@labelbox/horizon-cli 0.0.0-stage → 0.0.1

package/dist/program.js

@@ -0,0 +1,985 @@
+import { readFileSync } from 'node:fs';
+import { Readable } from 'node:stream';
+import { pipeline } from 'node:stream/promises';
+import { Command } from 'commander';
+import { addComputeSessionCommands } from './compute-session.js';
+import { dispatchOperation } from './dispatch.js';
+import { addGitHostCommands } from './git-host.js';
+import { hasJsonRequestRepresentation, isJsonOperationCallable, isMultipartRequestOperation, shapeMetaEntries, } from './manifest.js';
+import { gatedSummary, missingPermission, permissionDeniedMessage, permissionHelpNote, UNAVAILABLE_HELP_GROUP, } from './permissions.js';
+import { commandScope } from './resolve.js';
+import { addSkillsCommands } from './skills.js';
+// The CLI is a thin, generic driver. It builds its whole command tree + docs at
+// runtime from a manifest **fetched live** from the target server (see
+// `manifest.ts`), keyed by each operation's `callPath` — the exact path used as
+// `horizon.<noun>.<verb>(...)` in the TS SDK. Adding/changing a backend endpoint → the
+// command appears (or changes) after the backend deploys, with NO CLI release.
+// Dispatch is generic (`dispatch.ts`): there is no per-operation code and no baked
+// client.
+/** camelCase → kebab-case for command + flag names (shared with `@labelbox/horizon-sdk`). */
+export function kebab(value) {
+    return value.replace(/([a-z0-9])([A-Z])/gu, '$1-$2').toLowerCase();
+}
+/**
+ * The key commander stores a parsed flag under. Commander camelCases the long
+ * flag name, so `--if-match` lands on `opts.ifMatch` — a wire header name like
+ * `If-Match` never round-trips through `kebab()` back to itself the way a
+ * camelCase path or query param name does, and reading `opts[param.name]`
+ * silently dropped the header.
+ */
+export function optionAttributeName(value) {
+    return kebab(value).replace(/-([a-z0-9])/gu, (_match, char) => char.toUpperCase());
+}
+const SCALAR_TYPES = new Set(['string', 'number', 'integer', 'boolean']);
+// Flag names the CLI reserves for its own meta-options. If a generated operation
+// ever declares a param whose kebab name collides with one of these, commander
+// would silently register the flag twice (last-registration-wins), so we fail
+// fast at build time instead. `from-json`/`data` are body meta-flags; the rest
+// are program-level globals.
+const RESERVED_FLAGS = new Set([
+    'from-json',
+    'data',
+    'api-key',
+    'base-url',
+    'scope-organization-external-id',
+    'scope-environment-external-id',
+    'quiet',
+    'help',
+    'version',
+]);
+// Top-level command names the CLI registers itself (the docs browse groups + the
+// bespoke `skills` action group, added after the operation loop). An operation
+// whose top-level `callPath` segment kebabs onto one of these would be silently
+// shadowed — commander resolves duplicates to the first registration — so we
+// reserve them and fail fast, mirroring RESERVED_FLAGS for flags.
+const RESERVED_COMMANDS = new Set([
+    'resources',
+    'recipes',
+    'explain',
+    'tutorials',
+    'skills',
+    'scaffold',
+    'submit',
+]);
+const TRUE_VALUES = new Set(['true', '1', 'yes']);
+const FALSE_VALUES = new Set(['false', '0', 'no']);
+function isCliOperationCallable(entry, allowFileInputs) {
+    if (!allowFileInputs)
+        return isJsonOperationCallable(entry);
+    return hasJsonRequestRepresentation(entry) || isMultipartRequestOperation(entry);
+}
+/** Coerce a string flag value to its declared scalar type. */
+export function coerce(value, type) {
+    if (typeof value !== 'string')
+        return value;
+    if (type === 'number' || type === 'integer') {
+        const n = Number(value);
+        // Reject NaN and non-finite values (e.g. Infinity, 1e999): the latter
+        // JSON-serialize to null, which the API would silently misinterpret.
+        if (!Number.isFinite(n)) {
+            throw new Error(`invalid ${type} value ${JSON.stringify(value)} (expected a number)`);
+        }
+        if (type === 'integer' && !Number.isInteger(n)) {
+            throw new Error(`invalid integer value ${JSON.stringify(value)} (expected a whole number)`);
+        }
+        return n;
+    }
+    if (type === 'boolean') {
+        const lower = value.toLowerCase();
+        if (TRUE_VALUES.has(lower))
+            return true;
+        if (FALSE_VALUES.has(lower))
+            return false;
+        throw new Error(`invalid boolean value ${JSON.stringify(value)} (expected true or false)`);
+    }
+    return value;
+}
+/**
+ * Build the flat options object from parsed CLI flags + a pre-parsed body base
+ * (from `--from-json` / `--data`). Path and query params and scalar body fields
+ * come from individual flags; scalar flags override the JSON base. Required scalar
+ * body fields are enforced here — after the available sources are merged — so a
+ * missing JSON field or multipart form field fails locally rather than becoming a
+ * server-side 4xx.
+ */
+export function assembleParams(entry, opts, bodyBase) {
+    const params = {};
+    for (const param of entry.params) {
+        if (param.in === 'path' || param.in === 'query' || param.in === 'header') {
+            // Commander's attribute first, then the wire name, so a caller that built
+            // the options bag itself (tests, embedders) still works.
+            const value = opts[optionAttributeName(param.name)] ?? opts[param.name];
+            if (value === undefined)
+                continue;
+            // A non-scalar query param (array/object) must reach dispatch as a real
+            // array/object — the query serializer dispatches on JS type, so a raw string
+            // would be mis-serialized. Parse those flag values as JSON; scalars use
+            // `coerce`. (Path params are always plain string segments.)
+            params[param.name] =
+                (param.in === 'query' || param.in === 'header') && !SCALAR_TYPES.has(param.type)
+                    ? parseJson(typeof value === 'string' ? value : '', `--${kebab(param.name)}`)
+                    : coerce(value, param.type);
+        }
+    }
+    if (isMultipartRequestOperation(entry)) {
+        const missing = [];
+        for (const param of entry.params) {
+            if (param.in !== 'body')
+                continue;
+            if (!SCALAR_TYPES.has(param.type)) {
+                throw new Error(`multipart body field ${JSON.stringify(param.name)} has unsupported type ${JSON.stringify(param.type)}`);
+            }
+            const value = opts[optionAttributeName(param.name)] ?? opts[param.name];
+            if (value !== undefined) {
+                params[param.name] = param.format === 'binary' ? value : coerce(value, param.type);
+            }
+            else if (param.required) {
+                missing.push(kebab(param.name));
+            }
+        }
+        if (missing.length > 0) {
+            throw new Error(`missing required field(s): ${missing.map((name) => `--${name}`).join(', ')}`);
+        }
+    }
+    else if (entry.bodyKey) {
+        const body = { ...bodyBase };
+        const missing = [];
+        for (const param of entry.params) {
+            if (param.in === 'body' && SCALAR_TYPES.has(param.type)) {
+                const value = opts[param.name];
+                if (value !== undefined)
+                    body[param.name] = coerce(value, param.type);
+                if (param.required && body[param.name] === undefined)
+                    missing.push(kebab(param.name));
+            }
+        }
+        if (missing.length > 0) {
+            throw new Error(`missing required field(s): ${missing.map((m) => `--${m}`).join(', ')} ` +
+                // Names only --data: it is the one body source present in every
+                // program, whereas --from-json is absent from the embedded one, and a
+                // message naming a flag that does not exist sends the reader hunting.
+                '(pass the flag or include it in the --data JSON body)');
+        }
+        params[entry.bodyKey] = body;
+    }
+    return params;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/** Parse JSON, surfacing a clean `error:`-friendly message tagged by source. */
+function parseJson(text, source) {
+    try {
+        return JSON.parse(text);
+    }
+    catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        throw new Error(`invalid JSON in ${source}: ${detail}`);
+    }
+}
+export function parseBodyBase(opts) {
+    const { fromJson, data } = opts;
+    if (typeof fromJson === 'string' && typeof data === 'string') {
+        throw new Error('--from-json and --data are mutually exclusive; pass only one');
+    }
+    let parsed;
+    // Tracked so the failure below can name the flag the caller actually passed.
+    // Naming both would send a reader of the embedded program — where `--from-json`
+    // is not registered — hunting for a flag that does not exist there.
+    let source;
+    if (typeof fromJson === 'string') {
+        let contents;
+        try {
+            contents = readFileSync(fromJson, 'utf8');
+        }
+        catch {
+            throw new Error(`could not read --from-json file ${JSON.stringify(fromJson)}`);
+        }
+        source = '--from-json';
+        parsed = parseJson(contents, source);
+    }
+    else if (typeof data === 'string') {
+        source = '--data';
+        parsed = parseJson(data, source);
+    }
+    else {
+        return {};
+    }
+    if (!isRecord(parsed)) {
+        throw new Error(`${source} must contain a JSON object`);
+    }
+    return parsed;
+}
+/**
+ * Render a response for stdout. Normal mode preserves the HTTP result as a JSON
+ * envelope; JSON encodes a bodyless response's `undefined` data as `null` so the
+ * field remains explicit. `--quiet` is the deliberate lossy projection: it prints
+ * a manifest-declared scalar output field, or otherwise the response data's `id`
+ * (an empty line for data without one). Binary data is always written byte-for-byte.
+ * Text output includes a trailing newline.
+ */
+export function formatOutput(response, quiet, outputField) {
+    const result = response.data;
+    if (result instanceof ReadableStream)
+        return result;
+    if (quiet) {
+        if (outputField !== undefined) {
+            if (!isRecord(result) || !Object.hasOwn(result, outputField)) {
+                throw new Error(`response omitted CLI output field ${JSON.stringify(outputField)}`);
+            }
+            const value = result[outputField];
+            if (!['string', 'number', 'boolean'].includes(typeof value)) {
+                throw new Error(`CLI output field ${JSON.stringify(outputField)} was not a scalar`);
+            }
+            return `${String(value)}\n`;
+        }
+        const id = typeof result === 'object' && result !== null && 'id' in result ? result.id : undefined;
+        return `${id === undefined ? '' : String(id)}\n`;
+    }
+    return `${JSON.stringify({
+        data: result === undefined ? null : result,
+        status: response.status,
+        headers: response.headers,
+    }, null, 2)}\n`;
+}
+/**
+ * Render a caught error for stderr. Generic dispatch throws the server's JSON error
+ * body (printed as-is) or an `Error` (its message). A raw, detail-less object (or a
+ * thrown empty value) maps to a message that points at the likely cause.
+ */
+export function formatError(err) {
+    if (err instanceof Error)
+        return err.message;
+    const json = JSON.stringify(err, null, 2);
+    if (json === undefined || json === '{}') {
+        return 'request failed — the server could not be reached (check --base-url and your network)';
+    }
+    return json;
+}
+// Per-key CLI tag labels. Driven by `shapeMetaEntries` (the shared spine in
+// `manifest.ts`); `satisfies Record<ShapeMetaKey, string>` makes a new `ShapeNode`
+// constraint a compile error here until it gets a label.
+const CLI_META_LABELS = {
+    enum: 'enum',
+    itemEnum: 'values',
+    default: 'default',
+    format: 'format',
+    example: 'example',
+    minimum: 'min',
+    exclusiveMinimum: 'min',
+    maximum: 'max',
+    exclusiveMaximum: 'max',
+    minLength: 'minLength',
+    maxLength: 'maxLength',
+    minItems: 'minItems',
+    maxItems: 'maxItems',
+    maxProperties: 'maxProperties',
+    uniqueItems: 'uniqueItems',
+    pattern: 'pattern',
+    nullable: 'nullable',
+};
+/**
+ * Bracketed spec-metadata tags for a node — allowed values, default, format,
+ * example, the numeric/length/size constraints, and nullability. Shared by the
+ * per-flag help and the request-body / returns shape trees so both surface the
+ * same facts. (Required-ness is conveyed separately: commander marks required
+ * path/query flags, and the tree marks optional fields with a `?`.)
+ */
+function metaTags(node) {
+    return shapeMetaEntries(node).map(([key, value]) => {
+        if (key === 'nullable')
+            return `[${CLI_META_LABELS[key]}]`;
+        const rendered = Array.isArray(value) ? value.join('|') : value;
+        return `[${CLI_META_LABELS[key]}: ${rendered}]`;
+    });
+}
+/** Help text for a flag: its description plus any spec metadata, bracketed. */
+function helpText(param) {
+    const parts = [];
+    if (param.description)
+        parts.push(param.description);
+    parts.push(...metaTags(param));
+    // Body scalar fields are non-mandatory at the commander level (so --from-json
+    // can satisfy them) — commander's help won't mark them required, so surface it.
+    if (param.in === 'body' && param.required)
+        parts.push('[required]');
+    return parts.join(' ');
+}
+/**
+ * Render a request-body / response shape as an indented tree of lines. Each node
+ * shows `name` (or `name?` when optional), its type label, and its metadata tags,
+ * then recurses into whatever sub-shape it has.
+ */
+export function renderShapeTree(nodes, indent) {
+    return nodes.flatMap((node) => {
+        const label = node.name;
+        if (!label)
+            return [];
+        return renderShapeNode(node, label, indent);
+    });
+}
+/** One node as `<label>: <type> <tags> — <desc>`, followed by its nested sub-shape. */
+function renderShapeNode(node, label, indent) {
+    const optional = node.required === false ? '?' : '';
+    const tags = metaTags(node);
+    const desc = node.description ? ` — ${node.description}` : '';
+    const head = `${indent}${label}${optional}: ${node.type}${tags.length ? ` ${tags.join(' ')}` : ''}${desc}`;
+    return [head, ...renderShapeChildren(node, `${indent}  `)];
+}
+/**
+ * A node's nested sub-shape, recursed generically: a union lists each variant under
+ * `one of:`; an object renders its `fields`; an array descends into its `items`;
+ * and a map states whether additional properties are closed, open, or typed.
+ */
+function renderShapeChildren(node, indent) {
+    let structuralChildren = [];
+    if (node.variants?.length) {
+        structuralChildren = [
+            `${indent}one of:`,
+            ...node.variants.flatMap((variant, index) => renderShapeNode(variant, variant.name ?? `variant ${index + 1}`, `${indent}  `)),
+        ];
+    }
+    else if (node.fields?.length) {
+        structuralChildren = renderShapeTree(node.fields, indent);
+    }
+    else if (node.items) {
+        structuralChildren = renderShapeNode(node.items, 'items', indent);
+    }
+    const additionalProperties = node.additionalProperties;
+    if (additionalProperties === undefined)
+        return structuralChildren;
+    if (typeof additionalProperties === 'boolean') {
+        return [
+            ...structuralChildren,
+            `${indent}additional properties: ${additionalProperties ? 'open (any value)' : 'closed (not allowed)'}`,
+        ];
+    }
+    return [
+        ...structuralChildren,
+        ...renderShapeNode(additionalProperties, 'additional properties', indent),
+    ];
+}
+/**
+ * The "Request body" + "Returns" help sections appended after a leaf command's
+ * built-in help. The body section renders the body params' full nested shape; the
+ * returns section renders the success response's full shape — an object's fields,
+ * an `array of <element>` with the element's shape, or a scalar's type — or a note
+ * when the op returns no body.
+ */
+export function leafShapeHelp(entry) {
+    const sections = [];
+    const bodyParams = entry.params.filter((p) => p.in === 'body');
+    if (entry.requestBody) {
+        const bodyShape = entry.requestBodyRequired === undefined
+            ? entry.requestBody.shape
+            : { ...entry.requestBody.shape, required: entry.requestBodyRequired };
+        sections.push('Request body:', ...renderShapeNode(bodyShape, 'body', '  '), '');
+    }
+    else if (entry.bodyKey && bodyParams.length > 0) {
+        sections.push('Request body:', ...renderShapeTree(bodyParams, '  '), '');
+    }
+    const response = entry.response;
+    if (!response) {
+        sections.push('Returns: (no documented response body)');
+    }
+    else if (response.fields && response.fields.length > 0) {
+        const tags = metaTags(response);
+        const desc = response.description ? ` — ${response.description}` : '';
+        sections.push(`Returns: ${response.type}${tags.length ? ` ${tags.join(' ')}` : ''}${desc}`, ...renderShapeChildren(response, '  '));
+    }
+    else if (response.items) {
+        const item = response.items;
+        const tags = metaTags(response);
+        const desc = response.description ? ` — ${response.description}` : '';
+        sections.push(`Returns: array of ${item.type}${tags.length ? ` ${tags.join(' ')}` : ''}${desc}`, ...renderShapeChildren(response, '  '));
+    }
+    else if (response.variants?.length) {
+        const tags = metaTags(response);
+        const desc = response.description ? ` — ${response.description}` : '';
+        sections.push(`Returns: ${response.type}${tags.length ? ` ${tags.join(' ')}` : ''}${desc}`, ...renderShapeChildren(response, '  '));
+    }
+    else {
+        const tags = metaTags(response);
+        const desc = response.description ? ` — ${response.description}` : '';
+        sections.push(`Returns: ${response.type}${tags.length ? ` ${tags.join(' ')}` : ''}${desc}`, ...renderShapeChildren(response, '  '));
+    }
+    return `\n${sections.join('\n')}`;
+}
+/**
+ * Register an operation's flags.
+ *
+ * `fileFlags` is false when the program has no developer checkout. In that mode,
+ * `--from-json` would read from the host process rather than the user's machine,
+ * so it is not registered and `--data` remains the inline alternative.
+ */
+export function addOptions(command, entry, fileFlags = true) {
+    const multipart = isMultipartRequestOperation(entry);
+    for (const param of entry.params) {
+        if (multipart && param.in === 'body' && !SCALAR_TYPES.has(param.type)) {
+            throw new Error(`operation "${entry.operationId}" has multipart field "${param.name}" with unsupported type "${param.type}"`);
+        }
+        const registersFlag = param.in === 'path' ||
+            param.in === 'query' ||
+            param.in === 'header' ||
+            (param.in === 'body' && SCALAR_TYPES.has(param.type));
+        if (!registersFlag)
+            continue;
+        const name = kebab(param.name);
+        if (RESERVED_FLAGS.has(name)) {
+            throw new Error(`operation "${entry.operationId}" declares param "${param.name}" whose flag ` +
+                `--${name} collides with a reserved CLI flag; rename it in the backend spec.`);
+        }
+        const valueName = multipart && param.in === 'body' && param.format === 'binary' ? 'path' : name;
+        const flag = `--${name} <${valueName}>`;
+        const nonScalarTransport = (param.in === 'query' || param.in === 'header') && !SCALAR_TYPES.has(param.type);
+        const description = nonScalarTransport
+            ? [helpText(param), '[pass as JSON]'].filter(Boolean).join(' ')
+            : helpText(param);
+        if (param.in === 'path') {
+            command.requiredOption(flag, description);
+        }
+        else if (param.in === 'query') {
+            if (param.required)
+                command.requiredOption(flag, description);
+            else
+                command.option(flag, description);
+        }
+        else if (param.in === 'header') {
+            if (param.required)
+                command.requiredOption(flag, description);
+            else
+                command.option(flag, description);
+        }
+        else {
+            // JSON fields remain optional flags because --data/--from-json may supply
+            // them. Multipart has no alternate body source, so Commander can enforce
+            // each required form field directly (assembleParams repeats the check for
+            // non-Commander callers).
+            if (multipart && param.required)
+                command.requiredOption(flag, description);
+            else
+                command.option(flag, description);
+        }
+    }
+    if (entry.bodyKey && !multipart) {
+        if (fileFlags) {
+            command.option('--from-json <file>', 'Read the request body from a JSON file');
+        }
+        command.option('--data <json>', 'Inline JSON request body');
+    }
+}
+// ── docs browse surfaces — one consistent shape: `horizon <group> [<id>]` ─────────
+//
+// All four read-only browse groups (resources / recipes / explain / tutorials)
+// take one positional shape: bare lists, an id shows that one. No `show`/`list`
+// verbs (those are the action layer's, `horizon <noun> <verb>`). All data is the live
+// manifest; these commands are pure presentation (no further network).
+// The Labelbox app host (not the Horizon API base) — recipes/docs render in-app.
+const RECIPE_DOCS_BASE_URL = 'https://app.labelbox.com';
+/** Output formats `horizon recipes <id>` can render, mapped to the composed snippet field. */
+const RECIPE_FORMATS = { cli: 'cli', ts: 'sdk', curl: 'curl' };
+function isRecipeFormat(value) {
+    return Object.hasOwn(RECIPE_FORMATS, value);
+}
+/** Group entries under their domain (in nav order), with anything domainless last. */
+function groupByDomain(entries, domainOf, domains) {
+    const order = new Map(domains.map((d, i) => [d.id, { title: d.title, index: i }]));
+    const buckets = new Map();
+    for (const entry of entries) {
+        const key = domainOf(entry) ?? '';
+        const bucket = buckets.get(key) ?? [];
+        bucket.push(entry);
+        buckets.set(key, bucket);
+    }
+    const groups = [...buckets.entries()].map(([id, items]) => ({
+        id,
+        title: order.get(id)?.title ?? 'Other',
+        index: order.get(id)?.index ?? Number.MAX_SAFE_INTEGER,
+        entries: items,
+    }));
+    groups.sort((a, b) => a.index - b.index || a.title.localeCompare(b.title, 'en'));
+    return groups.map(({ title, entries: items }) => ({ title, entries: items }));
+}
+const ACTIONS_HELP_GROUP = 'Actions:';
+const DOCS_HELP_GROUP = 'Documentation:';
+const GIT_HOST_HELP_GROUP = 'Coding tasks:';
+/** Nested resource groups (`horizon problems --help`, etc.) — allowed subcommands. */
+const COMMANDS_HELP_GROUP = 'Commands';
+// ── permission gating (per-caller) ───────────────────────────────────────────
+//
+// A command the caller can't run stays *visible* (nothing is hidden) but is
+// grouped under "Unavailable (missing permission)", marked in its description,
+// and pre-empted on invoke. The listing marker, the leaf `--help` note, and the
+// invocation error all derive from the same missing-permission slug, so they
+// can't disagree. When permissions are unknown (fail-open) `missing` is undefined
+// everywhere and none of this fires. The per-leaf presentation lives in
+// permissions.ts so hand-written commands can reuse it verbatim.
+/** Banner above a resource group's `--help` when it lists unavailable subcommands. */
+function permissionGroupBanner(gatedCount) {
+    const noun = gatedCount === 1 ? 'command requires a permission' : 'commands require permissions';
+    return `\n${gatedCount} ${noun} you do not have (listed under "${UNAVAILABLE_HELP_GROUP}").\n`;
+}
+/** A resource's domain: its own, else the nearest ancestor's (walking `parent`). */
+function resolveResourceDomain(resource, byId) {
+    let current = resource;
+    const seen = new Set();
+    while (current && !seen.has(current.id)) {
+        if (current.domain)
+            return current.domain;
+        seen.add(current.id);
+        current =
+            current.parent && Object.hasOwn(byId, current.parent) ? byId[current.parent] : undefined;
+    }
+    return undefined;
+}
+/** The `horizon <callPath>` invocation for an operation, with its required-flag hints. */
+function operationInvocation(op) {
+    const flags = [];
+    const multipart = isMultipartRequestOperation(op);
+    for (const param of op.params) {
+        if (param.in === 'path' ||
+            ((param.in === 'query' || param.in === 'header') && param.required) ||
+            (multipart && param.in === 'body' && param.required)) {
+            const name = kebab(param.name);
+            const valueName = multipart && param.in === 'body' && param.format === 'binary' ? 'path' : name;
+            flags.push(`--${name} <${valueName}>`);
+        }
+    }
+    if (op.bodyKey && !multipart)
+        flags.push('--data <json>');
+    // kebab each segment so the printed command matches the real one (the tree is
+    // built from `kebab(segment)`) — `horizon environments attach-external-id`, not the
+    // camelCase callPath.
+    const command = op.callPath.map(kebab).join(' ');
+    return `horizon ${command}${flags.length ? ` ${flags.join(' ')}` : ''}`;
+}
+/** `horizon resources [<id>]` — the Reference hub (grouped browse, or one resource). */
+function addResourcesCommand(program, manifest, io) {
+    const byId = manifest.resources;
+    program
+        .command('resources [id]')
+        .helpGroup(DOCS_HELP_GROUP)
+        .description('Browse resource reference hubs (run without an argument to list all)')
+        .action((id) => {
+        if (id === undefined) {
+            io.stdout(renderResourceList(manifest));
+            return;
+        }
+        // `Object.hasOwn`, not `byId[id]`: a Zod `z.record` is a plain object, so a bare
+        // read walks the prototype chain — `horizon resources constructor` would resolve to a
+        // truthy inherited member, bypass the not-found guard, and crash in the renderer.
+        const entry = Object.hasOwn(byId, id) ? byId[id] : undefined;
+        if (!entry) {
+            throw new Error(`unknown resource "${id}". Run \`horizon resources\` to list resources.`);
+        }
+        io.stdout(renderResourceShow(entry, manifest, io.localCheckout));
+    });
+}
+function renderResourceList(manifest) {
+    const byId = manifest.resources;
+    const all = Object.values(byId);
+    const groups = groupByDomain(all, (r) => resolveResourceDomain(r, byId), manifest.domains);
+    const lines = ['Resources — run `horizon resources <id>` for the full overview.', ''];
+    for (const group of groups) {
+        lines.push(group.title);
+        const sorted = group.entries.sort((a, b) => a.order - b.order || a.id.localeCompare(b.id, 'en'));
+        for (const r of sorted) {
+            lines.push(r.summary ? `  ${r.id} — ${r.summary}` : `  ${r.id}`);
+        }
+    }
+    return `${lines.join('\n').trimEnd()}\n`;
+}
+function renderResourceShow(resource, manifest, allowFileInputs) {
+    const parts = [resource.title];
+    if (resource.summary)
+        parts.push(resource.summary);
+    if (resource.description)
+        parts.push('', resource.description);
+    if (resource.object && resource.object.fields.length > 0) {
+        parts.push('', `Object: ${resource.object.name}`, ...renderShapeTree(resource.object.fields, '  '));
+    }
+    const ops = resource.operationIds
+        // Object.hasOwn guards the prototype chain (matching the argv-driven lookups):
+        // `manifest.operations` is a Zod `z.record` plain object, so a stray operationId
+        // that's a JS prototype key (constructor/valueOf/…) would otherwise resolve to a
+        // truthy inherited member, survive the filter, and render as garbage.
+        .map((opId) => Object.hasOwn(manifest.operations, opId) ? manifest.operations[opId] : undefined)
+        .filter((op) => op !== undefined && isCliOperationCallable(op, allowFileInputs))
+        .sort((a, b) => a.callPath.join(' ').localeCompare(b.callPath.join(' '), 'en'));
+    if (ops.length > 0) {
+        parts.push('', 'Operations:');
+        for (const op of ops)
+            parts.push(`  ${operationInvocation(op)} — ${op.summary}`);
+    }
+    const opIds = new Set(resource.operationIds);
+    const recipes = Object.values(manifest.recipes)
+        .filter((r) => r.steps.some((s) => s.operationId !== undefined && opIds.has(s.operationId)))
+        .sort((a, b) => a.id.localeCompare(b.id, 'en'));
+    if (recipes.length > 0) {
+        parts.push('', 'Recipes that use this:');
+        for (const r of recipes)
+            parts.push(`  ${r.id} — ${r.title}`);
+    }
+    return `${parts.join('\n')}\n`;
+}
+/** `horizon recipes [<id>]` — How-to (list grouped by category, or one recipe). */
+function addRecipesCommand(program, manifest, io) {
+    program
+        .command('recipes [id]')
+        .helpGroup(DOCS_HELP_GROUP)
+        .description('Browse documented recipes — multi-step, user-goal guides for the app')
+        .option('--format <format>', `Output format: ${Object.keys(RECIPE_FORMATS).join(' | ')}`, 'cli')
+        .action((id, opts) => {
+        if (id === undefined) {
+            io.stdout(renderRecipeList(manifest.recipes));
+            return;
+        }
+        // Object.hasOwn guards the prototype chain (see the resources hub above).
+        const entry = Object.hasOwn(manifest.recipes, id) ? manifest.recipes[id] : undefined;
+        if (!entry) {
+            throw new Error(`unknown recipe "${id}". Run \`horizon recipes\` to see all recipes.`);
+        }
+        const format = opts.format ?? 'cli';
+        // `Object.hasOwn`, not `format in RECIPE_FORMATS`: `in` walks the prototype
+        // chain, so `--format toString` (or valueOf/constructor/__proto__/…) would
+        // pass and then crash in renderRecipeShow with an unactionable TypeError.
+        // Mirrors `resolveSkill`'s own-key check in skills.controller.ts.
+        if (!isRecipeFormat(format)) {
+            throw new Error(`invalid --format "${format}" (expected: ${Object.keys(RECIPE_FORMATS).join(', ')})`);
+        }
+        io.stdout(renderRecipeShow(entry, format, manifest.recipes));
+    });
+}
+/** The full catalog, grouped by category, for `horizon recipes`. */
+export function renderRecipeList(reference) {
+    const entries = Object.values(reference);
+    if (entries.length === 0)
+        return 'No recipes are available.\n';
+    const byCategory = new Map();
+    for (const entry of entries) {
+        const group = byCategory.get(entry.category) ?? [];
+        group.push(entry);
+        byCategory.set(entry.category, group);
+    }
+    const lines = ['Recipes — run `horizon recipes <id>` for the full walkthrough.', ''];
+    for (const category of [...byCategory.keys()].sort()) {
+        lines.push(category);
+        const group = byCategory.get(category) ?? [];
+        for (const entry of group.sort((a, b) => a.id.localeCompare(b.id, 'en'))) {
+            lines.push(`  ${entry.id} — ${entry.title}`);
+            lines.push(`    ${entry.goal}`);
+        }
+        lines.push('');
+    }
+    return `${lines.join('\n').trimEnd()}\n`;
+}
+/**
+ * The "Related" + "Unblocks" block for a recipe — its place in the graph. The
+ * stored links (`requires` / `variationOf` / `learnMore`) come off the recipe;
+ * **Unblocks** is *derived* (never stored): the recipes that name THIS one as a
+ * `requires` recipe, so an agent reading one recipe sees both what to do first
+ * and where it can go next. Returns `''` when the recipe is an island.
+ */
+export function renderRelatedBlock(entry, allRecipes) {
+    const related = entry.related;
+    const lines = [];
+    const requires = related?.requires ?? [];
+    if (requires.length > 0) {
+        lines.push('  Requires');
+        for (const req of requires) {
+            if (req.type === 'recipe') {
+                lines.push(`    • ${req.id}`);
+            }
+            else {
+                const via = req.via ? `   (via ${req.via.id})` : '';
+                lines.push(`    • state: ${req.explanation}${via}`);
+            }
+        }
+    }
+    if (related?.variationOf) {
+        lines.push('  Variation of');
+        lines.push(`    • ${related.variationOf}`);
+    }
+    const learnMore = related?.learnMore ?? [];
+    if (learnMore.length > 0) {
+        lines.push('  Learn more');
+        for (const target of learnMore)
+            lines.push(`    • ${target.type}: ${target.id}`);
+    }
+    // Unblocks — the inverse of `requires` (this recipe is a prerequisite of …).
+    // Matches the same edge set the cycle gate walks + the skill traverses: a
+    // direct `recipe` requirement AND a `state` requirement reached `via` this
+    // recipe, so the three surfaces agree on what counts as a prerequisite edge.
+    const unblocks = Object.values(allRecipes)
+        .filter((r) => (r.related?.requires ?? []).some((q) => (q.type === 'recipe' && q.id === entry.id) ||
+        (q.type === 'state' && q.via?.type === 'recipe' && q.via.id === entry.id)))
+        .map((r) => r.id)
+        .sort((a, b) => a.localeCompare(b, 'en'));
+    if (unblocks.length > 0) {
+        lines.push('  Unblocks');
+        for (const id of unblocks)
+            lines.push(`    • ${id}`);
+    }
+    return lines.length > 0 ? `Related\n${lines.join('\n')}\n` : '';
+}
+/** One recipe rendered for `horizon recipes <id>`: goal + composed code + related links + a docs link. */
+export function renderRecipeShow(entry, format, allRecipes) {
+    const composed = entry[RECIPE_FORMATS[format]];
+    const snippet = [composed.setup, composed.main].filter(Boolean).join('\n\n');
+    const relatedBlock = renderRelatedBlock(entry, allRecipes);
+    return [
+        entry.title,
+        entry.goal,
+        '',
+        snippet,
+        '',
+        ...(relatedBlock ? [relatedBlock] : []),
+        // "Full docs", not "Learn more": the Related block above already has a
+        // "Learn more" subsection (related concepts/tutorials), and two same-named
+        // labels in agent-facing output is confusing. This is the recipe's own page.
+        `Full docs: ${RECIPE_DOCS_BASE_URL}/admin/docs?page=recipe:${entry.id}`,
+        '',
+    ].join('\n');
+}
+/** `horizon explain [<concept>]` — Explanation (list grouped by domain, or one page). */
+function addExplainCommand(program, manifest, io) {
+    program
+        .command('explain [concept]')
+        .helpGroup(DOCS_HELP_GROUP)
+        .description('Browse explanation concept pages (run without an argument to list all)')
+        .action((concept) => {
+        if (concept === undefined) {
+            io.stdout(renderConceptList(manifest));
+            return;
+        }
+        // Object.hasOwn guards the prototype chain (see the resources hub above).
+        const entry = Object.hasOwn(manifest.concepts, concept)
+            ? manifest.concepts[concept]
+            : undefined;
+        if (!entry) {
+            throw new Error(`unknown concept "${concept}". Run \`horizon explain\` to list concepts.`);
+        }
+        io.stdout(renderConceptShow(entry));
+    });
+}
+function renderConceptList(manifest) {
+    const groups = groupByDomain(Object.values(manifest.concepts), (c) => c.domain, manifest.domains);
+    const lines = ['Explanations — run `horizon explain <concept>` for the full page.', ''];
+    for (const group of groups) {
+        lines.push(group.title);
+        for (const c of group.entries.sort((a, b) => a.id.localeCompare(b.id, 'en'))) {
+            lines.push(`  ${c.id} — ${c.title}`);
+        }
+    }
+    return `${lines.join('\n').trimEnd()}\n`;
+}
+function renderConceptShow(concept) {
+    const parts = [concept.body];
+    if (concept.related.length > 0) {
+        // Strip the `resource:` / `recipe:` / `concept:` kind prefix for a clean footer.
+        const related = concept.related.map((slug) => slug.replace(/^[a-z]+:/u, ''));
+        parts.push('', `Related: ${related.join(' · ')}`);
+    }
+    return `${parts.join('\n')}\n`;
+}
+/** `horizon tutorials [<id>]` — Tutorials (the existing getting-started docs). */
+function addTutorialsCommand(program, manifest, io) {
+    program
+        .command('tutorials [id]')
+        .helpGroup(DOCS_HELP_GROUP)
+        .description('Browse getting-started tutorials (run without an argument to list all)')
+        .action((id) => {
+        if (id === undefined) {
+            const lines = ['Tutorials — run `horizon tutorials <id>` for the full text.', ''];
+            for (const t of manifest.tutorials)
+                lines.push(`  ${t.id} — ${t.title}`);
+            io.stdout(`${lines.join('\n')}\n`);
+            return;
+        }
+        const entry = manifest.tutorials.find((t) => t.id === id);
+        if (!entry) {
+            throw new Error(`unknown tutorial "${id}". Run \`horizon tutorials\` to list tutorials.`);
+        }
+        if (entry.body === null) {
+            io.stdout(`${entry.title}\n\nThis tutorial is a notebook — open it in the app: ` +
+                `${RECIPE_DOCS_BASE_URL}/admin/docs?page=${entry.id}\n`);
+            return;
+        }
+        io.stdout(`${entry.body}\n`);
+    });
+}
+/** The program shell — name, description, version, and the global options. */
+export function buildBaseProgram(version, io, allowEnvironmentFallback = true) {
+    return (new Command('horizon')
+        // Route commander's own output (help text, unknown-command errors, invalid
+        // option values) through the caller's sinks, and turn its `process.exit`
+        // calls into thrown `CommanderError`s.
+        //
+        // Both settings MUST be applied here, on the root, *before* any `.command()`
+        // call: commander copies `_outputConfiguration` and `_exitCallback` onto a
+        // subcommand at creation time (`copyInheritedSettings`), so applying them
+        // after the tree is built would leave every subcommand still writing to the
+        // process streams and still calling `process.exit`.
+        .configureOutput({ writeOut: io.stdout, writeErr: io.stderr })
+        .exitOverride()
+        .description('Command-line interface for Horizon')
+        .version(version)
+        .option('--api-key <key>', 'API key (defaults to the LABELBOX_API_KEY env var)')
+        .option('--base-url <url>', 'Horizon API base URL (defaults to the HORIZON_BASE_URL env var, then the production host)')
+        .option('--quiet', 'Output only the declared direct result field or resulting resource id')
+        .option('--scope-organization-external-id <id>', 'Scope the request to an organization' +
+        (allowEnvironmentFallback
+            ? ' (defaults to the LABELBOX_ORGANIZATION_EXTERNAL_ID env var)'
+            : ''))
+        .option('--scope-environment-external-id <id>', 'Scope the request to an environment; required by operations like `computes create`. ' +
+        (allowEnvironmentFallback
+            ? 'Defaults to the HORIZON_ENVIRONMENT_EXTERNAL_ID env var. '
+            : '') +
+        'Implies an organization scope'));
+}
+/** Build the full `horizon` program from a fetched manifest. */
+export function buildProgram(manifest, ctx) {
+    // `ctx` structurally satisfies CliIo, so the root program — and by inheritance
+    // every command built below — writes to the caller's sinks and never exits.
+    const program = buildBaseProgram(ctx.version, ctx, ctx.localCheckout);
+    // Cache of group (non-leaf) commands by their joined path prefix so siblings
+    // share intermediate nodes (and each gets its own `--help`).
+    const groups = new Map();
+    // Parents whose `--help` should carry the unavailable-command banner.
+    const gatedCountByParent = new Map();
+    // Register a child command, failing fast if its name already exists under this
+    // parent (or shadows a reserved top-level group). `kebab()` is non-injective and
+    // commander registers duplicates silently — resolving `.find()` to the first — so
+    // a colliding op would otherwise become an unreachable command with no error.
+    const claim = (parent, name, source) => {
+        const clashesReserved = parent === program && RESERVED_COMMANDS.has(name);
+        if (clashesReserved || parent.commands.some((c) => c.name() === name)) {
+            throw new Error(`${source} maps to command "${name}"${parent === program ? '' : ` under "${parent.name()}"`}, ` +
+                'which is already taken — two operations’ call paths collide (or one hits a reserved ' +
+                'top-level command). Rename one in the backend spec.');
+        }
+        return parent.command(name);
+    };
+    // The terminal can open local files for multipart operations. Embedded/MCP
+    // programs cannot touch the server filesystem, so their command tree remains
+    // restricted to the generic JSON transport.
+    const entries = Object.values(manifest.operations)
+        .filter((entry) => isCliOperationCallable(entry, ctx.localCheckout))
+        .sort((a, b) => {
+        const aDenied = missingPermission(a, ctx.granted) !== undefined ? 1 : 0;
+        const bDenied = missingPermission(b, ctx.granted) !== undefined ? 1 : 0;
+        if (aDenied !== bDenied)
+            return aDenied - bDenied;
+        return a.callPath.join(' ').localeCompare(b.callPath.join(' '), 'en');
+    });
+    for (const entry of entries) {
+        const parents = entry.callPath.slice(0, -1);
+        const leaf = entry.callPath[entry.callPath.length - 1];
+        if (leaf === undefined)
+            continue;
+        let parent = program;
+        let prefix = '';
+        for (const segment of parents) {
+            const key = prefix === '' ? segment : `${prefix}.${segment}`;
+            let group = groups.get(key);
+            if (!group) {
+                // Label the group with its resource's one-line summary. The synthesizer's
+                // tag is singular while its namespace is plural, so fall back to the
+                // singular form; sub-namespaces match no resource and keep a generic label.
+                const groupName = kebab(segment);
+                const resourceFor = (key) => Object.hasOwn(manifest.resources, key) ? manifest.resources[key] : undefined;
+                const resource = resourceFor(groupName) ?? resourceFor(groupName.replace(/s$/u, ''));
+                group = claim(parent, groupName, `operation "${entry.operationId}"`).description(resource?.summary ?? `${groupName} commands`);
+                if (parent === program)
+                    group.helpGroup(ACTIONS_HELP_GROUP);
+                groups.set(key, group);
+            }
+            parent = group;
+            prefix = key;
+        }
+        // The first required permission the caller lacks (undefined → runnable /
+        // ungated / fail-open). Drives the listing marker, the help note, and the
+        // pre-emptive invocation error from one source so they always agree.
+        const missing = missingPermission(entry, ctx.granted);
+        const leafCommand = claim(parent, kebab(leaf), `operation "${entry.operationId}"`).description(gatedSummary(entry.summary, missing));
+        if (parent === program) {
+            leafCommand.helpGroup(missing === undefined ? ACTIONS_HELP_GROUP : UNAVAILABLE_HELP_GROUP);
+        }
+        else if (missing === undefined) {
+            leafCommand.helpGroup(COMMANDS_HELP_GROUP);
+        }
+        else {
+            leafCommand.helpGroup(UNAVAILABLE_HELP_GROUP);
+            gatedCountByParent.set(parent, (gatedCountByParent.get(parent) ?? 0) + 1);
+        }
+        addOptions(leafCommand, entry, ctx.localCheckout);
+        leafCommand.addHelpText('after', leafShapeHelp(entry));
+        if (missing !== undefined)
+            leafCommand.addHelpText('after', permissionHelpNote(missing));
+        leafCommand.action(async (localOpts) => {
+            try {
+                // Pre-empt a doomed request with a clear local error, instead of letting
+                // it round-trip to a server 403.
+                if (missing !== undefined)
+                    throw new Error(permissionDeniedMessage(missing));
+                const params = assembleParams(entry, localOpts, parseBodyBase(localOpts));
+                const result = await dispatchOperation(entry, params, {
+                    apiKey: ctx.apiKey,
+                    baseUrl: ctx.baseUrl,
+                    allowFileInputs: ctx.localCheckout,
+                    ...commandScope(program, ctx.localCheckout),
+                });
+                const global = program.opts();
+                const output = formatOutput(result, global.quiet === true, entry.cliOutputField);
+                if (output instanceof ReadableStream) {
+                    if (ctx.binaryStdout === undefined) {
+                        throw new Error('binary response output is unavailable in an embedded CLI');
+                    }
+                    await pipeline(Readable.from(output), ctx.binaryStdout, { end: false });
+                }
+                else {
+                    ctx.stdout(output);
+                }
+            }
+            catch (err) {
+                // Normalize to an Error carrying the rendered text, then rethrow: commander
+                // rejects `parseAsync`, and `run()` is the single place that renders
+                // `error: <message>`. Dispatch throws the server's raw JSON error body (not
+                // an Error), so formatting has to happen here, while that shape is intact.
+                throw new Error(formatError(err));
+            }
+        });
+    }
+    // The docs browse groups + the bespoke `horizon skills` action group.
+    addResourcesCommand(program, manifest, ctx);
+    addRecipesCommand(program, manifest, ctx);
+    addExplainCommand(program, manifest, ctx);
+    addTutorialsCommand(program, manifest, ctx);
+    if (ctx.localCheckout) {
+        addSkillsCommands(program, DOCS_HELP_GROUP);
+        addGitHostCommands(program, GIT_HOST_HELP_GROUP);
+        // Gated with the other bespoke commands: `computes open` can write a bearer-equivalent
+        // session cookie and `computes tools` writes its result straight to `process.stdout`,
+        // bypassing the `ctx.stdout` sink every other command uses. In the embedded MCP shape,
+        // either output would land in the API server's logs rather than in the tool result.
+        // Reachable from the real binary only until there is a reason to widen it.
+        //
+        // Registered before the banner loop so gated compute-session commands are counted in their
+        // group's "N commands require permissions" note.
+        const gated = addComputeSessionCommands(program, COMMANDS_HELP_GROUP, ctx.granted);
+        if (gated !== undefined) {
+            gatedCountByParent.set(gated.parent, (gatedCountByParent.get(gated.parent) ?? 0) + gated.gatedCount);
+        }
+    }
+    for (const [parent, gatedCount] of gatedCountByParent) {
+        parent.addHelpText('before', permissionGroupBanner(gatedCount));
+    }
+    program.configureHelp({ sortSubcommands: true });
+    program.commandsGroup(DOCS_HELP_GROUP);
+    // Lazy implicit help skips _initCommandGroup unless created via helpCommand(true).
+    program.helpCommand(true);
+    program.addHelpText('after', `
+Run \`horizon <command> --help\` for details and flags on any command.
+Browse the full reference with \`horizon resources\`, or guided walkthroughs with \`horizon recipes\`.`);
+    return program;
+}