""}` : collaborator.subject_id;
+  }
+  if (!collaborator.username) return collaborator.display_name ?? collaborator.subject_id;
+  return collaborator.display_name ? `@${collaborator.username} (${collaborator.display_name})` : `@${collaborator.username}`;
+}
+function presetLabel(collaborator) {
+  return collaborator.preset ?? `custom (${collaborator.permissions.length} permissions)`;
+}
+function formatCollaboratorList(list) {
+  const header = `${list.package.name} (${list.package.id})`;
+  if (list.collaborators.length === 0) {
+    return `${header}
+No collaborators. Org owners always have full access.
+`;
+  }
+  const rows = list.collaborators.map((collaborator) => [
+    collaborator.kind,
+    collaboratorLabel(collaborator),
+    presetLabel(collaborator),
+    collaborator.grant_id
+  ]);
+  const widths = [0, 1, 2].map(
+    (column) => Math.max(...rows.map((row) => row[column].length))
+  );
+  const lines = rows.map(
+    (row) => row.map((cell, column) => column < 3 ? cell.padEnd(widths[column]) : cell).join("  ")
+  );
+  return `${header}
+${lines.join("\n")}
+`;
+}
+function findCollaborator(list, subject) {
+  const match = list.collaborators.find(
+    (collaborator) => subject.kind === "team" ? collaborator.subject_type === "team" && collaborator.team_slug === subject.slug : collaborator.subject_type === "user" && collaborator.username?.toLowerCase() === subject.username.toLowerCase()
+  );
+  if (!match) {
+    throw new Error(`${describeSubject(subject)} is not a collaborator on ${list.package.name}.`);
+  }
+  return match;
+}
+async function runPackageCollaboratorPlan(input) {
+  const { plan, call, json } = input;
+  const print = (value, text) => json ? `${JSON.stringify(value, null, 2)}
+` : text;
+  switch (plan.action) {
+    case "collaborators": {
+      const list = await call("packageCollaboratorList", {
+        package_id: plan.packageId
+      });
+      return print(list, formatCollaboratorList(list));
+    }
+    case "grant": {
+      const result = await call("packageCollaboratorSet", {
+        package_id: plan.packageId,
+        ...plan.subject.kind === "team" ? { team_slug: plan.subject.slug } : { username: plan.subject.username },
+        preset: plan.preset
+      });
+      return print(
+        result,
+        `${collaboratorLabel(result.collaborator)} now has ${presetLabel(result.collaborator)} on ${result.package.name} (grant ${result.collaborator.grant_id}).
+`
+      );
+    }
+    case "revoke": {
+      const target = plan.target;
+      let grantId;
+      let label;
+      let packageName = plan.packageId;
+      if (target.kind === "grant") {
+        grantId = target.grantId;
+        label = `grant ${grantId}`;
+      } else {
+        const list = await call("packageCollaboratorList", {
+          package_id: plan.packageId
+        });
+        const collaborator = findCollaborator(list, target);
+        grantId = collaborator.grant_id;
+        label = collaboratorLabel(collaborator);
+        packageName = list.package.name;
+      }
+      const result = await call("packageCollaboratorRemove", {
+        package_id: plan.packageId,
+        grant_id: grantId
+      });
+      return print(result, `Removed ${label} from ${packageName}.
+`);
+    }
+    default: {
+      const exhaustive = plan;
+      throw new Error(`Unhandled package plan: ${JSON.stringify(exhaustive)}`);
+    }
+  }
+}
+
+// src/cli.ts
+var orgScopedCommands = /* @__PURE__ */ new Set([
+  "login",
+  "logout",
+  "whoami",
+  "search",
+  "api",
+  "package",
+  "execute",
+  "dev",
+  "auth"
+]);
+function mcpUrlFrom(values) {
+  return values.mcpUrl || process.env.KODY_MCP_URL || defaultMcpUrl;
+}
+function apiUrlFrom(values, env = process.env) {
+  return values.apiUrl || env.KODY_API_URL || defaultApiUrl;
+}
+function parseKnown(args) {
+  return parseArgs({
+    args,
+    allowPositionals: true,
+    strict: false,
+    options: {
+      help: { type: "boolean", short: "h" },
+      version: { type: "boolean", short: "v" },
+      json: { type: "boolean" },
+      "mcp-url": { type: "string" },
+      entity: { type: "string" },
+      domain: { type: "string" },
+      limit: { type: "string" },
+      code: { type: "string" },
+      file: { type: "string" },
+      invoke: { type: "string" },
+      params: { type: "string" },
+      "conversation-id": { type: "string" },
+      local: { type: "boolean" },
+      "allow-private-network": { type: "boolean" },
+      credential: { type: "string", multiple: true },
+      token: { type: "string" },
+      "api-url": { type: "string" },
+      lifetime: { type: "string" },
+      "idle-ttl-seconds": { type: "string" },
+      "max-lifetime-seconds": { type: "string" },
+      scopes: { type: "string" },
+      project: { type: "boolean" },
+      "no-browser": { type: "boolean" },
+      org: { type: "string" },
+      target: { type: "string" },
+      "reset-storage": { type: "boolean" },
+      "dry-run": { type: "boolean" },
+      passthrough: { type: "string" },
+      port: { type: "string" },
+      "app-base-path": { type: "string" },
+      "no-live-reload": { type: "boolean" },
+      "ready-file": { type: "string" },
+      "no-attach": { type: "boolean" },
+      method: { type: "string" },
+      body: { type: "string" },
+      clients: { type: "string" },
+      yes: { type: "boolean", short: "y" },
+      team: { type: "string" },
+      user: { type: "string" },
+      preset: { type: "string" },
+      grant: { type: "string" }
+    }
+  });
+}
+function resolveCommand(argv) {
+  const { positionals, values } = parseKnown(argv);
+  if (values.help && positionals.length === 0) {
+    return { command: "help", positionals, values };
+  }
+  if (values.version && positionals.length === 0) {
+    return { command: "version", positionals, values };
+  }
+  const raw = positionals[0];
+  if (!raw) return { command: "help", positionals, values };
+  switch (raw) {
+    case "login":
+    case "logout":
+    case "org":
+    case "status":
+    case "auth":
+    case "git-credential":
+    case "whoami":
+    case "search":
+    case "api":
+    case "package":
+    case "execute":
+    case "dev":
+    case "install":
+    case "skill":
+    case "help":
+    case "version":
+      return { command: raw, positionals: positionals.slice(1), values };
+    default:
+      throw new Error(
+        `Unknown command "${raw}". Run \`kody --help\` for usage.`
+      );
+  }
+}
+async function runCli(argv = process.argv.slice(2), io = {}) {
+  const write = io.stdout ?? ((text) => process.stdout.write(text));
+  const writeErr = io.stderr ?? ((text) => process.stderr.write(text));
+  const head = argv[0];
+  const skipHelperRefresh = process.env.NODE_TEST === "1" || process.env.KODY_SKIP_GIT_HELPER_REFRESH === "1" || head === "git-credential" || head === "version" || head === "--version" || head === "-v" || head === "help" || head === "--help" || head === "-h" || head === void 0;
+  if (!skipHelperRefresh) {
+    try {
+      refreshGitCredentialHelperPinIfNeeded({
+        mcpUrl: process.env.KODY_MCP_URL || void 0
+      });
+    } catch {
+    }
+  }
+  try {
+    const parsed = resolveCommand(argv);
+    const helpMcpUrl = mcpUrlFrom({
+      mcpUrl: typeof parsed.values["mcp-url"] === "string" ? parsed.values["mcp-url"] : void 0
+    });
+    if (parsed.values.help && parsed.command !== "help") {
+      write(buildUsage({ mcpUrl: helpMcpUrl }));
+      return 0;
+    }
+    return await dispatch(parsed, write, writeErr);
+  } catch (error) {
+    writeErr(`${redactError(error).message}
+`);
+    return 1;
+  }
+}
+async function dispatch(parsed, write, writeErr) {
+  const mcpUrl = mcpUrlFrom({
+    mcpUrl: typeof parsed.values["mcp-url"] === "string" ? parsed.values["mcp-url"] : void 0
+  });
+  const json = parsed.values.json === true;
+  if (parsed.values["allow-private-network"] === true) {
+    const executeAllowsPrivateNetwork = parsed.command === "execute" && (parsed.values.local === true || (await import("./target-3QHY7JT4.js")).resolveTarget({
+      command: "execute",
+      flag: typeof parsed.values.target === "string" ? parsed.values.target : void 0
+    }) === "mock");
+    if (parsed.command !== "dev" && !executeAllowsPrivateNetwork) {
+      throw new Error(
+        "--allow-private-network can only be used with execute --local, execute --target mock, or kody dev."
+      );
+    }
+  }
+  if (parsed.values["reset-storage"] === true && parsed.command !== "dev" && parsed.command !== "execute" && parsed.command !== "search") {
+    throw new Error("`--reset-storage` is only used with --target mock on execute, search, or dev.");
+  }
+  if (parsed.values["dry-run"] === true && parsed.command !== "dev") {
+    throw new Error(
+      "`--dry-run` is only used with `kody dev job|webhook|emit` (shows the plan without invoking)."
+    );
+  }
+  if (typeof parsed.values.passthrough === "string" && parsed.command !== "dev" && parsed.command !== "execute") {
+    throw new Error(
+      "`--passthrough` is only used with `execute --target mock` or `kody dev` when `.kody/mocks.ts` is active."
+    );
+  }
+  const orgFlag = typeof parsed.values.org === "string" ? parsed.values.org : void 0;
+  if (orgFlag !== void 0 && !orgScopedCommands.has(parsed.command)) {
+    throw new Error(
+      `\`--org\` is not used with \`kody ${parsed.command}\`. Use it with login, logout, whoami, search, api, package, execute, or auth.`
+    );
+  }
+  const orgFlagOnly = orgFlag !== void 0 ? orgSlugFromFlag(orgFlag) : void 0;
+  const org = resolveOrgSlug({ flag: orgFlag });
+  switch (parsed.command) {
+    case "help":
+      write(buildUsage({ mcpUrl }));
+      return 0;
+    case "version":
+      write(`${readPackageVersion()}
+`);
+      return 0;
+    case "login": {
+      const { login } = await import("./auth-4FW6GCLG.js");
+      write("Opening the Kody login page in your browser\u2026\n");
+      const result = await login({
+        mcpUrl,
+        ...orgFlagOnly ? { org: orgFlagOnly } : {},
+        openBrowser: parsed.values["no-browser"] !== true,
+        onAuthorizationUrl: (url) => {
+          write(`If the browser does not open, visit:
+${url.href}
+`);
+        }
+      });
+      const orgLabel = result.org ? ` as org ${result.org}` : result.credentials.org ? ` as org ${result.credentials.org}` : "";
+      const accountLabel = result.account?.email ? ` (${result.account.email})` : result.account?.displayName ? ` (${result.account.displayName})` : "";
+      write(`Logged in to ${result.credentials.mcpUrl}${orgLabel}${accountLabel}.
+`);
+      if (result.backendKind === "file" && result.backendPath) {
+        write(
+          `OS keychain was unavailable; credentials saved at ${result.backendPath} (mode 0600).
+`
+        );
+      } else {
+        write("Credentials stored in the OS keychain.\n");
+      }
+      return 0;
+    }
+    case "logout": {
+      const apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      const oauth = deleteCredentials(
+        mcpUrl,
+        void 0,
+        void 0,
+        orgFlagOnly ? { org: orgFlagOnly } : void 0
+      );
+      const clearApiToken = !orgFlagOnly || oauth.remaining === 0;
+      const apiToken = clearApiToken ? deleteStoredApiToken(apiUrl) : { deleted: false };
+      if (!oauth.deleted && !apiToken.deleted) {
+        write(
+          orgFlagOnly ? `No stored login for org "${orgFlagOnly}".
+` : "No stored credentials.\n"
+        );
+        return 0;
+      }
+      const parts = [];
+      if (oauth.deleted) {
+        parts.push(
+          orgFlagOnly ? `Logged out of org ${orgFlagOnly}.` : "Logged out of the active org (kody login)."
+        );
+      }
+      if (apiToken.deleted) parts.push("Cleared stored bootstrap/API token.");
+      write(`${parts.join(" ")}
+`);
+      return 0;
+    }
+    case "org": {
+      const {
+        chooseOrgInteractively,
+        formatOrgListHuman,
+        formatOrgListJson,
+        useOrg
+      } = await import("./org-X7B5BI4R.js");
+      const { listStoredOrgs: listStoredOrgs2 } = await import("./store-WTMRH527.js");
+      const action = parsed.positionals[0];
+      if (action === "list") {
+        const orgs = listStoredOrgs2(mcpUrl);
+        write(json ? formatOrgListJson(orgs) : formatOrgListHuman(orgs));
+        return orgs.length === 0 ? 1 : 0;
+      }
+      if (action === "use") {
+        const slugArg = parsed.positionals[1];
+        if (slugArg) {
+          const next2 = useOrg(slugArg, mcpUrl);
+          write(`Active org is now ${next2.activeOrg}.
+`);
+          return 0;
+        }
+        const orgs = listStoredOrgs2(mcpUrl);
+        const chosen = await chooseOrgInteractively({ orgs });
+        const next = useOrg(chosen, mcpUrl);
+        write(`Active org is now ${next.activeOrg}.
+`);
+        return 0;
+      }
+      throw new Error("Usage: kody org list [--json] | kody org use [<slug>]");
+    }
+    case "status": {
+      const apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      const credentials = loadCredentials(mcpUrl);
+      const orgs = listStoredOrgs(mcpUrl);
+      const storedApi = loadStoredApiToken(apiUrl);
+      if (!credentials && orgs.length === 0 && !storedApi) {
+        write("Not logged in.\n");
+        return 1;
+      }
+      const lines = [];
+      if (credentials || orgs.length > 0) {
+        const expires = credentials?.expiresAt ? new Date(credentials.expiresAt).toISOString() : "unknown";
+        lines.push(
+          `mcp: ${credentials?.mcpUrl ?? mcpUrl}`,
+          `logged in: yes`,
+          `active org: ${credentials?.org ?? orgs.find((row) => row.active)?.slug ?? "(pending)"}`,
+          `orgs: ${orgs.map((row) => row.active ? `${row.slug}*` : row.slug).join(", ") || "(pending)"}`,
+          `access token expires: ${expires}`,
+          `refresh token: ${credentials?.refreshToken ? "yes" : "no"}`,
+          `scope: ${credentials?.scope ?? "unknown"}`
+        );
+      } else {
+        lines.push(`mcp: ${mcpUrl}`, `logged in: no`);
+      }
+      if (storedApi) {
+        const scopes = storedApi.scopes?.join(", ") || "(unknown)";
+        lines.push(
+          `api: ${storedApi.apiUrl}`,
+          `stored API token: yes (${storedApi.tokenId})`,
+          `API token scopes: ${scopes}`,
+          `API token expires: ${storedApi.expiresAt ?? "unknown"}`,
+          `API token via: ${storedApi.createdVia ?? "unknown"}`
+        );
+      } else {
+        lines.push(`api: ${apiUrl}`, `stored API token: no`);
+      }
+      lines.push("");
+      write(lines.join("\n"));
+      return 0;
+    }
+    case "auth": {
+      const action = parsed.positionals[0];
+      if (action === "setup-git") {
+        return runAuthSetupGit({
+          values: parsed.values,
+          mcpUrl,
+          write,
+          ...org ? { org } : {}
+        });
+      }
+      if (action === "remove-git") {
+        return runAuthRemoveGit({
+          values: parsed.values,
+          mcpUrl,
+          write
+        });
+      }
+      if (action !== "bootstrap") {
+        throw new Error(
+          "Usage: kody auth bootstrap (\u2026) | kody auth setup-git [\u2026] | kody auth remove-git [--api-url <url>] [--mcp-url <url>]"
+        );
+      }
+      const code = typeof parsed.values.code === "string" ? parsed.values.code.trim() : "";
+      const scopes = parseCliScopesFlag(
+        typeof parsed.values.scopes === "string" ? parsed.values.scopes : void 0
+      );
+      if (!code && !scopes) {
+        throw new Error(
+          "Provide --code <kody_bc_\u2026> from cliCredentialBootstrap (MCP api / kody.cliCredentialBootstrap), or --scopes <list> to mint one with the current kody login session or API token."
+        );
+      }
+      const lifetime = resolveCliTokenLifetime({
+        lifetime: typeof parsed.values.lifetime === "string" ? parsed.values.lifetime : void 0,
+        idleTtlSeconds: parseCliLifetimeSecondsFlag(
+          typeof parsed.values["idle-ttl-seconds"] === "string" ? parsed.values["idle-ttl-seconds"] : void 0,
+          "--idle-ttl-seconds"
+        ),
+        maxLifetimeSeconds: parseCliLifetimeSecondsFlag(
+          typeof parsed.values["max-lifetime-seconds"] === "string" ? parsed.values["max-lifetime-seconds"] : void 0,
+          "--max-lifetime-seconds"
+        )
+      });
+      const apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      if (code && scopes) {
+        throw new Error(
+          `--scopes cannot change a bootstrap code: its scopes are fixed when it is minted. From Kody MCP, call \`${cliBootstrapMintCall(scopes, bootstrapMintLifetimeFields(lifetime))}\` and redeem the new code, or drop --code to mint with the current kody login session or API token.`
+        );
+      }
+      const result = scopes ? await authBootstrapWithScopes({
+        scopes,
+        lifetime,
+        apiUrl,
+        mint: bootstrapMinter({
+          scopes,
+          lifetime,
+          mcpUrl,
+          apiUrl,
+          tokenValues: tokenFlagValues(parsed.values),
+          ...org ? { org } : {}
+        })
+      }) : await authBootstrap({
+        code,
+        apiUrl,
+        ...lifetime.kind === "alias" ? { lifetime: lifetime.lifetime } : {
+          idleTtlSeconds: lifetime.idleTtlSeconds,
+          maxLifetimeSeconds: lifetime.maxLifetimeSeconds
+        }
+      });
+      const storedScopes = result.stored.scopes?.join(", ") || "(none)";
+      write(
+        [
+          `Bootstrap API token stored for execute --local, search, whoami, api, and token-auth cloud execute.`,
+          `api: ${result.stored.apiUrl}`,
+          `token id: ${result.stored.tokenId}`,
+          `scopes: ${storedScopes}`,
+          `expires: ${result.stored.expiresAt ?? "unknown"}`,
+          result.backendKind === "file" && result.backendPath ? `OS keychain was unavailable; token saved at ${result.backendPath} (mode 0600).` : "Token stored in the OS keychain.",
+          ""
+        ].join("\n")
+      );
+      return 0;
+    }
+    case "git-credential": {
+      const {
+        handleGitCredential,
+        parseGitCredentialAction,
+        parseGitCredentialInput,
+        readGitCredentialStdin
+      } = await import("./git-credential-FUE3JE3T.js");
+      const action = parseGitCredentialAction(parsed.positionals);
+      const raw = await readGitCredentialStdin(process.stdin);
+      const output = await handleGitCredential({
+        action,
+        request: parseGitCredentialInput(raw),
+        apiUrl: apiUrlFrom({
+          apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+        }),
+        mcpUrl
+      });
+      if (output) process.stdout.write(output);
+      return 0;
+    }
+    case "whoami": {
+      const { resolveTarget } = await import("./target-3QHY7JT4.js");
+      const target = resolveTarget({
+        command: "whoami",
+        flag: typeof parsed.values.target === "string" ? parsed.values.target : void 0
+      });
+      const tokenValues = tokenFlagValues(parsed.values);
+      let apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      if (target === "mock") {
+        const { ensureMockTarget } = await import("./mock-server-SV2IKC4I.js");
+        const mock = await ensureMockTarget({
+          resetStorage: parsed.values["reset-storage"] === true,
+          ...org ? { orgSlug: org } : {}
+        });
+        try {
+          const me = await fetch(`${mock.apiUrl}/v1/me${org ? `?org=${encodeURIComponent(org)}` : ""}`, {
+            headers: { authorization: `Bearer ${mock.token}` }
+          });
+          const body = await me.json();
+          if (json) {
+            write(`${JSON.stringify({ target: "mock", ...body }, null, 2)}
+`);
+          } else {
+            const userId = typeof body.user_id === "string" ? body.user_id : "user_mock";
+            const username = typeof body.username === "string" ? body.username : "mock-user";
+            const orgBody = body.org && typeof body.org === "object" ? body.org : {};
+            write(
+              [
+                `target: mock`,
+                `api: ${mock.apiUrl}`,
+                `user: ${username} (${userId})`,
+                `org: ${orgBody.slug ?? org ?? "mock-org"}`,
+                ""
+              ].join("\n")
+            );
+          }
+          return me.ok ? 0 : 1;
+        } finally {
+          if (mock.started) await mock.server.close();
+        }
+      }
+      if (shouldUseApiToken({
+        tokenValues,
+        mcpUrl,
+        apiUrl,
+        allowEnvWithoutLogin: true,
+        ...org ? { org } : {}
+      })) {
+        const { whoamiWithApiToken } = await import("./open-api-client-DVVMLY7P.js");
+        const identity = await whoamiWithApiToken({
+          token: requireApiToken(tokenValues, process.env, "whoami", { apiUrl }),
+          apiUrl,
+          ...org ? { org } : {}
+        });
+        if (json) {
+          write(`${JSON.stringify(identity, null, 2)}
+`);
+          return 0;
+        }
+        const scopeLine = identity.token.scopes.join(", ") || "(none)";
+        const userLine = identity.user ? `${identity.user.displayName} <${identity.user.email}>` : "(account:read not on this token)";
+        write(
+          [
+            `api: ${identity.apiUrl}`,
+            `auth: API token (${identity.token.id})`,
+            `user: ${userLine}`,
+            `scopes: ${scopeLine}`,
+            `expires: ${identity.token.expiresAt ?? "unknown"}`,
+            ""
+          ].join("\n")
+        );
+        return 0;
+      }
+      const [{ ensureFreshCredentials }, { listKodyTools }] = await Promise.all([
+        import("./auth-4FW6GCLG.js"),
+        import("./mcp-G2AWTIXR.js")
+      ]);
+      const credentials = await ensureFreshCredentials({ mcpUrl, org });
+      const tools = await listKodyTools({ mcpUrl, org });
+      if (json) {
+        write(
+          `${JSON.stringify(
+            {
+              mcpUrl: credentials.mcpUrl,
+              org: credentials.org ?? null,
+              protocol: modernMcpProtocolVersion,
+              scope: credentials.scope ?? null,
+              tools: tools.map((tool) => tool.name)
+            },
+            null,
+            2
+          )}
+`
+        );
+        return 0;
+      }
+      const orgLine = credentials.org ? `
+org: ${credentials.org}` : "";
+      write(
+        `Connected to ${credentials.mcpUrl} (${modernMcpProtocolVersion})${orgLine}
+Tools: ${tools.map((tool) => tool.name).join(", ") || "(none)"}
+`
+      );
+      return 0;
+    }
+    case "search": {
+      const { resolveTarget } = await import("./target-3QHY7JT4.js");
+      const target = resolveTarget({
+        command: "search",
+        flag: typeof parsed.values.target === "string" ? parsed.values.target : void 0
+      });
+      const query = parsed.positionals.join(" ").trim();
+      const tokenValues = tokenFlagValues(parsed.values);
+      let apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      let closeMock;
+      try {
+        if (target === "mock") {
+          const { ensureMockTarget } = await import("./mock-server-SV2IKC4I.js");
+          const mock = await ensureMockTarget({
+            resetStorage: parsed.values["reset-storage"] === true
+          });
+          apiUrl = mock.apiUrl;
+          closeMock = mock.started ? () => mock.server.close() : void 0;
+          const { searchWithApiToken } = await import("./open-api-client-DVVMLY7P.js");
+          const result2 = await searchWithApiToken({
+            token: mock.token,
+            apiUrl,
+            query: query || void 0,
+            entity: typeof parsed.values.entity === "string" ? parsed.values.entity : void 0,
+            domain: typeof parsed.values.domain === "string" ? parsed.values.domain : void 0,
+            limit: typeof parsed.values.limit === "string" ? Number(parsed.values.limit) : void 0
+          });
+          write(formatToolResult(result2, json));
+          return result2.isError ? 1 : 0;
+        }
+        if (shouldUseApiToken({
+          tokenValues,
+          mcpUrl,
+          apiUrl,
+          allowEnvWithoutLogin: true,
+          ...org ? { org } : {}
+        })) {
+          const { searchWithApiToken } = await import("./open-api-client-DVVMLY7P.js");
+          const result2 = await searchWithApiToken({
+            token: requireApiToken(tokenValues, process.env, "search", { apiUrl }),
+            apiUrl,
+            ...org ? { org } : {},
+            query: query || void 0,
+            entity: typeof parsed.values.entity === "string" ? parsed.values.entity : void 0,
+            domain: typeof parsed.values.domain === "string" ? parsed.values.domain : void 0,
+            limit: typeof parsed.values.limit === "string" ? Number(parsed.values.limit) : void 0
+          });
+          write(formatToolResult(result2, json));
+          return result2.isError ? 1 : 0;
+        }
+        const args = {};
+        if (query) args.query = query;
+        if (typeof parsed.values.entity === "string") args.entity = parsed.values.entity;
+        if (typeof parsed.values.domain === "string") args.domain = parsed.values.domain;
+        if (typeof parsed.values.limit === "string") args.limit = Number(parsed.values.limit);
+        const { callKodyTool } = await import("./mcp-G2AWTIXR.js");
+        const result = await callKodyTool({
+          name: "search",
+          args,
+          mcpUrl,
+          ...org ? { org } : {}
+        });
+        write(formatToolResult(result, json));
+        return result.isError ? 1 : 0;
+      } finally {
+        await closeMock?.();
+      }
+    }
+    case "execute": {
+      const { resolveTarget } = await import("./target-3QHY7JT4.js");
+      const target = resolveTarget({
+        command: "execute",
+        flag: typeof parsed.values.target === "string" ? parsed.values.target : void 0
+      });
+      const invoke = typeof parsed.values.invoke === "string" ? parsed.values.invoke : void 0;
+      const hasCodeFlag = typeof parsed.values.code === "string";
+      const hasFileFlag = typeof parsed.values.file === "string";
+      const positionalModule = parsed.positionals.join("\n").trim();
+      const local = parsed.values.local === true || target === "mock";
+      const tokenValues = tokenFlagValues(parsed.values);
+      const localPackageInvoke = invoke !== void 0 ? await tryResolveLocalPackageInvoke(invoke) : null;
+      let publishedInvokeCode;
+      if (local && invoke !== void 0 && !localPackageInvoke) {
+        try {
+          publishedInvokeCode = resolveExecuteInvokeCode(invoke);
+        } catch {
+          throw new Error(
+            `--invoke ${JSON.stringify(invoke)} is neither a local package export nor a published package specifier. From a package directory, pass an export key from package.json#exports (e.g. \`--invoke ./greet\`). To call a published export locally, use \`--invoke kody:@scope/pkg/export\` (or \`@scope/pkg#export\`) \u2014 no \`--code "import \u2026"\` wrapper needed. Or pass --code / --file / a module string.`
+          );
+        }
+      }
+      if (executeSourcesConflict({ invoke, hasCodeFlag, hasFileFlag, positionalModule })) {
+        throw new Error(
+          "--invoke cannot be combined with --code, --file, or a module string."
+        );
+      }
+      if (local) assertLocalExecuteNodeEngine();
+      const fileArg = hasFileFlag ? parsed.values.file : void 0;
+      const modulePath = localPackageInvoke?.modulePath ?? (!hasCodeFlag && fileArg !== void 0 && fileArg !== "-" ? fileArg : void 0);
+      const code = publishedInvokeCode !== void 0 ? publishedInvokeCode : invoke !== void 0 && !localPackageInvoke ? void 0 : hasCodeFlag ? parsed.values.code : modulePath !== void 0 && !localPackageInvoke ? await readFile(modulePath, "utf8") : localPackageInvoke ? await readFile(localPackageInvoke.modulePath, "utf8") : fileArg === "-" ? await readStdin() : positionalModule || void 0;
+      const credentials = parseCredentialFlags(
+        Array.isArray(parsed.values.credential) ? parsed.values.credential.filter(
+          (value) => typeof value === "string"
+        ) : typeof parsed.values.credential === "string" ? [parsed.values.credential] : void 0
+      );
+      const args = buildExecuteToolArgs({
+        // Local published invoke is already minted into `code`.
+        invoke: localPackageInvoke || publishedInvokeCode !== void 0 ? void 0 : invoke,
+        code: typeof code === "string" ? code : void 0,
+        paramsJson: typeof parsed.values.params === "string" ? parsed.values.params : void 0,
+        conversationId: typeof parsed.values["conversation-id"] === "string" ? parsed.values["conversation-id"] : void 0,
+        credentials
+      });
+      const prodApiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      let apiUrl = prodApiUrl;
+      const { parsePassthroughHosts } = await import("./mock-fetch-gateway-B5TFGGQS.js");
+      const passthroughHosts = parsePassthroughHosts(
+        typeof parsed.values.passthrough === "string" ? parsed.values.passthrough : void 0
+      );
+      if (passthroughHosts.length > 0 && target !== "mock") {
+        writeErr(
+          "note: `--passthrough` is ignored on `--target prod` (outbound fetch mocking is mock-only).\n"
+        );
+      }
+      let closeMock;
+      let mockToken;
+      let mockDepResolve;
+      let localPackageRun = localPackageInvoke;
+      if (!localPackageRun && local && modulePath !== void 0) {
+        try {
+          const { loadPackageManifest } = await import("./package-manifest-QH2RU64C.js");
+          const manifest = await loadPackageManifest(process.cwd());
+          localPackageRun = {
+            modulePath,
+            kodyId: manifest.kodyId,
+            packageRoot: manifest.root
+          };
+        } catch {
+          localPackageRun = null;
+        }
+      }
+      try {
+        if (target === "mock") {
+          const { ensureMockTarget } = await import("./mock-server-SV2IKC4I.js");
+          const mock = await ensureMockTarget({
+            resetStorage: parsed.values["reset-storage"] === true,
+            packageId: localPackageRun ? `local:${localPackageRun.kodyId}` : void 0,
+            ...org ? { orgSlug: org } : {}
+          });
+          apiUrl = mock.apiUrl;
+          mockToken = mock.token;
+          closeMock = mock.started ? () => mock.server.close() : void 0;
+          const { tryResolveMockDepResolve } = await import("./mock-dep-resolve-TVABDNR7.js");
+          mockDepResolve = await tryResolveMockDepResolve({
+            tokenValues,
+            apiUrl: prodApiUrl,
+            mcpUrl,
+            ...org ? { org } : {}
+          });
+        }
+        if (localPackageRun) {
+          const { buildLocalPackageContext, runLocalPackageModule } = await import("./local-package-run-2TMCAZZ2.js");
+          const result2 = await runLocalPackageModule({
+            modulePath: localPackageRun.modulePath,
+            params: args.params,
+            token: mockToken ?? await resolveLocalExecuteBearer({
+              tokenValues,
+              mcpUrl,
+              apiUrl,
+              purpose: "execute local package export",
+              ...org ? { org } : {}
+            }),
+            apiUrl,
+            target,
+            packageContext: buildLocalPackageContext({
+              kodyId: localPackageRun.kodyId,
+              hostedUrl: "http://127.0.0.1:0"
+            }),
+            packageRoot: localPackageRun.packageRoot,
+            ...org ? { org } : {},
+            ...mockDepResolve ? { depResolve: mockDepResolve } : {},
+            ...passthroughHosts.length > 0 && target === "mock" ? { passthroughHosts } : {},
+            allowPrivateNetwork: parsed.values["allow-private-network"] === true,
+            onStatus: (message) => writeErr(`${message}
+`)
+          });
+          write(formatToolResult(result2, json));
+          return result2.isError ? 1 : 0;
+        }
+        const useToken = local || shouldUseApiToken({
+          tokenValues,
+          mcpUrl,
+          apiUrl,
+          allowEnvWithoutLogin: true,
+          ...org ? { org } : {}
+        });
+        let packageRootForMocks;
+        if (target === "mock") {
+          try {
+            const { loadPackageManifest } = await import("./package-manifest-QH2RU64C.js");
+            packageRootForMocks = (await loadPackageManifest(process.cwd())).root;
+          } catch {
+            packageRootForMocks = void 0;
+          }
+        }
+        const result = local ? await (await import("./local-execute-SZV6XN4T.js")).runLocalExecute({
+          code: args.code,
+          ...modulePath !== void 0 ? { modulePath } : {},
+          params: args.params,
+          conversationId: args.conversationId,
+          ...credentials !== void 0 ? { credentials } : {},
+          token: mockToken ?? await resolveLocalExecuteBearer({
+            tokenValues,
+            mcpUrl,
+            apiUrl,
+            purpose: "execute --local",
+            ...org ? { org } : {}
+          }),
+          apiUrl,
+          target,
+          ...org ? { org } : {},
+          ...mockDepResolve ? { depResolve: mockDepResolve } : {},
+          ...packageRootForMocks ? { packageRoot: packageRootForMocks } : {},
+          ...passthroughHosts.length > 0 ? { passthroughHosts } : {},
+          allowPrivateNetwork: parsed.values["allow-private-network"] === true,
+          onStatus: (message) => writeErr(`${message}
+`)
+        }) : useToken ? await (await import("./remote-execute-QMQDVHOY.js")).runRemoteExecuteWithToken({
+          code: typeof args.code === "string" ? args.code : void 0,
+          invoke,
+          params: args.params,
+          conversationId: args.conversationId,
+          ...credentials !== void 0 ? { credentials } : {},
+          token: requireApiToken(
+            tokenValues,
+            process.env,
+            "execute with an API token",
+            { apiUrl }
+          ),
+          apiUrl,
+          ...org ? { org } : {}
+        }) : await (await import("./mcp-G2AWTIXR.js")).callKodyTool({
+          name: "execute",
+          args,
+          mcpUrl,
+          ...org ? { org } : {}
+        });
+        write(formatToolResult(result, json));
+        return result.isError ? 1 : 0;
+      } finally {
+        await closeMock?.();
+      }
+    }
+    case "dev": {
+      const { resolveTarget } = await import("./target-3QHY7JT4.js");
+      const {
+        parseDevPort,
+        parseDevSubcommand,
+        resolveDevAuth,
+        runDevCheck,
+        runDevEmit,
+        runDevFetch,
+        runDevJob,
+        runDevServe,
+        runDevWebhook,
+        tryAttachedDevFetch
+      } = await import("./dev-command-3LX234N6.js");
+      const target = resolveTarget({
+        command: "dev",
+        flag: typeof parsed.values.target === "string" ? parsed.values.target : void 0
+      });
+      const { subcommand, rest } = parseDevSubcommand(parsed.positionals);
+      const tokenValues = tokenFlagValues(parsed.values);
+      const prodApiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      const io = { stdout: write, stderr: writeErr };
+      const bodyPath = typeof parsed.values.body === "string" ? parsed.values.body : void 0;
+      if (subcommand === "check") {
+        return await runDevCheck({ target, json, io });
+      }
+      const dryRun = parsed.values["dry-run"] === true;
+      if (dryRun && subcommand !== "job" && subcommand !== "webhook" && subcommand !== "emit") {
+        throw new Error(
+          "`--dry-run` applies to `kody dev job|webhook|emit` only (shows the plan without invoking)."
+        );
+      }
+      if (dryRun) {
+        const dryAuth = { token: "dry-run", apiUrl: prodApiUrl };
+        switch (subcommand) {
+          case "job": {
+            const jobName = rest[0];
+            if (!jobName) throw new Error("Usage: kody dev job <name>");
+            return await runDevJob({
+              target,
+              auth: dryAuth,
+              jobName,
+              json,
+              dryRun: true,
+              io
+            });
+          }
+          case "webhook": {
+            const webhookName = rest[0];
+            if (!webhookName || !bodyPath) {
+              throw new Error(
+                "Usage: kody dev webhook <name> --body file.json"
+              );
+            }
+            return await runDevWebhook({
+              target,
+              auth: dryAuth,
+              webhookName,
+              bodyPath,
+              json,
+              dryRun: true,
+              io
+            });
+          }
+          case "emit": {
+            const event = rest[0];
+            if (!event || !bodyPath) {
+              throw new Error(
+                "Usage: kody dev emit <event> --body event.json"
+              );
+            }
+            return await runDevEmit({
+              target,
+              auth: dryAuth,
+              event,
+              bodyPath,
+              json,
+              dryRun: true,
+              io
+            });
+          }
+          default: {
+            throw new Error(
+              "`--dry-run` applies to `kody dev job|webhook|emit` only (shows the plan without invoking)."
+            );
+          }
+        }
+      }
+      if (subcommand === "fetch" && parsed.values["no-attach"] !== true && rest[0]) {
+        const attached = await tryAttachedDevFetch({
+          target,
+          path: rest[0],
+          method: typeof parsed.values.method === "string" ? parsed.values.method : void 0,
+          body: bodyPath ? await readFile(bodyPath, "utf8") : void 0,
+          json,
+          io
+        });
+        if (attached !== null) return attached;
+      }
+      const token = target === "prod" ? await resolveLocalExecuteBearer({
+        tokenValues,
+        mcpUrl,
+        apiUrl: prodApiUrl,
+        purpose: "kody dev",
+        ...org ? { org } : {}
+      }) : "mock";
+      const mockDepResolve = target === "mock" ? await (await import("./mock-dep-resolve-TVABDNR7.js")).tryResolveMockDepResolve({
+        tokenValues,
+        apiUrl: prodApiUrl,
+        mcpUrl,
+        ...org ? { org } : {}
+      }) : void 0;
+      const { parsePassthroughHosts } = await import("./mock-fetch-gateway-B5TFGGQS.js");
+      const passthroughHosts = parsePassthroughHosts(
+        typeof parsed.values.passthrough === "string" ? parsed.values.passthrough : void 0
+      );
+      if (passthroughHosts.length > 0 && target !== "mock") {
+        writeErr(
+          "note: `--passthrough` is ignored on `--target prod` (outbound fetch mocking is mock-only).\n"
+        );
+      }
+      const allowPrivateNetwork = parsed.values["allow-private-network"] === true;
+      let packageId;
+      try {
+        const { loadPackageManifest } = await import("./package-manifest-QH2RU64C.js");
+        const manifest = await loadPackageManifest(process.cwd());
+        packageId = `local:${manifest.kodyId}`;
+      } catch {
+        packageId = void 0;
+      }
+      const auth = await resolveDevAuth({
+        target,
+        token,
+        apiUrl: prodApiUrl,
+        ...org ? { org } : {},
+        ...mockDepResolve ? { depResolve: mockDepResolve } : {},
+        ...passthroughHosts.length > 0 && target === "mock" ? { passthroughHosts } : {},
+        resetStorage: parsed.values["reset-storage"] === true,
+        ...packageId ? { packageId } : {},
+        ...org && target === "mock" ? { orgSlug: org } : {}
+      });
+      const port = typeof parsed.values.port === "string" ? parseDevPort(parsed.values.port) : void 0;
+      const appBasePath = typeof parsed.values["app-base-path"] === "string" ? parsed.values["app-base-path"] : void 0;
+      try {
+        switch (subcommand) {
+          case "serve":
+            return await runDevServe({
+              target,
+              auth,
+              port,
+              appBasePath,
+              allowPrivateNetwork,
+              liveReload: parsed.values["no-live-reload"] !== true,
+              json,
+              ...typeof parsed.values["ready-file"] === "string" ? { readyFile: parsed.values["ready-file"] } : {},
+              io
+            });
+          case "fetch": {
+            const path = rest[0];
+            if (!path) {
+              throw new Error(
+                "Usage: kody dev fetch <path> [--method GET] [--body file.json]"
+              );
+            }
+            let body;
+            if (bodyPath) body = await readFile(bodyPath, "utf8");
+            return await runDevFetch({
+              target,
+              auth,
+              path,
+              method: typeof parsed.values.method === "string" ? parsed.values.method : void 0,
+              body,
+              port,
+              appBasePath,
+              allowPrivateNetwork,
+              json,
+              io
+            });
+          }
+          case "job": {
+            const jobName = rest[0];
+            if (!jobName) throw new Error("Usage: kody dev job <name>");
+            return await runDevJob({
+              target,
+              auth,
+              jobName,
+              json,
+              allowPrivateNetwork,
+              io
+            });
+          }
+          case "webhook": {
+            const webhookName = rest[0];
+            if (!webhookName || !bodyPath) {
+              throw new Error(
+                "Usage: kody dev webhook <name> --body file.json"
+              );
+            }
+            return await runDevWebhook({
+              target,
+              auth,
+              webhookName,
+              bodyPath,
+              json,
+              allowPrivateNetwork,
+              io
+            });
+          }
+          case "emit": {
+            const event = rest[0];
+            if (!event || !bodyPath) {
+              throw new Error(
+                "Usage: kody dev emit <event> --body event.json"
+              );
+            }
+            return await runDevEmit({
+              target,
+              auth,
+              event,
+              bodyPath,
+              json,
+              allowPrivateNetwork,
+              io
+            });
+          }
+          default: {
+            const exhaustive = subcommand;
+            throw new Error(
+              `Unhandled kody dev subcommand: ${String(exhaustive)}`
+            );
+          }
+        }
+      } catch (error) {
+        await auth.closeMock?.();
+        throw error;
+      }
+    }
+    case "api": {
+      const operationId = parsed.positionals[0]?.trim() ?? "";
+      if (!operationId || parsed.positionals.length > 1) {
+        throw new Error(
+          "Usage: kody api <operationId> [--params <json>] [--token <token>] [--api-url <url>] [--json]"
+        );
+      }
+      const apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      const tokenValues = tokenFlagValues(parsed.values);
+      const params = parseApiParamsJson(
+        typeof parsed.values.params === "string" ? parsed.values.params : void 0
+      );
+      const { callOpenApiOperation } = await import("./open-api-client-DVVMLY7P.js");
+      const result = await callOpenApiOperation({
+        operationId,
+        params,
+        token: requireApiToken(tokenValues, process.env, "api", { apiUrl }),
+        apiUrl,
+        ...org ? { org } : {}
+      });
+      write(`${JSON.stringify(result, null, 2)}
+`);
+      return 0;
+    }
+    case "package": {
+      const action = parsed.positionals[0];
+      const apiUrl = apiUrlFrom({
+        apiUrl: typeof parsed.values["api-url"] === "string" ? parsed.values["api-url"] : void 0
+      });
+      const tokenValues = tokenFlagValues(parsed.values);
+      if (isPackageCollaboratorAction(action)) {
+        const plan = parsePackageCollaboratorCommand({
+          action,
+          positionals: parsed.positionals.slice(1),
+          values: parsed.values
+        });
+        const token = requireApiToken(tokenValues, process.env, `package ${action}`, {
+          apiUrl
+        });
+        const { callOpenApiOperation: callOpenApiOperation2 } = await import("./open-api-client-DVVMLY7P.js");
+        write(
+          await runPackageCollaboratorPlan({
+            plan,
+            json,
+            call: (operationId, params2) => callOpenApiOperation2({
+              operationId,
+              params: params2,
+              token,
+              apiUrl,
+              ...org ? { org } : {}
+            })
+          })
+        );
+        return 0;
+      }
+      if (action !== "publish") {
+        throw new Error(
+          `Usage: kody package publish [<@owner/leaf|package_id>] [--params <json>] [--token <token>] [--api-url <url>] [--org <slug>]
+${packageCollaboratorUsage}`
+        );
+      }
+      const params = packagePublishParams({
+        positional: parsed.positionals[1],
+        paramsJson: typeof parsed.values.params === "string" ? parsed.values.params : void 0
+      });
+      const { callOpenApiOperation } = await import("./open-api-client-DVVMLY7P.js");
+      const publishToken = requireApiToken(tokenValues, process.env, "package publish", {
+        apiUrl
+      });
+      const call = (operationId, operationParams) => callOpenApiOperation({
+        operationId,
+        params: operationParams,
+        token: publishToken,
+        apiUrl,
+        ...org ? { org } : {}
+      });
+      const result = await call(
+        "packagePublishExternalPush",
+        await resolvePackagePublishTarget(params, call)
+      );
+      write(`${JSON.stringify(result, null, 2)}
+`);
+      return 0;
+    }
+    case "install": {
+      const { runInstall } = await import("./install-ZML2TCDG.js");
+      const result = await runInstall(
+        {
+          mcpUrl,
+          clients: typeof parsed.values.clients === "string" ? parsed.values.clients : void 0,
+          yes: parsed.values.yes === true,
+          project: parsed.values.project === true,
+          json
+        },
+        { stdout: write }
+      );
+      return result.code;
+    }
+    case "skill": {
+      const action = parsed.positionals[0] ?? "install";
+      if (action !== "install") {
+        throw new Error("Usage: kody skill install [--project]");
+      }
+      const { installSkill } = await import("./skill-ENPATRIW.js");
+      const targets = await installSkill({ project: parsed.values.project === true });
+      write(
+        `Installed the Kody skill to:
+${targets.map((target) => `- ${target.host}: ${target.path}`).join("\n")}
+`
+      );
+      return 0;
+    }
+    default: {
+      const exhaustive = parsed.command;
+      throw new Error(`Unhandled command: ${String(exhaustive)}`);
+    }
+  }
+}
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function tryResolveLocalPackageInvoke(invoke) {
+  const trimmed = invoke.trim();
+  if (!trimmed) return null;
+  if (isPublishedPackageInvokeSpecifier(trimmed)) return null;
+  const { loadPackageManifest, resolveExportModulePath } = await import("./package-manifest-QH2RU64C.js");
+  const { StructuredCliError } = await import("./structured-error-C65GQ53Z.js");
+  let manifest;
+  try {
+    manifest = await loadPackageManifest(process.cwd());
+  } catch {
+    return null;
+  }
+  try {
+    const modulePath = resolveExportModulePath(manifest, trimmed, {
+      exportsOnly: true
+    });
+    const { access } = await import("node:fs/promises");
+    try {
+      await access(modulePath);
+    } catch {
+      throw new StructuredCliError({
+        code: "dev_surface_missing",
+        message: `No package export ${JSON.stringify(trimmed)} (path missing: ${modulePath}).`,
+        where: manifest.packageJsonPath,
+        fix: `Known exports: ${Object.keys(manifest.exports).join(", ") || "(none)"}.`
+      });
+    }
+    return { modulePath, kodyId: manifest.kodyId, packageRoot: manifest.root };
+  } catch (error) {
+    if (error instanceof StructuredCliError) throw error;
+    return null;
+  }
+}
+function executeSourcesConflict(input) {
+  return input.invoke !== void 0 && (input.hasCodeFlag || input.hasFileFlag || input.positionalModule.length > 0);
+}
+function buildExecuteToolArgs(input) {
+  const invoke = input.invoke;
+  const code = input.code;
+  if (invoke !== void 0 && code !== void 0 && code.length > 0) {
+    throw new Error("--invoke cannot be combined with --code, --file, or a module string.");
+  }
+  if (invoke !== void 0) {
+    if (!invoke) {
+      throw new Error("Provide a non-empty --invoke value.");
+    }
+    return attachExecuteCommonArgs({ invoke }, input);
+  }
+  if (code) {
+    return attachExecuteCommonArgs({ code }, input);
+  }
+  throw new Error("Provide --invoke, --code, --file, or a module string.");
+}
+function attachExecuteCommonArgs(args, input) {
+  if (input.paramsJson !== void 0) {
+    args.params = JSON.parse(input.paramsJson);
+  }
+  if (input.conversationId !== void 0) {
+    args.conversationId = input.conversationId;
+  }
+  if (input.credentials !== void 0) {
+    args.credentials = input.credentials;
+  }
+  return args;
+}
+async function runAuthSetupGit(input) {
+  const { authSetupGit, setupGitDefaultScopes } = await import("./setup-git-5KCUBYPB.js");
+  const apiUrl = apiUrlFrom({
+    apiUrl: typeof input.values["api-url"] === "string" ? input.values["api-url"] : void 0
+  });
+  const scopes = parseCliScopesFlag(
+    typeof input.values.scopes === "string" ? input.values.scopes : void 0
+  );
+  const lifetime = resolveCliTokenLifetime({
+    lifetime: typeof input.values.lifetime === "string" ? input.values.lifetime : "long",
+    idleTtlSeconds: parseCliLifetimeSecondsFlag(
+      typeof input.values["idle-ttl-seconds"] === "string" ? input.values["idle-ttl-seconds"] : void 0,
+      "--idle-ttl-seconds"
+    ),
+    maxLifetimeSeconds: parseCliLifetimeSecondsFlag(
+      typeof input.values["max-lifetime-seconds"] === "string" ? input.values["max-lifetime-seconds"] : void 0,
+      "--max-lifetime-seconds"
+    )
+  });
+  const tokenValues = tokenFlagValues(input.values);
+  const mintScopes = scopes ?? setupGitDefaultScopes;
+  const hasLoginSession = loadCredentials(input.mcpUrl, void 0, void 0, {
+    org: input.org
+  }) != null;
+  const result = await authSetupGit({
+    apiUrl,
+    mcpUrl: input.mcpUrl,
+    token: tokenValues.token,
+    hasLoginSession,
+    ...scopes ? { scopesOverride: scopes } : {},
+    lifetime,
+    mint: bootstrapMinter({
+      scopes: mintScopes,
+      lifetime,
+      mcpUrl: input.mcpUrl,
+      apiUrl,
+      tokenValues,
+      ...input.org ? { org: input.org } : {}
+    })
+  });
+  input.write(
+    [
+      `Git HTTPS credential helper installed for https://${result.host}/`,
+      `helper: ${result.helperCommand}`,
+      `token: ${result.minted ? "minted" : "reused"} ${result.tokenId} (org_binding=user)`,
+      `scopes: ${result.scopes.join(", ") || "(none)"}`,
+      `expires: ${result.expiresAt ?? "unknown"}`,
+      result.backendKind === "file" && result.backendPath ? `OS keychain was unavailable; token saved at ${result.backendPath} (mode 0600).` : result.minted ? "Token stored in the OS keychain (or existing store)." : "Using the existing stored API token.",
+      "",
+      "This user-owned token authorizes every @owner/name.git you can access (all orgs).",
+      "Try: git clone https://kody.codes/@owner/name.git",
+      "Undo later: kody auth remove-git",
+      ""
+    ].join("\n")
+  );
+  return 0;
+}
+async function runAuthRemoveGit(input) {
+  const { authRemoveGit, formatAuthRemoveGitReport } = await import("./setup-git-5KCUBYPB.js");
+  const apiUrl = apiUrlFrom({
+    apiUrl: typeof input.values["api-url"] === "string" ? input.values["api-url"] : void 0
+  });
+  const result = await authRemoveGit({
+    apiUrl,
+    mcpUrl: input.mcpUrl
+  });
+  input.write(formatAuthRemoveGitReport(result));
+  return 0;
+}
+function bootstrapMinter(input) {
+  return async (params) => {
+    if (shouldUseApiToken({
+      tokenValues: input.tokenValues,
+      mcpUrl: input.mcpUrl,
+      apiUrl: input.apiUrl,
+      allowEnvWithoutLogin: true,
+      ...input.org ? { org: input.org } : {}
+    })) {
+      const token = requireApiToken(input.tokenValues, process.env, "auth bootstrap --scopes", {
+        apiUrl: input.apiUrl
+      });
+      const { callOpenApiOperation } = await import("./open-api-client-DVVMLY7P.js");
+      try {
+        return await callOpenApiOperation({
+          token,
+          apiUrl: input.apiUrl,
+          operationId: cliCredentialBootstrapOperationId,
+          params,
+          ...input.org ? { org: input.org } : {}
+        });
+      } catch (error) {
+        if (error instanceof Error && /cannot grant scopes it does not hold/i.test(error.message)) {
+          throw new Error(
+            `${error.message} A token can only mint scopes it already holds. Run \`kody login\` and retry without --token (a login session can mint any scope your org role grants), or from Kody MCP call \`${cliBootstrapMintCall(input.scopes, bootstrapMintLifetimeFields(input.lifetime))}\` and run the returned cli_command.`
+          );
+        }
+        throw error;
+      }
+    }
+    if (loadCredentials(input.mcpUrl, void 0, void 0, {
+      org: input.org
+    })) {
+      return (await import("./mcp-G2AWTIXR.js")).callKodyApiOperation({
+        operationId: cliCredentialBootstrapOperationId,
+        params,
+        mcpUrl: input.mcpUrl,
+        ...input.org ? { org: input.org } : {}
+      });
+    }
+    throw new Error(
+      `auth bootstrap --scopes mints with your current Kody credential, and none was found. Run \`kody login\` and retry, or from Kody MCP call \`${cliBootstrapMintCall(input.scopes, bootstrapMintLifetimeFields(input.lifetime))}\` and run the returned cli_command.`
+    );
+  };
+}
+function tokenFlagValues(values) {
+  return {
+    token: typeof values.token === "string" ? values.token : void 0
+  };
+}
+function parseApiParamsJson(paramsJson) {
+  if (paramsJson === void 0) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(paramsJson);
+  } catch {
+    throw new Error("--params must be valid JSON (a flat object).");
+  }
+  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`--params must be a JSON object (e.g. '{"query":"email"}').`);
+  }
+  return parsed;
+}
+var packageIdUuidPattern = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function packagePublishParams(input) {
+  const params = parseApiParamsJson(input.paramsJson);
+  const ref = input.positional?.trim();
+  if (!ref) return params;
+  if (packageIdUuidPattern.test(ref)) {
+    if (params.package_id === void 0) params.package_id = ref;
+  } else if (params.kody_id === void 0) {
+    params.kody_id = ref;
+  }
+  return params;
+}
+async function resolvePackagePublishTarget(params, call) {
+  if (params.package_id !== void 0 || typeof params.kody_id !== "string") return params;
+  const ref = params.kody_id.trim();
+  const listed = await call("packageList", {});
+  const packages = listed.packages ?? [];
+  const leaf = ref.includes("/") ? ref.slice(ref.lastIndexOf("/") + 1) : ref;
+  const byName = packages.filter((pkg) => pkg.name === ref);
+  const matches = byName.length > 0 ? byName : ref.startsWith("@") ? [] : packages.filter((pkg) => pkg.kody_id === leaf);
+  if (matches.length !== 1) {
+    const known = packages.map((pkg) => pkg.name).slice(0, 20).join(", ");
+    throw new Error(
+      matches.length === 0 ? `No saved package named "${ref}" in this org.${known ? ` Saved packages: ${known}.` : ""} Pass the scoped name (@owner/leaf), the package_id, or --org <slug> for another org.` : `"${ref}" matches several saved packages (${matches.map((pkg) => `${pkg.name} = ${pkg.package_id}`).join(", ")}). Pass the scoped name or the package_id.`
+    );
+  }
+  const { kody_id: _name, ...rest } = params;
+  return { ...rest, package_id: matches[0].package_id };
+}
+function shouldUseApiToken(input) {
+  if (hasExplicitTokenFlag(input.tokenValues)) return true;
+  if (!input.allowEnvWithoutLogin) return false;
+  if (!resolveScopedApiToken({
+    tokenValues: input.tokenValues,
+    env: input.env,
+    apiUrl: input.apiUrl,
+    loadApiToken: input.loadApiToken
+  })) {
+    return false;
+  }
+  const loggedIn = input.hasSession ?? loadCredentials(input.mcpUrl, void 0, void 0, {
+    org: input.org
+  }) != null;
+  return !loggedIn;
+}
+
+export {
+  apiUrlFrom,
+  resolveCommand,
+  runCli,
+  executeSourcesConflict,
+  buildExecuteToolArgs,
+  parseApiParamsJson,
+  packagePublishParams,
+  resolvePackagePublishTarget,
+  shouldUseApiToken
+};
+//# sourceMappingURL=chunk-TIL35OWA.js.map