devapp

var CreateApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+create",
	Product:     productDevApp,
	Description: "创建开放平台企业内部应用",
	Intent:      "当你要在开放平台从零新建一个企业内部应用（H5/机器人等的载体）时使用；传入应用名称、可选描述与图标 mediaId，会实际创建出一个新应用并返回其 unifiedAppId 供后续配置。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_create",
			CanonicalPath:  "devapp.shortcut_create",
			CLIPath:        "devapp +create",
			PrimaryCLIPath: "devapp +create",
		},
		Description: "创建开放平台企业内部应用",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "创建开放平台企业内部应用",
			UseWhen:      []string{"当你要在开放平台从零新建一个企业内部应用（H5/机器人等的载体）时使用；传入应用名称、可选描述与图标 mediaId，会实际创建出一个新应用并返回其 unifiedAppId 供后续配置。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +create --name <NAME>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "name", Type: shortcut.FlagString, Desc: "应用名称", Required: true},
		{Name: "desc", Type: shortcut.FlagString, Desc: "应用描述"},
		{Name: "icon-media-id", Type: shortcut.FlagString, Desc: "应用图标 mediaId"},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{"name": rt.Str("name")}
		if rt.Changed("desc") {
			params["desc"] = rt.Str("desc")
		}
		if rt.Changed("icon-media-id") {
			params["iconMediaId"] = rt.Str("icon-media-id")
		}
		if previewed, err := devAppWritePreview(rt, "create_dev_app", params); previewed || err != nil {
			return err
		}
		receipt, err := callDevAppWrite(rt, "create_dev_app", params)
		if err != nil {
			return err
		}
		created, err := requireDevAppObject(receipt, "devapp/create_dev_app")
		if err != nil {
			return err
		}
		appID := devAppFirstString(created, "unifiedAppId", "unified_app_id")
		if appID == "" {
			return devAppResponseError("devapp/create_dev_app", "missing_resource_id", "创建回执缺少 unifiedAppId，无法绑定精确读回")
		}
		_, resource, err := readDevAppObject(rt, "get_dev_app", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
		if err != nil {
			return err
		}
		if err := requireDevAppStringField(resource, "devapp/get_dev_app", rt.Str("name"), "name", "appName"); err != nil {
			return err
		}
		if rt.Changed("desc") {
			if err := requireDevAppStringField(resource, "devapp/get_dev_app", rt.Str("desc"), "desc", "description"); err != nil {
				return err
			}
		}
		if rt.Changed("icon-media-id") {
			if err := requireDevAppStringField(resource, "devapp/get_dev_app", rt.Str("icon-media-id"), "iconMediaId", "icon"); err != nil {
				return err
			}
		}
		return rt.Output(verifiedDevAppMutation("create", appID, resource))
	},
}

var DeleteApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+delete",
	Product:     productDevApp,
	Description: "删除开放平台企业内部应用（不可逆）",
	Intent:      "当你确认要彻底废弃某个企业内部应用时使用；传入 unifiedAppId 会真实且不可逆地删除该应用及其配置，执行前务必确认无误。",
	Risk:        shortcut.RiskHighWrite,
	Safety: contract.SafetySpec{
		Effect: "destructive", Risk: "high",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_delete",
			CanonicalPath:  "devapp.shortcut_delete",
			CLIPath:        "devapp +delete",
			PrimaryCLIPath: "devapp +delete",
		},
		Description: "删除开放平台企业内部应用（不可逆）",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "删除开放平台企业内部应用（不可逆）",
			UseWhen:      []string{"当你确认要彻底废弃某个企业内部应用时使用；传入 unifiedAppId 会真实且不可逆地删除该应用及其配置，执行前务必确认无误。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +delete --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		params := map[string]any{"unifiedAppId": appID}
		if previewed, err := devAppWritePreview(rt, "delete_dev_app", params); previewed || err != nil {
			return err
		}
		_, existing, err := readDevAppObject(rt, "get_dev_app", params, map[string]string{"unifiedAppId": appID})
		if err != nil {
			return err
		}
		appKey := devAppFirstString(existing, "appKey", "clientId")
		if appKey == "" {
			return devAppResponseError("devapp/get_dev_app", "missing_readback_selector", "删除前读回缺少 appKey，拒绝进入不可逆写入")
		}
		if _, err := callDevAppWrite(rt, "delete_dev_app", params); err != nil {
			return err
		}
		if err := verifyDeletedDevApp(rt, appID, appKey); err != nil {
			return err
		}
		return rt.Output(verifiedDevAppMutation("delete", appID, nil))
	},
}

var DisableApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+disable",
	Product:     productDevApp,
	Description: "停用开放平台企业内部应用",
	Intent:      "当你要临时下线某个应用、让它对用户不可用又不删除时使用；传入 unifiedAppId 会实际将应用状态切换为停用，可日后再启用恢复。",
	Risk:        shortcut.RiskHighWrite,
	Safety: contract.SafetySpec{
		Effect: "destructive", Risk: "high",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_disable",
			CanonicalPath:  "devapp.shortcut_disable",
			CLIPath:        "devapp +disable",
			PrimaryCLIPath: "devapp +disable",
		},
		Description: "停用开放平台企业内部应用",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "停用开放平台企业内部应用",
			UseWhen:      []string{"当你要临时下线某个应用、让它对用户不可用又不删除时使用；传入 unifiedAppId 会实际将应用状态切换为停用，可日后再启用恢复。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +disable --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		return changeDevAppStatus(rt, "disable_dev_app", "disable", "disabled")
	},
}

var EnableApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+enable",
	Product:     productDevApp,
	Description: "启用开放平台企业内部应用",
	Intent:      "当某个应用处于停用状态、你要让它重新生效可用时使用；传入 unifiedAppId 会实际将应用状态切换为启用。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_enable",
			CanonicalPath:  "devapp.shortcut_enable",
			CLIPath:        "devapp +enable",
			PrimaryCLIPath: "devapp +enable",
		},
		Description: "启用开放平台企业内部应用",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "启用开放平台企业内部应用",
			UseWhen:      []string{"当某个应用处于停用状态、你要让它重新生效可用时使用；传入 unifiedAppId 会实际将应用状态切换为启用。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +enable --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		return changeDevAppStatus(rt, "enable_dev_app", "enable", "normal")
	},
}

var EventList = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+event-list",
	Product:     productDevApp,
	Description: "查询应用可用事件目录与订阅状态",
	Intent:      "当你要查某应用可用的事件码、事件名称及当前订阅状态（用于选择订阅项、排查漏收事件或退订前核对）时使用；输入 unifiedAppId，可按关键词过滤并游标分页。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_event_list",
			CanonicalPath:  "devapp.shortcut_event_list",
			CLIPath:        "devapp +event-list",
			PrimaryCLIPath: "devapp +event-list",
		},
		Description: "查询应用可用事件目录与订阅状态",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询应用可用事件目录与订阅状态",
			UseWhen:      []string{"当你要查某应用可用的事件码、事件名称及当前订阅状态（用于选择订阅项、排查漏收事件或退订前核对）时使用；输入 unifiedAppId，可按关键词过滤并游标分页。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +event-list --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result:     devAppPaginatedProjectionResult("events", "当前页应用订阅事件查询结果"),
		Pagination: devAppCursorPagination(),
	},
	Flags: append([]shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "keyword", Type: shortcut.FlagString, Desc: "事件搜索关键词，支持按事件码或事件名称模糊匹配"},
	}, cursorFlags...),
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{"unifiedAppId": rt.Str("unified-app-id")}
		if rt.Changed("keyword") {
			params["keyword"] = rt.Str("keyword")
		}
		applyCursor(rt, params)
		data, err := rt.CallMCPData(productDevApp, "list_dev_app_events", params)
		if err != nil {
			return err
		}
		events, err := eventListProject(data)
		if err != nil {
			return err
		}
		projection, err := devAppListProjection(data, "events", events, "devapp/list_dev_app_events")
		if err != nil {
			return err
		}
		return rt.Output(projection)
	},
}

var EventSubscribe = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+event-subscribe",
	Product:     productDevApp,
	Description: "订阅应用事件回调",
	Intent:      "当你要让应用开始接收某些事件的回调推送（如通讯录变更、审批事件等）时使用；传入 unifiedAppId 和事件码列表，会实际为该应用登记这些事件订阅。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID: "devapp", Name: "shortcut_event_subscribe",
			CanonicalPath: "devapp.shortcut_event_subscribe", CLIPath: "devapp +event-subscribe", PrimaryCLIPath: "devapp +event-subscribe",
		},
		Description: "订阅应用事件并逐项精确读回",
		Interface:   &contract.InterfaceSpec{Mode: "composite", Availability: "available", Reason: "Reviewed adapter rejects empty or duplicate event codes, requires terminal success, then traverses the bounded event cursor and verifies every requested eventCode under the same unifiedAppId."},
		Selection: contract.SelectionSpec{
			AgentSummary: "订阅应用事件回调",
			UseWhen:      []string{"当你要让应用开始接收某些事件的回调推送（如通讯录变更、审批事件等）时使用；传入 unifiedAppId 和事件码列表，会实际为该应用登记这些事件订阅。"},
			AvoidWhen:    []string{"只需查看现有订阅时暂用 dev app event list 原子命令；+event-list 缺少零结果分页终止事实，退订也无法证明实际移除"},
			Examples:     []string{"dws devapp +event-subscribe --unified-app-id <UNIFIED_APP_ID> --event-codes <EVENT_CODES>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "event-codes", Type: shortcut.FlagStringSlice, Desc: "事件码列表至少包含一项非空且互不重复的 eventCode", Required: true},
	},
	Constraints: []shortcut.Constraint{{
		Kind:        shortcut.ConstraintCustom,
		Flags:       []string{"event-codes"},
		Description: "事件码列表至少包含一项非空且互不重复的 eventCode",
	}},
	Validate: func(rt *shortcut.RuntimeContext) error {
		_, err := validatedDevAppValues(rt.StrSlice("event-codes"), "--event-codes")
		return err
	},
	Execute: func(rt *shortcut.RuntimeContext) error {

		codes, _ := validatedDevAppValues(rt.StrSlice("event-codes"), "--event-codes")
		appID := rt.Str("unified-app-id")
		params := map[string]any{
			"unifiedAppId": appID,
			"eventCodes":   codes,
		}
		if previewed, err := devAppWritePreview(rt, "subscribe_dev_app_events", params); previewed || err != nil {
			return err
		}
		if _, err := callDevAppWrite(rt, "subscribe_dev_app_events", params); err != nil {
			return err
		}
		if err := verifyDevAppEventCodes(rt, appID, codes); err != nil {
			return err
		}
		return rt.Output(verifiedDevAppMutation("event_subscribe", appID, map[string]any{"eventCodes": codes}))
	},
}

var EventUnsubscribe = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+event-unsubscribe",
	Product:     productDevApp,
	Description: "取消订阅应用事件",
	Intent:      "当你不再需要某些事件的回调推送、要停止接收它们时使用；传入 unifiedAppId 和事件码列表，会实际取消这些事件的订阅。",
	Risk:        shortcut.RiskHighWrite,
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "event-codes", Type: shortcut.FlagStringSlice, Desc: "事件码列表", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{
			"unifiedAppId": rt.Str("unified-app-id"),
			"eventCodes":   rt.StrSlice("event-codes"),
		}
		return rt.CallMCP("unsubscribe_dev_app_events", params)
	},
}

var GetApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+get",
	Product:     productDevApp,
	Description: "查询开放平台企业内部应用详情",
	Intent:      "当你已知某应用的 unifiedAppId、需要查看它的完整配置信息（如名称、描述、图标、能力开关等）以便核对现状或作为修改前的依据时使用；输入 unifiedAppId，返回单个应用的详情。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_get",
			CanonicalPath:  "devapp.shortcut_get",
			CLIPath:        "devapp +get",
			PrimaryCLIPath: "devapp +get",
		},
		Description: "查询开放平台企业内部应用详情",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询开放平台企业内部应用详情",
			UseWhen:      []string{"当你已知某应用的 unifiedAppId、需要查看它的完整配置信息（如名称、描述、图标、能力开关等）以便核对现状或作为修改前的依据时使用；输入 unifiedAppId，返回单个应用的详情。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +get --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppObjectResult(
			contract.ResultOutcomeSuccess,
			contract.ResultOutcomeFailure,
		),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		return outputDevAppObject(rt, "get_dev_app", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
	},
}

var GetCredentials = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+credentials-get",
	Product:     productDevApp,
	Description: "读取开放平台应用凭证",
	Intent:      "当你需要拿到某应用的鉴权凭证（如 clientId/AppKey、clientSecret/AppSecret）以便在代码或调试中调用开放平台接口时使用；输入 unifiedAppId，返回该应用的凭证信息。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "medium",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_credentials_get",
			CanonicalPath:  "devapp.shortcut_credentials_get",
			CLIPath:        "devapp +credentials-get",
			PrimaryCLIPath: "devapp +credentials-get",
		},
		Description: "读取开放平台应用凭证",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed adapter requires an explicit success marker, a non-empty credential object, exact unifiedAppId, a public client identifier, and a non-empty secret before unified output; secret fields are declared sensitive.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "读取开放平台应用凭证",
			UseWhen:      []string{"当你需要拿到某应用的鉴权凭证（如 clientId/AppKey、clientSecret/AppSecret）以便在代码或调试中调用开放平台接口时使用；输入 unifiedAppId，返回该应用的凭证信息。"},
			AvoidWhen:    []string{"只需应用元数据时使用 +get；不要把返回密钥写入文档、日志、示例或聊天正文"},
			Examples:     []string{"dws devapp +credentials-get --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppCredentialResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		_, credentials, err := readDevAppObject(rt, "get_dev_app_credentials", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
		if err != nil {
			return err
		}
		if devAppFirstString(credentials, "appKey", "clientId") == "" {
			return devAppResponseError("devapp/get_dev_app_credentials", "missing_client_id", "凭证响应缺少非空 appKey/clientId")
		}
		if devAppFirstString(credentials, "appSecret", "clientSecret", "secret") == "" {
			return devAppResponseError("devapp/get_dev_app_credentials", "missing_client_secret", "凭证响应缺少非空 appSecret/clientSecret")
		}
		return rt.Output(credentials)
	},
}

var ListApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+list",
	Product:     productDevApp,
	Description: "查询开放平台企业内部应用列表",
	Intent:      "当你要在开发者后台盘点或定位某个企业内部应用（例如按应用名、appKey、创建人或机器人名搜索，拿到其 unifiedAppId 以便后续查看详情、配置或发布）时使用；支持关键词过滤、排序和分页，返回应用列表。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_list",
			CanonicalPath:  "devapp.shortcut_list",
			CLIPath:        "devapp +list",
			PrimaryCLIPath: "devapp +list",
		},
		Description: "查询开放平台企业内部应用列表",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询开放平台企业内部应用列表",
			UseWhen:      []string{"当你要在开发者后台盘点或定位某个企业内部应用（例如按应用名、appKey、创建人或机器人名搜索，拿到其 unifiedAppId 以便后续查看详情、配置或发布）时使用；支持关键词过滤、排序和分页，返回应用列表。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +list"},
		},
		Result:     devAppPaginatedProjectionResult("apps", "当前页开放平台应用查询结果"),
		Pagination: devAppCursorPagination(),
	},
	Flags: append([]shortcut.Flag{
		{Name: "name", Type: shortcut.FlagString, Desc: "应用名称关键词"},
		{Name: "app-key", Type: shortcut.FlagString, Desc: "按 appKey/clientId 过滤"},
		{Name: "app-group-id", Type: shortcut.FlagInt, Desc: "应用分组 ID"},
		{Name: "creator", Type: shortcut.FlagString, Desc: "创建人名称关键词"},
		{Name: "robot-name", Type: shortcut.FlagString, Desc: "机器人名称关键词"},
		{Name: "develop-type", Type: shortcut.FlagInt, Desc: "开发类型枚举；不确定时不要传"},
		{Name: "filter-cool-app", Type: shortcut.FlagInt, Desc: "酷应用过滤枚举；不确定时不要传"},
		{Name: "sort-type", Type: shortcut.FlagString, Desc: "排序字段，如 gmt_modified"},
		{Name: "sort-order", Type: shortcut.FlagString, Desc: "排序方向 asc 或 desc"},
	}, cursorFlags...),
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{}
		applyCursor(rt, params)
		if rt.Changed("name") {
			params["name"] = rt.Str("name")
		}
		if rt.Changed("app-key") {
			params["appKey"] = rt.Str("app-key")
		}
		if rt.Changed("app-group-id") {
			params["appGroupId"] = rt.Int("app-group-id")
		}
		if rt.Changed("creator") {
			params["creator"] = rt.Str("creator")
		}
		if rt.Changed("robot-name") {
			params["robotName"] = rt.Str("robot-name")
		}
		if rt.Changed("develop-type") {
			params["developType"] = rt.Int("develop-type")
		}
		if rt.Changed("filter-cool-app") {
			params["filterCoolApp"] = rt.Int("filter-cool-app")
		}
		if rt.Changed("sort-type") {
			params["sortType"] = rt.Str("sort-type")
		}
		if rt.Changed("sort-order") {
			params["sortOrder"] = rt.Str("sort-order")
		}
		data, err := rt.CallMCPData(productDevApp, "list_dev_app", params)
		if err != nil {
			return err
		}
		apps, err := listAppProject(data)
		if err != nil {
			return err
		}
		projection, err := devAppListProjection(data, "apps", apps, "devapp/list_dev_app")
		if err != nil {
			return err
		}
		return rt.Output(projection)
	},
}

var MemberAdd = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+member-add",
	Product:     productDevApp,
	Description: "添加开放平台应用成员",
	Intent:      "当你要给某应用增加协作人员并要求按稳定 userId 逐项确认成员角色已写回时使用；传入 unifiedAppId、userId 列表和成员类型（如 DEVELOPER）。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_member_add",
			CanonicalPath:  "devapp.shortcut_member_add",
			CLIPath:        "devapp +member-add",
			PrimaryCLIPath: "devapp +member-add",
		},
		Description: "添加开放平台应用成员",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "添加开放平台应用成员",
			UseWhen:      []string{"当你要给某应用增加协作人员并要求按稳定 userId 逐项确认成员角色已写回时使用；传入 unifiedAppId、userId 列表和成员类型（如 DEVELOPER）。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +member-add --unified-app-id <UNIFIED_APP_ID> --user-ids <VALUES> --member-type <MEMBER_TYPE>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "user-ids", Type: shortcut.FlagStringSlice, Desc: "成员 userId 列表，不能为空且不能重复", Required: true},
		{Name: "member-type", Type: shortcut.FlagString, Desc: "成员类型，如 DEVELOPER，不能为空", Required: true},
	},
	Constraints: []shortcut.Constraint{
		{Kind: shortcut.ConstraintCustom, Flags: []string{"user-ids"}, Description: "userId 列表不能为空且不能重复"},
		{Kind: shortcut.ConstraintCustom, Flags: []string{"member-type"}, Description: "成员类型不能为空"},
	},
	Validate: func(rt *shortcut.RuntimeContext) error {
		_, _, err := validatedDevAppMemberInputs(rt)
		return err
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		userIDs, memberType, _ := validatedDevAppMemberInputs(rt)
		appID := rt.Str("unified-app-id")
		params := map[string]any{
			"unifiedAppId": appID,
			"userIds":      userIDs,
			"memberType":   memberType,
		}
		if previewed, err := devAppWritePreview(rt, "add_dev_app_members", params); previewed || err != nil {
			return err
		}
		if _, err := callDevAppWrite(rt, "add_dev_app_members", params); err != nil {
			return err
		}
		if err := verifyDevAppMembers(rt, appID, userIDs, memberType, true); err != nil {
			return err
		}
		return rt.Output(verifiedDevAppMutation("member_add", appID, map[string]any{
			"count": len(userIDs), "memberType": memberType,
		}))
	},
}

var MemberList = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+member-list",
	Product:     productDevApp,
	Description: "查询开放平台应用成员",
	Intent:      "当你要查看某应用有哪些成员及其角色（如谁是开发者/管理员），用于核对协作人员或权限归属时使用；输入 unifiedAppId，返回成员列表。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_member_list",
			CanonicalPath:  "devapp.shortcut_member_list",
			CLIPath:        "devapp +member-list",
			PrimaryCLIPath: "devapp +member-list",
		},
		Description: "查询开放平台应用成员",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询开放平台应用成员",
			UseWhen:      []string{"当你要查看某应用有哪些成员及其角色（如谁是开发者/管理员），用于核对协作人员或权限归属时使用；输入 unifiedAppId，返回成员列表。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +member-list --unified-app-id <UNIFIED_APP_ID> --user-id <USER_ID>"},
		},
		Result: devAppMemberListResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "user-id", Type: shortcut.FlagString, Desc: "可选稳定 userId；由 Shortcut 在严格验证完整成员数组后做精确等值筛选"},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		raw, err := rt.CallMCPData(productDevApp, "list_dev_app_members", map[string]any{"unifiedAppId": rt.Str("unified-app-id")})
		if err != nil {
			return err
		}
		members, _, err := requireDevAppCollection(raw, "devapp/list_dev_app_members", []string{"userId", "user_id"}, "members", "items", "list")
		if err != nil {
			return err
		}
		wantUser := strings.TrimSpace(rt.Str("user-id"))
		out := projectDevAppMembers(members, wantUser)
		return rt.Output(map[string]any{"count": len(out), "members": out})
	},
}

var MemberRemove = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+member-remove",
	Product:     productDevApp,
	Description: "移除开放平台应用成员",
	Intent:      "当某人不再参与、你要取消其应用成员身份，并要求按稳定 userId 逐项确认目标已不在成员列表中时使用；传入 unifiedAppId、userId 列表和成员类型。",
	Risk:        shortcut.RiskHighWrite,
	Safety: contract.SafetySpec{
		Effect: "destructive", Risk: "high",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_member_remove",
			CanonicalPath:  "devapp.shortcut_member_remove",
			CLIPath:        "devapp +member-remove",
			PrimaryCLIPath: "devapp +member-remove",
		},
		Description: "移除开放平台应用成员",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "移除开放平台应用成员",
			UseWhen:      []string{"当某人不再参与、你要取消其应用成员身份，并要求按稳定 userId 逐项确认目标已不在成员列表中时使用；传入 unifiedAppId、userId 列表和成员类型。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +member-remove --unified-app-id <UNIFIED_APP_ID> --user-ids <VALUES> --member-type <MEMBER_TYPE>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "user-ids", Type: shortcut.FlagStringSlice, Desc: "成员 userId 列表，不能为空且不能重复", Required: true},
		{Name: "member-type", Type: shortcut.FlagString, Desc: "成员类型，如 DEVELOPER，不能为空", Required: true},
	},
	Constraints: []shortcut.Constraint{
		{Kind: shortcut.ConstraintCustom, Flags: []string{"user-ids"}, Description: "userId 列表不能为空且不能重复"},
		{Kind: shortcut.ConstraintCustom, Flags: []string{"member-type"}, Description: "成员类型不能为空"},
	},
	Validate: func(rt *shortcut.RuntimeContext) error {
		_, _, err := validatedDevAppMemberInputs(rt)
		return err
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		userIDs, memberType, _ := validatedDevAppMemberInputs(rt)
		appID := rt.Str("unified-app-id")
		params := map[string]any{
			"unifiedAppId": appID,
			"userIds":      userIDs,
			"memberType":   memberType,
		}
		if previewed, err := devAppWritePreview(rt, "remove_dev_app_members", params); previewed || err != nil {
			return err
		}
		if _, err := callDevAppWrite(rt, "remove_dev_app_members", params); err != nil {
			return err
		}
		if err := verifyDevAppMembers(rt, appID, userIDs, memberType, false); err != nil {
			return err
		}
		return rt.Output(verifiedDevAppMutation("member_remove", appID, map[string]any{
			"count": len(userIDs), "memberType": memberType,
		}))
	},
}

var PermissionAdd = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+permission-add",
	Product:     productDevApp,
	Description: "申请开放平台应用权限点",
	Intent:      "当应用调用某接口报缺少权限、你要为它开通一批 API 权限点时使用；传入 unifiedAppId 和 scopeValue 列表，会实际为该应用申请/授予这些权限。",
	Risk:        shortcut.RiskWrite,
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "scope-values", Type: shortcut.FlagStringSlice, Desc: "权限点 scopeValue 列表", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{
			"unifiedAppId": rt.Str("unified-app-id"),
			"scopeValues":  rt.StrSlice("scope-values"),
		}
		return rt.CallMCP("apply_dev_app_permissions", params)
	},
}

var PermissionList = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+permission-list",
	Product:     productDevApp,
	Description: "查询开放平台应用权限列表",
	Intent:      "当你要查看某应用已申请/可申请的 API 权限点及其授权状态（用于排查接口报权限错、或确认某 scopeValue 是否已开通）时使用；可按关键词、scopeValue、授权状态等过滤，返回权限点列表。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_permission_list",
			CanonicalPath:  "devapp.shortcut_permission_list",
			CLIPath:        "devapp +permission-list",
			PrimaryCLIPath: "devapp +permission-list",
		},
		Description: "查询开放平台应用权限列表",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询开放平台应用权限列表",
			UseWhen:      []string{"当你要查看某应用已申请/可申请的 API 权限点及其授权状态（用于排查接口报权限错、或确认某 scopeValue 是否已开通）时使用；可按关键词、scopeValue、授权状态等过滤，返回权限点列表。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +permission-list --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result:     devAppPaginatedProjectionResult("permissions", "当前页开放平台应用权限查询结果"),
		Pagination: devAppCursorPagination(),
	},
	Flags: append([]shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "keyword", Type: shortcut.FlagString, Desc: "权限名、权限点、接口名关键词"},
		{Name: "scope-value", Type: shortcut.FlagString, Desc: "精确权限点 scopeValue"},
		{Name: "auth-status", Type: shortcut.FlagString, Default: "ALL", Desc: "权限状态：ALL、AUTHED、UNAUTHED"},
		{Name: "scope-type", Type: shortcut.FlagString, Desc: "权限一级类型：APP 或 SNS"},
		{Name: "api-status", Type: shortcut.FlagString, Desc: "开发者后台 apiStatus 过滤"},
	}, cursorFlags...),
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{"unifiedAppId": rt.Str("unified-app-id")}
		if rt.Changed("keyword") {
			params["keyword"] = rt.Str("keyword")
		}
		if rt.Changed("scope-value") {
			params["scopeValue"] = rt.Str("scope-value")
		}
		if v := strings.ToUpper(rt.Str("auth-status")); v != "" {
			params["authStatus"] = v
		}
		if rt.Changed("scope-type") {
			params["scopeType"] = strings.ToUpper(rt.Str("scope-type"))
		}
		if rt.Changed("api-status") {
			params["apiStatus"] = rt.Str("api-status")
		}
		applyCursor(rt, params)
		data, err := rt.CallMCPData(productDevApp, "list_dev_app_permissions", params)
		if err != nil {
			return err
		}
		permissions, err := permissionListProject(data)
		if err != nil {
			return err
		}
		projection, err := devAppListProjection(data, "permissions", permissions, "devapp/list_dev_app_permissions")
		if err != nil {
			return err
		}
		return rt.Output(projection)
	},
}

var PermissionRemove = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+permission-remove",
	Product:     productDevApp,
	Description: "取消开放平台应用权限点",
	Intent:      "当你要收回应用已开通的某些 API 权限（如安全收敛、下线不再使用的接口）时使用；传入 unifiedAppId 和待取消的 scopeValue 列表，会实际移除这些权限授权。",
	Risk:        shortcut.RiskHighWrite,
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "scope-values", Type: shortcut.FlagStringSlice, Desc: "待取消权限点 scopeValue 列表", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{
			"unifiedAppId": rt.Str("unified-app-id"),
			"scopeValues":  rt.StrSlice("scope-values"),
		}
		return rt.CallMCP("remove_dev_app_permissions", params)
	},
}

var RobotConfig = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+robot-config",
	Product:     productDevApp,
	Description: "创建或更新现有应用的机器人配置（upsert）",
	Intent:      "当你要为应用开通机器人或调整其机器人设置（改名称/简介/图标、设消息与事件回调地址、切换 HTTPS/STREAM/AISKILL 模式、配技能、是否自动加权限或关 SSL 校验）时使用；按 unifiedAppId 以 upsert 方式写入机器人配置，会实际生效。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID: "devapp", Name: "shortcut_robot_config",
			CanonicalPath: "devapp.shortcut_robot_config", CLIPath: "devapp +robot-config", PrimaryCLIPath: "devapp +robot-config",
		},
		Description: "创建或更新现有应用的机器人配置并精确读回",
		Interface: &contract.InterfaceSpec{
			Mode: "composite", Availability: "available",
			Reason: "Reviewed adapter rejects an empty update, requires terminal success, then reads the same unifiedAppId and compares every changed scalar field before returning verified output.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "创建或更新现有应用的机器人配置（upsert）",
			UseWhen:      []string{"当你要为应用开通机器人或调整其机器人设置（改名称/简介/图标、设消息与事件回调地址、切换 HTTPS/STREAM/AISKILL 模式、配技能、是否自动加权限或关 SSL 校验）时使用；按 unifiedAppId 以 upsert 方式写入机器人配置，会实际生效。"},
			AvoidWhen:    []string{"只需查看现状使用 +robot-get；仅切换已配置机器人的在线状态使用 +robot-enable 或 +robot-disable"},
			Examples:     []string{"dws devapp +robot-config --unified-app-id <UNIFIED_APP_ID> --name <BOT_NAME> --mode STREAM"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "name", Type: shortcut.FlagString, Desc: "机器人名称；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "brief", Type: shortcut.FlagString, Desc: "机器人简介；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "desc", Type: shortcut.FlagString, Desc: "机器人描述；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "icon-media-id", Type: shortcut.FlagString, Desc: "机器人图标 mediaId；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "outgoing-url", Type: shortcut.FlagString, Desc: "消息回调地址；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "event-callback-url", Type: shortcut.FlagString, Desc: "事件回调地址；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "mode", Type: shortcut.FlagString, Enum: []string{"HTTPS", "STREAM", "AISKILL"}, Desc: "机器人模式：HTTPS / STREAM / AISKILL；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "skills", Type: shortcut.FlagStringSlice, Desc: "技能列表；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "add-scope", Type: shortcut.FlagBool, Desc: "是否自动添加机器人相关权限；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
		{Name: "disable-ssl-verify", Type: shortcut.FlagBool, Desc: "回调地址是否关闭 SSL 校验；至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置"},
	},
	Constraints: []shortcut.Constraint{{
		Kind:        shortcut.ConstraintCustom,
		Flags:       []string{"name", "brief", "desc", "icon-media-id", "outgoing-url", "event-callback-url", "mode", "skills", "add-scope", "disable-ssl-verify"},
		Description: "至少提供一项非空机器人配置；布尔开关显式传入 false 也算配置",
	}},
	Validate: func(rt *shortcut.RuntimeContext) error {
		for _, name := range []string{"name", "brief", "desc", "icon-media-id", "outgoing-url", "event-callback-url", "mode"} {
			if rt.Changed(name) && strings.TrimSpace(rt.Str(name)) != "" {
				return nil
			}
		}
		if rt.Changed("skills") && len(rt.StrSlice("skills")) > 0 {
			return nil
		}
		if rt.Changed("add-scope") || rt.Changed("disable-ssl-verify") {
			return nil
		}
		return apperrors.NewValidation("至少提供一项非空机器人配置")
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		params := map[string]any{"unifiedAppId": appID}
		if rt.Changed("name") {
			params["name"] = rt.Str("name")
		}
		if rt.Changed("brief") {
			params["brief"] = rt.Str("brief")
		}
		if rt.Changed("desc") {
			params["desc"] = rt.Str("desc")
		}
		if rt.Changed("icon-media-id") {
			params["iconMediaId"] = rt.Str("icon-media-id")
		}
		if rt.Changed("outgoing-url") {
			params["outgoingUrl"] = rt.Str("outgoing-url")
		}
		if rt.Changed("event-callback-url") {
			params["eventCallbackUrl"] = rt.Str("event-callback-url")
		}
		if rt.Changed("mode") {
			params["mode"] = strings.ToUpper(rt.Str("mode"))
		}
		if rt.Changed("skills") {
			params["skills"] = rt.StrSlice("skills")
		}
		if rt.Changed("add-scope") {
			params["addScope"] = rt.Bool("add-scope")
		}
		if rt.Changed("disable-ssl-verify") {
			params["disableSSLVerify"] = rt.Bool("disable-ssl-verify")
		}
		if previewed, err := devAppWritePreview(rt, "set_extension_robot_config", params); previewed || err != nil {
			return err
		}
		if _, err := callDevAppWrite(rt, "set_extension_robot_config", params); err != nil {
			return err
		}
		_, resource, err := readDevAppObject(rt, "get_extension_robot_config", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
		if err != nil {
			return err
		}
		for flag, keys := range map[string][]string{
			"name": {"name"}, "brief": {"brief"}, "desc": {"desc", "description"},
			"icon-media-id": {"iconMediaId"}, "outgoing-url": {"outgoingUrl"},
			"event-callback-url": {"eventCallbackUrl"}, "mode": {"mode"},
		} {
			if !rt.Changed(flag) {
				continue
			}
			want := rt.Str(flag)
			if flag == "mode" {
				want = strings.ToUpper(want)
			}
			if err := requireDevAppStringField(resource, "devapp/get_extension_robot_config", want, keys...); err != nil {
				return err
			}
		}
		for flag, key := range map[string]string{"add-scope": "addScope", "disable-ssl-verify": "disableSSLVerify"} {
			if rt.Changed(flag) {
				if err := requireDevAppFields(resource, "devapp/get_extension_robot_config", map[string]any{key: rt.Bool(flag)}); err != nil {
					return err
				}
			}
		}
		if rt.Changed("skills") {
			if err := requireDevAppFields(resource, "devapp/get_extension_robot_config", map[string]any{"skills": rt.StrSlice("skills")}); err != nil {
				return err
			}
		}
		return rt.Output(verifiedDevAppMutation("robot_config", appID, resource))
	},
}

var RobotDisable = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+robot-disable",
	Product:     productDevApp,
	Description: "停用现有应用的机器人能力",
	Intent:      "当你要下线某应用的机器人、不再收发机器人消息时使用；当前平台读回终态为 UNCONFIGURED，因此重新上线前可能需要先用 +robot-config 恢复配置。",
	Risk:        shortcut.RiskHighWrite,
	Safety: contract.SafetySpec{
		Effect: "destructive", Risk: "high",
		Confirmation: "user_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID: "devapp", Name: "shortcut_robot_disable",
			CanonicalPath: "devapp.shortcut_robot_disable", CLIPath: "devapp +robot-disable", PrimaryCLIPath: "devapp +robot-disable",
		},
		Description: "下线应用机器人并读回 UNCONFIGURED 终态",
		Interface:   &contract.InterfaceSpec{Mode: "composite", Availability: "available", Reason: "Reviewed adapter requires terminal success and exact get_extension_robot_config readback for the same unifiedAppId with robotStatus=UNCONFIGURED; it does not promise that configuration remains reusable."},
		Selection: contract.SelectionSpec{
			AgentSummary: "停用现有应用的机器人能力",
			UseWhen:      []string{"当你要下线某应用的机器人、不再收发机器人消息时使用；当前平台读回终态为 UNCONFIGURED，因此重新上线前可能需要先用 +robot-config 恢复配置。"},
			AvoidWhen:    []string{"只需临时停用但必须保证配置可原样恢复时不要使用；当前下游没有该保留语义"},
			Examples:     []string{"dws devapp +robot-disable --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		return changeDevAppRobotStatus(rt, "disable_dev_app_robot", "robot_disable", "UNCONFIGURED")
	},
}

var RobotEnable = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+robot-enable",
	Product:     productDevApp,
	Description: "启用现有应用机器人能力（纯启用，无需配置字段）",
	Intent:      "当应用已经具有可启用的机器人配置、你要把它切换到 ONLINE 时使用；写后会读取同一 unifiedAppId 并只在 robotStatus=ONLINE 时成功。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID: "devapp", Name: "shortcut_robot_enable",
			CanonicalPath: "devapp.shortcut_robot_enable", CLIPath: "devapp +robot-enable", PrimaryCLIPath: "devapp +robot-enable",
		},
		Description: "启用已配置的应用机器人并读回 ONLINE 终态",
		Interface:   &contract.InterfaceSpec{Mode: "composite", Availability: "available", Reason: "Reviewed adapter requires terminal success and exact get_extension_robot_config readback for the same unifiedAppId with robotStatus=ONLINE."},
		Selection: contract.SelectionSpec{
			AgentSummary: "启用现有应用机器人能力（纯启用，无需配置字段）",
			UseWhen:      []string{"当应用已经具有可启用的机器人配置、你要把它切换到 ONLINE 时使用；写后会读取同一 unifiedAppId 并只在 robotStatus=ONLINE 时成功。"},
			AvoidWhen:    []string{"需要修改机器人字段时使用 +robot-config；只查看状态使用 +robot-get"},
			Examples:     []string{"dws devapp +robot-enable --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		return changeDevAppRobotStatus(rt, "enable_dev_app_robot", "robot_enable", "ONLINE")
	},
}

var RobotGet = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+robot-get",
	Product:     productDevApp,
	Description: "查询现有应用的机器人配置",
	Intent:      "当你要查看某应用已有的机器人配置（名称、回调地址、模式 HTTPS/STREAM/AISKILL、技能等）以核对现状或作为改配置前的依据时使用；输入 unifiedAppId，返回当前机器人配置。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_robot_get",
			CanonicalPath:  "devapp.shortcut_robot_get",
			CLIPath:        "devapp +robot-get",
			PrimaryCLIPath: "devapp +robot-get",
		},
		Description: "查询现有应用的机器人配置",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询现有应用的机器人配置",
			UseWhen:      []string{"当你要查看某应用已有的机器人配置（名称、回调地址、模式 HTTPS/STREAM/AISKILL、技能等）以核对现状或作为改配置前的依据时使用；输入 unifiedAppId，返回当前机器人配置。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +robot-get --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppObjectResult(
			contract.ResultOutcomeSuccess,
			contract.ResultOutcomeFailure,
		),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		return outputDevAppObject(rt, "get_extension_robot_config", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
	},
}

var SecurityConfig = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+security-config",
	Product:     productDevApp,
	Description: "更新开放平台应用安全配置（整组覆盖，非追加）",
	Intent:      "当你要设置应用的安全策略，如出口 IP 白名单、登录重定向 URL、端内免登地址时使用；注意每项传入的是整组值会全量覆盖旧配置（非追加），所以要一次性传全，常用于配置 OAuth 回调或加固网络白名单。",
	Risk:        shortcut.RiskWrite,
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "ip-whitelist", Type: shortcut.FlagStringSlice, Desc: "出口 IP 白名单（整组覆盖）"},
		{Name: "redirect-urls", Type: shortcut.FlagStringSlice, Desc: "登录重定向 URL（整组覆盖）"},
		{Name: "sso-urls", Type: shortcut.FlagStringSlice, Desc: "端内免登地址（整组覆盖）"},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{"unifiedAppId": rt.Str("unified-app-id")}
		if rt.Changed("ip-whitelist") {
			params["ipWhitelist"] = rt.StrSlice("ip-whitelist")
		}
		if rt.Changed("redirect-urls") {
			params["redirectUrls"] = rt.StrSlice("redirect-urls")
		}
		if rt.Changed("sso-urls") {
			params["ssoUrls"] = rt.StrSlice("sso-urls")
		}
		return rt.CallMCP("update_dev_app_security_config", params)
	},
}

var UpdateApp = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+update",
	Product:     productDevApp,
	Description: "修改开放平台企业内部应用基础信息",
	Intent:      "当你要改动一个已存在应用的基础信息（更名、改描述或换图标）时使用；指定 unifiedAppId 及要更新的字段，会实际写回并覆盖对应的应用基础资料。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_update",
			CanonicalPath:  "devapp.shortcut_update",
			CLIPath:        "devapp +update",
			PrimaryCLIPath: "devapp +update",
		},
		Description: "修改开放平台企业内部应用基础信息",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "修改开放平台企业内部应用基础信息",
			UseWhen:      []string{"当你要改动一个已存在应用的基础信息（更名、改描述或换图标）时使用；指定 unifiedAppId 及要更新的字段，会实际写回并覆盖对应的应用基础资料。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +update --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "name", Type: shortcut.FlagString, Desc: "新的应用名称；至少提供一项非空的应用基础信息更新"},
		{Name: "desc", Type: shortcut.FlagString, Desc: "新的应用描述；至少提供一项非空的应用基础信息更新"},
		{Name: "icon-media-id", Type: shortcut.FlagString, Desc: "新的应用图标 mediaId；至少提供一项非空的应用基础信息更新"},
	},
	Constraints: []shortcut.Constraint{{
		Kind:        shortcut.ConstraintCustom,
		Flags:       []string{"name", "desc", "icon-media-id"},
		Description: "至少提供一项非空的应用基础信息更新",
	}},
	Validate: func(rt *shortcut.RuntimeContext) error {
		for _, name := range []string{"name", "desc", "icon-media-id"} {
			if rt.Changed(name) && rt.Str(name) != "" {
				return nil
			}
		}
		return apperrors.NewValidation("至少提供一项待更新字段：--name、--desc 或 --icon-media-id")
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		params := map[string]any{"unifiedAppId": appID}
		if rt.Changed("name") {
			params["name"] = rt.Str("name")
		}
		if rt.Changed("desc") {
			params["desc"] = rt.Str("desc")
		}
		if rt.Changed("icon-media-id") {
			params["iconMediaId"] = rt.Str("icon-media-id")
		}
		if previewed, err := devAppWritePreview(rt, "update_dev_app", params); previewed || err != nil {
			return err
		}
		if _, err := callDevAppWrite(rt, "update_dev_app", params); err != nil {
			return err
		}
		_, resource, err := readDevAppObject(rt, "get_dev_app", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
		if err != nil {
			return err
		}
		for flag, keys := range map[string][]string{
			"name": {"name", "appName"}, "desc": {"desc", "description"}, "icon-media-id": {"iconMediaId", "icon"},
		} {
			if rt.Changed(flag) {
				if err := requireDevAppStringField(resource, "devapp/get_dev_app", rt.Str(flag), keys...); err != nil {
					return err
				}
			}
		}
		return rt.Output(verifiedDevAppMutation("update", appID, resource))
	},
}

var VersionCheckApproval = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+version-check-approval",
	Product:     productDevApp,
	Description: "预检版本发布是否需要审批（不实际发布）",
	Intent:      "当你在正式发布某版本前想先确认它是否会触发审批、是否含高敏权限等发布前置要求时使用；传入 unifiedAppId 和 versionId，仅做预检返回审批要求，不会真正发布。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_version_check_approval",
			CanonicalPath:  "devapp.shortcut_version_check_approval",
			CLIPath:        "devapp +version-check-approval",
			PrimaryCLIPath: "devapp +version-check-approval",
		},
		Description: "预检版本发布是否需要审批（不实际发布）",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "预检版本发布是否需要审批（不实际发布）",
			UseWhen:      []string{"当你在正式发布某版本前想先确认它是否会触发审批、是否含高敏权限等发布前置要求时使用；传入 unifiedAppId 和 versionId，仅做预检返回审批要求，不会真正发布。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +version-check-approval --unified-app-id <UNIFIED_APP_ID> --version-id <VERSION_ID>"},
		},
		Result: devAppObjectResult(
			contract.ResultOutcomeSuccess,
			contract.ResultOutcomePending,
			contract.ResultOutcomeFailure,
		),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "version-id", Type: shortcut.FlagString, Desc: "版本 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		versionID := rt.Str("version-id")
		params := map[string]any{
			"unifiedAppId": appID,
			"versionId":    versionID,
			"precheckOnly": true,
		}
		return outputDevAppObject(rt, "publish_dev_app_version", params, map[string]string{
			"unifiedAppId": appID, "versionId": versionID,
		})
	},
}

var VersionCreate = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+version-create",
	Product:     productDevApp,
	Description: "基于当前配置创建应用新版本",
	Intent:      "当你改完应用配置、准备走发布流程前需要先打一个版本快照时使用；传入 unifiedAppId（可选显式版本号与描述，默认服务端自动递增），会实际创建一个新版本并返回 versionId 供后续预检和发布。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "non_idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID: "devapp", Name: "shortcut_version_create",
			CanonicalPath: "devapp.shortcut_version_create", CLIPath: "devapp +version-create", PrimaryCLIPath: "devapp +version-create",
		},
		Description: "创建不可变版本快照并按应用与版本双 ID 精确读回",
		Interface:   &contract.InterfaceSpec{Mode: "composite", Availability: "available", Reason: "Reviewed adapter requires terminal success and a non-empty versionId, then reads get_dev_app_version_detail with the same unifiedAppId/versionId and compares supplied version metadata before verified output."},
		Selection: contract.SelectionSpec{
			AgentSummary: "基于当前配置创建应用新版本",
			UseWhen:      []string{"当你改完应用配置、准备走发布流程前需要先打一个版本快照时使用；传入 unifiedAppId（可选显式版本号与描述，默认服务端自动递增），会实际创建一个新版本并返回 versionId 供后续预检和发布。"},
			AvoidWhen:    []string{"只需查看历史版本使用 +version-list；正式发布使用前先运行 +version-check-approval，发布能力当前仍不可用"},
			Examples:     []string{"dws devapp +version-create --unified-app-id <UNIFIED_APP_ID> --desc <DESCRIPTION>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "version", Type: shortcut.FlagString, Desc: "高级可选：显式版本号，如 1.0.1；默认由服务端自动递增"},
		{Name: "desc", Type: shortcut.FlagString, Desc: "版本描述"},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		params := map[string]any{"unifiedAppId": appID}
		if rt.Changed("version") {
			params["version"] = rt.Str("version")
		}
		if rt.Changed("desc") {
			params["desc"] = rt.Str("desc")
		}
		if previewed, err := devAppWritePreview(rt, "create_dev_app_version", params); previewed || err != nil {
			return err
		}
		created, err := callDevAppWrite(rt, "create_dev_app_version", params)
		if err != nil {
			return err
		}
		createdObject, err := requireDevAppObject(created, "devapp/create_dev_app_version")
		if err != nil {
			return err
		}
		versionID := devAppFirstString(createdObject, "versionId", "version_id", "id")
		if versionID == "" {
			return devAppResponseError("devapp/create_dev_app_version", "missing_version_id", "创建版本回执缺少稳定 versionId")
		}
		_, resource, err := readDevAppObject(rt, "get_dev_app_version_detail", map[string]any{
			"unifiedAppId": appID,
			"versionId":    versionID,
		}, map[string]string{"unifiedAppId": appID, "versionId": versionID})
		if err != nil {
			return err
		}
		if rt.Changed("version") {
			if err := requireDevAppStringField(resource, "devapp/get_dev_app_version_detail", rt.Str("version"), "version", "versionName"); err != nil {
				return err
			}
		}
		if rt.Changed("desc") {
			if err := requireDevAppStringField(resource, "devapp/get_dev_app_version_detail", rt.Str("desc"), "desc", "description", "remark"); err != nil {
				return err
			}
		}
		return rt.Output(verifiedDevAppMutation("version_create", appID, resource))
	},
}

var VersionGet = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+version-get",
	Product:     productDevApp,
	Description: "查询指定版本详情",
	Intent:      "当你已知某个 versionId、要查看该版本的具体内容（版本号、描述、包含的配置等）以核对发布内容时使用；输入 unifiedAppId 和 versionId，返回单个版本的详情。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_version_get",
			CanonicalPath:  "devapp.shortcut_version_get",
			CLIPath:        "devapp +version-get",
			PrimaryCLIPath: "devapp +version-get",
		},
		Description: "查询指定版本详情",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询指定版本详情",
			UseWhen:      []string{"当你已知某个 versionId、要查看该版本的具体内容（版本号、描述、包含的配置等）以核对发布内容时使用；输入 unifiedAppId 和 versionId，返回单个版本的详情。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +version-get --unified-app-id <UNIFIED_APP_ID> --version-id <VERSION_ID>"},
		},
		Result: devAppObjectResult(
			contract.ResultOutcomeSuccess,
			contract.ResultOutcomeFailure,
		),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "version-id", Type: shortcut.FlagString, Desc: "版本 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		versionID := rt.Str("version-id")
		params := map[string]any{
			"unifiedAppId": appID,
			"versionId":    versionID,
		}
		return outputDevAppObject(rt, "get_dev_app_version_detail", params, map[string]string{
			"unifiedAppId": appID, "versionId": versionID,
		})
	},
}

var VersionList = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+version-list",
	Product:     productDevApp,
	Description: "分页查询应用版本列表",
	Intent:      "当你要查看某应用的历史版本（找某个 versionId、看各版本发布状态或回顾迭代记录）时使用；输入 unifiedAppId 并分页，返回版本列表。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_version_list",
			CanonicalPath:  "devapp.shortcut_version_list",
			CLIPath:        "devapp +version-list",
			PrimaryCLIPath: "devapp +version-list",
		},
		Description: "分页查询应用版本列表",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "分页查询应用版本列表",
			UseWhen:      []string{"当你要查看某应用的历史版本（找某个 versionId、看各版本发布状态或回顾迭代记录）时使用；输入 unifiedAppId 并分页，返回版本列表。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +version-list --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result:     devAppPaginatedProjectionResult("versions", "当前页开放平台应用版本查询结果"),
		Pagination: devAppCursorPagination(),
	},
	Flags: append([]shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	}, cursorFlags...),
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{"unifiedAppId": rt.Str("unified-app-id")}
		applyCursor(rt, params)
		data, err := rt.CallMCPData(productDevApp, "list_dev_app_versions", params)
		if err != nil {
			return err
		}
		versions, err := versionListProject(data)
		if err != nil {
			return err
		}
		projection, err := devAppListProjection(data, "versions", versions, "devapp/list_dev_app_versions")
		if err != nil {
			return err
		}
		return rt.Output(projection)
	},
}

var VersionPublish = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+version-publish",
	Product:     productDevApp,
	Description: "发布指定版本（含高敏权限需 --confirmed-sensitive）",
	Intent:      "当你要把某个已创建的版本正式上线到线上环境时使用；传入 unifiedAppId 和 versionId，会实际触发发布（含高敏权限需加 --confirmed-sensitive 确认，灰度选人可指定审批人），可能进入审批流。",
	Risk:        shortcut.RiskWrite,
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "version-id", Type: shortcut.FlagString, Desc: "版本 ID", Required: true},
		{Name: "confirmed-sensitive", Type: shortcut.FlagBool, Desc: "确认发布包含高敏权限的版本"},
		{Name: "approver-user-id", Type: shortcut.FlagString, Desc: "灰度选人模式下指定审批人 userId"},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		params := map[string]any{
			"unifiedAppId": rt.Str("unified-app-id"),
			"versionId":    rt.Str("version-id"),
			"precheckOnly": false,
		}
		if rt.Changed("confirmed-sensitive") {
			params["confirmedSensitive"] = rt.Bool("confirmed-sensitive")
		}
		if rt.Changed("approver-user-id") {
			params["approverUserId"] = rt.Str("approver-user-id")
		}
		return rt.CallMCP("publish_dev_app_version", params)
	},
}

var VersionStatus = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+version-status",
	Product:     productDevApp,
	Description: "查询版本发布/审批状态",
	Intent:      "当你已提交发布、想跟进某版本当前处于什么阶段（审批中、已发布、被驳回等）时使用；输入 unifiedAppId 和 versionId，返回该版本的发布/审批状态。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_version_status",
			CanonicalPath:  "devapp.shortcut_version_status",
			CLIPath:        "devapp +version-status",
			PrimaryCLIPath: "devapp +version-status",
		},
		Description: "查询版本发布/审批状态",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询版本发布/审批状态",
			UseWhen:      []string{"当你已提交发布、想跟进某版本当前处于什么阶段（审批中、已发布、被驳回等）时使用；输入 unifiedAppId 和 versionId，返回该版本的发布/审批状态。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +version-status --unified-app-id <UNIFIED_APP_ID> --version-id <VERSION_ID>"},
		},
		Result: devAppObjectResult(
			contract.ResultOutcomeSuccess,
			contract.ResultOutcomePending,
			contract.ResultOutcomeFailure,
		),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "version-id", Type: shortcut.FlagString, Desc: "版本 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		versionID := rt.Str("version-id")
		params := map[string]any{
			"unifiedAppId": appID,
			"versionId":    versionID,
		}
		return outputDevAppObject(rt, "get_dev_app_version_status", params, map[string]string{
			"unifiedAppId": appID, "versionId": versionID,
		})
	},
}

var WebappConfig = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+webapp-config",
	Product:     productDevApp,
	Description: "配置网页应用能力",
	Intent:      "当你要为应用开通或调整网页（H5）入口，如设置移动端/PC 端首页 URL、管理后台地址或页面类型时使用；指定 unifiedAppId 及相应地址，会实际写入该应用的网页应用配置。",
	Risk:        shortcut.RiskWrite,
	Safety: contract.SafetySpec{
		Effect: "write", Risk: "medium",
		Confirmation: "user_required", Idempotency: "unknown",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_webapp_config",
			CanonicalPath:  "devapp.shortcut_webapp_config",
			CLIPath:        "devapp +webapp-config",
			PrimaryCLIPath: "devapp +webapp-config",
		},
		Description: "配置网页应用能力",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "配置网页应用能力",
			UseWhen:      []string{"当你要为应用开通或调整网页（H5）入口，如设置移动端/PC 端首页 URL、管理后台地址或页面类型时使用；指定 unifiedAppId 及相应地址，会实际写入该应用的网页应用配置。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +webapp-config --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppVerifiedMutationResult(),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
		{Name: "h5-page-type", Type: shortcut.FlagString, Desc: "网页应用生效端/页面类型；至少提供一项非空的网页应用配置"},
		{Name: "homepage-url", Type: shortcut.FlagString, Desc: "移动端首页地址；至少提供一项非空的网页应用配置"},
		{Name: "pc-homepage-url", Type: shortcut.FlagString, Desc: "PC 端首页地址；至少提供一项非空的网页应用配置"},
		{Name: "omp-url", Type: shortcut.FlagString, Desc: "管理后台地址；至少提供一项非空的网页应用配置"},
	},
	Constraints: []shortcut.Constraint{{
		Kind:        shortcut.ConstraintCustom,
		Flags:       []string{"h5-page-type", "homepage-url", "pc-homepage-url", "omp-url"},
		Description: "至少提供一项非空的网页应用配置",
	}},
	Validate: func(rt *shortcut.RuntimeContext) error {
		for _, name := range []string{"h5-page-type", "homepage-url", "pc-homepage-url", "omp-url"} {
			if rt.Changed(name) && rt.Str(name) != "" {
				return nil
			}
		}
		return apperrors.NewValidation("至少提供一项网页应用配置：--h5-page-type、--homepage-url、--pc-homepage-url 或 --omp-url")
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		params := map[string]any{"unifiedAppId": appID}
		if rt.Changed("h5-page-type") {
			params["h5PageType"] = rt.Str("h5-page-type")
		}
		if rt.Changed("homepage-url") {
			params["homepageUrl"] = rt.Str("homepage-url")
		}
		if rt.Changed("pc-homepage-url") {
			params["pcHomepageUrl"] = rt.Str("pc-homepage-url")
		}
		if rt.Changed("omp-url") {
			params["ompUrl"] = rt.Str("omp-url")
		}
		if previewed, err := devAppWritePreview(rt, "set_extension_webapp_config", params); previewed || err != nil {
			return err
		}
		if _, err := callDevAppWrite(rt, "set_extension_webapp_config", params); err != nil {
			return err
		}
		_, resource, err := readDevAppObject(rt, "get_extension_webapp_config", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
		if err != nil {
			return err
		}
		for flag, keys := range map[string][]string{
			"h5-page-type": {"h5PageType"}, "homepage-url": {"homepageUrl"},
			"pc-homepage-url": {"pcHomepageUrl"}, "omp-url": {"ompUrl"},
		} {
			if rt.Changed(flag) {
				if err := requireDevAppStringField(resource, "devapp/get_extension_webapp_config", rt.Str(flag), keys...); err != nil {
					return err
				}
			}
		}
		return rt.Output(verifiedDevAppMutation("webapp_config", appID, resource))
	},
}

var WebappGet = shortcut.Shortcut{
	Service:     "devapp",
	Command:     "+webapp-get",
	Product:     productDevApp,
	Description: "查询网页应用配置",
	Intent:      "当你要查看某应用的网页（H5）能力现状，如移动端/PC 首页地址、管理后台地址等，以便核对或作为改配置前的参考时使用；输入 unifiedAppId，返回当前网页应用配置。",
	Risk:        shortcut.RiskRead,
	Safety: contract.SafetySpec{
		Effect: "read", Risk: "low",
		Confirmation: "not_required", Idempotency: "idempotent",
	},
	Contract: corecmd.ContractDecl{
		Identity: contract.ToolIdentitySpec{
			ProductID:      "devapp",
			Name:           "shortcut_webapp_get",
			CanonicalPath:  "devapp.shortcut_webapp_get",
			CLIPath:        "devapp +webapp-get",
			PrimaryCLIPath: "devapp +webapp-get",
		},
		Description: "查询网页应用配置",
		Interface: &contract.InterfaceSpec{
			Mode:         "composite",
			Availability: "available",
			Reason:       "Reviewed built-in shortcut adapter: the executable CLI owns validation, optional multi-step orchestration, output projection, and confirmation; the complete command contract is not represented by one pinned MCP interface_ref.",
		},
		Selection: contract.SelectionSpec{
			AgentSummary: "查询网页应用配置",
			UseWhen:      []string{"当你要查看某应用的网页（H5）能力现状，如移动端/PC 首页地址、管理后台地址等，以便核对或作为改配置前的参考时使用；输入 unifiedAppId，返回当前网页应用配置。"},
			AvoidWhen:    []string{"需要该 Shortcut 未公开的底层参数、原始响应或不同执行语义时，改用对应原子命令"},
			Examples:     []string{"dws devapp +webapp-get --unified-app-id <UNIFIED_APP_ID>"},
		},
		Result: devAppObjectResult(
			contract.ResultOutcomeSuccess,
			contract.ResultOutcomeFailure,
		),
	},
	Flags: []shortcut.Flag{
		{Name: "unified-app-id", Type: shortcut.FlagString, Desc: "开放平台统一应用 ID", Required: true},
	},
	Execute: func(rt *shortcut.RuntimeContext) error {
		appID := rt.Str("unified-app-id")
		return outputDevAppObject(rt, "get_extension_webapp_config", map[string]any{"unifiedAppId": appID}, map[string]string{"unifiedAppId": appID})
	},
}