@wirecat/cli-template 0.14.0 → 0.16.0

package/.github/workflows/ci.yml

@@ -57,6 +57,23 @@ jobs:
       - run: pnpm test
       - run: pnpm smoke:node
 
+  # The template's own check: a CLI made from it has no kit/. Needs the network for npm and pnpm installs.
+  kit-e2e:
+    if: github.repository == 'WireCatLabs/cli-template'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        with:
+          node-version: 24
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts
+      - run: pnpm kit:e2e
+
   version:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest

package/AGENTS.md

@@ -10,13 +10,67 @@ touches (`WC-<AREA>-<n>`) in the commit message and the pull request. The rules
 
 [docs/dev/DESIGN.md](docs/dev/DESIGN.md) holds the owner's answers to the
 [design interview](docs/dev/skills/design-interview/SKILL.md) and the decisions made since. Read it before changing
-what a command does, and write a new decision there. Learn the patterns for the provider, the store and the commands
-from the reference CLI below; the template has no sample code on purpose.
+what a command does, and write a new decision there. Learn how a command reaches a service from the sample below,
+and the domain, the store and its commands from the reference CLI.
 
 <!-- cli-template:reference-cli:start -->
 The reference CLI is not chosen yet; see [Reference CLIs](docs/dev/reference-clis.md).
 <!-- cli-template:reference-cli:end -->
 
+## The sample: what to keep, what to replace
+
+<!-- cspell:words gcal SECR -->
+
+The template ships one working command group, `comments`, against a made-up service, Example Comments, whose address
+never resolves. It shows every pattern a command that reaches a service needs, each tested against a strict fake of
+the service. Build your first command on it: keep the patterns, replace the service. Delete the rest of the sample
+once your own commands cover every pattern below; until then `pnpm test` keeps it working. A CLI made before the
+sample has no `src/sample/`; read it in [cli-template](https://github.com/WireCatLabs/cli-template/tree/main/src).
+Comments marked `SAMPLE:` in the code say what to replace.
+
+Keep, the same for every service:
+
+- **Token storage**, `src/token.ts`: cli-base `Credentials`, the environment variable, then the keyring, then a
+  private file; a run with moved folders never replaces the owner's entry (WC-SECR-4, WC-SECR-24).
+- **Sign-in**, `src/commands/session.ts`: `session start | status | end | list`. The token is read hidden or from
+  stdin, never as an argument, and checked against the service before it is kept (WC-ACCT-12, WC-SECR-5). Replace
+  the `me` check with your service's. A service with OAuth signs in through cli-core's oauth module instead, as
+  [gcal-cli](https://github.com/WireCatLabs/gcal-cli) does (WC-SECR-22).
+- **The command context**, `src/context.ts`: settings, the keyring and the run come from cli-core's `baseContext`
+  only, and every request runs inside its `run()`, with the `events` it gives passed to the transport. That is what
+  bounds a command by `--timeout` and records a run named after it (WC-LIFE-5, WC-LIFE-15).
+- **Permissions**, `src/program.ts` and `src/config.ts`: the program hands cli-core the whole `configuration`, and
+  each command path is its own key (WC-PERM-22). A command that reaches the service another way, such as an
+  `api call`, also checks the key of the command it does the same as, with `alsoChecks`.
+- **Writes**, `write` in `src/commands/comments.ts`: the guard asks or refuses by the command's key, the send journal
+  records the attempt, the answer carries `operation_id`, and a write is never retried: one that got no answer is
+  `outcome_unknown` (WC-PERM-13, WC-PERM-17, WC-OUT-10, WC-LIFE-9). `--dry-run` and `<PREFIX>_READ_ONLY` are
+  cli-core's; declare no `--dry-run` of your own.
+- **MCP and doctor**, `src/program.ts`: cli-core's `appMcpCommand` and `appDoctorCommand`, never a copy of them.
+  Rewrite `name` and `untrusted` for your service (WC-MCP-11).
+- **The test harness**, `src/testing/harness.ts`: the CLI through its own `run()`, with a memory keyring and the fake
+  in place of the network (WC-TEST-2, WC-TEST-3, WC-TEST-6).
+
+Replace, your service's own:
+
+- **The transport**, `src/sample/transport.ts`: the token in a header only, no redirects, a timeout, cli-core's
+  `Pacer`, cli-base's error codes and no retry (WC-SECR-6, WC-SECR-7, WC-OUT-20). Keep its shape; take the address,
+  the header and the error mapping from your service's documentation.
+- **Wire shapes and the mapper**, `src/sample/comments.ts`: each field name from the documentation or a captured
+  answer, never from memory; no wire type leaves this file (WC-ARCH-3).
+- **The commands**, `src/commands/comments.ts`: a list with `withPaging`, `withQuery` and `answerEntity`, so
+  `--json=a,b` and the MCP schema come from one schema (WC-CMD-19, WC-CMD-20); `show`; `create` and `update`.
+- **The strict fake**, `src/testing/fake-comments.ts`: it refuses an unknown path, parameter or field, so a name typed
+  from memory fails a test instead of reaching the owner's account. Build yours from the documentation.
+- **The tests**, `src/comments.test.ts` and `src/sample/transport.test.ts`. Keep each case for your commands: a deny
+  stops a read before any request, `--dry-run` sends nothing, a lost write is `outcome_unknown`, a recorded run is
+  named after its command, and the token reaches no output, run record or file.
+
+Remove the sample only once your own commands and their tests cover each pattern above: the skeleton alone is below
+the coverage floor, and the floor is never lowered (WC-TEST-11). To remove it, unmount `commentsCommand` in `src/program.ts` and delete `src/sample/`,
+`src/commands/comments.ts`, `src/testing/fake-comments.ts` and their tests. Then run `pnpm generate`,
+`pnpm exec cli-contract contracts/plan.json --update` and `pnpm test:matrix`.
+
 ## Template-owned files
 
 This CLI was made from [cli-template](https://github.com/WireCatLabs/cli-template). `template.json` names the files

package/CHANGELOG.md

@@ -5,6 +5,52 @@ Notable changes to `@wirecat/cli-template`. One section per version, newest firs
 
 <!-- cspell:words clawhub gcal katex openclaw smol whatsapp -->
 
+## 0.16.0 — 06.11.2026
+
+### Added
+
+- **`pnpm kit:e2e` runs in CI and checks more.** It makes a CLI with a short name and one with a long name, since a
+  rename changes line lengths, and runs `pnpm lint` in each besides `ci:quick` and `test:coverage`. A rename that
+  broke Biome's formatting passed it before. The `kit-e2e` job in `.github/workflows/ci.yml` runs it on every pull
+  request and merge, in this repository only: a CLI made from the template has no `kit/` and skips the job.
+
+- **A working sample shows every pattern a command that reaches a service needs.** `comments list | show | create |
+  update` and `session start | status | end | list` reach Example Comments, a made-up service whose address never
+  resolves. The token is kept with cli-base's `Credentials`; every request runs inside cli-core's `baseContext` run
+  with its `events`; the transport keeps the token in a header, times out and never retries; writes pass the guard
+  and the send journal and answer with `operation_id`, and a lost write is `outcome_unknown`. The tests run against a
+  strict fake that refuses unknown paths, parameters and fields. `AGENTS.md` lists what to keep and what to replace,
+  pattern by pattern, with the rules each follows, and the code marks each replaceable part with `SAMPLE:`. Before,
+  the template had no sample, and agents copied the patterns from other CLIs, their bugs included.
+
+### Changed — may break callers
+
+- **MCP and doctor are cli-core's.** `src/program.ts` mounts `appMcpCommand` and `appDoctorCommand`, as gcal-cli
+  does, in place of the template's own `src/mcp.ts`, `src/commands/mcp.ts` and `src/commands/doctor.ts`. `mcp` gains
+  `config`, `add`, `check`, `--profiles` and `--permission`; `doctor` gains `--online`, and its answer `store` and
+  `profile_lock`. A CLI made from an older skeleton swaps them the same way and removes `@modelcontextprotocol/server`
+  and `@modelcontextprotocol/client` from its dependencies.
+
+### Fixed
+
+- **A new CLI passes `pnpm lint` from its first commit.** Renaming `clidev` changes line lengths, so Biome wraps some
+  lines differently, and the first commit's hook or CI failed on formatting. `new`'s next steps now run
+  `pnpm lint:fix` after `pnpm install`, and `kit:e2e` does the same before it runs `pnpm lint`.
+- **The MCP server applies the permission table too (WC-PERM-23).** `src/mcp.ts` built its tools without it, so a
+  command a profile denies was offered to an agent as available and ran. It now passes `permissions` to
+  `toolsFromCommands` and to each tool call: the command is listed as unavailable and refused before it runs. A CLI
+  made from an older skeleton adds `permissions` in both places by hand.
+
+## 0.15.0 — 06.11.2026
+
+### Fixed
+
+- **A `deny` in a profile stops a command again.** The skeleton handed cli-core only `resolveSettings`, and cli-core
+  checks a command's key only when it gets the permission table too, so a denied read still ran and `--dry-run`
+  previewed every command as allowed. `src/program.ts` now passes the whole `configuration`, and `src/config.ts`
+  declares `commandPermissions()`, so each command is checked against its own path. A CLI made from an older
+  skeleton makes the same two changes by hand.
+
 ## 0.14.0 — 06.11.2026
 
 ### Added

package/README.md

@@ -5,8 +5,9 @@
 
 `clidev` is a command-line tool started from [cli-template](https://github.com/WireCatLabs/cli-template), the kit for
 new WireCat CLIs. It is a working skeleton: the shared root commands, the settings, the agent skill and the MCP
-server run, and every check of the WireCat standards passes. It does not connect to a service yet. Replace this page
-with the tool's own introduction once it does.
+server run, and every check of the WireCat standards passes. Its one service is a sample, Example Comments, made up
+to show how a command reaches a service; its address never resolves. Replace this page with the tool's own
+introduction once the CLI reaches its real service.
 
 To start a new CLI from the template:
 
@@ -30,6 +31,8 @@ such as `personal` in `clidev personal config show`; none is ever assumed. `CLID
 | Command | What it does |
 | --- | --- |
 | `clidev doctor` | Checks this installation: version, paths, settings and profiles, without the network |
+| `clidev personal session start` | Signs the profile in with the service's token, kept in the OS keyring |
+| `clidev personal comments list` | The sample: lists, shows, creates and updates comments in Example Comments |
 | `clidev commands --json` | Prints every command as JSON, for agents and scripts |
 | `clidev personal config show` | Shows each setting and where it came from |
 | `clidev skill install` | Installs the agent skill for Claude Code, Codex, Gemini CLI and OpenClaw; `--for hermes` for Hermes Agent |
@@ -57,6 +60,9 @@ keeps the shared files in step later, so a CLI made today does not drift from on
 - **`upgrade`** merges each template change into your CLI file by file, and asks before it touches a file you changed.
 - **The skeleton runs.** The shared root commands, settings with permissions, the agent skill and the MCP server
   work before a line of your own code.
+- **A sample shows every pattern.** `comments` reaches a made-up service the way a real command must: the token in
+  the keyring, every request inside cli-core's run, writes behind the guard, and a strict fake in the tests.
+  `AGENTS.md` lists what to keep and what to replace.
 - **Every check is wired in:** lint, types, tests with a coverage floor, command contracts, the docs checks and the
   release script.
 
@@ -66,7 +72,8 @@ The copy tool is described in [kit/README.md](kit/README.md).
 
 A profile is a name you choose for one account, such as `personal` or `work`. It is the first word of every command
 that uses an account. No profile is ever assumed: a command without one stops and lists the profiles on this
-computer. The skeleton has no sign-in yet; the CLI built from it adds one.
+computer. `session start` signs a profile in; its token goes to the OS keyring, or to a private file where no
+keyring works.
 
 ## Settings and permissions
 
@@ -80,7 +87,8 @@ The skeleton connects to no service, keeps no messages and has no commands of it
 
 ## Security
 
-`clidev` keeps its settings and state on this computer and sends nothing to any service yet. See
+`clidev` keeps its settings and state on this computer, and its token in the OS keyring. Its only service is the
+sample's, whose address never resolves. See
 [Security](docs/security.md), and report a vulnerability privately as [SECURITY.md](SECURITY.md) says.
 
 ## When it does not work

package/biome.json

@@ -5,7 +5,7 @@
   "extends": ["./config/wirecat/biome.base.json"],
   "overrides": [
     {
-      "includes": ["src/**", "!src/mcp.ts", "!**/*.test.ts"],
+      "includes": ["src/**", "!**/*.test.ts"],
       "linter": {
         "rules": {
           "style": {
@@ -15,7 +15,7 @@
                 "patterns": [
                   {
                     "group": ["@modelcontextprotocol/**"],
-                    "message": "only src/mcp.ts serves MCP; commands and services do not know the protocol"
+                    "message": "cli-core's appMcpCommand serves MCP; commands and services do not know the protocol"
                   }
                 ]
               }

package/contracts/mcp-tools.json

@@ -18,7 +18,7 @@
           "type": "object"
         },
         "command": {
-          "description": "a command clidev_tools_search returned: \"runs list\"",
+          "description": "a command clidev_tools_search returned: \"session list\"",
           "minLength": 1,
           "type": "string"
         }
@@ -542,7 +542,7 @@
           "type": "object"
         },
         "command": {
-          "description": "a command clidev_tools_search returned: \"runs list\"",
+          "description": "a command clidev_tools_search returned: \"session list\"",
           "minLength": 1,
           "type": "string"
         }

package/dist/bin/clidev.js

@@ -9,7 +9,7 @@ if (
   (words[0] === "--version" || words[0] === "-V") &&
   !Object.keys(process.env).some((key) => key.endsWith("_TEST_ARGV_LOG"))
 ) {
-  process.stdout.write("0.14.0\n")
+  process.stdout.write("0.16.0\n")
 } else {
   // Before the bundle compiles: the bundle's own call comes after its chunks.
   module.enableCompileCache()
@@ -28,7 +28,7 @@ if (
           : next(specifier, context),
     })
   }
-  const chunks = ["../bundle/all-profiles-NVB2HT2S.js","../bundle/anthropic-ICTW7CNQ.js","../bundle/app-server-B6BCKXR7.js","../bundle/bun-ILPS6AYA.js","../bundle/bun-sqlite-JE6FJFQT.js","../bundle/decode-NXB5UKMO.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-DRDGGHJT.js","../bundle/embed-IKZ24BMC.js","../bundle/embedder-GMQ24DOQ.js","../bundle/first-screen-376CXGXJ.js","../bundle/instructions-EOQOXY6V.js","../bundle/mcp-7HBLFGCW.js","../bundle/mcp-KHUZOJO6.js","../bundle/mcp-MZHWJXAE.js","../bundle/node-52WF2326.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-73Z4SFOA.js","../bundle/oauth-EVTPAMZP.js","../bundle/open-46WZAPJ3.js","../bundle/openai-GWRDAHDU.js","../bundle/process-YIQPKLZI.js","../bundle/program-B3CY3FP7.js","../bundle/prompt-IVEYRLS5.js","../bundle/recognize-WVEKHODM.js","../bundle/remote-4K5VPMC7.js","../bundle/rerank-V24UJZYJ.js","../bundle/serve-PJWSOV7F.js","../bundle/server-2ZN7KZHZ.js","../bundle/server-5VYM7CCF.js","../bundle/state-ZPYGECVP.js","../bundle/store-6JQCLPQF.js","../bundle/store-maintenance-command-7XICIYHW.js"]
+  const chunks = ["../bundle/all-profiles-FS7AEOE7.js","../bundle/anthropic-5RN7BGDI.js","../bundle/app-server-WGTKZQKJ.js","../bundle/bun-ILPS6AYA.js","../bundle/bun-sqlite-WK2IGBGD.js","../bundle/decode-QMLOGZ6R.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-DRDGGHJT.js","../bundle/embed-PIR2LJR2.js","../bundle/embedder-6KBRPAEQ.js","../bundle/first-screen-3T5IXTFL.js","../bundle/instructions-EOQOXY6V.js","../bundle/mcp-7HBLFGCW.js","../bundle/node-52WF2326.js","../bundle/node-P4E63KXA.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-LIK6OYNF.js","../bundle/oauth-7FVF7HQQ.js","../bundle/open-CRZDEATN.js","../bundle/openai-WAJ6WREQ.js","../bundle/process-YIQPKLZI.js","../bundle/program-ZFFFPBRS.js","../bundle/prompt-QQIVHO3M.js","../bundle/recognize-4KLBZDEC.js","../bundle/remote-BABMZTHA.js","../bundle/rerank-P3IQQJIL.js","../bundle/serve-25SSAKRZ.js","../bundle/server-G4GCDMYI.js","../bundle/server-P4XUYY5A.js","../bundle/state-QCQALQBJ.js","../bundle/store-ZECPRGGH.js","../bundle/store-maintenance-command-ECUO5G6L.js"]
   if (((words) => words
     .filter((word) => !word.startsWith("-"))
     .slice(0, 2)

package/dist/bundle/{chunk-LU4A2T7Y.js → all-profiles-FS7AEOE7.js}

@@ -9,10 +9,14 @@ import {
   StdioServerTransport,
   callerOf,
   serveStdio
-} from "./chunk-F34HGYWF.js";
+} from "./chunk-JFXWLQ2L.js";
 import {
   McpServer
 } from "./chunk-5D4AEUVA.js";
+import "./chunk-ORV4EGNC.js";
+import "./chunk-3WDYHOAF.js";
+import "./chunk-WDWP5N6M.js";
+import "./chunk-Y5E2WNWB.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";
@@ -251,7 +255,7 @@ var serveAllProfilesOverStdio = /* @__PURE__ */ __name(async (options, io = {})
 }, "serveAllProfilesOverStdio");
 var serveAllProfilesOverHttp = /* @__PURE__ */ __name(async (options, http) => {
   const { build, close } = allProfilesServer(options);
-  const { serveOverHttp } = await import("./serve-PJWSOV7F.js");
+  const { serveOverHttp } = await import("./serve-25SSAKRZ.js");
   const listening = await serveOverHttp(build, {
     ...http,
     appName: options.command,
@@ -271,11 +275,10 @@ var serveAllProfilesOverHttp = /* @__PURE__ */ __name(async (options, http) => {
     }, "close")
   };
 }, "serveAllProfilesOverHttp");
-
 export {
   CHILD_IDLE_MS,
-  withProfile,
   allProfilesServer,
+  serveAllProfilesOverHttp,
   serveAllProfilesOverStdio,
-  serveAllProfilesOverHttp
+  withProfile
 };

package/dist/bundle/{anthropic-ICTW7CNQ.js → anthropic-5RN7BGDI.js}

@@ -2,11 +2,11 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   checkedOptions
-} from "./chunk-R5RYPD23.js";
+} from "./chunk-RYOAQCVJ.js";
 import {
   messagesFor,
   systemFor
-} from "./chunk-LATYBJ4T.js";
+} from "./chunk-FMO6F5Q2.js";
 import {
   Anthropic
 } from "./chunk-ADLS6FVG.js";
@@ -15,7 +15,7 @@ import {
   optional,
   strictObject,
   string
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import "./chunk-Y5E2WNWB.js";
 import {
   __name

package/dist/bundle/{app-server-B6BCKXR7.js → app-server-WGTKZQKJ.js}

@@ -3,11 +3,10 @@ const require = __bundleRequire(import.meta.url);
 import {
   PER_RUN,
   envelope
-} from "./chunk-BEBD27QT.js";
-import "./chunk-BWBZCYUN.js";
+} from "./chunk-EILS4BTQ.js";
 import {
   mcpUrlOf
-} from "./chunk-GUFPQZUA.js";
+} from "./chunk-TXHCL75B.js";
 import {
   answeredWire
 } from "./chunk-VS5LGSTM.js";
@@ -17,20 +16,20 @@ import {
   registerCommands,
   runCommandForAgent,
   toolsFromCommands
-} from "./chunk-UT5TQ6MD.js";
+} from "./chunk-BPMKAZSS.js";
 import {
   agentJson,
   skillResource
-} from "./chunk-HYTHTSJP.js";
+} from "./chunk-WM5AMTRY.js";
 import {
   StdioServerTransport,
   serveStdio
-} from "./chunk-F34HGYWF.js";
-import "./chunk-IZKXJJ7V.js";
-import "./chunk-5SAF3XOL.js";
-import "./chunk-PIJUGF5F.js";
-import "./chunk-2DAXUNTS.js";
-import "./chunk-AS2PJNQ2.js";
+} from "./chunk-JFXWLQ2L.js";
+import "./chunk-JJZCPBH3.js";
+import "./chunk-ZSY4WAGI.js";
+import "./chunk-CTBHQRX6.js";
+import "./chunk-5HHIPDNW.js";
+import "./chunk-2MWNE4L3.js";
 import "./chunk-7Z4HR6GO.js";
 import {
   appInstructions
@@ -40,11 +39,11 @@ import {
 } from "./chunk-5D4AEUVA.js";
 import {
   mcpHttpMarker
-} from "./chunk-6AW4DDK4.js";
-import "./chunk-DZLHY4IA.js";
-import "./chunk-SOYOOU2D.js";
-import "./chunk-LATYBJ4T.js";
-import "./chunk-BM5ZCDPQ.js";
+} from "./chunk-ETJXPB6A.js";
+import "./chunk-C3GNOEJP.js";
+import "./chunk-MBBOINK4.js";
+import "./chunk-FMO6F5Q2.js";
+import "./chunk-MEXT6XDP.js";
 import {
   DEFAULT_OUTPUT_BYTES,
   changesAuthorityAt,
@@ -54,25 +53,25 @@ import {
   readOnlyLockOf,
   readsOverMcpAt,
   rootOf2 as rootOf
-} from "./chunk-RJ7AS7UB.js";
-import "./chunk-VXOR76ZL.js";
-import "./chunk-U6QD3J3F.js";
+} from "./chunk-HTYLT6ME.js";
+import "./chunk-ORV4EGNC.js";
+import "./chunk-ATHZEV2Z.js";
 import "./chunk-VOTEB3AN.js";
-import "./chunk-NVNUUHT5.js";
-import "./chunk-R2JKPHH5.js";
-import "./chunk-YOJLIVGO.js";
+import "./chunk-EA3TMI4A.js";
+import "./chunk-NVPWZF67.js";
+import "./chunk-5KAYQKBK.js";
 import "./chunk-3WDYHOAF.js";
-import "./chunk-TJJ2XSJP.js";
-import "./chunk-NH6LZ3H3.js";
+import "./chunk-QGOOPPEW.js";
+import "./chunk-RFJKNFVF.js";
 import "./chunk-3MDNAYQA.js";
 import "./chunk-CGFQT3LQ.js";
-import "./chunk-DQIBGCF3.js";
-import "./chunk-45244QQ6.js";
-import "./chunk-62JRF2JA.js";
+import "./chunk-Z5NL6YNU.js";
+import "./chunk-OF56L2JU.js";
+import "./chunk-6WOJIAYA.js";
 import {
   CliError,
   mcpErrorResult
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import "./chunk-Y5E2WNWB.js";
 import {
   __name
@@ -193,7 +192,7 @@ var serveAppOverStdio = /* @__PURE__ */ __name(async (command, context, options)
 var serveAppOverHttp = /* @__PURE__ */ __name(async (command, context, options, http) => {
   const { app } = options;
   const { build } = createAppServer(command, context, options);
-  const { serveOverHttp } = await import("./serve-PJWSOV7F.js");
+  const { serveOverHttp } = await import("./serve-25SSAKRZ.js");
   const listening = await serveOverHttp(build, {
     ...http,
     appName: app.command,

package/dist/bundle/{bun-sqlite-JE6FJFQT.js → bun-sqlite-WK2IGBGD.js}

@@ -3,8 +3,8 @@ const require = __bundleRequire(import.meta.url);
 import {
   loadVectorExtension,
   vectorExtension
-} from "./chunk-LFLSV353.js";
-import "./chunk-IOJ2DTCY.js";
+} from "./chunk-DEHBTFIC.js";
+import "./chunk-WDWP5N6M.js";
 import {
   importFrom
 } from "./chunk-Y5E2WNWB.js";

package/dist/bundle/{chunk-AS2PJNQ2.js → chunk-2MWNE4L3.js}

@@ -12,7 +12,7 @@ import {
   optional,
   saveConfigFile,
   string
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import {
   __name,
   __toESM

package/dist/bundle/{chunk-2DAXUNTS.js → chunk-5HHIPDNW.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   CliError
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";

package/dist/bundle/{chunk-YOJLIVGO.js → chunk-5KAYQKBK.js}

@@ -37,7 +37,7 @@ import {
   unknown,
   variant,
   visibleControls
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";

package/dist/bundle/{chunk-62JRF2JA.js → chunk-6WOJIAYA.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   resolvePaths
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";

package/dist/bundle/chunk-7EUX7AZV.js

@@ -0,0 +1,141 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  CliError,
+  isCliError
+} from "./chunk-WDWP5N6M.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_typescript@7.0.2_vitest@5.0.5/node_modules/@wirecat/cli-base/dist/http/body.js
+var interrupted = /* @__PURE__ */ __name((signal) => isCliError(signal.reason) ? signal.reason : new CliError(signal.reason instanceof Error && signal.reason.name === "TimeoutError" ? "timeout" : "cancelled", "HTTP response read was interrupted"), "interrupted");
+var checked = /* @__PURE__ */ __name((signal) => {
+  if (signal?.aborted)
+    throw interrupted(signal);
+}, "checked");
+var abortable = /* @__PURE__ */ __name(async (pending, signal) => {
+  if (!signal)
+    return pending;
+  let abort = /* @__PURE__ */ __name(() => {
+  }, "abort");
+  const stopped = new Promise((_, reject) => {
+    abort = /* @__PURE__ */ __name(() => reject(interrupted(signal)), "abort");
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted)
+      abort();
+  });
+  try {
+    return await Promise.race([pending, stopped]);
+  } finally {
+    signal.removeEventListener("abort", abort);
+  }
+}, "abortable");
+var readJsonResponse = /* @__PURE__ */ __name(async (response, options) => {
+  const { maxBytes, signal } = options ?? {};
+  if (!Number.isSafeInteger(maxBytes) || maxBytes < 1)
+    throw new CliError("validation_error", "maxBytes must be a positive safe integer");
+  if (signal !== void 0 && !(signal instanceof AbortSignal))
+    throw new CliError("validation_error", "signal must be an AbortSignal");
+  if (signal?.aborted) {
+    void response.body?.cancel().catch(() => {
+    });
+    throw interrupted(signal);
+  }
+  const length = response.headers.get("content-length");
+  if (length !== null && (!/^\d+$/.test(length) || Number(length) > maxBytes)) {
+    void response.body?.cancel().catch(() => {
+    });
+    throw new CliError("invalid_response", "HTTP response exceeds the byte budget");
+  }
+  if (!response.body)
+    throw new CliError("invalid_response", "HTTP response has no body");
+  if (response.body.locked)
+    throw new CliError("invalid_response", "HTTP response body is already in use");
+  const reader = response.body.getReader();
+  const chunks = [];
+  let bytes = 0;
+  try {
+    for (; ; ) {
+      checked(signal);
+      const part = await abortable(reader.read(), signal);
+      checked(signal);
+      if (part.done)
+        break;
+      if (!(part.value instanceof Uint8Array))
+        throw new CliError("invalid_response", "HTTP response is not bytes");
+      bytes += part.value.byteLength;
+      if (bytes > maxBytes)
+        throw new CliError("invalid_response", "HTTP response exceeds the byte budget");
+      if (part.value.byteLength)
+        chunks.push(new Uint8Array(part.value));
+    }
+    const body = new Uint8Array(bytes);
+    let offset = 0;
+    for (const chunk of chunks) {
+      body.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    try {
+      return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(body));
+    } catch {
+      throw new CliError("invalid_response", "HTTP response is not valid UTF-8 JSON");
+    }
+  } catch (error) {
+    checked(signal);
+    if (isCliError(error))
+      throw error;
+    throw new CliError("network_error", "HTTP response could not be read");
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+    reader.releaseLock();
+  }
+}, "readJsonResponse");
+
+// node_modules/.pnpm/@wirecat+cli-base@0.77.1_commander@15.0.0_esbuild@0.28.2_typescript@7.0.2_vitest@5.0.5/node_modules/@wirecat/cli-base/dist/http/index.js
+var parseRetryAfter = /* @__PURE__ */ __name((header, now) => {
+  if (!header)
+    return void 0;
+  const trimmed = header.trim();
+  if (/^\d+$/.test(trimmed))
+    return Number(trimmed) * 1e3;
+  const at = Date.parse(trimmed);
+  if (Number.isNaN(at))
+    return void 0;
+  const delta = at - now().getTime();
+  return delta > 0 ? delta : void 0;
+}, "parseRetryAfter");
+var parseRateLimitReset = /* @__PURE__ */ __name((header, now) => {
+  if (!header)
+    return void 0;
+  const seconds = Number(header.trim());
+  if (!Number.isFinite(seconds))
+    return void 0;
+  const delta = seconds * 1e3 - now().getTime();
+  return delta > 0 ? delta : void 0;
+}, "parseRateLimitReset");
+var providerWaitMs = /* @__PURE__ */ __name((headers, now) => parseRetryAfter(headers.get("retry-after"), now) ?? parseRateLimitReset(headers.get("x-ratelimit-reset"), now), "providerWaitMs");
+var statusToCode = /* @__PURE__ */ __name((status) => {
+  if (status === 400 || status === 422)
+    return "validation_error";
+  if (status === 401)
+    return "authentication_error";
+  if (status === 403)
+    return "permission_error";
+  if (status === 404)
+    return "not_found";
+  if (status === 408)
+    return "timeout";
+  if (status === 429)
+    return "rate_limited";
+  if (status === 502 || status === 503 || status === 504)
+    return "provider_unavailable";
+  return "provider_error";
+}, "statusToCode");
+
+export {
+  readJsonResponse,
+  providerWaitMs,
+  statusToCode
+};

package/dist/bundle/{chunk-7F5VMLVK.js → chunk-ADFSSIV4.js}

@@ -2,7 +2,7 @@ import { createRequire as __bundleRequire } from "node:module";
 const require = __bundleRequire(import.meta.url);
 import {
   CliError
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import {
   importFrom
 } from "./chunk-Y5E2WNWB.js";

package/dist/bundle/{chunk-U6QD3J3F.js → chunk-ATHZEV2Z.js}

@@ -3,10 +3,10 @@ const require = __bundleRequire(import.meta.url);
 import {
   readSharedSection,
   writeSharedSection
-} from "./chunk-TJJ2XSJP.js";
+} from "./chunk-QGOOPPEW.js";
 import {
   CliError
-} from "./chunk-IOJ2DTCY.js";
+} from "./chunk-WDWP5N6M.js";
 import {
   __name
 } from "./chunk-ZVVMGPBJ.js";