@wcs-edu-os/cli 0.0.0-stage → 0.1.1

package/dist/index.js

@@ -0,0 +1,1446 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { stdin, stdout, stderr } from "process";
+
+// src/program.ts
+import { Command, CommanderError, Option } from "commander";
+
+// ../core/src/registry.ts
+import { z } from "zod";
+var intOption = (min, max) => z.coerce.number().int().min(min).max(max);
+var idSchema = z.string().min(1).describe("\u8D44\u6E90 ID\uFF0C\u59CB\u7EC8\u6309\u5B57\u7B26\u4E32\u5904\u7406");
+var emptySchema = z.object({}).strict();
+var anyOutput = z.unknown();
+var requiredText = z.string().trim().min(1);
+var nonNegativeDecimal = z.string().regex(/^\d+(?:\.\d+)?$/, "\u5FC5\u987B\u662F\u975E\u8D1F\u5341\u8FDB\u5236\u5B57\u7B26\u4E32");
+var date = z.string().regex(/^\d{4}-\d{2}-\d{2}$/, "\u65E5\u671F\u683C\u5F0F\u5FC5\u987B\u4E3A yyyy-MM-dd");
+var dateTime = z.string().regex(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/, "\u65F6\u95F4\u683C\u5F0F\u5FC5\u987B\u4E3A yyyy-MM-dd HH:mm:ss");
+var binary = z.number().int().min(0).max(1);
+var writeInputSchema = z.object({ input: requiredText }).strict();
+var writeOptions = [{ flags: "--input <path>", description: "JSON \u8F93\u5165\u6587\u4EF6\uFF0C- \u8868\u793A stdin" }];
+var pageOptions = [
+  { flags: "--page <number>", description: "\u8D77\u59CB\u9875\u7801", defaultValue: 1 },
+  { flags: "--size <number>", description: "\u6BCF\u9875\u6570\u91CF", defaultValue: 20 },
+  { flags: "--max-items <number>", description: "\u8DE8\u9875\u6700\u591A\u62C9\u53D6\u6761\u6570", defaultValue: 100 },
+  { flags: "--filter <key=value...>", description: "\u900F\u4F20\u540E\u7AEF\u7B5B\u9009\u5B57\u6BB5\uFF0C\u53EF\u91CD\u590D", collect: true },
+  { flags: "--name <name>", description: "\u540D\u79F0\u7B5B\u9009" },
+  { flags: "--keyword <keyword>", description: "\u5173\u952E\u5B57\u7B5B\u9009" },
+  { flags: "--mobile <mobile>", description: "\u624B\u673A\u53F7\u7B5B\u9009" },
+  { flags: "--status-id <statusId>", description: "\u72B6\u6001\u7B5B\u9009" },
+  { flags: "--user-id <userId>", description: "\u7528\u6237 ID" },
+  { flags: "--course-id <courseId>", description: "\u8BFE\u7A0B ID" },
+  { flags: "--task-id <taskId>", description: "\u4EFB\u52A1 ID" }
+];
+var pageSchema = z.object({
+  page: intOption(1, 1e6).default(1),
+  size: intOption(1, 500).default(20),
+  maxItems: intOption(1, 1e5).default(100),
+  filter: z.array(z.string()).default([]),
+  name: z.string().optional(),
+  keyword: z.string().optional(),
+  mobile: z.string().optional(),
+  statusId: z.string().optional(),
+  userId: idSchema.optional(),
+  courseId: idSchema.optional(),
+  taskId: idSchema.optional()
+});
+var idInput = z.object({ id: idSchema });
+var courseInput = z.object({ courseId: idSchema });
+var defaultTable = [
+  { key: "id", label: "ID" },
+  { key: "name", label: "\u540D\u79F0" },
+  { key: "statusId", label: "\u72B6\u6001" }
+];
+function endpoint(method, path, controller, requestDto, responseDto, pagination = false) {
+  return { method, path, controller, requestDto, responseDto, pagination };
+}
+function spec(value2) {
+  return {
+    ...value2,
+    risk: "R0",
+    readOnly: true,
+    supportsDryRun: false,
+    supportsIdempotency: false,
+    sideEffects: [],
+    rollback: null,
+    implemented: true,
+    outputSchema: anyOutput
+  };
+}
+function writeSpec(value2) {
+  return {
+    ...value2,
+    risk: "R1",
+    readOnly: false,
+    supportsDryRun: true,
+    supportsIdempotency: true,
+    inputSchema: writeInputSchema,
+    options: writeOptions,
+    implemented: true,
+    outputSchema: anyOutput
+  };
+}
+var userCreatePayload = z.object({
+  mobile: requiredText.max(11),
+  mobilePwd: requiredText,
+  userSex: z.number().int().min(1).max(3),
+  userHead: requiredText,
+  remark: z.string().max(200).optional(),
+  userAge: date.optional(),
+  school: z.string().optional(),
+  realName: z.string().optional(),
+  nickname: z.string().optional(),
+  tagIds: z.array(idSchema).optional()
+}).strict();
+var userUpdatePayload = z.object({
+  id: idSchema,
+  userSex: z.number().int().min(1).max(3).optional(),
+  nickname: z.string().optional(),
+  realName: z.string().max(20).optional(),
+  idCard: z.string().max(18).optional(),
+  faceImg: z.string().optional(),
+  faceError: z.number().int().min(0).optional(),
+  faceStatus: z.boolean().optional(),
+  userAge: date.nullable(),
+  school: z.string().optional(),
+  userHead: z.string().optional(),
+  remark: z.string().max(200).optional(),
+  tagIds: z.array(idSchema)
+}).strict();
+function coursePayload(includeId) {
+  return z.object({
+    ...includeId ? { id: idSchema } : {},
+    lecturerId: idSchema,
+    categoryId: idSchema,
+    courseName: requiredText.max(120),
+    courseLogo: requiredText,
+    introduce: z.string().optional(),
+    countVirtualStudy: z.number().int().min(0).optional(),
+    countVirtualBuy: z.number().int().min(0).optional(),
+    linePrice: nonNegativeDecimal,
+    price: nonNegativeDecimal,
+    publishStatus: binary,
+    speedDouble: binary,
+    speedDrag: binary,
+    checkIn: binary,
+    studyMode: z.number().int().min(1).max(2),
+    validityDateType: z.number().int().min(1).max(3),
+    days: z.number().int().min(1).optional(),
+    beginTime: dateTime.optional(),
+    endTime: dateTime.optional(),
+    courseSell: z.boolean().optional(),
+    certSet: z.boolean().optional(),
+    certStudyProgress: nonNegativeDecimal.optional(),
+    certId: idSchema.optional()
+  }).strict().superRefine(validateValidity);
+}
+function validateValidity(payload, context) {
+  if (payload.validityDateType === 2 && payload.days === void 0) {
+    context.addIssue({ code: "custom", path: ["days"], message: "\u6709\u6548\u671F\u7C7B\u578B\u4E3A 2 \u65F6\u5FC5\u987B\u63D0\u4F9B days" });
+  }
+  if (payload.validityDateType === 3) {
+    if (!payload.beginTime) context.addIssue({ code: "custom", path: ["beginTime"], message: "\u6709\u6548\u671F\u7C7B\u578B\u4E3A 3 \u65F6\u5FC5\u987B\u63D0\u4F9B beginTime" });
+    if (!payload.endTime) context.addIssue({ code: "custom", path: ["endTime"], message: "\u6709\u6548\u671F\u7C7B\u578B\u4E3A 3 \u65F6\u5FC5\u987B\u63D0\u4F9B endTime" });
+    if (typeof payload.beginTime === "string" && typeof payload.endTime === "string" && payload.beginTime > payload.endTime) {
+      context.addIssue({ code: "custom", path: ["endTime"], message: "endTime \u4E0D\u80FD\u65E9\u4E8E beginTime" });
+    }
+  }
+}
+var noArgs = [];
+function adminPage(name, segments, description, path, controller, requestDto, responseDto, method = "GET") {
+  return spec({
+    name,
+    segments,
+    description,
+    permissionHint: null,
+    kind: "api",
+    arguments: noArgs,
+    options: pageOptions,
+    inputSchema: pageSchema,
+    endpoints: [endpoint(method, path, controller, requestDto, responseDto, true)],
+    table: defaultTable
+  });
+}
+function adminGet(name, segments, description, path, controller, requestDto, responseDto) {
+  return spec({
+    name,
+    segments,
+    description,
+    permissionHint: null,
+    kind: "api",
+    arguments: [{ name: "id", description: "\u8D44\u6E90 ID", required: true }],
+    options: [],
+    inputSchema: idInput,
+    endpoints: [endpoint("GET", path, controller, requestDto, responseDto)],
+    table: []
+  });
+}
+var commandRegistry = [
+  spec({ name: "version", segments: ["version"], description: "\u663E\u793A CLI \u7248\u672C", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [], table: [] }),
+  spec({ name: "guide", segments: ["guide"], description: "\u67E5\u770B\u5B89\u88C5\u3001\u8BA4\u8BC1\u548C\u4E1A\u52A1\u64CD\u4F5C\u5F15\u5BFC", permissionHint: null, kind: "local", arguments: [{ name: "topic", description: "\u4E3B\u9898\uFF1Agetting-started|course|exam|write|all", required: false }], options: [], inputSchema: z.object({ topic: z.enum(["getting-started", "course", "exam", "write", "all"]).default("all") }), endpoints: [], table: [{ key: "title", label: "\u4E3B\u9898" }, { key: "summary", label: "\u8BF4\u660E" }] }),
+  spec({ name: "capabilities", segments: ["capabilities"], description: "\u5217\u51FA\u547D\u4EE4\u53CA\u5F53\u524D\u8C03\u7528\u80FD\u529B", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [], table: defaultTable }),
+  spec({ name: "schema", segments: ["schema"], description: "\u8F93\u51FA\u6307\u5B9A\u547D\u4EE4\u7684 Zod JSON Schema", permissionHint: null, kind: "local", arguments: [{ name: "command", description: "\u547D\u4EE4\u540D\uFF08\u70B9\u53F7\u6216\u7A7A\u683C\u5206\u9694\uFF09", required: true }], options: [], inputSchema: z.object({ command: z.string().min(1) }), endpoints: [], table: [] }),
+  spec({ name: "doctor", segments: ["doctor"], description: "\u68C0\u67E5\u8FD0\u884C\u73AF\u5883\u3001\u914D\u7F6E\u3001\u51ED\u636E\u548C\u540E\u7AEF\u8FDE\u901A\u6027", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [], table: [{ key: "check", label: "\u68C0\u67E5\u9879" }, { key: "status", label: "\u72B6\u6001" }, { key: "message", label: "\u8BF4\u660E" }] }),
+  spec({ name: "auth.status", segments: ["auth", "status"], description: "\u68C0\u67E5\u672C\u5730\u8BA4\u8BC1\u72B6\u6001\uFF0C\u4E0D\u8BBF\u95EE\u7F51\u7EDC", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [], table: [] }),
+  spec({ name: "auth.whoami", segments: ["auth", "whoami"], description: "\u83B7\u53D6\u5F53\u524D\u7ED1\u5B9A\u7BA1\u7406\u5458\u4FE1\u606F", permissionHint: null, kind: "api", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [endpoint("GET", "/base/admin/login/user", "AdminLoginController", "-", "AdminLoginUserResp")], table: [] }),
+  spec({ name: "auth.test", segments: ["auth", "test"], description: "\u7B7E\u53D1\u5E76\u9A8C\u8BC1 CLI token", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [endpoint("POST", "/base/api/cli/token", "ApiCliTokenController", "OAuth client_credentials", "ApiCliTokenResp")], table: [] }),
+  spec({ name: "auth.credential-info", segments: ["auth", "credential-info"], description: "\u663E\u793A\u8131\u654F\u51ED\u636E\u4E0E token \u4FE1\u606F", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [], table: [] }),
+  spec({ name: "profile.list", segments: ["profile", "list"], description: "\u5217\u51FA Profile", permissionHint: null, kind: "local", arguments: noArgs, options: [], inputSchema: emptySchema, endpoints: [], table: [{ key: "name", label: "\u540D\u79F0" }, { key: "baseUrl", label: "Base URL" }, { key: "current", label: "\u5F53\u524D" }] }),
+  spec({ name: "profile.get", segments: ["profile", "get"], description: "\u67E5\u770B Profile", permissionHint: null, kind: "local", arguments: [{ name: "name", description: "Profile \u540D\u79F0", required: false }], options: [], inputSchema: z.object({ name: z.string().optional() }), endpoints: [], table: [] }),
+  spec({ name: "profile.use", segments: ["profile", "use"], description: "\u5207\u6362 Profile\uFF0C\u53EF\u540C\u65F6\u521B\u5EFA\u6216\u66F4\u65B0 base URL", permissionHint: null, kind: "local", arguments: [{ name: "name", description: "Profile \u540D\u79F0", required: true }], options: [{ flags: "--base-url <url>", description: "\u521B\u5EFA\u6216\u66F4\u65B0 Profile \u7684 base URL" }], inputSchema: z.object({ name: z.string().min(1), baseUrl: z.string().url().optional() }), endpoints: [], table: [] }),
+  spec({ name: "user.list", segments: ["user", "list"], description: "\u5206\u9875\u5217\u51FA\u7528\u6237", permissionHint: "\u5019\u9009: user:view", kind: "api", arguments: noArgs, options: pageOptions, inputSchema: pageSchema, endpoints: [endpoint("POST", "/base/admin/users/page", "AdminUsersController", "AdminUsersPageReq", "Page<AdminUsersPageResp>", true)], table: [{ key: "id", label: "ID" }, { key: "realName", label: "\u59D3\u540D" }, { key: "mobile", label: "\u624B\u673A\u53F7" }, { key: "statusId", label: "\u72B6\u6001" }] }),
+  spec({ name: "user.get", segments: ["user", "get"], description: "\u67E5\u770B\u7528\u6237", permissionHint: "\u5019\u9009: user:view", kind: "api", arguments: [{ name: "id", description: "\u7528\u6237 ID", required: true }], options: [], inputSchema: idInput, endpoints: [endpoint("GET", "/base/admin/users/view", "AdminUsersController", "id", "AdminUsersViewResp")], table: [] }),
+  spec({ name: "user.situation", segments: ["user", "situation"], description: "\u67E5\u770B\u7528\u6237\u5185\u5BB9\u6982\u51B5", permissionHint: "\u5019\u9009: user:record", kind: "api", arguments: [{ name: "id", description: "\u7528\u6237 ID", required: true }], options: [], inputSchema: idInput, endpoints: [endpoint("GET", "/base/admin/users/situation", "AdminUsersController", "id", "AdminUsersSituationResp")], table: [] }),
+  spec({ name: "user.account", segments: ["user", "account"], description: "\u67E5\u770B\u7528\u6237\u8D26\u6237", permissionHint: "\u5019\u9009: user:record", kind: "api", arguments: [{ name: "id", description: "\u7528\u6237 ID", required: true }], options: [], inputSchema: idInput, endpoints: [endpoint("GET", "/base/admin/users/account", "AdminUsersController", "id", "AdminUsersViewAccountResp")], table: [] }),
+  writeSpec({ name: "user.create", segments: ["user", "create"], description: "\u521B\u5EFA\u7528\u6237", permissionHint: "user:add", kind: "api", arguments: noArgs, payloadSchema: userCreatePayload, endpoints: [endpoint("POST", "/base/admin/users/save", "AdminUsersController", "AdminUsersSaveReq", "String")], table: [], sideEffects: ["\u521B\u5EFA\u7528\u6237\u53CA\u5173\u8054\u6807\u7B7E", "\u4FDD\u5B58\u52A0\u5BC6\u540E\u7684\u767B\u5F55\u5BC6\u7801"], rollback: "\u53EF\u901A\u8FC7\u7BA1\u7406\u7AEF\u5220\u9664\u672A\u4EA7\u751F\u4E1A\u52A1\u8BB0\u5F55\u7684\u7528\u6237" }),
+  writeSpec({ name: "user.update", segments: ["user", "update"], description: "\u5B8C\u6574\u66F4\u65B0\u7528\u6237\u8D44\u6599", permissionHint: "user:edit", kind: "api", arguments: noArgs, payloadSchema: userUpdatePayload, endpoints: [endpoint("PUT", "/base/admin/users/edit", "AdminUsersController", "AdminUsersEditReq", "String")], table: [], sideEffects: ["\u66F4\u65B0\u7528\u6237\u8D44\u6599", "\u66FF\u6362\u5168\u90E8\u7528\u6237\u6807\u7B7E", "\u6309 userAge \u663E\u5F0F\u503C\u66F4\u65B0\u6216\u6E05\u7A7A\u51FA\u751F\u65E5\u671F"], rollback: "\u9700\u4F7F\u7528\u53D8\u66F4\u524D\u6570\u636E\u518D\u6B21\u6267\u884C update" }),
+  spec({ name: "course.list", segments: ["course", "list"], description: "\u5206\u9875\u5217\u51FA\u8BFE\u7A0B", permissionHint: "\u5019\u9009: course:view", kind: "api", arguments: noArgs, options: pageOptions, inputSchema: pageSchema, endpoints: [endpoint("POST", "/resource/admin/course/page", "AdminCourseController", "AdminCoursePageReq", "Page<AdminCoursePageResp>", true)], table: defaultTable }),
+  spec({ name: "course.get", segments: ["course", "get"], description: "\u67E5\u770B\u8BFE\u7A0B", permissionHint: "\u5019\u9009: course:view", kind: "api", arguments: [{ name: "id", description: "\u8BFE\u7A0B ID", required: true }], options: [], inputSchema: idInput, endpoints: [endpoint("GET", "/resource/admin/course/view", "AdminCourseController", "id", "AdminCourseViewResp")], table: [] }),
+  writeSpec({ name: "course.create", segments: ["course", "create"], description: "\u521B\u5EFA\u8BFE\u7A0B", permissionHint: "course:save", kind: "api", arguments: noArgs, payloadSchema: coursePayload(false), endpoints: [endpoint("POST", "/resource/admin/course/save", "AdminCourseController", "AdminCourseSaveReq", "String")], table: [], sideEffects: ["\u521B\u5EFA\u8BFE\u7A0B\u8BB0\u5F55"], rollback: "\u53EF\u901A\u8FC7\u7BA1\u7406\u7AEF\u5220\u9664\u672A\u4EA7\u751F\u5173\u8054\u6570\u636E\u7684\u8BFE\u7A0B" }),
+  writeSpec({ name: "course.update", segments: ["course", "update"], description: "\u5B8C\u6574\u66F4\u65B0\u8BFE\u7A0B", permissionHint: "course:edit", kind: "api", arguments: noArgs, payloadSchema: coursePayload(true), endpoints: [endpoint("PUT", "/resource/admin/course/edit", "AdminCourseController", "AdminCourseEditReq", "String")], table: [], sideEffects: ["\u66F4\u65B0\u8BFE\u7A0B\u914D\u7F6E\u3001\u4EF7\u683C\u4E0E\u6709\u6548\u671F"], rollback: "\u9700\u4F7F\u7528\u53D8\u66F4\u524D\u6570\u636E\u518D\u6B21\u6267\u884C update" }),
+  spec({ name: "course.chapter.list", segments: ["course", "chapter", "list"], description: "\u5217\u51FA\u8BFE\u7A0B\u7AE0\u8282", permissionHint: "\u5019\u9009: course:chapter:period", kind: "api", arguments: [{ name: "courseId", description: "\u8BFE\u7A0B ID", required: true }], options: [], inputSchema: courseInput, endpoints: [endpoint("GET", "/resource/admin/course/chapter/list", "AdminCourseChapterController", "courseId", "List<AdminCourseChapterListResp>")], table: defaultTable }),
+  spec({ name: "course.chapter.get", segments: ["course", "chapter", "get"], description: "\u67E5\u770B\u8BFE\u7A0B\u7AE0\u8282", permissionHint: "\u5019\u9009: course:chapter:period", kind: "api", arguments: [{ name: "id", description: "\u7AE0\u8282 ID", required: true }], options: [], inputSchema: idInput, endpoints: [endpoint("GET", "/resource/admin/course/chapter/view", "AdminCourseChapterController", "id", "AdminCourseChapterViewResp")], table: [] }),
+  spec({ name: "course-study.list", segments: ["course-study", "list"], description: "\u5206\u9875\u5217\u51FA\u8BFE\u7A0B\u5B66\u4E60\u8BB0\u5F55", permissionHint: "\u5019\u9009: user:course", kind: "api", arguments: noArgs, options: pageOptions, inputSchema: pageSchema, endpoints: [endpoint("GET", "/resource/admin/course/user/study/page", "AdminCourseUserStudyController", "AdminCourseUserStudyPageReq", "Page<AdminCourseUserStudyPageResp>", true)], table: [{ key: "id", label: "ID" }, { key: "userId", label: "\u7528\u6237 ID" }, { key: "courseId", label: "\u8BFE\u7A0B ID" }, { key: "studyProgress", label: "\u8FDB\u5EA6" }] }),
+  spec({ name: "course-study.get", segments: ["course-study", "get"], description: "\u67E5\u770B\u8BFE\u7A0B\u5B66\u4E60\u8BB0\u5F55", permissionHint: "\u5019\u9009: user:course", kind: "api", arguments: [{ name: "id", description: "\u5B66\u4E60\u8BB0\u5F55 ID", required: true }], options: [], inputSchema: idInput, endpoints: [endpoint("GET", "/resource/admin/course/user/study/view", "AdminCourseUserStudyController", "id", "AdminCourseUserStudyViewResp")], table: [] }),
+  spec({ name: "statistics.dashboard", segments: ["statistics", "dashboard"], description: "\u5E76\u884C\u83B7\u53D6\u7BA1\u7406\u7AEF\u4EEA\u8868\u76D8\u7EDF\u8BA1", permissionHint: "\u5019\u9009: dashboard:view", kind: "dashboard", arguments: noArgs, options: [{ flags: "--dates <days>", description: "\u8D8B\u52BF\u7A97\u53E3\uFF0C\u6CBF\u7528 Admin dates \u53C2\u6570", defaultValue: -14 }], inputSchema: z.object({ dates: z.coerce.number().int().min(-3650).max(3650).default(-14) }), endpoints: [
+    endpoint("GET", "/base/admin/dashboard/stat/data", "AdminDashboardController", "-", "AdminDashboardDataResp"),
+    endpoint("GET", "/base/admin/dashboard/stat/login", "AdminDashboardController", "dates", "AdminDashboardLoginResp"),
+    endpoint("GET", "/base/admin/dashboard/stat/order", "AdminDashboardController", "dates", "AdminDashboardOrderResp")
+  ], table: [] }),
+  // Admin menu read-only coverage. Write operations remain gated until their DTO and risk contract are added.
+  adminPage("category.list", ["category", "list"], "\u5206\u9875\u5217\u51FA\u8BFE\u7A0B\u5206\u7C7B", "/resource/admin/category/page", "AdminCategoryController", "AdminCategoryPageReq", "Page<AdminCategoryPageResp>"),
+  adminGet("category.get", ["category", "get"], "\u67E5\u770B\u8BFE\u7A0B\u5206\u7C7B", "/resource/admin/category/view", "AdminCategoryController", "id", "AdminCategoryViewResp"),
+  adminPage("lecturer.list", ["lecturer", "list"], "\u5206\u9875\u5217\u51FA\u8BB2\u5E08", "/base/admin/lecturer/page", "AdminLecturerController", "AdminLecturerPageReq", "Page<AdminLecturerPageResp>"),
+  adminGet("lecturer.get", ["lecturer", "get"], "\u67E5\u770B\u8BB2\u5E08", "/base/admin/lecturer/view", "AdminLecturerController", "id", "AdminLecturerViewResp"),
+  adminPage("question.list", ["question", "list"], "\u5206\u9875\u5217\u51FA\u8BD5\u9898", "/resource/admin/question/page", "AdminQuestionController", "AdminQuestionPageReq", "Page<AdminQuestionPageResp>", "POST"),
+  adminGet("question.get", ["question", "get"], "\u67E5\u770B\u8BD5\u9898", "/resource/admin/question/view", "AdminQuestionController", "id", "AdminQuestionViewResp"),
+  adminPage("paper.list", ["paper", "list"], "\u5206\u9875\u5217\u51FA\u8BD5\u5377", "/resource/admin/paper/page", "AdminPaperController", "AdminPaperPageReq", "Page<AdminPaperPageResp>"),
+  adminGet("paper.get", ["paper", "get"], "\u67E5\u770B\u8BD5\u5377", "/resource/admin/paper/view", "AdminPaperController", "id", "AdminPaperViewResp"),
+  adminPage("exam.list", ["exam", "list"], "\u5206\u9875\u5217\u51FA\u8003\u8BD5", "/resource/admin/exam/page", "AdminExamController", "AdminExamPageReq", "Page<AdminExamPageResp>", "POST"),
+  adminGet("exam.get", ["exam", "get"], "\u67E5\u770B\u8003\u8BD5", "/resource/admin/exam/view", "AdminExamController", "id", "AdminExamViewResp"),
+  adminPage("material.list", ["material", "list"], "\u5206\u9875\u5217\u51FA\u7D20\u6750", "/resource/admin/material/page", "AdminMaterialController", "AdminMaterialPageReq", "Page<AdminMaterialPageResp>", "POST"),
+  adminGet("material.get", ["material", "get"], "\u67E5\u770B\u7D20\u6750", "/resource/admin/material/view", "AdminMaterialController", "id", "AdminMaterialViewResp")
+];
+var notImplementedCapabilities = [
+  { name: "statistics.course", reason: "\u7F3A\u5C11\u7A33\u5B9A\u7EDF\u4E00\u540E\u7AEF\u5951\u7EA6", risk: "R0", readOnly: true },
+  { name: "statistics.task", reason: "\u7F3A\u5C11\u7A33\u5B9A\u7EDF\u4E00\u540E\u7AEF\u5951\u7EA6", risk: "R0", readOnly: true },
+  { name: "statistics.user", reason: "\u7F3A\u5C11\u7A33\u5B9A\u7EDF\u4E00\u540E\u7AEF\u5951\u7EA6", risk: "R0", readOnly: true },
+  { name: "job.status", reason: "\u7F3A\u5C11\u7EDF\u4E00\u4EFB\u52A1\u72B6\u6001\u6A21\u578B", risk: "R0", readOnly: true },
+  { name: "job.wait", reason: "\u7F3A\u5C11\u7EDF\u4E00\u4EFB\u52A1\u72B6\u6001\u6A21\u578B", risk: "R0", readOnly: true },
+  { name: "training-task.assign", reason: "R2 \u6279\u91CF\u6307\u6D3E\u4E0D\u5728\u672C\u9636\u6BB5\u8303\u56F4", risk: "R2", readOnly: false },
+  { name: "user.enable", reason: "R2 \u72B6\u6001\u64CD\u4F5C\u4E0D\u5728\u672C\u9636\u6BB5\u8303\u56F4", risk: "R2", readOnly: false },
+  { name: "user.disable", reason: "R2 \u72B6\u6001\u64CD\u4F5C\u4E0D\u5728\u672C\u9636\u6BB5\u8303\u56F4", risk: "R2", readOnly: false },
+  { name: "course-study.import", reason: "R2 \u5BFC\u5165\u4EFB\u52A1\u4E0D\u5728\u672C\u9636\u6BB5\u8303\u56F4", risk: "R2", readOnly: false },
+  { name: "course.publish", reason: "R2 \u53D1\u5E03\u64CD\u4F5C\u4E0D\u5728\u672C\u9636\u6BB5\u8303\u56F4", risk: "R2", readOnly: false },
+  { name: "resource.delete", reason: "R3 \u5220\u9664\u64CD\u4F5C\u4E0D\u5728\u672C\u9636\u6BB5\u8303\u56F4", risk: "R3", readOnly: false }
+];
+function findCommand(name) {
+  const normalized = name.trim().replace(/\s+/g, ".");
+  return commandRegistry.find((item) => item.name === normalized);
+}
+
+// ../core/src/capabilities.ts
+function getCapabilities(apis) {
+  return [
+    ...commandRegistry.map((spec2) => {
+      const endpointPaths = spec2.endpoints.map((item) => item.path);
+      const callable = endpointPaths.length === 0 || !apis ? endpointPaths.length === 0 ? true : null : endpointPaths.every((path) => apis.some((api) => matchesApi(api, path)));
+      return {
+        name: spec2.name,
+        description: spec2.description,
+        risk: spec2.risk,
+        readOnly: spec2.readOnly,
+        implemented: true,
+        authenticated: Boolean(apis),
+        callable,
+        endpoints: endpointPaths,
+        permissionHint: spec2.permissionHint
+      };
+    }),
+    ...notImplementedCapabilities.map((item) => ({
+      ...item,
+      implemented: false,
+      callable: false,
+      endpoints: []
+    }))
+  ];
+}
+function matchesApi(pattern, path) {
+  if (pattern === path) return true;
+  try {
+    return new RegExp(`^(?:${pattern})$`).test(path);
+  } catch {
+    return false;
+  }
+}
+function buildTree(items) {
+  const nodes = /* @__PURE__ */ new Map();
+  const roots = [];
+  for (const value2 of items) {
+    if (!isRecord(value2) || value2.id === void 0) continue;
+    nodes.set(String(value2.id), { ...value2, children: [] });
+  }
+  for (const node of nodes.values()) {
+    const parentId = node.parentId === void 0 || node.parentId === null ? "0" : String(node.parentId);
+    const parent = nodes.get(parentId);
+    if (parent && String(node.id) !== parentId) parent.children?.push(node);
+    else roots.push(node);
+  }
+  return roots;
+}
+function isRecord(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+
+// ../core/src/client.ts
+import { z as z2 } from "zod";
+
+// ../core/src/errors.ts
+var ExitCode = {
+  SUCCESS: 0,
+  VALIDATION: 2,
+  AUTH: 3,
+  PERMISSION: 4,
+  NOT_FOUND: 5,
+  BUSINESS: 6,
+  RATE_LIMIT: 7,
+  SERVER: 8,
+  NETWORK: 9,
+  CONFIRMATION: 10,
+  PARTIAL: 11,
+  CANCELLED: 130
+};
+var CliError = class extends Error {
+  constructor(code, message, exitCode2, retryable = false, details = {}, suggestions = [], options) {
+    super(message, options);
+    this.code = code;
+    this.exitCode = exitCode2;
+    this.retryable = retryable;
+    this.details = details;
+    this.suggestions = suggestions;
+    this.name = "CliError";
+  }
+  code;
+  exitCode;
+  retryable;
+  details;
+  suggestions;
+  toJSON() {
+    return {
+      code: this.code,
+      message: this.message,
+      retryable: this.retryable,
+      details: this.details,
+      suggestions: this.suggestions
+    };
+  }
+};
+function mapHttpError(status, data) {
+  const body = isRecord2(data) ? data : {};
+  const oauthError = typeof body.error === "string" ? body.error : void 0;
+  if (status === 401 && oauthError === "invalid_client") {
+    return new CliError("AUTH_INVALID_CLIENT", "client authentication failed", ExitCode.AUTH, false);
+  }
+  if (status === 404) {
+    return new CliError("RESOURCE_NOT_FOUND", "\u8BF7\u6C42\u7684\u8D44\u6E90\u6216\u63A5\u53E3\u4E0D\u5B58\u5728", ExitCode.NOT_FOUND, false, { httpStatus: status });
+  }
+  if (status === 429) {
+    return new CliError("RATE_LIMITED", "\u8BF7\u6C42\u8FC7\u4E8E\u9891\u7E41", ExitCode.RATE_LIMIT, true, { httpStatus: status });
+  }
+  if (status >= 500) {
+    return new CliError("BACKEND_SERVICE_ERROR", "\u540E\u7AEF\u670D\u52A1\u5F02\u5E38", ExitCode.SERVER, true, { httpStatus: status });
+  }
+  return new CliError("HTTP_ERROR", `HTTP \u8BF7\u6C42\u5931\u8D25 (${status})`, ExitCode.BUSINESS, false, { httpStatus: status });
+}
+function mapBackendError(code, message) {
+  const details = { backendCode: code };
+  if ([301, 302, 303, 304].includes(code)) {
+    return new CliError("AUTH_REQUIRED", message, ExitCode.AUTH, false, details);
+  }
+  if ([305, 306].includes(code)) {
+    return new CliError("ADMIN_PERMISSION_DENIED", message, ExitCode.PERMISSION, false, details);
+  }
+  if (code === 999) {
+    return new CliError("BACKEND_BUSINESS_ERROR", message, ExitCode.BUSINESS, false, details);
+  }
+  return new CliError("BACKEND_BUSINESS_ERROR", message, ExitCode.BUSINESS, false, details);
+}
+function toCliError(error) {
+  if (error instanceof CliError) return error;
+  if (error instanceof Error && (error.name === "AbortError" || error.name === "TimeoutError")) {
+    return new CliError("NETWORK_TIMEOUT", "\u8BF7\u6C42\u8D85\u65F6", ExitCode.NETWORK, true, {}, [], { cause: error });
+  }
+  const message = error instanceof Error ? error.message : "\u672A\u77E5\u9519\u8BEF";
+  return new CliError("NETWORK_ERROR", message, ExitCode.NETWORK, true, {}, [], {
+    cause: error instanceof Error ? error : void 0
+  });
+}
+function isRecord2(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+
+// ../core/src/http.ts
+import { request } from "undici";
+
+// ../core/src/redact.ts
+var SENSITIVE_KEYS = /^(token|access[_-]?token|authorization|password|passwd|secret|appsecret|app_secret|privatekey|private_key|mobile|idcard|id_card|email)$/i;
+function redact(value2) {
+  return redactValue(value2, /* @__PURE__ */ new WeakSet());
+}
+function redactValue(value2, seen) {
+  if (Array.isArray(value2)) return value2.map((item) => redactValue(item, seen));
+  if (typeof value2 !== "object" || value2 === null) return value2;
+  if (seen.has(value2)) return "[Circular]";
+  seen.add(value2);
+  const output = {};
+  for (const [key, child] of Object.entries(value2)) {
+    output[key] = SENSITIVE_KEYS.test(key) ? mask(child) : redactValue(child, seen);
+  }
+  return output;
+}
+function mask(value2) {
+  const text = String(value2 ?? "");
+  if (text.length <= 4) return "[REDACTED]";
+  return `${text.slice(0, 2)}***${text.slice(-2)}`;
+}
+function maskIdentifier(value2) {
+  if (!value2) return "";
+  if (value2.length <= 6) return `${value2.slice(0, 1)}***`;
+  return `${value2.slice(0, 3)}***${value2.slice(-3)}`;
+}
+
+// ../core/src/http.ts
+var USER_AGENT = "@wcs-edu-os/cli/0.1.1";
+var HttpClient = class {
+  constructor(baseUrl) {
+    this.baseUrl = baseUrl;
+  }
+  baseUrl;
+  async send(options) {
+    const maxAttempts = options.readOnly ? 3 : 1;
+    let lastError;
+    for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
+      try {
+        const response = await this.sendOnce(options);
+        if (isRetryableStatus(response.status) && attempt < maxAttempts) {
+          options.onDiagnostic?.(`\u8BF7\u6C42\u8FD4\u56DE ${response.status}\uFF0C\u51C6\u5907\u7B2C ${attempt} \u6B21\u91CD\u8BD5`, redact({ path: options.path }));
+          await delay(50 * attempt);
+          continue;
+        }
+        if (response.status < 200 || response.status >= 300) throw mapHttpError(response.status, response.data);
+        return response;
+      } catch (error) {
+        if (error instanceof CliError) {
+          if (!error.retryable || attempt >= maxAttempts) throw error;
+        } else if (attempt >= maxAttempts || !options.readOnly) {
+          throw toCliError(error);
+        }
+        lastError = error;
+        options.onDiagnostic?.(`\u7F51\u7EDC\u8BF7\u6C42\u5931\u8D25\uFF0C\u51C6\u5907\u7B2C ${attempt} \u6B21\u91CD\u8BD5`, redact({ path: options.path, error }));
+        await delay(50 * attempt);
+      }
+    }
+    throw toCliError(lastError);
+  }
+  async sendOnce(options) {
+    const url = new URL(options.path, `${this.baseUrl}/`);
+    for (const [key, value2] of Object.entries(options.query ?? {})) {
+      if (value2 === void 0 || value2 === null || value2 === "") continue;
+      if (Array.isArray(value2)) value2.forEach((item) => url.searchParams.append(key, String(item)));
+      else url.searchParams.set(key, String(value2));
+    }
+    const headers = {
+      accept: "application/json",
+      "user-agent": USER_AGENT,
+      "x-request-id": options.requestId
+    };
+    if (options.token) headers.token = options.token;
+    if (options.idempotencyKey) headers["x-idempotency-key"] = options.idempotencyKey;
+    if (options.basic) {
+      headers.authorization = `Basic ${Buffer.from(`${options.basic.appKey}:${options.basic.appSecret}`, "utf8").toString("base64")}`;
+    }
+    let body;
+    if (options.form) {
+      headers["content-type"] = "application/x-www-form-urlencoded";
+      body = new URLSearchParams(options.form).toString();
+    } else if (options.body !== void 0) {
+      headers["content-type"] = "application/json";
+      body = JSON.stringify(options.body);
+    }
+    let response;
+    try {
+      response = await request(url, {
+        method: options.method,
+        headers,
+        body,
+        signal: AbortSignal.timeout(options.timeoutMs)
+      });
+    } catch (error) {
+      throw toCliError(error);
+    }
+    const text = await response.body.text();
+    let data = null;
+    if (text) {
+      try {
+        data = JSON.parse(text);
+      } catch (error) {
+        throw new CliError("BACKEND_INVALID_RESPONSE", "\u540E\u7AEF\u8FD4\u56DE\u4E86\u65E0\u6548 JSON", ExitCode.SERVER, false, {
+          httpStatus: response.statusCode
+        }, [], { cause: error instanceof Error ? error : void 0 });
+      }
+    }
+    return {
+      status: response.statusCode,
+      headers: response.headers,
+      data
+    };
+  }
+};
+function isRetryableStatus(status) {
+  return status === 429 || status >= 500;
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// ../core/src/client.ts
+var tokenSchema = z2.object({
+  access_token: z2.string().min(1),
+  token_type: z2.string().min(1),
+  expires_in: z2.number().int().positive(),
+  user_id: z2.string().min(1),
+  apis: z2.array(z2.string())
+});
+var WcsClient = class {
+  constructor(baseUrl, appKey, tokenCache, timeoutMs, onDiagnostic) {
+    this.baseUrl = baseUrl;
+    this.appKey = appKey;
+    this.tokenCache = tokenCache;
+    this.timeoutMs = timeoutMs;
+    this.onDiagnostic = onDiagnostic;
+    this.http = new HttpClient(baseUrl);
+  }
+  baseUrl;
+  appKey;
+  tokenCache;
+  timeoutMs;
+  onDiagnostic;
+  http;
+  async token(requestId2, appSecret, force = false) {
+    if (!force) {
+      const cached = await this.tokenCache.get(this.baseUrl, this.appKey);
+      if (cached) return cached;
+    }
+    if (!appSecret) {
+      throw new CliError("APP_SECRET_MISSING", "\u672A\u63D0\u4F9B appSecret\uFF0C\u4E14\u6CA1\u6709\u53EF\u7528 token \u7F13\u5B58", ExitCode.AUTH, false, {}, [
+        "\u4F7F\u7528 --secret-stdin \u4ECE\u6807\u51C6\u8F93\u5165\u63D0\u4F9B",
+        "\u6216\u8BBE\u7F6E WCS_EDU_APP_SECRET"
+      ]);
+    }
+    const response = await this.http.send({
+      method: "POST",
+      path: "/base/api/cli/token",
+      requestId: requestId2,
+      timeoutMs: this.timeoutMs,
+      readOnly: false,
+      basic: { appKey: this.appKey, appSecret },
+      form: { grant_type: "client_credentials" },
+      onDiagnostic: this.onDiagnostic
+    });
+    const parsed = tokenSchema.safeParse(response.data);
+    if (!parsed.success) {
+      throw new CliError("TOKEN_RESPONSE_INVALID", "token \u54CD\u5E94\u4E0D\u7B26\u5408\u534F\u8BAE", ExitCode.SERVER, false, {
+        issues: parsed.error.issues
+      });
+    }
+    return this.tokenCache.set(this.baseUrl, this.appKey, parsed.data);
+  }
+  async result(spec2, endpointIndex, requestId2, token, input, idempotencyKey) {
+    const endpoint2 = spec2.endpoints[endpointIndex];
+    if (!endpoint2) throw new CliError("COMMAND_CONTRACT_ERROR", "\u547D\u4EE4\u7F3A\u5C11 endpoint", ExitCode.SERVER);
+    const payload = buildBackendPayload(input);
+    const response = await this.http.send({
+      method: endpoint2.method,
+      path: endpoint2.path,
+      requestId: requestId2,
+      timeoutMs: this.timeoutMs,
+      readOnly: spec2.readOnly,
+      token,
+      query: endpoint2.method === "GET" ? payload : void 0,
+      body: endpoint2.method === "GET" ? void 0 : payload,
+      idempotencyKey,
+      onDiagnostic: this.onDiagnostic
+    });
+    return normalizeBackendResult(response.data);
+  }
+  async pagedResult(spec2, requestId2, token, input) {
+    const startPage = Number(input.page ?? 1);
+    const size = Number(input.size ?? 20);
+    const maxItems = Number(input.maxItems ?? 100);
+    const items = [];
+    let current = startPage;
+    let finalPage = null;
+    while (items.length < maxItems) {
+      const result = await this.result(spec2, 0, requestId2, token, { ...input, page: current, size });
+      const pageItems = extractItems(result.data);
+      items.push(...pageItems.slice(0, maxItems - items.length));
+      finalPage = result.page;
+      if (!result.page?.hasMore || pageItems.length === 0 || items.length >= maxItems) break;
+      current += 1;
+    }
+    const total = finalPage?.total ?? items.length;
+    return {
+      data: { items },
+      page: { number: startPage, size, total, hasMore: startPage * size < total && items.length < total }
+    };
+  }
+};
+function normalizeBackendResult(value2) {
+  if (!isRecord3(value2) || typeof value2.code !== "number") {
+    throw new CliError("BACKEND_INVALID_RESPONSE", "\u540E\u7AEF\u54CD\u5E94\u7F3A\u5C11 Result.code", ExitCode.SERVER);
+  }
+  if (value2.code !== 200) {
+    throw mapBackendError(value2.code, typeof value2.msg === "string" ? value2.msg : "\u540E\u7AEF\u4E1A\u52A1\u9519\u8BEF");
+  }
+  const data = value2.data;
+  if (isPage(data)) {
+    const page = {
+      number: numberOr(data.pageCurrent, 1),
+      size: numberOr(data.pageSize, 20),
+      total: numberOr(data.totalCount, 0),
+      hasMore: numberOr(data.pageCurrent, 1) < numberOr(data.totalPage, 0)
+    };
+    return { data: { items: Array.isArray(data.list) ? data.list : [] }, page };
+  }
+  return { data, page: null };
+}
+function buildBackendPayload(input) {
+  const output = {};
+  const filters = Array.isArray(input.filter) ? input.filter : [];
+  for (const filter of filters) {
+    const separator = String(filter).indexOf("=");
+    if (separator <= 0) {
+      throw new CliError("FILTER_INVALID", `\u7B5B\u9009\u6761\u4EF6\u683C\u5F0F\u9519\u8BEF: ${filter}`, ExitCode.VALIDATION);
+    }
+    output[String(filter).slice(0, separator)] = String(filter).slice(separator + 1);
+  }
+  for (const [key, value2] of Object.entries(input)) {
+    if (["filter", "maxItems"].includes(key) || value2 === void 0 || value2 === "") continue;
+    if (key === "page") output.pageCurrent = value2;
+    else if (key === "size") output.pageSize = value2;
+    else output[key] = value2;
+  }
+  return output;
+}
+function extractItems(data) {
+  if (isRecord3(data) && Array.isArray(data.items)) return data.items;
+  return [];
+}
+function isPage(value2) {
+  return isRecord3(value2) && ("list" in value2 || "totalCount" in value2) && "pageCurrent" in value2;
+}
+function isRecord3(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+function numberOr(value2, fallback) {
+  const number = Number(value2);
+  return Number.isFinite(number) ? number : fallback;
+}
+
+// ../core/src/confirmation-store.ts
+import { createHash as createHash2, randomBytes } from "crypto";
+import { chmod as chmod2, mkdir as mkdir2, readFile as readFile2, rm as rm2, writeFile as writeFile2 } from "fs/promises";
+import { join as join2 } from "path";
+
+// ../core/src/token-cache.ts
+import { createHash } from "crypto";
+import { chmod, mkdir, readFile, rm, writeFile } from "fs/promises";
+import { homedir } from "os";
+import { join } from "path";
+function getCacheDir(env = process.env) {
+  if (env.WCS_EDU_CACHE_DIR) return env.WCS_EDU_CACHE_DIR;
+  if (process.platform === "win32") return join(env.LOCALAPPDATA ?? join(homedir(), "AppData", "Local"), "wcs-edu-os-cli");
+  if (process.platform === "darwin") return join(homedir(), "Library", "Caches", "wcs-edu-os-cli");
+  return join(env.XDG_CACHE_HOME ?? join(homedir(), ".cache"), "wcs-edu-os-cli");
+}
+function credentialFingerprint(baseUrl, appKey) {
+  return createHash("sha256").update(`${baseUrl}\0${appKey}`).digest("hex").slice(0, 16);
+}
+var TokenCache = class {
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  env;
+  path(baseUrl, appKey) {
+    return join(getCacheDir(this.env), `token-${credentialFingerprint(baseUrl, appKey)}.json`);
+  }
+  async get(baseUrl, appKey, now = Date.now()) {
+    const path = this.path(baseUrl, appKey);
+    try {
+      const token = JSON.parse(await readFile(path, "utf8"));
+      if (!token.access_token || token.expiresAt <= now + 5e3) {
+        await rm(path, { force: true });
+        return null;
+      }
+      return token;
+    } catch (error) {
+      if (error instanceof SyntaxError) await rm(path, { force: true });
+      return null;
+    }
+  }
+  async set(baseUrl, appKey, token, now = Date.now()) {
+    const dir = getCacheDir(this.env);
+    const path = this.path(baseUrl, appKey);
+    const cached = { ...token, expiresAt: now + token.expires_in * 1e3 };
+    await mkdir(dir, { recursive: true });
+    await writeFile(path, JSON.stringify(cached), { encoding: "utf8", mode: 384 });
+    if (process.platform !== "win32") await chmod(path, 384);
+    return cached;
+  }
+};
+
+// ../core/src/confirmation-store.ts
+var CONFIRMATION_TTL_MS = 10 * 60 * 1e3;
+var ConfirmationStore = class {
+  constructor(env = process.env) {
+    this.env = env;
+  }
+  env;
+  async create(binding, now = Date.now()) {
+    const confirmationCode = randomBytes(32).toString("base64url");
+    const record = this.bind(binding, now + CONFIRMATION_TTL_MS);
+    const path = this.path(confirmationCode);
+    await mkdir2(this.directory(), { recursive: true });
+    await writeFile2(path, JSON.stringify(record), { encoding: "utf8", mode: 384 });
+    if (process.platform !== "win32") await chmod2(path, 384);
+    return { confirmationCode, record };
+  }
+  async verify(code, binding, now = Date.now()) {
+    const path = this.path(code);
+    let record;
+    try {
+      record = JSON.parse(await readFile2(path, "utf8"));
+    } catch (error) {
+      throw new CliError("CONFIRMATION_INVALID", "\u786E\u8BA4\u4EE4\u724C\u4E0D\u5B58\u5728\u6216\u5DF2\u5931\u6548", ExitCode.CONFIRMATION, false, {}, [], {
+        cause: error instanceof Error ? error : void 0
+      });
+    }
+    if (record.expiresAt <= now) {
+      await rm2(path, { force: true });
+      throw new CliError("CONFIRMATION_EXPIRED", "\u786E\u8BA4\u4EE4\u724C\u5DF2\u8FC7\u671F\uFF0C\u8BF7\u91CD\u65B0\u6267\u884C dry-run", ExitCode.CONFIRMATION);
+    }
+    const expected = this.bind(binding, record.expiresAt);
+    const mismatches = ["command", "environmentFingerprint", "userId", "payloadHash", "endpoint", "risk"].filter((key) => record[key] !== expected[key]);
+    if (mismatches.length > 0) {
+      throw new CliError("CONFIRMATION_MISMATCH", "\u8BF7\u6C42\u53C2\u6570\u6216\u6267\u884C\u8EAB\u4EFD\u4E0E dry-run \u4E0D\u4E00\u81F4", ExitCode.CONFIRMATION, false, {
+        mismatches
+      });
+    }
+    return record;
+  }
+  async consume(code) {
+    await rm2(this.path(code), { force: true });
+  }
+  bind(binding, expiresAt) {
+    return {
+      command: binding.command,
+      environmentFingerprint: hash(binding.baseUrl),
+      userId: binding.userId,
+      payloadHash: hash(stableStringify(binding.payload)),
+      endpoint: binding.endpoint,
+      risk: binding.risk,
+      sideEffects: binding.sideEffects,
+      rollback: binding.rollback,
+      expiresAt
+    };
+  }
+  directory() {
+    return join2(getCacheDir(this.env), "confirmations");
+  }
+  path(code) {
+    return join2(this.directory(), `${hash(code)}.json`);
+  }
+};
+function stableStringify(value2) {
+  return JSON.stringify(sortValue(value2));
+}
+function sortValue(value2) {
+  if (Array.isArray(value2)) return value2.map(sortValue);
+  if (typeof value2 !== "object" || value2 === null) return value2;
+  return Object.fromEntries(Object.entries(value2).sort(([left], [right]) => left.localeCompare(right)).map(([key, child]) => [key, sortValue(child)]));
+}
+function hash(value2) {
+  return createHash2("sha256").update(value2).digest("hex");
+}
+
+// ../core/src/credentials.ts
+import { emitKeypressEvents } from "readline";
+import { createInterface } from "readline/promises";
+import { stdin as defaultStdin, stderr as defaultStderr } from "process";
+async function resolveAppSecret(options = {}) {
+  const env = options.env ?? process.env;
+  const input = options.stdin ?? defaultStdin;
+  if (options.secretStdin) {
+    const value2 = (await readAll(input)).trimEnd();
+    if (!value2) throw new CliError("APP_SECRET_MISSING", "\u6807\u51C6\u8F93\u5165\u4E2D\u6CA1\u6709 appSecret", ExitCode.VALIDATION);
+    return { value: value2, source: "stdin" };
+  }
+  if (options.interactive && "isTTY" in input && input.isTTY) {
+    const output = options.stderr ?? defaultStderr;
+    const value2 = "setRawMode" in input && typeof input.setRawMode === "function" ? await readHidden(input, output) : await readVisibleFallback(input, output);
+    if (value2) return { value: value2, source: "prompt" };
+  }
+  if (env.WCS_EDU_APP_SECRET) return { value: env.WCS_EDU_APP_SECRET, source: "environment" };
+  return { source: "none" };
+}
+async function readHidden(input, output) {
+  output.write("App Secret: ");
+  emitKeypressEvents(input);
+  const wasRaw = input.isRaw ?? false;
+  input.setRawMode(true);
+  input.resume();
+  return new Promise((resolve, reject) => {
+    let value2 = "";
+    const cleanup = () => {
+      input.off("keypress", onKeypress);
+      input.setRawMode(wasRaw);
+      input.pause();
+      output.write("\n");
+    };
+    const onKeypress = (text, key) => {
+      if (key.ctrl && key.name === "c") {
+        cleanup();
+        reject(new CliError("USER_CANCELLED", "\u7528\u6237\u53D6\u6D88\u8F93\u5165", ExitCode.CANCELLED));
+      } else if (key.name === "return" || key.name === "enter") {
+        cleanup();
+        resolve(value2);
+      } else if (key.name === "backspace") {
+        value2 = value2.slice(0, -1);
+      } else if (!key.ctrl && !key.meta && text) {
+        value2 += text;
+      }
+    };
+    input.on("keypress", onKeypress);
+  });
+}
+async function readVisibleFallback(input, output) {
+  const rl = createInterface({ input, output, terminal: true });
+  const value2 = await rl.question("App Secret: ");
+  rl.close();
+  return value2;
+}
+async function readAll(stream) {
+  const chunks = [];
+  for await (const chunk of stream) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk)));
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// ../core/src/json-input.ts
+import { readFile as readFile3 } from "fs/promises";
+var MAX_INPUT_BYTES = 1024 * 1024;
+async function loadJsonInput(path, stdin2) {
+  let text;
+  try {
+    text = path === "-" ? await readStream(stdin2) : await readFile3(path, "utf8");
+  } catch (error) {
+    if (error instanceof CliError) throw error;
+    throw new CliError("INPUT_READ_FAILED", `\u65E0\u6CD5\u8BFB\u53D6\u8F93\u5165: ${path}`, ExitCode.VALIDATION, false, {}, [], {
+      cause: error instanceof Error ? error : void 0
+    });
+  }
+  if (Buffer.byteLength(text, "utf8") > MAX_INPUT_BYTES) {
+    throw new CliError("INPUT_TOO_LARGE", "\u8F93\u5165 JSON \u4E0D\u80FD\u8D85\u8FC7 1 MiB", ExitCode.VALIDATION);
+  }
+  try {
+    return JSON.parse(text);
+  } catch (error) {
+    throw new CliError("INPUT_JSON_INVALID", "\u8F93\u5165\u4E0D\u662F\u6709\u6548 JSON", ExitCode.VALIDATION, false, {}, [], {
+      cause: error instanceof Error ? error : void 0
+    });
+  }
+}
+async function readStream(stream) {
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of stream) {
+    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk));
+    size += buffer.length;
+    if (size > MAX_INPUT_BYTES) {
+      throw new CliError("INPUT_TOO_LARGE", "\u8F93\u5165 JSON \u4E0D\u80FD\u8D85\u8FC7 1 MiB", ExitCode.VALIDATION);
+    }
+    chunks.push(buffer);
+  }
+  return Buffer.concat(chunks).toString("utf8");
+}
+
+// ../core/src/output.ts
+import { randomUUID } from "crypto";
+function requestId(value2) {
+  return value2?.trim() || randomUUID();
+}
+function successEnvelope(command, id, result, meta, warnings = []) {
+  return redact({
+    schemaVersion: "1.0",
+    ok: true,
+    command,
+    requestId: id,
+    data: result.data,
+    page: result.page,
+    warnings,
+    meta,
+    error: null
+  });
+}
+function failureEnvelope(command, id, error, meta = {}) {
+  const cliError = toCliError(error);
+  return {
+    error: cliError,
+    envelope: redact({
+      schemaVersion: "1.0",
+      ok: false,
+      command,
+      requestId: id,
+      data: null,
+      page: null,
+      warnings: [],
+      meta,
+      error: cliError.toJSON()
+    })
+  };
+}
+
+// ../core/src/profiles.ts
+import { chmod as chmod3, mkdir as mkdir3, readFile as readFile4, writeFile as writeFile3 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import { join as join3 } from "path";
+import YAML from "yaml";
+var EMPTY_PROFILES = { profiles: {} };
+function getConfigDir(env = process.env) {
+  if (env.WCS_EDU_CONFIG_DIR) return env.WCS_EDU_CONFIG_DIR;
+  if (process.platform === "win32") return join3(env.APPDATA ?? join3(homedir2(), "AppData", "Roaming"), "wcs-edu-os-cli");
+  if (process.platform === "darwin") return join3(homedir2(), "Library", "Application Support", "wcs-edu-os-cli");
+  return join3(env.XDG_CONFIG_HOME ?? join3(homedir2(), ".config"), "wcs-edu-os-cli");
+}
+function getProfilePath(env = process.env) {
+  return join3(getConfigDir(env), "profiles.yml");
+}
+async function loadProfiles(env = process.env) {
+  try {
+    const parsed = YAML.parse(await readFile4(getProfilePath(env), "utf8"));
+    if (!parsed || typeof parsed !== "object") return structuredClone(EMPTY_PROFILES);
+    const value2 = parsed;
+    return { currentProfile: value2.currentProfile, profiles: value2.profiles ?? {} };
+  } catch (error) {
+    if (isNotFound(error)) return structuredClone(EMPTY_PROFILES);
+    throw new CliError("PROFILE_READ_FAILED", "\u65E0\u6CD5\u8BFB\u53D6 Profile \u914D\u7F6E", ExitCode.VALIDATION, false, {}, [], {
+      cause: error instanceof Error ? error : void 0
+    });
+  }
+}
+async function saveProfiles(config, env = process.env) {
+  const dir = getConfigDir(env);
+  const path = getProfilePath(env);
+  await mkdir3(dir, { recursive: true });
+  await writeFile3(path, YAML.stringify(config), { encoding: "utf8", mode: 384 });
+  if (process.platform !== "win32") await chmod3(path, 384);
+}
+async function useProfile(name, baseUrl, env = process.env) {
+  const config = await loadProfiles(env);
+  if (baseUrl) config.profiles[name] = { baseUrl: normalizeBaseUrl(baseUrl) };
+  if (!config.profiles[name]) {
+    throw new CliError("PROFILE_NOT_FOUND", `Profile \u4E0D\u5B58\u5728: ${name}`, ExitCode.VALIDATION);
+  }
+  config.currentProfile = name;
+  await saveProfiles(config, env);
+  return config;
+}
+async function resolveProfile(explicitName, env = process.env) {
+  const config = await loadProfiles(env);
+  const name = explicitName ?? env.WCS_EDU_PROFILE ?? config.currentProfile ?? "default";
+  const source = explicitName ? "argument" : env.WCS_EDU_PROFILE ? "environment" : config.currentProfile ? "current" : "default";
+  const baseUrl = env.WCS_EDU_BASE_URL ?? config.profiles[name]?.baseUrl;
+  if (!baseUrl) {
+    throw new CliError("BASE_URL_MISSING", "\u672A\u914D\u7F6E WCS EDU OS base URL", ExitCode.VALIDATION, false, { profile: name }, [
+      "\u8BBE\u7F6E WCS_EDU_BASE_URL",
+      `\u6216\u6267\u884C profile use ${name} --base-url <url>`
+    ]);
+  }
+  return { name, baseUrl: normalizeBaseUrl(baseUrl), source };
+}
+function normalizeBaseUrl(value2) {
+  let url;
+  try {
+    url = new URL(value2);
+  } catch {
+    throw new CliError("BASE_URL_INVALID", "base URL \u683C\u5F0F\u65E0\u6548", ExitCode.VALIDATION);
+  }
+  if (!["http:", "https:"].includes(url.protocol)) {
+    throw new CliError("BASE_URL_INVALID", "base URL \u53EA\u652F\u6301 http \u6216 https", ExitCode.VALIDATION);
+  }
+  return url.toString().replace(/\/$/, "");
+}
+function isNotFound(error) {
+  return error instanceof Error && "code" in error && error.code === "ENOENT";
+}
+
+// src/runner.ts
+import { createHash as createHash3 } from "crypto";
+import { z as z3 } from "zod";
+import Table from "cli-table3";
+var VERSION = "0.1.1";
+async function runCommand(spec2, rawInput, globals, io) {
+  const id = requestId(globals.requestId);
+  const started = Date.now();
+  let profileName;
+  try {
+    const parsed = spec2.inputSchema.safeParse(rawInput);
+    if (!parsed.success) {
+      throw new CliError("VALIDATION_ERROR", "\u547D\u4EE4\u53C2\u6570\u6821\u9A8C\u5931\u8D25", ExitCode.VALIDATION, false, {
+        issues: parsed.error.issues
+      });
+    }
+    const input = parsed.data;
+    const result = await execute(spec2, input, globals, io, id, (name) => {
+      profileName = name;
+    });
+    const envelope = successEnvelope(spec2.name, id, result, {
+      profile: profileName ?? null,
+      durationMs: Date.now() - started
+    });
+    writeSuccess(envelope, chooseOutput(globals.output, io.stdout.isTTY), spec2, io.stdout);
+    return { exitCode: !spec2.readOnly && globals.dryRun ? ExitCode.CONFIRMATION : 0, envelope };
+  } catch (error) {
+    const failed = failureEnvelope(spec2.name, id, error, {
+      profile: profileName ?? null,
+      durationMs: Date.now() - started
+    });
+    io.stdout.write(`${JSON.stringify(failed.envelope)}
+`);
+    if (globals.debug) io.stderr.write(`${JSON.stringify(redact({ error }))}
+`);
+    return { exitCode: failed.error.exitCode, envelope: failed.envelope };
+  }
+}
+async function execute(spec2, input, globals, io, id, setProfile) {
+  if (spec2.name === "version") return value({ version: VERSION, node: process.version });
+  if (spec2.name === "guide") return value(buildGuide(String(input.topic ?? "all")));
+  if (spec2.name.startsWith("profile.")) return executeProfile(spec2.name, input, globals, io, setProfile);
+  if (spec2.name === "schema") {
+    const target = findCommand(String(input.command));
+    if (!target) throw new CliError("COMMAND_NOT_FOUND", `\u672A\u77E5\u547D\u4EE4: ${input.command}`, ExitCode.VALIDATION);
+    return value({
+      command: target.name,
+      input: z3.toJSONSchema(target.payloadSchema ?? target.inputSchema),
+      output: z3.toJSONSchema(target.outputSchema),
+      endpoints: target.endpoints,
+      risk: target.risk,
+      readOnly: target.readOnly,
+      supportsDryRun: target.supportsDryRun,
+      supportsIdempotency: target.supportsIdempotency
+    });
+  }
+  if (spec2.name === "auth.status") return authStatus(globals, io, setProfile);
+  if (spec2.name === "auth.credential-info") return credentialInfo(globals, io, setProfile);
+  if (spec2.name === "doctor") return doctor(globals, io, id, setProfile);
+  if (spec2.name === "capabilities") return capabilities(globals, io, id, setProfile);
+  if (!spec2.readOnly && globals.dryRun && globals.confirmToken) {
+    throw new CliError("CONFIRMATION_OPTION_CONFLICT", "dry-run \u4E0D\u80FD\u540C\u65F6\u63D0\u4F9B --confirm-token", ExitCode.VALIDATION);
+  }
+  if (!spec2.readOnly && !globals.dryRun && !globals.confirmToken) {
+    throw new CliError("CONFIRMATION_REQUIRED", "\u5199\u64CD\u4F5C\u5FC5\u987B\u5148\u6267\u884C --dry-run\uFF0C\u518D\u63D0\u4F9B --confirm-token", ExitCode.CONFIRMATION);
+  }
+  if (!spec2.readOnly && !globals.dryRun) {
+    const idempotencyKey = globals.idempotencyKey?.trim();
+    if (!idempotencyKey || idempotencyKey.length > 128) {
+      throw new CliError("IDEMPOTENCY_KEY_REQUIRED", "\u5199\u64CD\u4F5C\u5FC5\u987B\u63D0\u4F9B 1-128 \u5B57\u7B26\u7684 --idempotency-key", ExitCode.CONFIRMATION);
+    }
+  }
+  if (!spec2.readOnly && input.input === "-" && globals.secretStdin) {
+    throw new CliError("STDIN_CONFLICT", "--input - \u4E0E --secret-stdin \u4E0D\u80FD\u540C\u65F6\u4F7F\u7528", ExitCode.VALIDATION);
+  }
+  const context = await createContext(globals, io, setProfile);
+  const token = await context.client.token(id, context.secret.value, spec2.name === "auth.test");
+  if (spec2.name === "auth.test") {
+    const whoami = findCommand("auth.whoami");
+    if (!whoami) throw new CliError("COMMAND_CONTRACT_ERROR", "\u7F3A\u5C11 auth.whoami \u5951\u7EA6", ExitCode.SERVER);
+    await context.client.result(whoami, 0, id, token.access_token, {});
+    return value({ valid: true, userId: token.user_id, expiresAt: token.expiresAt, apiCount: token.apis.length });
+  }
+  if (spec2.name === "statistics.dashboard") return dashboard(spec2, input, context.client, token.access_token, id);
+  if (!spec2.readOnly) {
+    return executeWrite(spec2, input, globals, io, context.client, context.profile.baseUrl, token, id);
+  }
+  const endpoint2 = spec2.endpoints[0];
+  const result = endpoint2?.pagination ? await context.client.pagedResult(spec2, id, token.access_token, input) : await context.client.result(spec2, 0, id, token.access_token, input);
+  if (spec2.name === "department.tree") {
+    return value(buildTree(Array.isArray(result.data) ? result.data : []));
+  }
+  if (spec2.name === "auth.whoami") {
+    return value({ user: result.data, permissions: { count: token.apis.length, apis: token.apis } });
+  }
+  return result;
+}
+async function executeWrite(spec2, input, globals, io, client, baseUrl, token, requestIdValue) {
+  if (!spec2.payloadSchema || !spec2.supportsDryRun || !spec2.supportsIdempotency) {
+    throw new CliError("COMMAND_CONTRACT_ERROR", "\u5199\u547D\u4EE4\u7F3A\u5C11\u5B89\u5168\u534F\u8BAE\u58F0\u660E", ExitCode.SERVER);
+  }
+  const inputPath = String(input.input);
+  const payloadResult = spec2.payloadSchema.safeParse(await loadJsonInput(inputPath, io.stdin));
+  if (!payloadResult.success) {
+    throw new CliError("PAYLOAD_VALIDATION_ERROR", "\u8F93\u5165 JSON \u4E0D\u7B26\u5408\u547D\u4EE4\u5951\u7EA6", ExitCode.VALIDATION, false, {
+      issues: payloadResult.error.issues
+    });
+  }
+  const payload = payloadResult.data;
+  const endpoint2 = spec2.endpoints[0];
+  if (!endpoint2) throw new CliError("COMMAND_CONTRACT_ERROR", "\u5199\u547D\u4EE4\u7F3A\u5C11 endpoint", ExitCode.SERVER);
+  const binding = {
+    command: spec2.name,
+    baseUrl,
+    userId: token.user_id,
+    payload,
+    endpoint: endpoint2.path,
+    risk: spec2.risk,
+    sideEffects: spec2.sideEffects,
+    rollback: spec2.rollback
+  };
+  const confirmations = new ConfirmationStore(io.env);
+  if (globals.dryRun) {
+    const plan = await confirmations.create(binding);
+    return value({
+      dryRun: true,
+      confirmationCode: plan.confirmationCode,
+      expiresAt: plan.record.expiresAt,
+      endpoint: endpoint2.path,
+      method: endpoint2.method,
+      risk: spec2.risk,
+      sideEffects: spec2.sideEffects,
+      rollback: spec2.rollback,
+      payloadHash: plan.record.payloadHash
+    });
+  }
+  const confirmationToken = globals.confirmToken;
+  const idempotencyKey = globals.idempotencyKey?.trim();
+  await confirmations.verify(confirmationToken, binding);
+  const result = await client.result(spec2, 0, requestIdValue, token.access_token, payload, idempotencyKey);
+  await confirmations.consume(confirmationToken);
+  return result;
+}
+async function executeProfile(name, input, globals, io, setProfile) {
+  const config = await loadProfiles(io.env);
+  if (name === "profile.list") {
+    return value(Object.entries(config.profiles).map(([profileName2, profile]) => ({
+      name: profileName2,
+      baseUrl: profile.baseUrl,
+      current: config.currentProfile === profileName2
+    })));
+  }
+  if (name === "profile.get") {
+    const profileName2 = String(input.name ?? globals.profile ?? io.env.WCS_EDU_PROFILE ?? config.currentProfile ?? "default");
+    const profile = config.profiles[profileName2];
+    if (!profile) throw new CliError("PROFILE_NOT_FOUND", `Profile \u4E0D\u5B58\u5728: ${profileName2}`, ExitCode.VALIDATION);
+    setProfile(profileName2);
+    return value({ name: profileName2, ...profile, current: config.currentProfile === profileName2 });
+  }
+  const profileName = String(input.name);
+  const updated = await useProfile(profileName, input.baseUrl ? String(input.baseUrl) : void 0, io.env);
+  setProfile(profileName);
+  return value({ name: profileName, baseUrl: updated.profiles[profileName]?.baseUrl, current: true });
+}
+async function authStatus(globals, io, setProfile) {
+  const profiles = await loadProfiles(io.env);
+  const profileName = globals.profile ?? io.env.WCS_EDU_PROFILE ?? profiles.currentProfile ?? "default";
+  setProfile(profileName);
+  const baseUrl = io.env.WCS_EDU_BASE_URL ?? profiles.profiles[profileName]?.baseUrl;
+  const appKey = io.env.WCS_EDU_APP_KEY;
+  const token = baseUrl && appKey ? await new TokenCache(io.env).get(baseUrl.replace(/\/$/, ""), appKey) : null;
+  return value({
+    profile: profileName,
+    configPath: getProfilePath(io.env),
+    baseUrlConfigured: Boolean(baseUrl),
+    appKeyConfigured: Boolean(appKey),
+    credentialSource: globals.secretStdin ? "stdin" : io.env.WCS_EDU_APP_SECRET ? "environment" : io.stdin.isTTY ? "prompt" : "none",
+    tokenCached: Boolean(token),
+    tokenExpiresAt: token?.expiresAt ?? null
+  });
+}
+async function credentialInfo(globals, io, setProfile) {
+  const profile = await resolveProfile(globals.profile, io.env);
+  setProfile(profile.name);
+  const appKey = io.env.WCS_EDU_APP_KEY;
+  const token = appKey ? await new TokenCache(io.env).get(profile.baseUrl, appKey) : null;
+  return value({
+    profile: profile.name,
+    baseUrl: profile.baseUrl,
+    appKey: appKey ? maskIdentifier(appKey) : null,
+    appKeyFingerprint: appKey ? credentialFingerprint(profile.baseUrl, appKey) : null,
+    credentialSource: globals.secretStdin ? "stdin" : io.env.WCS_EDU_APP_SECRET ? "environment" : io.stdin.isTTY ? "prompt" : "none",
+    userId: token?.user_id ?? null,
+    tokenExpiresAt: token?.expiresAt ?? null
+  });
+}
+async function capabilities(globals, io, id, setProfile) {
+  try {
+    const context = await createContext(globals, io, setProfile, false);
+    const cached = await context.cache.get(context.profile.baseUrl, context.appKey);
+    if (cached) return value(getCapabilities(cached.apis));
+    if (context.secret.value) {
+      const token = await context.client.token(id, context.secret.value);
+      return value(getCapabilities(token.apis));
+    }
+  } catch {
+  }
+  return value(getCapabilities());
+}
+async function doctor(globals, io, id, setProfile) {
+  const checks = [];
+  const nodeMajor = Number(process.versions.node.split(".")[0]);
+  checks.push({ check: "node", status: nodeMajor >= 22 ? "pass" : "fail", message: process.version });
+  checks.push({ check: "config", status: "pass", message: getConfigDir(io.env) });
+  let context;
+  try {
+    context = await createContext(globals, io, setProfile, false);
+    checks.push({ check: "profile", status: "pass", message: context.profile.name });
+    checks.push({ check: "baseUrl", status: "pass", message: context.profile.baseUrl });
+    checks.push({ check: "credentials", status: context.secret.value ? "pass" : "skip", message: context.secret.source });
+  } catch (error) {
+    checks.push({ check: "profile/baseUrl", status: "fail", message: error instanceof Error ? error.message : String(error) });
+  }
+  if (context) {
+    try {
+      const token = await context.client.token(id, context.secret.value);
+      checks.push({ check: "token", status: "pass", message: `userId=${token.user_id}` });
+      const whoami = findCommand("auth.whoami");
+      if (!whoami) throw new Error("auth.whoami contract missing");
+      await context.client.result(whoami, 0, id, token.access_token, {});
+      checks.push({ check: "currentUser", status: "pass", message: "/base/admin/login/user" });
+    } catch (error) {
+      checks.push({ check: "token/currentUser", status: context.secret.value ? "fail" : "skip", message: error instanceof Error ? error.message : String(error) });
+    }
+  } else {
+    checks.push({ check: "token/currentUser", status: "skip", message: "\u7F3A\u5C11\u53EF\u7528\u914D\u7F6E" });
+  }
+  return value({ items: checks, healthy: checks.every((item) => item.status !== "fail") });
+}
+async function dashboard(spec2, input, client, token, id) {
+  const calls = spec2.endpoints.map((endpoint2, index) => client.result(
+    spec2,
+    index,
+    id,
+    token,
+    endpoint2.path.endsWith("/data") ? {} : { dates: input.dates }
+  ));
+  const settled = await Promise.allSettled(calls);
+  const failed = settled.flatMap((result, index) => result.status === "rejected" ? [{ endpoint: spec2.endpoints[index]?.path, error: result.reason instanceof Error ? result.reason.message : String(result.reason) }] : []);
+  if (failed.length > 0) {
+    throw new CliError("DASHBOARD_REQUEST_FAILED", "\u4EEA\u8868\u76D8\u5B50\u8BF7\u6C42\u5931\u8D25", ExitCode.SERVER, false, { failedEndpoints: failed });
+  }
+  const values = settled.map((result) => result.status === "fulfilled" ? result.value.data : null);
+  return value({ data: values[0], login: values[1], order: values[2] });
+}
+async function createContext(globals, io, setProfile, allowPrompt = true) {
+  const profile = await resolveProfile(globals.profile, io.env);
+  setProfile(profile.name);
+  const appKey = io.env.WCS_EDU_APP_KEY;
+  if (!appKey) throw new CliError("APP_KEY_MISSING", "\u672A\u8BBE\u7F6E WCS_EDU_APP_KEY", ExitCode.AUTH);
+  const secret = await resolveAppSecret({
+    secretStdin: globals.secretStdin,
+    interactive: allowPrompt && !globals.nonInteractive,
+    env: io.env,
+    stdin: io.stdin,
+    stderr: io.stderr
+  });
+  const cache = new TokenCache(io.env);
+  const timeoutMs = Number(globals.timeout ?? 1e4);
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new CliError("TIMEOUT_INVALID", "timeout \u5FC5\u987B\u662F\u6B63\u6574\u6570", ExitCode.VALIDATION);
+  }
+  const diagnostic = globals.debug ? (message, context) => io.stderr.write(`${message} ${JSON.stringify(redact(context))}
+`) : void 0;
+  return { profile, appKey, secret, cache, client: new WcsClient(profile.baseUrl, appKey, cache, timeoutMs, diagnostic) };
+}
+function value(data) {
+  return { data, page: null };
+}
+function buildGuide(topic) {
+  const guides = {
+    "getting-started": {
+      title: "\u9996\u6B21\u5B89\u88C5\u4E0E\u8FDE\u63A5",
+      summary: "\u5B89\u88C5 CLI\u3001\u914D\u7F6E\u7F51\u5173\u548C\u51ED\u636E\uFF0C\u7136\u540E\u7528 doctor \u9A8C\u8BC1\u8FDE\u63A5\u3002",
+      commands: [
+        "npm install -g @wcs-edu-os/cli",
+        "wcs-edu-os version",
+        "wcs-edu-os profile use test --base-url https://edu.example.com",
+        "wcs-edu-os doctor --output table",
+        "wcs-edu-os auth test --non-interactive --output json"
+      ],
+      environment: ["WCS_EDU_BASE_URL", "WCS_EDU_APP_KEY", "WCS_EDU_APP_SECRET \u6216 --secret-stdin"],
+      prompt: "\u8BF7\u5148\u8FD0\u884C wcs-edu-os doctor\uFF1B\u5982\u679C\u901A\u8FC7\uFF0C\u5E2E\u6211\u67E5\u770B\u5F53\u524D\u7BA1\u7406\u5458\u8EAB\u4EFD\u548C\u53EF\u7528\u6743\u9650\u3002"
+    },
+    course: {
+      title: "\u8BFE\u7A0B\u7BA1\u7406\u6D41\u7A0B",
+      summary: "\u5148\u67E5\u5206\u7C7B\u548C\u8BB2\u5E08\uFF0C\u518D\u67E5\u8BE2\u8BFE\u7A0B\u3001\u7AE0\u8282\uFF1B\u521B\u5EFA\u6216\u66F4\u65B0\u5FC5\u987B\u5148 dry-run\u3002",
+      commands: [
+        "wcs-edu-os category list --output table",
+        "wcs-edu-os lecturer list --output table",
+        "wcs-edu-os course list --keyword \u5173\u952E\u8BCD --output table",
+        "wcs-edu-os course get <courseId> --output json",
+        "wcs-edu-os course chapter list <courseId> --output json",
+        "wcs-edu-os course create --input course.json --dry-run --output json"
+      ],
+      prompt: "\u8BF7\u5148\u5217\u51FA\u8BFE\u7A0B\u5206\u7C7B\u3001\u8BB2\u5E08\u548C\u8BFE\u7A0B\uFF0C\u627E\u5230\u76EE\u6807\u8BFE\u7A0B\u540E\u5C55\u793A\u8BE6\u60C5\u4E0E\u7AE0\u8282\uFF1B\u4EFB\u4F55\u5199\u64CD\u4F5C\u5148\u7ED9\u51FA dry-run \u8BA1\u5212\uFF0C\u4E0D\u8981\u76F4\u63A5\u63D0\u4EA4\u3002"
+    },
+    exam: {
+      title: "\u9898\u5E93\u4E0E\u8003\u8BD5\u67E5\u8BE2",
+      summary: "\u6309\u8BD5\u9898\u3001\u8BD5\u5377\u3001\u8003\u8BD5\u4E09\u5C42\u67E5\u8BE2\uFF0C\u5148\u5217\u51FA\u8D44\u6E90\u518D\u67E5\u770B\u8BE6\u60C5\u3002",
+      commands: [
+        "wcs-edu-os question list --output table",
+        "wcs-edu-os paper list --output table",
+        "wcs-edu-os exam list --output table",
+        "wcs-edu-os exam get <examId> --output json"
+      ],
+      prompt: "\u8BF7\u5148\u5217\u51FA\u53EF\u7528\u8BD5\u5377\u548C\u8003\u8BD5\uFF0C\u6309\u540D\u79F0\u6216\u72B6\u6001\u7B5B\u9009\uFF1B\u627E\u5230\u76EE\u6807\u540E\u67E5\u8BE2\u8BE6\u60C5\uFF0C\u5E76\u8BF4\u660E\u5F53\u524D CLI \u4E0D\u652F\u6301\u53D1\u5E03\u3001\u5220\u9664\u548C\u6279\u91CF\u6307\u6D3E\u3002"
+    },
+    write: {
+      title: "\u5B89\u5168\u5199\u64CD\u4F5C",
+      summary: "\u521B\u5EFA\u548C\u66F4\u65B0\u53EA\u63A5\u53D7 JSON \u8F93\u5165\uFF0C\u5FC5\u987B\u7ECF\u8FC7 dry-run\u3001\u786E\u8BA4\u4EE4\u724C\u548C\u5E42\u7B49\u952E\u3002",
+      commands: [
+        "wcs-edu-os course update --input course.json --dry-run --output json",
+        "wcs-edu-os course update --input course.json --confirm-token <token> --idempotency-key <unique-key> --output json"
+      ],
+      prompt: "\u8BF7\u68C0\u67E5\u8FD9\u4EFD JSON \u7684\u5B57\u6BB5\u548C\u76EE\u6807\u73AF\u5883\uFF0C\u5148\u6267\u884C dry-run\uFF0C\u89E3\u91CA\u526F\u4F5C\u7528\u3001\u56DE\u6EDA\u65B9\u5F0F\u548C\u786E\u8BA4\u7801\u6709\u6548\u671F\uFF0C\u7B49\u5F85\u6211\u786E\u8BA4\u540E\u518D\u63D0\u4EA4\u3002"
+    }
+  };
+  if (topic === "all") return { topics: Object.values(guides), hint: "\u4F7F\u7528 wcs-edu-os guide <topic> \u67E5\u770B\u5355\u4E2A\u4E3B\u9898\u3002" };
+  return guides[topic] ?? guides["getting-started"];
+}
+function chooseOutput(explicit, isTTY) {
+  return explicit ?? (isTTY ? "table" : "json");
+}
+function writeSuccess(envelope, format, spec2, stdout2) {
+  if (format === "jsonl") {
+    stdout2.write(`${JSON.stringify(envelope)}
+`);
+    return;
+  }
+  if (format === "json") {
+    stdout2.write(`${JSON.stringify(envelope, null, 2)}
+`);
+    return;
+  }
+  stdout2.write(`${renderTable(envelope.data, spec2)}
+`);
+}
+function renderTable(data, spec2) {
+  const items = extractRows(data);
+  if (items.length === 0) return "(\u65E0\u6570\u636E)";
+  const columns = spec2.table.length > 0 ? spec2.table : inferColumns(items[0]);
+  const table = new Table({ head: columns.map((column) => column.label), style: { head: [], border: [] } });
+  for (const row of items) table.push(columns.map((column) => formatCell(row[column.key])));
+  return table.toString();
+}
+function extractRows(data) {
+  if (Array.isArray(data)) return data.filter(isRecord4);
+  if (isRecord4(data) && Array.isArray(data.items)) return data.items.filter(isRecord4);
+  if (isRecord4(data)) return Object.entries(data).map(([key, val]) => ({ key, value: val }));
+  return [{ value: data }];
+}
+function inferColumns(row) {
+  if (!row) return [];
+  return Object.keys(row).slice(0, 8).map((key) => ({ key, label: key }));
+}
+function formatCell(value2) {
+  if (value2 === null || value2 === void 0) return "";
+  if (typeof value2 === "object") return JSON.stringify(value2);
+  return String(value2);
+}
+function isRecord4(value2) {
+  return typeof value2 === "object" && value2 !== null && !Array.isArray(value2);
+}
+
+// src/program.ts
+function createProgram(io) {
+  const program = new Command();
+  program.name("wcs-edu-os").description("WCS EDU OS \u5F00\u6E90\u7BA1\u7406\u5458\u547D\u4EE4\u884C\u5DE5\u5177").addHelpText("after", `
+\u9996\u6B21\u4F7F\u7528\uFF1A
+  npm install -g @wcs-edu-os/cli
+  wcs-edu-os guide getting-started
+  wcs-edu-os doctor
+
+\u5E38\u7528\u4E3B\u9898\uFF1Awcs-edu-os guide course | wcs-edu-os guide exam | wcs-edu-os guide write
+`).showHelpAfterError().exitOverride().option("--profile <name>", "\u9009\u62E9 Profile").option("--output <format>", "\u8F93\u51FA\u683C\u5F0F: json|jsonl|table").option("--non-interactive", "\u7981\u7528\u4EA4\u4E92\u63D0\u793A").option("--secret-stdin", "\u4ECE\u6807\u51C6\u8F93\u5165\u8BFB\u53D6 appSecret").option("--request-id <id>", "\u8BF7\u6C42\u94FE\u8DEF\u6807\u8BC6").option("--timeout <ms>", "\u8BF7\u6C42\u8D85\u65F6\u6BEB\u79D2\u6570", "10000").option("--no-color", "\u7981\u7528 ANSI \u989C\u8272").option("--debug", "\u8F93\u51FA\u8131\u654F\u8BCA\u65AD\u4FE1\u606F\u5230 stderr");
+  program.option("--dry-run", "\u4EC5\u6821\u9A8C\u5199\u8BA1\u5212\u5E76\u751F\u6210\u786E\u8BA4\u4EE4\u724C").option("--confirm-token <token>", "\u6267\u884C dry-run \u751F\u6210\u7684\u786E\u8BA4\u4EE4\u724C").option("--idempotency-key <key>", "\u5199\u8BF7\u6C42\u5E42\u7B49\u952E");
+  for (const spec2 of commandRegistry) registerSpec(program, spec2, io);
+  return program;
+}
+async function runProgram(argv, io) {
+  const program = createProgram(io);
+  try {
+    await program.parseAsync(argv, { from: "user" });
+    return Number(process.exitCode ?? 0);
+  } catch (error) {
+    if (error instanceof CommanderError && error.exitCode === 0) return 0;
+    const id = requestId();
+    const cliError = error instanceof CommanderError ? new CliError("VALIDATION_ERROR", error.message, ExitCode.VALIDATION) : error;
+    const failed = failureEnvelope("cli", id, cliError);
+    io.stdout.write(`${JSON.stringify(failed.envelope)}
+`);
+    return failed.error.exitCode;
+  }
+}
+function registerSpec(program, spec2, io) {
+  let parent = program;
+  for (let index = 0; index < spec2.segments.length - 1; index += 1) {
+    const segment = spec2.segments[index];
+    let child = parent.commands.find((command) => command.name() === segment);
+    if (!child) {
+      child = new Command(segment).exitOverride();
+      parent.addCommand(child);
+    }
+    parent = child;
+  }
+  const leaf = new Command(spec2.segments.at(-1)).description(spec2.description).exitOverride();
+  leaf.addHelpText("after", `
+\u793A\u4F8B\uFF1Awcs-edu-os ${spec2.segments.join(" ")} --output json
+`);
+  for (const argument of spec2.arguments) {
+    leaf.argument(argument.required ? `<${argument.name}>` : `[${argument.name}]`, argument.description);
+  }
+  for (const option of spec2.options) addOption(leaf, option);
+  leaf.action(async (...values) => {
+    const command = values.at(-1);
+    const positional = values.slice(0, spec2.arguments.length);
+    const input = { ...command.opts() };
+    spec2.arguments.forEach((argument, index) => {
+      if (positional[index] !== void 0) input[argument.name] = positional[index];
+    });
+    const globals = command.optsWithGlobals();
+    if (globals.output && !["json", "jsonl", "table"].includes(globals.output)) {
+      throw new CliError("OUTPUT_INVALID", `\u4E0D\u652F\u6301\u7684\u8F93\u51FA\u683C\u5F0F: ${globals.output}`, ExitCode.VALIDATION);
+    }
+    const result = await runCommand(spec2, input, globals, io);
+    process.exitCode = result.exitCode;
+  });
+  parent.addCommand(leaf);
+}
+function addOption(command, spec2) {
+  const option = new Option(spec2.flags, spec2.description);
+  if (spec2.collect) {
+    option.argParser((value2, previous = []) => previous.concat(value2));
+    option.default([]);
+  } else if (spec2.defaultValue !== void 0) {
+    option.default(spec2.defaultValue);
+  }
+  command.addOption(option);
+}
+
+// src/index.ts
+var exitCode = await runProgram(process.argv.slice(2), {
+  stdin,
+  stdout,
+  stderr,
+  env: process.env
+});
+process.exitCode = exitCode;
+//# sourceMappingURL=index.js.map