@wirecat/cli-template 0.8.0 → 0.10.0

package/.github/workflows/ci.yml

@@ -29,13 +29,13 @@ jobs:
       platform-run: |
         node dist/bin/clidev.js commands --json >/dev/null
         node dist/bin/clidev.js doctor --json >/dev/null
-      # The skeleton keeps no local state of its own; its config file and run records are cli-core's. A CLI that keeps
-      # its own (a store, a sync cursor, any file it writes) adds a contracts:upgrade script and removes this skip
-      # (WC-TEST-14).
+      # contracts:upgrade needs local state of the CLI's own and a published version to upgrade from (WC-TEST-14).
+      # Once a CLI has both, it adds the script and removes this skip; see docs/dev/TESTING.md.
       skip: |
         contracts:upgrade
       checks: |
         bash scripts/audit.sh
+        pnpm smoke:node
 
   version:
     if: github.event_name == 'pull_request'

package/.github/workflows/release.yml

@@ -189,3 +189,66 @@ jobs:
         run: |
           awk -v v="$VERSION" '$0 ~ "^## "v" " {on=1; next} /^## / && on {exit} on' CHANGELOG.md |
             gh release create "v$VERSION" --title "$VERSION" --notes-file -
+
+  # The template's own release publishes @wirecat/cli-template, which has no skill on ClawHub.
+  # ClawHub's own workflow, pinned: it runs the ClawHub CLI from this commit and needs id-token only to read which
+  # commit that is. It publishes the skill only when it changed, as the next patch of ClawHub's own version line.
+  clawhub-dry-run:
+    needs: build
+    if: inputs.dry_run && github.repository != 'WireCatLabs/cli-template'
+    permissions:
+      contents: read
+      id-token: write
+    uses: openclaw/clawhub/.github/workflows/skill-publish.yml@52358852d3510f1150756d48e8a72cb8c8e698e0 # main, 2026-10-25
+    with:
+      skill_path: skills/clidev-cli
+      owner: wirecat
+      dry_run: true
+
+  # After the tag, so a ClawHub failure never holds back the npm release. The same CLI commit as the dry run, but run
+  # here instead of through ClawHub's workflow, which GitHub cannot let fail: a version stuck pending ClawHub's scan
+  # is not counted as the latest, so the next publish picks it again and gets "already exists" (openclaw/clawhub#4046).
+  # That one error warns; any other fails. Bump CLAWHUB_SHA together with the dry run's pin.
+  clawhub:
+    needs: tag
+    if: ${{ !inputs.dry_run && github.repository != 'WireCatLabs/cli-template' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SKILL_PATH: skills/clidev-cli
+      CLAWHUB_SLUG: wirecat-clidev
+      CLAWHUB_SHA: 52358852d3510f1150756d48e8a72cb8c8e698e0
+      CLAWHUB_URL: https://clawhub.ai
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          repository: openclaw/clawhub
+          ref: ${{ env.CLAWHUB_SHA }}
+          path: clawhub-source
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
+        with:
+          bun-version: 1.4.4
+      - run: bun install --frozen-lockfile
+        working-directory: clawhub-source
+      - name: publish the skill
+        env:
+          CLAWHUB_TOKEN: ${{ secrets.CLAWHUB_TOKEN }}
+          CLAWHUB_CONFIG_PATH: ${{ runner.temp }}/clawhub-config.json
+        run: |
+          (umask 077; jq -n --arg r "$CLAWHUB_URL" --arg t "$CLAWHUB_TOKEN" '{registry: $r, token: $t}' > "$CLAWHUB_CONFIG_PATH")
+          status=0
+          output=$(bun clawhub-source/packages/clawhub/src/cli.ts --workdir "$GITHUB_WORKSPACE" \
+            --site "$CLAWHUB_URL" --registry "$CLAWHUB_URL" skill publish "$SKILL_PATH" --slug "$CLAWHUB_SLUG" --json \
+            --owner wirecat --tags latest --source-repo "$GITHUB_REPOSITORY" --source-commit "$GITHUB_SHA" \
+            --source-path "$SKILL_PATH" --source-ref "$GITHUB_REF" 2>&1) || status=$?
+          echo "$output"
+          if [ "$status" -ne 0 ] && grep -q "already exists" <<< "$output"; then
+            echo "::warning::ClawHub already has this skill version, still pending its stalled scan — not republished (openclaw/clawhub#4046)"
+            exit 0
+          fi
+          exit "$status"

package/.gitleaks.toml

@@ -3,3 +3,21 @@ useDefault = true
 
 [allowlist]
 paths = ['''pnpm-lock\.yaml''']
+
+# gitleaks' own rules know Google API keys (AIza…) only. Google calls its OAuth tokens opaque, so these prefixes are
+# the observed format, not a promised one: ya29. in Apigee's sample access token, 1// in the sample refresh token of
+# the web-server OAuth guide.
+[[rules]]
+id = "google-oauth-access-token"
+description = "Google OAuth 2.0 access token"
+regex = '''\b(ya29\.[A-Za-z0-9._-]{20,})'''
+secretGroup = 1
+keywords = ["ya29."]
+
+[[rules]]
+id = "google-oauth-refresh-token"
+description = "Google OAuth 2.0 refresh token"
+regex = '''(?:^|[^A-Za-z0-9/])(1//[A-Za-z0-9_-]{30,})'''
+secretGroup = 1
+entropy = 3.5
+keywords = ["1//"]

package/AGENTS.md

@@ -6,20 +6,12 @@ file and over every other document in this repository. The handbook ships inside
 touches (`WC-<AREA>-<n>`) in the commit message and the pull request. The rules of this CLI alone are in
 [CLAUDE.md](CLAUDE.md).
 
-## Before building anything
+## Design
 
-This CLI was made from [cli-template](https://github.com/WireCatLabs/cli-template). Its first task is the design:
-
-1. Read [docs/dev/DESIGN.md](docs/dev/DESIGN.md). If the seven answers are not there, ask the owner the
-   [design interview](docs/dev/skills/design-interview/SKILL.md) and write them down.
-2. Learn from the reference CLI below. Copy its patterns for the provider, the store and the commands; the
-   template has no sample code on purpose.
-3. Ask the further questions in the interview that the reference CLI does not answer. Build only after the owner
-   has read `DESIGN.md`.
-4. When the first command reaches the service, rewrite `README.md`, `docs/index.md` and the description in
-   `skills/clidev-cli/SKILL.md` to say what the tool does and who it is for. Rewrite the MCP server's instructions
-   in `src/mcp.ts` too: name the kinds of outside text the CLI carries, from the untrusted-text answer in
-   `DESIGN.md` (WC-MCP-11).
+[docs/dev/DESIGN.md](docs/dev/DESIGN.md) holds the owner's answers to the
+[design interview](docs/dev/skills/design-interview/SKILL.md) and the decisions made since. Read it before changing
+what a command does, and write a new decision there. Learn the patterns for the provider, the store and the commands
+from the reference CLI below; the template has no sample code on purpose.
 
 <!-- cli-template:reference-cli:start -->
 The reference CLI is not chosen yet; see [Reference CLIs](docs/dev/reference-clis.md).
@@ -27,5 +19,7 @@ The reference CLI is not chosen yet; see [Reference CLIs](docs/dev/reference-cli
 
 ## Template-owned files
 
-`template.json` names the files `npx @wirecat/cli-template upgrade` keeps in step with the template. Change one of
-them here only when this CLI needs to differ; `upgrade` asks before it touches your change.
+This CLI was made from [cli-template](https://github.com/WireCatLabs/cli-template). `template.json` names the files
+`npx @wirecat/cli-template upgrade` keeps in step with the template. Change one of them here only when this CLI needs
+to differ; `upgrade` asks before it touches your change. Text that holds for this CLI alone goes into the pages it
+owns, such as `DESIGN.md`, `CLAUDE.md` and `README.md`, not into a template-owned page.

package/CHANGELOG.md

@@ -3,7 +3,93 @@
 Notable changes to `@wirecat/cli-template`. One section per version, newest first; versions follow
 [semantic versioning](https://semver.org), so before `1.0.0` the skeleton may still change.
 
-<!-- cspell:words katex smol whatsapp -->
+<!-- cspell:words clawhub gcal katex openclaw smol whatsapp -->
+
+## 0.10.0 — 31.10.2026
+
+### Changed — may break callers
+
+- **The skeleton runs on cli-core 0.469.0 and cli-base 0.65.0**; a CLI that pins cli-base moves both pins together.
+  A non-messenger CLI no longer offers messenger settings or the `follow-ups` and `link-conversations` skills
+  (cli-core 0.468); runs record successes too, under cli-core 0.467's rules. cli-base 0.64 adds `cli-dev bundle`, the
+  shared build that ships the bin as an esbuild bundle, and calendar words in the command vocabulary. cli-base 0.65 adds
+  the verbs `serve` and `revoke`, and `cli-dev lint` fails on a baseline entry that names them: the skeleton's
+  `lint/baseline/unknown-verb.json` (`mcp serve`, `mcp revoke`) is gone, and a CLI made from the template removes the
+  same entries. `<cli> upgrade` now restarts the HTTP MCP server that `mcp server start` started, on the new version,
+  and names the MCP sessions over stdio that still run the old one (cli-core #2117).
+
+### Added
+
+- **A CLI made from the template publishes its skill on ClawHub as `wirecat-<command>` after each release.** `release.yml`
+  gets a dry run through ClawHub's pinned workflow and, after the tag, a publish that only warns while ClawHub still holds
+  the version pending its scan ([openclaw/clawhub#4046](https://github.com/openclaw/clawhub/issues/4046)); the template's
+  own release skips both. The skill names its binary and npm package for OpenClaw (`metadata.openclaw`). It needs the
+  `CLAWHUB_TOKEN` secret, which the WireCatLabs organization shares.
+- **`new --category calendar` names gcal-cli as the reference CLI** in `AGENTS.md` and `DESIGN.md`, and the
+  Reference CLIs page lists it, instead of "No reference CLI for this category yet". gcal-cli is the WireCat Google
+  Calendar CLI. A CLI made before this keeps what it wrote; edit its `AGENTS.md` by hand if you want the link.
+- **`scripts/audit.sh` audits beside gcal-cli too**: it installs `@wirecat/gcal-cli` with the other published CLIs
+  and passes its `gcal` bin to `cli-dev audit`.
+- **An agent publishes a release itself.** The release skill and `bin/release` let an agent merge the release pull
+  request and run `bin/release`, which publishes from GitHub Actions. `bin/release --local` stays the owner's, for
+  the first release.
+
+### Fixed
+
+- **The release audit never uses the owner's accounts.** Its prompt now says: no sign-in, every folder moved, the
+  keyring hidden with `DBUS_SESSION_BUS_ADDRESS=disabled:`, and no command that writes to a service.
+- **`bin/release` raises the next free version to the level the changelog needs.** When npm already had the version, it
+  took the next patch, so a release with `Added` (`0.1.1` taken, `0.1.2` proposed) failed `version:check` and stopped;
+  it now proposes `0.2.0`. A generated CLI gets it with the next template update.
+- **A CLI made from the template starts from an esbuild bundle.** `pnpm build` runs `tsc`, then cli-base's
+  `cli-dev bundle` ([WC-LAY-10](https://github.com/WireCatLabs/cli-base/blob/main/docs/standards/layout.md)), and the
+  bin becomes a loader for `dist/bundle/`: the skeleton's `config show --help` starts in 151 ms instead of 366.
+  `scripts/smoke-bundle.ts` runs the bundle under Node (`pnpm smoke:node`, in CI) and Bun (`pnpm smoke:bun`).
+
+## 0.9.0 — 27.10.2026
+
+### Changed — may break callers
+
+- **The MCP server is `clidev <profile> mcp serve`; `mcp` alone only shows its commands** (WC-CMD-3). `--http`,
+  `--port` and `--public-url` move to `mcp serve`, and `mcp --revoke` is its own command, `mcp revoke`, still refused
+  under `CLIDEV_READ_ONLY`. There is no alias: a client set up with `claude mcp add clidev -- clidev personal mcp`
+  gets the help and exits 2; set it up again with `… mcp serve`. `mcp server start` runs `mcp serve --http`.
+- **The skeleton runs on cli-core 0.463.0 and cli-base 0.63.0**, the cli-base line cli-core 0.463 accepts; a CLI that
+  pins cli-base moves both pins together. `skill show`, `skill status` and `skill install --json` answer in the
+  one-thing envelope, `{ item, meta }`, so a script reads their fields under `item`.
+- **`mcp server start` no longer offers `--permission`.** cli-core added it to every CLI and passed it to a server
+  that refused it; now it is refused before anything starts. The profile's `permissions` still make the server
+  stricter.
+
+A CLI made from an older template keeps its own `src/commands/mcp.ts`, since `src/` is a seed: copy the template's
+file, and change `claude mcp add` lines in its docs to end in `mcp serve`.
+
+### Security
+
+- **`.gitleaks.toml` catches Google OAuth tokens.** gitleaks' own rules know Google API keys only, so an access token
+  (`ya29.…`) or a refresh token (`1//…`) with no keyword beside it went through. Two rules now catch them. A CLI takes
+  them with `upgrade`; scan its history once with `gitleaks git` after that, since CI scans all of it.
+
+### Fixed
+
+- **A command other than `mcp serve` no longer loads the MCP library.** `src/commands/mcp.ts` imported `portOf` and
+  `publicUrlOf` from `@wirecat/cli-core/mcp` at the top, so `--version` and `doctor` loaded the MCP server SDK too
+  (WC-LIFE-6). `mcp serve --http` now imports them when it runs.
+- `docs/security.md` says what `mcp serve --http` listens on, what it keeps of each browser login, and that
+  `mcp revoke` ends them.
+- **`pnpm audit:commands` prints the CLI's own scorecard lines**, not the last CLI's total, which was zoom-cli's. It
+  fails when the scorecard has no line for the CLI. Whether a new finding fails the run did not change.
+- **`AGENTS.md` keeps only what holds for the CLI's whole life.** The one-time first task (interview, reference CLI,
+  rewrite the README and the MCP instructions) moved into the `DESIGN.md` that `new` writes, which the CLI owns and
+  deletes the section from when it is done. `upgrade` drops the old text from `AGENTS.md`.
+- **`new` writes a `files` list that ships only what the CLI runs from**: `dist`, `skills`, `README.md`,
+  `CHANGELOG.md` and `LICENSE`. It copied the template's own list, so a new CLI published its `src/` with tests and
+  fakes, `scripts/`, `.github/`, `bin/release`, `config/`, `lint/` and `template.json` (WC-REL-16). `package.json` is
+  a seed, so a CLI made before this trims its list by hand; `pnpm smoke` then checks the package still runs.
+- `docs/dev/TESTING.md` and `ci.yml` give both reasons `contracts:upgrade` is skipped: it needs local state of the
+  CLI's own and a published version to upgrade from (WC-TEST-14).
+- `docs/dev/reference-clis.md` shows the provider call cli-core has, `store.accounts.registerProvider(entry)`.
+  `@wirecat/cli-core/store` exports no `registerProvider` function.
 
 ## 0.8.0 — 27.10.2026
 

package/README.md

@@ -33,14 +33,15 @@ such as `personal` in `clidev personal config show`; none is ever assumed. `CLID
 | `clidev commands --json` | Prints every command as JSON, for agents and scripts |
 | `clidev personal config show` | Shows each setting and where it came from |
 | `clidev skill install` | Installs the agent skill for Claude Code, Codex, Gemini CLI and OpenClaw; `--for hermes` for Hermes Agent |
-| `clidev personal mcp` | Serves the profile's commands to an AI agent over MCP; `--http` for agents in the browser |
+| `clidev personal mcp serve` | Serves the profile's commands to an AI agent over MCP; `--http` for agents in the browser |
 | `clidev runs list` | Lists recorded runs, newest first: every command that failed is kept |
 | `clidev upgrade --check` | Says whether a newer version is on npm |
 
 ## For AI agents
 
-`clidev skill show` prints the rules an agent follows with this tool. `clidev personal mcp` serves every command to an
-agent, writes included: the profile's permissions decide what runs. See [MCP and permissions](docs/usage.md#agents).
+`clidev skill show` prints the rules an agent follows with this tool. `clidev personal mcp serve` serves every
+command to an agent, writes included: the profile's permissions decide what runs. See
+[MCP and permissions](docs/usage.md#agents).
 
 ## Why this template
 

package/bin/release

@@ -1,7 +1,8 @@
 #!/usr/bin/env sh
-# Publishes the version in package.json and tags it. Run on a clean `main` that matches origin/main; the owner runs
-# it, never an agent. When npm already has that version, or a higher one, it raises it to the next free one through a
-# pull request and publishes that (WC-REL-5). Nothing is published until `pnpm release:check` passes.
+# Publishes the version in package.json and tags it. Run on a clean `main` that matches origin/main. An agent may run
+# it without --local; --local is for the owner's first release only. When npm already has that version, or a higher
+# one, it raises it to the next free one through a pull request and publishes that (WC-REL-5). Nothing is published
+# until `pnpm release:check` passes.
 #
 #   bin/release           # publishes from GitHub Actions (.github/workflows/release.yml, npm trusted publishing)
 #   bin/release --local   # publishes from this computer: NPM_TOKEN if exported, else the keyring, else `npm login`
@@ -110,6 +111,7 @@ next=$(pnpm exec cli-dev next-version "$version" "$latest" "$versions")
 if [ "$next" != "$version" ]; then
   taken=""
   if published; then taken=1; why="$version is already on npm"; else why="$version is not above npm's latest $latest"; fi
+  next=$(node --experimental-strip-types scripts/version-level.ts --next "$next")
   echo "$why — publishing $next instead"
   # A version npm already has keeps its changelog section; the unreleased one becomes the new version.
   node -e 'const fs = require("fs"); const [o, n, taken] = process.argv.slice(1)

package/contracts/plan.json

@@ -36,7 +36,7 @@
     },
     {
       "id": "missing-explicit-profile",
-      "args": ["mcp"],
+      "args": ["mcp", "serve"],
       "exit": 2,
       "stream": "stderr",
       "kind": "json",
@@ -44,7 +44,7 @@
     }
   ],
   "mcp": {
-    "args": ["personal", "mcp"],
+    "args": ["personal", "mcp", "serve"],
     "snapshot": "mcp-tools.json"
   }
 }

package/dist/bin/clidev.js

@@ -1,14 +1,36 @@
 #!/usr/bin/env node
-import { enableCompileCache } from "node:module";
-import { catchCrashes } from "@wirecat/cli-base";
-import { IDENTITY } from "../identity.js";
-enableCompileCache();
-const stopCatching = catchCrashes({ cli: IDENTITY.command, interactive: process.stdout.isTTY === true });
-const { run } = await import("../program.js");
-try {
-    process.exitCode = await run(process.argv.slice(2));
+// cli-dev bundle loader
+import * as module from "node:module"
+
+const words = process.argv.slice(2)
+// As the CLI answers it, unless a test records the argv: then the CLI writes the record too.
+if (
+  words.length === 1 &&
+  (words[0] === "--version" || words[0] === "-V") &&
+  !Object.keys(process.env).some((key) => key.endsWith("_TEST_ARGV_LOG"))
+) {
+  process.stdout.write("0.10.0\n")
+} else {
+  // Before the bundle compiles: the bundle's own call comes after its chunks.
+  module.enableCompileCache()
+  const serves = ((words) => {
+    const plain = words.filter((word) => !word.startsWith("-"));
+    return plain
+        .slice(0, 4)
+        .some((word, at) => word === "serve" || word === "watch" || (word === "mcp" && plain[at + 1] === undefined));
+})(words)
+  if (serves && module.registerHooks) {
+    const bundle = new URL("../bundle/", import.meta.url).href
+    module.registerHooks({
+      resolve: (specifier, context, next) =>
+        specifier.startsWith("./") && context.parentURL?.startsWith(bundle)
+          ? { url: new URL(specifier, context.parentURL).href, format: "module", shortCircuit: true }
+          : next(specifier, context),
+    })
+  }
+  const running = import("../bundle/clidev.js")
+  const chunks = ["../bundle/all-profiles-XHC7BG3P.js","../bundle/anthropic-N6B3ZZHQ.js","../bundle/bun-HUJLS7KP.js","../bundle/bun-sqlite-OWFO2TVR.js","../bundle/dist-ESHIQU4M.js","../bundle/echarts-2QGL2JP5.js","../bundle/embed-HHAAGHA6.js","../bundle/embedder-W2OGVVYH.js","../bundle/first-screen-U4DFUKUC.js","../bundle/instructions-OTZHT6NV.js","../bundle/mcp-OQBZXELQ.js","../bundle/mcp-VVF6J7SQ.js","../bundle/mcp-Y7VCIZ2J.js","../bundle/node-P4E63KXA.js","../bundle/node-SYD4GX5O.js","../bundle/node-TLZSIHIJ.js","../bundle/node-sqlite-X2DGRFOZ.js","../bundle/oauth-42M34GQ5.js","../bundle/open-SWXRCDLN.js","../bundle/process-KAFGXZ7Q.js","../bundle/program-EHR4G7VN.js","../bundle/prompt-ZQTMHRGX.js","../bundle/recognize-TTED4SE3.js","../bundle/remote-C37XJ4BP.js","../bundle/rerank-APFZAMQL.js","../bundle/serve-DDPIHDVZ.js","../bundle/server-L5GNG7KC.js","../bundle/server-LKVYA2AE.js","../bundle/state-WWPPHERF.js","../bundle/store-H6UIA4PK.js","../bundle/store-maintenance-command-EYBT64A2.js"]
+  // After the server answers its first request, so it starts no later.
+  if (serves) setTimeout(() => void Promise.allSettled(chunks.map((chunk) => import(chunk))), 2000).unref()
+  await running
 }
-finally {
-    stopCatching();
-}
-//# sourceMappingURL=clidev.js.map

package/dist/bundle/all-profiles-XHC7BG3P.js

@@ -0,0 +1,24 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  CHILD_IDLE_MS,
+  allProfilesServer,
+  serveAllProfilesOverHttp,
+  serveAllProfilesOverStdio,
+  withProfile
+} from "./chunk-BDSDQCV4.js";
+import "./chunk-437W3Z2M.js";
+import "./chunk-XFXBXQBS.js";
+import "./chunk-5D4AEUVA.js";
+import "./chunk-NTLPDH76.js";
+import "./chunk-O5EHUB2V.js";
+import "./chunk-EFHLQXG6.js";
+import "./chunk-Y5E2WNWB.js";
+import "./chunk-ZVVMGPBJ.js";
+export {
+  CHILD_IDLE_MS,
+  allProfilesServer,
+  serveAllProfilesOverHttp,
+  serveAllProfilesOverStdio,
+  withProfile
+};

package/dist/bundle/anthropic-N6B3ZZHQ.js

@@ -0,0 +1,70 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  checkedOptions
+} from "./chunk-2TBVT4SZ.js";
+import {
+  messagesFor,
+  systemFor
+} from "./chunk-JTTW5ZKF.js";
+import {
+  Anthropic
+} from "./chunk-ADLS6FVG.js";
+import {
+  array,
+  optional,
+  strictObject,
+  string
+} from "./chunk-EFHLQXG6.js";
+import "./chunk-Y5E2WNWB.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_9d12b0091b773232c527328da5835651/node_modules/@wirecat/cli-core/dist/models/anthropic.js
+var options = strictObject({
+  stop_sequences: optional(array(string()))
+});
+var anthropic = {
+  images: true,
+  baseUrl: "https://api.anthropic.com",
+  validate: /* @__PURE__ */ __name((given) => checkedOptions("anthropic", options, given), "validate"),
+  complete: /* @__PURE__ */ __name(async (target, request, checked, apiKey, fetcher) => {
+    const client = new Anthropic({
+      apiKey: apiKey ?? "",
+      authToken: null,
+      fetch: /* @__PURE__ */ __name((input, init) => fetcher(input, { ...init, redirect: "error" }), "fetch"),
+      baseURL: target.baseUrl,
+      maxRetries: 0,
+      logLevel: "off",
+      timeout: 12e4
+    });
+    const response = await client.messages.stream({
+      ...checked,
+      model: target.model,
+      system: systemFor(request),
+      messages: [
+        ...messagesFor(request),
+        ...request.images === void 0 ? [] : [
+          {
+            role: "user",
+            content: request.images.map((image) => ({
+              type: "image",
+              source: { type: "base64", media_type: image.mimeType, data: image.data }
+            }))
+          }
+        ]
+      ],
+      max_tokens: request.maxTokens
+    }).finalMessage();
+    if (response.stop_reason !== "end_turn")
+      throw new Error("incomplete response");
+    return {
+      text: response.content.filter((block) => block.type === "text").map((block) => block.text).join(""),
+      tokens: response.usage.input_tokens + response.usage.output_tokens + (response.usage.cache_creation_input_tokens ?? 0) + (response.usage.cache_read_input_tokens ?? 0)
+    };
+  }, "complete")
+};
+export {
+  anthropic
+};

package/dist/bundle/bun-HUJLS7KP.js

@@ -0,0 +1,169 @@
+import { createRequire as __bundleRequire } from "node:module";
+const require = __bundleRequire(import.meta.url);
+import {
+  DefaultLogger,
+  DrizzleQueryError,
+  NoopLogger,
+  SQLiteAsyncDatabase,
+  SQLiteAsyncPreparedQuery,
+  SQLiteAsyncSession,
+  SQLiteAsyncTransaction,
+  SQLiteDialect,
+  booleanFromInteger,
+  bufferFromBytes,
+  castToText,
+  dateFromStoredMilliseconds,
+  dateFromStoredSeconds,
+  entityKind,
+  jitCompatCheck,
+  refineSqliteCodecs,
+  sql
+} from "./chunk-S57AMKLX.js";
+import {
+  __name
+} from "./chunk-ZVVMGPBJ.js";
+
+// node_modules/.pnpm/@wirecat+cli-core@0.469.0_@wirecat+cli-base@0.65.0_commander@15.0.0_esbuild@0.28.2_type_9d12b0091b773232c527328da5835651/node_modules/@wirecat/cli-core/dist/store/sqlite/drizzle/bun.js
+import { Database } from "bun:sqlite";
+var bunSQLiteCodecs = refineSqliteCodecs({
+  "integer:boolean": { normalize: booleanFromInteger },
+  "integer:timestamp": { normalize: dateFromStoredSeconds },
+  "integer:timestamp_ms": { normalize: dateFromStoredMilliseconds },
+  "text:json": { normalize: JSON.parse },
+  blob: { normalize: bufferFromBytes },
+  "blob:json": {
+    cast: castToText,
+    normalize: JSON.parse
+  },
+  "blob:bigint": {
+    cast: castToText,
+    normalize: BigInt
+  },
+  numeric: {
+    cast: castToText,
+    normalize: String
+  },
+  "numeric:number": { normalize: Number },
+  "numeric:bigint": {
+    cast: castToText,
+    normalize: BigInt
+  }
+});
+var SQLiteBunSession = class extends SQLiteAsyncSession {
+  static {
+    __name(this, "SQLiteBunSession");
+  }
+  client;
+  relations;
+  options;
+  static [entityKind] = "SQLiteBunSession";
+  logger;
+  constructor(client, dialect, relations, options = {}) {
+    super(dialect, "sync");
+    this.client = client;
+    this.relations = relations;
+    this.options = options;
+    this.logger = options.logger ?? new NoopLogger();
+  }
+  exec(query) {
+    this.client.exec(query);
+  }
+  prepareQuery(query, mode, _prepare, executeMethod, mapper, queryMetadata) {
+    let stmt;
+    try {
+      stmt = this.client.query(query.sql);
+    } catch (e) {
+      throw new DrizzleQueryError(query.sql, this.options.paramsInErrors ? query.params : void 0, e);
+    }
+    return new SQLiteAsyncPreparedQuery("sync", executeMethod, {
+      all: /* @__PURE__ */ __name((params) => {
+        if (mode === "arrays") return stmt.values(...params);
+        return stmt.all(...params);
+      }, "all"),
+      get: /* @__PURE__ */ __name((params) => {
+        if (mode === "arrays") return stmt.values(...params)[0];
+        return stmt.get(...params);
+      }, "get"),
+      run: /* @__PURE__ */ __name((params) => {
+        return stmt.run(...params);
+      }, "run")
+    }, query, mapper, mode, this.logger, void 0, queryMetadata, void 0, this.options.paramsInErrors);
+  }
+  transaction(transaction, config = {}) {
+    const tx = new SQLiteBunTransaction("sync", this.dialect, this, this.relations);
+    let result;
+    const nativeTx = this.client.transaction(() => {
+      result = transaction(tx);
+    });
+    if (config.behavior === "concurrent") throw new Error("Concurrent transactions are not supported by driver");
+    nativeTx[config.behavior ?? "deferred"]();
+    return result;
+  }
+};
+var SQLiteBunTransaction = class SQLiteBunTransaction2 extends SQLiteAsyncTransaction {
+  static {
+    __name(this, "SQLiteBunTransaction2");
+  }
+  static [entityKind] = "SQLiteBunTransaction";
+  transaction(transaction) {
+    const savepointName = `sp${this.nestedIndex}`;
+    const tx = new SQLiteBunTransaction2("sync", this.dialect, this.session, this._.relations, this.nestedIndex + 1);
+    this.session.run(sql.raw(`savepoint ${savepointName}`));
+    try {
+      const result = transaction(tx);
+      this.session.run(sql.raw(`release savepoint ${savepointName}`));
+      return result;
+    } catch (err) {
+      try {
+        this.session.run(sql.raw(`rollback to savepoint ${savepointName}`));
+      } catch {
+      }
+      throw err;
+    }
+  }
+};
+var SQLiteBunDatabase = class extends SQLiteAsyncDatabase {
+  static {
+    __name(this, "SQLiteBunDatabase");
+  }
+  static [entityKind] = "SQLiteBunDatabase";
+};
+function construct(client, config = {}) {
+  const dialect = new SQLiteDialect({
+    codecs: config.codecs ?? bunSQLiteCodecs,
+    useJitMappers: jitCompatCheck(config.jit)
+  });
+  let logger;
+  if (config.logger === true) logger = new DefaultLogger();
+  else if (config.logger !== false) logger = config.logger;
+  const relations = config.relations ?? {};
+  const db = new SQLiteBunDatabase("sync", dialect, new SQLiteBunSession(client, dialect, relations, {
+    logger,
+    paramsInErrors: config.paramsInErrors
+  }), relations);
+  db.$client = client;
+  return db;
+}
+__name(construct, "construct");
+function drizzle(...params) {
+  if (params[0] === void 0 || typeof params[0] === "string") return construct(params[0] === void 0 ? new Database() : new Database(params[0]), params[1]);
+  const { connection, client, ...DrizzleSQLiteConfig } = params[0];
+  if (client) return construct(client, DrizzleSQLiteConfig);
+  if (typeof connection === "object") {
+    const { source, ...opts } = connection;
+    const options = Object.values(opts).filter((v) => v !== void 0).length ? opts : void 0;
+    return construct(new Database(source, options), DrizzleSQLiteConfig);
+  }
+  return construct(new Database(connection), DrizzleSQLiteConfig);
+}
+__name(drizzle, "drizzle");
+(function(_drizzle) {
+  function mock(config) {
+    return construct({}, config);
+  }
+  __name(mock, "mock");
+  _drizzle.mock = mock;
+})(drizzle || (drizzle = {}));
+export {
+  drizzle
+};