@wirecat/cli-template 0.15.0 → 0.16.0

package/dist/context.js

@@ -0,0 +1,58 @@
+import { CliError } from "@wirecat/cli-base";
+import { baseContext, environmentOf, } from "@wirecat/cli-core/cli";
+import { Pacer, pacePathFor } from "@wirecat/cli-core/sends";
+import { configuration } from "./config.js";
+import { IDENTITY } from "./identity.js";
+import { commentsService } from "./sample/comments.js";
+import { SERVICE, transport } from "./sample/transport.js";
+import { tokenStore } from "./token.js";
+// SAMPLE: your service's documented limit; this one is made up.
+const PACE = { perMinute: 120, burst: 20 };
+/**
+ * Settings, keyring and the run come from cli-core's `baseContext` and nowhere else: a command that resolves settings
+ * on its own skips `--timeout`, the run record and the profile's permissions (WC-LIFE-5, WC-LIFE-15).
+ */
+export const contextOf = (command) => {
+    const base = baseContext(command, configuration.resolveSettings);
+    return {
+        ...base,
+        environment: environmentOf(command),
+        flags: command.optsWithGlobals(),
+        profile: base.settings.profile,
+        tokens: tokenStore(base.env, base.keyring, base.renderer.warn),
+    };
+};
+export const signInWords = (profile) => `\`${IDENTITY.command} ${profile} session start\``;
+export const refuseOffline = (flags) => {
+    if (flags.offline)
+        throw new CliError("permission_error", `this needs ${SERVICE}; leave out --offline`, { reason: "offline.refused" });
+};
+/** The service for one run, with the token it was given; `events` comes from `run()`, so each request is recorded. */
+export const serviceFor = (command, token, events) => {
+    const { environment, env, profile } = contextOf(command);
+    return commentsService(transport({
+        token,
+        events,
+        signal: environment.signal,
+        ...(environment.fetch ? { fetch: environment.fetch } : {}),
+        pacer: new Pacer(pacePathFor(IDENTITY, profile, env), PACE),
+    }));
+};
+/** The profile's saved token, or an authentication error that says how to sign in. Read before any request. */
+export const tokenOf = (command) => {
+    const { flags, profile, tokens } = contextOf(command);
+    refuseOffline(flags);
+    const saved = tokens.read(profile);
+    if (!saved)
+        throw new CliError("authentication_error", `profile ${profile} is not signed in — run ${signInWords(profile)}`);
+    return saved.secret;
+};
+/**
+ * Every remote call goes through here: inside cli-core's run, so `--timeout` bounds it, a failure or `--record` keeps
+ * a run named after the command, and the transport's requests land in that run (WC-LIFE-5, WC-LIFE-15).
+ */
+export const withService = (command, body) => {
+    const token = tokenOf(command);
+    return contextOf(command).run((events) => body(serviceFor(command, token, events)));
+};
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAEL,WAAW,EAEX,aAAa,GAEd,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AACxC,OAAO,EAAwB,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AAC1D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAOvC,gEAAgE;AAChE,MAAM,IAAI,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAA;AAE1C;;;GAGG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAgB,EAAE,EAAE;IAC5C,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,CAAA;IAChE,OAAO;QACL,GAAG,IAAI;QACP,WAAW,EAAE,aAAa,CAAqB,OAAO,CAAC;QACvD,KAAK,EAAE,OAAO,CAAC,eAAe,EAAe;QAC7C,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;QAC9B,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;KAC/D,CAAA;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,KAAK,QAAQ,CAAC,OAAO,IAAI,OAAO,kBAAkB,CAAA;AAElG,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAE,EAAE;IAClD,IAAI,KAAK,CAAC,OAAO;QACf,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,cAAc,OAAO,uBAAuB,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;AACvH,CAAC,CAAA;AAED,sHAAsH;AACtH,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,OAAgB,EAAE,KAAa,EAAE,MAAiB,EAAE,EAAE;IAC/E,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IACxD,OAAO,eAAe,CACpB,SAAS,CAAC;QACR,KAAK;QACL,MAAM;QACN,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,KAAK,EAAE,IAAI,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC;KAC5D,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED,+GAA+G;AAC/G,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,OAAgB,EAAU,EAAE;IAClD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IACrD,aAAa,CAAC,KAAK,CAAC,CAAA;IACpB,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,CAAC,KAAK;QACR,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,WAAW,OAAO,2BAA2B,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACjH,OAAO,KAAK,CAAC,MAAM,CAAA;AACrB,CAAC,CAAA;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAI,OAAgB,EAAE,IAA8C,EAAc,EAAE;IAC7G,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;AACrF,CAAC,CAAA"}

package/dist/program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAEA,OAAO,EAKL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EAKhB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAiBxC,eAAO,MAAM,UAAU,QAAO,iBAkB5B,CAAA;AAEF,eAAO,MAAM,aAAa,aAAc,cAAc,KAAG,OAAqD,CAAA;AAE9G,eAAO,MAAM,GAAG,SAAU,MAAM,EAAE,YAAY,UAAU,KAAG,OAAO,CAAC,MAAM,CAA2C,CAAA"}
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAEA,OAAO,EAQL,KAAK,iBAAiB,EACtB,KAAK,cAAc,EACnB,KAAK,UAAU,EAKhB,MAAM,uBAAuB,CAAA;AAE9B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAoCxC,eAAO,MAAM,UAAU,QAAO,iBAoB5B,CAAA;AAEF,eAAO,MAAM,aAAa,aAAc,cAAc,KAAG,OAAqD,CAAA;AAE9G,eAAO,MAAM,GAAG,SAAU,MAAM,EAAE,YAAY,UAAU,KAAG,OAAO,CAAC,MAAM,CAA2C,CAAA"}

package/dist/program.js

@@ -1,11 +1,13 @@
 import { join } from "node:path";
 import { resolvePaths } from "@wirecat/cli-base";
-import { commandsCommand, configCommand, createProgram as createSharedProgram, outputFor, run as runShared, runsCommand, skillCommand, upgradeCommand, } from "@wirecat/cli-core/cli";
+import { appDoctorCommand, appMcpCommand, commandsCommand, configCommand, createProgram as createSharedProgram, environmentOf, outputFor, run as runShared, runsCommand, skillCommand, upgradeCommand, } from "@wirecat/cli-core/cli";
 import { appUpdate } from "@wirecat/cli-core/update";
-import { doctorCommand } from "./commands/doctor.js";
-import { mcpCommand } from "./commands/mcp.js";
+import { commentsCommand } from "./commands/comments.js";
+import { sessionCommand } from "./commands/session.js";
 import { configuration } from "./config.js";
 import { IDENTITY, PACKAGE, SKILL } from "./identity.js";
+import { SERVICE } from "./sample/transport.js";
+import { holdsToken } from "./token.js";
 const update = appUpdate({
     packageName: PACKAGE,
     command: IDENTITY.command,
@@ -15,13 +17,31 @@ const update = appUpdate({
     enabled: (env) => configuration.resolveSettings({}, { env, needsProfile: false }).updateCheck,
     offVariables: [`${IDENTITY.envPrefix}_NO_UPDATE_CHECK`],
 });
+const mcpCommand = () => {
+    // cli-core asks `signedIn` with no keyring; the run's own one, a test's `memoryKeyring()`, is taken here. Each
+    // program builds its own `mcp`, so a tool call run beside it never swaps the server's keyring (WC-ARCH-22).
+    let keyring;
+    const mcp = appMcpCommand(IDENTITY, configuration, {
+        name: SERVICE,
+        // SAMPLE: name the kinds of text other people wrote that your answers carry (WC-MCP-11).
+        untrusted: ["comment text", "author names"],
+        permissionExample: "comments.create=deny",
+        skill: SKILL,
+        signedIn: (profile, env) => holdsToken(env, profile, keyring),
+    });
+    return mcp.hook("preAction", (_mcp, action) => {
+        keyring = environmentOf(action).keyring;
+    });
+};
 export const definition = () => ({
     app: IDENTITY,
     // The whole object: cli-core refuses a command by its key only when it gets the permission table too.
     configuration,
     commands: () => [
         commandsCommand(IDENTITY),
-        doctorCommand(),
+        sessionCommand(),
+        commentsCommand(),
+        appDoctorCommand(IDENTITY, configuration, { packageName: PACKAGE }),
         skillCommand(IDENTITY, SKILL),
         mcpCommand(),
         upgradeCommand(IDENTITY, PACKAGE, (command) => ({

package/dist/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAChD,OAAO,EACL,eAAe,EACf,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,SAAS,EAIT,GAAG,IAAI,SAAS,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AAEpD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AAExD,MAAM,MAAM,GAAG,SAAS,CAAC;IACvB,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CACjB,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAC/G,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW;IAC7F,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,kBAAkB,CAAC;CACxD,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,GAAsB,EAAE,CAAC,CAAC;IAClD,GAAG,EAAE,QAAQ;IACb,sGAAsG;IACtG,aAAa;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,QAAQ,CAAC;QACzB,aAAa,EAAE;QACf,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC7B,UAAU,EAAE;QACZ,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,SAAS,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;QACtC,WAAW,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAW,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,OAAoB,EAAmB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA"}
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../src/program.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAqB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACnE,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,aAAa,EACb,aAAa,IAAI,mBAAmB,EACpC,aAAa,EACb,SAAS,EAIT,GAAG,IAAI,SAAS,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,GACf,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAA;AAEpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAA;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAA;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,MAAM,MAAM,GAAG,SAAS,CAAC;IACvB,WAAW,EAAE,OAAO;IACpB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;IACzB,KAAK,EAAE,OAAO,IAAI,CAAC,GAAG;IACtB,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CACjB,IAAI,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,EAAE,mBAAmB,CAAC;IAC/G,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,WAAW;IAC7F,YAAY,EAAE,CAAC,GAAG,QAAQ,CAAC,SAAS,kBAAkB,CAAC;CACxD,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,GAAG,EAAE;IACtB,+GAA+G;IAC/G,4GAA4G;IAC5G,IAAI,OAAiC,CAAA;IACrC,MAAM,GAAG,GAAG,aAAa,CAAC,QAAQ,EAAE,aAAa,EAAE;QACjD,IAAI,EAAE,OAAO;QACb,yFAAyF;QACzF,SAAS,EAAE,CAAC,cAAc,EAAE,cAAc,CAAC;QAC3C,iBAAiB,EAAE,sBAAsB;QACzC,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC;KAC9D,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAC5C,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,OAAO,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,GAAsB,EAAE,CAAC,CAAC;IAClD,GAAG,EAAE,QAAQ;IACb,sGAAsG;IACtG,aAAa;IACb,QAAQ,EAAE,GAAG,EAAE,CAAC;QACd,eAAe,CAAC,QAAQ,CAAC;QACzB,cAAc,EAAE;QAChB,eAAe,EAAE;QACjB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACnE,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC;QAC7B,UAAU,EAAE;QACZ,cAAc,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9C,GAAG,SAAS,CAAC,OAAO,CAAC;YACrB,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACrC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,CAAC;SAC9C,CAAC,CAAC;QACH,aAAa,CAAC,QAAQ,EAAE,aAAa,CAAC;QACtC,WAAW,CAAC,QAAQ,CAAC;KACtB;CACF,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,OAAwB,EAAW,EAAE,CAAC,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA;AAE9G,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,IAAc,EAAE,OAAoB,EAAmB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,OAAO,CAAC,CAAA"}

package/dist/sample/comments.d.ts

@@ -0,0 +1,61 @@
+import * as v from "valibot";
+import type { Transport } from "./transport.js";
+declare const wireComment: v.ObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly body: v.StringSchema<undefined>;
+    readonly authorName: v.StringSchema<undefined>;
+    readonly createdAt: v.StringSchema<undefined>;
+}, undefined>;
+/**
+ * The answer's own shape, in snake_case (WC-OUT-12). `answerEntity` publishes it, so `--json=id,text` and the MCP
+ * schema both come from here (WC-CMD-19). No wire type leaves this file (WC-ARCH-3).
+ */
+export declare const commentSchema: v.StrictObjectSchema<{
+    readonly id: v.StringSchema<undefined>;
+    readonly text: v.StringSchema<undefined>;
+    readonly author: v.StringSchema<undefined>;
+    readonly created_at: v.StringSchema<undefined>;
+}, undefined>;
+export type Comment = v.InferOutput<typeof commentSchema>;
+export declare const commentOf: (wire: v.InferOutput<typeof wireComment>) => Comment;
+/** Every call the sample makes: a method, a path template and only the fields the service documents. */
+export declare const commentsService: (api: Transport) => {
+    me: () => Promise<{
+        id: string;
+        name: string;
+    }>;
+    list: ({ limit, offset, author }: {
+        limit: number;
+        offset: number;
+        author?: string | undefined;
+    }) => Promise<{
+        items: {
+            id: string;
+            text: string;
+            author: string;
+            created_at: string;
+        }[];
+        has_more: boolean;
+    }>;
+    show: (id: string) => Promise<{
+        id: string;
+        text: string;
+        author: string;
+        created_at: string;
+    }>;
+    create: (text: string) => Promise<{
+        id: string;
+        text: string;
+        author: string;
+        created_at: string;
+    }>;
+    update: (id: string, text: string) => Promise<{
+        id: string;
+        text: string;
+        author: string;
+        created_at: string;
+    }>;
+};
+export type CommentsService = ReturnType<typeof commentsService>;
+export {};
+//# sourceMappingURL=comments.d.ts.map

package/dist/sample/comments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.d.ts","sourceRoot":"","sources":["../../src/sample/comments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AAI/C,QAAA,MAAM,WAAW;;;;;aAKf,CAAA;AAIF;;;GAGG;AACH,eAAO,MAAM,aAAa;;;;;aAKxB,CAAA;AACF,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,OAAO,aAAa,CAAC,CAAA;AAEzD,eAAO,MAAM,SAAS,SAAU,CAAC,CAAC,WAAW,CAAC,OAAO,WAAW,CAAC,KAAG,OAKlE,CAAA;AAEF,wGAAwG;AACxG,eAAO,MAAM,eAAe,QAAS,SAAS;IAC5C,EAAE;;;;IACF,IAAI,8BAAoC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE;;;;;;;;;IAItG,IAAI,OAAa,MAAM;;;;;;IAEvB,MAAM,SAAe,MAAM;;;;;;IAE3B,MAAM,OAAa,MAAM,QAAQ,MAAM;;;;;;CAIvC,CAAA;AAEF,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAA"}

package/dist/sample/comments.js

@@ -0,0 +1,39 @@
+import * as v from "valibot";
+// SAMPLE: replace these shapes with your service's. Each wire name comes from the service's docs or a captured answer,
+// never from memory; the strict fake in src/testing/fake-comments.ts refuses any other.
+const wireComment = v.object({
+    id: v.string(),
+    body: v.string(),
+    authorName: v.string(),
+    createdAt: v.string(),
+});
+const wirePage = v.object({ comments: v.array(wireComment), hasMore: v.boolean() });
+const wireUser = v.object({ id: v.string(), name: v.string() });
+/**
+ * The answer's own shape, in snake_case (WC-OUT-12). `answerEntity` publishes it, so `--json=id,text` and the MCP
+ * schema both come from here (WC-CMD-19). No wire type leaves this file (WC-ARCH-3).
+ */
+export const commentSchema = v.strictObject({
+    id: v.string(),
+    text: v.string(),
+    author: v.string(),
+    created_at: v.string(),
+});
+export const commentOf = (wire) => ({
+    id: wire.id,
+    text: wire.body,
+    author: wire.authorName,
+    created_at: wire.createdAt,
+});
+/** Every call the sample makes: a method, a path template and only the fields the service documents. */
+export const commentsService = (api) => ({
+    me: () => api.send({ method: "GET", path: "me" }, wireUser),
+    list: async ({ limit, offset, author }) => {
+        const page = await api.send({ method: "GET", path: "comments", query: { limit, offset, by: author } }, wirePage);
+        return { items: page.comments.map(commentOf), has_more: page.hasMore };
+    },
+    show: async (id) => commentOf(await api.send({ method: "GET", path: "comments/{id}", ids: { id } }, wireComment)),
+    create: async (text) => commentOf(await api.send({ method: "POST", path: "comments", body: { body: text } }, wireComment)),
+    update: async (id, text) => commentOf(await api.send({ method: "PATCH", path: "comments/{id}", ids: { id }, body: { body: text } }, wireComment)),
+});
+//# sourceMappingURL=comments.js.map

package/dist/sample/comments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comments.js","sourceRoot":"","sources":["../../src/sample/comments.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAG5B,uHAAuH;AACvH,wFAAwF;AACxF,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC;IAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;CACtB,CAAC,CAAA;AACF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;AACnF,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAE/D;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACvB,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAuC,EAAW,EAAE,CAAC,CAAC;IAC9E,EAAE,EAAE,IAAI,CAAC,EAAE;IACX,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,MAAM,EAAE,IAAI,CAAC,UAAU;IACvB,UAAU,EAAE,IAAI,CAAC,SAAS;CAC3B,CAAC,CAAA;AAEF,wGAAwG;AACxG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAc,EAAE,EAAE,CAAC,CAAC;IAClD,EAAE,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,QAAQ,CAAC;IAC3D,IAAI,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAkE,EAAE,EAAE;QACxG,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAA;QAChH,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,CAAA;IACxE,CAAC;IACD,IAAI,EAAE,KAAK,EAAE,EAAU,EAAE,EAAE,CACzB,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IAC/F,MAAM,EAAE,KAAK,EAAE,IAAY,EAAE,EAAE,CAC7B,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC;IACpG,MAAM,EAAE,KAAK,EAAE,EAAU,EAAE,IAAY,EAAE,EAAE,CACzC,SAAS,CACP,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,WAAW,CAAC,CAC3G;CACJ,CAAC,CAAA"}

package/dist/sample/transport.d.ts

@@ -0,0 +1,42 @@
+import { CliError, type SleepLike } from "@wirecat/cli-base";
+import { type EventSink } from "@wirecat/cli-core/cli";
+import type { Pacer } from "@wirecat/cli-core/sends";
+import * as v from "valibot";
+export declare const SERVICE_URL = "https://comments.example.invalid/v1/";
+export declare const SERVICE = "Example Comments";
+export interface Request {
+    method: "GET" | "POST" | "PATCH";
+    /** The path as a template, `comments/{id}`: the run record keeps the template, never an id. */
+    path: string;
+    ids?: Record<string, string>;
+    query?: Record<string, string | number | undefined>;
+    body?: Record<string, unknown>;
+}
+export interface TransportOptions {
+    token: string;
+    fetch?: typeof fetch;
+    signal?: AbortSignal | undefined;
+    /** The run's sink from `baseContext(...).run(events => …)`, so each request lands in the run record (WC-LIFE-15). */
+    events?: EventSink;
+    /** cli-core's per-profile pace, shared by every process of the profile through a file. */
+    pacer?: Pacer;
+    sleep?: SleepLike;
+    now?: () => number;
+    timeoutMs?: number;
+}
+/**
+ * A refusal as a CliError with cli-base's code for its status. The service's own message is never repeated: it can
+ * quote what was sent (WC-SECR-6). A write that failed on the service's side may have happened, so it is
+ * `outcome_unknown` and never retryable (WC-OUT-20, WC-LIFE-9).
+ */
+export declare const failureOf: (status: number, writes: boolean, retryAfterMs?: number) => CliError;
+/**
+ * The only code that holds the token: it goes in the Authorization header, never in an address, an error or a run
+ * record (WC-SECR-7). Nothing here retries. A read the caller may run again; a write is never sent twice, since the
+ * first may have landed (WC-OUT-20).
+ */
+export declare const transport: (options: TransportOptions) => {
+    send: <T>(request: Request, answer: v.GenericSchema<unknown, T>) => Promise<T>;
+};
+export type Transport = ReturnType<typeof transport>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/sample/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/sample/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAyB,KAAK,SAAS,EAAa,MAAM,mBAAmB,CAAA;AAE9F,OAAO,EAAE,KAAK,SAAS,EAAmB,MAAM,uBAAuB,CAAA;AACvE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,yBAAyB,CAAA;AACpD,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAI5B,eAAO,MAAM,WAAW,yCAAyC,CAAA;AACjE,eAAO,MAAM,OAAO,qBAAqB,CAAA;AAOzC,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;IAChC,+FAA+F;IAC/F,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC,CAAA;IACnD,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,OAAO,KAAK,CAAA;IACpB,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAA;IAChC,qHAAqH;IACrH,MAAM,CAAC,EAAE,SAAS,CAAA;IAClB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,KAAK,CAAA;IACb,KAAK,CAAC,EAAE,SAAS,CAAA;IACjB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAkBD;;;;GAIG;AACH,eAAO,MAAM,SAAS,WAAY,MAAM,UAAU,OAAO,iBAAiB,MAAM,KAAG,QAqBlF,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,YAAa,gBAAgB;WA6B7B,CAAC,WAAW,OAAO,UAAU,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC,CAAC,KAAG,OAAO,CAAC,CAAC,CAAC;CAiE1F,CAAA;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAA"}

package/dist/sample/transport.js

@@ -0,0 +1,152 @@
+import { CliError, isCliError, realSleep, wallClock } from "@wirecat/cli-base";
+import { providerWaitMs, readJsonResponse, statusToCode } from "@wirecat/cli-base/http";
+import { providerRequest } from "@wirecat/cli-core/cli";
+import * as v from "valibot";
+// SAMPLE: the Example Comments service does not exist; `.invalid` never resolves, so a real run reaches nothing.
+// Replace the address, the paths and the answer shapes with your service's, each from its docs or a captured answer.
+export const SERVICE_URL = "https://comments.example.invalid/v1/";
+export const SERVICE = "Example Comments";
+const TIMEOUT_MS = 30_000;
+const LARGEST_ANSWER = 8 * 1024 * 1024;
+/** A pace wait longer than this ends the run with `rate_limited` instead of sitting in it. */
+const LONGEST_PACE_WAIT_MS = 60_000;
+/** `new URL` folds a `.` or `..` segment into its parent, so such an id would reach another endpoint. */
+const segment = (name, value) => {
+    if (value === "" || value === "." || value === "..")
+        throw new CliError("validation_error", `${name} must name one item; an empty, "." or ".." id is refused`);
+    return encodeURIComponent(value);
+};
+const urlOf = ({ path, ids = {}, query = {} }) => {
+    const url = new URL(path.replace(/\{(\w+)\}/g, (_, name) => segment(name, ids[name] ?? "")), SERVICE_URL);
+    for (const [key, value] of Object.entries(query))
+        if (value !== undefined)
+            url.searchParams.set(key, String(value));
+    return url;
+};
+/**
+ * A refusal as a CliError with cli-base's code for its status. The service's own message is never repeated: it can
+ * quote what was sent (WC-SECR-6). A write that failed on the service's side may have happened, so it is
+ * `outcome_unknown` and never retryable (WC-OUT-20, WC-LIFE-9).
+ */
+export const failureOf = (status, writes, retryAfterMs) => {
+    if (status === 401)
+        return new CliError("authentication_error", `${SERVICE} refused the token; sign in again with session start`, {
+            status,
+        });
+    if (status === 429)
+        return new CliError("rate_limited", `${SERVICE} asked to slow down; retry the command later`, {
+            status,
+            retryable: true,
+            ...(retryAfterMs === undefined ? {} : { retry_after_ms: retryAfterMs }),
+        });
+    if (status >= 500 && writes)
+        return new CliError("outcome_unknown", `${SERVICE} failed during a write; check it before repeating the write`, {
+            status,
+            retryable: false,
+        });
+    if (status === 404)
+        return new CliError("not_found", `${SERVICE} has no such item, or this token cannot see it`);
+    return new CliError(statusToCode(status), `${SERVICE} refused the request (HTTP ${status})`, {
+        status,
+        retryable: status >= 500,
+    });
+};
+/**
+ * The only code that holds the token: it goes in the Authorization header, never in an address, an error or a run
+ * record (WC-SECR-7). Nothing here retries. A read the caller may run again; a write is never sent twice, since the
+ * first may have landed (WC-OUT-20).
+ */
+export const transport = (options) => {
+    const fetchOf = options.fetch ?? fetch;
+    const sleep = options.sleep ?? realSleep;
+    const now = options.now ?? Date.now;
+    const turn = async () => {
+        if (!options.pacer)
+            return;
+        const wait = (await options.pacer.reserve()) - now();
+        if (wait <= 0)
+            return;
+        if (wait > LONGEST_PACE_WAIT_MS)
+            throw new CliError("rate_limited", `this profile must wait ${Math.ceil(wait / 1000)} s before its next request`, {
+                retry_after_ms: wait,
+            });
+        await sleep(wait, options.signal, "retry");
+    };
+    const unanswered = (writes, error) => {
+        // Before the stop check: a write stopped in flight may still have landed (WC-LIFE-9).
+        if (writes)
+            return new CliError("outcome_unknown", `${SERVICE} did not answer a write; check it before repeating the write`, {
+                retryable: false,
+            });
+        if (options.signal?.aborted)
+            return new CliError("cancelled", `the ${SERVICE} request was stopped`);
+        const timedOut = error?.name === "TimeoutError";
+        return timedOut
+            ? new CliError("timeout", `${SERVICE} did not answer in time`, { retryable: true })
+            : new CliError("network_error", `${SERVICE} could not be reached`, { retryable: true });
+    };
+    const send = async (request, answer) => {
+        const writes = request.method !== "GET";
+        const url = urlOf(request);
+        await turn();
+        // Not AbortSignal.timeout: its timer keeps the run's async context alive until it fires.
+        const deadline = new AbortController();
+        const timer = setTimeout(() => deadline.abort(new DOMException("timed out", "TimeoutError")), options.timeoutMs ?? TIMEOUT_MS);
+        timer.unref();
+        const signal = options.signal ? AbortSignal.any([options.signal, deadline.signal]) : deadline.signal;
+        const end = providerRequest(`${request.method} /${request.path}`, options.events, {
+            method: request.method,
+            transport: "http",
+        });
+        try {
+            let response;
+            try {
+                response = await fetchOf(url, {
+                    method: request.method,
+                    headers: {
+                        authorization: `Bearer ${options.token}`,
+                        accept: "application/json",
+                        ...(request.body ? { "content-type": "application/json" } : {}),
+                    },
+                    ...(request.body ? { body: JSON.stringify(request.body) } : {}),
+                    // A redirect would carry the Authorization header to an address we did not choose.
+                    redirect: "error",
+                    signal,
+                });
+            }
+            catch (error) {
+                const failure = unanswered(writes, deadline.signal.reason ?? error);
+                end({ errorCode: failure.code });
+                throw failure;
+            }
+            if (!response.ok) {
+                const failure = failureOf(response.status, writes, providerWaitMs(response.headers, wallClock));
+                end({ status: response.status, errorCode: failure.code });
+                throw failure;
+            }
+            let body;
+            try {
+                body = await readJsonResponse(response, { maxBytes: LARGEST_ANSWER, signal });
+            }
+            catch (error) {
+                const failure = isCliError(error) && error.code !== "invalid_response"
+                    ? error
+                    : new CliError("invalid_response", `${SERVICE} answered with something other than bounded JSON`);
+                end({ status: response.status, errorCode: failure.code });
+                throw failure;
+            }
+            const parsed = v.safeParse(answer, body);
+            if (!parsed.success) {
+                end({ status: response.status, errorCode: "invalid_response" });
+                throw new CliError("invalid_response", `${SERVICE}'s answer does not have the documented shape`);
+            }
+            end({ status: response.status });
+            return parsed.output;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    };
+    return { send };
+};
+//# sourceMappingURL=transport.js.map

package/dist/sample/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/sample/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAkB,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC9F,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAA;AACvF,OAAO,EAAkB,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvE,OAAO,KAAK,CAAC,MAAM,SAAS,CAAA;AAE5B,iHAAiH;AACjH,qHAAqH;AACrH,MAAM,CAAC,MAAM,WAAW,GAAG,sCAAsC,CAAA;AACjE,MAAM,CAAC,MAAM,OAAO,GAAG,kBAAkB,CAAA;AAEzC,MAAM,UAAU,GAAG,MAAM,CAAA;AACzB,MAAM,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AACtC,8FAA8F;AAC9F,MAAM,oBAAoB,GAAG,MAAM,CAAA;AAwBnC,yGAAyG;AACzG,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,EAAE;IAC9C,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;QACjD,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,IAAI,0DAA0D,CAAC,CAAA;IAC3G,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAA;AAClC,CAAC,CAAA;AAED,MAAM,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,GAAG,GAAG,EAAE,EAAE,KAAK,GAAG,EAAE,EAAW,EAAE,EAAE;IACxD,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,IAAY,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,EAC/E,WAAW,CACZ,CAAA;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,KAAK,KAAK,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACnH,OAAO,GAAG,CAAA;AACZ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,MAAc,EAAE,MAAe,EAAE,YAAqB,EAAY,EAAE;IAC5F,IAAI,MAAM,KAAK,GAAG;QAChB,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,GAAG,OAAO,sDAAsD,EAAE;YAC5G,MAAM;SACP,CAAC,CAAA;IACJ,IAAI,MAAM,KAAK,GAAG;QAChB,OAAO,IAAI,QAAQ,CAAC,cAAc,EAAE,GAAG,OAAO,8CAA8C,EAAE;YAC5F,MAAM;YACN,SAAS,EAAE,IAAI;YACf,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;SACxE,CAAC,CAAA;IACJ,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM;QACzB,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,OAAO,6DAA6D,EAAE;YAC9G,MAAM;YACN,SAAS,EAAE,KAAK;SACjB,CAAC,CAAA;IACJ,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,GAAG,OAAO,gDAAgD,CAAC,CAAA;IAChH,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,GAAG,OAAO,8BAA8B,MAAM,GAAG,EAAE;QAC3F,MAAM;QACN,SAAS,EAAE,MAAM,IAAI,GAAG;KACzB,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAyB,EAAE,EAAE;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAA;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAEnC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,OAAM;QAC1B,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,GAAG,EAAE,CAAA;QACpD,IAAI,IAAI,IAAI,CAAC;YAAE,OAAM;QACrB,IAAI,IAAI,GAAG,oBAAoB;YAC7B,MAAM,IAAI,QAAQ,CAAC,cAAc,EAAE,0BAA0B,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,4BAA4B,EAAE;gBAC/G,cAAc,EAAE,IAAI;aACrB,CAAC,CAAA;QACJ,MAAM,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC5C,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,CAAC,MAAe,EAAE,KAAc,EAAY,EAAE;QAC/D,sFAAsF;QACtF,IAAI,MAAM;YACR,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,GAAG,OAAO,8DAA8D,EAAE;gBAC/G,SAAS,EAAE,KAAK;aACjB,CAAC,CAAA;QACJ,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,OAAO,OAAO,sBAAsB,CAAC,CAAA;QACnG,MAAM,QAAQ,GAAI,KAAuC,EAAE,IAAI,KAAK,cAAc,CAAA;QAClF,OAAO,QAAQ;YACb,CAAC,CAAC,IAAI,QAAQ,CAAC,SAAS,EAAE,GAAG,OAAO,yBAAyB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACnF,CAAC,CAAC,IAAI,QAAQ,CAAC,eAAe,EAAE,GAAG,OAAO,uBAAuB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3F,CAAC,CAAA;IAED,MAAM,IAAI,GAAG,KAAK,EAAK,OAAgB,EAAE,MAAmC,EAAc,EAAE;QAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAA;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;QAC1B,MAAM,IAAI,EAAE,CAAA;QACZ,yFAAyF;QACzF,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,EACnE,OAAO,CAAC,SAAS,IAAI,UAAU,CAChC,CAAA;QACD,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAA;QACpG,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,MAAM,EAAE;YAChF,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAA;QACF,IAAI,CAAC;YACH,IAAI,QAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;oBAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;wBACxC,MAAM,EAAE,kBAAkB;wBAC1B,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAChE;oBACD,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/D,mFAAmF;oBACnF,QAAQ,EAAE,OAAO;oBACjB,MAAM;iBACP,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAA;gBACnE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBAChC,MAAM,OAAO,CAAA;YACf,CAAC;YACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAA;gBAC/F,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACzD,MAAM,OAAO,CAAA;YACf,CAAC;YACD,IAAI,IAAa,CAAA;YACjB,IAAI,CAAC;gBACH,IAAI,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAA;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GACX,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,kBAAkB;oBACpD,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,OAAO,kDAAkD,CAAC,CAAA;gBACpG,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;gBACzD,MAAM,OAAO,CAAA;YACf,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YACxC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC,CAAA;gBAC/D,MAAM,IAAI,QAAQ,CAAC,kBAAkB,EAAE,GAAG,OAAO,8CAA8C,CAAC,CAAA;YAClG,CAAC;YACD,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;YAChC,OAAO,MAAM,CAAC,MAAM,CAAA;QACtB,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC,CAAA;IAED,OAAO,EAAE,IAAI,EAAE,CAAA;AACjB,CAAC,CAAA"}

package/dist/token.d.ts

@@ -0,0 +1,16 @@
+import { type CredentialSource, type KeyringStore } from "@wirecat/cli-base";
+export declare const TOKEN_VARIABLE: string;
+export type TokenStorage = "keyring" | "file";
+/**
+ * One token per profile: `CLIDEV_TOKEN`, then the keyring entry `token:<profile>` under the app's name, then a 0600
+ * file (WC-SECR-4). A run with moved folders reads the owner's entry and never replaces or deletes it (WC-SECR-24);
+ * cli-base's `Credentials` does both. cli-core has no token store for a CLI that is not a bot; keep this one.
+ */
+export declare const tokenStore: (env: NodeJS.ProcessEnv, keyring: KeyringStore | undefined, warn: (message: string) => void) => {
+    read: (profile: string) => import("@wirecat/cli-base").StoredCredential | undefined;
+    write: (profile: string, token: string, storage: TokenStorage) => CredentialSource;
+    remove: (profile: string) => CredentialSource[];
+};
+/** Whether the profile has a token here, for `mcp check`, which prints its own verdict. */
+export declare const holdsToken: (env: NodeJS.ProcessEnv, profile: string, keyring?: KeyringStore) => boolean;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,gBAAgB,EAA2B,KAAK,YAAY,EAAgB,MAAM,mBAAmB,CAAA;AAGnH,eAAO,MAAM,cAAc,QAAgC,CAAA;AAE3D,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,MAAM,CAAA;AAE7C;;;;GAIG;AACH,eAAO,MAAM,UAAU,QAChB,MAAM,CAAC,UAAU,WACb,YAAY,GAAG,SAAS,QAC3B,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI;IAe7B,IAAI,YAAY,MAAM;IACtB,KAAK,YAAY,MAAM,SAAS,MAAM,WAAW,YAAY,KAAG,gBAAgB;IAIhF,MAAM,YAAY,MAAM,KAAG,gBAAgB,EAAE;CAEhD,CAAA;AAED,2FAA2F;AAC3F,eAAO,MAAM,UAAU,QAAS,MAAM,CAAC,UAAU,WAAW,MAAM,YAAY,YAAY,KAAG,OAC7B,CAAA"}

package/dist/token.js

@@ -0,0 +1,32 @@
+import { Credentials, isMovedRun, resolvePaths } from "@wirecat/cli-base";
+import { IDENTITY } from "./identity.js";
+export const TOKEN_VARIABLE = `${IDENTITY.envPrefix}_TOKEN`;
+/**
+ * One token per profile: `CLIDEV_TOKEN`, then the keyring entry `token:<profile>` under the app's name, then a 0600
+ * file (WC-SECR-4). A run with moved folders reads the owner's entry and never replaces or deletes it (WC-SECR-24);
+ * cli-base's `Credentials` does both. cli-core has no token store for a CLI that is not a bot; keep this one.
+ */
+export const tokenStore = (env, keyring, warn) => {
+    const where = { appName: IDENTITY.appName, prefix: IDENTITY.envPrefix, env };
+    const options = {
+        configDir: resolvePaths(where).config,
+        service: IDENTITY.appName,
+        envVar: TOKEN_VARIABLE,
+        isolated: isMovedRun(where),
+        env,
+        ...(keyring ? { keyring } : {}),
+        warn,
+    };
+    const credentials = new Credentials(options);
+    const account = (profile) => `token:${profile}`;
+    return {
+        read: (profile) => credentials.read(account(profile)),
+        write: (profile, token, storage) => new Credentials({ ...options, storage: storage === "file" ? "file" : "auto" }).write(account(profile), token, {
+            signIn: true,
+        }),
+        remove: (profile) => credentials.remove(account(profile)),
+    };
+};
+/** Whether the profile has a token here, for `mcp check`, which prints its own verdict. */
+export const holdsToken = (env, profile, keyring) => tokenStore(env, keyring, () => { }).read(profile) !== undefined;
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyB,WAAW,EAAE,UAAU,EAAqB,YAAY,EAAE,MAAM,mBAAmB,CAAA;AACnH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,QAAQ,CAAC,SAAS,QAAQ,CAAA;AAI3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,GAAsB,EACtB,OAAiC,EACjC,IAA+B,EAC/B,EAAE;IACF,MAAM,KAAK,GAAG,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,CAAA;IAC5E,MAAM,OAAO,GAAG;QACd,SAAS,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC,MAAM;QACrC,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,cAAc;QACtB,QAAQ,EAAE,UAAU,CAAC,KAAK,CAAC;QAC3B,GAAG;QACH,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,IAAI;KACL,CAAA;IACD,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,OAAO,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,SAAS,OAAO,EAAE,CAAA;IACvD,OAAO;QACL,IAAI,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,KAAK,EAAE,CAAC,OAAe,EAAE,KAAa,EAAE,OAAqB,EAAoB,EAAE,CACjF,IAAI,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;YAC5G,MAAM,EAAE,IAAI;SACb,CAAC;QACJ,MAAM,EAAE,CAAC,OAAe,EAAsB,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;KACtF,CAAA;AACH,CAAC,CAAA;AAED,2FAA2F;AAC3F,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,GAAsB,EAAE,OAAe,EAAE,OAAsB,EAAW,EAAE,CACrG,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,SAAS,CAAA"}

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.15.0";
+export declare const VERSION = "0.16.0";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = "0.15.0";
+export const VERSION = "0.16.0";
 //# sourceMappingURL=version.js.map