@mu-cabin/coding-cli 0.1.0

package/dist/cli.js

@@ -0,0 +1,1181 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import * as fs6 from "fs";
+import * as path5 from "path";
+import { Command } from "commander";
+
+// src/core/errors.ts
+var EXIT = {
+  OK: 0,
+  INTERNAL: 1,
+  USAGE: 2,
+  AUTH: 3,
+  NOT_FOUND: 4,
+  REMOTE: 5,
+  CONFIG_MISSING: 6,
+  CONFIG_INVALID: 7,
+  FORBIDDEN: 8,
+  RATE_LIMIT: 9,
+  CONFIRM: 10,
+  VALIDATION: 11
+};
+var CliError = class extends Error {
+  exit;
+  body;
+  action;
+  requestId;
+  warnings;
+  constructor(exit, body, opts = {}) {
+    super(body.message);
+    this.name = "CliError";
+    this.exit = exit;
+    this.body = body;
+    this.action = opts.action;
+    this.requestId = opts.requestId;
+    this.warnings = opts.warnings && opts.warnings.length ? opts.warnings : void 0;
+  }
+};
+function exitForServerCode(code) {
+  switch (code) {
+    case "AuthFailure":
+      return EXIT.AUTH;
+    case "UnauthorizedOperation":
+    case "OperationDenied":
+      return EXIT.FORBIDDEN;
+    case "ResourceNotFound":
+      return EXIT.NOT_FOUND;
+    case "RequestLimitExceeded":
+      return EXIT.RATE_LIMIT;
+    default:
+      return EXIT.REMOTE;
+  }
+}
+function hintForServerCode(code) {
+  switch (code) {
+    case "AuthFailure":
+      return "Token is missing/invalid/revoked. Re-run `coding auth login`.";
+    case "UnauthorizedOperation":
+      return "Token is valid but its scope does not cover this action. Mint a token with the required scope in your instance's token settings.";
+    case "RequestLimitExceeded":
+      return "Rate limit is 30 req/s per team per action. Back off and pace your requests (the CLI does not auto-retry).";
+    default:
+      return void 0;
+  }
+}
+
+// src/core/envelope.ts
+function success(data, opts = {}) {
+  const warnings = opts.warnings && opts.warnings.length ? opts.warnings : void 0;
+  return { ok: true, action: opts.action, requestId: opts.requestId, warnings, data };
+}
+function errorEnvelope(err) {
+  return { ok: false, action: err.action, requestId: err.requestId, warnings: err.warnings, error: err.body };
+}
+function compact(obj) {
+  const out = {};
+  for (const [k, v] of Object.entries(obj)) {
+    if (v !== void 0) out[k] = v;
+  }
+  return out;
+}
+function renderEnvelope(env, json) {
+  if (json) return JSON.stringify(compact(env));
+  if (env.ok) {
+    const head = env.action ? `\u2713 ${env.action}` : "\u2713 ok";
+    const warn = (env.warnings || []).map((w) => `\u26A0 ${w}`);
+    const body = typeof env.data === "string" ? env.data : JSON.stringify(env.data, null, 2);
+    return [head, ...warn, body].join("\n");
+  }
+  const e = env.error;
+  const label = e.code || e.type || "error";
+  const lines = [`\u2717 ${label}: ${e.message}`];
+  for (const w of env.warnings || []) lines.push(`  \u26A0 ${w}`);
+  if (e.risk) lines.push(`  risk: ${e.risk.level} (${e.risk.action})`);
+  if (e.hint) lines.push(`  hint: ${e.hint}`);
+  if (env.requestId) lines.push(`  requestId: ${env.requestId}`);
+  return lines.join("\n");
+}
+
+// src/core/config.ts
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+var DEFAULT_BASE = "http://coding.example.com/open-api";
+var DEFAULT_PROFILE = "default";
+function configDir() {
+  return process.env.CODING_CONFIG_DIR || path.join(os.homedir(), ".coding");
+}
+function configPath() {
+  return path.join(configDir(), "config.json");
+}
+function credentialsPath() {
+  return path.join(configDir(), "credentials.json");
+}
+function readJson(file) {
+  if (!fs.existsSync(file)) return null;
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch (e) {
+    throw new CliError(EXIT.CONFIG_INVALID, { type: "config_invalid", message: `Cannot read ${file}: ${e.message}` });
+  }
+  try {
+    return JSON.parse(text);
+  } catch {
+    throw new CliError(EXIT.CONFIG_INVALID, {
+      type: "config_invalid",
+      message: `Malformed JSON in ${file}`,
+      hint: "Fix the file by hand or re-run `coding config init`."
+    });
+  }
+}
+function asObject(v) {
+  return v && typeof v === "object" && !Array.isArray(v) ? v : void 0;
+}
+function configInvalid(file, detail) {
+  return new CliError(EXIT.CONFIG_INVALID, { type: "config_invalid", message: `Invalid config (${file}): ${detail}`, hint: "Fix the file by hand or re-run `coding config init`." });
+}
+function loadConfig() {
+  const file = configPath();
+  const raw = readJson(file);
+  if (raw === null) return null;
+  const obj = asObject(raw);
+  if (!obj) throw configInvalid(file, "top-level value must be a JSON object");
+  if (obj.activeProfile !== void 0 && typeof obj.activeProfile !== "string") throw configInvalid(file, "activeProfile must be a string");
+  const profiles = asObject(obj.profiles) ?? {};
+  for (const [name, p] of Object.entries(profiles)) {
+    const po = asObject(p);
+    if (!po) throw configInvalid(file, `profile "${name}" must be an object`);
+    if (po.baseUrl !== void 0 && typeof po.baseUrl !== "string") throw configInvalid(file, `profile "${name}".baseUrl must be a string`);
+  }
+  return obj;
+}
+function loadCredentials() {
+  const file = credentialsPath();
+  const raw = readJson(file);
+  if (raw === null) return null;
+  const obj = asObject(raw);
+  if (!obj) throw configInvalid(file, "top-level value must be a JSON object");
+  const profiles = asObject(obj.profiles) ?? {};
+  for (const [name, p] of Object.entries(profiles)) {
+    const po = asObject(p);
+    if (!po) throw configInvalid(file, `profile "${name}" must be an object`);
+    if (po.token !== void 0 && typeof po.token !== "string") throw configInvalid(file, `profile "${name}".token must be a string`);
+  }
+  return obj;
+}
+function insecureHttpWarning(baseUrl) {
+  if (process.env.CODING_ALLOW_HTTP) return void 0;
+  let u;
+  try {
+    u = new URL(baseUrl);
+  } catch {
+    return void 0;
+  }
+  if (u.protocol === "https:") return void 0;
+  if (u.hostname === "localhost" || u.hostname === "127.0.0.1" || u.hostname === "::1") return void 0;
+  return `Access token is being sent over plaintext ${u.protocol}// to ${u.host}. Prefer HTTPS if your instance supports it, or set CODING_ALLOW_HTTP=1 to silence this warning.`;
+}
+function resolveProfileName(cliProfile) {
+  return cliProfile || process.env.CODING_PROFILE || loadConfig()?.activeProfile || DEFAULT_PROFILE;
+}
+function normalizeBaseUrl(url) {
+  return url.replace(/\/+$/, "");
+}
+function resolveBaseUrl(opts) {
+  const raw = opts.cliBaseUrl || process.env.CODING_API_BASE || loadConfig()?.profiles?.[opts.profile]?.baseUrl || DEFAULT_BASE;
+  return normalizeBaseUrl(raw);
+}
+function resolveToken(profile) {
+  const fromEnv = process.env.CODING_TOKEN;
+  if (fromEnv && fromEnv.trim()) return fromEnv.trim();
+  const fromFile = loadCredentials()?.profiles?.[profile]?.token;
+  if (fromFile && fromFile.trim()) return fromFile.trim();
+  throw new CliError(EXIT.AUTH, {
+    type: "auth_required",
+    message: `No token for profile "${profile}".`,
+    hint: "Run `coding auth login` (in your own terminal) or set CODING_TOKEN."
+  });
+}
+function ensureDir() {
+  fs.mkdirSync(configDir(), { recursive: true });
+}
+function writeConfig(cfg) {
+  ensureDir();
+  fs.writeFileSync(configPath(), JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+}
+function writeCredentials(creds) {
+  ensureDir();
+  fs.writeFileSync(credentialsPath(), JSON.stringify(creds, null, 2) + "\n", { mode: 384 });
+  try {
+    fs.chmodSync(credentialsPath(), 384);
+  } catch {
+  }
+}
+function storeToken(profile, token) {
+  const creds = loadCredentials() || { version: 1, profiles: {} };
+  creds.version = creds.version || 1;
+  creds.profiles = creds.profiles || {};
+  creds.profiles[profile] = { ...creds.profiles[profile], token };
+  writeCredentials(creds);
+}
+function initConfig(profile, baseUrl) {
+  const existing = loadConfig();
+  const cfg = existing || { version: 1, activeProfile: profile, profiles: {} };
+  cfg.version = cfg.version || 1;
+  cfg.activeProfile = profile;
+  cfg.profiles = cfg.profiles || {};
+  cfg.profiles[profile] = { ...cfg.profiles[profile], baseUrl: normalizeBaseUrl(baseUrl) };
+  writeConfig(cfg);
+  return cfg;
+}
+
+// src/core/paths.ts
+import * as fs2 from "fs";
+import * as path2 from "path";
+import { fileURLToPath } from "url";
+var HERE = path2.dirname(fileURLToPath(import.meta.url));
+function packageRoot(start = HERE) {
+  let dir = start;
+  for (let i = 0; i < 8; i++) {
+    if (fs2.existsSync(path2.join(dir, "package.json"))) return dir;
+    const parent = path2.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return start;
+}
+
+// src/commands/config.ts
+function cmdConfigInit(ctx, baseUrl) {
+  const profile = ctx.profile;
+  const url = baseUrl || ctx.cliBaseUrl || DEFAULT_BASE;
+  initConfig(profile, url);
+  return { data: { path: configPath(), activeProfile: profile, baseUrl: url } };
+}
+function cmdConfigShow(ctx) {
+  const profile = resolveProfileName(ctx.profile);
+  let tokenPresent = false;
+  try {
+    resolveToken(profile);
+    tokenPresent = true;
+  } catch (e) {
+    if (!(e instanceof CliError && e.exit === EXIT.AUTH)) throw e;
+  }
+  return {
+    data: {
+      configPath: configPath(),
+      credentialsPath: credentialsPath(),
+      activeProfile: profile,
+      baseUrl: resolveBaseUrl({ cliBaseUrl: ctx.cliBaseUrl, profile }),
+      tokenPresent
+    }
+  };
+}
+
+// src/core/credentials.ts
+import * as readline from "readline";
+function readStdin() {
+  return new Promise((resolve, reject) => {
+    let buf = "";
+    process.stdin.setEncoding("utf8");
+    process.stdin.on("data", (chunk) => buf += chunk);
+    process.stdin.on("end", () => resolve(buf));
+    process.stdin.on("error", reject);
+  });
+}
+function promptHidden(prompt) {
+  if (!process.stdin.isTTY) {
+    throw new CliError(EXIT.USAGE, {
+      type: "no_tty",
+      message: "Cannot prompt for a token without an interactive terminal.",
+      hint: "Run `coding auth login` in your own terminal, or pipe the token via `coding auth login --token -`."
+    });
+  }
+  return new Promise((resolve, reject) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    const rlAny = rl;
+    let muted = false;
+    rlAny._writeToOutput = (s) => {
+      if (!muted) process.stdout.write(s);
+    };
+    process.stdout.write(prompt);
+    muted = true;
+    rl.question("", (answer) => {
+      muted = false;
+      rl.close();
+      process.stdout.write("\n");
+      resolve(answer.trim());
+    });
+    rl.on("error", reject);
+  });
+}
+
+// src/core/http.ts
+function actionUrl(baseUrl, action) {
+  return `${baseUrl}/?action=${encodeURIComponent(action)}`;
+}
+function buildDryRun(baseUrl, action, body) {
+  return {
+    dryRun: true,
+    request: {
+      method: "POST",
+      url: actionUrl(baseUrl, action),
+      headers: { Authorization: "token <redacted>", "Content-Type": "application/json" },
+      body
+    }
+  };
+}
+async function callAction(opts) {
+  const url = actionUrl(opts.baseUrl, opts.action);
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? 6e4);
+  let res;
+  let text;
+  try {
+    res = await fetch(url, {
+      method: "POST",
+      headers: {
+        Authorization: `token ${opts.token}`,
+        "Content-Type": "application/json",
+        Accept: "application/json"
+      },
+      body: JSON.stringify(opts.body ?? {}),
+      signal: controller.signal
+    });
+    text = await res.text();
+  } catch (e) {
+    const msg = e.name === "AbortError" ? "Request timed out" : `Request failed: ${e.message}`;
+    throw new CliError(EXIT.REMOTE, { type: "network", message: msg }, { action: opts.action });
+  } finally {
+    clearTimeout(timer);
+  }
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new CliError(
+      EXIT.REMOTE,
+      { type: "bad_response", message: `Non-JSON response (HTTP ${res.status}): ${text.slice(0, 200)}` },
+      { action: opts.action }
+    );
+  }
+  const root = json && typeof json === "object" && !Array.isArray(json) ? json : void 0;
+  const resp = root?.Response;
+  if (!resp || typeof resp !== "object" || Array.isArray(resp)) {
+    throw new CliError(
+      EXIT.REMOTE,
+      { type: "bad_response", message: `Unexpected response shape (HTTP ${res.status}); missing "Response" object: ${text.slice(0, 200)}` },
+      { action: opts.action }
+    );
+  }
+  const respObj = resp;
+  const requestId = respObj.RequestId;
+  const errObj = respObj.Error;
+  if (errObj && typeof errObj === "object") {
+    const code = errObj.Code || "UnknownError";
+    const message = errObj.Message || "Unknown error";
+    throw new CliError(exitForServerCode(code), { code, message, hint: hintForServerCode(code) }, { action: opts.action, requestId });
+  }
+  const data = { ...respObj };
+  delete data.RequestId;
+  return { action: opts.action, requestId, data };
+}
+
+// src/commands/auth.ts
+async function cmdAuthLogin(ctx, fromStdin) {
+  const token = (fromStdin ? await readStdin() : await promptHidden("CODING token: ")).trim();
+  if (!token) {
+    throw new CliError(EXIT.USAGE, { type: "empty_token", message: "No token provided." });
+  }
+  storeToken(ctx.profile, token);
+  return { data: { activeProfile: ctx.profile, credentialsPath: credentialsPath(), stored: true } };
+}
+async function cmdAuthStatus(ctx) {
+  const baseUrl = resolveBaseUrl({ cliBaseUrl: ctx.cliBaseUrl, profile: ctx.profile });
+  const token = resolveToken(ctx.profile);
+  const warn = insecureHttpWarning(baseUrl);
+  const res = await callAction({ baseUrl, token, action: "DescribeCodingCurrentUser", body: {} });
+  return {
+    action: res.action,
+    requestId: res.requestId,
+    warnings: warn ? [warn] : void 0,
+    data: { profile: ctx.profile, baseUrl, user: res.data.User }
+  };
+}
+
+// src/core/indexLoader.ts
+import * as fs3 from "fs";
+import * as path3 from "path";
+function findIndexFile() {
+  const candidate = path3.join(packageRoot(), "generated", "index.json");
+  return fs3.existsSync(candidate) ? candidate : null;
+}
+var cached = null;
+function loadIndex() {
+  if (cached) return cached;
+  const file = findIndexFile();
+  if (!file) {
+    throw new CliError(EXIT.INTERNAL, {
+      type: "index_missing",
+      message: "Bundled action index (generated/index.json) not found.",
+      hint: "Run `npm run regen` to build it from the OpenAPI spec."
+    });
+  }
+  try {
+    cached = JSON.parse(fs3.readFileSync(file, "utf8"));
+  } catch (e) {
+    throw new CliError(EXIT.INTERNAL, { type: "index_invalid", message: `Cannot parse action index: ${e.message}` });
+  }
+  return cached;
+}
+function getAction(action) {
+  return loadIndex().actions[action];
+}
+
+// src/commands/discover.ts
+function cmdCategories(_ctx) {
+  return { data: loadIndex().categories };
+}
+function cmdActions(_ctx, opts) {
+  const index = loadIndex();
+  const kw = opts.search?.toLowerCase();
+  const cat = opts.category?.toLowerCase();
+  const list = Object.entries(index.actions).filter(([name, meta]) => {
+    if (kw && !(name.toLowerCase().includes(kw) || (meta.summary || "").toLowerCase().includes(kw) || (meta.description || "").toLowerCase().includes(kw))) {
+      return false;
+    }
+    if (cat && !meta.category.toLowerCase().includes(cat)) return false;
+    return true;
+  }).map(([name, meta]) => ({ action: name, summary: meta.summary, category: meta.category, risk: meta.risk })).sort((a, b) => a.action.localeCompare(b.action));
+  return { data: { count: list.length, actions: list } };
+}
+function cmdSchema(_ctx, action) {
+  const meta = getAction(action);
+  if (!meta) {
+    throw new CliError(EXIT.NOT_FOUND, {
+      type: "unknown_action",
+      message: `Action "${action}" is not in the bundled index.`,
+      hint: "Search with `coding actions --search <keyword>` (your self-hosted instance may still accept it; use `coding call ... --force`)."
+    });
+  }
+  return { data: { action, ...meta } };
+}
+
+// src/commands/call.ts
+import * as fs4 from "fs";
+
+// src/core/risk.ts
+var DESTRUCTIVE = ["Delete", "Remove", "Disable", "Revoke", "Reset", "Clear", "Stop", "Terminate", "Unbind", "Archive", "Cancel", "Kill", "Destroy"];
+var WRITE = ["Create", "Modify", "Update", "Add", "Set", "Bind", "Enable", "Start", "Trigger", "Import", "Generate", "Move", "Copy", "Apply", "Submit", "Publish", "Release", "Rename", "Transfer", "Merge", "Close", "Open", "Restore", "Sync", "Upload", "Send", "Batch"];
+var READ = ["Describe", "List", "Get", "Query", "Check", "Search", "Preview", "Export", "Download", "Count", "Has", "Is", "Fetch"];
+function startsWithVerb(action, verbs) {
+  return verbs.some((v) => action.startsWith(v));
+}
+function hasKnownVerb(action) {
+  return startsWithVerb(action, DESTRUCTIVE) || startsWithVerb(action, READ) || startsWithVerb(action, WRITE);
+}
+function classifyRisk(action) {
+  if (startsWithVerb(action, DESTRUCTIVE)) return "destructive";
+  if (startsWithVerb(action, READ)) return "read";
+  if (startsWithVerb(action, WRITE)) return "write";
+  return "write";
+}
+var VALID_LEVELS = /* @__PURE__ */ new Set(["read", "write", "destructive"]);
+function effectiveRisk(action, indexed) {
+  if (indexed && VALID_LEVELS.has(indexed)) return indexed;
+  if (!hasKnownVerb(action)) return "destructive";
+  return classifyRisk(action);
+}
+function enforceGate(action, risk, yes) {
+  if (risk === "destructive" && !yes) {
+    const info = { level: risk, action };
+    throw new CliError(
+      EXIT.CONFIRM,
+      {
+        type: "confirmation_required",
+        message: `${action} is a destructive operation and requires confirmation`,
+        hint: "Re-run with --yes after the user explicitly approves. Use --dry-run first to preview the request.",
+        risk: info
+      },
+      { action }
+    );
+  }
+}
+
+// src/core/validate.ts
+function tryJson(v) {
+  try {
+    const parsed = JSON.parse(v);
+    if (typeof parsed === "number" && !Number.isFinite(parsed)) return v;
+    return parsed;
+  } catch {
+    return v;
+  }
+}
+function coerceParam(value, type) {
+  if (!type) return tryJson(value);
+  const t = type.toLowerCase();
+  const blank = value.trim() === "";
+  if (t.startsWith("integer")) {
+    if (blank) return value;
+    const n = Number(value);
+    return Number.isInteger(n) ? n : value;
+  }
+  if (t.startsWith("number")) {
+    if (blank) return value;
+    const n = Number(value);
+    return Number.isFinite(n) ? n : value;
+  }
+  if (t.startsWith("boolean") || t.startsWith("bool")) {
+    if (value === "true" || value === "1") return true;
+    if (value === "false" || value === "0") return false;
+    return value;
+  }
+  if (t.startsWith("string")) return value;
+  return tryJson(value);
+}
+function mergeParams(base, pairs, meta) {
+  const out = { ...base };
+  const types = /* @__PURE__ */ new Map();
+  if (meta) for (const p of meta.params) types.set(p.name, p.type);
+  for (const pair of pairs) {
+    const eq = pair.indexOf("=");
+    if (eq < 0) {
+      throw new Error(`Invalid --param "${pair}" (expected Key=Value)`);
+    }
+    const key = pair.slice(0, eq);
+    const raw = pair.slice(eq + 1);
+    out[key] = coerceParam(raw, types.get(key));
+  }
+  return out;
+}
+function validateCall(action, body, meta) {
+  const problems = [];
+  if (!meta) {
+    problems.push({ kind: "unknown_action", detail: `Action "${action}" is not in the bundled index (possible typo, or your instance has it but the public spec does not).` });
+    return problems;
+  }
+  const known = new Set(meta.params.map((p) => p.name));
+  for (const p of meta.params) {
+    if (p.required && !(p.name in body)) {
+      problems.push({ kind: "missing_required", detail: `Missing required param "${p.name}" (${p.type}).` });
+    }
+  }
+  for (const key of Object.keys(body)) {
+    if (!known.has(key)) {
+      problems.push({ kind: "unknown_param", detail: `Unknown param "${key}".` });
+    }
+  }
+  return problems;
+}
+
+// src/core/select.ts
+function getByPath(value, path6) {
+  const parts = path6.split(".").filter((p) => p.length > 0);
+  let cur = value;
+  for (let i = 0; i < parts.length; i++) {
+    const m = parts[i].match(/^(.*?)(\[(\d*)\])?$/);
+    const key = m ? m[1] : parts[i];
+    const hasBracket = !!(m && m[2] !== void 0);
+    const idxStr = m ? m[3] : void 0;
+    if (key !== "") {
+      if (cur == null || typeof cur !== "object") return void 0;
+      cur = cur[key];
+    }
+    if (hasBracket) {
+      if (!Array.isArray(cur)) return void 0;
+      if (idxStr === "" || idxStr === void 0) {
+        const restPath = parts.slice(i + 1).join(".");
+        return cur.map((item) => restPath ? getByPath(item, restPath) : item);
+      }
+      cur = cur[Number(idxStr)];
+    }
+  }
+  return cur;
+}
+function applySelect(data, paths) {
+  const out = {};
+  for (const p of paths) out[p] = getByPath(data, p);
+  return out;
+}
+function applyLimit(data, n) {
+  if (n < 0) return data;
+  if (Array.isArray(data)) return data.slice(0, n);
+  if (data && typeof data === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(data)) {
+      out[k] = Array.isArray(v) ? v.slice(0, n) : v;
+    }
+    return out;
+  }
+  return data;
+}
+
+// src/commands/call.ts
+async function readBody(data) {
+  if (!data) return {};
+  let text;
+  if (data === "-") text = await readStdin();
+  else if (data.startsWith("@")) {
+    const file = data.slice(1);
+    try {
+      text = fs4.readFileSync(file, "utf8");
+    } catch (e) {
+      throw new CliError(EXIT.USAGE, { type: "bad_data", message: `Cannot read --data file "${file}": ${e.message}` });
+    }
+  } else text = data;
+  text = text.trim();
+  if (!text) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (e) {
+    throw new CliError(EXIT.USAGE, { type: "bad_data", message: `--data is not valid JSON: ${e.message}` });
+  }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new CliError(EXIT.USAGE, { type: "bad_data", message: "--data must be a JSON object." });
+  }
+  return parsed;
+}
+async function cmdCall(ctx, action, opts) {
+  const meta = getAction(action);
+  const base = await readBody(opts.data);
+  let body;
+  try {
+    body = mergeParams(base, opts.param, meta);
+  } catch (e) {
+    throw new CliError(EXIT.USAGE, { type: "bad_param", message: e.message });
+  }
+  const warnings = [];
+  const problems = validateCall(action, body, meta);
+  if (problems.length) {
+    if (opts.force) {
+      for (const p of problems) warnings.push(p.detail);
+    } else {
+      throw new CliError(EXIT.VALIDATION, {
+        type: "validation_failed",
+        message: problems.map((p) => p.detail).join(" "),
+        hint: "Fix the params, or pass --force/--no-validate to send anyway (e.g. for an action your self-hosted instance has but the public spec lacks)."
+      });
+    }
+  }
+  const baseUrl = resolveBaseUrl({ cliBaseUrl: ctx.cliBaseUrl, profile: ctx.profile });
+  if (opts.dryRun) {
+    return { action, data: buildDryRun(baseUrl, action, body), warnings };
+  }
+  try {
+    const risk = effectiveRisk(action, meta?.risk);
+    enforceGate(action, risk, opts.yes);
+    const insecure = insecureHttpWarning(baseUrl);
+    if (insecure) warnings.push(insecure);
+    const token = resolveToken(ctx.profile);
+    const res = await callAction({ baseUrl, token, action, body });
+    let data = res.data;
+    if (opts.select) {
+      const paths = opts.select.split(",").map((s) => s.trim()).filter(Boolean);
+      if (paths.length) data = applySelect(data, paths);
+    }
+    if (opts.limit !== void 0) data = applyLimit(data, opts.limit);
+    return { action: res.action, requestId: res.requestId, data, warnings };
+  } catch (e) {
+    if (e instanceof CliError && warnings.length && !e.warnings) e.warnings = warnings;
+    throw e;
+  }
+}
+
+// src/core/specBuild.ts
+import * as fs5 from "fs";
+import * as path4 from "path";
+import { parse as parseYaml } from "yaml";
+var DOCS_PAGE = "https://coding.net/help/openapi";
+var NEW_BASE = DEFAULT_BASE;
+var NEW_HOST = new URL(DEFAULT_BASE).host;
+var OLD_BASE = "https://e.coding.net/open-api";
+var OLD_HOST = "coding.tencentcloudapi.com";
+var COMMON_ERROR_CODES = [
+  ["AuthFailure", "\u9274\u6743\u5931\u8D25\u3002"],
+  ["DryRunOperation", "DryRun \u64CD\u4F5C\uFF0C\u4EE3\u8868\u8BF7\u6C42\u5C06\u4F1A\u662F\u6210\u529F\u7684\uFF0C\u53EA\u662F\u591A\u4F20\u4E86 DryRun \u53C2\u6570\u3002"],
+  ["FailedOperation", "\u64CD\u4F5C\u5931\u8D25\u3002"],
+  ["InternalError", "\u5185\u90E8\u9519\u8BEF\u3002"],
+  ["InvalidParameter", "\u53C2\u6570\u9519\u8BEF\u3002"],
+  ["InvalidParameterValue", "\u53C2\u6570\u53D6\u503C\u9519\u8BEF\u3002"],
+  ["LimitExceeded", "\u8D85\u8FC7\u914D\u989D\u9650\u5236\u3002"],
+  ["MissingParameter", "\u7F3A\u5C11\u53C2\u6570\u9519\u8BEF\u3002"],
+  ["OperationDenied", "\u64CD\u4F5C\u88AB\u62D2\u7EDD\u3002"],
+  ["RequestLimitExceeded", "\u8BF7\u6C42\u7684\u6B21\u6570\u8D85\u8FC7\u4E86\u9891\u7387\u9650\u5236\u3002"],
+  ["ResourceInUse", "\u8D44\u6E90\u88AB\u5360\u7528\u3002"],
+  ["ResourceInsufficient", "\u8D44\u6E90\u4E0D\u8DB3\u3002"],
+  ["ResourceNotFound", "\u8D44\u6E90\u4E0D\u5B58\u5728\u3002"],
+  ["ResourceUnavailable", "\u8D44\u6E90\u4E0D\u53EF\u7528\u3002"],
+  ["ResourcesSoldOut", "\u8D44\u6E90\u552E\u7F44\u3002"],
+  ["UnauthorizedOperation", "\u672A\u6388\u6743\u64CD\u4F5C\u3002"],
+  ["UnknownParameter", "\u672A\u77E5\u53C2\u6570\u9519\u8BEF\u3002"],
+  ["UnsupportedOperation", "\u64CD\u4F5C\u4E0D\u652F\u6301\u3002"]
+];
+var COMMON_ERROR_SET = new Set(COMMON_ERROR_CODES.map(([c]) => c));
+var ERROR_CODE_FIXES = { "Missing\u6781arameter": "MissingParameter" };
+var VALID_RISK = /* @__PURE__ */ new Set(["read", "write", "destructive"]);
+function rewrite(text) {
+  if (!text) return text ?? "";
+  return text.split(OLD_BASE).join(NEW_BASE).split(OLD_HOST).join(NEW_HOST);
+}
+function cell(text) {
+  if (text === null || text === void 0) return "";
+  let s = String(text).trim();
+  s = s.split("|").join("\\|").replace(/\r\n/g, "\n").replace(/\n/g, "<br>");
+  return rewrite(s);
+}
+function schemaAnchor(name) {
+  return "schema-" + name;
+}
+function refName(ref) {
+  return ref.split("/").pop();
+}
+function typeOf(prop, link) {
+  if (!prop || typeof prop !== "object") return "";
+  if (prop.$ref) {
+    const n = refName(prop.$ref);
+    return link ? `[${n}](#${schemaAnchor(n)})` : n;
+  }
+  const t = prop.type;
+  if (t === "array") {
+    const items = prop.items || {};
+    if (items.$ref) {
+      const n = refName(items.$ref);
+      return link ? `Array of [${n}](#${schemaAnchor(n)})` : `Array of ${n}`;
+    }
+    return `Array of ${items.type || "object"}`;
+  }
+  if (t) return prop.format ? `${t} (${prop.format})` : t;
+  if (prop.properties) return "object";
+  return "";
+}
+function collectRefs(schema, schemas, seen) {
+  if (Array.isArray(schema)) {
+    for (const item of schema) collectRefs(item, schemas, seen);
+    return;
+  }
+  if (schema && typeof schema === "object") {
+    if (schema.$ref) {
+      const n = refName(schema.$ref);
+      if (!seen.has(n) && schemas[n]) {
+        seen.add(n);
+        collectRefs(schemas[n], schemas, seen);
+      }
+    }
+    for (const [k, v] of Object.entries(schema)) {
+      if (k === "$ref") continue;
+      collectRefs(v, schemas, seen);
+    }
+  }
+}
+function paramsTable(properties, required, lines) {
+  const keys = Object.keys(properties || {});
+  if (keys.length === 0) {
+    lines.push("_\u65E0_\n");
+    return;
+  }
+  lines.push("| \u53C2\u6570\u540D | \u7C7B\u578B | \u5FC5\u9009 | \u63CF\u8FF0 |");
+  lines.push("| --- | --- | --- | --- |");
+  for (const name of keys) {
+    const prop = properties[name] || {};
+    const req = required.has(name) ? "\u662F" : "\u5426";
+    lines.push(`| ${cell(name)} | ${typeOf(prop, true)} | ${req} | ${cell(prop.description)} |`);
+  }
+  lines.push("");
+}
+function paramMetas(properties, required) {
+  return Object.keys(properties || {}).map((name) => {
+    const prop = properties[name] || {};
+    return { name, type: typeOf(prop, false), required: required.has(name), description: prop.description ? rewrite(String(prop.description)).trim() : void 0 };
+  });
+}
+function reqSchemaOf(op) {
+  return op?.requestBody?.content?.["application/json"]?.schema || {};
+}
+function respPropsOf(op) {
+  const respSchema = op?.responses?.["200"]?.content?.["application/json"]?.schema || {};
+  return respSchema?.properties?.Response || {};
+}
+function specificErrors(op) {
+  const errs = (op["x-tcapi-errorcodes"] || []).map((e) => ERROR_CODE_FIXES[e] || e);
+  return [...new Set(errs)].filter((e) => !COMMON_ERROR_SET.has(e));
+}
+function renderAction(key, op, schemas, refAcc, lines) {
+  const action = op.operationId || key;
+  const title = op.summary || op["x-tcapi-action-name"] || action;
+  lines.push(`<a id="action-${action}"></a>`);
+  lines.push(`## ${title}\uFF08${action}\uFF09
+`);
+  lines.push(`**\u63A5\u53E3\u8BF7\u6C42\u65B9\u5F0F\u4E0E\u5730\u5740\uFF1A** \`POST ${NEW_BASE}/?action=${action}\`
+`);
+  if (op.description) lines.push(rewrite(op.description).trim() + "\n");
+  const reqSchema = reqSchemaOf(op);
+  lines.push("### \u8BF7\u6C42\u53C2\u6570\n");
+  paramsTable(reqSchema.properties || {}, new Set(reqSchema.required || []), lines);
+  collectRefs(reqSchema, schemas, refAcc);
+  const respProps = respPropsOf(op);
+  const outRequired = new Set(respProps["x-tcapi-output-required"] || []);
+  lines.push("### \u8FD4\u56DE\u53C2\u6570\n");
+  paramsTable(respProps.properties || {}, outRequired, lines);
+  const respSchema = op?.responses?.["200"]?.content?.["application/json"]?.schema || {};
+  collectRefs(respSchema, schemas, refAcc);
+  const errs = (op["x-tcapi-errorcodes"] || []).map((e) => ERROR_CODE_FIXES[e] || e);
+  const specific = specificErrors(op);
+  if (errs.length) {
+    lines.push("### \u9519\u8BEF\u7801\n");
+    if (specific.length) {
+      lines.push("\u672C\u63A5\u53E3\u7279\u6709\u9519\u8BEF\u7801\uFF1A\n");
+      lines.push(specific.map((e) => `\`${e}\``).join(", "));
+      lines.push("\n\u6B64\u5916\u8FD8\u53EF\u80FD\u8FD4\u56DE[\u516C\u5171\u9519\u8BEF\u7801](./README.md#\u516C\u5171\u9519\u8BEF\u7801)\u3002\n");
+    } else {
+      lines.push("\u672C\u63A5\u53E3\u53EF\u80FD\u8FD4\u56DE\u7684\u9519\u8BEF\u7801\u5747\u4E3A[\u516C\u5171\u9519\u8BEF\u7801](./README.md#\u516C\u5171\u9519\u8BEF\u7801)\u3002\n");
+    }
+  }
+  const examples = op["x-tcapi-examples"] || [];
+  if (examples.length) {
+    lines.push("### \u793A\u4F8B\n");
+    for (const ex of examples) {
+      const t = ex.title || ex.description || "\u793A\u4F8B";
+      lines.push(`**${cell(t)}**
+`);
+      if (ex.input) {
+        lines.push("\u8BF7\u6C42\uFF1A\n");
+        lines.push("```http");
+        lines.push(rewrite(ex.input).replace(/\s+$/, ""));
+        lines.push("```\n");
+      }
+      if (ex.output) {
+        lines.push("\u8FD4\u56DE\uFF1A\n");
+        lines.push("```json");
+        lines.push(rewrite(ex.output).replace(/\s+$/, ""));
+        lines.push("```\n");
+      }
+    }
+  }
+  lines.push("---\n");
+}
+function renderSchemaAppendix(refNames, schemas, lines) {
+  if (refNames.size === 0) return;
+  lines.push("## \u6570\u636E\u7ED3\u6784\n");
+  for (const name of [...refNames].sort()) {
+    const sch = schemas[name] || {};
+    lines.push(`<a id="${schemaAnchor(name)}"></a>`);
+    lines.push(`### ${name}
+`);
+    if (sch.description) lines.push(rewrite(sch.description).trim() + "\n");
+    if (sch.properties) {
+      paramsTable(sch.properties, new Set(sch.required || []), lines);
+    } else if (sch.type === "array") {
+      lines.push(`\u7C7B\u578B\uFF1A${typeOf(sch, true)}
+`);
+    } else {
+      lines.push(`\u7C7B\u578B\uFF1A${sch.type || "object"}
+`);
+    }
+  }
+}
+function slugIndex(tagsInOrder, usedTags) {
+  const ordered = tagsInOrder.map((t) => t.name).filter((n) => usedTags.has(n));
+  for (const t of usedTags) if (!ordered.includes(t)) ordered.push(t);
+  return ordered.map((t, i) => [String(i + 1).padStart(2, "0"), t]);
+}
+async function fetchText(url) {
+  const res = await fetch(url, { headers: { "User-Agent": "coding-openapi-docgen" } });
+  if (!res.ok) throw new Error(`GET ${url} -> HTTP ${res.status}`);
+  return res.text();
+}
+async function loadSpecText(specCache, opts) {
+  const haveCache = fs5.existsSync(specCache);
+  if (opts.offline) {
+    if (!haveCache) throw new Error(`--offline requires a cached spec at ${specCache}, but none exists.`);
+    return { text: fs5.readFileSync(specCache, "utf8"), source: specCache };
+  }
+  if (haveCache && !opts.forceRefresh) {
+    return { text: fs5.readFileSync(specCache, "utf8"), source: specCache };
+  }
+  const html = await fetchText(DOCS_PAGE);
+  const m = html.match(/DOCUMENT_YAML_URL"\s+content="([^"]+)"/);
+  if (!m) throw new Error("Could not find DOCUMENT_YAML_URL in the docs page.");
+  return { text: await fetchText(m[1]), source: m[1] };
+}
+function loadRiskOverrides(file) {
+  if (!fs5.existsSync(file)) return {};
+  let parsed;
+  try {
+    parsed = JSON.parse(fs5.readFileSync(file, "utf8"));
+  } catch (e) {
+    console.warn(`Ignoring malformed ${file}: ${e.message}`);
+    return {};
+  }
+  const out = {};
+  for (const [action, level] of Object.entries(parsed)) {
+    if (typeof level === "string" && VALID_RISK.has(level)) out[action] = level;
+    else console.warn(`Ignoring invalid risk override for ${action}: ${JSON.stringify(level)} (expected read|write|destructive)`);
+  }
+  return out;
+}
+function readExistingActions(indexOut) {
+  if (!fs5.existsSync(indexOut)) return /* @__PURE__ */ new Set();
+  try {
+    const idx = JSON.parse(fs5.readFileSync(indexOut, "utf8"));
+    return new Set(Object.keys(idx.actions || {}));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+function rmrf(p) {
+  try {
+    fs5.rmSync(p, { recursive: true, force: true });
+  } catch {
+  }
+}
+function atomicWriteFile(file, content) {
+  const tmp = `${file}.tmp-${process.pid}-${Date.now()}`;
+  fs5.writeFileSync(tmp, content);
+  fs5.renameSync(tmp, file);
+}
+function swapDir(targetDir, builtDir) {
+  const bak = `${targetDir}.bak-${process.pid}-${Date.now()}`;
+  const hadTarget = fs5.existsSync(targetDir);
+  if (hadTarget) fs5.renameSync(targetDir, bak);
+  try {
+    fs5.renameSync(builtDir, targetDir);
+  } catch (e) {
+    if (hadTarget && !fs5.existsSync(targetDir)) fs5.renameSync(bak, targetDir);
+    throw e;
+  }
+  rmrf(bak);
+}
+async function buildSpec(opts) {
+  const specCache = path4.join(opts.root, "spec", "coding-openapi.yaml");
+  const outDir = path4.join(opts.root, "docs");
+  const indexOut = path4.join(opts.root, "generated", "index.json");
+  const overridesFile = path4.join(opts.root, "risk-overrides.json");
+  const { text, source } = await loadSpecText(specCache, opts);
+  const spec = parseYaml(text);
+  const schemas = spec.components?.schemas || {};
+  const paths = spec.paths;
+  const overrides = loadRiskOverrides(overridesFile);
+  const groups = /* @__PURE__ */ new Map();
+  for (const [key, methods] of Object.entries(paths)) {
+    for (const op of Object.values(methods)) {
+      const tag = op.tags && op.tags[0] || "\u5176\u4ED6\u63A5\u53E3";
+      if (!groups.has(tag)) groups.set(tag, []);
+      groups.get(tag).push({ key, op });
+    }
+  }
+  const indexed = slugIndex(spec.tags || [], new Set(groups.keys()));
+  const index = {
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    source,
+    baseUrl: NEW_BASE,
+    total: 0,
+    categories: [],
+    actions: {}
+  };
+  const docFiles = [];
+  const tocRows = [];
+  for (const [nn, tag] of indexed) {
+    const ops = groups.get(tag);
+    ops.sort((a, b) => (a.op.operationId || a.key).localeCompare(b.op.operationId || b.key));
+    const fname = `${nn}-${tag}.md`;
+    const categoryLabel = `${nn}-${tag}`;
+    const lines = [`# ${tag}
+`, `> \u672C\u7C7B\u76EE\u5171 **${ops.length}** \u4E2A\u63A5\u53E3\u3002\u8BF7\u6C42\u57FA\u7840\u5730\u5740\uFF1A\`${NEW_BASE}\`
+`, "## \u63A5\u53E3\u5217\u8868\n"];
+    for (const { key, op } of ops) {
+      const action = op.operationId || key;
+      const title = op.summary || action;
+      lines.push(`- [${cell(title)}\uFF08${action}\uFF09](#action-${action})`);
+    }
+    lines.push("");
+    const refAcc = /* @__PURE__ */ new Set();
+    for (const { key, op } of ops) {
+      renderAction(key, op, schemas, refAcc, lines);
+      const action = op.operationId || key;
+      const reqSchema = reqSchemaOf(op);
+      const respProps = respPropsOf(op);
+      const examples = op["x-tcapi-examples"] || [];
+      const meta = {
+        summary: op.summary || op["x-tcapi-action-name"] || void 0,
+        category: categoryLabel,
+        description: op.description ? rewrite(op.description).trim() : void 0,
+        params: paramMetas(reqSchema.properties || {}, new Set(reqSchema.required || [])),
+        response: paramMetas(respProps.properties || {}, new Set(respProps["x-tcapi-output-required"] || [])),
+        errors: specificErrors(op),
+        risk: overrides[action] || classifyRisk(action),
+        example: examples[0]?.input ? rewrite(examples[0].input).trim() : void 0
+      };
+      index.actions[action] = meta;
+    }
+    renderSchemaAppendix(refAcc, schemas, lines);
+    docFiles.push({ name: fname, content: lines.join("\n").replace(/\s+$/, "") + "\n" });
+    tocRows.push([nn, tag, fname, ops.length]);
+  }
+  index.total = Object.keys(index.actions).length;
+  index.categories = tocRows.map(([nn, tag, , count]) => ({ slug: nn, name: tag, count }));
+  const info = spec.info || {};
+  const rd = [
+    `# ${info.title || "CODING OPEN API"}
+`,
+    `\u81EA\u6258\u7BA1\u5B9E\u4F8B OpenAPI \u63A5\u53E3\u6587\u6863\uFF08\u5171 **${index.total}** \u4E2A\u63A5\u53E3\uFF0C\u5206 **${tocRows.length}** \u4E2A\u7C7B\u76EE\uFF09\u3002
+`,
+    "## \u57FA\u7840\u4FE1\u606F\n",
+    `- **\u8BF7\u6C42\u57FA\u7840\u5730\u5740\uFF08Base URL\uFF09\uFF1A** \`${NEW_BASE}\``,
+    "- **\u8BF7\u6C42\u65B9\u5F0F\uFF1A** \u6240\u6709\u63A5\u53E3\u5747\u4E3A `POST`\uFF0C\u901A\u8FC7 `?action=<Action>` \u6307\u5B9A\u5177\u4F53\u63A5\u53E3",
+    "- **\u8BF7\u6C42/\u8FD4\u56DE\u683C\u5F0F\uFF1A** `application/json`",
+    `- **\u8BA4\u8BC1\u65B9\u5F0F\uFF1A** OAuth 2.0 / \u4E2A\u4EBA\u8BBF\u95EE\u4EE4\u724C / \u9879\u76EE\u4EE4\u724C\uFF08\u8BE6\u89C1 ${NEW_BASE.replace(/\/[^/]*$/, "")}\uFF09`,
+    "- **\u9891\u7387\u9650\u5236\uFF1A** \u5355\u56E2\u961F\u5355\u63A5\u53E3\u6BCF\u79D2\u6700\u591A 30 \u6B21\u8BF7\u6C42\n",
+    "## \u7C7B\u76EE\u7D22\u5F15\n",
+    "| # | \u7C7B\u76EE | \u63A5\u53E3\u6570 | \u6587\u6863 |",
+    "| --- | --- | --- | --- |"
+  ];
+  for (const [nn, tag, fname, count] of tocRows) rd.push(`| ${nn} | ${tag} | ${count} | [${fname}](./${fname.replace(/ /g, "%20")}) |`);
+  rd.push("");
+  rd.push("## \u516C\u5171\u9519\u8BEF\u7801\n");
+  rd.push("\u4EE5\u4E0B\u9519\u8BEF\u7801\u4E3A\u5404\u63A5\u53E3\u901A\u7528\uFF0C\u5355\u4E2A\u63A5\u53E3\u6587\u6863\u4E2D\u4EC5\u989D\u5916\u5217\u51FA\u5176\u7279\u6709\u9519\u8BEF\u7801\u3002\n");
+  rd.push("| \u9519\u8BEF\u7801 | \u63CF\u8FF0 |");
+  rd.push("| --- | --- |");
+  for (const [code, desc] of COMMON_ERROR_CODES) rd.push(`| \`${code}\` | ${desc} |`);
+  rd.push("");
+  const oldActions = readExistingActions(indexOut);
+  const newActions = new Set(Object.keys(index.actions));
+  const added = [...newActions].filter((a) => !oldActions.has(a)).sort();
+  const removed = [...oldActions].filter((a) => !newActions.has(a)).sort();
+  const readmeContent = rd.join("\n").replace(/\s+$/, "") + "\n";
+  const fetchedLive = /^https?:/i.test(source);
+  let wrote = false;
+  if (!opts.dryRun) {
+    const stagingDocs = `${outDir}.new-${process.pid}-${Date.now()}`;
+    try {
+      fs5.mkdirSync(stagingDocs, { recursive: true });
+      for (const f of docFiles) fs5.writeFileSync(path4.join(stagingDocs, f.name), f.content);
+      fs5.writeFileSync(path4.join(stagingDocs, "README.md"), readmeContent);
+      swapDir(outDir, stagingDocs);
+      fs5.mkdirSync(path4.dirname(indexOut), { recursive: true });
+      atomicWriteFile(indexOut, JSON.stringify(index) + "\n");
+      if (fetchedLive) {
+        fs5.mkdirSync(path4.dirname(specCache), { recursive: true });
+        atomicWriteFile(specCache, text);
+      }
+      wrote = true;
+    } catch (e) {
+      rmrf(stagingDocs);
+      throw e;
+    }
+  }
+  return { total: index.total, categories: index.categories, added, removed, wrote, source };
+}
+
+// src/commands/update.ts
+async function cmdUpdate(_ctx, opts) {
+  const root = packageRoot();
+  let result;
+  try {
+    result = await buildSpec({ root, offline: opts.offline, forceRefresh: !opts.offline, dryRun: opts.dryRun });
+  } catch (e) {
+    throw new CliError(EXIT.REMOTE, {
+      type: "update_failed",
+      message: e.message,
+      hint: opts.offline ? "No cached spec to rebuild from." : "Spec fetch failed; retry, or use `coding update --offline` if a cached spec exists."
+    });
+  }
+  return {
+    data: {
+      root,
+      source: result.source,
+      total: result.total,
+      categories: result.categories.length,
+      added: result.added,
+      removed: result.removed,
+      wrote: result.wrote,
+      note: opts.dryRun ? "dry-run: nothing written" : result.wrote ? "index + docs regenerated" : "no changes"
+    }
+  };
+}
+
+// src/cli.ts
+function readVersion() {
+  try {
+    return JSON.parse(fs6.readFileSync(path5.join(packageRoot(), "package.json"), "utf8")).version || "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+function ctxOf(cmd) {
+  const o = cmd.optsWithGlobals();
+  return { json: !!o.json, profile: resolveProfileName(o.profile), cliBaseUrl: o.baseUrl };
+}
+async function run(cmd, fn) {
+  const ctx = ctxOf(cmd);
+  try {
+    const result = await fn(ctx);
+    process.stdout.write(renderEnvelope(success(result.data, { action: result.action, requestId: result.requestId, warnings: result.warnings }), ctx.json) + "\n");
+    process.exit(EXIT.OK);
+  } catch (e) {
+    const err = e instanceof CliError ? e : new CliError(EXIT.INTERNAL, { type: "internal", message: e.message || String(e) });
+    process.stderr.write(renderEnvelope(errorEnvelope(err), ctx.json) + "\n");
+    process.exit(err.exit);
+  }
+}
+function collect(value, acc) {
+  acc.push(value);
+  return acc;
+}
+function parseLimit(value) {
+  const n = Number(value);
+  if (!Number.isInteger(n) || n < 0) {
+    throw new CliError(EXIT.USAGE, { type: "bad_option", message: `--limit must be a non-negative integer (got "${value}")` });
+  }
+  return n;
+}
+function main() {
+  const program = new Command();
+  program.name("coding").description("Agent-first CLI for a self-hosted CODING instance (generic OpenAPI passthrough).").version(readVersion()).option("--json", "emit a machine-readable JSON envelope").option("--profile <name>", "config profile to use").option("--base-url <url>", "override the instance base URL");
+  const config = program.command("config").description("manage instance config");
+  config.command("init").description("write ~/.coding/config.json (use --base-url to set the instance URL)").action((_opts, cmd) => run(cmd, (ctx) => cmdConfigInit(ctx, cmd.optsWithGlobals().baseUrl)));
+  config.command("show").description("show resolved config and whether a token is present").action((_opts, cmd) => run(cmd, (ctx) => cmdConfigShow(ctx)));
+  const auth = program.command("auth").description("manage the access token");
+  auth.command("login").description("store a token (hidden prompt by default; use --token - to read stdin)").option("--token <src>", "pass '-' to read the token from stdin").action((opts, cmd) => run(cmd, (ctx) => cmdAuthLogin(ctx, opts.token === "-")));
+  auth.command("status").description("verify credentials via DescribeCodingCurrentUser").action((_opts, cmd) => run(cmd, (ctx) => cmdAuthStatus(ctx)));
+  program.command("whoami").description("alias of `auth status`").action((_opts, cmd) => run(cmd, (ctx) => cmdAuthStatus(ctx)));
+  program.command("categories").description("list the API categories").action((_opts, cmd) => run(cmd, (ctx) => cmdCategories(ctx)));
+  program.command("actions").description("list/search actions in the bundled index").option("-s, --search <keyword>", "filter by name/summary/description").option("-c, --category <category>", "filter by category slug or name").action((opts, cmd) => run(cmd, (ctx) => cmdActions(ctx, opts)));
+  program.command("schema <action>").description("show an action's params, response fields, errors and risk").action((action, _opts, cmd) => run(cmd, (ctx) => cmdSchema(ctx, action)));
+  program.command("update").description("refresh the bundled action index + docs from the live CODING spec").option("--offline", "rebuild from the cached spec instead of fetching", false).option("--dry-run", "report what would change without writing", false).action((opts, cmd) => run(cmd, (ctx) => cmdUpdate(ctx, { offline: !!opts.offline, dryRun: !!opts.dryRun })));
+  program.command("call <action>").description("invoke any action (generic passthrough)").option("-d, --data <src>", "JSON body: inline string, @file, or - for stdin").option("-p, --param <Key=Value>", "set one param (repeatable); coerced by index type", collect, []).option("--select <paths>", "comma-separated dotpaths to project from the response").option("--limit <n>", "truncate response arrays to the first N items", parseLimit).option("--dry-run", "print the request without sending (never trips the confirm gate)", false).option("--force", "bypass client-side validation (alias of --no-validate)", false).option("--no-validate", "bypass client-side validation").option("-y, --yes", "confirm a destructive (exit-10) action", false).action(
+    (action, opts, cmd) => run(
+      cmd,
+      (ctx) => cmdCall(ctx, action, {
+        data: opts.data,
+        param: opts.param,
+        select: opts.select,
+        limit: opts.limit,
+        dryRun: !!opts.dryRun,
+        force: !!opts.force || opts.validate === false,
+        yes: !!opts.yes
+      })
+    )
+  );
+  const applyOverride = (cmd) => {
+    cmd.exitOverride();
+    cmd.configureOutput({ writeErr: () => {
+    } });
+    cmd.commands.forEach(applyOverride);
+  };
+  applyOverride(program);
+  program.parseAsync(process.argv).catch((e) => {
+    const ce = e;
+    if (ce && (ce.code === "commander.helpDisplayed" || ce.code === "commander.help" || ce.code === "commander.version")) {
+      process.exit(0);
+    }
+    const json = process.argv.includes("--json");
+    const err = e instanceof CliError ? e : new CliError(EXIT.USAGE, { type: "usage", message: ce?.message || String(e) });
+    process.stderr.write(renderEnvelope(errorEnvelope(err), json) + "\n");
+    process.exit(err.exit);
+  });
+}
+main();