feat: 更新 flag

skip-hidden defaults to false (lossless reads), but the read primitives don't mark which rows/cols are hidden. Cross-reference +sheet-info --include hidden_rows,hidden_cols + row_indices/col_indices so agents can identify hidden ranges when they need to filter or interpret hidden data.

Synced from sheet-skill-spec.

.github/CODEOWNERS

@@ -0,0 +1,30 @@
+/internal/ @liangshuo-1
+
+# Last match wins: existing domains below are exempt, only new skills/ entries need review.
+/skills/ @liangshuo-1
+/skills/lark-approval/
+/skills/lark-apps/
+/skills/lark-attendance/
+/skills/lark-base/
+/skills/lark-calendar/
+/skills/lark-contact/
+/skills/lark-doc/
+/skills/lark-drive/
+/skills/lark-event/
+/skills/lark-im/
+/skills/lark-mail/
+/skills/lark-markdown/
+/skills/lark-minutes/
+/skills/lark-okr/
+/skills/lark-openapi-explorer/
+/skills/lark-shared/
+/skills/lark-sheets/
+/skills/lark-skill-maker/
+/skills/lark-slides/
+/skills/lark-task/
+/skills/lark-vc/
+/skills/lark-vc-agent/
+/skills/lark-whiteboard/
+/skills/lark-wiki/
+/skills/lark-workflow-meeting-summary/
+/skills/lark-workflow-standup-report/

.gitignore

@@ -35,6 +35,8 @@ tests/mail/reports/
 # Generated / test artifacts
 .hammer/
 .lark-slides/
+/notes/
+/minutes/
 internal/registry/meta_data.json
 cmd/api/download.bin
 app.log

.golangci.yml

@@ -73,20 +73,20 @@ linters:
           - forbidigo
       # errs-typed-only enforced on paths already migrated to errs.NewXxxError.
       # Add a path when its migration is complete.
-      - path-except: (internal/auth/|internal/errcompat/|internal/errclass/|internal/client/|internal/cmdutil/factory\.go|cmd/auth/|cmd/config/|cmd/service/|shortcuts/common/mcp_client\.go|shortcuts/calendar/helpers\.go|shortcuts/drive/|shortcuts/mail/)
+      - path-except: (internal/auth/|internal/errcompat/|internal/errclass/|internal/client/|internal/cmdutil/factory\.go|cmd/auth/|cmd/config/|cmd/service/|shortcuts/common/mcp_client\.go|shortcuts/apps/|shortcuts/base/|shortcuts/calendar/|shortcuts/contact/|shortcuts/doc/|shortcuts/drive/|shortcuts/im/|shortcuts/mail/|shortcuts/markdown/|shortcuts/minutes/|shortcuts/okr/|shortcuts/sheets/|shortcuts/slides/|shortcuts/task/|shortcuts/vc/|shortcuts/whiteboard/|shortcuts/wiki/|internal/event/consume/|cmd/event/|events/|shortcuts/event/)
         text: errs-typed-only
         linters:
           - forbidigo
       # errs-no-bare-wrap enforced on paths fully migrated to typed final
       # errors. Scoped separately from errs-typed-only because cmd/auth/,
       # cmd/config/ still have residual fmt.Errorf and must not be caught.
-      - path-except: (shortcuts/drive/|shortcuts/mail/|shortcuts/calendar/helpers\.go|shortcuts/common/mcp_client\.go)
+      - path-except: (shortcuts/apps/|shortcuts/base/|shortcuts/calendar/|shortcuts/contact/|shortcuts/doc/|shortcuts/drive/|shortcuts/im/|shortcuts/mail/|shortcuts/markdown/|shortcuts/minutes/|shortcuts/okr/|shortcuts/sheets/|shortcuts/slides/|shortcuts/task/|shortcuts/vc/|shortcuts/whiteboard/|shortcuts/wiki/|shortcuts/common/mcp_client\.go|cmd/event/|events/|shortcuts/event/)
         text: errs-no-bare-wrap
         linters:
           - forbidigo
-      # errs-no-legacy-helper is scoped to migrated domains: the shared helpers
-      # it bans are still used by other domains until their later migration phase.
-      - path-except: (shortcuts/drive/|shortcuts/mail/)
+      # errs-no-legacy-helper enforced on domains whose shared validation/save
+      # helpers have migrated to typed final errors.
+      - path-except: (shortcuts/apps/|shortcuts/base/|shortcuts/calendar/|shortcuts/contact/|shortcuts/doc/|shortcuts/drive/|shortcuts/im/|shortcuts/mail/|shortcuts/markdown/|shortcuts/minutes/|shortcuts/okr/|shortcuts/sheets/|shortcuts/slides/|shortcuts/task/|shortcuts/vc/|shortcuts/whiteboard/|shortcuts/wiki/|cmd/event/|events/|shortcuts/event/)
         text: errs-no-legacy-helper
         linters:
           - forbidigo
@@ -116,16 +116,14 @@ linters:
             [errs-typed-only] use errs.NewXxxError(...) builder
             (see errs/types.go).
         # ── legacy shared error helpers banned on migrated domains ──
-        # These helpers internally produce legacy output.Err* shapes, so they
-        # are invisible to the errs-typed-only ban above. Migrated domains use
-        # typed errs.* builders or domain-local file-I/O helpers instead; this
-        # prevents reintroduction while unmigrated domains continue to use the
-        # shared helpers until their later migration phase.
-        - pattern: (common\.FlagErrorf|common\.WrapInputStatError|common\.WrapSaveErrorByCategory)\b
+        # These helpers emit legacy output.Err* / bare error shapes or drop
+        # typed metadata such as Param/Cause. Migrated domains must use typed
+        # common replacements or local typed helpers instead.
+        - pattern: (common\.FlagErrorf|common\.RejectDangerousChars|common\.WrapInputStatError|common\.WrapSaveErrorByCategory)\b
           msg: >-
-            [errs-no-legacy-helper] these shared helpers emit legacy output.Err*
-            shapes. Use typed errs.NewXxxError builders or a domain-local
-            file-I/O helper.
+            [errs-no-legacy-helper] these shared helpers emit legacy or
+            metadata-poor error shapes. Use typed common replacements, typed
+            errs.NewXxxError builders, or domain-local typed helpers.
         # ── bare error wraps banned on fully-typed paths ──
         - pattern: (fmt\.Errorf|errors\.New)\b
           msg: >-

.goreleaser.yml

@@ -17,6 +17,7 @@ builds:
     goarch:
       - amd64
       - arm64
+      - riscv64
 
 archives:
   - name_template: "lark-cli-{{ .Version }}-{{ .Os }}-{{ .Arch }}"

AGENTS.md

@@ -11,7 +11,7 @@
 
 ```bash
 make build          # Build (runs fetch_meta first)
-make unit-test      # Required before PR (runs with -race)
+make unit-test      # Required before PR (runs with -race where supported, e.g. amd64/arm64)
 make test           # Full: vet + unit + integration
 ```
 
@@ -75,7 +75,31 @@ The one rule to internalize: **every error message you write will be parsed by a
 
 ### Structured errors in commands
 
-`RunE` functions must return `output.Errorf` / `output.ErrWithHint` — never bare `fmt.Errorf`. AI agents parse stderr as JSON; bare errors break this contract.
+Command-facing failures must be typed `errs.*` errors — never the legacy `output.Err*` helpers and never a final bare `fmt.Errorf`. AI agents parse the stderr envelope's `type` / `subtype` / `param` / `hint` fields to decide their next action; the full taxonomy lives in `errs/ERROR_CONTRACT.md`.
+
+Picking a constructor:
+
+| Failure | Constructor |
+|---------|-------------|
+| User flag/arg fails validation | `errs.NewValidationError(errs.SubtypeInvalidArgument, ...).WithParam("--flag")` |
+| Valid request, wrong system state | `errs.NewValidationError(errs.SubtypeFailedPrecondition, ...).WithHint(...)` |
+| Lark API returned `code != 0` | `runtime.CallAPITyped` (shortcuts) / `errclass.BuildAPIError` (raw responses) — never hand-build |
+| Network / transport failure | `errs.NewNetworkError(errs.SubtypeNetworkTransport, ...)` |
+| Local file I/O failure | `errs.NewInternalError(errs.SubtypeFileIO, ...)` — validate the path first (`validate.SafeInputPath` / `SafeOutputPath`) and use `vfs.*` |
+| Unclassified lower-layer error as final | `errs.NewInternalError(errs.SubtypeUnknown, ...).WithCause(err)` |
+| Lower layer already returned a typed error | pass it through unchanged — re-wrapping downgrades its classification |
+
+Signatures that are easy to guess wrong:
+
+- `runtime.CallAPITyped(method, url string, params map[string]interface{}, data interface{}) (map[string]interface{}, error)` — it performs the HTTP request itself and classifies `code != 0` into a typed error; just return the error it gives you.
+- Typed pass-through check: `if _, ok := errs.ProblemOf(err); ok { return err }` — `ProblemOf` returns `(*errs.Problem, bool)`, not a nilable pointer.
+- `.WithParam` exists only on `*errs.ValidationError`. `InternalError` / `NetworkError` have no param field — file or endpoint context goes in the message or `.WithHint(...)`.
+
+`forbidigo` + `lint/errscontract` reject the legacy `output.Err*` helpers, bare final `fmt.Errorf` / `errors.New`, and legacy envelope literals on migrated paths. Beyond what lint catches, three authoring conventions apply:
+
+- Preserve the underlying error with `.WithCause(err)` so `errors.Is` / `errors.Unwrap` keep working.
+- `param` names only the user input that actually failed. Recovery guidance goes in `.WithHint(...)`; machine-readable recovery fields (`missing_scopes`, `log_id`) carry server/system ground truth only — never caller-side guesses.
+- Error-path tests assert typed metadata via `errs.ProblemOf` (`category` / `subtype` / `param`) and cause preservation, not message substrings alone.
 
 ### stdout is data, stderr is everything else
 

CHANGELOG.md

@@ -2,6 +2,129 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v1.0.53] - 2026-06-12
+
+### Features
+
+- **auth**: Revoke user tokens server-side on `auth logout` (#1434)
+- **auth**: Add `--json` flag support to auth subcommands (#1431)
+- **token**: Mint TAT via unified OAuth v3 Token Endpoint (#1408)
+- **note**: Split note into a dedicated domain with `+detail` and `+transcript` flows (#1345, #1417, #1435)
+- **im**: Unify sort flags into `--sort` field and `--order` direction (#1302)
+
+### Bug Fixes
+
+- **apps**: Read release error_logs from `data.error_logs` in `+release-get` (#1436)
+
+### Documentation
+
+- **skills**: Optimize whiteboard skill (#1371)
+- **skills**: Optimize okr skill (#1368)
+
+## [v1.0.52] - 2026-06-11
+
+### Features
+
+- **events**: Per-resource subscription identity + Match hook (#1185)
+- **apps**: Emit typed error envelopes across the apps domain (#1288)
+- **wiki**: Emit typed error envelopes across the wiki domain (#1350)
+- **im**: Add `--chat-modes` filter to chat search (#1317)
+- **apps**: Exclude `.git` directory from `+html-publish` package (#1396)
+- **build**: Support riscv64 prebuilt binaries in release and install pipeline
+
+### Bug Fixes
+
+- **apps**: Support git credential dry-run (#1390)
+- **whiteboard**: Fix parsing empty whiteboard content (#1391)
+- **build**: Make `-race` flag arch-conditional to support riscv64
+
+### Documentation
+
+- **im**: Document `chat.user_setting` batch_query/batch_update (#1339)
+- **im**: Document `chat.managers` and `chat.moderation` API resources (#1294)
+- **skills**: Optimize lark-drive skill routing (#1284)
+- **skills**: Expand cite user guidance and fix typos (#1394)
+
+## [v1.0.51] - 2026-06-10
+
+### Features
+
+- **apps**: Support multi dev modes (#1175)
+- **im**: Complete audio/post rendering and add opt-in `--download-resources` (#1245)
+- **base**: Configure initial base table schema (#1377)
+- **vc**: Add recording event support (#1369)
+- **minutes**: Replace words for transcript (#1372)
+- **markdown**: Emit typed error envelopes across the markdown domain (#1347)
+- **sheets**: Emit typed error envelopes across the sheets domain (#1348)
+- **slides**: Emit typed error envelopes across the slides domain (#1349)
+
+### Documentation
+
+- **skills**: Warn about `@file` absolute path restriction in lark-doc skills (#1375)
+- **skills**: Remove unsupported ⚠️ from callout emoji list (#1374)
+
+## [v1.0.50] - 2026-06-09
+
+### Features
+
+- **doc**: Emit typed error envelopes across the doc domain (#1346)
+- **event**: Emit typed error envelopes across the event domain (#1289)
+- **contact**: Emit typed error envelopes across the contact domain (#1287)
+- **sheets**: Guard `+csv-put --csv` against a path passed without `@` (#1337)
+- **cli**: Adjust agent timeout hint output conditions (#1328)
+
+### Bug Fixes
+
+- **drive**: Add `@file`/stdin support to `+add-comment --content` (#1343)
+- **slides**: Build create URL locally instead of drive metas call (#1329)
+- **cli**: Clarify `--block-id` supports comma-separated batch delete in help text (#1336)
+
+### Documentation
+
+- **doc**: Replace append with `block_insert_after` in skeleton workflow guidance (#1340)
+- **doc**: Document `<folder-manager>` resource block (#1168)
+- **drive**: Add drive comment location guidance (#1258)
+
+## [v1.0.49] - 2026-06-08
+
+### Features
+
+- **events**: Add whiteboard event domain with per-board subscription (#1265)
+- **im**: Support feed group (#1102)
+- **im**: Add feed shortcut create, list, and remove shortcuts (#1273)
+- **im**: Format feed group error handling (#1308)
+- **im**: Return typed error envelopes across the im domain (#1230)
+- **base**: Emit typed error envelopes across the base domain (#1248)
+- **calendar**: Emit typed error envelopes across the calendar domain (#1232)
+- **task**: Emit typed error envelopes across the task domain (#1231)
+- **okr,whiteboard**: Emit typed error envelopes across both domains (#1236)
+- **minutes,vc**: Emit typed error envelopes across both domains (#1234)
+- **markdown**: Harden create upload failures (#1325)
+- **drive**: Harden inspect shortcut failures (#1324)
+- **slides**: Add IconPark lookup for Lark slides (#1123)
+- **doc**: Remove docs v1 API (#1291)
+- **cli**: Add `skills` command to read embedded skill content (#1318)
+- **cli**: Fetch official skills index (#1301)
+- **shared**: Document relative-path-only file arguments (#1319)
+- **scopes**: Clear `recommend.allow` scope auto-approve overrides (#1272)
+- **shortcuts**: Check shortcut example commands against the live CLI tree (#1244)
+
+### Bug Fixes
+
+- **events**: Keep bounded event consume runs alive after stdin EOF (#1285)
+- **drive**: Use docs secure label read scope (#1281)
+
+### Documentation
+
+- **approval**: Restructure skill with intent table and scope boundaries (#1307)
+- **skills**: Tighten drive and markdown guardrails (#1326)
+- **skills**: Optimize calendar, vc, and minutes skill guidance (#1269)
+- **markdown**: Add markdown domain template (#1293)
+- **markdown**: Improve lark-markdown skill guidance (#1279)
+- **doc**: Improve lark-doc skill guidance (#1283)
+- **wiki**: Optimize skill guidance and routing boundaries (#1275)
+- **slides**: Tighten routing/boundary and reconcile in-slide whiteboard (#1169)
+
 ## [v1.0.48] - 2026-06-04
 
 ### Features
@@ -1026,6 +1149,11 @@ Bundled AI agent skills for intelligent assistance:
 - Bilingual documentation (English & Chinese).
 - CI/CD pipelines: linting, testing, coverage reporting, and automated releases.
 
+[v1.0.53]: https://github.com/larksuite/cli/releases/tag/v1.0.53
+[v1.0.52]: https://github.com/larksuite/cli/releases/tag/v1.0.52
+[v1.0.51]: https://github.com/larksuite/cli/releases/tag/v1.0.51
+[v1.0.50]: https://github.com/larksuite/cli/releases/tag/v1.0.50
+[v1.0.49]: https://github.com/larksuite/cli/releases/tag/v1.0.49
 [v1.0.48]: https://github.com/larksuite/cli/releases/tag/v1.0.48
 [v1.0.47]: https://github.com/larksuite/cli/releases/tag/v1.0.47
 [v1.0.46]: https://github.com/larksuite/cli/releases/tag/v1.0.46

Makefile

@@ -8,6 +8,13 @@ DATE     := $(shell date +%Y-%m-%d)
 LDFLAGS  := -s -w -X $(MODULE)/internal/build.Version=$(VERSION) -X $(MODULE)/internal/build.Date=$(DATE)
 PREFIX   ?= /usr/local
 
+# The repository's Go 1.23 CI toolchain does not support -race on riscv64.
+# Prefer GOARCH passed to make (for example, `make GOARCH=riscv64 unit-test`)
+# over `go env GOARCH`, because command-line make variables are not visible to
+# $(shell ...).
+TEST_GOARCH := $(or $(GOARCH),$(shell go env GOARCH))
+RACE_FLAG := $(if $(filter riscv64,$(TEST_GOARCH)),,-race)
+
 .PHONY: all build vet fmt-check test unit-test integration-test examples-build install uninstall clean fetch_meta gitleaks
 
 all: test
@@ -34,7 +41,7 @@ fmt-check:
 
 # ./extension/... keeps the public plugin SDK in the default test matrix.
 unit-test: fetch_meta
-	go test -race -gcflags="all=-N -l" -count=1 \
+	go test $(RACE_FLAG) -gcflags="all=-N -l" -count=1 \
 		./cmd/... ./internal/... ./shortcuts/... ./extension/...
 
 # examples-build keeps the shipped plugin-SDK examples compilable. If this

README.md

@@ -41,7 +41,7 @@ The official [Lark/Feishu](https://www.larksuite.com/) CLI tool, maintained by t
 | ✍️ Approval   | Query approval tasks, approve/reject/transfer tasks, cancel and CC instances                                                      |
 | 🎯 OKR        | Query, create, update OKRs; manage objective & key results, alignments, indicators and progress.                                  |
 | 📋 Project    | Meegle — manage work items, schedules, and data via the standalone [meegle-cli](https://github.com/larksuite/meegle-cli) (install separately) |
-| 🔗 Apps       | Develop, deploy HTML, web pages and applications                                                                                  |
+| 🔗 Apps       | Create Spark/Miaoda apps, publish HTML/static sites, run cloud generation, and manage access scope                                 |
 
 ## Installation & Quick Start
 

README.zh.md

@@ -41,7 +41,7 @@
 | ✍️ 审批     | 查询审批任务、同意/拒绝/转交审批任务、撤回与抄送审批实例              |
 | 🎯 OKR  | 查询、创建、更新 OKR，管理目标、关键结果、对齐、指标和进展记录        |
 | 📋 飞书项目 | 管理工作项、排期与数据 — 由独立的 [meegle-cli](https://github.com/larksuite/meegle-cli) 提供（需单独安装） |
-| 🔗 应用     | 开发、部署 HTML、Web 页面和应用                                                                                                          |
+| 🔗 应用     | 创建妙搭（Spark/Miaoda）应用、发布 HTML/静态站点、云端生成迭代、管理可用范围                                                                                                   |
 
 ## 安装与快速开始
 

cmd/api/api_test.go

@@ -66,6 +66,24 @@ func TestApiCmd_DryRun(t *testing.T) {
 	}
 }
 
+// Regression: --params null parses to a nil map; writing page_size onto it must
+// not panic. Symmetric to the typed-flag overlay path in cmd/service — both
+// write into the map ParseJSONMap returns.
+func TestApiCmd_NullParamsWithPageSize(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+	})
+
+	cmd := NewCmdApi(f, nil)
+	cmd.SetArgs([]string{"GET", "/open-apis/test", "--params", "null", "--page-size", "50", "--as", "bot", "--dry-run"})
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("--params null with --page-size should not error, got: %v", err)
+	}
+	if out := stdout.String(); !strings.Contains(out, "page_size") {
+		t.Errorf("expected page_size applied over null --params, got:\n%s", out)
+	}
+}
+
 func TestApiCmd_BotMode(t *testing.T) {
 	f, stdout, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,

cmd/auth/auth_test.go

@@ -91,6 +91,29 @@ func TestAuthCheckCmd_FlagParsing(t *testing.T) {
 	}
 }
 
+func TestAuthCheckCmd_AcceptsJSONFlag(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+	})
+
+	var gotOpts *CheckOptions
+	cmd := NewCmdAuthCheck(f, func(opts *CheckOptions) error {
+		gotOpts = opts
+		return nil
+	})
+	cmd.SetArgs([]string{"--scope", "calendar:calendar:read", "--json"})
+	err := cmd.Execute()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotOpts == nil {
+		t.Fatal("expected opts to be set")
+	}
+	if !gotOpts.JSON {
+		t.Error("expected JSON=true")
+	}
+}
+
 func TestAuthLogoutCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, nil)
 
@@ -109,6 +132,27 @@ func TestAuthLogoutCmd_FlagParsing(t *testing.T) {
 	}
 }
 
+func TestAuthLogoutCmd_AcceptsJSONFlag(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+
+	var gotOpts *LogoutOptions
+	cmd := NewCmdAuthLogout(f, func(opts *LogoutOptions) error {
+		gotOpts = opts
+		return nil
+	})
+	cmd.SetArgs([]string{"--json"})
+	err := cmd.Execute()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotOpts == nil {
+		t.Fatal("expected opts to be set")
+	}
+	if !gotOpts.JSON {
+		t.Error("expected JSON=true")
+	}
+}
+
 func TestAuthListCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, nil)
 
@@ -126,6 +170,27 @@ func TestAuthListCmd_FlagParsing(t *testing.T) {
 	}
 }
 
+func TestAuthListCmd_AcceptsJSONFlag(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, nil)
+
+	var gotOpts *ListOptions
+	cmd := NewCmdAuthList(f, func(opts *ListOptions) error {
+		gotOpts = opts
+		return nil
+	})
+	cmd.SetArgs([]string{"--json"})
+	err := cmd.Execute()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotOpts == nil {
+		t.Error("expected opts to be set")
+	}
+	if !gotOpts.JSON {
+		t.Error("expected JSON=true")
+	}
+}
+
 func TestAuthStatusCmd_FlagParsing(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
@@ -145,6 +210,29 @@ func TestAuthStatusCmd_FlagParsing(t *testing.T) {
 	}
 }
 
+func TestAuthStatusCmd_AcceptsJSONFlag(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+	})
+
+	var gotOpts *StatusOptions
+	cmd := NewCmdAuthStatus(f, func(opts *StatusOptions) error {
+		gotOpts = opts
+		return nil
+	})
+	cmd.SetArgs([]string{"--json"})
+	err := cmd.Execute()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotOpts == nil {
+		t.Error("expected opts to be set")
+	}
+	if !gotOpts.JSON {
+		t.Error("expected JSON=true")
+	}
+}
+
 func TestAuthStatusCmd_VerifyFlag(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
@@ -267,6 +355,32 @@ func TestAuthScopesCmd_FlagParsing(t *testing.T) {
 	}
 }
 
+func TestAuthScopesCmd_JSONFlagForcesJSONFormat(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
+	})
+
+	var gotOpts *ScopesOptions
+	cmd := NewCmdAuthScopes(f, func(opts *ScopesOptions) error {
+		gotOpts = opts
+		return nil
+	})
+	cmd.SetArgs([]string{"--format", "pretty", "--json"})
+	err := cmd.Execute()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if gotOpts == nil {
+		t.Fatal("expected opts to be set")
+	}
+	if !gotOpts.JSON {
+		t.Error("expected JSON=true")
+	}
+	if gotOpts.Format != "json" {
+		t.Errorf("expected format json, got %s", gotOpts.Format)
+	}
+}
+
 func TestAuthScopesRun_UsesTenantAccessTokenFromCredentialProvider(t *testing.T) {
 	f, _, _, reg := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "", Brand: core.BrandFeishu,

cmd/auth/check.go

@@ -19,6 +19,7 @@ import (
 type CheckOptions struct {
 	Factory *cmdutil.Factory
 	Scope   string
+	JSON    bool
 }
 
 // NewCmdAuthCheck creates the auth check subcommand.
@@ -37,6 +38,7 @@ func NewCmdAuthCheck(f *cmdutil.Factory, runF func(*CheckOptions) error) *cobra.
 	}
 
 	cmd.Flags().StringVar(&opts.Scope, "scope", "", "scopes to check (space-separated)")
+	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
 	cmd.MarkFlagRequired("scope")
 	cmdutil.SetRisk(cmd, "read")
 

cmd/auth/list.go

@@ -18,6 +18,7 @@ import (
 // ListOptions holds all inputs for auth list.
 type ListOptions struct {
 	Factory *cmdutil.Factory
+	JSON    bool
 }
 
 // NewCmdAuthList creates the auth list subcommand.
@@ -34,6 +35,7 @@ func NewCmdAuthList(f *cmdutil.Factory, runF func(*ListOptions) error) *cobra.Co
 			return authListRun(opts)
 		},
 	}
+	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
 	cmdutil.SetRisk(cmd, "read")
 
 	return cmd
@@ -44,6 +46,14 @@ func authListRun(opts *ListOptions) error {
 
 	multi, _ := core.LoadMultiAppConfig()
 	if multi == nil || len(multi.Apps) == 0 {
+		if opts.JSON {
+			output.PrintJson(f.IOStreams.Out, map[string]interface{}{
+				"ok":     true,
+				"users":  []map[string]interface{}{},
+				"reason": "not_configured",
+			})
+			return nil
+		}
 		// auth list is a read-only probe; the "configured but no users"
 		// branch below already returns exit 0 with a stderr hint, so we
 		// keep the same contract here. We still want the hint to be
@@ -61,6 +71,14 @@ func authListRun(opts *ListOptions) error {
 
 	app := multi.CurrentAppConfig(f.Invocation.Profile)
 	if app == nil || len(app.Users) == 0 {
+		if opts.JSON {
+			output.PrintJson(f.IOStreams.Out, map[string]interface{}{
+				"ok":     true,
+				"users":  []map[string]interface{}{},
+				"reason": "not_logged_in",
+			})
+			return nil
+		}
 		fmt.Fprintln(f.IOStreams.ErrOut, "No logged-in users. Run `lark-cli auth login` to log in.")
 		return nil
 	}

cmd/auth/list_test.go

@@ -4,6 +4,7 @@
 package auth
 
 import (
+	"encoding/json"
 	"strings"
 	"testing"
 
@@ -34,6 +35,33 @@ func TestAuthListRun_NotConfigured_ReturnsExitZero(t *testing.T) {
 	}
 }
 
+func TestAuthListRun_JSONMode_NotConfigured_WritesStdoutOnly(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authListRun(&ListOptions{Factory: f, JSON: true}); err != nil {
+		t.Fatalf("auth list should succeed when not configured (exit 0); got: %v", err)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("stdout must be valid JSON: %v\nstdout=%s", err, stdout.String())
+	}
+	if payload["ok"] != true {
+		t.Errorf("stdout.ok = %v, want true", payload["ok"])
+	}
+	users, ok := payload["users"].([]any)
+	if !ok || len(users) != 0 {
+		t.Errorf("stdout.users = %v, want empty array", payload["users"])
+	}
+	if payload["reason"] != "not_configured" {
+		t.Errorf("stdout.reason = %v, want not_configured", payload["reason"])
+	}
+	if stderr.Len() != 0 {
+		t.Errorf("stderr must stay empty in JSON mode, got:\n%s", stderr.String())
+	}
+}
+
 // TestAuthListRun_NotConfigured_AgentWorkspace_RoutesToBindHelp covers the
 // reason this hint exists workspace-aware in the first place: an AI agent
 // in OpenClaw / Hermes that probes auth list before binding gets routed to
@@ -57,3 +85,48 @@ func TestAuthListRun_NotConfigured_AgentWorkspace_RoutesToBindHelp(t *testing.T)
 		t.Errorf("agent hint must not mention config init: %s", out)
 	}
 }
+
+func TestAuthListRun_JSONMode_NoLoggedInUsers_WritesStdoutOnly(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	writeLogoutConfig(t, nil)
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authListRun(&ListOptions{Factory: f, JSON: true}); err != nil {
+		t.Fatalf("auth list should succeed when no users exist (exit 0); got: %v", err)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("stdout must be valid JSON: %v\nstdout=%s", err, stdout.String())
+	}
+	if payload["ok"] != true {
+		t.Errorf("stdout.ok = %v, want true", payload["ok"])
+	}
+	users, ok := payload["users"].([]any)
+	if !ok || len(users) != 0 {
+		t.Errorf("stdout.users = %v, want empty array", payload["users"])
+	}
+	if payload["reason"] != "not_logged_in" {
+		t.Errorf("stdout.reason = %v, want not_logged_in", payload["reason"])
+	}
+	if stderr.Len() != 0 {
+		t.Errorf("stderr must stay empty in JSON mode, got:\n%s", stderr.String())
+	}
+}
+
+func TestAuthListRun_DefaultMode_NoLoggedInUsers_KeepsTextOutput(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	writeLogoutConfig(t, nil)
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authListRun(&ListOptions{Factory: f}); err != nil {
+		t.Fatalf("auth list should succeed when no users exist (exit 0); got: %v", err)
+	}
+
+	if stdout.Len() != 0 {
+		t.Errorf("stdout must stay empty in default mode, got:\n%s", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "No logged-in users") {
+		t.Errorf("stderr = %q, want no-users hint", stderr.String())
+	}
+}

cmd/auth/login.go

@@ -296,10 +296,11 @@ func authLoginRun(opts *LoginOptions) error {
 	}
 
 	// Step 2: Show user code and verification URL.
-	// Both branches surface AgentTimeoutHint, but on different channels:
-	// JSON mode embeds it as a structured field (so an agent that captures
-	// stdout into a JSON parser sees it without stream-mixing surprises),
-	// text mode prints to stderr (alongside the URL prompt).
+	// JSON mode embeds AgentTimeoutHint as a structured field so agents that
+	// capture stdout into a JSON parser see it without stream-mixing surprises.
+	// Text mode prints the hint to stderr only when running under a non-TTY
+	// (i.e. piped / agent harness), since humans reading a terminal don't need
+	// the agent-oriented instructions.
 	if opts.JSON {
 		data := map[string]interface{}{
 			"event":                     "device_authorization",
@@ -317,7 +318,9 @@ func authLoginRun(opts *LoginOptions) error {
 	} else {
 		fmt.Fprintf(f.IOStreams.ErrOut, msg.OpenURL)
 		fmt.Fprintf(f.IOStreams.ErrOut, "  %s\n\n", authResp.VerificationUriComplete)
-		fmt.Fprintln(f.IOStreams.ErrOut, msg.AgentTimeoutHint)
+		if f.IOStreams != nil && !f.IOStreams.IsTerminal {
+			fmt.Fprintln(f.IOStreams.ErrOut, msg.AgentTimeoutHint)
+		}
 	}
 
 	// Step 3: Poll for token
@@ -404,10 +407,11 @@ func authLoginPollDeviceCode(opts *LoginOptions, config *core.CliConfig, msg *lo
 			fmt.Fprintf(f.IOStreams.ErrOut, "[lark-cli] [WARN] auth login: failed to remove cached requested scopes: %v\n", err)
 		}
 	}
-	// Skip the stderr hint in JSON mode — the --no-wait call that issued the
-	// device_code already returned the hint as a JSON field, and writing
-	// text to stderr would pollute consumers that combine streams via 2>&1.
-	if !opts.JSON {
+	// Skip the stderr hint in JSON mode (the --no-wait call that issued
+	// the device_code already surfaced it as a JSON field), and also skip it
+	// when running on an interactive terminal — the agent-oriented
+	// instructions only matter for piped / harness environments.
+	if !opts.JSON && f.IOStreams != nil && !f.IOStreams.IsTerminal {
 		fmt.Fprintln(f.IOStreams.ErrOut, msg.AgentTimeoutHint)
 	}
 	log(msg.WaitingAuth)

cmd/auth/login_interactive.go

@@ -92,16 +92,11 @@ func buildDomainMeta(name, lang string) domainMeta {
 			Description: desc,
 		}
 	}
-	// Fallback: read from from_meta spec (legacy)
-	meta := registry.LoadFromMeta(name)
+	// Fallback: read from the typed service spec (legacy)
 	dm := domainMeta{Name: name}
-	if meta != nil {
-		if t, ok := meta["title"].(string); ok {
-			dm.Title = t
-		}
-		if d, ok := meta["description"].(string); ok {
-			dm.Description = d
-		}
+	if svc, ok := registry.ServiceTyped(name); ok {
+		dm.Title = svc.Title
+		dm.Description = svc.Description
 	}
 	return dm
 }

cmd/auth/login_messages.go

@@ -128,5 +128,5 @@ func getLoginMsg(lang i18n.Lang) *loginMsg {
 // (not backed by from_meta service specs). Descriptions are now centralized in
 // service_descriptions.json.
 func getShortcutOnlyDomainNames() []string {
-	return []string{"base", "contact", "docs", "markdown", "apps"}
+	return []string{"base", "contact", "docs", "markdown", "apps", "note"}
 }

cmd/auth/login_test.go

@@ -9,6 +9,7 @@ import (
 	"errors"
 	"io"
 	"net/http"
+	"slices"
 	"sort"
 	"strings"
 	"testing"
@@ -214,6 +215,12 @@ func TestGetShortcutOnlyDomainNames_HaveDescriptions(t *testing.T) {
 	}
 }
 
+func TestGetShortcutOnlyDomainNames_IncludesNote(t *testing.T) {
+	if !slices.Contains(getShortcutOnlyDomainNames(), "note") {
+		t.Fatal("shortcut-only domains must include note so auth login can select vc:note:read")
+	}
+}
+
 func TestCollectScopesForDomains(t *testing.T) {
 	projects := registry.ListFromMetaProjects()
 	if len(projects) == 0 {

cmd/auth/logout.go

@@ -18,6 +18,7 @@ import (
 // LogoutOptions holds all inputs for auth logout.
 type LogoutOptions struct {
 	Factory *cmdutil.Factory
+	JSON    bool
 }
 
 // NewCmdAuthLogout creates the auth logout subcommand.
@@ -34,6 +35,7 @@ func NewCmdAuthLogout(f *cmdutil.Factory, runF func(*LogoutOptions) error) *cobr
 			return authLogoutRun(opts)
 		},
 	}
+	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
 	cmdutil.SetRisk(cmd, "write")
 
 	return cmd
@@ -44,25 +46,65 @@ func authLogoutRun(opts *LogoutOptions) error {
 
 	multi, _ := core.LoadMultiAppConfig()
 	if multi == nil || len(multi.Apps) == 0 {
+		if opts.JSON {
+			output.PrintJson(f.IOStreams.Out, map[string]interface{}{
+				"ok":        true,
+				"loggedOut": false,
+				"reason":    "not_configured",
+			})
+			return nil
+		}
 		fmt.Fprintln(f.IOStreams.ErrOut, "No configuration found.")
 		return nil
 	}
 
 	app := multi.CurrentAppConfig(f.Invocation.Profile)
 	if app == nil || len(app.Users) == 0 {
+		if opts.JSON {
+			output.PrintJson(f.IOStreams.Out, map[string]interface{}{
+				"ok":        true,
+				"loggedOut": false,
+				"reason":    "not_logged_in",
+			})
+			return nil
+		}
 		fmt.Fprintln(f.IOStreams.ErrOut, "Not logged in.")
 		return nil
 	}
 
+	httpClient, httpErr := f.HttpClient()
+	appSecret, secretErr := core.ResolveSecretInput(app.AppSecret, f.Keychain)
+
 	for _, user := range app.Users {
+		if httpErr == nil && secretErr == nil {
+			if token := larkauth.GetStoredToken(app.AppId, user.UserOpenId); token != nil {
+				revokeToken := token.RefreshToken
+				tokenTypeHint := "refresh_token"
+				if revokeToken == "" {
+					revokeToken = token.AccessToken
+					tokenTypeHint = "access_token"
+				}
+				if revokeToken != "" {
+					_ = larkauth.RevokeToken(httpClient, app.AppId, appSecret, app.Brand, revokeToken, tokenTypeHint)
+				}
+			}
+		}
 		if err := larkauth.RemoveStoredToken(app.AppId, user.UserOpenId); err != nil {
 			fmt.Fprintf(f.IOStreams.ErrOut, "Warning: failed to remove token for %s: %v\n", user.UserOpenId, err)
 		}
 	}
+
 	app.Users = []core.AppUser{}
 	if err := core.SaveMultiAppConfig(multi); err != nil {
 		return errs.NewInternalError(errs.SubtypeStorage, "failed to save config: %v", err).WithCause(err)
 	}
+	if opts.JSON {
+		output.PrintJson(f.IOStreams.Out, map[string]interface{}{
+			"ok":        true,
+			"loggedOut": true,
+		})
+		return nil
+	}
 	output.PrintSuccess(f.IOStreams.ErrOut, "Logged out")
 	return nil
 }

cmd/auth/logout_test.go

@@ -0,0 +1,356 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"encoding/json"
+	"net/url"
+	"strings"
+	"testing"
+
+	larkauth "github.com/larksuite/cli/internal/auth"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/zalando/go-keyring"
+)
+
+func writeLogoutConfig(t *testing.T, users []core.AppUser) {
+	t.Helper()
+	if err := core.SaveMultiAppConfig(&core.MultiAppConfig{
+		CurrentApp: "test-app",
+		Apps: []core.AppConfig{
+			{
+				AppId:     "test-app",
+				AppSecret: core.PlainSecret("test-secret"),
+				Brand:     core.BrandFeishu,
+				Users:     users,
+			},
+		},
+	}); err != nil {
+		t.Fatalf("SaveMultiAppConfig() error = %v", err)
+	}
+}
+
+func TestAuthLogoutRun_JSONMode_NotConfigured_WritesStdoutOnly(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authLogoutRun(&LogoutOptions{Factory: f, JSON: true}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("stdout must be valid JSON: %v\nstdout=%s", err, stdout.String())
+	}
+	if payload["ok"] != true {
+		t.Errorf("stdout.ok = %v, want true", payload["ok"])
+	}
+	if payload["loggedOut"] != false {
+		t.Errorf("stdout.loggedOut = %v, want false", payload["loggedOut"])
+	}
+	if payload["reason"] != "not_configured" {
+		t.Errorf("stdout.reason = %v, want not_configured", payload["reason"])
+	}
+	if stderr.Len() != 0 {
+		t.Errorf("stderr must stay empty in JSON mode, got:\n%s", stderr.String())
+	}
+}
+
+func TestAuthLogoutRun_JSONMode_NotLoggedIn_WritesStdoutOnly(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	writeLogoutConfig(t, nil)
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authLogoutRun(&LogoutOptions{Factory: f, JSON: true}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("stdout must be valid JSON: %v\nstdout=%s", err, stdout.String())
+	}
+	if payload["ok"] != true {
+		t.Errorf("stdout.ok = %v, want true", payload["ok"])
+	}
+	if payload["loggedOut"] != false {
+		t.Errorf("stdout.loggedOut = %v, want false", payload["loggedOut"])
+	}
+	if payload["reason"] != "not_logged_in" {
+		t.Errorf("stdout.reason = %v, want not_logged_in", payload["reason"])
+	}
+	if stderr.Len() != 0 {
+		t.Errorf("stderr must stay empty in JSON mode, got:\n%s", stderr.String())
+	}
+}
+
+func TestAuthLogoutRun_JSONMode_Success_WritesStdoutOnly(t *testing.T) {
+	keyring.MockInit()
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	writeLogoutConfig(t, []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}})
+	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
+		AppId:      "test-app",
+		UserOpenId: "ou_user",
+	}); err != nil {
+		t.Fatalf("SetStoredToken() error = %v", err)
+	}
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authLogoutRun(&LogoutOptions{Factory: f, JSON: true}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(stdout.Bytes(), &payload); err != nil {
+		t.Fatalf("stdout must be valid JSON: %v\nstdout=%s", err, stdout.String())
+	}
+	if payload["ok"] != true {
+		t.Errorf("stdout.ok = %v, want true", payload["ok"])
+	}
+	if payload["loggedOut"] != true {
+		t.Errorf("stdout.loggedOut = %v, want true", payload["loggedOut"])
+	}
+	if _, hasReason := payload["reason"]; hasReason {
+		t.Errorf("stdout.reason must be absent on success, got %v", payload["reason"])
+	}
+	if stderr.Len() != 0 {
+		t.Errorf("stderr must stay empty in JSON mode, got:\n%s", stderr.String())
+	}
+}
+
+func TestAuthLogoutRun_DefaultMode_KeepsTextOutput(t *testing.T) {
+	keyring.MockInit()
+	t.Setenv("HOME", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_DATA_DIR", t.TempDir())
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	writeLogoutConfig(t, []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}})
+	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
+		AppId:      "test-app",
+		UserOpenId: "ou_user",
+	}); err != nil {
+		t.Fatalf("SetStoredToken() error = %v", err)
+	}
+
+	f, stdout, stderr, _ := cmdutil.TestFactory(t, nil)
+	if err := authLogoutRun(&LogoutOptions{Factory: f}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	if stdout.Len() != 0 {
+		t.Errorf("stdout must stay empty in default mode, got:\n%s", stdout.String())
+	}
+	if !strings.Contains(stderr.String(), "Logged out") {
+		t.Errorf("stderr = %q, want success text", stderr.String())
+	}
+}
+
+func TestAuthLogoutRun_RevokesTokenAndClearsLocalState(t *testing.T) {
+	keyring.MockInit()
+	setupLoginConfigDir(t)
+	t.Setenv("HOME", t.TempDir())
+
+	multi := &core.MultiAppConfig{
+		CurrentApp: "default",
+		Apps: []core.AppConfig{
+			{
+				Name:      "default",
+				AppId:     "cli_test",
+				AppSecret: core.PlainSecret("secret"),
+				Brand:     core.BrandFeishu,
+				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
+			},
+		},
+	}
+	if err := core.SaveMultiAppConfig(multi); err != nil {
+		t.Fatalf("SaveMultiAppConfig() error = %v", err)
+	}
+	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
+		AppId:        "cli_test",
+		UserOpenId:   "ou_user",
+		AccessToken:  "user-access-token",
+		RefreshToken: "user-refresh-token",
+	}); err != nil {
+		t.Fatalf("SetStoredToken() error = %v", err)
+	}
+
+	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+		ProfileName: "default",
+		AppID:       "cli_test",
+		AppSecret:   "secret",
+		Brand:       core.BrandFeishu,
+	})
+
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    larkauth.PathOAuthRevoke,
+		Body:   map[string]interface{}{"code": 0},
+		BodyFilter: func(body []byte) bool {
+			values, err := url.ParseQuery(string(body))
+			if err != nil {
+				return false
+			}
+			return values.Get("client_id") == "cli_test" &&
+				values.Get("client_secret") == "secret" &&
+				values.Get("token") == "user-refresh-token" &&
+				values.Get("token_type_hint") == "refresh_token"
+		},
+	})
+
+	if err := authLogoutRun(&LogoutOptions{Factory: f}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	if got := stderr.String(); !strings.Contains(got, "Logged out") {
+		t.Fatalf("stderr = %q, want Logged out", got)
+	}
+	if got := larkauth.GetStoredToken("cli_test", "ou_user"); got != nil {
+		t.Fatalf("expected stored token removed, got %#v", got)
+	}
+	saved, err := core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatalf("LoadMultiAppConfig() error = %v", err)
+	}
+	if len(saved.Apps) != 1 || len(saved.Apps[0].Users) != 0 {
+		t.Fatalf("expected users cleared, got %#v", saved.Apps)
+	}
+}
+
+func TestAuthLogoutRun_FallsBackToAccessTokenWhenRefreshTokenMissing(t *testing.T) {
+	keyring.MockInit()
+	setupLoginConfigDir(t)
+	t.Setenv("HOME", t.TempDir())
+
+	multi := &core.MultiAppConfig{
+		CurrentApp: "default",
+		Apps: []core.AppConfig{
+			{
+				Name:      "default",
+				AppId:     "cli_test",
+				AppSecret: core.PlainSecret("secret"),
+				Brand:     core.BrandFeishu,
+				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
+			},
+		},
+	}
+	if err := core.SaveMultiAppConfig(multi); err != nil {
+		t.Fatalf("SaveMultiAppConfig() error = %v", err)
+	}
+	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
+		AppId:       "cli_test",
+		UserOpenId:  "ou_user",
+		AccessToken: "user-access-token",
+	}); err != nil {
+		t.Fatalf("SetStoredToken() error = %v", err)
+	}
+
+	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+		ProfileName: "default",
+		AppID:       "cli_test",
+		AppSecret:   "secret",
+		Brand:       core.BrandFeishu,
+	})
+
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    larkauth.PathOAuthRevoke,
+		Body:   map[string]interface{}{"code": 0},
+		BodyFilter: func(body []byte) bool {
+			values, err := url.ParseQuery(string(body))
+			if err != nil {
+				return false
+			}
+			return values.Get("client_id") == "cli_test" &&
+				values.Get("client_secret") == "secret" &&
+				values.Get("token") == "user-access-token" &&
+				values.Get("token_type_hint") == "access_token"
+		},
+	})
+
+	if err := authLogoutRun(&LogoutOptions{Factory: f}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	if got := stderr.String(); !strings.Contains(got, "Logged out") {
+		t.Fatalf("stderr = %q, want Logged out", got)
+	}
+	if got := larkauth.GetStoredToken("cli_test", "ou_user"); got != nil {
+		t.Fatalf("expected stored token removed, got %#v", got)
+	}
+	saved, err := core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatalf("LoadMultiAppConfig() error = %v", err)
+	}
+	if len(saved.Apps) != 1 || len(saved.Apps[0].Users) != 0 {
+		t.Fatalf("expected users cleared, got %#v", saved.Apps)
+	}
+}
+
+func TestAuthLogoutRun_RevokeFailureStillClearsLocalState(t *testing.T) {
+	keyring.MockInit()
+	setupLoginConfigDir(t)
+	t.Setenv("HOME", t.TempDir())
+
+	multi := &core.MultiAppConfig{
+		CurrentApp: "default",
+		Apps: []core.AppConfig{
+			{
+				Name:      "default",
+				AppId:     "cli_test",
+				AppSecret: core.PlainSecret("secret"),
+				Brand:     core.BrandFeishu,
+				Users:     []core.AppUser{{UserOpenId: "ou_user", UserName: "tester"}},
+			},
+		},
+	}
+	if err := core.SaveMultiAppConfig(multi); err != nil {
+		t.Fatalf("SaveMultiAppConfig() error = %v", err)
+	}
+	if err := larkauth.SetStoredToken(&larkauth.StoredUAToken{
+		AppId:        "cli_test",
+		UserOpenId:   "ou_user",
+		AccessToken:  "user-access-token",
+		RefreshToken: "user-refresh-token",
+	}); err != nil {
+		t.Fatalf("SetStoredToken() error = %v", err)
+	}
+
+	f, _, stderr, reg := cmdutil.TestFactory(t, &core.CliConfig{
+		ProfileName: "default",
+		AppID:       "cli_test",
+		AppSecret:   "secret",
+		Brand:       core.BrandFeishu,
+	})
+
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    larkauth.PathOAuthRevoke,
+		Status: 500,
+		Body:   map[string]interface{}{"error": "server_error"},
+	})
+
+	if err := authLogoutRun(&LogoutOptions{Factory: f}); err != nil {
+		t.Fatalf("authLogoutRun() error = %v", err)
+	}
+
+	gotErr := stderr.String()
+	if strings.Contains(gotErr, "failed to revoke token for ou_user") {
+		t.Fatalf("stderr = %q, want no revoke warning", gotErr)
+	}
+	if !strings.Contains(gotErr, "Logged out") {
+		t.Fatalf("stderr = %q, want Logged out", gotErr)
+	}
+	if got := larkauth.GetStoredToken("cli_test", "ou_user"); got != nil {
+		t.Fatalf("expected stored token removed, got %#v", got)
+	}
+	saved, err := core.LoadMultiAppConfig()
+	if err != nil {
+		t.Fatalf("LoadMultiAppConfig() error = %v", err)
+	}
+	if len(saved.Apps) != 1 || len(saved.Apps[0].Users) != 0 {
+		t.Fatalf("expected users cleared, got %#v", saved.Apps)
+	}
+}

cmd/auth/scopes.go

@@ -19,6 +19,7 @@ type ScopesOptions struct {
 	Factory *cmdutil.Factory
 	Ctx     context.Context
 	Format  string
+	JSON    bool
 }
 
 // NewCmdAuthScopes creates the auth scopes subcommand.
@@ -30,6 +31,9 @@ func NewCmdAuthScopes(f *cmdutil.Factory, runF func(*ScopesOptions) error) *cobr
 		Short: "Query scopes enabled for the app",
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.Ctx = cmd.Context()
+			if opts.JSON {
+				opts.Format = "json"
+			}
 			if runF != nil {
 				return runF(opts)
 			}
@@ -38,6 +42,7 @@ func NewCmdAuthScopes(f *cmdutil.Factory, runF func(*ScopesOptions) error) *cobr
 	}
 
 	cmd.Flags().StringVar(&opts.Format, "format", "json", "output format: json (default) | pretty")
+	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
 	cmdutil.SetRisk(cmd, "read")
 
 	return cmd

cmd/auth/status.go

@@ -17,6 +17,7 @@ import (
 type StatusOptions struct {
 	Factory *cmdutil.Factory
 	Verify  bool
+	JSON    bool
 }
 
 // NewCmdAuthStatus creates the auth status subcommand.
@@ -35,6 +36,7 @@ func NewCmdAuthStatus(f *cmdutil.Factory, runF func(*StatusOptions) error) *cobr
 	}
 
 	cmd.Flags().BoolVar(&opts.Verify, "verify", false, "verify token against server (requires network)")
+	cmd.Flags().BoolVar(&opts.JSON, "json", false, "structured JSON output")
 	cmdutil.SetRisk(cmd, "read")
 
 	return cmd

cmd/build.go

@@ -6,6 +6,7 @@ package cmd
 import (
 	"context"
 	"io"
+	"io/fs"
 
 	"github.com/larksuite/cli/cmd/api"
 	"github.com/larksuite/cli/cmd/auth"
@@ -16,6 +17,7 @@ import (
 	"github.com/larksuite/cli/cmd/profile"
 	"github.com/larksuite/cli/cmd/schema"
 	"github.com/larksuite/cli/cmd/service"
+	"github.com/larksuite/cli/cmd/skill"
 	cmdupdate "github.com/larksuite/cli/cmd/update"
 	_ "github.com/larksuite/cli/events"
 	"github.com/larksuite/cli/internal/build"
@@ -51,6 +53,18 @@ func WithKeychain(kc keychain.KeychainAccess) BuildOption {
 	}
 }
 
+// embeddedSkillContent is the skill tree wired into cmdutil.Factory.SkillContent
+// at build time. It is registered by the repo-root package main's init via
+// SetEmbeddedSkillContent — it cannot be threaded through main.go without
+// breaking the single-file preview build (see skills_embed.go). nil in builds
+// that embed no skills; the `skills` commands then return a typed internal error.
+var embeddedSkillContent fs.FS
+
+// SetEmbeddedSkillContent registers the embedded skill tree. Called from the
+// repo-root package main's init; a wrapper main can call it before Execute to
+// supply its own skill content.
+func SetEmbeddedSkillContent(fsys fs.FS) { embeddedSkillContent = fsys }
+
 // HideProfile sets the visibility policy for the root-level --profile flag.
 // When hide is true the flag stays registered (so existing invocations still
 // parse) but is omitted from help and shell completion. Typically called as
@@ -103,6 +117,7 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 	if cfg.keychain != nil {
 		f.Keychain = cfg.keychain
 	}
+	f.SkillContent = embeddedSkillContent
 	rootCmd := &cobra.Command{
 		Use:     "lark-cli",
 		Short:   "Lark/Feishu CLI — OAuth authorization, UAT management, API calls",
@@ -140,6 +155,7 @@ func buildInternal(ctx context.Context, inv cmdutil.InvocationContext, opts ...B
 	rootCmd.AddCommand(completion.NewCmdCompletion(f))
 	rootCmd.AddCommand(cmdupdate.NewCmdUpdate(f))
 	rootCmd.AddCommand(cmdevent.NewCmdEvents(f))
+	rootCmd.AddCommand(skill.NewCmdSkill(f))
 	service.RegisterServiceCommandsWithContext(ctx, rootCmd, f)
 	shortcuts.RegisterShortcutsWithContext(ctx, rootCmd, f)
 

cmd/command_catalog_path_test.go

@@ -0,0 +1,52 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmd
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/spf13/cobra"
+)
+
+// TestCommandCatalogPath pins that the auth-hint path reconstruction inverts the
+// service command tree for any depth — flat dotted resources AND genuinely
+// nested resources — so it round-trips through apicatalog.Resolve instead of
+// assuming a fixed root->service->resource->method shape.
+func TestCommandCatalogPath(t *testing.T) {
+	chain := func(names ...string) *cobra.Command {
+		var parent, leaf *cobra.Command
+		for _, n := range names {
+			c := &cobra.Command{Use: n}
+			if parent != nil {
+				parent.AddCommand(c)
+			}
+			parent = c
+			leaf = c
+		}
+		return leaf
+	}
+
+	tests := []struct {
+		name string
+		leaf *cobra.Command
+		want []string
+	}{
+		{"flat dotted resource", chain("lark-cli", "im", "chat.members", "create"), []string{"im", "chat.members", "create"}},
+		{"nested resources", chain("lark-cli", "im", "spaces", "items", "get"), []string{"im", "spaces", "items", "get"}},
+		{"service level", chain("lark-cli", "im"), []string{"im"}},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := commandCatalogPath(tt.leaf); !reflect.DeepEqual(got, tt.want) {
+				t.Errorf("commandCatalogPath = %v, want %v", got, tt.want)
+			}
+		})
+	}
+
+	// The root command (no parent) has no catalog path.
+	if got := commandCatalogPath(&cobra.Command{Use: "lark-cli"}); len(got) != 0 {
+		t.Errorf("root path = %v, want empty", got)
+	}
+}

cmd/config/init_probe.go

@@ -33,15 +33,16 @@ const probeTimeout = 3 * time.Second
 //
 //  1. A TAT request using the just-saved credentials. credential.FetchTAT
 //     returns a typed errs.* error (via the shared classifyTATResponseCode)
-//     only when the server deterministically rejected the credentials — a
-//     non-zero TAT body code, classified as CategoryConfig / SubtypeInvalidClient
-//     (10003 / 10014) or whatever codemeta maps. That typed error is propagated
-//     so the root dispatcher renders the canonical envelope and `config init`
-//     exits non-zero — identical to how every other token-resolving command
-//     reports the same bad credentials. Ambiguous failures (transport errors,
-//     HTTP non-200, JSON parse errors, timeouts) come back as raw untyped
-//     errors and are swallowed (return nil), so valid configurations are never
-//     disturbed by upstream noise. errs.IsTyped is the discriminator.
+//     only when the unified Token Endpoint deterministically rejected the
+//     credentials — an OAuth2 invalid_client / unauthorized_client classified as
+//     CategoryConfig / SubtypeInvalidClient, or whatever codemeta maps. That
+//     typed error is propagated so the root dispatcher renders the canonical
+//     envelope and `config init` exits non-zero — identical to how every other
+//     token-resolving command reports the same bad credentials. Ambiguous
+//     failures (transport errors, transient 5xx/server_error, JSON parse errors,
+//     timeouts) come back as raw untyped errors and are swallowed (return nil),
+//     so valid configurations are never disturbed by upstream noise.
+//     errs.IsTyped is the discriminator.
 //
 //  2. If TAT succeeded, a POST to the probe endpoint is fired. The outcome of
 //     that call (success, server error, timeout, parse failure) is always

cmd/config/init_probe_test.go

@@ -31,10 +31,10 @@ type fakeRT struct {
 
 func (f *fakeRT) RoundTrip(req *http.Request) (*http.Response, error) {
 	switch {
-	case strings.HasSuffix(req.URL.Path, "/auth/v3/tenant_access_token/internal"):
+	case strings.HasSuffix(req.URL.Path, "/oauth/v3/token"):
 		f.tatCalls++
 		if f.tatHandler == nil {
-			return jsonResp(200, `{"code":0,"tenant_access_token":"t-ok"}`), nil
+			return jsonResp(200, `{"code":0,"access_token":"t-ok","token_type":"Bearer"}`), nil
 		}
 		return f.tatHandler(req)
 	case strings.HasSuffix(req.URL.Path, "/application/v6/larksuite_cli_app/probe"):
@@ -84,14 +84,15 @@ func fakeFactory(t *testing.T, rt http.RoundTripper) (*cmdutil.Factory, *bytes.B
 }
 
 // assertConfigRejection asserts runProbe propagated a deterministic credential
-// rejection: a *errs.ConfigError (CategoryConfig / SubtypeInvalidClient) with
-// the expected upstream code. This is the same typed error every other
-// token-resolving command returns for the same bad credentials, and nothing is
-// written to stderr (the root dispatcher renders the envelope).
-func assertConfigRejection(t *testing.T, err error, errBuf *bytes.Buffer, wantCode int) {
+// rejection: a *errs.ConfigError (CategoryConfig / SubtypeInvalidClient). This
+// is the same typed error every other token-resolving command returns for the
+// same bad credentials, and nothing is written to stderr (the root dispatcher
+// renders the envelope). The numeric code is not asserted: the unified v3 Token
+// Endpoint reports invalid_client via the OAuth2 error string, not a Lark code.
+func assertConfigRejection(t *testing.T, err error, errBuf *bytes.Buffer) {
 	t.Helper()
 	if err == nil {
-		t.Fatalf("expected *errs.ConfigError (code %d), got nil", wantCode)
+		t.Fatal("expected *errs.ConfigError, got nil")
 	}
 	var cfgErr *errs.ConfigError
 	if !errors.As(err, &cfgErr) {
@@ -103,9 +104,6 @@ func assertConfigRejection(t *testing.T, err error, errBuf *bytes.Buffer, wantCo
 	if cfgErr.Subtype != errs.SubtypeInvalidClient {
 		t.Errorf("Subtype = %q, want %q", cfgErr.Subtype, errs.SubtypeInvalidClient)
 	}
-	if cfgErr.Code != wantCode {
-		t.Errorf("Code = %d, want %d", cfgErr.Code, wantCode)
-	}
 	if errBuf.Len() != 0 {
 		t.Errorf("runProbe must not write to stderr, got: %q", errBuf.String())
 	}
@@ -123,11 +121,13 @@ func assertSilent(t *testing.T, err error, errBuf *bytes.Buffer) {
 	}
 }
 
-// 10003 (bad / non-existent app_id) → ConfigError/InvalidClient, propagated.
-func TestRunProbe_TATCode10003_ReturnsConfigError(t *testing.T) {
+// invalid_client (bad / non-existent app_id or wrong secret) → the v3 Token
+// Endpoint returns HTTP 400 with the OAuth2 error → ConfigError/InvalidClient,
+// propagated. The probe endpoint must not be called when TAT fails.
+func TestRunProbe_TATInvalidClient_ReturnsConfigError(t *testing.T) {
 	rt := &fakeRT{
 		tatHandler: func(req *http.Request) (*http.Response, error) {
-			return jsonResp(200, `{"code":10003,"msg":"invalid param"}`), nil
+			return jsonResp(400, `{"error":"invalid_client","error_description":"The client secret is invalid.","code":20002}`), nil
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)
@@ -137,28 +137,27 @@ func TestRunProbe_TATCode10003_ReturnsConfigError(t *testing.T) {
 	if rt.probeCalls != 0 {
 		t.Error("probe endpoint must not be called when TAT fails")
 	}
-	assertConfigRejection(t, err, errBuf, 10003)
+	assertConfigRejection(t, err, errBuf)
 }
 
-// 10014 (real app_id + wrong secret) → ConfigError/InvalidClient via codemeta —
-// the most common real-world rejection, propagated.
-func TestRunProbe_TATCode10014_ReturnsConfigError(t *testing.T) {
+// unauthorized_client is treated as the same credential rejection, propagated.
+func TestRunProbe_TATUnauthorizedClient_ReturnsConfigError(t *testing.T) {
 	rt := &fakeRT{
 		tatHandler: func(req *http.Request) (*http.Response, error) {
-			return jsonResp(200, `{"code":10014,"msg":"app secret invalid"}`), nil
+			return jsonResp(401, `{"error":"unauthorized_client","error_description":"client not authorized"}`), nil
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)
-	assertConfigRejection(t, runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu), errBuf, 10014)
+	assertConfigRejection(t, runProbe(context.Background(), f, "cli_x", "secret_y", core.BrandFeishu), errBuf)
 }
 
-// Any non-zero body code is a deterministic rejection and propagates (typed).
-// An unrecognized code falls back to *errs.APIError via BuildAPIError — still
-// typed, so the probe still surfaces it rather than swallowing.
-func TestRunProbe_TATUnknownBodyCode_Propagates(t *testing.T) {
+// Any other deterministic client-side OAuth error (e.g. invalid_scope) falls
+// back to *errs.APIError via BuildAPIError — still typed, so the probe surfaces
+// it rather than swallowing — but is not a credential (ConfigError) rejection.
+func TestRunProbe_TATOtherClientError_Propagates(t *testing.T) {
 	rt := &fakeRT{
 		tatHandler: func(req *http.Request) (*http.Response, error) {
-			return jsonResp(200, `{"code":99999,"msg":"future-unknown"}`), nil
+			return jsonResp(400, `{"code":20068,"error":"invalid_scope","error_description":"unauthorized scope"}`), nil
 		},
 	}
 	f, errBuf := fakeFactory(t, rt)

cmd/error_auth_hint.go

@@ -11,6 +11,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/apicatalog"
 	internalauth "github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
@@ -118,38 +119,37 @@ func resolveDeclaredShortcutScopes(cmd *cobra.Command, identity string) []string
 }
 
 // resolveDeclaredServiceMethodScopes returns the scopes declared by a
-// service/resource/method command from the embedded from_meta registry.
+// service/resource/method command. It reconstructs the catalog path from the
+// command ancestry and resolves it through the same navigation Module the
+// command tree is built from (apicatalog), so it stays correct for nested
+// resources instead of hard-coding a root->service->resource->method depth.
+// Non-method commands (services, resources, shortcuts) resolve to a non-method
+// target and yield no scopes.
 func resolveDeclaredServiceMethodScopes(cmd *cobra.Command, identity string) []string {
-	// Service-method scope lookup only applies to commands mounted as
-	// root -> service -> resource -> method. Non-resource/method commands
-	// intentionally return no scopes here so auth-hint enrichment does not
-	// change runtime semantics for other command shapes.
-	if cmd == nil || cmd.Parent() == nil || cmd.Parent().Parent() == nil || cmd.Parent().Parent().Parent() == nil {
+	if cmd == nil || strings.HasPrefix(cmd.Name(), "+") {
 		return nil
 	}
-	if strings.HasPrefix(cmd.Name(), "+") {
+	path := commandCatalogPath(cmd)
+	if len(path) == 0 {
 		return nil
 	}
+	target, err := registry.RuntimeCatalog().Resolve(path)
+	if err != nil || target.Kind != apicatalog.TargetMethod {
+		return nil
+	}
+	return registry.DeclaredScopesForMethod(target.Method.Method, identity)
+}
 
-	service := cmd.Parent().Parent().Name()
-	resource := cmd.Parent().Name()
-	method := cmd.Name()
-
-	spec := registry.LoadFromMeta(service)
-	if spec == nil {
-		return nil
+// commandCatalogPath reconstructs the catalog path [service, resource..., method]
+// from a command's ancestry, excluding the root command. It is the inverse of
+// the service command tree's construction, so any depth (flat or nested)
+// round-trips through apicatalog.Resolve.
+func commandCatalogPath(cmd *cobra.Command) []string {
+	var path []string
+	for c := cmd; c != nil && c.Parent() != nil; c = c.Parent() {
+		path = append([]string{c.Name()}, path...)
 	}
-	resources, _ := spec["resources"].(map[string]interface{})
-	resMap, _ := resources[resource].(map[string]interface{})
-	if resMap == nil {
-		return nil
-	}
-	methods, _ := resMap["methods"].(map[string]interface{})
-	methodMap, _ := methods[method].(map[string]interface{})
-	if methodMap == nil {
-		return nil
-	}
-	return registry.DeclaredScopesForMethod(methodMap, identity)
+	return path
 }
 
 // shortcutSupportsIdentity reports whether a shortcut supports the requested

cmd/event/bus.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/event"
@@ -38,7 +39,8 @@ func NewCmdBus(f *cmdutil.Factory) *cobra.Command {
 
 			logger, err := bus.SetupBusLogger(eventsDir)
 			if err != nil {
-				return err
+				return errs.NewInternalError(errs.SubtypeFileIO,
+					"set up bus logger: %s", err).WithCause(err)
 			}
 
 			tr := transport.New()
@@ -58,7 +60,14 @@ func NewCmdBus(f *cmdutil.Factory) *cobra.Command {
 				}
 			}()
 
-			return b.Run(ctx)
+			if err := b.Run(ctx); err != nil {
+				if _, ok := errs.ProblemOf(err); ok {
+					return err
+				}
+				return errs.NewInternalError(errs.SubtypeUnknown,
+					"event bus daemon exited: %s", err).WithCause(err)
+			}
+			return nil
 		},
 	}
 

cmd/event/bus_test.go

@@ -0,0 +1,45 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package event
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/core"
+)
+
+// The hidden `event _bus` daemon command must exit with a typed file_io error
+// when its log directory cannot be created (the error is only visible in the
+// forked process's captured stderr / bus.log).
+func TestBusCommandLoggerSetupFailureIsTypedFileIO(t *testing.T) {
+	dir := t.TempDir()
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", dir)
+	// Block the events/ root with a regular file so MkdirAll fails.
+	if err := os.WriteFile(filepath.Join(dir, "events"), []byte("x"), 0600); err != nil {
+		t.Fatal(err)
+	}
+
+	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
+		AppID: "cli_bus_test", AppSecret: "secret", Brand: core.BrandFeishu,
+	})
+	cmd := NewCmdBus(f)
+	cmd.SetArgs([]string{})
+
+	err := cmd.Execute()
+	if err == nil {
+		t.Fatal("expected logger setup error")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != errs.CategoryInternal || p.Subtype != errs.SubtypeFileIO {
+		t.Errorf("problem = %s/%s, want %s/%s", p.Category, p.Subtype,
+			errs.CategoryInternal, errs.SubtypeFileIO)
+	}
+}

cmd/event/consume.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/appmeta"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/cmdutil"
@@ -64,8 +65,8 @@ Use 'event schema <EventKey>' for parameter details.`,
 	cmd.Flags().StringVar(&o.jqExpr, "jq", "", "JQ expression to filter output")
 	cmd.Flags().BoolVar(&o.quiet, "quiet", false, "Suppress informational messages on stderr")
 	cmd.Flags().StringVar(&o.outputDir, "output-dir", "", "Write each event as a file in this directory (relative paths only; absolute paths and ~ are rejected to prevent path traversal)")
-	cmd.Flags().IntVar(&o.maxEvents, "max-events", 0, "Exit after N successful emits (0 = unlimited). Multi-worker EventKeys may emit up to workers-1 past N before all workers stop.")
-	cmd.Flags().DurationVar(&o.timeout, "timeout", 0, "Exit after DURATION (e.g. 30s, 2m). 0 = no timeout. Timeout is a normal exit (code 0; stderr 'reason: timeout').")
+	cmd.Flags().IntVar(&o.maxEvents, "max-events", 0, "Exit after N successful emits (0 = unlimited). Multi-worker EventKeys may emit up to workers-1 past N before all workers stop. Bounded runs ignore stdin EOF.")
+	cmd.Flags().DurationVar(&o.timeout, "timeout", 0, "Exit after DURATION (e.g. 30s, 2m). 0 = no timeout. Timeout is a normal exit (code 0; stderr 'reason: timeout'). Bounded runs ignore stdin EOF.")
 	cmd.Flags().String("as", "auto", "identity type: user | bot | auto (must match EventKey's declared AuthTypes)")
 	_ = cmd.RegisterFlagCompletionFunc("as", func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		return []string{"user", "bot", "auto"}, cobra.ShellCompDirectiveNoFileComp
@@ -101,11 +102,10 @@ func runConsume(cmd *cobra.Command, f *cmdutil.Factory, eventKey string, o consu
 
 	if o.jqExpr != "" {
 		if err := output.ValidateJqExpression(o.jqExpr); err != nil {
-			return output.ErrWithHint(
-				output.ExitValidation, "validation",
-				err.Error(),
-				fmt.Sprintf("see `lark-cli event consume --help` EXAMPLES for common patterns, or `lark-cli event schema %s` for valid field paths", eventKey),
-			)
+			return errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).
+				WithParam("--jq").
+				WithCause(err).
+				WithHint("see `lark-cli event consume --help` EXAMPLES for common patterns, or `lark-cli event schema %s` for valid field paths", eventKey)
 		}
 	}
 
@@ -184,8 +184,9 @@ func runConsume(cmd *cobra.Command, f *cmdutil.Factory, eventKey string, o consu
 		errOut = io.Discard
 	}
 
-	// Non-TTY only: stdin EOF is shutdown for subprocess callers; in TTY Ctrl-D must not exit.
-	if !f.IOStreams.IsTerminal {
+	// Non-TTY unbounded consumers use stdin EOF as shutdown for subprocess callers.
+	// Bounded runs already have --max-events/--timeout as their lifecycle control.
+	if shouldWatchStdinEOF(f.IOStreams.IsTerminal, o.maxEvents, o.timeout) {
 		watchStdinEOF(os.Stdin, cancel, errOut)
 	}
 
@@ -260,12 +261,12 @@ func preflightScopes(ctx context.Context, pf *preflightCtx) error {
 	if len(missing) == 0 {
 		return nil
 	}
-	return output.ErrWithHint(
-		output.ExitAuth, "auth",
-		fmt.Sprintf("missing required scopes for EventKey %s (as %s): %s",
-			pf.eventKey, pf.identity, strings.Join(missing, ", ")),
-		scopeRemediationHint(pf.identity, missing, pf.appID, pf.brand),
-	)
+	return errs.NewPermissionError(errs.SubtypeMissingScope,
+		"missing required scopes for EventKey %s (as %s): %s",
+		pf.eventKey, pf.identity, strings.Join(missing, ", ")).
+		WithIdentity(string(pf.identity)).
+		WithMissingScopes(missing...).
+		WithHint("%s", scopeRemediationHint(pf.identity, missing, pf.appID, pf.brand))
 }
 
 // scopeRemediationHint returns an identity-appropriate fix for missing scopes.
@@ -300,23 +301,27 @@ func preflightEventTypes(pf *preflightCtx) error {
 	if len(missing) == 0 {
 		return nil
 	}
-	return output.ErrWithHint(
-		output.ExitValidation, "validation",
-		fmt.Sprintf("EventKey %s requires event types not subscribed in console: %s",
-			pf.keyDef.Key, strings.Join(missing, ", ")),
-		fmt.Sprintf("subscribe these events and publish a new app version at: %s",
-			consoleEventSubscriptionURL(pf.brand, pf.appID)),
-	)
+	return errs.NewValidationError(errs.SubtypeFailedPrecondition,
+		"EventKey %s requires event types not subscribed in console: %s",
+		pf.keyDef.Key, strings.Join(missing, ", ")).
+		WithHint("subscribe these events and publish a new app version at: %s",
+			consoleEventSubscriptionURL(pf.brand, pf.appID))
 }
 
 // sanitizeOutputDir rejects absolute/parent-escaping paths and ~ (SafeOutputPath treats it as a literal dir name).
 func sanitizeOutputDir(dir string) (string, error) {
 	if strings.HasPrefix(dir, "~") {
-		return "", output.ErrValidation("%s; use a relative path like ./output instead", errOutputDirTilde)
+		return "", errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"%s; use a relative path like ./output instead", errOutputDirTilde).
+			WithParam("--output-dir").
+			WithCause(errOutputDirTilde)
 	}
 	safe, err := validate.SafeOutputPath(dir)
 	if err != nil {
-		return "", output.ErrValidation("%s %q: %s", errOutputDirUnsafe, dir, err)
+		return "", errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"%s %q: %s", errOutputDirUnsafe, dir, err).
+			WithParam("--output-dir").
+			WithCause(errOutputDirUnsafe)
 	}
 	return safe, nil
 }
@@ -328,18 +333,21 @@ func resolveTenantToken(ctx context.Context, f *cmdutil.Factory, appID string) (
 	}
 	result, err := f.Credential.ResolveToken(ctx, credential.NewTokenSpec(core.AsBot, appID))
 	if err != nil {
-		return "", output.ErrAuth("resolve tenant access token: %s", err)
+		if _, ok := errs.ProblemOf(err); ok {
+			return "", err
+		}
+		return "", errs.NewAuthenticationError(errs.SubtypeTokenMissing,
+			"resolve tenant access token: %s", err).WithCause(err)
 	}
 	if result == nil || result.Token == "" {
-		return "", output.ErrWithHint(
-			output.ExitAuth, "auth",
-			fmt.Sprintf("no tenant access token available for app %s", appID),
-			"Check that app_secret is configured (lark-cli config show) and try 'lark-cli auth login'.",
-		)
+		return "", errs.NewAuthenticationError(errs.SubtypeTokenMissing,
+			"no tenant access token available for app %s", appID).
+			WithHint("Check that app_secret is configured (lark-cli config show) and try 'lark-cli auth login'.")
 	}
 	return result.Token, nil
 }
 
+// Sentinels for errors.Is checks; call sites wrap them as typed ValidationError causes.
 var (
 	errInvalidParamFormat = errors.New("invalid --param format")
 	errOutputDirTilde     = errors.New("--output-dir does not support ~ expansion")
@@ -351,7 +359,10 @@ func parseParams(raw []string) (map[string]string, error) {
 	for _, kv := range raw {
 		k, v, ok := strings.Cut(kv, "=")
 		if !ok || k == "" {
-			return nil, output.ErrValidation("%s %q: expected key=value", errInvalidParamFormat, kv)
+			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"%s %q: expected key=value", errInvalidParamFormat, kv).
+				WithParam("--param").
+				WithCause(errInvalidParamFormat)
 		}
 		m[k] = v
 	}
@@ -370,3 +381,8 @@ func watchStdinEOF(r io.Reader, cancel context.CancelFunc, errOut io.Writer) {
 		cancel()
 	}()
 }
+
+// shouldWatchStdinEOF gates the stdin-EOF shutdown watcher: non-TTY unbounded runs only (<= 0 mirrors downstream's >0-is-bounded semantics, so negative bounds stay unbounded).
+func shouldWatchStdinEOF(isTerminal bool, maxEvents int, timeout time.Duration) bool {
+	return !isTerminal && maxEvents <= 0 && timeout <= 0
+}

cmd/event/consume_stdin_test.go

@@ -61,3 +61,70 @@ func TestWatchStdinEOF_DiagnosticMessage(t *testing.T) {
 		t.Fatal("watchStdinEOF did not cancel within 1s of EOF")
 	}
 }
+
+func TestShouldWatchStdinEOF(t *testing.T) {
+	tests := []struct {
+		name       string
+		isTerminal bool
+		maxEvents  int
+		timeout    time.Duration
+		want       bool
+	}{
+		{
+			name:       "terminal",
+			isTerminal: true,
+			want:       false,
+		},
+		{
+			name: "non terminal unbounded",
+			want: true,
+		},
+		{
+			name:      "non terminal negative max events is unbounded",
+			maxEvents: -1,
+			want:      true,
+		},
+		{
+			name:    "non terminal negative timeout is unbounded",
+			timeout: -1 * time.Second,
+			want:    true,
+		},
+		{
+			name:      "non terminal max events bounded",
+			maxEvents: 1,
+			want:      false,
+		},
+		{
+			name:    "non terminal timeout bounded",
+			timeout: 10 * time.Minute,
+			want:    false,
+		},
+		{
+			name:      "non terminal both bounds positive",
+			maxEvents: 1,
+			timeout:   10 * time.Minute,
+			want:      false,
+		},
+		{
+			name:      "non terminal bounded max events with negative timeout",
+			maxEvents: 1,
+			timeout:   -1 * time.Second,
+			want:      false,
+		},
+		{
+			name:      "non terminal bounded timeout with negative max events",
+			maxEvents: -1,
+			timeout:   10 * time.Minute,
+			want:      false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := shouldWatchStdinEOF(tt.isTerminal, tt.maxEvents, tt.timeout)
+			if got != tt.want {
+				t.Fatalf("shouldWatchStdinEOF() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

cmd/event/consume_test.go

@@ -4,9 +4,14 @@
 package event
 
 import (
+	"context"
 	"errors"
 	"strings"
 	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/credential"
 )
 
 func TestParseParams(t *testing.T) {
@@ -73,6 +78,7 @@ func TestParseParams(t *testing.T) {
 				if tc.wantEcho != "" && !strings.Contains(err.Error(), tc.wantEcho) {
 					t.Errorf("err %q should echo %q so user sees the bad input", err.Error(), tc.wantEcho)
 				}
+				assertInvalidArgumentParam(t, err, "--param")
 				return
 			}
 			if err != nil {
@@ -90,6 +96,77 @@ func TestParseParams(t *testing.T) {
 	}
 }
 
+// emptyTokenResolver resolves to a result that carries no token.
+type emptyTokenResolver struct{}
+
+func (emptyTokenResolver) ResolveToken(_ context.Context, _ credential.TokenSpec) (*credential.TokenResult, error) {
+	return &credential.TokenResult{}, nil
+}
+
+// failingTokenResolver fails outright with an untyped error.
+type failingTokenResolver struct{}
+
+func (failingTokenResolver) ResolveToken(_ context.Context, _ credential.TokenSpec) (*credential.TokenResult, error) {
+	return nil, errors.New("backend unavailable")
+}
+
+func factoryWithResolver(r credential.DefaultTokenResolver) *cmdutil.Factory {
+	return &cmdutil.Factory{Credential: credential.NewCredentialProvider(nil, nil, r, nil)}
+}
+
+func TestResolveTenantToken_EmptyTokenResult(t *testing.T) {
+	_, err := resolveTenantToken(context.Background(), factoryWithResolver(emptyTokenResolver{}), "cli_x")
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != errs.CategoryAuthentication || p.Subtype != errs.SubtypeTokenMissing {
+		t.Errorf("problem = %s/%s, want %s/%s", p.Category, p.Subtype,
+			errs.CategoryAuthentication, errs.SubtypeTokenMissing)
+	}
+	var malformed *credential.MalformedTokenResultError
+	if !errors.As(err, &malformed) {
+		t.Error("empty-token failure should preserve the credential-layer cause")
+	}
+}
+
+func TestResolveTenantToken_ResolverFailure(t *testing.T) {
+	_, err := resolveTenantToken(context.Background(), factoryWithResolver(failingTokenResolver{}), "cli_x")
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != errs.CategoryAuthentication || p.Subtype != errs.SubtypeTokenMissing {
+		t.Errorf("problem = %s/%s, want %s/%s", p.Category, p.Subtype,
+			errs.CategoryAuthentication, errs.SubtypeTokenMissing)
+	}
+	if errors.Unwrap(err) == nil {
+		t.Error("resolver failure should preserve its cause")
+	}
+}
+
+// assertInvalidArgumentParam verifies err is a typed validation error with
+// subtype invalid_argument naming the given flag in its param field.
+func assertInvalidArgumentParam(t *testing.T, err error, param string) {
+	t.Helper()
+	var ve *errs.ValidationError
+	if !errors.As(err, &ve) {
+		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
+	}
+	if ve.Subtype != errs.SubtypeInvalidArgument {
+		t.Errorf("subtype = %s, want %s", ve.Subtype, errs.SubtypeInvalidArgument)
+	}
+	if ve.Param != param {
+		t.Errorf("param = %q, want %q", ve.Param, param)
+	}
+}
+
 func TestSanitizeOutputDir(t *testing.T) {
 	cases := []struct {
 		name       string
@@ -130,6 +207,7 @@ func TestSanitizeOutputDir(t *testing.T) {
 				if !errors.Is(err, tc.wantSentry) {
 					t.Fatalf("want errors.Is(err, %v), got %q", tc.wantSentry, err.Error())
 				}
+				assertInvalidArgumentParam(t, err, "--output-dir")
 				return
 			}
 			if err != nil {

cmd/event/format_helpers_test.go

@@ -143,6 +143,79 @@ func TestWriteStatusText_CoversAllStates(t *testing.T) {
 	}
 }
 
+func TestWriteStatusText_ShowsSubColumn(t *testing.T) {
+	var buf bytes.Buffer
+	writeStatusText(&buf, []appStatus{
+		{
+			AppID:     "cli_RUNNINGXXXXXXXXX",
+			State:     stateRunning,
+			PID:       1234,
+			UptimeSec: 60,
+			Active:    2,
+			Consumers: []protocol.ConsumerInfo{
+				{PID: 1001, EventKey: "mail.x", SubscriptionID: "mail.x:alice", Received: 5, Dropped: 0},
+				{PID: 1002, EventKey: "mail.x", SubscriptionID: "mail.x:bob", Received: 3, Dropped: 0},
+			},
+		},
+	})
+	out := buf.String()
+	if !strings.Contains(out, "SUB") {
+		t.Errorf("missing SUB column header: %s", out)
+	}
+	if !strings.Contains(out, "alice") {
+		t.Errorf("missing alice suffix in SUB column: %s", out)
+	}
+	if !strings.Contains(out, "bob") {
+		t.Errorf("missing bob suffix in SUB column: %s", out)
+	}
+}
+
+func TestWriteStatusText_LegacySubscriptionID_RendersDash(t *testing.T) {
+	var buf bytes.Buffer
+	writeStatusText(&buf, []appStatus{
+		{
+			AppID:     "cli_RUNNINGXXXXXXXXX",
+			State:     stateRunning,
+			PID:       1234,
+			UptimeSec: 60,
+			Active:    1,
+			Consumers: []protocol.ConsumerInfo{
+				{PID: 1001, EventKey: "im.x", SubscriptionID: "", Received: 5},
+			},
+		},
+	})
+	out := buf.String()
+	if !strings.Contains(out, "SUB") {
+		t.Errorf("missing SUB header: %s", out)
+	}
+	if !strings.Contains(out, "-") {
+		t.Errorf("missing dash placeholder for empty SubscriptionID: %s", out)
+	}
+}
+
+func TestWriteStatusText_EventKeyEqualSubscriptionID_RendersDash(t *testing.T) {
+	var buf bytes.Buffer
+	writeStatusText(&buf, []appStatus{
+		{
+			AppID:     "cli_RUNNINGXXXXXXXXX",
+			State:     stateRunning,
+			PID:       1234,
+			UptimeSec: 60,
+			Active:    1,
+			Consumers: []protocol.ConsumerInfo{
+				{PID: 1001, EventKey: "im.x", SubscriptionID: "im.x", Received: 5},
+			},
+		},
+	})
+	out := buf.String()
+	if !strings.Contains(out, "SUB") {
+		t.Errorf("missing SUB header: %s", out)
+	}
+	if !strings.Contains(out, "-") {
+		t.Errorf("missing dash placeholder when SubscriptionID==EventKey: %s", out)
+	}
+}
+
 func TestWriteStatusJSON_OrphanHint(t *testing.T) {
 	var buf bytes.Buffer
 	if err := writeStatusJSON(&buf, []appStatus{

cmd/event/preflight_test.go

@@ -8,10 +8,10 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/appmeta"
 	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/output"
 )
 
 func newPreflightCtx(appID string, brand core.LarkBrand, identity core.Identity, keyDef *eventlib.KeyDefinition, appVer *appmeta.AppVersion) *preflightCtx {
@@ -89,19 +89,17 @@ func TestPreflightEventTypes_MissingBlocks(t *testing.T) {
 	if !strings.Contains(err.Error(), "mail.user_mailbox.event.message_read_v1") {
 		t.Errorf("error should name the missing event type, got: %v", err)
 	}
-	var exit *output.ExitError
-	if !errors.As(err, &exit) {
-		t.Fatalf("expected output.ExitError, got %T: %v", err, err)
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
 	}
-	if exit.Code != output.ExitValidation {
-		t.Errorf("ExitCode = %d, want ExitValidation (%d)", exit.Code, output.ExitValidation)
-	}
-	if exit.Detail == nil {
-		t.Fatal("expected Detail with hint")
+	if p.Category != errs.CategoryValidation || p.Subtype != errs.SubtypeFailedPrecondition {
+		t.Errorf("problem = %s/%s, want %s/%s", p.Category, p.Subtype,
+			errs.CategoryValidation, errs.SubtypeFailedPrecondition)
 	}
 	wantURL := "https://open.feishu.cn/app/cli_XXXXXXXXXXXXXXXX/event"
-	if !strings.Contains(exit.Detail.Hint, wantURL) {
-		t.Errorf("hint missing subscription URL %q\ngot: %s", wantURL, exit.Detail.Hint)
+	if !strings.Contains(p.Hint, wantURL) {
+		t.Errorf("hint missing subscription URL %q\ngot: %s", wantURL, p.Hint)
 	}
 }
 
@@ -145,17 +143,19 @@ func TestPreflightScopes_Bot_MissingBlocks(t *testing.T) {
 	if !strings.Contains(err.Error(), "im:message.group_at_msg") {
 		t.Errorf("error should name missing scope, got: %v", err)
 	}
-	var exit *output.ExitError
-	if !errors.As(err, &exit) {
-		t.Fatalf("expected output.ExitError, got %T: %v", err, err)
+	var permErr *errs.PermissionError
+	if !errors.As(err, &permErr) {
+		t.Fatalf("expected *errs.PermissionError, got %T: %v", err, err)
 	}
-	if exit.Code != output.ExitAuth {
-		t.Errorf("ExitCode = %d, want ExitAuth (%d)", exit.Code, output.ExitAuth)
+	if permErr.Category != errs.CategoryAuthorization || permErr.Subtype != errs.SubtypeMissingScope {
+		t.Errorf("problem = %s/%s, want %s/%s", permErr.Category, permErr.Subtype,
+			errs.CategoryAuthorization, errs.SubtypeMissingScope)
 	}
-	if exit.Detail == nil {
-		t.Fatal("expected Detail with hint, got nil Detail")
+	wantMissing := []string{"im:message.group_at_msg"}
+	if len(permErr.MissingScopes) != 1 || permErr.MissingScopes[0] != wantMissing[0] {
+		t.Errorf("MissingScopes = %v, want %v", permErr.MissingScopes, wantMissing)
 	}
-	hint := exit.Detail.Hint
+	hint := permErr.Hint
 	wantSubstrings := []string{
 		"https://open.feishu.cn/app/cli_x/auth?q=",
 		"im:message.group_at_msg",

cmd/event/runtime.go

@@ -6,8 +6,8 @@ package event
 import (
 	"context"
 	"encoding/json"
-	"fmt"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/core"
 )
@@ -26,7 +26,11 @@ func (r *consumeRuntime) CallAPI(ctx context.Context, method, path string, body
 		As:     r.accessIdentity,
 	})
 	if err != nil {
-		return nil, err
+		if _, ok := errs.ProblemOf(err); ok {
+			return nil, err
+		}
+		return nil, errs.NewNetworkError(errs.SubtypeNetworkTransport,
+			"api %s %s: %s", method, path, err).WithCause(err)
 	}
 	// Non-JSON HTTP errors (gateway text/plain 404 etc.) skip OAPI envelope parsing.
 	ct := resp.Header.Get("Content-Type")
@@ -36,11 +40,20 @@ func (r *consumeRuntime) CallAPI(ctx context.Context, method, path string, body
 		if len(body) > maxBodyEcho {
 			body = body[:maxBodyEcho] + "…(truncated)"
 		}
-		return nil, fmt.Errorf("api %s %s returned %d: %s", method, path, resp.StatusCode, body)
+		if resp.StatusCode >= 500 {
+			return nil, errs.NewNetworkError(errs.SubtypeNetworkServer,
+				"api %s %s returned %d: %s", method, path, resp.StatusCode, body).WithRetryable()
+		}
+		return nil, errs.NewInternalError(errs.SubtypeInvalidResponse,
+			"api %s %s returned %d: %s", method, path, resp.StatusCode, body)
 	}
 	result, err := client.ParseJSONResponse(resp)
 	if err != nil {
-		return nil, err
+		if _, ok := errs.ProblemOf(err); ok {
+			return nil, err
+		}
+		return nil, errs.NewInternalError(errs.SubtypeInvalidResponse,
+			"api %s %s: %s", method, path, err).WithCause(err)
 	}
 	if apiErr := r.client.CheckResponse(result, r.accessIdentity); apiErr != nil {
 		return json.RawMessage(resp.RawBody), apiErr

cmd/event/runtime_test.go

@@ -0,0 +1,147 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package event
+
+import (
+	"context"
+	"errors"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+
+	lark "github.com/larksuite/oapi-sdk-go/v3"
+	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/client"
+	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/credential"
+)
+
+// staticTokenResolver always returns a fixed token without any HTTP calls.
+type staticTokenResolver struct{}
+
+func (s *staticTokenResolver) ResolveToken(_ context.Context, _ credential.TokenSpec) (*credential.TokenResult, error) {
+	return &credential.TokenResult{Token: "test-token"}, nil
+}
+
+// stubRoundTripper intercepts every outgoing request with a canned response.
+type stubRoundTripper struct {
+	respond func(*http.Request) (*http.Response, error)
+}
+
+func (s stubRoundTripper) RoundTrip(r *http.Request) (*http.Response, error) { return s.respond(r) }
+
+func newTestConsumeRuntime(rt http.RoundTripper) *consumeRuntime {
+	sdk := lark.NewClient("test-app", "test-secret",
+		lark.WithEnableTokenCache(false),
+		lark.WithLogLevel(larkcore.LogLevelError),
+		lark.WithHttpClient(&http.Client{Transport: rt}),
+	)
+	return &consumeRuntime{
+		client: &client.APIClient{
+			SDK:        sdk,
+			ErrOut:     io.Discard,
+			Credential: credential.NewCredentialProvider(nil, nil, &staticTokenResolver{}, nil),
+			Config:     &core.CliConfig{AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu},
+		},
+		accessIdentity: core.AsBot,
+	}
+}
+
+func stubResponse(status int, contentType, body string) func(*http.Request) (*http.Response, error) {
+	return func(r *http.Request) (*http.Response, error) {
+		return &http.Response{
+			StatusCode: status,
+			Header:     http.Header{"Content-Type": []string{contentType}},
+			Body:       io.NopCloser(strings.NewReader(body)),
+			Request:    r,
+		}, nil
+	}
+}
+
+func requireCallAPIProblem(t *testing.T, err error, category errs.Category, subtype errs.Subtype) {
+	t.Helper()
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != category || p.Subtype != subtype {
+		t.Fatalf("problem = %s/%s, want %s/%s", p.Category, p.Subtype, category, subtype)
+	}
+}
+
+func TestConsumeRuntimeCallAPI_NonJSONHTTPError(t *testing.T) {
+	r := newTestConsumeRuntime(stubRoundTripper{respond: stubResponse(http.StatusNotFound, "text/plain", "gone")})
+	_, err := r.CallAPI(context.Background(), "GET", "/open-apis/event/v1/connection", nil)
+	requireCallAPIProblem(t, err, errs.CategoryInternal, errs.SubtypeInvalidResponse)
+	if !strings.Contains(err.Error(), "returned 404") {
+		t.Errorf("error should echo the HTTP status, got: %v", err)
+	}
+}
+
+func TestConsumeRuntimeCallAPI_NonJSONHTTPErrorTruncatesLongBody(t *testing.T) {
+	long := strings.Repeat("x", 300)
+	r := newTestConsumeRuntime(stubRoundTripper{respond: stubResponse(http.StatusBadGateway, "text/html", long)})
+	_, err := r.CallAPI(context.Background(), "GET", "/open-apis/event/v1/connection", nil)
+	requireCallAPIProblem(t, err, errs.CategoryNetwork, errs.SubtypeNetworkServer)
+	p, _ := errs.ProblemOf(err)
+	if !p.Retryable {
+		t.Fatal("5xx non-JSON response should be marked retryable")
+	}
+	if !strings.Contains(err.Error(), "…(truncated)") {
+		t.Errorf("long body should be truncated in the message, got: %v", err)
+	}
+}
+
+func TestConsumeRuntimeCallAPI_UnparsableJSONBody(t *testing.T) {
+	r := newTestConsumeRuntime(stubRoundTripper{respond: stubResponse(http.StatusOK, "application/json", "{not json")})
+	_, err := r.CallAPI(context.Background(), "GET", "/open-apis/event/v1/connection", nil)
+	requireCallAPIProblem(t, err, errs.CategoryInternal, errs.SubtypeInvalidResponse)
+}
+
+func TestConsumeRuntimeCallAPI_TransportFailure(t *testing.T) {
+	r := newTestConsumeRuntime(stubRoundTripper{respond: func(*http.Request) (*http.Response, error) {
+		return nil, errors.New("connection refused")
+	}})
+	_, err := r.CallAPI(context.Background(), "GET", "/open-apis/event/v1/connection", nil)
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != errs.CategoryNetwork {
+		t.Fatalf("category = %s, want %s", p.Category, errs.CategoryNetwork)
+	}
+}
+
+func TestConsumeRuntimeCallAPI_EnvelopeErrorIsTyped(t *testing.T) {
+	r := newTestConsumeRuntime(stubRoundTripper{respond: stubResponse(http.StatusOK, "application/json",
+		`{"code":99991663,"msg":"app not found"}`)})
+	_, err := r.CallAPI(context.Background(), "GET", "/open-apis/event/v1/connection", nil)
+	if err == nil {
+		t.Fatal("expected error, got nil")
+	}
+	if _, ok := errs.ProblemOf(err); !ok {
+		t.Fatalf("envelope error should be typed via BuildAPIError, got %T: %v", err, err)
+	}
+}
+
+func TestConsumeRuntimeCallAPI_Success(t *testing.T) {
+	r := newTestConsumeRuntime(stubRoundTripper{respond: stubResponse(http.StatusOK, "application/json",
+		`{"code":0,"data":{"ok":true}}`)})
+	raw, err := r.CallAPI(context.Background(), "GET", "/open-apis/event/v1/connection", nil)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(string(raw), `"code":0`) {
+		t.Errorf("raw body should pass through, got: %s", raw)
+	}
+}

cmd/event/schema.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	eventlib "github.com/larksuite/cli/internal/event"
 	"github.com/larksuite/cli/internal/event/schemas"
@@ -39,12 +40,14 @@ func resolveSchemaJSON(def *eventlib.KeyDefinition) (json.RawMessage, []string,
 	if len(def.Schema.FieldOverrides) > 0 {
 		var parsed map[string]interface{}
 		if err := json.Unmarshal(base, &parsed); err != nil {
-			return nil, nil, err
+			return nil, nil, errs.NewInternalError(errs.SubtypeUnknown,
+				"parse base schema for field overrides: %s", err).WithCause(err)
 		}
 		orphans := schemas.ApplyFieldOverrides(parsed, def.Schema.FieldOverrides)
 		out, err := json.Marshal(parsed)
 		if err != nil {
-			return nil, nil, err
+			return nil, nil, errs.NewInternalError(errs.SubtypeUnknown,
+				"serialize schema with field overrides: %s", err).WithCause(err)
 		}
 		return out, orphans, nil
 	}
@@ -73,7 +76,7 @@ func renderSpec(s *eventlib.SchemaSpec) (json.RawMessage, error) {
 		copy(buf, s.Raw)
 		return buf, nil
 	}
-	return nil, fmt.Errorf("schemaSpec has neither Type nor Raw")
+	return nil, errs.NewInternalError(errs.SubtypeUnknown, "schemaSpec has neither Type nor Raw")
 }
 
 func NewCmdSchema(f *cmdutil.Factory) *cobra.Command {
@@ -131,12 +134,16 @@ func runSchema(f *cmdutil.Factory, key string, asJSON bool) error {
 	if len(def.Params) > 0 {
 		fmt.Fprintf(out, "\nParameters:\n")
 		w := tabwriter.NewWriter(out, 0, 4, 2, ' ', 0)
-		fmt.Fprintf(w, "  NAME\tTYPE\tREQUIRED\tDEFAULT\tDESCRIPTION\n")
+		fmt.Fprintf(w, "  NAME\tTYPE\tREQUIRED\tSUB-KEY\tDEFAULT\tDESCRIPTION\n")
 		for _, p := range def.Params {
 			required := "no"
 			if p.Required {
 				required = "yes"
 			}
+			subKey := "no"
+			if p.SubscriptionKey {
+				subKey = "yes"
+			}
 			defaultVal := p.Default
 			if defaultVal == "" {
 				defaultVal = "-"
@@ -145,7 +152,7 @@ func runSchema(f *cmdutil.Factory, key string, asJSON bool) error {
 			if desc == "" {
 				desc = "-"
 			}
-			fmt.Fprintf(w, "  %s\t%s\t%s\t%s\t%s\n", p.Name, p.Type, required, defaultVal, desc)
+			fmt.Fprintf(w, "  %s\t%s\t%s\t%s\t%s\t%s\n", p.Name, p.Type, required, subKey, defaultVal, desc)
 		}
 		w.Flush()
 
@@ -165,7 +172,7 @@ func runSchema(f *cmdutil.Factory, key string, asJSON bool) error {
 
 	resolved, _, err := resolveSchemaJSON(def)
 	if err != nil {
-		return output.Errorf(output.ExitInternal, "internal", "resolve schema: %v", err)
+		return err
 	}
 	if resolved != nil {
 		fmt.Fprintf(out, "\nOutput Schema:\n")

cmd/event/schema_test.go

@@ -10,6 +10,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	eventlib "github.com/larksuite/cli/internal/event"
@@ -95,6 +96,79 @@ func TestRunSchema_JSONOutput(t *testing.T) {
 	}
 }
 
+func TestSchema_RendersSubscriptionKeyMarker(t *testing.T) {
+	const syntheticKey = "test.evt_sub"
+	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })
+
+	eventlib.RegisterKey(eventlib.KeyDefinition{
+		Key:       syntheticKey,
+		EventType: syntheticKey,
+		Params: []eventlib.ParamDef{
+			{Name: "mailbox", SubscriptionKey: true, Description: "subscription id source"},
+			{Name: "folders", Description: "filter only"},
+		},
+		Schema: eventlib.SchemaDef{Native: &eventlib.SchemaSpec{Type: reflect.TypeOf(struct{ X string }{})}},
+	})
+
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	if err := runSchema(f, syntheticKey, false); err != nil {
+		t.Fatalf("runSchema: %v", err)
+	}
+
+	out := stdout.String()
+	if !strings.Contains(out, "SUB-KEY") {
+		t.Errorf("missing SUB-KEY column header in:\n%s", out)
+	}
+
+	// Find the mailbox row and verify "yes" is present
+	var mailboxRow string
+	for _, ln := range strings.Split(out, "\n") {
+		if strings.Contains(ln, "mailbox") && !strings.Contains(ln, "NAME") {
+			mailboxRow = ln
+			break
+		}
+	}
+	if !strings.Contains(mailboxRow, "yes") {
+		t.Errorf("mailbox row missing yes SUB-KEY marker: %q", mailboxRow)
+	}
+
+	// Find the folders row and verify "no" is present
+	var foldersRow string
+	for _, ln := range strings.Split(out, "\n") {
+		if strings.Contains(ln, "folders") && !strings.Contains(ln, "NAME") {
+			foldersRow = ln
+			break
+		}
+	}
+	if !strings.Contains(foldersRow, "no") {
+		t.Errorf("folders row missing no SUB-KEY marker: %q", foldersRow)
+	}
+}
+
+func TestSchema_JSON_IncludesSubscriptionKey(t *testing.T) {
+	const syntheticKey = "test.evt_json"
+	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })
+
+	eventlib.RegisterKey(eventlib.KeyDefinition{
+		Key:       syntheticKey,
+		EventType: syntheticKey,
+		Params:    []eventlib.ParamDef{{Name: "mailbox", SubscriptionKey: true}},
+		Schema:    eventlib.SchemaDef{Native: &eventlib.SchemaSpec{Type: reflect.TypeOf(struct{ X string }{})}},
+	})
+
+	f, stdout, _, _ := cmdutil.TestFactory(t, &core.CliConfig{AppID: "test"})
+	if err := runSchema(f, syntheticKey, true); err != nil {
+		t.Fatalf("runSchema json: %v", err)
+	}
+
+	if !strings.Contains(stdout.String(), `"subscription_key"`) {
+		t.Errorf("JSON output missing subscription_key field: %s", stdout.String())
+	}
+	if !strings.Contains(stdout.String(), `true`) {
+		t.Errorf("JSON output missing subscription_key: true value: %s", stdout.String())
+	}
+}
+
 func TestResolveSchemaJSON_CustomWithOverlay(t *testing.T) {
 	const syntheticKey = "t.custom.overlay"
 	t.Cleanup(func() { eventlib.UnregisterKeyForTest(syntheticKey) })
@@ -129,3 +203,38 @@ func TestResolveSchemaJSON_CustomWithOverlay(t *testing.T) {
 		t.Errorf("overlay format = %v, want open_id", got)
 	}
 }
+
+func TestRenderSpec_EmptySpecIsTypedInternalError(t *testing.T) {
+	_, err := renderSpec(&eventlib.SchemaSpec{})
+	if err == nil {
+		t.Fatal("expected error for spec with neither Type nor Raw")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != errs.CategoryInternal {
+		t.Errorf("category = %s, want %s", p.Category, errs.CategoryInternal)
+	}
+}
+
+func TestResolveSchemaJSON_InvalidBaseWithOverridesIsTypedInternalError(t *testing.T) {
+	def := &eventlib.KeyDefinition{
+		Key: "synthetic.invalid.base",
+		Schema: eventlib.SchemaDef{
+			Custom:         &eventlib.SchemaSpec{Raw: json.RawMessage("{not json")},
+			FieldOverrides: map[string]schemas.FieldMeta{"x": {}},
+		},
+	}
+	_, _, err := resolveSchemaJSON(def)
+	if err == nil {
+		t.Fatal("expected error for unparsable base schema")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed errs error, got %T: %v", err, err)
+	}
+	if p.Category != errs.CategoryInternal {
+		t.Errorf("category = %s, want %s", p.Category, errs.CategoryInternal)
+	}
+}

cmd/event/status.go

@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"io"
 	"sort"
+	"strings"
 	"sync"
 	"time"
 
@@ -242,12 +243,17 @@ func writeStatusText(out io.Writer, statuses []appStatus) {
 				s.PID, (time.Duration(s.UptimeSec) * time.Second).String())
 			fmt.Fprintf(out, "  Active consumers: %d\n", s.Active)
 			if len(s.Consumers) > 0 {
-				headers := []string{"CONSUMER", "EVENT KEY", "RECEIVED", "DROPPED"}
+				headers := []string{"CONSUMER", "EVENT KEY", "SUB", "RECEIVED", "DROPPED"}
 				rows := make([][]string, 0, len(s.Consumers))
 				for _, c := range s.Consumers {
+					subDisplay := "-"
+					if c.SubscriptionID != "" && c.SubscriptionID != c.EventKey {
+						subDisplay = strings.TrimPrefix(c.SubscriptionID, c.EventKey+":")
+					}
 					rows = append(rows, []string{
 						fmt.Sprintf("pid=%d", c.PID),
 						c.EventKey,
+						subDisplay,
 						fmt.Sprintf("%d", c.Received),
 						fmt.Sprintf("%d", c.Dropped),
 					})

cmd/event/suggestions.go

@@ -8,8 +8,8 @@ import (
 	"sort"
 	"strings"
 
+	"github.com/larksuite/cli/errs"
 	eventlib "github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/suggest"
 )
 
@@ -64,9 +64,6 @@ func unknownEventKeyErr(key string) error {
 	if guesses := suggestEventKeys(key); len(guesses) > 0 {
 		msg += " — did you mean " + formatSuggestions(guesses) + "?"
 	}
-	return output.ErrWithHint(
-		output.ExitValidation, "validation",
-		msg,
-		"Run 'lark-cli event list' to see available keys.",
-	)
+	return errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", msg).
+		WithHint("Run 'lark-cli event list' to see available keys.")
 }

cmd/root.go

@@ -36,7 +36,7 @@ const rootLong = `lark-cli — Lark/Feishu CLI tool.
 USAGE:
     lark-cli <command> [subcommand] [method] [options]
     lark-cli api <method> <path> [--params <json>] [--data <json>]
-    lark-cli schema <service.resource.method> [--format pretty]
+    lark-cli schema <service.resource.method>
 
 EXAMPLES:
     # View upcoming events

cmd/root_integration_test.go

@@ -377,9 +377,9 @@ func TestIntegration_Shortcut_BusinessError_OutputsEnvelope(t *testing.T) {
 		OK:       false,
 		Identity: "bot",
 		Error: &output.ErrDetail{
-			Type:    "api_error",
+			Type:    "api",
 			Code:    230002,
-			Message: "HTTP 400: Bot/User can NOT be out of the chat.",
+			Message: "Bot/User can NOT be out of the chat.",
 		},
 	})
 }

cmd/schema/schema.go

@@ -5,17 +5,17 @@ package schema
 
 import (
 	"context"
-	"fmt"
+	"errors"
 	"io"
-	"sort"
 	"strings"
 
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
 	"github.com/larksuite/cli/internal/schema"
-	"github.com/larksuite/cli/internal/util"
 	"github.com/spf13/cobra"
 )
 
@@ -24,336 +24,10 @@ type SchemaOptions struct {
 	Factory *cmdutil.Factory
 	Ctx     context.Context
 
-	// Positional args
-	Path      string   // first positional, when only one is given
-	ExtraArgs []string // 2nd+ positional args (space-separated form)
-
-	// Flags
-	Format string
-}
-
-func printServices(w io.Writer) {
-	services := registry.ListFromMetaProjects()
-	fmt.Fprintf(w, "%sAvailable services:%s\n\n", output.Bold, output.Reset)
-	for _, s := range services {
-		spec := registry.LoadFromMeta(s)
-		title := registry.GetStrFromMap(spec, "title")
-		if title == "" {
-			title = registry.GetStrFromMap(spec, "description")
-		}
-		fmt.Fprintf(w, "  %s%s%s  %s%s%s\n", output.Cyan, s, output.Reset, output.Dim, title, output.Reset)
-	}
-	fmt.Fprintf(w, "\n%sUsage: lark-cli schema <service>.<resource>.<method>%s\n", output.Dim, output.Reset)
-}
-
-func printResourceList(w io.Writer, spec map[string]interface{}, mode core.StrictMode) {
-	name := registry.GetStrFromMap(spec, "name")
-	version := registry.GetStrFromMap(spec, "version")
-	title := registry.GetStrFromMap(spec, "title")
-	if title == "" {
-		title = registry.GetStrFromMap(spec, "description")
-	}
-	servicePath := registry.GetStrFromMap(spec, "servicePath")
-
-	fmt.Fprintf(w, "%s%s%s (%s) — %s\n\n", output.Bold, name, output.Reset, version, title)
-	fmt.Fprintf(w, "%sBase path: %s%s\n\n", output.Dim, servicePath, output.Reset)
-
-	resources, _ := spec["resources"].(map[string]interface{})
-	for _, resName := range sortedKeys(resources) {
-		resMap, _ := resources[resName].(map[string]interface{})
-		methods, _ := resMap["methods"].(map[string]interface{})
-		methods = filterMethodsByStrictMode(methods, mode)
-		if len(methods) == 0 {
-			continue
-		}
-		fmt.Fprintf(w, "  %s%s%s\n", output.Cyan, resName, output.Reset)
-		for _, methodName := range sortedKeys(methods) {
-			m, _ := methods[methodName].(map[string]interface{})
-			httpMethod := registry.GetStrFromMap(m, "httpMethod")
-			desc := registry.GetStrFromMap(m, "description")
-			danger := ""
-			if d, _ := m["danger"].(bool); d {
-				danger = fmt.Sprintf(" %s[danger]%s", output.Red, output.Reset)
-			}
-			fmt.Fprintf(w, "    %-7s %s%s%s  %s%s%s%s\n", httpMethod, output.Bold, methodName, output.Reset, output.Dim, desc, output.Reset, danger)
-		}
-		fmt.Fprintln(w)
-	}
-	fmt.Fprintf(w, "%sUsage: lark-cli schema %s.<resource>.<method>%s\n", output.Dim, name, output.Reset)
-}
-
-// hasFileFields returns true if any requestBody field has type "file".
-func hasFileFields(method map[string]interface{}) (bool, []string) {
-	names := cmdutil.DetectFileFields(method)
-	return len(names) > 0, names
-}
-
-func printMethodDetail(w io.Writer, spec map[string]interface{}, resName, methodName string, method map[string]interface{}) {
-	servicePath := registry.GetStrFromMap(spec, "servicePath")
-	specName := registry.GetStrFromMap(spec, "name")
-	methodPath := registry.GetStrFromMap(method, "path")
-	fullPath := servicePath + "/" + methodPath
-	httpMethod := registry.GetStrFromMap(method, "httpMethod")
-	desc := registry.GetStrFromMap(method, "description")
-	isFileUpload, fileFieldNames := hasFileFields(method)
-
-	fmt.Fprintf(w, "%s%s.%s.%s%s\n\n", output.Bold, specName, resName, methodName, output.Reset)
-
-	httpColor := output.Yellow
-	if httpMethod == "GET" {
-		httpColor = output.Green
-	} else if httpMethod == "DELETE" {
-		httpColor = output.Red
-	}
-	fmt.Fprintf(w, "  %s%s%s %s\n", httpColor, httpMethod, output.Reset, fullPath)
-	if desc != "" {
-		fmt.Fprintf(w, "  %s\n", desc)
-	}
-	fmt.Fprintln(w)
-
-	// Parameters
-	params, _ := method["parameters"].(map[string]interface{})
-	if len(params) > 0 {
-		fmt.Fprintf(w, "%sParameters:%s\n\n", output.Bold, output.Reset)
-		fmt.Fprintf(w, "  %s--params%s  <json>  %soptional%s\n", output.Cyan, output.Reset, output.Dim, output.Reset)
-		for _, paramName := range sortedParamKeys(params) {
-			p, _ := params[paramName].(map[string]interface{})
-			pType := registry.GetStrFromMap(p, "type")
-			if pType == "" {
-				pType = "string"
-			}
-			location := registry.GetStrFromMap(p, "location")
-			required, _ := p["required"].(bool)
-			reqStr := fmt.Sprintf("%soptional%s", output.Dim, output.Reset)
-			if required {
-				reqStr = fmt.Sprintf("%srequired%s", output.Red, output.Reset)
-			}
-			locColor := output.Dim
-			if location == "path" {
-				locColor = output.Yellow
-			}
-			// Options (enum values)
-			optStr := formatOptions(p)
-			fmt.Fprintf(w, "      - %s%s%s (%s, %s%s%s, %s)%s\n", output.Cyan, paramName, output.Reset, pType, locColor, location, output.Reset, reqStr, optStr)
-			if pdesc := registry.GetStrFromMap(p, "description"); pdesc != "" {
-				pdesc = util.TruncateStrWithEllipsis(pdesc, 100)
-				fmt.Fprintf(w, "        %s%s%s\n", output.Dim, pdesc, output.Reset)
-			}
-			if ex := registry.GetStrFromMap(p, "example"); ex != "" {
-				fmt.Fprintf(w, "        %se.g. %s%s\n", output.Dim, ex, output.Reset)
-			}
-			if rangeStr := formatRange(p); rangeStr != "" {
-				fmt.Fprintf(w, "        %srange: %s%s\n", output.Dim, rangeStr, output.Reset)
-			}
-		}
-		fmt.Fprintln(w)
-	}
-
-	// --data for write methods
-	if httpMethod == "POST" || httpMethod == "PUT" || httpMethod == "PATCH" || httpMethod == "DELETE" {
-		if len(params) == 0 {
-			fmt.Fprintf(w, "%sParameters:%s\n\n", output.Bold, output.Reset)
-		}
-		fileUploadTag := ""
-		if isFileUpload {
-			fileUploadTag = fmt.Sprintf("  %s[file upload]%s", output.Yellow, output.Reset)
-		}
-		fmt.Fprintf(w, "  %s--data%s  <json>  %soptional%s%s\n", output.Cyan, output.Reset, output.Dim, output.Reset, fileUploadTag)
-		requestBody, _ := method["requestBody"].(map[string]interface{})
-		if len(requestBody) > 0 {
-			printNestedFields(w, requestBody, "      ", "")
-		}
-
-		if isFileUpload {
-			if len(fileFieldNames) == 1 {
-				fmt.Fprintf(w, "\n  %s--file%s  <[field=]path>  %sfile upload%s\n", output.Cyan, output.Reset, output.Dim, output.Reset)
-				fmt.Fprintf(w, "      Upload file as multipart/form-data. Default field: %q\n", fileFieldNames[0])
-			} else {
-				fmt.Fprintf(w, "\n  %s--file%s  <field=path>  %sfile upload%s\n", output.Cyan, output.Reset, output.Dim, output.Reset)
-				fmt.Fprintf(w, "      Upload file as multipart/form-data. Fields: %s\n", strings.Join(fileFieldNames, ", "))
-			}
-		}
-		fmt.Fprintln(w)
-	}
-
-	// Response
-	responseBody, _ := method["responseBody"].(map[string]interface{})
-	if len(responseBody) > 0 {
-		fmt.Fprintf(w, "%sResponse:%s\n\n", output.Bold, output.Reset)
-		printNestedFields(w, responseBody, "  ", "")
-		fmt.Fprintln(w)
-	}
-
-	// Identity
-	if tokens, ok := method["accessTokens"].([]interface{}); ok && len(tokens) > 0 {
-		var identities []string
-		for _, t := range tokens {
-			if s, ok := t.(string); ok {
-				switch s {
-				case "user":
-					identities = append(identities, "user")
-				case "tenant":
-					identities = append(identities, "bot")
-				}
-			}
-		}
-		if len(identities) > 0 {
-			fmt.Fprintf(w, "%sIdentity:%s %s\n", output.Bold, output.Reset, strings.Join(identities, ", "))
-		}
-	}
-
-	// Scopes (all)
-	if scopes, ok := method["scopes"].([]interface{}); ok && len(scopes) > 0 {
-		var scopeStrs []string
-		for _, s := range scopes {
-			if str, ok := s.(string); ok {
-				scopeStrs = append(scopeStrs, str)
-			}
-		}
-		fmt.Fprintf(w, "%sScopes:%s   %s\n", output.Bold, output.Reset, strings.Join(scopeStrs, ", "))
-	}
-
-	// CLI example
-	if isFileUpload && len(fileFieldNames) == 1 {
-		fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s --file <path>\n", output.Bold, output.Reset, specName, resName, methodName)
-	} else if isFileUpload {
-		fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s --file <field=path>\n", output.Bold, output.Reset, specName, resName, methodName)
-	} else {
-		fmt.Fprintf(w, "%sCLI:%s      lark-cli %s %s %s\n", output.Bold, output.Reset, specName, resName, methodName)
-	}
-
-	// Docs
-	if docUrl := registry.GetStrFromMap(method, "docUrl"); docUrl != "" {
-		fmt.Fprintf(w, "%sDocs:%s     %s\n", output.Bold, output.Reset, docUrl)
-	}
-}
-
-func printNestedFields(w io.Writer, fields map[string]interface{}, indent, prefix string) {
-	for _, fieldName := range sortedFieldKeys(fields) {
-		f, _ := fields[fieldName].(map[string]interface{})
-		fullName := fieldName
-		if prefix != "" {
-			fullName = prefix + "." + fieldName
-		}
-		fType := registry.GetStrFromMap(f, "type")
-		required, _ := f["required"].(bool)
-		reqStr := fmt.Sprintf("%soptional%s", output.Dim, output.Reset)
-		if required {
-			reqStr = fmt.Sprintf("%srequired%s", output.Red, output.Reset)
-		}
-		optStr := formatOptions(f)
-		fmt.Fprintf(w, "%s- %s%s%s (%s, %s)%s\n", indent, output.Cyan, fullName, output.Reset, fType, reqStr, optStr)
-		desc := registry.GetStrFromMap(f, "description")
-		if desc != "" {
-			desc = util.TruncateStrWithEllipsis(desc, 100)
-			fmt.Fprintf(w, "%s  %s%s%s\n", indent, output.Dim, desc, output.Reset)
-		}
-		if ex := registry.GetStrFromMap(f, "example"); ex != "" {
-			fmt.Fprintf(w, "%s  %se.g. %s%s\n", indent, output.Dim, ex, output.Reset)
-		}
-		if rangeStr := formatRange(f); rangeStr != "" {
-			fmt.Fprintf(w, "%s  %srange: %s%s\n", indent, output.Dim, rangeStr, output.Reset)
-		}
-		if props, ok := f["properties"].(map[string]interface{}); ok && len(props) > 0 {
-			printNestedFields(w, props, indent+"  ", fullName)
-		}
-	}
-}
-
-// formatOptions returns " — val1 | val2 | ..." if field has options, else "".
-func formatOptions(f map[string]interface{}) string {
-	opts, ok := f["options"].([]interface{})
-	if !ok || len(opts) == 0 {
-		return ""
-	}
-	var vals []string
-	for _, o := range opts {
-		if om, ok := o.(map[string]interface{}); ok {
-			if v := registry.GetStrFromMap(om, "value"); v != "" {
-				vals = append(vals, v)
-			}
-		}
-	}
-	if len(vals) == 0 {
-		return ""
-	}
-	return fmt.Sprintf(" %s— %s%s", output.Dim, strings.Join(vals, " | "), output.Reset)
-}
-
-// formatRange returns "min..max" if field has min/max, else "".
-func formatRange(f map[string]interface{}) string {
-	minVal := registry.GetStrFromMap(f, "min")
-	maxVal := registry.GetStrFromMap(f, "max")
-	if minVal == "" && maxVal == "" {
-		return ""
-	}
-	if minVal != "" && maxVal != "" {
-		return minVal + ".." + maxVal
-	}
-	if minVal != "" {
-		return ">=" + minVal
-	}
-	return "<=" + maxVal
-}
-
-// sortedKeys returns map keys in alphabetical order.
-func sortedKeys(m map[string]interface{}) []string {
-	keys := make([]string, 0, len(m))
-	for k := range m {
-		keys = append(keys, k)
-	}
-	sort.Strings(keys)
-	return keys
-}
-
-// sortedParamKeys returns parameter keys sorted: required first, then alphabetical.
-func sortedParamKeys(params map[string]interface{}) []string {
-	keys := make([]string, 0, len(params))
-	for k := range params {
-		keys = append(keys, k)
-	}
-	sort.Slice(keys, func(i, j int) bool {
-		pi, _ := params[keys[i]].(map[string]interface{})
-		pj, _ := params[keys[j]].(map[string]interface{})
-		ri, _ := pi["required"].(bool)
-		rj, _ := pj["required"].(bool)
-		if ri != rj {
-			return ri
-		}
-		return keys[i] < keys[j]
-	})
-	return keys
-}
-
-// sortedFieldKeys returns field keys sorted: required first, then alphabetical.
-func sortedFieldKeys(fields map[string]interface{}) []string {
-	keys := make([]string, 0, len(fields))
-	for k := range fields {
-		keys = append(keys, k)
-	}
-	sort.Slice(keys, func(i, j int) bool {
-		fi, _ := fields[keys[i]].(map[string]interface{})
-		fj, _ := fields[keys[j]].(map[string]interface{})
-		ri, _ := fi["required"].(bool)
-		rj, _ := fj["required"].(bool)
-		if ri != rj {
-			return ri
-		}
-		return keys[i] < keys[j]
-	})
-	return keys
-}
-
-func findResourceByPath(resources map[string]interface{}, parts []string) (map[string]interface{}, string, []string) {
-	for i := len(parts); i >= 1; i-- {
-		candidateName := strings.Join(parts[:i], ".")
-		if res, ok := resources[candidateName]; ok {
-			if resMap, ok := res.(map[string]interface{}); ok {
-				return resMap, candidateName, parts[i:]
-			}
-		}
-	}
-	return nil, "", nil
+	// Args are the positional path segments, in either the dotted single-arg
+	// form ("im.messages.reply") or the space-separated form ("im messages
+	// reply"); apicatalog.ParsePath normalizes both.
+	Args []string
 }
 
 // NewCmdSchema creates the schema command. If runF is non-nil it is called instead of schemaRun (test hook).
@@ -365,12 +39,7 @@ func NewCmdSchema(f *cmdutil.Factory, runF func(*SchemaOptions) error) *cobra.Co
 		Short: "View API method parameters, types, and scopes",
 		Args:  cobra.MaximumNArgs(8),
 		RunE: func(cmd *cobra.Command, args []string) error {
-			if len(args) > 0 {
-				opts.Path = args[0]
-			}
-			if len(args) > 1 {
-				opts.ExtraArgs = args[1:]
-			}
+			opts.Args = append([]string(nil), args...)
 			opts.Ctx = cmd.Context()
 			if runF != nil {
 				return runF(opts)
@@ -380,433 +49,89 @@ func NewCmdSchema(f *cmdutil.Factory, runF func(*SchemaOptions) error) *cobra.Co
 	}
 	cmdutil.DisableAuthCheck(cmd)
 
+	// Tolerated for agent compatibility; ignored — schema only emits the JSON
+	// envelope, and its output is identity-independent (strict-mode filtering
+	// comes from ResolveStrictMode, never from --as).
+	cmd.Flags().String("format", "json", "")
+	cmd.Flags().Bool("json", true, "")
+	cmd.Flags().String("as", "", "")
+	_ = cmd.Flags().MarkHidden("format")
+	_ = cmd.Flags().MarkHidden("json")
+	_ = cmd.Flags().MarkHidden("as")
+
 	cmd.ValidArgsFunction = completeSchemaPath(f)
-	cmd.Flags().StringVar(&opts.Format, "format", "json", "output format: json (default) | pretty")
-	cmdutil.RegisterFlagCompletion(cmd, "format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
-		return []string{"json", "pretty"}, cobra.ShellCompDirectiveNoFileComp
-	})
 	cmdutil.SetRisk(cmd, cmdutil.RiskRead)
 
 	return cmd
 }
 
-// completeSchemaPath provides tab-completion for the schema path argument.
-// It handles both legacy dotted resource names (e.g. app.table.fields) and the
-// newer space-separated form (e.g. `schema im messages reply`).
+// completeSchemaPath is a thin adapter over the embedded catalog's Complete.
+// It uses the embedded source so completion candidates match what `schema`
+// execution can resolve (both overlay-free).
 func completeSchemaPath(f *cmdutil.Factory) func(*cobra.Command, []string, string) ([]string, cobra.ShellCompDirective) {
 	return func(cmd *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
 		mode := f.ResolveStrictMode(cmd.Context())
-
-		// Case 1: legacy "single dotted arg" path — no previous args yet
-		if len(args) == 0 {
-			parts := strings.Split(toComplete, ".")
-			if len(parts) <= 1 {
-				var completions []string
-				for _, s := range registry.ListFromMetaProjects() {
-					if strings.HasPrefix(s, toComplete) {
-						completions = append(completions, s+".")
-					}
-				}
-				return completions, cobra.ShellCompDirectiveNoFileComp | cobra.ShellCompDirectiveNoSpace
-			}
-			serviceName := parts[0]
-			spec := registry.LoadFromMeta(serviceName)
-			if spec == nil {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			spec = filterSpecByStrictMode(spec, mode)
-			resources, _ := spec["resources"].(map[string]interface{})
-			if resources == nil {
-				return nil, cobra.ShellCompDirectiveNoFileComp
-			}
-			afterService := strings.Join(parts[1:], ".")
-			completions := completeSchemaPathForSpec(serviceName, resources, afterService)
-			allTrailingDot := len(completions) > 0
-			for _, c := range completions {
-				if !strings.HasSuffix(c, ".") {
-					allTrailingDot = false
-					break
-				}
-			}
-			directive := cobra.ShellCompDirectiveNoFileComp
-			if allTrailingDot {
-				directive |= cobra.ShellCompDirectiveNoSpace
-			}
-			return completions, directive
+		completions, noSpace := registry.EmbeddedCatalog().Complete(args, toComplete, registry.FilterForStrictMode(mode))
+		directive := cobra.ShellCompDirectiveNoFileComp
+		if noSpace {
+			directive |= cobra.ShellCompDirectiveNoSpace
 		}
-
-		// Case 2: space-form, args already has segments
-		// Walk down service -> resource(s) -> method based on existing args
-		serviceName := args[0]
-		spec := registry.LoadFromMeta(serviceName)
-		if spec == nil {
-			return nil, cobra.ShellCompDirectiveNoFileComp
-		}
-		spec = filterSpecByStrictMode(spec, mode)
-		resources, _ := spec["resources"].(map[string]interface{})
-		if resources == nil {
-			return nil, cobra.ShellCompDirectiveNoFileComp
-		}
-
-		// args[1:] are resource path segments (possibly partial); current
-		// toComplete is the next segment under cursor.
-		consumed := args[1:]
-		resource, _, remaining := findResourceByPath(resources, consumed)
-		if resource == nil {
-			// Suggest top-level resource names that match toComplete
-			var completions []string
-			for resName := range resources {
-				if strings.HasPrefix(resName, toComplete) {
-					completions = append(completions, resName)
-				}
-			}
-			sort.Strings(completions)
-			return completions, cobra.ShellCompDirectiveNoFileComp
-		}
-		if len(remaining) > 0 {
-			// Already typed past the resource — suggest methods
-			methods, _ := resource["methods"].(map[string]interface{})
-			methods = filterMethodsByStrictMode(methods, mode)
-			var completions []string
-			for mName := range methods {
-				if strings.HasPrefix(mName, toComplete) {
-					completions = append(completions, mName)
-				}
-			}
-			sort.Strings(completions)
-			return completions, cobra.ShellCompDirectiveNoFileComp
-		}
-		// Resource matched exactly, suggest methods
-		methods, _ := resource["methods"].(map[string]interface{})
-		methods = filterMethodsByStrictMode(methods, mode)
-		var completions []string
-		for mName := range methods {
-			if strings.HasPrefix(mName, toComplete) {
-				completions = append(completions, mName)
-			}
-		}
-		sort.Strings(completions)
-		return completions, cobra.ShellCompDirectiveNoFileComp
+		return completions, directive
 	}
 }
 
-func completeSchemaPathForSpec(serviceName string, resources map[string]interface{}, afterService string) []string {
-	var completions []string
-
-	for resName, resVal := range resources {
-		if strings.HasPrefix(resName, afterService) {
-			completions = append(completions, serviceName+"."+resName+".")
-			continue
-		}
-		if !strings.HasPrefix(afterService, resName+".") {
-			continue
-		}
-		methodPrefix := afterService[len(resName)+1:]
-		resMap, _ := resVal.(map[string]interface{})
-		if resMap == nil {
-			continue
-		}
-		methods, _ := resMap["methods"].(map[string]interface{})
-		for methodName := range methods {
-			if strings.HasPrefix(methodName, methodPrefix) {
-				completions = append(completions, serviceName+"."+resName+"."+methodName)
-			}
-		}
-	}
-
-	sort.Strings(completions)
-	return completions
-}
-
 func schemaRun(opts *SchemaOptions) error {
 	out := opts.Factory.IOStreams.Out
 	mode := opts.Factory.ResolveStrictMode(opts.Ctx)
-
-	// args may have arrived as a single string (legacy single-arg path) or
-	// split into multiple — normalize to a single args slice.
-	var rawArgs []string
-	if opts.Path != "" {
-		rawArgs = []string{opts.Path}
-	}
-	if len(opts.ExtraArgs) > 0 {
-		if opts.Path != "" {
-			rawArgs = append([]string{opts.Path}, opts.ExtraArgs...)
-		} else {
-			rawArgs = append([]string(nil), opts.ExtraArgs...)
-		}
-	}
-	parts := schema.ParsePath(rawArgs)
-
-	if opts.Format == "pretty" {
-		return runPrettyMode(out, parts, mode)
-	}
-	return runJSONMode(out, parts, mode)
+	return runSchema(out, apicatalog.ParsePath(opts.Args), mode)
 }
 
-// runJSONMode dispatches list/single envelope output based on parts.
-// JSON mode uses embedded data only (bypasses remote overlay) so envelope
-// output is deterministic across machines.
-func runJSONMode(out io.Writer, parts []string, mode core.StrictMode) error {
-	filter := strictModeFilter(mode)
-
-	switch len(parts) {
-	case 0:
-		envs := schema.AssembleAll(filter)
-		output.PrintJson(out, envs)
-		return nil
-	case 1:
-		spec := registry.EmbeddedSpec(parts[0])
-		if spec == nil {
-			return errUnknownEmbeddedService(parts[0])
+// runSchema resolves the path through the embedded catalog and renders the
+// matching envelope(s). The catalog owns navigation (Resolve + MethodRefs) and
+// schema owns rendering (Envelope/Envelopes); this adapter only chooses the
+// output shape — a single resolved method renders as one envelope object,
+// anything broader as an array — and maps resolve failures to hints.
+func runSchema(out io.Writer, parts []string, mode core.StrictMode) error {
+	catalog := registry.EmbeddedCatalog()
+	target, err := catalog.Resolve(parts)
+	if err != nil {
+		return resolveError(err)
+	}
+	refs := catalog.MethodRefs(target, registry.FilterForStrictMode(mode))
+	if target.Kind == apicatalog.TargetMethod {
+		if len(refs) == 0 {
+			return errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"Method %s not available in current identity mode", target.Method.SchemaPath()).
+				WithHint("strict mode hides methods the active account identity cannot call; it is shown for an identity (user or bot) that has the required access token")
 		}
-		envs := schema.AssembleService(parts[0], spec, filter)
-		output.PrintJson(out, envs)
-		return nil
-	default:
-		return runJSONForPath(out, parts, filter)
-	}
-}
-
-// runJSONForPath handles len(parts) >= 2: try resource match first, fallback
-// to single-method match. Uses embedded data only.
-func runJSONForPath(out io.Writer, parts []string, filter schema.MethodFilter) error {
-	serviceName := parts[0]
-	spec := registry.EmbeddedSpec(serviceName)
-	if spec == nil {
-		return errUnknownEmbeddedService(serviceName)
-	}
-	resources, _ := spec["resources"].(map[string]interface{})
-	resource, resName, remaining := findResourceByPath(resources, parts[1:])
-	if resource == nil {
-		var names []string
-		for k := range resources {
-			names = append(names, k)
-		}
-		sort.Strings(names)
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Unknown resource: %s.%s", serviceName, strings.Join(parts[1:], ".")),
-			fmt.Sprintf("Available: %s", strings.Join(names, ", ")))
-	}
-	if len(remaining) == 0 {
-		// Resource-scoped envelope array
-		envs := assembleResource(serviceName, resName, resource, filter)
-		output.PrintJson(out, envs)
+		output.PrintJson(out, schema.EnvelopeOf(refs[0]))
 		return nil
 	}
-	methodName := remaining[0]
-	methods, _ := resource["methods"].(map[string]interface{})
-	method, ok := methods[methodName].(map[string]interface{})
-	if !ok {
-		var names []string
-		for k := range methods {
-			names = append(names, k)
-		}
-		sort.Strings(names)
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Unknown method: %s.%s.%s", serviceName, resName, methodName),
-			fmt.Sprintf("Available: %s", strings.Join(names, ", ")))
-	}
-	if len(remaining) > 1 {
-		// Method exists but caller appended extra segments — reject so they
-		// don't silently get this method's schema when they typo'd the path.
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Unknown path: %s.%s.%s",
-				serviceName, resName, strings.Join(remaining, ".")),
-			fmt.Sprintf("Method %q exists but the trailing segments %q do not resolve",
-				methodName, strings.Join(remaining[1:], ".")))
-	}
-	if filter != nil && !filter(method) {
-		// Method exists in spec but filtered out by strict mode
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Method %s.%s.%s not available in current identity mode", serviceName, resName, methodName),
-			"Use --as user / --as bot to switch")
-	}
-	env := schema.AssembleEnvelope(serviceName, []string{resName}, methodName, method)
-	output.PrintJson(out, env)
+	output.PrintJson(out, schema.Envelopes(refs))
 	return nil
 }
 
-func assembleResource(serviceName, resName string, resource map[string]interface{}, filter schema.MethodFilter) []schema.Envelope {
-	methods, _ := resource["methods"].(map[string]interface{})
-	resourcePath := []string{resName}
-	var envs []schema.Envelope
-	for methodName, raw := range methods {
-		method, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if filter != nil && !filter(method) {
-			continue
-		}
-		envs = append(envs, schema.AssembleEnvelope(serviceName, resourcePath, methodName, method))
+// resolveError maps a catalog *ResolveError to a typed *errs.ValidationError
+// (CategoryValidation drives the exit code; Hint promotes to the envelope),
+// preserving the historical message + hint text.
+func resolveError(err error) error {
+	var re *apicatalog.ResolveError
+	if !errors.As(err, &re) {
+		return err
 	}
-	sort.Slice(envs, func(i, j int) bool { return envs[i].Name < envs[j].Name })
-	return envs
-}
-
-// runPrettyMode preserves the existing legacy pretty rendering verbatim.
-// All printServices/printResourceList/printMethodDetail calls stay unchanged.
-func runPrettyMode(out io.Writer, parts []string, mode core.StrictMode) error {
-	if len(parts) == 0 {
-		printServices(out)
-		return nil
-	}
-	serviceName := parts[0]
-	spec := registry.LoadFromMeta(serviceName)
-	if spec == nil {
-		return errUnknownService(serviceName)
-	}
-	if len(parts) == 1 {
-		printResourceList(out, spec, mode)
-		return nil
-	}
-	resources, _ := spec["resources"].(map[string]interface{})
-	resource, resName, remaining := findResourceByPath(resources, parts[1:])
-	if resource == nil {
-		var names []string
-		for k := range resources {
-			names = append(names, k)
-		}
-		sort.Strings(names)
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Unknown resource: %s.%s", serviceName, strings.Join(parts[1:], ".")),
-			fmt.Sprintf("Available: %s", strings.Join(names, ", ")))
-	}
-	if len(remaining) == 0 {
-		fmt.Fprintf(out, "%s%s.%s%s\n\n", output.Bold, serviceName, resName, output.Reset)
-		methods, _ := resource["methods"].(map[string]interface{})
-		methods = filterMethodsByStrictMode(methods, mode)
-		for _, mName := range sortedKeys(methods) {
-			m, _ := methods[mName].(map[string]interface{})
-			httpMethod := registry.GetStrFromMap(m, "httpMethod")
-			desc := registry.GetStrFromMap(m, "description")
-			fmt.Fprintf(out, "  %-7s %s%s%s  %s%s%s\n", httpMethod, output.Bold, mName, output.Reset, output.Dim, desc, output.Reset)
-		}
-		fmt.Fprintf(out, "\n%sUsage: lark-cli schema %s.%s.<method>%s\n", output.Dim, serviceName, resName, output.Reset)
-		return nil
-	}
-	methodName := remaining[0]
-	methods, _ := resource["methods"].(map[string]interface{})
-	methods = filterMethodsByStrictMode(methods, mode)
-	method, ok := methods[methodName].(map[string]interface{})
-	if !ok {
-		var names []string
-		for k := range methods {
-			names = append(names, k)
-		}
-		sort.Strings(names)
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Unknown method: %s.%s.%s", serviceName, resName, methodName),
-			fmt.Sprintf("Available: %s", strings.Join(names, ", ")))
-	}
-	if len(remaining) > 1 {
-		return output.ErrWithHint(output.ExitValidation, "validation",
-			fmt.Sprintf("Unknown path: %s.%s.%s",
-				serviceName, resName, strings.Join(remaining, ".")),
-			fmt.Sprintf("Method %q exists but the trailing segments %q do not resolve",
-				methodName, strings.Join(remaining[1:], ".")))
-	}
-	printMethodDetail(out, spec, resName, methodName, method)
-	return nil
-}
-
-// strictModeFilter adapts core.StrictMode into a schema.MethodFilter, or returns
-// nil if strict mode is not active.
-func strictModeFilter(mode core.StrictMode) schema.MethodFilter {
-	if !mode.IsActive() {
-		return nil
-	}
-	token := registry.IdentityToAccessToken(string(mode.ForcedIdentity()))
-	return func(method map[string]interface{}) bool {
-		tokens, _ := method["accessTokens"].([]interface{})
-		if tokens == nil {
-			return true // permissive when meta_data lacks accessTokens
-		}
-		for _, t := range tokens {
-			if s, _ := t.(string); s == token {
-				return true
-			}
-		}
-		return false
-	}
-}
-
-func errUnknownService(name string) error {
-	return output.ErrWithHint(output.ExitValidation, "validation",
-		fmt.Sprintf("Unknown service: %s", name),
-		fmt.Sprintf("Available: %s", strings.Join(registry.ListFromMetaProjects(), ", ")))
-}
-
-// errUnknownEmbeddedService is the JSON-mode variant: it lists only embedded
-// services (no overlay) because JSON mode itself bypasses overlay; suggesting
-// overlay-only services would mislead callers when those services subsequently
-// fail to resolve in envelope output.
-func errUnknownEmbeddedService(name string) error {
-	return output.ErrWithHint(output.ExitValidation, "validation",
-		fmt.Sprintf("Unknown service: %s", name),
-		fmt.Sprintf("Available: %s", strings.Join(registry.EmbeddedServiceNames(), ", ")))
-}
-
-// filterSpecByStrictMode returns a shallow copy of spec with each resource's methods
-// filtered by strict mode. Returns the original spec when strict mode is off.
-func filterSpecByStrictMode(spec map[string]interface{}, mode core.StrictMode) map[string]interface{} {
-	if !mode.IsActive() {
-		return spec
-	}
-	result := make(map[string]interface{}, len(spec))
-	for k, v := range spec {
-		result[k] = v
-	}
-	resources, _ := spec["resources"].(map[string]interface{})
-	if resources == nil {
-		return result
-	}
-	filteredRes := make(map[string]interface{}, len(resources))
-	for resName, resVal := range resources {
-		resMap, ok := resVal.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		methods, _ := resMap["methods"].(map[string]interface{})
-		filtered := filterMethodsByStrictMode(methods, mode)
-		if len(filtered) == 0 {
-			continue
-		}
-		resCopy := make(map[string]interface{}, len(resMap))
-		for k, v := range resMap {
-			resCopy[k] = v
-		}
-		resCopy["methods"] = filtered
-		filteredRes[resName] = resCopy
-	}
-	result["resources"] = filteredRes
-	return result
-}
-
-// filterMethodsByStrictMode removes methods incompatible with the active strict mode.
-// Returns the original map unmodified when strict mode is off.
-func filterMethodsByStrictMode(methods map[string]interface{}, mode core.StrictMode) map[string]interface{} {
-	if !mode.IsActive() || methods == nil {
-		return methods
-	}
-	token := registry.IdentityToAccessToken(string(mode.ForcedIdentity()))
-	filtered := make(map[string]interface{}, len(methods))
-	for name, val := range methods {
-		m, ok := val.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		tokens, _ := m["accessTokens"].([]interface{})
-		if tokens == nil {
-			filtered[name] = val
-			continue
-		}
-		for _, t := range tokens {
-			if ts, ok := t.(string); ok && ts == token {
-				filtered[name] = val
-				break
-			}
-		}
-	}
-	return filtered
+	switch re.Kind {
+	case apicatalog.ErrService:
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "Unknown service: %s", re.Subject).
+			WithHint("Available: %s", strings.Join(re.Candidates, ", "))
+	case apicatalog.ErrResource:
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "Unknown resource: %s", re.Subject).
+			WithHint("Available: %s", strings.Join(re.Candidates, ", "))
+	case apicatalog.ErrMethod:
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "Unknown method: %s", re.Subject).
+			WithHint("Available: %s", strings.Join(re.Candidates, ", "))
+	case apicatalog.ErrPath:
+		return errs.NewValidationError(errs.SubtypeInvalidArgument, "Unknown path: %s", re.Subject).
+			WithHint("Method %q exists but the trailing segments %q do not resolve", re.Method, re.Trailing)
+	}
+	return err
 }

cmd/schema/schema_test.go

@@ -4,7 +4,6 @@
 package schema
 
 import (
-	"bytes"
 	"encoding/json"
 	"strings"
 	"testing"
@@ -21,29 +20,46 @@ func TestSchemaCmd_FlagParsing(t *testing.T) {
 		gotOpts = opts
 		return nil
 	})
-	cmd.SetArgs([]string{"calendar.events.list", "--format", "pretty"})
+	cmd.SetArgs([]string{"calendar.events.list"})
 	err := cmd.Execute()
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
-	if gotOpts.Path != "calendar.events.list" {
-		t.Errorf("expected path calendar.events.list, got %s", gotOpts.Path)
-	}
-	if gotOpts.Format != "pretty" {
-		t.Errorf("expected Format=pretty, got %s", gotOpts.Format)
+	if len(gotOpts.Args) != 1 || gotOpts.Args[0] != "calendar.events.list" {
+		t.Errorf("expected args [calendar.events.list], got %v", gotOpts.Args)
 	}
 }
 
-func TestSchemaCmd_NoArgs_Pretty(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, nil)
-
-	cmd := NewCmdSchema(f, nil)
-	cmd.SetArgs([]string{"--format", "pretty"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
+func TestSchemaCmd_OutputFlagsAcceptedForCompat(t *testing.T) {
+	// Agents are habituated to --format/--json/--as from api/service commands.
+	// schema must accept them without erroring and always emit the JSON envelope —
+	// its output is structured JSON and identity-independent, so the values have
+	// no effect.
+	argSets := [][]string{
+		{"--format", "json"},
+		{"--format", "pretty"},
+		{"--format", "table"}, // no table rendering for a nested schema -> JSON
+		{"--format", "csv"},
+		{"--json"},
+		{"--json", "--format", "ndjson"},
+		{"--as", "user"},
+		{"--as", "bot"},
+		{"--as", "user", "--json"},
 	}
-	if !strings.Contains(stdout.String(), "Available services") {
-		t.Error("expected service list in pretty mode")
+	for _, extra := range argSets {
+		f, stdout, _, _ := cmdutil.TestFactory(t, nil)
+		cmd := NewCmdSchema(f, nil)
+		cmd.SetArgs(append([]string{"im.images.create"}, extra...))
+		if err := cmd.Execute(); err != nil {
+			t.Fatalf("args %v should be accepted, got error: %v", extra, err)
+		}
+		var env map[string]interface{}
+		if err := json.Unmarshal(stdout.Bytes(), &env); err != nil {
+			t.Fatalf("args %v: output is not a JSON envelope: %v\n%s", extra, err, stdout.String())
+		}
+		if env["name"] != "im images create" {
+			t.Errorf("args %v: expected the im images create envelope, got name=%v", extra, env["name"])
+		}
 	}
 }
 
@@ -51,7 +67,7 @@ func TestSchemaCmd_NoArgs_JSON_IsArray(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, nil)
 
 	cmd := NewCmdSchema(f, nil)
-	cmd.SetArgs([]string{}) // default --format json
+	cmd.SetArgs([]string{})
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -76,7 +92,7 @@ func TestSchemaCmd_JSONIsEnvelope(t *testing.T) {
 	f, stdout, _, _ := cmdutil.TestFactory(t, nil)
 
 	cmd := NewCmdSchema(f, nil)
-	cmd.SetArgs([]string{"im.images.create", "--format", "json"})
+	cmd.SetArgs([]string{"im.images.create"})
 	if err := cmd.Execute(); err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -179,23 +195,6 @@ func TestSchemaCmd_NoYesForReadRisk(t *testing.T) {
 	}
 }
 
-func TestSchemaCmd_PrettyUnchanged_KeyTextPresent(t *testing.T) {
-	f, stdout, _, _ := cmdutil.TestFactory(t, nil)
-
-	cmd := NewCmdSchema(f, nil)
-	cmd.SetArgs([]string{"im.images.create", "--format", "pretty"})
-	if err := cmd.Execute(); err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	out := stdout.String()
-	// Existing pretty rendering surfaces these markers — they must still appear
-	for _, want := range []string{"Parameters:", "Response:", "Identity:", "Scopes:", "CLI:"} {
-		if !strings.Contains(out, want) {
-			t.Errorf("pretty output missing marker %q", want)
-		}
-	}
-}
-
 func TestSchemaCmd_UnknownService(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, &core.CliConfig{
 		AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
@@ -212,168 +211,6 @@ func TestSchemaCmd_UnknownService(t *testing.T) {
 	}
 }
 
-func TestPrintMethodDetail_FileUpload(t *testing.T) {
-	spec := map[string]interface{}{
-		"name":        "im",
-		"servicePath": "/open-apis/im/v1",
-	}
-	method := map[string]interface{}{
-		"path":        "images",
-		"httpMethod":  "POST",
-		"description": "Upload an image",
-		"requestBody": map[string]interface{}{
-			"image_type": map[string]interface{}{
-				"type":     "string",
-				"required": true,
-			},
-			"image": map[string]interface{}{
-				"type":     "file",
-				"required": true,
-			},
-		},
-		"accessTokens": []interface{}{"user", "tenant"},
-	}
-
-	var buf bytes.Buffer
-	printMethodDetail(&buf, spec, "images", "create", method)
-	out := buf.String()
-
-	if !strings.Contains(out, "file upload") {
-		t.Errorf("expected 'file upload' marker in output, got:\n%s", out)
-	}
-	if !strings.Contains(out, "--file") {
-		t.Errorf("expected '--file' in output, got:\n%s", out)
-	}
-	if !strings.Contains(out, `"image"`) {
-		t.Errorf("expected default field name 'image' in output, got:\n%s", out)
-	}
-	if !strings.Contains(out, "--file <path>") {
-		t.Errorf("expected CLI example with --file <path>, got:\n%s", out)
-	}
-}
-
-func TestPrintMethodDetail_NoFileUpload(t *testing.T) {
-	spec := map[string]interface{}{
-		"name":        "calendar",
-		"servicePath": "/open-apis/calendar/v4",
-	}
-	method := map[string]interface{}{
-		"path":        "events",
-		"httpMethod":  "POST",
-		"description": "Create an event",
-		"requestBody": map[string]interface{}{
-			"summary": map[string]interface{}{
-				"type":     "string",
-				"required": true,
-			},
-		},
-	}
-
-	var buf bytes.Buffer
-	printMethodDetail(&buf, spec, "events", "create", method)
-	out := buf.String()
-
-	if strings.Contains(out, "file upload") {
-		t.Errorf("did not expect 'file upload' marker for non-file method, got:\n%s", out)
-	}
-	if strings.Contains(out, "--file") {
-		t.Errorf("did not expect '--file' for non-file method, got:\n%s", out)
-	}
-}
-
-func TestHasFileFields(t *testing.T) {
-	tests := []struct {
-		name       string
-		method     map[string]interface{}
-		wantBool   bool
-		wantFields []string
-	}{
-		{
-			name: "has file field",
-			method: map[string]interface{}{
-				"requestBody": map[string]interface{}{
-					"image": map[string]interface{}{"type": "file"},
-					"name":  map[string]interface{}{"type": "string"},
-				},
-			},
-			wantBool:   true,
-			wantFields: []string{"image"},
-		},
-		{
-			name: "no file field",
-			method: map[string]interface{}{
-				"requestBody": map[string]interface{}{
-					"name": map[string]interface{}{"type": "string"},
-				},
-			},
-			wantBool:   false,
-			wantFields: nil,
-		},
-		{
-			name:       "no requestBody",
-			method:     map[string]interface{}{},
-			wantBool:   false,
-			wantFields: nil,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got, names := hasFileFields(tt.method)
-			if got != tt.wantBool {
-				t.Errorf("hasFileFields() = %v, want %v", got, tt.wantBool)
-			}
-			if tt.wantFields == nil && names != nil {
-				t.Errorf("expected nil names, got %v", names)
-			}
-			if tt.wantFields != nil && len(names) != len(tt.wantFields) {
-				t.Errorf("expected %d field names, got %d", len(tt.wantFields), len(names))
-			}
-		})
-	}
-}
-
-func TestCompleteSchemaPathForSpec(t *testing.T) {
-	resources := map[string]interface{}{
-		"records": map[string]interface{}{
-			"methods": map[string]interface{}{
-				"create": map[string]interface{}{},
-				"list":   map[string]interface{}{},
-			},
-		},
-		"record_permissions": map[string]interface{}{
-			"methods": map[string]interface{}{
-				"get": map[string]interface{}{},
-			},
-		},
-	}
-
-	got := completeSchemaPathForSpec("base", resources, "records.cr")
-	if len(got) != 1 || got[0] != "base.records.create" {
-		t.Fatalf("completions = %v, want [base.records.create]", got)
-	}
-
-	got = completeSchemaPathForSpec("base", resources, "record")
-	if len(got) != 2 || got[0] != "base.record_permissions." || got[1] != "base.records." {
-		t.Fatalf("resource completions = %v", got)
-	}
-}
-
-func TestFilterSpecByStrictMode_RemovesIncompatibleMethodsFromCompletionSource(t *testing.T) {
-	spec := map[string]interface{}{
-		"resources": map[string]interface{}{
-			"records": map[string]interface{}{
-				"methods": map[string]interface{}{
-					"list":   map[string]interface{}{"accessTokens": []interface{}{"tenant"}},
-					"create": map[string]interface{}{"accessTokens": []interface{}{"user"}},
-				},
-			},
-		},
-	}
-
-	filtered := filterSpecByStrictMode(spec, core.StrictModeBot)
-	resources, _ := filtered["resources"].(map[string]interface{})
-	got := completeSchemaPathForSpec("base", resources, "records.")
-	if len(got) != 1 || got[0] != "base.records.list" {
-		t.Fatalf("filtered completions = %v, want [base.records.list]", got)
-	}
-}
+// Completion candidate generation (dotted + space forms, strict-mode filtering,
+// dotted-resource handling) now lives in internal/apicatalog and is covered by
+// apicatalog's TestComplete. cmd/schema only adapts catalog.Complete to cobra.

cmd/service/affordance.go

@@ -0,0 +1,80 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/larksuite/cli/internal/meta"
+)
+
+// methodLong composes a method command's long help in one place: the
+// description, the affordance guidance block (when the method has one), the
+// pointer to the full schema, and the params-only addendum (params whose flag
+// name is taken — paramFlagBinder.paramsOnlyHelp, "" when none). Affordance
+// sits near the top so an agent sees when-to-use and few-shot examples before
+// the flag list.
+func methodLong(description, affordance, schemaPath, paramsOnly string) string {
+	var b strings.Builder
+	b.WriteString(description)
+	if affordance != "" {
+		b.WriteString("\n\n")
+		b.WriteString(affordance)
+	}
+	fmt.Fprintf(&b, "\n\nView parameter definitions before calling:\n  lark-cli schema %s", schemaPath)
+	b.WriteString(paramsOnly)
+	return b.String()
+}
+
+// renderAffordance renders a method's affordance as a help block — when to use,
+// prerequisites, and (most importantly for agents) few-shot Examples — or "" when
+// the method carries no affordance. It reads the single typed model
+// (meta.Method.ParsedAffordance) so the help and the envelope agree on shape.
+func renderAffordance(m meta.Method) string {
+	a, ok := m.ParsedAffordance()
+	if !ok {
+		return ""
+	}
+
+	var b strings.Builder
+	bullets := func(title string, items []string) {
+		var nonEmpty []string
+		for _, it := range items {
+			if strings.TrimSpace(it) != "" {
+				nonEmpty = append(nonEmpty, it)
+			}
+		}
+		if len(nonEmpty) == 0 {
+			return
+		}
+		fmt.Fprintf(&b, "%s:\n", title)
+		for _, it := range nonEmpty {
+			fmt.Fprintf(&b, "  • %s\n", it)
+		}
+	}
+
+	bullets("When to use", a.UseWhen)
+	bullets("Avoid when", a.DoNotUseWhen)
+	bullets("Prerequisites", a.Prerequisites)
+	if len(a.Examples) > 0 {
+		var lines []string
+		for _, ex := range a.Examples {
+			if ex.Command == "" {
+				continue
+			}
+			if ex.Description != "" {
+				lines = append(lines, fmt.Sprintf("  • %s\n      %s", ex.Description, ex.Command))
+			} else {
+				lines = append(lines, fmt.Sprintf("  • %s", ex.Command))
+			}
+		}
+		if len(lines) > 0 {
+			fmt.Fprintf(&b, "Examples:\n%s\n", strings.Join(lines, "\n"))
+		}
+	}
+	bullets("Related", a.Related)
+
+	return strings.TrimRight(b.String(), "\n")
+}

cmd/service/affordance_test.go

@@ -0,0 +1,72 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/meta"
+)
+
+func TestRenderAffordance(t *testing.T) {
+	raw := json.RawMessage(`{
+		"use_when": ["发送文本消息"],
+		"do_not_use_when": ["群已解散"],
+		"prerequisites": ["已获取 chat_id"],
+		"examples": [
+			{"description":"发一条文本","command":"lark-cli im messages create --params '{...}'"},
+			{"command":"lark-cli im messages list"},
+			{"description":"no command, skipped","command":""}
+		],
+		"related": ["im.messages.list"]
+	}`)
+	out := renderAffordance(meta.Method{Affordance: raw})
+	for _, want := range []string{
+		"When to use:", "发送文本消息",
+		"Avoid when:", "群已解散",
+		"Prerequisites:", "已获取 chat_id",
+		"Examples:", "发一条文本", "lark-cli im messages create --params '{...}'",
+		"lark-cli im messages list", // example with no description -> bare command line
+		"Related:", "im.messages.list",
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("renderAffordance missing %q in:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, "no command, skipped") {
+		t.Errorf("example with empty command should be skipped:\n%s", out)
+	}
+
+	// Absent or empty affordance renders nothing (so methods without an overlay
+	// add nothing to their help).
+	if renderAffordance(meta.Method{}) != "" || renderAffordance(meta.Method{Affordance: json.RawMessage(`{}`)}) != "" {
+		t.Error("empty affordance should render nothing")
+	}
+}
+
+func TestServiceMethod_AffordanceInLong(t *testing.T) {
+	withAff := map[string]interface{}{
+		"path": "messages", "httpMethod": "POST", "description": "发送消息",
+		"affordance": map[string]interface{}{
+			"examples": []interface{}{
+				map[string]interface{}{"description": "发文本", "command": "lark-cli im messages create ..."},
+			},
+		},
+	}
+	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(withAff), "create", "messages", nil)
+	if !strings.Contains(cmd.Long, "Examples:") || !strings.Contains(cmd.Long, "lark-cli im messages create ...") {
+		t.Errorf("affordance examples not in command Long:\n%s", cmd.Long)
+	}
+
+	// A method with no affordance adds no guidance block.
+	plain := map[string]interface{}{"path": "x", "httpMethod": "GET", "description": "d"}
+	cmd2 := NewCmdServiceMethod(f, imSpec(), meta.FromMap(plain), "list", "x", nil)
+	if strings.Contains(cmd2.Long, "Examples:") {
+		t.Errorf("no-affordance method should have no Examples in Long:\n%s", cmd2.Long)
+	}
+}

cmd/service/flaggroups.go

@@ -0,0 +1,211 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+// Flag annotations the grouped service-method help renderer reads.
+const (
+	flagGroupAnnotation = "lark_flag_group" // display group key
+	flagSubAnnotation   = "lark_flag_sub"   // "required" | "optional" within API Parameters
+	flagNoteAnnotation  = "lark_flag_note"  // extra lines shown indented under a flag
+
+	groupParams    = "params"    // typed path/query flags
+	groupBody      = "body"      // --data, --file
+	groupRaw       = "raw"       // --params
+	groupExecution = "execution" // --as/--dry-run/--page-*/--yes
+	groupOutput    = "output"    // --output/--format/--jq
+
+	subRequired = "required"
+	subOptional = "optional"
+)
+
+// serviceFlagGroupOrder is the display order + titles of the flag groups. API
+// Parameters carries only typed path/query flags; raw --params, request body and
+// execution/output controls each get their own group so an agent can tell the
+// distinct input kinds apart.
+var serviceFlagGroupOrder = []struct{ key, title string }{
+	{groupParams, "API Parameters"},
+	{groupBody, "Request Body"},
+	{groupRaw, "Raw Parameter Input"},
+	{groupExecution, "Execution"},
+	{groupOutput, "Output"},
+}
+
+// applyGroupedUsage installs the grouped usage renderer on a service method
+// cmd: local flags via the grouped renderer instead of cobra's flat Flags:
+// list; global (inherited) flags and the Risk/Tips sections appended by the
+// root help func are unaffected. Rendered by hand rather than via
+// cmd.SetUsageTemplate: cobra lazy-links text/template on the first
+// SetUsageTemplate call, whose executor reaches reflect.Value.MethodByName —
+// that disables the linker's method-level dead-code elimination and costs
+// ~19 MB of binary size.
+func applyGroupedUsage(cmd *cobra.Command) {
+	cmd.SetUsageFunc(func(c *cobra.Command) error {
+		w := c.OutOrStderr()
+		fmt.Fprintf(w, "Usage:\n  %s\n", c.UseLine())
+		if c.HasAvailableLocalFlags() {
+			fmt.Fprintf(w, "\n%s\n", renderServiceFlagGroups(c))
+		}
+		if c.HasAvailableInheritedFlags() {
+			fmt.Fprintf(w, "\nGlobal Flags:\n%s\n", strings.TrimRight(c.InheritedFlags().FlagUsages(), " \t\n"))
+		}
+		return nil
+	})
+}
+
+func annotate(f *pflag.Flag, key string, vals []string) {
+	if f.Annotations == nil {
+		f.Annotations = map[string][]string{}
+	}
+	f.Annotations[key] = vals
+}
+
+// tagFlagGroup records a flag's display group (no-op if the flag is absent).
+func tagFlagGroup(fs *pflag.FlagSet, name, group string) {
+	if f := fs.Lookup(name); f != nil {
+		annotate(f, flagGroupAnnotation, []string{group})
+	}
+}
+
+func annotationOf(f *pflag.Flag, key string) []string {
+	if f.Annotations != nil {
+		return f.Annotations[key]
+	}
+	return nil
+}
+
+func flagGroupOf(f *pflag.Flag) string {
+	if v := annotationOf(f, flagGroupAnnotation); len(v) > 0 {
+		return v[0]
+	}
+	return ""
+}
+
+func flagSubOf(f *pflag.Flag) string {
+	if v := annotationOf(f, flagSubAnnotation); len(v) > 0 {
+		return v[0]
+	}
+	return ""
+}
+
+// renderServiceFlagGroups renders the command's local flags into ordered,
+// titled groups; the API Parameters group is further split into Required /
+// Optional. It is the body of the usage func applyGroupedUsage installs.
+func renderServiceFlagGroups(cmd *cobra.Command) string {
+	var b strings.Builder
+	seen := map[*pflag.Flag]bool{}
+	for _, g := range serviceFlagGroupOrder {
+		flags := groupFlags(cmd, g.key, seen)
+		if len(flags) == 0 {
+			continue
+		}
+		fmt.Fprintf(&b, "%s:\n", g.title)
+		if g.key == groupParams {
+			writeSection(&b, "  Required:", subFlags(flags, subRequired))
+			writeSection(&b, "  Optional:", subFlags(flags, subOptional))
+		} else {
+			writeSection(&b, "", flags)
+		}
+		fmt.Fprintln(&b)
+	}
+	// Anything untagged (e.g. -h/--help) goes last under "Other".
+	var other []*pflag.Flag
+	cmd.LocalFlags().VisitAll(func(f *pflag.Flag) {
+		if f.Hidden || seen[f] {
+			return
+		}
+		other = append(other, f)
+	})
+	if len(other) > 0 {
+		fmt.Fprintln(&b, "Other:")
+		writeSection(&b, "", other)
+	}
+	return strings.TrimRight(b.String(), "\n")
+}
+
+// groupFlags returns the visible local flags tagged with group key, marking them
+// seen so the trailing "Other" bucket only catches genuinely untagged flags.
+func groupFlags(cmd *cobra.Command, key string, seen map[*pflag.Flag]bool) []*pflag.Flag {
+	var flags []*pflag.Flag
+	cmd.LocalFlags().VisitAll(func(f *pflag.Flag) {
+		if f.Hidden || flagGroupOf(f) != key {
+			return
+		}
+		flags = append(flags, f)
+		seen[f] = true
+	})
+	return flags
+}
+
+func subFlags(flags []*pflag.Flag, sub string) []*pflag.Flag {
+	var out []*pflag.Flag
+	for _, f := range flags {
+		s := flagSubOf(f)
+		// Untagged subgroup defaults to Optional so nothing is dropped.
+		if s == sub || (s == "" && sub == subOptional) {
+			out = append(out, f)
+		}
+	}
+	return out
+}
+
+// writeSection prints an optional (sub)header and the flags, aligned in a
+// column, each flag row followed by its note lines indented under the usage.
+func writeSection(b *strings.Builder, header string, flags []*pflag.Flag) {
+	if len(flags) == 0 {
+		return
+	}
+	if header != "" {
+		fmt.Fprintf(b, "%s\n", header)
+	}
+	specs := make([]string, len(flags))
+	maxSpec := 0
+	for i, f := range flags {
+		specs[i] = flagSpec(f)
+		if len(specs[i]) > maxSpec {
+			maxSpec = len(specs[i])
+		}
+	}
+	for i, f := range flags {
+		_, usage := pflag.UnquoteUsage(f)
+		if showsDefault(f) {
+			usage += fmt.Sprintf(" (default %s)", f.DefValue)
+		}
+		fmt.Fprintf(b, "%-*s   %s\n", maxSpec, specs[i], strings.TrimSpace(usage))
+		for _, note := range annotationOf(f, flagNoteAnnotation) {
+			fmt.Fprintf(b, "%*s%s\n", maxSpec+3+4, "", note)
+		}
+	}
+}
+
+// flagSpec is pflag's "      --name type" / "  -x, --name type" left column.
+func flagSpec(f *pflag.Flag) string {
+	typeName, _ := pflag.UnquoteUsage(f)
+	spec := "      --" + f.Name
+	if f.Shorthand != "" && f.ShorthandDeprecated == "" {
+		spec = "  -" + f.Shorthand + ", --" + f.Name
+	}
+	if typeName != "" {
+		spec += " " + typeName
+	}
+	return spec
+}
+
+// showsDefault mirrors pflag's "non-zero default" rule for the flag types these
+// commands use, so the grouped rendering shows the same "(default x)" hints as
+// cobra's flat list.
+func showsDefault(f *pflag.Flag) bool {
+	switch f.DefValue {
+	case "", "0", "false", "[]":
+		return false
+	}
+	return true
+}

cmd/service/flaggroups_test.go

@@ -0,0 +1,115 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/meta"
+)
+
+func TestServiceFlagGroups_AgentContract(t *testing.T) {
+	method := map[string]interface{}{
+		"path":       "chats/:chat_id/members",
+		"httpMethod": "POST",
+		"parameters": map[string]interface{}{
+			"chat_id": map[string]interface{}{"type": "string", "location": "path", "required": true},
+			"member_id_type": map[string]interface{}{
+				"type": "string", "location": "query",
+				"options": []interface{}{
+					map[string]interface{}{"value": "open_id", "description": "以 open_id 标识用户"},
+					map[string]interface{}{"value": "user_id", "description": "以 user_id 标识用户"},
+				},
+			},
+		},
+		// Documented body field -> --data belongs under Request Body.
+		"requestBody": map[string]interface{}{
+			"id_list": map[string]interface{}{"type": "list", "required": true},
+		},
+	}
+	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(method), "create", "chat.members", nil)
+	out := renderServiceFlagGroups(cmd)
+
+	idx := func(s string) int { return strings.Index(out, s) }
+
+	// Section order: API Parameters → Request Body → Raw Parameter Input → Execution → Output.
+	iParams, iBody, iRaw, iExec, iOut := idx("API Parameters:"), idx("Request Body:"), idx("Raw Parameter Input:"), idx("Execution:"), idx("Output:")
+	for name, i := range map[string]int{"API Parameters": iParams, "Request Body": iBody, "Raw Parameter Input": iRaw, "Execution": iExec, "Output": iOut} {
+		if i < 0 {
+			t.Fatalf("missing section %q in:\n%s", name, out)
+		}
+	}
+	if !(iParams < iBody && iBody < iRaw && iRaw < iExec && iExec < iOut) {
+		t.Errorf("section order wrong:\n%s", out)
+	}
+
+	// Required/Optional subsections under API Parameters.
+	if i := idx("  Required:"); i < iParams || i > iBody {
+		t.Errorf("Required subsection misplaced:\n%s", out)
+	}
+	if i := idx("  Optional:"); i < iParams || i > iBody {
+		t.Errorf("Optional subsection misplaced:\n%s", out)
+	}
+
+	// Typed flags are API Parameters; required path flag under Required, enum
+	// flag under Optional with an inline "enum: ..." (not multi-line meanings).
+	if i := idx("--chat-id"); i < iParams || i > iBody {
+		t.Errorf("--chat-id not under API Parameters:\n%s", out)
+	}
+	if !strings.Contains(out, "chat_id, required") {
+		t.Errorf("typed flag help format wrong:\n%s", out)
+	}
+	if !strings.Contains(out, "enum: open_id=以 open_id 标识用户|user_id=以 user_id 标识用户") {
+		t.Errorf("expected compact enum value=meaning inline:\n%s", out)
+	}
+
+	// --data is Request Body; --params is Raw Parameter Input (NOT API Parameters)
+	// and carries the precedence rule.
+	if i := idx("--data"); i < iBody || i > iRaw {
+		t.Errorf("--data not under Request Body:\n%s", out)
+	}
+	if i := idx("--params"); i < iRaw || i > iExec {
+		t.Errorf("--params not under Raw Parameter Input:\n%s", out)
+	}
+	if !strings.Contains(out, "typed flags override matching keys in --params") {
+		t.Errorf("missing --params precedence rule:\n%s", out)
+	}
+
+	// Control flags land in Execution/Output.
+	if i := idx("--dry-run"); i < iExec || i > iOut {
+		t.Errorf("--dry-run not under Execution:\n%s", out)
+	}
+	if idx("--format") < iOut {
+		t.Errorf("--format not under Output:\n%s", out)
+	}
+
+	// The usage template is wired to the grouped renderer (no flat Flags: list).
+	if u := cmd.UsageString(); !strings.Contains(u, "API Parameters:") || strings.Contains(u, "\nFlags:\n") {
+		t.Errorf("usage template not grouped:\n%s", u)
+	}
+}
+
+// TestServiceFlagGroups_UndocumentedBodyIsRaw: a POST with no documented body
+// fields still offers --data (escape hatch) but must NOT imply a declared body —
+// it goes under Raw Parameter Input, not "Request Body".
+func TestServiceFlagGroups_UndocumentedBodyIsRaw(t *testing.T) {
+	method := map[string]interface{}{"path": "things/do", "httpMethod": "POST"} // POST, no requestBody, no params
+	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(method), "do", "things", nil)
+	out := renderServiceFlagGroups(cmd)
+
+	if strings.Contains(out, "Request Body:") {
+		t.Errorf("undocumented body must not render a Request Body section:\n%s", out)
+	}
+	iRaw, iData := strings.Index(out, "Raw Parameter Input:"), strings.Index(out, "--data")
+	if iRaw < 0 || iData < iRaw {
+		t.Errorf("--data not under Raw Parameter Input:\n%s", out)
+	}
+	if !strings.Contains(out, "no documented fields") {
+		t.Errorf("--data should be labeled a raw escape hatch:\n%s", out)
+	}
+}

cmd/service/paramflags.go

@@ -0,0 +1,166 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/meta"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+type boundParamFlag struct {
+	field meta.Field
+	read  func() interface{}
+}
+
+// paramsOnlyField is a path/query parameter that got no typed flag because its
+// kebab name is already taken by another flag (a standard flag like --format, or
+// a root persistent flag). It stays reachable via --params; the binder keeps it,
+// with the flag that claimed the name, so --help can show the exact --params form
+// and steer the reader off the wrong flag.
+type paramsOnlyField struct {
+	field   meta.Field
+	claimed *pflag.Flag
+}
+
+// paramFlagBinder owns one service method's generated typed param flags: it
+// registers them (kind, help, enum completion, reserved-name skip) and applies
+// the --params overlay, where a changed typed flag overrides its key in the
+// --params JSON. Holding the field<->flag binding here keeps the request builder
+// from re-deriving which flags map to which param keys.
+type paramFlagBinder struct {
+	bound      []boundParamFlag
+	paramsOnly []paramsOnlyField
+}
+
+// newParamFlagBinder registers one typed kebab flag per path/query parameter on
+// cmd and returns a binder for the --params overlay. A name already taken by
+// another flag is skipped — pflag panics on a local duplicate and a generated
+// flag would silently shadow a persistent one — and recorded as paramsOnly so
+// the parameter stays reachable (and discoverable) via --params. The taken set
+// is derived, not hand-listed: local flags (the standard set, registered before
+// this runs) via cmd, the lazily-added --help materialized here, and the root's
+// persistent flags via reserved (nil for direct callers that have no root).
+func newParamFlagBinder(cmd *cobra.Command, params []meta.Field, reserved *pflag.FlagSet) *paramFlagBinder {
+	cmd.InitDefaultHelpFlag() // materialize --help/-h so the local guard below sees it
+	b := &paramFlagBinder{}
+	for _, f := range params {
+		name := f.FlagName()
+		if claimed := flagClaiming(cmd, reserved, name); claimed != nil {
+			b.paramsOnly = append(b.paramsOnly, paramsOnlyField{field: f, claimed: claimed})
+			continue
+		}
+		read := registerTypedFlag(cmd.Flags(), name, f.CanonicalType(), paramFlagUsage(f))
+		if values := enumStrings(f.EnumValues()); len(values) > 0 {
+			cmdutil.RegisterFlagCompletion(cmd, name, func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
+				return values, cobra.ShellCompDirectiveNoFileComp
+			})
+		}
+		// Group as an API parameter and mark required/optional for the
+		// Required/Optional subsections of the grouped --help renderer.
+		if fl := cmd.Flags().Lookup(name); fl != nil {
+			annotate(fl, flagGroupAnnotation, []string{groupParams})
+			sub := subOptional
+			if f.Required {
+				sub = subRequired
+			}
+			annotate(fl, flagSubAnnotation, []string{sub})
+		}
+		b.bound = append(b.bound, boundParamFlag{field: f, read: read})
+	}
+	return b
+}
+
+// flagClaiming returns the flag already occupying name (so a typed param flag
+// would collide), or nil when the name is free. It checks the command's own
+// flags (the standard set + the materialized --help) and the root's persistent
+// flags — so the reserved set is whatever is actually registered, never a
+// hand-kept list that drifts when a global flag is added.
+func flagClaiming(cmd *cobra.Command, reserved *pflag.FlagSet, name string) *pflag.Flag {
+	if fl := cmd.Flags().Lookup(name); fl != nil {
+		return fl
+	}
+	if reserved != nil {
+		return reserved.Lookup(name)
+	}
+	return nil
+}
+
+// paramsOnlyHelp renders the --help addendum for parameters that have no typed
+// flag, or "" when there are none. Per field: a copy-pasteable --params form,
+// the same fieldFacts a typed flag would show on its usage line, and what the
+// colliding flag actually does — so neither a human nor an agent sets the
+// wrong one (e.g. --format, which is the output format, not the API parameter).
+func (b *paramFlagBinder) paramsOnlyHelp() string {
+	if len(b.paramsOnly) == 0 {
+		return ""
+	}
+	var sb strings.Builder
+	sb.WriteString("\nParameters set via --params (no typed flag; the name is taken by another flag):\n")
+	for _, p := range b.paramsOnly {
+		name := p.field.Name
+		fmt.Fprintf(&sb, "  %s: --params '{%q: %s}'\n", name, name, paramExample(p.field))
+		for _, fact := range fieldFacts(p.field) {
+			fmt.Fprintf(&sb, "      %s\n", fact)
+		}
+		if p.claimed != nil {
+			fmt.Fprintf(&sb, "      do not use --%s (%s)\n", p.claimed.Name, p.claimed.Usage)
+		}
+	}
+	return sb.String()
+}
+
+// hasTypedFlag reports whether the binder registered a typed flag for the
+// param named name. False for params-only fields — a flag with the same kebab
+// name may exist (that's the collision), but it is not this param's input.
+// Nil-safe for direct buildServiceRequest callers that have no binder.
+func (b *paramFlagBinder) hasTypedFlag(name string) bool {
+	if b == nil {
+		return false
+	}
+	for _, pf := range b.bound {
+		if pf.field.Name == name {
+			return true
+		}
+	}
+	return false
+}
+
+// overlay lets an explicit typed flag override the same key in --params
+// (--params is the base). Only changed flags apply, so the --params-only path is
+// unchanged. A nil binder or cmd is a no-op.
+func (b *paramFlagBinder) overlay(cmd *cobra.Command, params map[string]interface{}) {
+	if b == nil || cmd == nil {
+		return
+	}
+	for _, pf := range b.bound {
+		if cmd.Flags().Changed(pf.field.FlagName()) {
+			params[pf.field.Name] = pf.read()
+		}
+	}
+}
+
+// registerTypedFlag registers one flag of the given canonical JSON-Schema kind
+// and returns a reader for its parsed value; the kind→pflag-type switch lives
+// only here.
+func registerTypedFlag(fs *pflag.FlagSet, name, kind, usage string) func() interface{} {
+	switch kind {
+	case "integer":
+		return flagReader(fs.Int(name, 0, usage))
+	case "boolean":
+		return flagReader(fs.Bool(name, false, usage))
+	case "array":
+		return flagReader(fs.StringArray(name, nil, usage))
+	default:
+		return flagReader(fs.String(name, "", usage))
+	}
+}
+
+func flagReader[T any](p *T) func() interface{} {
+	return func() interface{} { return *p }
+}

cmd/service/paramflags_test.go

@@ -0,0 +1,626 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/meta"
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+// imChatMembersCreate: POST chats/{chat_id}/members with one path param and one
+// optional enum query param — the canonical case from the screenshot feedback.
+func imChatMembersCreate() meta.Method {
+	return meta.FromMap(map[string]interface{}{
+		"path":       "chats/{chat_id}/members",
+		"httpMethod": "POST",
+		"parameters": map[string]interface{}{
+			"chat_id": map[string]interface{}{
+				"type": "string", "location": "path", "required": true,
+			},
+			"member_id_type": map[string]interface{}{
+				"type": "string", "location": "query", "required": false,
+				"options": []interface{}{
+					map[string]interface{}{"value": "open_id"},
+					map[string]interface{}{"value": "user_id"},
+				},
+			},
+		},
+	})
+}
+
+func TestServiceMethod_TypedFlagRegistered(t *testing.T) {
+	f := &cmdutil.Factory{}
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+
+	if cmd.Flags().Lookup("chat-id") == nil {
+		t.Error("expected generated --chat-id flag for path param chat_id")
+	}
+	if cmd.Flags().Lookup("member-id-type") == nil {
+		t.Error("expected generated --member-id-type flag for query param member_id_type")
+	}
+}
+
+// A query param literally named "format" kebab-collides with the global
+// --format flag. Generation must skip it (never re-register, never panic) and
+// leave the standard --format flag intact.
+func TestServiceMethod_TypedFlagReservedCollisionSkipped(t *testing.T) {
+	method := map[string]interface{}{
+		"path":       "messages",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"format": map[string]interface{}{"type": "string", "location": "query"},
+		},
+	}
+
+	var cmd *cobra.Command
+	func() {
+		defer func() {
+			if r := recover(); r != nil {
+				t.Fatalf("flag generation panicked on reserved-name collision: %v", r)
+			}
+		}()
+		cmd = NewCmdServiceMethod(&cmdutil.Factory{}, imSpec(), meta.FromMap(method), "list", "messages", nil)
+	}()
+
+	fl := cmd.Flags().Lookup("format")
+	if fl == nil || fl.DefValue != "json" {
+		t.Fatalf("standard --format flag must be preserved, got %+v", fl)
+	}
+}
+
+func TestServiceMethod_TypedFlag_DrivesPathParam(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--chat-id", "oc_abc123", "--data", `{"id_list":["ou_x"]}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(stdout.String(), "chats/oc_abc123/members") {
+		t.Errorf("expected URL with chat_id substituted from --chat-id, got:\n%s", stdout.String())
+	}
+}
+
+func TestServiceMethod_TypedFlag_DrivesQueryParam(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--chat-id", "oc_abc123", "--member-id-type", "open_id", "--data", `{}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "member_id_type") || !strings.Contains(out, "open_id") {
+		t.Errorf("expected query param member_id_type=open_id from flag, got:\n%s", out)
+	}
+}
+
+func TestServiceMethod_TypedFlag_AgreesWithParams(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--chat-id", "oc_abc123", "--params", `{"chat_id":"oc_abc123"}`, "--data", `{}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("same value via flag and --params should be accepted, got: %v", err)
+	}
+	if !strings.Contains(stdout.String(), "chats/oc_abc123/members") {
+		t.Errorf("expected URL with chat_id, got:\n%s", stdout.String())
+	}
+}
+
+// --params is the base; an explicit typed flag overrides the same key.
+func TestServiceMethod_TypedFlag_OverridesParams(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--chat-id", "oc_flag", "--params", `{"chat_id":"oc_params"}`, "--data", `{}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "chats/oc_flag/members") {
+		t.Errorf("expected --chat-id to override --params chat_id, got:\n%s", out)
+	}
+	if strings.Contains(out, "oc_params") {
+		t.Errorf("--params value should have been overridden by the flag, got:\n%s", out)
+	}
+}
+
+// Override works for a non-string (integer) param too, exercising the int
+// register/read path end to end.
+func TestServiceMethod_TypedFlag_IntegerOverridesParams(t *testing.T) {
+	method := map[string]interface{}{
+		"path":       "messages",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"page_size": map[string]interface{}{"type": "integer", "location": "query"},
+		},
+	}
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(method), "list", "messages", nil)
+	cmd.SetArgs([]string{"--page-size", "100", "--params", `{"page_size":5}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "page_size") || !strings.Contains(out, "100") {
+		t.Errorf("expected --page-size 100 to override --params page_size=5, got:\n%s", out)
+	}
+}
+
+// Regression: with no typed flags passed, behavior is byte-identical to today.
+func TestServiceMethod_TypedFlag_OnlyParamsStillWorks(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--params", `{"chat_id":"oc_abc123"}`, "--data", `{}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !strings.Contains(stdout.String(), "chats/oc_abc123/members") {
+		t.Errorf("expected URL with chat_id from --params, got:\n%s", stdout.String())
+	}
+}
+
+// Regression: --params null is valid JSON that unmarshals to a nil map. A typed
+// flag overlaying onto it must not panic (assignment to a nil map) — null is
+// treated as "no base params", with the flag value applied on top.
+func TestServiceMethod_TypedFlag_OverridesNullParams(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--chat-id", "oc_abc123", "--params", "null", "--data", `{}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("--params null with a typed flag should not error, got: %v", err)
+	}
+	if !strings.Contains(stdout.String(), "chats/oc_abc123/members") {
+		t.Errorf("expected chat_id from --chat-id over null --params, got:\n%s", stdout.String())
+	}
+}
+
+// Startup smoke test: registering every embedded method must not panic on a
+// generated-flag name collision (pflag panics on duplicate registration, which
+// would crash the whole CLI at startup), and a known path param must surface as
+// a typed flag end to end.
+func TestRegisterServiceCommands_GeneratesFlagsNoPanic(t *testing.T) {
+	root := &cobra.Command{Use: "lark-cli"}
+	f := &cmdutil.Factory{}
+
+	defer func() {
+		if r := recover(); r != nil {
+			t.Fatalf("registering all service commands panicked: %v", r)
+		}
+	}()
+	RegisterServiceCommands(root, f)
+
+	create, _, err := root.Find([]string{"im", "chat.members", "create"})
+	if err != nil {
+		t.Fatalf("im chat.members create not registered: %v", err)
+	}
+	if create.Flags().Lookup("chat-id") == nil {
+		t.Error("expected generated --chat-id flag on im chat.members create")
+	}
+}
+
+// Locks the boolean and array branches of bindParamFlag end to end (string and
+// integer are covered above): a bool flag yields true and a repeatable array
+// flag yields all its elements in the request.
+func TestServiceMethod_TypedFlag_BoolAndArrayKinds(t *testing.T) {
+	method := map[string]interface{}{
+		"path":       "items",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"with_deleted": map[string]interface{}{"type": "boolean", "location": "query"},
+			"ids":          map[string]interface{}{"type": "list", "location": "query"},
+		},
+	}
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(method), "list", "items", nil)
+	cmd.SetArgs([]string{"--with-deleted", "--ids", "a", "--ids", "b", "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	for _, want := range []string{"with_deleted", "true", "ids", "\"a\"", "\"b\""} {
+		if !strings.Contains(out, want) {
+			t.Errorf("expected dry-run output to contain %q, got:\n%s", want, out)
+		}
+	}
+}
+
+// Override (--params base, typed flag wins) is covered for string and integer
+// above; this locks the same semantics for the boolean and array kinds.
+func TestServiceMethod_TypedFlag_BoolAndArrayOverrideParams(t *testing.T) {
+	method := map[string]interface{}{
+		"path":       "items",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"with_deleted": map[string]interface{}{"type": "boolean", "location": "query"},
+			"ids":          map[string]interface{}{"type": "list", "location": "query"},
+		},
+	}
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(method), "list", "items", nil)
+	cmd.SetArgs([]string{
+		"--params", `{"with_deleted":false,"ids":["from_params"]}`,
+		"--with-deleted", "--ids", "a", "--ids", "b",
+		"--dry-run",
+	})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	for _, want := range []string{"with_deleted", "true", "\"a\"", "\"b\""} {
+		if !strings.Contains(out, want) {
+			t.Errorf("expected flag to override --params (want %q), got:\n%s", want, out)
+		}
+	}
+	if strings.Contains(out, "from_params") {
+		t.Errorf("--params array value should have been overridden by --ids, got:\n%s", out)
+	}
+}
+
+// A param whose kebab name collides with a global flag (here "format" vs the
+// global --format) gets no typed flag, but the collision is no longer silent:
+// non-colliding params still get flags, the global --format is untouched, and
+// --help shows the exact --params form and steers the reader off --format.
+func TestServiceMethod_ParamsOnly_HelpSteersToParams(t *testing.T) {
+	method := map[string]interface{}{
+		"path":       "things/{thing_id}",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"thing_id": map[string]interface{}{"type": "string", "location": "path", "required": true},
+			"format": map[string]interface{}{"type": "string", "location": "query", "min": "1", "max": "64", "description": "返回的消息体格式。", "options": []interface{}{
+				map[string]interface{}{"value": "full"},
+				map[string]interface{}{"value": "metadata"},
+			}},
+		},
+	}
+	cmd := NewCmdServiceMethod(&cmdutil.Factory{}, imSpec(), meta.FromMap(method), "get", "things", nil)
+
+	if cmd.Flags().Lookup("thing-id") == nil {
+		t.Error("non-colliding param should still get a typed --thing-id flag")
+	}
+	if fl := cmd.Flags().Lookup("format"); fl == nil || fl.DefValue != "json" {
+		t.Fatalf("global --format must be preserved (not shadowed), got %+v", fl)
+	}
+	for _, want := range []string{`--params '{"format"`, "返回的消息体格式", "full", "metadata", "min: 1, max: 64", "do not use --format"} {
+		if !strings.Contains(cmd.Long, want) {
+			t.Errorf("help should contain %q so the reader uses --params, not --format; got:\n%s", want, cmd.Long)
+		}
+	}
+}
+
+// The collision guard derives reserved names from the actual flag sets — local
+// flags plus the root's persistent flags passed in — so a future persistent
+// flag is covered with no hand-maintained list. Here a param named "profile"
+// (a root persistent flag) is skipped while a normal param is bound.
+func TestParamFlagBinder_PersistentFlagReserved(t *testing.T) {
+	cmd := &cobra.Command{Use: "x"}
+	reserved := pflag.NewFlagSet("root", pflag.ContinueOnError)
+	reserved.String("profile", "", "use a specific profile")
+
+	m := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+		"profile": map[string]interface{}{"type": "string", "location": "query"},
+		"id":      map[string]interface{}{"type": "string", "location": "path"},
+	}})
+	b := newParamFlagBinder(cmd, m.Params(), reserved)
+
+	if cmd.Flags().Lookup("id") == nil {
+		t.Error("non-colliding param should get a typed flag")
+	}
+	if cmd.Flags().Lookup("profile") != nil {
+		t.Error("param colliding with a reserved persistent flag must not be registered")
+	}
+	found := false
+	for _, p := range b.paramsOnly {
+		if p.field.Name == "profile" {
+			found = true
+		}
+	}
+	if !found {
+		t.Error("colliding param should be recorded for the --params help note")
+	}
+}
+
+// boolIntQueryMethod is the fixture for the zero-value semantics tests: one
+// boolean and one integer query param, where false and 0 are meaningful values.
+func boolIntQueryMethod(required bool) meta.Method {
+	return meta.FromMap(map[string]interface{}{
+		"path":       "items",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"with_deleted": map[string]interface{}{"type": "boolean", "location": "query", "required": required},
+			"page_size":    map[string]interface{}{"type": "integer", "location": "query"},
+		},
+	})
+}
+
+// Presence is intent: a typed flag is only overlaid when explicitly Changed,
+// so --flag=false / --flag 0 are real values and must be sent — not silently
+// dropped as "empty", which would let the API default win over an explicit
+// user choice.
+func TestServiceMethod_TypedFlag_ExplicitFalseAndZeroAreSent(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), boolIntQueryMethod(false), "list", "items", nil)
+	cmd.SetArgs([]string{"--with-deleted=false", "--page-size", "0", "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	for _, want := range []string{`"with_deleted": false`, `"page_size": 0`} {
+		if !strings.Contains(out, want) {
+			t.Errorf("explicit zero value must be sent (want %s), got:\n%s", want, out)
+		}
+	}
+}
+
+// An explicitly provided false satisfies a required query parameter — the
+// pre-flight must not report "missing" for a value the user just set.
+func TestServiceMethod_TypedFlag_ExplicitFalseSatisfiesRequired(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), boolIntQueryMethod(true), "list", "items", nil)
+	cmd.SetArgs([]string{"--with-deleted=false", "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("required param explicitly set to false must pass pre-flight, got: %v", err)
+	}
+	if !strings.Contains(stdout.String(), `"with_deleted": false`) {
+		t.Errorf("explicit false must be sent, got:\n%s", stdout.String())
+	}
+}
+
+// The same presence-is-intent rule applies to the --params JSON base: a key
+// deliberately written as false/0 is sent. (Zero values used to be silently
+// dropped; this locks the corrected semantics as the contract.)
+func TestServiceMethod_Params_JSONZeroValuesAreSent(t *testing.T) {
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), boolIntQueryMethod(false), "list", "items", nil)
+	cmd.SetArgs([]string{"--params", `{"with_deleted":false,"page_size":0}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	for _, want := range []string{`"with_deleted": false`, `"page_size": 0`} {
+		if !strings.Contains(out, want) {
+			t.Errorf("--params zero value must be sent (want %s), got:\n%s", want, out)
+		}
+	}
+}
+
+// "" stays unusable: a required parameter fed an empty-string placeholder is
+// still caught by the friendly pre-flight error, not sent as an empty value.
+func TestServiceMethod_Params_EmptyStringStillMissing(t *testing.T) {
+	method := meta.FromMap(map[string]interface{}{
+		"path":       "items",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"user_id_type": map[string]interface{}{"type": "string", "location": "query", "required": true},
+		},
+	})
+	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), method, "list", "items", nil)
+	cmd.SetArgs([]string{"--params", `{"user_id_type":""}`, "--dry-run"})
+
+	err := cmd.Execute()
+	if err == nil || !strings.Contains(err.Error(), "missing required query parameter") {
+		t.Fatalf("empty string for a required param should still pre-flight error, got: %v", err)
+	}
+}
+
+// A declared optional query param fed "" is dropped (unusable value), not sent
+// as an empty query value — the declared-param loop owns the decision and the
+// undeclared passthrough must not resurrect it. Undeclared keys stay the
+// verbatim raw escape hatch.
+func TestServiceMethod_Params_EmptyOptionalDroppedUndeclaredKept(t *testing.T) {
+	method := meta.FromMap(map[string]interface{}{
+		"path":       "items",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"user_id_type": map[string]interface{}{"type": "string", "location": "query"},
+		},
+	})
+	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), method, "list", "items", nil)
+	cmd.SetArgs([]string{"--params", `{"user_id_type":"","custom_key":"v1"}`, "--dry-run"})
+
+	if err := cmd.Execute(); err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	out := stdout.String()
+	if strings.Contains(out, "user_id_type") {
+		t.Errorf("declared optional param with empty value must be dropped, got:\n%s", out)
+	}
+	if !strings.Contains(out, `"custom_key": "v1"`) {
+		t.Errorf("undeclared key must pass through verbatim, got:\n%s", out)
+	}
+}
+
+// min/max from the metadata surface on the typed flag's help line, in the same
+// vocabulary as the envelope's minimum/maximum.
+func TestParamFlagUsage_Bounds(t *testing.T) {
+	cases := []struct{ name, min, max, want string }{
+		{"both", "1", "100", "min: 1, max: 100"},
+		{"min only", "1", "", "min: 1"},
+		{"max only", "", "64", "max: 64"},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			fields := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+				"page_size": map[string]interface{}{"type": "integer", "location": "query", "min": tc.min, "max": tc.max},
+			}}).Params()
+			if usage := paramFlagUsage(fields[0]); !strings.Contains(usage, tc.want) {
+				t.Errorf("usage = %q, want contains %q", usage, tc.want)
+			}
+		})
+	}
+	t.Run("no bounds, no clause", func(t *testing.T) {
+		fields := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+			"page_token": map[string]interface{}{"type": "string", "location": "query"},
+		}}).Params()
+		if usage := paramFlagUsage(fields[0]); strings.Contains(usage, "min:") || strings.Contains(usage, "max:") {
+			t.Errorf("usage without bounds should not mention min/max, got %q", usage)
+		}
+	})
+}
+
+// The sanitized field description rides the help line — a bare name like
+// user_mailbox_id carries no meaning. The cut is at note separators (;), NOT
+// at sentence ends (。): the later sentence often holds the key affordance.
+func TestParamFlagUsage_Description(t *testing.T) {
+	fields := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+		"user_mailbox_id": map[string]interface{}{
+			"type": "string", "location": "path", "required": true,
+			"description": `用户邮箱地址。当使用用户身份访问时，可以输入"me"代表当前调用接口用户;后续补充说明不该出现`,
+		},
+	}}).Params()
+	usage := paramFlagUsage(fields[0])
+	if !strings.Contains(usage, `可以输入"me"代表当前调用接口用户`) {
+		t.Errorf("description must keep full sentences up to the note separator, got %q", usage)
+	}
+	if strings.Contains(usage, "补充说明") {
+		t.Errorf("text after the note separator must be cut, got %q", usage)
+	}
+
+	t.Run("long description truncated", func(t *testing.T) {
+		fields := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+			"x": map[string]interface{}{
+				"type": "string", "location": "query",
+				"description": strings.Repeat("长", 80),
+			},
+		}}).Params()
+		usage := paramFlagUsage(fields[0])
+		if !strings.Contains(usage, "...") {
+			t.Errorf("long description should be truncated with ellipsis, got %q", usage)
+		}
+		if strings.Contains(usage, strings.Repeat("长", 61)) {
+			t.Errorf("description should not exceed the cap, got %q", usage)
+		}
+	})
+
+	t.Run("trailing sentence punctuation trimmed", func(t *testing.T) {
+		fields := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+			"x": map[string]interface{}{
+				"type": "string", "location": "query", "description": "返回格式。",
+			},
+		}}).Params()
+		if usage := paramFlagUsage(fields[0]); strings.Contains(usage, "。.") {
+			t.Errorf("clause join must not double the punctuation, got %q", usage)
+		}
+	})
+}
+
+// Pins the convergence contract: the params-only addendum renders the SAME
+// fieldFacts list the typed flag's usage line joins inline — a fact added to
+// fieldFacts reaches both surfaces, and neither can drift over what a param's
+// help says (the addendum once rendered values-only enums and silently lacked
+// the API default).
+func TestParamHelp_BothSurfacesRenderFieldFacts(t *testing.T) {
+	f := meta.FromMap(map[string]interface{}{"parameters": map[string]interface{}{
+		"mode": map[string]interface{}{
+			"type": "string", "location": "query",
+			"description": "模式选择。",
+			"default":     "fast",
+			"min":         "1", "max": "8",
+			"options": []interface{}{
+				map[string]interface{}{"value": "fast", "description": "快速"},
+				map[string]interface{}{"value": "full"},
+			},
+		},
+	}}).Params()[0]
+
+	facts := fieldFacts(f)
+	if len(facts) != 4 { // description, enum, bounds, API default
+		t.Fatalf("fieldFacts = %v, want 4 facts", facts)
+	}
+	usage := paramFlagUsage(f)
+	help := (&paramFlagBinder{paramsOnly: []paramsOnlyField{{field: f}}}).paramsOnlyHelp()
+	for _, fact := range facts {
+		if !strings.Contains(usage, fact) {
+			t.Errorf("usage line missing fact %q: %q", fact, usage)
+		}
+		if !strings.Contains(help, fact) {
+			t.Errorf("params-only addendum missing fact %q:\n%s", fact, help)
+		}
+	}
+}
+
+// Bounds reach the registered flag's help end to end.
+func TestServiceMethod_TypedFlag_HelpShowsBounds(t *testing.T) {
+	method := meta.FromMap(map[string]interface{}{
+		"path":       "items",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"page_size": map[string]interface{}{"type": "integer", "location": "query", "min": "1", "max": "100", "default": "20"},
+		},
+	})
+	cmd := NewCmdServiceMethod(&cmdutil.Factory{}, imSpec(), method, "list", "items", nil)
+	fl := cmd.Flags().Lookup("page-size")
+	if fl == nil {
+		t.Fatal("expected generated --page-size flag")
+	}
+	if !strings.Contains(fl.Usage, "min: 1, max: 100") {
+		t.Errorf("flag usage should carry bounds, got %q", fl.Usage)
+	}
+}
+
+// The missing-required hint must name both recovery paths — the typed flag and
+// the --params fallback — so a reader who only knows one input style can
+// proceed without a round-trip through schema.
+func TestServiceMethod_MissingRequired_HintNamesFlagAndParams(t *testing.T) {
+	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), imChatMembersCreate(), "create", "chat.members", nil)
+	cmd.SetArgs([]string{"--data", `{"id_list":["ou_x"]}`, "--dry-run"})
+
+	err := cmd.Execute()
+	var ve *errs.ValidationError
+	if !errors.As(err, &ve) {
+		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
+	}
+	for _, want := range []string{"--chat-id", `--params '{"chat_id": "<value>"}'`, "lark-cli schema im.chat.members.create"} {
+		if !strings.Contains(ve.Hint, want) {
+			t.Errorf("hint %q should contain %q", ve.Hint, want)
+		}
+	}
+}
+
+// A params-only required field (kebab name claimed by the standard --format
+// flag) has no typed flag to offer: the hint must give only the --params form,
+// never steer the reader to the colliding flag.
+func TestServiceMethod_MissingRequired_ParamsOnlyHintSkipsFlag(t *testing.T) {
+	method := meta.FromMap(map[string]interface{}{
+		"path":       "messages",
+		"httpMethod": "GET",
+		"parameters": map[string]interface{}{
+			"format": map[string]interface{}{"type": "string", "location": "query", "required": true},
+		},
+	})
+	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
+	cmd := NewCmdServiceMethod(f, imSpec(), method, "list", "messages", nil)
+	cmd.SetArgs([]string{"--dry-run"})
+
+	err := cmd.Execute()
+	var ve *errs.ValidationError
+	if !errors.As(err, &ve) {
+		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
+	}
+	if !strings.Contains(ve.Hint, `--params '{"format": "<value>"}'`) {
+		t.Errorf("hint %q should carry the --params form", ve.Hint)
+	}
+	if strings.Contains(ve.Hint, "set --format") {
+		t.Errorf("hint %q must not steer to the colliding --format flag", ve.Hint)
+	}
+}

cmd/service/paramhelp.go

@@ -0,0 +1,162 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Help rendering for generated param flags. fieldFacts is the single list of
+// agent-relevant facts a param exposes; every help surface (the typed flag's
+// usage line, the params-only --params addendum) renders that one list, so the
+// surfaces cannot drift over which facts exist. Values come from the
+// meta.Field accessors, so nothing here depends on internal/schema.
+
+package service
+
+import (
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+
+	"github.com/larksuite/cli/internal/meta"
+	"github.com/larksuite/cli/internal/util"
+)
+
+// fieldFacts returns a param field's facts in display order, each as a compact
+// one-line clause: the sanitized description, the allowed enum values (with
+// meanings), the min/max constraint, and the API default. This is the ONE
+// place that decides what a param's help says — add a fact here (e.g. a future
+// deprecation marker) and every surface shows it. Unabridged prose and
+// per-option detail stay in `lark-cli schema`.
+func fieldFacts(f meta.Field) []string {
+	var facts []string
+	if d := sanitizeFieldDesc(f.Description); d != "" {
+		facts = append(facts, d)
+	}
+	if opts := f.EnumOptions(); len(opts) > 0 {
+		facts = append(facts, "enum: "+formatEnumInline(opts))
+	}
+	if b := formatBoundsInline(f); b != "" {
+		facts = append(facts, b)
+	}
+	if s := literalStr(f.CoercedDefault()); s != "" {
+		facts = append(facts, "API default: "+s)
+	}
+	return facts
+}
+
+// paramFlagUsage renders the typed param flag's help line:
+//
+//	<param_name>, required|optional[. <fact>]...
+//
+// It leads with the canonical underscore param name (the key this flag
+// overrides in --params) and required/optional, then joins the field's facts
+// inline.
+func paramFlagUsage(f meta.Field) string {
+	req := "optional"
+	if f.Required {
+		req = "required"
+	}
+	parts := append([]string{fmt.Sprintf("%s, %s", f.Name, req)}, fieldFacts(f)...)
+	return strings.Join(parts, ". ") + "."
+}
+
+// paramExample picks a concrete sample for a params-only field's --help snippet:
+// its first allowed enum value, else its example, else a placeholder.
+func paramExample(f meta.Field) string {
+	if vals := enumStrings(f.EnumValues()); len(vals) > 0 {
+		return fmt.Sprintf("%q", vals[0])
+	}
+	if s := literalStr(f.CoercedExample()); s != "" {
+		return fmt.Sprintf("%q", s)
+	}
+	return `"<value>"`
+}
+
+var markdownLinkRe = regexp.MustCompile(`\[([^\]]*)\]\([^)]*\)`)
+
+// inlineClause compresses metadata prose into one help clause: markdown links
+// keep their text, the clause cuts at the first rune in stops, whitespace
+// collapses, trailing punctuation goes — sentence enders (the clause join adds
+// its own) and connectors a cut can strand, like a colon introducing a list the
+// newline cut dropped — and the result caps at max runes. The two policies
+// below differ only in where they cut and how much they keep.
+func inlineClause(s, stops string, max int) string {
+	if s == "" {
+		return ""
+	}
+	s = markdownLinkRe.ReplaceAllString(s, "$1")
+	// Backquotes must go: pflag's UnquoteUsage treats a backquoted word in a
+	// flag's usage string as the flag's metavar, so a description like wiki
+	// space_id's "可替换为`my_library`" would render the flag as
+	// "--space-id my_library" instead of "--space-id string".
+	s = strings.ReplaceAll(s, "`", "")
+	if i := strings.IndexAny(s, stops); i >= 0 {
+		s = s[:i]
+	}
+	s = strings.Join(strings.Fields(s), " ")
+	s = strings.TrimRight(s, "。.：:，,、")
+	return util.TruncateStrWithEllipsis(s, max)
+}
+
+// sanitizeOptionDesc is the enum-option policy: many values share one line, so
+// keep only the first clause (cut at 。 too) and stay ultra-compact.
+func sanitizeOptionDesc(s string) string { return inlineClause(s, "。；;\n\r", 40) }
+
+// sanitizeFieldDesc is the field-description policy: one line per field, so
+// keep full sentences and cut only at note separators (meta_data appends
+// bullet notes after ;/；) — the later sentence often carries the key
+// affordance, e.g. user_mailbox_id's `可以输入"me"`.
+func sanitizeFieldDesc(s string) string { return inlineClause(s, "；;\n\r", 60) }
+
+// formatEnumInline renders allowed values for the help line: "v=meaning" when
+// the value carries a (sanitized, truncated) description — so opaque numeric
+// enums like succeed_type read as "0=…|1=…|2=…" — else just "v". Full meanings
+// live in the envelope's enumDescriptions / `lark-cli schema`.
+func formatEnumInline(opts []meta.EnumOption) string {
+	items := make([]string, len(opts))
+	for i, o := range opts {
+		if d := sanitizeOptionDesc(o.Description); d != "" {
+			items[i] = fmt.Sprintf("%v=%s", o.Value, d)
+		} else {
+			items[i] = fmt.Sprintf("%v", o.Value)
+		}
+	}
+	return strings.Join(items, "|")
+}
+
+// formatBoundsInline renders the field's min/max constraint ("min: 1, max:
+// 100", or the single declared side), or "" when the field declares neither.
+// The vocabulary matches the envelope's minimum/maximum, so help and `lark-cli
+// schema` state the same constraint.
+func formatBoundsInline(f meta.Field) string {
+	min, max := f.MinBound(), f.MaxBound()
+	switch {
+	case min != nil && max != nil:
+		return fmt.Sprintf("min: %s, max: %s", formatBound(*min), formatBound(*max))
+	case min != nil:
+		return "min: " + formatBound(*min)
+	case max != nil:
+		return "max: " + formatBound(*max)
+	}
+	return ""
+}
+
+// formatBound renders a bound without a float artifact (100 not 100.000000).
+func formatBound(v float64) string {
+	return strconv.FormatFloat(v, 'f', -1, 64)
+}
+
+// literalStr renders a coerced literal (default/example) for flag help,
+// returning "" for a nil or empty value so the caller can omit the clause.
+func literalStr(v interface{}) string {
+	if v == nil {
+		return ""
+	}
+	return fmt.Sprintf("%v", v)
+}
+
+func enumStrings(enum []interface{}) []string {
+	out := make([]string, 0, len(enum))
+	for _, e := range enum {
+		out = append(out, fmt.Sprintf("%v", e))
+	}
+	return out
+}

cmd/service/sanitize_test.go

@@ -0,0 +1,61 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package service
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestSanitizeOptionDesc(t *testing.T) {
+	cases := map[string]string{
+		"":                         "",
+		"以 open_id 标识用户":           "以 open_id 标识用户",
+		"中文。English second clause": "中文",         // first clause only (。)
+		"head；tail":                "head",       // first clause (；)
+		"line one\nline two":       "line one",   // first clause (newline)
+		"  spaced   out  ":         "spaced out", // whitespace collapsed
+		"see [飞书后台](https://x/admin) 详情": "see 飞书后台 详情", // markdown link -> text, url dropped
+	}
+	for in, want := range cases {
+		if got := sanitizeOptionDesc(in); got != want {
+			t.Errorf("sanitizeOptionDesc(%q) = %q, want %q", in, got, want)
+		}
+	}
+
+	// Truncation: a long single clause is cut to 40 runes with an ellipsis,
+	// rune-safe (no split mid-character).
+	long := strings.Repeat("文", 60)
+	got := sanitizeOptionDesc(long)
+	if r := []rune(got); len(r) != 40 || !strings.HasSuffix(got, "...") {
+		t.Errorf("truncation = %q (%d runes), want 40 runes ending in ...", got, len(r))
+	}
+}
+
+func TestSanitizeFieldDesc_TrimsDanglingPunctuation(t *testing.T) {
+	// A clause cut can strand a connector (e.g. a colon introducing a list the
+	// newline cut drops, as in im.reactions.list's message_id); the help line
+	// joiner then renders "…获取方式：." — so dangling punctuation must go too.
+	cases := map[string]string{
+		"待查询的消息ID。ID 获取方式：\n- 调用接口获取": "待查询的消息ID。ID 获取方式",
+		"see the list below:\nitem":   "see the list below",
+		"逗号结尾，\n下一行":                  "逗号结尾",
+	}
+	for in, want := range cases {
+		if got := sanitizeFieldDesc(in); got != want {
+			t.Errorf("sanitizeFieldDesc(%q) = %q, want %q", in, got, want)
+		}
+	}
+}
+
+func TestSanitizeFieldDesc_StripsBackquotes(t *testing.T) {
+	// pflag's UnquoteUsage takes a backquoted word in a flag's usage string as
+	// the flag's metavar: wiki space_id's description rendered the flag as
+	// "--space-id my_library" instead of "--space-id string".
+	in := "[知识空间id](https://x/wiki)，如果查询我的文档库可替换为`my_library`"
+	want := "知识空间id，如果查询我的文档库可替换为my_library"
+	if got := sanitizeFieldDesc(in); got != want {
+		t.Errorf("sanitizeFieldDesc(%q) = %q, want %q", in, got, want)
+	}
+}

cmd/service/service.go

@@ -10,18 +10,20 @@ import (
 	"strings"
 
 	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/apicatalog"
 	"github.com/larksuite/cli/internal/auth"
 	"github.com/larksuite/cli/internal/client"
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/credential"
 	"github.com/larksuite/cli/internal/errclass"
+	"github.com/larksuite/cli/internal/meta"
 	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/registry"
-	"github.com/larksuite/cli/internal/util"
 	"github.com/larksuite/cli/internal/validate"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
 )
 
 // RegisterServiceCommands registers all service commands from from_meta specs.
@@ -30,85 +32,74 @@ func RegisterServiceCommands(parent *cobra.Command, f *cmdutil.Factory) {
 }
 
 func RegisterServiceCommandsWithContext(ctx context.Context, parent *cobra.Command, f *cmdutil.Factory) {
-	for _, project := range registry.ListFromMetaProjects() {
-		spec := registry.LoadFromMeta(project)
-		if spec == nil {
+	// Drive the service list from the same navigation catalog the method walk
+	// uses — RuntimeCatalog().Services() is the deterministic, sorted view of the
+	// merged metadata — so registration is catalog-sourced end to end. Kept as a
+	// per-service loop rather than a flat WalkMethods(nil) drive precisely so a
+	// service with no methods still gets its bare command (WalkMethods yields one
+	// ref per method, so empty services would vanish).
+	for _, svc := range registry.RuntimeCatalog().Services() {
+		if svc.Name == "" || svc.ServicePath == "" {
 			continue
 		}
-		specName := registry.GetStrFromMap(spec, "name")
-		servicePath := registry.GetStrFromMap(spec, "servicePath")
-		if specName == "" || servicePath == "" {
-			continue
-		}
-		resources, _ := spec["resources"].(map[string]interface{})
-		if resources == nil {
-			continue
-		}
-		registerServiceWithContext(ctx, parent, spec, resources, f)
+		registerServiceWithContext(ctx, parent, svc, f)
 	}
 }
 
-func registerService(parent *cobra.Command, spec map[string]interface{}, resources map[string]interface{}, f *cmdutil.Factory) {
-	registerServiceWithContext(context.Background(), parent, spec, resources, f)
+func registerService(parent *cobra.Command, svc meta.Service, f *cmdutil.Factory) {
+	registerServiceWithContext(context.Background(), parent, svc, f)
 }
 
-func registerServiceWithContext(ctx context.Context, parent *cobra.Command, spec map[string]interface{}, resources map[string]interface{}, f *cmdutil.Factory) {
-	specName := registry.GetStrFromMap(spec, "name")
-	specDesc := registry.GetServiceDescription(specName, "en")
-	if specDesc == "" {
-		specDesc = registry.GetStrFromMap(spec, "description")
-	}
+func registerServiceWithContext(ctx context.Context, parent *cobra.Command, svc meta.Service, f *cmdutil.Factory) {
+	svcCmd := ensureChildCommand(parent, svc.Name, serviceShort(svc))
 
-	// Find existing service command or create one
-	var svc *cobra.Command
+	// Build the service's subtree from the catalog's method walk
+	// (apicatalog.ServiceMethods recurses nested resources), so the command tree
+	// is sourced from the same navigation Module as schema/scope rather than a
+	// hand-rolled resource/method walk. Each ref's ResourcePath becomes the
+	// resource-command chain — one level for a flat dotted resource like
+	// "chat.members", deeper for genuinely nested resources. A service with no
+	// methods keeps its bare command (svcCmd is created above regardless).
+	for _, ref := range apicatalog.ServiceMethods(svc, nil) {
+		resCmd := svcCmd
+		for _, seg := range ref.ResourcePath {
+			resCmd = ensureChildCommand(resCmd, seg, seg+" operations")
+		}
+		resCmd.AddCommand(buildMethodCommand(ctx, f, newMethodCommandSpec(ref), nil, parent.PersistentFlags()))
+	}
+}
+
+// serviceShort is the service command's help summary: the localized description
+// from the registry, falling back to the metadata's own description.
+func serviceShort(svc meta.Service) string {
+	if d := registry.GetServiceDescription(svc.Name, "en"); d != "" {
+		return d
+	}
+	return svc.Description
+}
+
+// ensureChildCommand returns the child of parent named name, creating it (with
+// short) when absent — so re-registration merges into an existing command tree
+// instead of duplicating a level.
+func ensureChildCommand(parent *cobra.Command, name, short string) *cobra.Command {
 	for _, c := range parent.Commands() {
-		if c.Name() == specName {
-			svc = c
-			break
+		if c.Name() == name {
+			return c
 		}
 	}
-	if svc == nil {
-		svc = &cobra.Command{
-			Use:   specName,
-			Short: specDesc,
-		}
-		parent.AddCommand(svc)
-	}
-
-	for resName, resource := range resources {
-		resMap, _ := resource.(map[string]interface{})
-		if resMap == nil {
-			continue
-		}
-		registerResourceWithContext(ctx, svc, spec, resName, resMap, f)
-	}
-}
-
-func registerResourceWithContext(ctx context.Context, parent *cobra.Command, spec map[string]interface{}, name string, resource map[string]interface{}, f *cmdutil.Factory) {
-	res := &cobra.Command{
-		Use:   name,
-		Short: name + " operations",
-	}
-	parent.AddCommand(res)
-
-	methods, _ := resource["methods"].(map[string]interface{})
-	for methodName, method := range methods {
-		methodMap, _ := method.(map[string]interface{})
-		if methodMap == nil {
-			continue
-		}
-		registerMethodWithContext(ctx, res, spec, methodMap, methodName, name, f)
-	}
+	cmd := &cobra.Command{Use: name, Short: short}
+	parent.AddCommand(cmd)
+	return cmd
 }
 
 // ServiceMethodOptions holds all inputs for a dynamically registered service method command.
 type ServiceMethodOptions struct {
-	Factory    *cmdutil.Factory
-	Cmd        *cobra.Command
-	Ctx        context.Context
-	Spec       map[string]interface{}
-	Method     map[string]interface{}
-	SchemaPath string
+	Factory     *cmdutil.Factory
+	Cmd         *cobra.Command
+	Ctx         context.Context
+	ServicePath string
+	Method      meta.Method
+	SchemaPath  string
 
 	// Flags
 	Params     string
@@ -123,41 +114,113 @@ type ServiceMethodOptions struct {
 	DryRun     bool
 	File       string   // --file flag value
 	FileFields []string // auto-detected file field names from metadata
+
+	// binder owns the generated typed param flags — registration and the
+	// --params overlay — replacing the raw paramFlags side-channel.
+	binder *paramFlagBinder
 }
 
-// detectFileFields delegates to the shared cmdutil.DetectFileFields helper.
-func detectFileFields(method map[string]interface{}) []string {
-	return cmdutil.DetectFileFields(method)
-}
-
-func registerMethodWithContext(ctx context.Context, parent *cobra.Command, spec map[string]interface{}, method map[string]interface{}, name string, resName string, f *cmdutil.Factory) {
-	parent.AddCommand(NewCmdServiceMethodWithContext(ctx, f, spec, method, name, resName, nil))
+// detectFileFields returns the request-body file-upload field names.
+func detectFileFields(m meta.Method) []string {
+	files := m.Files()
+	if len(files) == 0 {
+		return nil
+	}
+	names := make([]string, len(files))
+	for i, f := range files {
+		names[i] = f.Name
+	}
+	return names
 }
 
 // NewCmdServiceMethod creates a command for a dynamically registered service method.
-func NewCmdServiceMethod(f *cmdutil.Factory, spec, method map[string]interface{}, name, resName string, runF func(*ServiceMethodOptions) error) *cobra.Command {
-	return NewCmdServiceMethodWithContext(context.Background(), f, spec, method, name, resName, runF)
+func NewCmdServiceMethod(f *cmdutil.Factory, svc meta.Service, m meta.Method, name, resName string, runF func(*ServiceMethodOptions) error) *cobra.Command {
+	return NewCmdServiceMethodWithContext(context.Background(), f, svc, m, name, resName, runF)
 }
 
-func NewCmdServiceMethodWithContext(ctx context.Context, f *cmdutil.Factory, spec, method map[string]interface{}, name, resName string, runF func(*ServiceMethodOptions) error) *cobra.Command {
-	desc := registry.GetStrFromMap(method, "description")
-	httpMethod := registry.GetStrFromMap(method, "httpMethod")
-	risk := registry.GetStrFromMap(method, "risk")
-	specName := registry.GetStrFromMap(spec, "name")
-	schemaPath := fmt.Sprintf("%s.%s.%s", specName, resName, name)
+// NewCmdServiceMethodWithContext builds the command for one service method from
+// its (service, resource, method) coordinates, deriving the methodCommandSpec
+// via an apicatalog.MethodRef so direct callers and the catalog-driven
+// registration assemble the command identically.
+func NewCmdServiceMethodWithContext(ctx context.Context, f *cmdutil.Factory, svc meta.Service, m meta.Method, name, resName string, runF func(*ServiceMethodOptions) error) *cobra.Command {
+	m.Name = name
+	ref := apicatalog.MethodRef{Service: svc, ResourcePath: []string{resName}, Method: m}
+	// No root in scope here; persistent-flag collisions don't apply to a
+	// standalone command, and local/standard-flag collisions are still caught.
+	return buildMethodCommand(ctx, f, newMethodCommandSpec(ref), runF, nil)
+}
 
+// methodCommandSpec is the static description of one generated service method
+// command, read off an apicatalog.MethodRef — the single place command
+// construction gets the method's facts (schema path, HTTP base path, risk,
+// identities, params, file fields, request-body support), so the cobra command
+// is assembled from a typed spec rather than recomputing paths/flags inline.
+type methodCommandSpec struct {
+	method      meta.Method
+	schemaPath  string       // "service.resource.method", for the --help hint
+	servicePath string       // service HTTP base path
+	risk        string       // RiskRead | RiskWrite | RiskHighRiskWrite
+	restricts   bool         // method declares accessTokens (identity-restricted)
+	identities  []string     // permitted --as values; empty when unrestricted
+	params      []meta.Field // path/query params -> typed flags
+	fileFields  []string     // request-body file-upload field names
+	// acceptsBody is whether the HTTP method allows a request body at all (so
+	// --data is offered as a raw escape hatch). declaresBody is whether the
+	// metadata documents body fields (data or file). They differ for e.g. a POST
+	// with no documented requestBody: --data still works, but help must not imply
+	// the API declares a body.
+	acceptsBody  bool
+	declaresBody bool
+	affordance   string // rendered hand-authored usage guidance (when-to-use, examples); "" if none
+}
+
+func newMethodCommandSpec(ref apicatalog.MethodRef) methodCommandSpec {
+	m := ref.Method
+	return methodCommandSpec{
+		method:       m,
+		schemaPath:   ref.SchemaPath(),
+		servicePath:  ref.Service.ServicePath,
+		risk:         m.Risk,
+		restricts:    m.RestrictsIdentity(),
+		identities:   m.Identities(),
+		params:       m.Params(),
+		fileFields:   detectFileFields(m),
+		acceptsBody:  methodTakesBody(m.HTTPMethod),
+		declaresBody: len(m.Data()) > 0 || len(m.Files()) > 0,
+		affordance:   renderAffordance(m),
+	}
+}
+
+// methodTakesBody reports whether the HTTP method allows a request body, i.e.
+// whether --data applies (as a raw escape hatch even when no body is declared).
+func methodTakesBody(httpMethod string) bool {
+	switch httpMethod {
+	case "POST", "PUT", "PATCH", "DELETE":
+		return true
+	}
+	return false
+}
+
+// buildMethodCommand assembles the cobra command for a service method from its
+// static spec: the standard flags, the conditional --data/--file/--yes flags,
+// the generated typed param flags (via paramFlagBinder), and the risk/identity
+// policy annotations.
+func buildMethodCommand(ctx context.Context, f *cmdutil.Factory, spec methodCommandSpec, runF func(*ServiceMethodOptions) error, reserved *pflag.FlagSet) *cobra.Command {
+	m := spec.method
 	opts := &ServiceMethodOptions{
-		Factory:    f,
-		Spec:       spec,
-		Method:     method,
-		SchemaPath: schemaPath,
+		Factory:     f,
+		ServicePath: spec.servicePath,
+		Method:      m,
+		SchemaPath:  spec.schemaPath,
+		FileFields:  spec.fileFields,
 	}
 	var asStr string
 
 	cmd := &cobra.Command{
-		Use:   name,
-		Short: desc,
-		Long:  fmt.Sprintf("%s\n\nView parameter definitions before calling:\n  lark-cli schema %s", desc, schemaPath),
+		Use:   m.Name,
+		Short: m.Description,
+		// Long is assembled below, once the binder knows which params got no
+		// typed flag.
 		RunE: func(cmd *cobra.Command, args []string) error {
 			opts.Cmd = cmd
 			opts.Ctx = cmd.Context()
@@ -169,10 +232,15 @@ func NewCmdServiceMethodWithContext(ctx context.Context, f *cmdutil.Factory, spe
 		},
 	}
 
-	cmd.Flags().StringVar(&opts.Params, "params", "", "URL/query parameters JSON (supports - for stdin, @file for file input)")
-	switch httpMethod {
-	case "POST", "PUT", "PATCH", "DELETE":
-		cmd.Flags().StringVar(&opts.Data, "data", "", "request body JSON (supports - for stdin, @file for file input)")
+	cmd.Flags().StringVar(&opts.Params, "params", "", "Raw URL/query params JSON. Supports - and @file.")
+	if spec.acceptsBody {
+		dataUsage := "JSON request body. Supports - and @file."
+		if !spec.declaresBody {
+			// POST/etc. with no documented body fields: --data is a raw escape
+			// hatch, not a declared body — say so rather than imply structure.
+			dataUsage = "Raw JSON request body (no documented fields; see schema). Supports - and @file."
+		}
+		cmd.Flags().StringVar(&opts.Data, "data", "", dataUsage)
 	}
 	cmdutil.AddAPIIdentityFlag(ctx, cmd, f, &asStr)
 	cmd.Flags().StringVarP(&opts.Output, "output", "o", "", "output file path for binary responses")
@@ -183,27 +251,61 @@ func NewCmdServiceMethodWithContext(ctx context.Context, f *cmdutil.Factory, spe
 	cmd.Flags().Bool("json", false, "shorthand for --format json")
 	cmd.Flags().StringVarP(&opts.JqExpr, "jq", "q", "", "jq expression to filter JSON output")
 	cmd.Flags().BoolVar(&opts.DryRun, "dry-run", false, "print request without executing")
-	if risk == "high-risk-write" {
+	if spec.risk == cmdutil.RiskHighRiskWrite {
 		cmd.Flags().Bool("yes", false, "confirm high-risk operation")
 	}
-
-	// Conditionally register --file for methods with file-type fields.
-	fileFields := detectFileFields(method)
-	opts.FileFields = fileFields
-	if len(fileFields) > 0 {
-		switch httpMethod {
-		case "POST", "PUT", "PATCH", "DELETE":
-			cmd.Flags().StringVar(&opts.File, "file", "", "file to upload ([field=]path, supports - for stdin)")
-		}
+	// --file only for body methods that actually declare file-type fields.
+	if len(spec.fileFields) > 0 && spec.acceptsBody {
+		cmd.Flags().StringVar(&opts.File, "file", "", "File upload [field=]path. Supports - and stdin.")
 	}
 	cmdutil.RegisterFlagCompletion(cmd, "format", func(_ *cobra.Command, _ []string, _ string) ([]string, cobra.ShellCompDirective) {
 		return []string{"json", "ndjson", "table", "csv"}, cobra.ShellCompDirectiveNoFileComp
 	})
 
-	cmdutil.SetTips(cmd, registry.GetStrSliceFromMap(method, "tips"))
-	cmdutil.SetRisk(cmd, risk)
-	if tokens, ok := method["accessTokens"].([]interface{}); ok && len(tokens) > 0 {
-		cmdutil.SetSupportedIdentities(cmd, cmdutil.AccessTokensToIdentities(tokens))
+	// Registered last so the collision guard sees the standard flags above.
+	opts.binder = newParamFlagBinder(cmd, spec.params, reserved)
+	// Single composition point for Long: description, affordance, schema
+	// pointer, and the binder's params-only addendum (params whose flag name is
+	// taken, reachable via --params only).
+	cmd.Long = methodLong(m.Description, spec.affordance, spec.schemaPath, opts.binder.paramsOnlyHelp())
+
+	// Group flags for the grouped --help renderer (typed param flags are grouped
+	// as API Parameters by the binder). tagFlagGroup is a no-op for flags not
+	// registered above (e.g. --data/--file/--yes only exist for some methods).
+	// --data sits under Request Body only when the metadata documents body
+	// fields; otherwise it's a raw escape hatch, grouped with --params so help
+	// doesn't imply a declared body the API doesn't have.
+	if fl := cmd.Flags().Lookup("data"); fl != nil {
+		if spec.declaresBody {
+			annotate(fl, flagGroupAnnotation, []string{groupBody})
+		} else {
+			annotate(fl, flagGroupAnnotation, []string{groupRaw})
+		}
+	}
+	tagFlagGroup(cmd.Flags(), "file", groupBody)
+	if fl := cmd.Flags().Lookup("params"); fl != nil {
+		annotate(fl, flagGroupAnnotation, []string{groupRaw})
+		// State the precedence rule where the agent reads it: --params is the
+		// base, typed flags override. Only meaningful when typed flags exist.
+		if len(spec.params) > 0 {
+			annotate(fl, flagNoteAnnotation, []string{
+				"Typed API parameter flags above are preferred.",
+				"If both are set, typed flags override matching keys in --params.",
+			})
+		}
+	}
+	for _, name := range []string{"as", "dry-run", "page-all", "page-limit", "page-delay", "yes"} {
+		tagFlagGroup(cmd.Flags(), name, groupExecution)
+	}
+	for _, name := range []string{"output", "format", "jq"} {
+		tagFlagGroup(cmd.Flags(), name, groupOutput)
+	}
+	applyGroupedUsage(cmd)
+
+	cmdutil.SetTips(cmd, m.Tips)
+	cmdutil.SetRisk(cmd, spec.risk)
+	if spec.restricts {
+		cmdutil.SetSupportedIdentities(cmd, spec.identities)
 	}
 
 	return cmd
@@ -218,8 +320,8 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 	}
 
 	// Check if this API method supports the resolved identity.
-	if tokens, ok := opts.Method["accessTokens"].([]interface{}); ok && len(tokens) > 0 {
-		if err := f.CheckIdentity(opts.As, cmdutil.AccessTokensToIdentities(tokens)); err != nil {
+	if opts.Method.RestrictsIdentity() {
+		if err := f.CheckIdentity(opts.As, opts.Method.Identities()); err != nil {
 			return err
 		}
 	}
@@ -235,12 +337,10 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 	if err != nil {
 		return err
 	}
-	// Identity info is now included in the JSON envelope; skip stderr printing.
-	// cmdutil.PrintIdentity(f.IOStreams.ErrOut, opts.As, config, f.IdentityAutoDetected)
+	// Identity is not printed to stderr here: it is part of the JSON envelope.
 
-	scopes, _ := opts.Method["scopes"].([]interface{})
 	if !opts.As.IsBot() {
-		if err := checkServiceScopes(opts.Ctx, f.Credential, opts.As, config, opts.Method, scopes); err != nil {
+		if err := checkServiceScopes(opts.Ctx, f.Credential, opts.As, config, opts.Method); err != nil {
 			return err
 		}
 	}
@@ -257,7 +357,7 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 		return serviceDryRun(f, request, config, opts.Format)
 	}
 
-	if registry.GetStrFromMap(opts.Method, "risk") == "high-risk-write" {
+	if opts.Method.Risk == cmdutil.RiskHighRiskWrite {
 		if yes, _ := opts.Cmd.Flags().GetBool("yes"); !yes {
 			return cmdutil.RequireConfirmation(opts.SchemaPath)
 		}
@@ -302,7 +402,7 @@ func serviceMethodRun(opts *ServiceMethodOptions) error {
 }
 
 // checkServiceScopes pre-checks user scopes before making the API call.
-func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider, identity core.Identity, config *core.CliConfig, method map[string]interface{}, scopes []interface{}) error {
+func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider, identity core.Identity, config *core.CliConfig, method meta.Method) error {
 	if ctx.Err() != nil {
 		return ctx.Err()
 	}
@@ -311,23 +411,15 @@ func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider
 		return nil //nolint:nilerr // skip scope check when token resolution fails or has no scopes
 	}
 
-	requiredScopes, hasRequired := method["requiredScopes"].([]interface{})
-
-	if hasRequired && len(requiredScopes) > 0 {
+	if len(method.RequiredScopes) > 0 {
 		// Strict: ALL requiredScopes must be present
-		required := make([]string, 0, len(requiredScopes))
-		for _, s := range requiredScopes {
-			if str, ok := s.(string); ok {
-				required = append(required, str)
-			}
-		}
-		if missing := auth.MissingScopes(result.Scopes, required); len(missing) > 0 {
+		if missing := auth.MissingScopes(result.Scopes, method.RequiredScopes); len(missing) > 0 {
 			return newPreflightMissingScopeError(string(config.Brand), config.AppID, string(identity), missing)
 		}
 		return nil
 	}
 
-	if len(scopes) == 0 {
+	if len(method.Scopes) == 0 {
 		return nil
 	}
 
@@ -336,12 +428,12 @@ func checkServiceScopes(ctx context.Context, cred *credential.CredentialProvider
 	for _, s := range strings.Fields(result.Scopes) {
 		grantedSet[s] = true
 	}
-	for _, s := range scopes {
-		if str, ok := s.(string); ok && grantedSet[str] {
+	for _, s := range method.Scopes {
+		if grantedSet[s] {
 			return nil
 		}
 	}
-	recommended := registry.SelectRecommendedScope(scopes, "user")
+	recommended := registry.SelectRecommendedScopeFromStrings(method.Scopes, "user")
 	return newPreflightMissingScopeError(string(config.Brand), config.AppID, string(identity), []string{recommended})
 }
 
@@ -362,14 +454,44 @@ func newPreflightMissingScopeError(brand, appID, identity string, missing []stri
 		WithIdentity(identity)
 }
 
+// unusableParamValue reports whether a provided path/query parameter value
+// cannot form a usable request value: nil or an empty string. A key's presence
+// in params is the intent signal — a typed flag is overlaid only when
+// explicitly Changed, and a --params JSON key is deliberately written — so
+// false and 0 are real values and must not be conflated with "unset"
+// (reflect.IsZero would drop an explicit --with-deleted=false or --foo 0).
+// Only nil/"" stay treated as missing: that keeps the friendly pre-flight
+// error when a required param is fed an empty placeholder, and never emits a
+// declared param as an empty path segment or query value. Undeclared keys are
+// not judged by this rule — they pass through verbatim as the raw escape hatch.
+func unusableParamValue(v interface{}) bool {
+	if v == nil {
+		return true
+	}
+	s, ok := v.(string)
+	return ok && s == ""
+}
+
+// missingParamHint is the recovery hint for a missing required parameter. It
+// names both input paths — the typed flag when the binder registered one, and
+// the --params fallback — plus the schema pointer. A params-only field gets
+// only the --params form: a flag with its kebab name exists but belongs to
+// something else (e.g. the output --format), and the hint must not steer
+// there. Asking the binder, not cmd.Flags(), is what tells those apart.
+func missingParamHint(opts *ServiceMethodOptions, f meta.Field) string {
+	paramsForm := fmt.Sprintf("--params '{%q: \"<value>\"}'", f.Name)
+	if opts.binder.hasTypedFlag(f.Name) {
+		return fmt.Sprintf("set --%s <value> (or %s); see: lark-cli schema %s", f.FlagName(), paramsForm, opts.SchemaPath)
+	}
+	return fmt.Sprintf("set %s; see: lark-cli schema %s", paramsForm, opts.SchemaPath)
+}
+
 // buildServiceRequest parses flags, builds the URL with path/query params, and returns a RawApiRequest.
 // When dryRun is true and a file is provided, file reading is skipped and
 // FileUploadMeta is returned instead so the caller can render dry-run output.
 func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmdutil.FileUploadMeta, error) {
-	spec := opts.Spec
 	method := opts.Method
-	schemaPath := opts.SchemaPath
-	httpMethod := registry.GetStrFromMap(method, "httpMethod")
+	httpMethod := method.HTTPMethod
 
 	// stdin is an io.Reader consumed at most once. Only one of --params/--data
 	// may use "-" (stdin); the conflict check below prevents silent data loss.
@@ -387,53 +509,55 @@ func buildServiceRequest(opts *ServiceMethodOptions) (client.RawApiRequest, *cmd
 	if err != nil {
 		return client.RawApiRequest{}, nil, err
 	}
+	opts.binder.overlay(opts.Cmd, params)
 
-	url := registry.GetStrFromMap(spec, "servicePath") + "/" + registry.GetStrFromMap(method, "path")
+	url := opts.ServicePath + "/" + method.Path
 
-	parameters, _ := method["parameters"].(map[string]interface{})
-	for name, param := range parameters {
-		p, _ := param.(map[string]interface{})
-		if registry.GetStrFromMap(p, "location") != "path" {
+	specs := method.Params()
+	for _, s := range specs {
+		if s.Location != "path" {
 			continue
 		}
-		val, ok := params[name]
-		if !ok || util.IsEmptyValue(val) {
+		val, ok := params[s.Name]
+		if !ok || unusableParamValue(val) {
 			return client.RawApiRequest{}, nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"missing required path parameter: %s", name).
-				WithHint("lark-cli schema %s", schemaPath).
-				WithParam(name)
+				"missing required path parameter: %s", s.Name).
+				WithHint("%s", missingParamHint(opts, s)).
+				WithParam(s.Name)
 		}
 		valStr := fmt.Sprintf("%v", val)
-		if err := validate.ResourceName(valStr, name); err != nil {
-			return client.RawApiRequest{}, nil, errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).WithParam(name).WithCause(err)
+		if err := validate.ResourceName(valStr, s.Name); err != nil {
+			return client.RawApiRequest{}, nil, errs.NewValidationError(errs.SubtypeInvalidArgument, "%s", err).WithParam(s.Name).WithCause(err)
 		}
-		url = strings.Replace(url, "{"+name+"}", validate.EncodePathSegment(valStr), 1)
-		delete(params, name)
+		url = strings.Replace(url, "{"+s.Name+"}", validate.EncodePathSegment(valStr), 1)
+		delete(params, s.Name)
 	}
 
 	queryParams := map[string]interface{}{}
-	for name, param := range parameters {
-		p, _ := param.(map[string]interface{})
-		if registry.GetStrFromMap(p, "location") != "query" {
+	for _, s := range specs {
+		if s.Location != "query" {
 			continue
 		}
-		value, exists := params[name]
-		required, _ := p["required"].(bool)
-		isPaginationParam := opts.PageAll && (name == "page_token" || name == "page_size")
-		if required && !isPaginationParam && (!exists || util.IsEmptyValue(value)) {
+		value, exists := params[s.Name]
+		isPaginationParam := opts.PageAll && (s.Name == "page_token" || s.Name == "page_size")
+		if s.Required && !isPaginationParam && (!exists || unusableParamValue(value)) {
 			return client.RawApiRequest{}, nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
-				"missing required query parameter: %s", name).
-				WithHint("lark-cli schema %s", schemaPath).
-				WithParam(name)
+				"missing required query parameter: %s", s.Name).
+				WithHint("%s", missingParamHint(opts, s)).
+				WithParam(s.Name)
 		}
-		if exists && !util.IsEmptyValue(value) {
-			queryParams[name] = value
+		if exists && !unusableParamValue(value) {
+			queryParams[s.Name] = value
 		}
+		// This loop owns declared query params: consume the key so the
+		// passthrough below can't resurrect a value the gate dropped (an
+		// unusable "" would otherwise be sent as an empty query value).
+		delete(params, s.Name)
 	}
+	// Whatever remains is undeclared — the raw escape hatch for params the
+	// metadata doesn't (yet) describe; passed through verbatim, no filtering.
 	for name, value := range params {
-		if _, ok := queryParams[name]; !ok {
-			queryParams[name] = value
-		}
+		queryParams[name] = value
 	}
 
 	request := client.RawApiRequest{

cmd/service/service_risk_test.go

@@ -8,13 +8,14 @@ import (
 	"testing"
 
 	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/meta"
 )
 
 // highRiskDeleteMethod mirrors a simple DELETE API with a required path
-// parameter and risk metadata. The returned map is what service registration
-// reads; the test exercises --yes registration and the gate behavior.
-func highRiskDeleteMethod() map[string]interface{} {
-	return map[string]interface{}{
+// parameter and risk metadata. The test exercises --yes registration and the
+// gate behavior.
+func highRiskDeleteMethod() meta.Method {
+	return meta.FromMap(map[string]interface{}{
 		"path":       "files/{file_token}",
 		"httpMethod": "DELETE",
 		"risk":       "high-risk-write",
@@ -23,11 +24,11 @@ func highRiskDeleteMethod() map[string]interface{} {
 				"type": "string", "location": "path", "required": true,
 			},
 		},
-	}
+	})
 }
 
-func writeMethodNoRisk() map[string]interface{} {
-	return map[string]interface{}{
+func writeMethodNoRisk() meta.Method {
+	return meta.FromMap(map[string]interface{}{
 		"path":       "files/{file_token}",
 		"httpMethod": "DELETE",
 		"parameters": map[string]interface{}{
@@ -35,7 +36,7 @@ func writeMethodNoRisk() map[string]interface{} {
 				"type": "string", "location": "path", "required": true,
 			},
 		},
-	}
+	})
 }
 
 func TestServiceMethod_YesFlagRegisteredForHighRisk(t *testing.T) {

cmd/service/service_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/larksuite/cli/internal/cmdutil"
 	"github.com/larksuite/cli/internal/core"
 	"github.com/larksuite/cli/internal/httpmock"
+	"github.com/larksuite/cli/internal/meta"
 	"github.com/spf13/cobra"
 )
 
@@ -20,14 +21,14 @@ var testConfig = &core.CliConfig{
 	AppID: "test-app", AppSecret: "test-secret", Brand: core.BrandFeishu,
 }
 
-func driveSpec() map[string]interface{} {
-	return map[string]interface{}{
+func driveSpec() meta.Service {
+	return meta.ServiceFromMap(map[string]interface{}{
 		"name":        "drive",
 		"servicePath": "/open-apis/drive/v1",
-	}
+	})
 }
 
-func driveMethod(httpMethod string, params map[string]interface{}) map[string]interface{} {
+func driveMethod(httpMethod string, params map[string]interface{}) meta.Method {
 	m := map[string]interface{}{
 		"path":       "files/{file_token}/copy",
 		"httpMethod": httpMethod,
@@ -41,7 +42,7 @@ func driveMethod(httpMethod string, params map[string]interface{}) map[string]in
 			},
 		}
 	}
-	return m
+	return meta.FromMap(m)
 }
 
 // ── registerService ──
@@ -49,23 +50,23 @@ func driveMethod(httpMethod string, params map[string]interface{}) map[string]in
 func TestRegisterService(t *testing.T) {
 	parent := &cobra.Command{Use: "root"}
 	f := &cmdutil.Factory{}
-	spec := map[string]interface{}{
+	base := meta.ServiceFromMap(map[string]interface{}{
 		"name":        "base",
 		"description": "Base API",
 		"servicePath": "/open-apis/base/v3",
-	}
-	resources := map[string]interface{}{
-		"tables": map[string]interface{}{
-			"methods": map[string]interface{}{
-				"list": map[string]interface{}{
-					"description": "List tables",
-					"httpMethod":  "GET",
+		"resources": map[string]interface{}{
+			"tables": map[string]interface{}{
+				"methods": map[string]interface{}{
+					"list": map[string]interface{}{
+						"description": "List tables",
+						"httpMethod":  "GET",
+					},
 				},
 			},
 		},
-	}
+	})
 
-	registerService(parent, spec, resources, f)
+	registerService(parent, base, f)
 
 	// service command exists
 	svc, _, err := parent.Find([]string{"base"})
@@ -90,18 +91,18 @@ func TestRegisterService_MergesExistingCommand(t *testing.T) {
 	parent.AddCommand(existing)
 
 	f := &cmdutil.Factory{}
-	spec := map[string]interface{}{
+	svc := meta.ServiceFromMap(map[string]interface{}{
 		"name": "base", "description": "Base API", "servicePath": "/open-apis/base/v3",
-	}
-	resources := map[string]interface{}{
-		"tables": map[string]interface{}{
-			"methods": map[string]interface{}{
-				"list": map[string]interface{}{"description": "List", "httpMethod": "GET"},
+		"resources": map[string]interface{}{
+			"tables": map[string]interface{}{
+				"methods": map[string]interface{}{
+					"list": map[string]interface{}{"description": "List", "httpMethod": "GET"},
+				},
 			},
 		},
-	}
+	})
 
-	registerService(parent, spec, resources, f)
+	registerService(parent, svc, f)
 
 	// Should reuse existing, not duplicate
 	count := 0
@@ -143,7 +144,7 @@ func TestNewCmdServiceMethod_StrictModeHidesAsFlag(t *testing.T) {
 func TestNewCmdServiceMethod_GETHasNoDataFlag(t *testing.T) {
 	f := &cmdutil.Factory{}
 	cmd := NewCmdServiceMethod(f, driveSpec(),
-		map[string]interface{}{"description": "desc", "httpMethod": "GET"}, "list", "files", nil)
+		meta.FromMap(map[string]interface{}{"description": "desc", "httpMethod": "GET"}), "list", "files", nil)
 
 	if cmd.Flags().Lookup("data") != nil {
 		t.Error("GET method should not have --data flag")
@@ -159,7 +160,7 @@ func TestNewCmdServiceMethod_GETHasNoDataFlag(t *testing.T) {
 func TestNewCmdServiceMethod_POSTHasDataFlag(t *testing.T) {
 	f := &cmdutil.Factory{}
 	cmd := NewCmdServiceMethod(f, driveSpec(),
-		map[string]interface{}{"description": "desc", "httpMethod": "POST"}, "create", "files", nil)
+		meta.FromMap(map[string]interface{}{"description": "desc", "httpMethod": "POST"}), "create", "files", nil)
 
 	if cmd.Flags().Lookup("data") == nil {
 		t.Error("POST method should have --data flag")
@@ -171,7 +172,7 @@ func TestNewCmdServiceMethod_RunFCallback(t *testing.T) {
 
 	var captured *ServiceMethodOptions
 	cmd := NewCmdServiceMethod(f, driveSpec(),
-		map[string]interface{}{"description": "desc", "httpMethod": "GET"}, "list", "files",
+		meta.FromMap(map[string]interface{}{"description": "desc", "httpMethod": "GET"}), "list", "files",
 		func(opts *ServiceMethodOptions) error {
 			captured = opts
 			return nil
@@ -268,15 +269,15 @@ func TestServiceMethod_MissingPathParam(t *testing.T) {
 }
 
 func TestServiceMethod_MissingRequiredQueryParam(t *testing.T) {
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{
+	})
+	method := meta.FromMap(map[string]interface{}{
 		"path": "items", "httpMethod": "GET",
 		"parameters": map[string]interface{}{
 			"q": map[string]interface{}{"location": "query", "required": true},
 		},
-	}
+	})
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--params", `{}`, "--dry-run"})
@@ -291,15 +292,15 @@ func TestServiceMethod_MissingRequiredQueryParam(t *testing.T) {
 }
 
 func TestServiceMethod_PaginationParamSkippedWithPageAll(t *testing.T) {
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{
+	})
+	method := meta.FromMap(map[string]interface{}{
 		"path": "items", "httpMethod": "GET",
 		"parameters": map[string]interface{}{
 			"page_size": map[string]interface{}{"location": "query", "required": true},
 		},
-	}
+	})
 	f, stdout, _, _ := cmdutil.TestFactory(t, testConfig)
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--params", `{}`, "--page-all", "--dry-run"})
@@ -315,10 +316,10 @@ func TestServiceMethod_PaginationParamSkippedWithPageAll(t *testing.T) {
 
 func TestServiceMethod_InvalidParamsJSON(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET"}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET"})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--params", "{bad", "--dry-run"})
 
@@ -333,10 +334,10 @@ func TestServiceMethod_InvalidParamsJSON(t *testing.T) {
 
 func TestServiceMethod_InvalidDataJSON(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "POST", "parameters": map[string]interface{}{}}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "POST", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "create", "items", nil)
 	cmd.SetArgs([]string{"--data", "{bad", "--dry-run"})
 
@@ -351,10 +352,10 @@ func TestServiceMethod_InvalidDataJSON(t *testing.T) {
 
 func TestServiceMethod_ParamsAndDataBothStdinConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "POST", "parameters": map[string]interface{}{}}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "POST", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "create", "items", nil)
 	cmd.SetArgs([]string{"--params", "-", "--data", "-", "--dry-run"})
 
@@ -369,10 +370,10 @@ func TestServiceMethod_ParamsAndDataBothStdinConflict(t *testing.T) {
 
 func TestServiceMethod_OutputAndPageAllConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET"}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET"})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--page-all", "--output", "file.bin", "--as", "bot"})
 
@@ -398,8 +399,8 @@ func TestServiceMethod_BotMode_Success(t *testing.T) {
 		},
 	})
 
-	spec := map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}}
+	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--as", "bot"})
 
@@ -427,8 +428,8 @@ func TestServiceMethod_BotMode_PageAll_JSON(t *testing.T) {
 		},
 	})
 
-	spec := map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}}
+	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--as", "bot", "--page-all"})
 
@@ -450,8 +451,8 @@ func TestServiceMethod_UnknownFormat_Warning(t *testing.T) {
 		Body: map[string]interface{}{"code": 0, "msg": "ok", "data": map[string]interface{}{}},
 	})
 
-	spec := map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}}
+	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--as", "bot", "--format", "unknown"})
 
@@ -470,7 +471,7 @@ func TestNewCmdServiceMethod_JqFlag(t *testing.T) {
 
 	var captured *ServiceMethodOptions
 	cmd := NewCmdServiceMethod(f, driveSpec(),
-		map[string]interface{}{"description": "desc", "httpMethod": "GET"}, "list", "files",
+		meta.FromMap(map[string]interface{}{"description": "desc", "httpMethod": "GET"}), "list", "files",
 		func(opts *ServiceMethodOptions) error {
 			captured = opts
 			return nil
@@ -492,7 +493,7 @@ func TestNewCmdServiceMethod_JqShortForm(t *testing.T) {
 
 	var captured *ServiceMethodOptions
 	cmd := NewCmdServiceMethod(f, driveSpec(),
-		map[string]interface{}{"description": "desc", "httpMethod": "GET"}, "list", "files",
+		meta.FromMap(map[string]interface{}{"description": "desc", "httpMethod": "GET"}), "list", "files",
 		func(opts *ServiceMethodOptions) error {
 			captured = opts
 			return nil
@@ -508,10 +509,10 @@ func TestNewCmdServiceMethod_JqShortForm(t *testing.T) {
 
 func TestServiceMethod_JqAndOutputConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET"}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET"})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--jq", ".data", "--output", "file.bin", "--as", "bot"})
 
@@ -542,8 +543,8 @@ func TestServiceMethod_JqFilter_AppliesExpression(t *testing.T) {
 		},
 	})
 
-	spec := map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}}
+	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--as", "bot", "--jq", ".data.items[].name"})
 
@@ -561,10 +562,10 @@ func TestServiceMethod_JqFilter_AppliesExpression(t *testing.T) {
 
 func TestServiceMethod_JqAndFormatConflict(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET"}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET"})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--jq", ".data", "--format", "ndjson", "--as", "bot"})
 
@@ -579,10 +580,10 @@ func TestServiceMethod_JqAndFormatConflict(t *testing.T) {
 
 func TestServiceMethod_JqInvalidExpression(t *testing.T) {
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	spec := map[string]interface{}{
+	spec := meta.ServiceFromMap(map[string]interface{}{
 		"name": "svc", "servicePath": "/open-apis/svc/v1",
-	}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET"}
+	})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET"})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--jq", "invalid[", "--as", "bot"})
 
@@ -611,8 +612,8 @@ func TestServiceMethod_PageAll_WithJq(t *testing.T) {
 		},
 	})
 
-	spec := map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"}
-	method := map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}}
+	spec := meta.ServiceFromMap(map[string]interface{}{"name": "svc", "servicePath": "/open-apis/svc/v1"})
+	method := meta.FromMap(map[string]interface{}{"path": "items", "httpMethod": "GET", "parameters": map[string]interface{}{}})
 	cmd := NewCmdServiceMethod(f, spec, method, "list", "items", nil)
 	cmd.SetArgs([]string{"--as", "bot", "--page-all", "--jq", ".data.items[].id"})
 
@@ -630,8 +631,8 @@ func TestServiceMethod_PageAll_WithJq(t *testing.T) {
 
 // ── file upload ──
 
-func imImageMethod() map[string]interface{} {
-	return map[string]interface{}{
+func imImageMethod() meta.Method {
+	return meta.FromMap(map[string]interface{}{
 		"path":       "images",
 		"httpMethod": "POST",
 		"requestBody": map[string]interface{}{
@@ -645,14 +646,14 @@ func imImageMethod() map[string]interface{} {
 			},
 		},
 		"accessTokens": []interface{}{"user", "tenant"},
-	}
+	})
 }
 
-func imSpec() map[string]interface{} {
-	return map[string]interface{}{
+func imSpec() meta.Service {
+	return meta.ServiceFromMap(map[string]interface{}{
 		"name":        "im",
 		"servicePath": "/open-apis/im/v1",
-	}
+	})
 }
 
 func TestServiceMethod_FileFlagRegistered(t *testing.T) {
@@ -684,7 +685,7 @@ func TestServiceMethod_FileFlagNotRegisteredForGET(t *testing.T) {
 		},
 	}
 	f, _, _, _ := cmdutil.TestFactory(t, testConfig)
-	cmd := NewCmdServiceMethod(f, imSpec(), getMethod, "get", "images", nil)
+	cmd := NewCmdServiceMethod(f, imSpec(), meta.FromMap(getMethod), "get", "images", nil)
 	flag := cmd.Flags().Lookup("file")
 	if flag != nil {
 		t.Fatal("expected --file flag NOT to be registered for GET method")
@@ -752,7 +753,7 @@ func TestDetectFileFields(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := detectFileFields(tt.method)
+			got := detectFileFields(meta.FromMap(tt.method))
 			if len(got) != len(tt.want) {
 				t.Errorf("detectFileFields() = %v, want %v", got, tt.want)
 				return
@@ -771,7 +772,7 @@ func TestServiceMethod_JsonFlag_Accepted(t *testing.T) {
 
 	var captured *ServiceMethodOptions
 	cmd := NewCmdServiceMethod(f, driveSpec(),
-		map[string]interface{}{"description": "desc", "httpMethod": "GET"}, "list", "files",
+		meta.FromMap(map[string]interface{}{"description": "desc", "httpMethod": "GET"}), "list", "files",
 		func(opts *ServiceMethodOptions) error {
 			captured = opts
 			return nil

cmd/skill/skill.go

@@ -0,0 +1,183 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package skill implements the `lark-cli skills` command group, which serves
+// binary-embedded skill content to AI agents. The package is "skill"; the
+// user-facing verb is "skills".
+package skill
+
+import (
+	"fmt"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/cmdutil"
+	"github.com/larksuite/cli/internal/output"
+	"github.com/larksuite/cli/internal/skillcontent"
+	"github.com/spf13/cobra"
+)
+
+func newReader(f *cmdutil.Factory) (*skillcontent.Reader, error) {
+	if f.SkillContent == nil {
+		return nil, errs.NewInternalError(errs.SubtypeFileIO,
+			"skill content not embedded in this build")
+	}
+	return skillcontent.New(f.SkillContent), nil
+}
+
+type readEnvelope struct {
+	Skill    string `json:"skill"`
+	Path     string `json:"path"`
+	Content  string `json:"content"`
+	Guidance string `json:"guidance,omitempty"`
+}
+
+type listEnvelope struct {
+	OK     bool                     `json:"ok"`
+	Skills []skillcontent.SkillInfo `json:"skills"`
+	Count  int                      `json:"count"`
+}
+
+type listPathEnvelope struct {
+	OK      bool                    `json:"ok"`
+	Path    string                  `json:"path"`
+	Entries []skillcontent.DirEntry `json:"entries"`
+	Count   int                     `json:"count"`
+}
+
+func NewCmdSkill(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "skills",
+		Short: "Read embedded skill content (list / read)",
+		Long: "Read agent-readable skill content (SKILL.md and reference files) embedded in " +
+			"the CLI binary at build time, so it stays in sync with the CLI version. " +
+			"Machine resources such as assets/ and scripts/ are not embedded.",
+	}
+	// Risk is set on each leaf (GetRisk does not walk parents); the group has none.
+	cmdutil.DisableAuthCheck(cmd)
+	cmd.AddCommand(newListCmd(f), newReadCmd(f))
+	return cmd
+}
+
+func newListCmd(f *cmdutil.Factory) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "list [name[/path]]",
+		Short: "List skills, or list one layer under a skill path (like ls)",
+		Example: `  lark-cli skills list                      # all skills: name, description, version
+  lark-cli skills list lark-doc             # one layer under a skill (like ls)
+  lark-cli skills list lark-doc/references  # one layer under a subdirectory`,
+		Args: cobra.ArbitraryArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) > 1 {
+				return errs.NewValidationError(errs.SubtypeInvalidArgument,
+					"list takes at most 1 argument: [name[/path]]").
+					WithHint("run 'lark-cli skills list --help'")
+			}
+			r, err := newReader(f)
+			if err != nil {
+				return err
+			}
+			if len(args) == 0 {
+				skills, err := r.List()
+				if err != nil {
+					return err
+				}
+				output.PrintJson(f.IOStreams.Out, listEnvelope{OK: true, Skills: skills, Count: len(skills)})
+				return nil
+			}
+			entries, listed, err := r.ListPath(args[0])
+			if err != nil {
+				return err
+			}
+			output.PrintJson(f.IOStreams.Out, listPathEnvelope{OK: true, Path: listed, Entries: entries, Count: len(entries)})
+			return nil
+		},
+	}
+	// --json is a no-op (list is always JSON), accepted only to stay symmetric with read.
+	cmd.Flags().Bool("json", false, "no-op (list output is always JSON)")
+	cmdutil.SetRisk(cmd, "read")
+	cmdutil.DisableAuthCheck(cmd)
+	return cmd
+}
+
+func newReadCmd(f *cmdutil.Factory) *cobra.Command {
+	var asJSON bool
+	cmd := &cobra.Command{
+		Use:   "read <name>[/<path>] [path]",
+		Short: "Print a skill's SKILL.md, or a file under the skill (raw markdown by default)",
+		Example: `  lark-cli skills read lark-doc                             # the skill's SKILL.md
+  lark-cli skills read lark-doc references/lark-doc-fetch.md  # a file under the skill
+  lark-cli skills read lark-doc/references/lark-doc-fetch.md  # same, slash form
+  lark-cli skills read lark-doc --json                      # JSON envelope`,
+		Args: cobra.ArbitraryArgs,
+		RunE: func(cmd *cobra.Command, args []string) error {
+			name, relpath, err := parseReadTarget(args)
+			if err != nil {
+				return err
+			}
+			r, err := newReader(f)
+			if err != nil {
+				return err
+			}
+
+			var content []byte
+			var pathOut string
+			if relpath == "" {
+				content, err = r.ReadSkill(name)
+				pathOut = "SKILL.md"
+			} else {
+				content, pathOut, err = r.ReadReference(name, relpath)
+			}
+			if err != nil {
+				return err
+			}
+
+			isMain := pathOut == "SKILL.md"
+			if asJSON {
+				env := readEnvelope{Skill: name, Path: pathOut, Content: string(content)}
+				if isMain {
+					env.Guidance = readGuidance(name)
+				}
+				output.PrintJson(f.IOStreams.Out, env)
+				return nil
+			}
+			// Raw stdout stays byte-identical to the file; guidance goes to stderr.
+			if _, err := f.IOStreams.Out.Write(content); err != nil {
+				return errs.NewInternalError(errs.SubtypeFileIO, "failed to write output: %v", err)
+			}
+			if isMain {
+				fmt.Fprintln(f.IOStreams.ErrOut, readGuidance(name))
+			}
+			return nil
+		},
+	}
+	cmd.Flags().BoolVar(&asJSON, "json", false, "output as a JSON envelope instead of raw markdown")
+	cmdutil.SetRisk(cmd, "read")
+	cmdutil.DisableAuthCheck(cmd)
+	return cmd
+}
+
+// parseReadTarget maps 1-or-2 positional args to (name, relpath); a lone
+// "<a>/<b>" splits on the first '/', and relpath "" reads the main SKILL.md.
+func parseReadTarget(args []string) (name, relpath string, err error) {
+	switch len(args) {
+	case 1:
+		name, relpath = skillcontent.SplitArg(args[0])
+		return name, relpath, nil
+	case 2:
+		return args[0], args[1], nil
+	default:
+		return "", "", errs.NewValidationError(errs.SubtypeInvalidArgument,
+			"read requires 1 or 2 arguments: <name>[/<path>] [path]").
+			WithHint("run 'lark-cli skills read --help'")
+	}
+}
+
+// readGuidance routes cross-skill "../lark-foo/..." references back through
+// `skills read lark-foo/...`: the path guard rejects a literal "../", so the
+// relative form must be rewritten.
+func readGuidance(name string) string {
+	return fmt.Sprintf("> Tip: read this skill's own files (e.g. `references/...`) with "+
+		"`lark-cli skills read %s <relative-path>` to keep them in sync with this CLI version. "+
+		"A reference to another skill (`../lark-foo/...`) uses the same command with the "+
+		"leading `../` removed: `lark-cli skills read lark-foo/...`.", name)
+}

cmd/skill/skill_test.go

@@ -0,0 +1,306 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package skill
+
+import (
+	"encoding/json"
+	"io"
+	"io/fs"
+	"strings"
+	"testing"
+	"testing/fstest"
+
+	"github.com/larksuite/cli/internal/cmdutil"
+)
+
+// calFS is the default single-skill content tree for these tests. The embedded
+// FS is now injected through the Factory (no package global), so tests pass it
+// explicitly to run() — nothing is shared, so they are safe under -parallel.
+func calFS() fstest.MapFS {
+	return fstest.MapFS{
+		"lark-calendar/SKILL.md":             {Data: []byte("---\nname: lark-calendar\nversion: 1.0.0\ndescription: \"Cal\"\nmetadata:\n  cliHelp: \"lark-cli calendar --help\"\n---\nbody")},
+		"lark-calendar/references/agenda.md": {Data: []byte("# Agenda")},
+	}
+}
+
+// run executes the skills command tree against the given content FS (may be nil
+// to exercise the not-embedded path) and returns stdout/stderr/err.
+func run(t *testing.T, fsys fs.FS, args ...string) (stdout, stderr string, err error) {
+	t.Helper()
+	// Isolate CLI config state so tests never read/write the real config dir
+	// (repo convention).
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+	f, out, errOut, _ := cmdutil.TestFactory(t, nil)
+	f.SkillContent = fsys
+	cmd := NewCmdSkill(f)
+	cmd.SetOut(io.Discard)
+	cmd.SetErr(io.Discard)
+	cmd.SetArgs(args)
+	err = cmd.Execute()
+	return out.String(), errOut.String(), err
+}
+
+func TestSkillList(t *testing.T) {
+	stdout, _, err := run(t, calFS(), "list")
+	if err != nil {
+		t.Fatalf("list error: %v", err)
+	}
+	var got struct {
+		OK     bool             `json:"ok"`
+		Skills []map[string]any `json:"skills"`
+		Count  int              `json:"count"`
+	}
+	if e := json.Unmarshal([]byte(stdout), &got); e != nil {
+		t.Fatalf("invalid JSON: %v\n%s", e, stdout)
+	}
+	// "ok" is an explicit success marker (the list envelope is a typed struct;
+	// no automatic _notice attaches).
+	if !got.OK {
+		t.Error("expected ok=true in list envelope")
+	}
+	if got.Count != 1 || len(got.Skills) != 1 {
+		t.Fatalf("count: got %d", got.Count)
+	}
+	if got.Skills[0]["name"] != "lark-calendar" {
+		t.Errorf("name: got %v", got.Skills[0]["name"])
+	}
+	// Top-level list carries version + metadata, not a references list.
+	if _, ok := got.Skills[0]["references"]; ok {
+		t.Error("top-level list must not include references")
+	}
+	if got.Skills[0]["version"] != "1.0.0" {
+		t.Errorf("version: got %v, want 1.0.0", got.Skills[0]["version"])
+	}
+	if _, ok := got.Skills[0]["metadata"]; !ok {
+		t.Error("expected metadata in list entry")
+	}
+}
+
+func TestSkillListJSONFlagAccepted(t *testing.T) {
+	// `list --json` must be accepted (no-op), not rejected as an unknown flag,
+	// so it stays symmetric with read --json.
+	stdout, _, err := run(t, calFS(), "list", "--json")
+	if err != nil {
+		t.Fatalf("list --json error: %v", err)
+	}
+	var got struct {
+		OK    bool `json:"ok"`
+		Count int  `json:"count"`
+	}
+	if e := json.Unmarshal([]byte(stdout), &got); e != nil {
+		t.Fatalf("invalid JSON: %v\n%s", e, stdout)
+	}
+	if !got.OK || got.Count != 1 {
+		t.Errorf("envelope: %+v", got)
+	}
+}
+
+func TestSkillListPath(t *testing.T) {
+	stdout, _, err := run(t, calFS(), "list", "lark-calendar")
+	if err != nil {
+		t.Fatalf("list <name> error: %v", err)
+	}
+	var got struct {
+		OK      bool   `json:"ok"`
+		Path    string `json:"path"`
+		Entries []struct {
+			Path  string `json:"path"`
+			IsDir bool   `json:"is_dir"`
+		} `json:"entries"`
+		Count int `json:"count"`
+	}
+	if e := json.Unmarshal([]byte(stdout), &got); e != nil {
+		t.Fatalf("invalid JSON: %v\n%s", e, stdout)
+	}
+	if !got.OK || got.Path != "lark-calendar" {
+		t.Errorf("envelope: %+v", got)
+	}
+	// One layer under the skill root: SKILL.md (file) + references (dir).
+	if got.Count != 2 || len(got.Entries) != 2 {
+		t.Fatalf("entries: got %+v", got.Entries)
+	}
+	if got.Entries[0].Path != "lark-calendar/SKILL.md" || got.Entries[0].IsDir {
+		t.Errorf("entry[0]: got %+v", got.Entries[0])
+	}
+	if got.Entries[1].Path != "lark-calendar/references" || !got.Entries[1].IsDir {
+		t.Errorf("entry[1]: got %+v", got.Entries[1])
+	}
+}
+
+func TestSkillListPathUnknown(t *testing.T) {
+	_, _, err := run(t, calFS(), "list", "no-such-skill")
+	if err == nil || !strings.Contains(err.Error(), "unknown skill") {
+		t.Fatalf("expected 'unknown skill' error, got %v", err)
+	}
+}
+
+func TestSkillListPathTraversal(t *testing.T) {
+	stdout, _, err := run(t, calFS(), "list", "lark-calendar/../../etc")
+	if err == nil || !strings.Contains(err.Error(), "invalid path") {
+		t.Fatalf("expected 'invalid path' error, got %v", err)
+	}
+	if stdout != "" {
+		t.Errorf("stdout must be empty on rejection, got %q", stdout)
+	}
+}
+
+func TestSkillListTooManyArgs(t *testing.T) {
+	_, _, err := run(t, calFS(), "list", "a", "b")
+	if err == nil || !strings.Contains(err.Error(), "at most 1 argument") {
+		t.Fatalf("expected 'at most 1 argument' error, got %v", err)
+	}
+}
+
+// TestSkillListSkipsDirWithoutSKILLmd proves a top-level dir lacking SKILL.md is
+// omitted from the catalog (no blank entry).
+func TestSkillListSkipsDirWithoutSKILLmd(t *testing.T) {
+	fsys := fstest.MapFS{
+		"lark-calendar/SKILL.md": {Data: []byte("---\nname: lark-calendar\ndescription: \"Cal\"\n---\nb")},
+		"not-a-skill/readme.txt": {Data: []byte("junk")}, // dir without SKILL.md
+	}
+	stdout, _, err := run(t, fsys, "list")
+	if err != nil {
+		t.Fatalf("list error: %v", err)
+	}
+	var got struct {
+		Skills []map[string]any `json:"skills"`
+		Count  int              `json:"count"`
+	}
+	if e := json.Unmarshal([]byte(stdout), &got); e != nil {
+		t.Fatalf("invalid JSON: %v\n%s", e, stdout)
+	}
+	if got.Count != 1 || got.Skills[0]["name"] != "lark-calendar" {
+		t.Fatalf("expected only lark-calendar, got %+v", got.Skills)
+	}
+}
+
+func TestSkillReadRaw(t *testing.T) {
+	stdout, stderr, err := run(t, calFS(), "read", "lark-calendar")
+	if err != nil {
+		t.Fatalf("read error: %v", err)
+	}
+	if !strings.HasPrefix(stdout, "---\nname: lark-calendar") {
+		t.Errorf("raw output: got %q", stdout)
+	}
+	// Raw stdout is byte-pure SKILL.md — the guidance tip must NOT be appended.
+	if strings.Contains(stdout, "Tip:") {
+		t.Errorf("raw stdout must not carry the guidance tip: got %q", stdout)
+	}
+	// Guidance goes to stderr: own files via `skills read <name> ...`, and
+	// cross-skill refs routed to `skills read <other-skill> ...` (version-
+	// consistent), not "read directly".
+	if !strings.Contains(stderr, "lark-cli skills read lark-calendar <relative-path>") {
+		t.Errorf("expected own-files guidance on stderr: got %q", stderr)
+	}
+	if !strings.Contains(stderr, "lark-cli skills read lark-foo/...") {
+		t.Errorf("expected cross-skill refs routed to skills read: got %q", stderr)
+	}
+	if strings.Contains(stderr, "instead of opening them directly") ||
+		strings.Contains(stderr, "read those directly") {
+		t.Errorf("guidance must not steer cross-skill refs to direct reads: got %q", stderr)
+	}
+}
+
+func TestSkillReadJSON(t *testing.T) {
+	stdout, _, err := run(t, calFS(), "read", "lark-calendar", "--json")
+	if err != nil {
+		t.Fatalf("read --json error: %v", err)
+	}
+	var got struct {
+		Skill, Path, Content, Guidance string
+	}
+	if e := json.Unmarshal([]byte(stdout), &got); e != nil {
+		t.Fatalf("invalid JSON: %v", e)
+	}
+	if got.Skill != "lark-calendar" || got.Path != "SKILL.md" || got.Content == "" {
+		t.Errorf("envelope: %+v", got)
+	}
+	// Guidance is a separate field, not merged into content.
+	if got.Guidance == "" {
+		t.Error("expected guidance field for main SKILL.md")
+	}
+	if strings.Contains(got.Content, "Tip:") {
+		t.Error("guidance must not be merged into content")
+	}
+}
+
+func TestSkillReadFile(t *testing.T) {
+	// Both the 2-arg and slash forms read the same file, with no guidance tip.
+	for _, args := range [][]string{
+		{"read", "lark-calendar", "references/agenda.md"},
+		{"read", "lark-calendar/references/agenda.md"},
+	} {
+		stdout, stderr, err := run(t, calFS(), args...)
+		if err != nil {
+			t.Fatalf("read %v error: %v", args, err)
+		}
+		if stdout != "# Agenda" {
+			t.Errorf("read %v output: got %q", args, stdout)
+		}
+		// Reference reads carry no guidance on either stream.
+		if strings.Contains(stderr, "Tip:") {
+			t.Errorf("read %v must not emit guidance on stderr: got %q", args, stderr)
+		}
+	}
+}
+
+func TestSkillReadFileJSON(t *testing.T) {
+	stdout, _, err := run(t, calFS(), "read", "lark-calendar", "references/agenda.md", "--json")
+	if err != nil {
+		t.Fatalf("read file --json error: %v", err)
+	}
+	var got struct {
+		Skill, Path, Content, Guidance string
+	}
+	if e := json.Unmarshal([]byte(stdout), &got); e != nil {
+		t.Fatalf("invalid JSON: %v\n%s", e, stdout)
+	}
+	if got.Skill != "lark-calendar" || got.Path != "references/agenda.md" || got.Content != "# Agenda" {
+		t.Errorf("envelope: %+v", got)
+	}
+	// Reference reads do not carry the guidance tip.
+	if got.Guidance != "" {
+		t.Errorf("reference read must not include guidance, got %q", got.Guidance)
+	}
+}
+
+func TestSkillReadUnknown(t *testing.T) {
+	_, _, err := run(t, calFS(), "read", "no-such")
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	if !strings.Contains(err.Error(), "unknown skill") {
+		t.Errorf("err: %v", err)
+	}
+}
+
+func TestSkillReadMissingArg(t *testing.T) {
+	_, _, err := run(t, calFS(), "read")
+	if err == nil || !strings.Contains(err.Error(), "requires 1 or 2 arguments") {
+		t.Fatalf("expected arg error, got %v", err)
+	}
+}
+
+func TestSkillReadTraversal(t *testing.T) {
+	stdout, _, err := run(t, calFS(), "read", "lark-calendar", "../../etc/passwd")
+	if err == nil {
+		t.Fatal("expected rejection")
+	}
+	if !strings.Contains(err.Error(), "invalid path") {
+		t.Errorf("err: %v", err)
+	}
+	if stdout != "" {
+		t.Errorf("stdout must be empty on rejection, got %q", stdout)
+	}
+}
+
+func TestSkillNilContentFS(t *testing.T) {
+	_, _, err := run(t, nil, "list")
+	if err == nil {
+		t.Fatal("expected error when SkillContent is nil")
+	}
+	if !strings.Contains(err.Error(), "not embedded") {
+		t.Errorf("err: %v", err)
+	}
+}

cmd/update/update_test.go

@@ -49,12 +49,21 @@ func mockDetectAndNpm(t *testing.T, result selfupdate.DetectResult, npmFn func(s
 		u.DetectOverride = func() selfupdate.DetectResult { return result }
 		u.NpmInstallOverride = npmFn
 		u.VerifyOverride = func(string) error { return nil }
+		u.SkillsIndexFetchOverride = successfulSkillsIndexFetch()
 		u.SkillsCommandOverride = successfulSkillsCommand()
 		return u
 	}
 	t.Cleanup(func() { newUpdater = origNew })
 }
 
+func successfulSkillsIndexFetch() func() *selfupdate.NpmResult {
+	return func() *selfupdate.NpmResult {
+		r := &selfupdate.NpmResult{}
+		r.Stdout.WriteString(`{"skills":[{"name":"lark-calendar"},{"name":"lark-mail"}]}`)
+		return r
+	}
+}
+
 func successfulSkillsCommand() func(args ...string) *selfupdate.NpmResult {
 	return func(args ...string) *selfupdate.NpmResult {
 		r := &selfupdate.NpmResult{}
@@ -478,6 +487,10 @@ func TestUpdateNpmVerifyFail_JSON_NoRestoreHintWhenBackupUnavailable(t *testing.
 		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} }
 		u.VerifyOverride = func(string) error { return errors.New("bad binary") }
 		u.RestoreAvailableOverride = func() bool { return false }
+		u.SkillsIndexFetchOverride = func() *selfupdate.NpmResult {
+			t.Fatal("skills sync should not run when binary verification fails")
+			return nil
+		}
 		u.SkillsCommandOverride = func(args ...string) *selfupdate.NpmResult {
 			t.Fatal("skills sync should not run when binary verification fails")
 			return nil
@@ -810,6 +823,11 @@ func TestUpdateNpm_SkillsFail_JSON(t *testing.T) {
 		}
 		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} }
 		u.VerifyOverride = func(string) error { return nil }
+		u.SkillsIndexFetchOverride = func() *selfupdate.NpmResult {
+			r := &selfupdate.NpmResult{}
+			r.Err = fmt.Errorf("index unavailable")
+			return r
+		}
 		u.SkillsCommandOverride = func(args ...string) *selfupdate.NpmResult {
 			r := &selfupdate.NpmResult{}
 			r.Stderr.WriteString("npx: command not found")
@@ -862,6 +880,11 @@ func TestUpdateNpm_SkillsFail_Human(t *testing.T) {
 		}
 		u.NpmInstallOverride = func(version string) *selfupdate.NpmResult { return &selfupdate.NpmResult{} }
 		u.VerifyOverride = func(string) error { return nil }
+		u.SkillsIndexFetchOverride = func() *selfupdate.NpmResult {
+			r := &selfupdate.NpmResult{}
+			r.Err = fmt.Errorf("index unavailable")
+			return r
+		}
 		u.SkillsCommandOverride = func(args ...string) *selfupdate.NpmResult {
 			r := &selfupdate.NpmResult{}
 			r.Stderr.WriteString("npx: command not found")
@@ -1006,6 +1029,7 @@ func TestUpdateRun_AlreadyLatest_RunsSkillsSync(t *testing.T) {
 	t.Cleanup(func() { newUpdater = origNew })
 	newUpdater = func() *selfupdate.Updater {
 		return &selfupdate.Updater{
+			SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 			SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 				skillsCalled = true
 				return successfulSkillsCommand()(args...)
@@ -1044,6 +1068,7 @@ func TestUpdateRun_Manual_RunsSkillsSync(t *testing.T) {
 	t.Cleanup(func() { newUpdater = origNew })
 	newUpdater = func() *selfupdate.Updater {
 		return &selfupdate.Updater{
+			SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 			DetectOverride: func() selfupdate.DetectResult {
 				return selfupdate.DetectResult{
 					Method:       selfupdate.InstallManual,
@@ -1088,6 +1113,7 @@ func TestUpdateRun_Npm_RunsSkillsSync_WritesLatestState(t *testing.T) {
 	t.Cleanup(func() { newUpdater = origNew })
 	newUpdater = func() *selfupdate.Updater {
 		return &selfupdate.Updater{
+			SkillsIndexFetchOverride: successfulSkillsIndexFetch(),
 			DetectOverride: func() selfupdate.DetectResult {
 				return selfupdate.DetectResult{
 					Method: selfupdate.InstallNpm, NpmAvailable: true,
@@ -1147,6 +1173,10 @@ func TestUpdateRun_CheckIncludesSkillsStatus(t *testing.T) {
 			DetectOverride: func() selfupdate.DetectResult {
 				return selfupdate.DetectResult{Method: selfupdate.InstallNpm, NpmAvailable: true}
 			},
+			SkillsIndexFetchOverride: func() *selfupdate.NpmResult {
+				skillsCalled = true
+				return successfulSkillsIndexFetch()()
+			},
 			SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 				skillsCalled = true
 				return successfulSkillsCommand()(args...)
@@ -1196,6 +1226,10 @@ func TestUpdateRun_CheckAlreadyLatest_NoSideEffect(t *testing.T) {
 	t.Cleanup(func() { newUpdater = origNew })
 	newUpdater = func() *selfupdate.Updater {
 		return &selfupdate.Updater{
+			SkillsIndexFetchOverride: func() *selfupdate.NpmResult {
+				skillsCalled = true
+				return successfulSkillsIndexFetch()()
+			},
 			SkillsCommandOverride: func(args ...string) *selfupdate.NpmResult {
 				skillsCalled = true
 				return successfulSkillsCommand()(args...)

errs/subtypes.go

@@ -80,6 +80,7 @@ const (
 	SubtypeSDKError        Subtype = "sdk_error"        // lark SDK Do() returned an unexpected error
 	SubtypeInvalidResponse Subtype = "invalid_response" // SDK response body not parsable as JSON
 	SubtypeFileIO          Subtype = "file_io"          // local file I/O failure (mkdir / write / read)
+	SubtypeExternalTool    Subtype = "external_tool"    // an external tool the CLI shells out to (git, npx) failed at runtime; the tool output is in the message
 	SubtypeStorage         Subtype = "storage"          // local persistence failure (e.g. config file save)
 	// Generic untyped error lifted to InternalError uses SubtypeUnknown.
 )

events/minutes/preconsume.go

@@ -5,18 +5,19 @@ package minutes
 
 import (
 	"context"
-	"fmt"
 	"time"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/event"
 )
 
 const cleanupTimeout = 5 * time.Second
 
-func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func(), error) {
-	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func(), error) {
+func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
+	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func() error, error) {
 		if rt == nil {
-			return nil, fmt.Errorf("runtime API client is required for pre-consume subscription")
+			return nil, errs.NewInternalError(errs.SubtypeUnknown,
+				"runtime API client is required for pre-consume subscription")
 		}
 
 		body := map[string]string{"event_type": eventType}
@@ -24,10 +25,13 @@ func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) fu
 			return nil, err
 		}
 
-		return func() {
+		return func() error {
 			cleanupCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
 			defer cancel()
-			_, _ = rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body)
+			if _, err := rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body); err != nil {
+				return err
+			}
+			return nil
 		}, nil
 	}
 }

events/register.go

@@ -8,6 +8,7 @@ import (
 	"github.com/larksuite/cli/events/im"
 	"github.com/larksuite/cli/events/minutes"
 	"github.com/larksuite/cli/events/vc"
+	"github.com/larksuite/cli/events/whiteboard"
 	"github.com/larksuite/cli/internal/event"
 )
 
@@ -17,6 +18,7 @@ func init() {
 		im.Keys(),
 		minutes.Keys(),
 		vc.Keys(),
+		whiteboard.Keys(),
 	}
 	for _, keys := range all {
 		for _, k := range keys {

events/vc/note_detail_retry_test.go

@@ -0,0 +1,35 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package vc
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+)
+
+// isLarkCode must match the API code on typed errs.* errors — the consume
+// runtime classifies OAPI failures via errclass.BuildAPIError, so the
+// not-found retry in fillVCNoteGeneratedDetails depends on this reading
+// Problem.Code rather than the legacy envelope shape.
+func TestIsLarkCode_MatchesTypedAPIErrorCode(t *testing.T) {
+	typedNotFound := errs.NewAPIError(errs.SubtypeNotFound, "note not ready").
+		WithCode(vcNoteDetailNotFoundCode)
+	if !isLarkCode(typedNotFound, vcNoteDetailNotFoundCode) {
+		t.Fatal("typed API error carrying the not-found code must match (retry path)")
+	}
+	if isLarkCode(typedNotFound, 99999) {
+		t.Error("a different expected code must not match")
+	}
+
+	otherTyped := errs.NewAPIError(errs.SubtypeServerError, "boom").WithCode(500)
+	if isLarkCode(otherTyped, vcNoteDetailNotFoundCode) {
+		t.Error("typed error with another code must not match")
+	}
+
+	if isLarkCode(errors.New("plain failure"), vcNoteDetailNotFoundCode) {
+		t.Error("untyped error must not match")
+	}
+}

events/vc/note_generated.go

@@ -6,12 +6,11 @@ package vc
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"time"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/event"
-	"github.com/larksuite/cli/internal/output"
 	"github.com/larksuite/cli/internal/validate"
 )
 
@@ -148,9 +147,8 @@ func fillVCNoteGeneratedDetails(ctx context.Context, rt event.APIClient, out *VC
 }
 
 func isLarkCode(err error, code int) bool {
-	var exitErr *output.ExitError
-	if errors.As(err, &exitErr) && exitErr.Detail != nil {
-		return exitErr.Detail.Code == code
+	if p, ok := errs.ProblemOf(err); ok {
+		return p.Code == code
 	}
 	return false
 }

events/vc/preconsume.go

@@ -5,18 +5,19 @@ package vc
 
 import (
 	"context"
-	"fmt"
 	"time"
 
+	"github.com/larksuite/cli/errs"
 	"github.com/larksuite/cli/internal/event"
 )
 
 const cleanupTimeout = 5 * time.Second
 
-func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func(), error) {
-	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func(), error) {
+func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
+	return func(ctx context.Context, rt event.APIClient, _ map[string]string) (func() error, error) {
 		if rt == nil {
-			return nil, fmt.Errorf("runtime API client is required for pre-consume subscription")
+			return nil, errs.NewInternalError(errs.SubtypeUnknown,
+				"runtime API client is required for pre-consume subscription")
 		}
 
 		body := map[string]string{"event_type": eventType}
@@ -24,10 +25,13 @@ func subscriptionPreConsume(eventType, subscribePath, unsubscribePath string) fu
 			return nil, err
 		}
 
-		return func() {
+		return func() error {
 			cleanupCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
 			defer cancel()
-			_, _ = rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body)
+			if _, err := rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body); err != nil {
+				return err
+			}
+			return nil
 		}, nil
 	}
 }

events/vc/recording_ended.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package vc
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"time"
+
+	"github.com/larksuite/cli/internal/event"
+)
+
+// VCRecordingEndedOutput is the flattened shape for vc.recording.recording_ended_v1.
+type VCRecordingEndedOutput struct {
+	Type      string `json:"type"                 desc:"Event type; always vc.recording.recording_ended_v1"`
+	EventID   string `json:"event_id,omitempty"   desc:"Globally unique event ID; safe for deduplication"`
+	EventTime string `json:"event_time,omitempty" desc:"Time when the recording ended and uploaded successfully, in RFC3339 / ISO 8601 with the current system timezone"`
+	UniqueKey string `json:"unique_key,omitempty" desc:"Unique key generated for one recording_bean recording session"`
+	Source    string `json:"source,omitempty"     desc:"Recording source; always recording_bean"`
+}
+
+type recordingEndedEnvelope struct {
+	Header struct {
+		EventID    string `json:"event_id"`
+		EventType  string `json:"event_type"`
+		CreateTime string `json:"create_time"`
+	} `json:"header"`
+	Event recordingEndedEvent `json:"event"`
+}
+
+type recordingEndedEvent struct {
+	UniqueKey string `json:"unique_key"`
+	Source    string `json:"source"`
+}
+
+func processVCRecordingEnded(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
+	envelope, ok := parseRecordingEndedEnvelope(raw)
+	if !ok {
+		return raw.Payload, nil
+	}
+	if !isRecordingEndedBeanEvent(envelope) {
+		return nil, nil
+	}
+	out := &VCRecordingEndedOutput{
+		Type:      recordingEndedEventType(envelope, raw),
+		EventID:   envelope.Header.EventID,
+		EventTime: recordingEndedEventTime(envelope.Header.CreateTime),
+		UniqueKey: envelope.Event.UniqueKey,
+		Source:    envelope.Event.Source,
+	}
+	return json.Marshal(out)
+}
+
+func parseRecordingEndedEnvelope(raw *event.RawEvent) (*recordingEndedEnvelope, bool) {
+	var envelope recordingEndedEnvelope
+	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
+		return nil, false
+	}
+	return &envelope, true
+}
+
+func isRecordingEndedBeanEvent(envelope *recordingEndedEnvelope) bool {
+	return envelope != nil && envelope.Event.Source == "recording_bean"
+}
+
+func recordingEndedEventType(envelope *recordingEndedEnvelope, raw *event.RawEvent) string {
+	if envelope != nil && envelope.Header.EventType != "" {
+		return envelope.Header.EventType
+	}
+	return raw.EventType
+}
+
+func recordingEndedEventTime(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	millis, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil {
+		return ""
+	}
+	return time.UnixMilli(millis).Local().Format(time.RFC3339)
+}

events/vc/recording_started.go

@@ -0,0 +1,84 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package vc
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"time"
+
+	"github.com/larksuite/cli/internal/event"
+)
+
+// VCRecordingStartedOutput is the flattened shape for vc.recording.recording_started_v1.
+type VCRecordingStartedOutput struct {
+	Type      string `json:"type"                 desc:"Event type; always vc.recording.recording_started_v1"`
+	EventID   string `json:"event_id,omitempty"   desc:"Globally unique event ID; safe for deduplication"`
+	EventTime string `json:"event_time,omitempty" desc:"Recording start time in RFC3339 / ISO 8601 with the current system timezone"`
+	UniqueKey string `json:"unique_key,omitempty" desc:"Unique key generated for one recording_bean recording session"`
+	Source    string `json:"source,omitempty"     desc:"Recording source; always recording_bean"`
+}
+
+type recordingStartedEnvelope struct {
+	Header struct {
+		EventID    string `json:"event_id"`
+		EventType  string `json:"event_type"`
+		CreateTime string `json:"create_time"`
+	} `json:"header"`
+	Event recordingStartedEvent `json:"event"`
+}
+
+type recordingStartedEvent struct {
+	UniqueKey string `json:"unique_key"`
+	Source    string `json:"source"`
+}
+
+func processVCRecordingStarted(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
+	envelope, ok := parseRecordingStartedEnvelope(raw)
+	if !ok {
+		return raw.Payload, nil
+	}
+	if !isRecordingStartedBeanEvent(envelope) {
+		return nil, nil
+	}
+	out := &VCRecordingStartedOutput{
+		Type:      recordingStartedEventType(envelope, raw),
+		EventID:   envelope.Header.EventID,
+		EventTime: recordingStartedEventTime(envelope.Header.CreateTime),
+		UniqueKey: envelope.Event.UniqueKey,
+		Source:    envelope.Event.Source,
+	}
+	return json.Marshal(out)
+}
+
+func parseRecordingStartedEnvelope(raw *event.RawEvent) (*recordingStartedEnvelope, bool) {
+	var envelope recordingStartedEnvelope
+	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
+		return nil, false
+	}
+	return &envelope, true
+}
+
+func isRecordingStartedBeanEvent(envelope *recordingStartedEnvelope) bool {
+	return envelope != nil && envelope.Event.Source == "recording_bean"
+}
+
+func recordingStartedEventType(envelope *recordingStartedEnvelope, raw *event.RawEvent) string {
+	if envelope != nil && envelope.Header.EventType != "" {
+		return envelope.Header.EventType
+	}
+	return raw.EventType
+}
+
+func recordingStartedEventTime(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	millis, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil {
+		return ""
+	}
+	return time.UnixMilli(millis).Local().Format(time.RFC3339)
+}

events/vc/recording_test.go

@@ -0,0 +1,468 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package vc
+
+import (
+	"context"
+	"encoding/json"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/larksuite/cli/internal/event"
+)
+
+func TestVCKeys_RecordingEventsRegistered(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	for _, tc := range []struct {
+		eventType string
+	}{
+		{eventTypeRecordingStarted},
+		{eventTypeRecordingTranscriptGenerated},
+		{eventTypeRecordingEnded},
+	} {
+		t.Run(tc.eventType, func(t *testing.T) {
+			def, ok := event.Lookup(tc.eventType)
+			if !ok {
+				t.Fatalf("%s should be registered via Keys()", tc.eventType)
+			}
+			if def.Schema.Custom == nil {
+				t.Error("Processed key must set Schema.Custom")
+			}
+			if def.Schema.Native != nil {
+				t.Error("Processed key must not set Schema.Native")
+			}
+			if def.Process == nil {
+				t.Error("Process must not be nil for processed key")
+			}
+			if def.PreConsume == nil {
+				t.Error("PreConsume must not be nil for processed key")
+			}
+			if len(def.Scopes) != 1 || def.Scopes[0] != "vc:recording:read" {
+				t.Errorf("Scopes = %v", def.Scopes)
+			}
+			if len(def.AuthTypes) != 1 || def.AuthTypes[0] != "user" {
+				t.Errorf("AuthTypes = %v", def.AuthTypes)
+			}
+			if len(def.RequiredConsoleEvents) != 1 || def.RequiredConsoleEvents[0] != tc.eventType {
+				t.Errorf("RequiredConsoleEvents = %v", def.RequiredConsoleEvents)
+			}
+			if !strings.Contains(def.Description, "recording_bean") {
+				t.Errorf("Description should document recording_bean source, got %q", def.Description)
+			}
+			if !strings.Contains(def.Description, "connected to Feishu software") {
+				t.Errorf("Description should document Feishu software connection requirement, got %q", def.Description)
+			}
+			if strings.Contains(def.Description, "future") || strings.Contains(def.Description, "software_recording") {
+				t.Errorf("Description should not mention future sources, got %q", def.Description)
+			}
+			if tc.eventType == eventTypeRecordingEnded && (strings.Contains(def.Description, "object_type") || strings.Contains(def.Description, "object_id")) {
+				t.Errorf("ended Description should not document object metadata, got %q", def.Description)
+			}
+			wantSchemaType := reflect.TypeOf(VCRecordingStartedOutput{})
+			switch tc.eventType {
+			case eventTypeRecordingTranscriptGenerated:
+				wantSchemaType = reflect.TypeOf(VCRecordingTranscriptGeneratedOutput{})
+			case eventTypeRecordingEnded:
+				wantSchemaType = reflect.TypeOf(VCRecordingEndedOutput{})
+			}
+			if def.Schema.Custom.Type != wantSchemaType {
+				t.Errorf("Custom schema Type = %v, want %v", def.Schema.Custom.Type, wantSchemaType)
+			}
+		})
+	}
+}
+
+func TestProcessVCRecordingStarted(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	out := runRecordingProcess[VCRecordingStartedOutput](t, eventTypeRecordingStarted, processVCRecordingStarted, `{
+		"schema": "2.0",
+		"header": {
+			"event_id": "ev_rec_start_001",
+			"event_type": "vc.recording.recording_started_v1",
+			"create_time": "1761782400000"
+		},
+		"event": {
+			"unique_key": "recording_001",
+			"source": "recording_bean"
+		}
+	}`)
+
+	if out.Type != eventTypeRecordingStarted {
+		t.Errorf("Type = %q", out.Type)
+	}
+	if out.EventID != "ev_rec_start_001" || out.EventTime != recordingTestEventTime(1761782400000) {
+		t.Errorf("EventID/EventTime = %q/%q", out.EventID, out.EventTime)
+	}
+	if out.UniqueKey != "recording_001" || out.Source != "recording_bean" {
+		t.Errorf("UniqueKey/Source = %q/%q", out.UniqueKey, out.Source)
+	}
+}
+
+func TestProcessVCRecordingTranscriptGenerated(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	got := runRecordingProcessRaw(t, eventTypeRecordingTranscriptGenerated, processVCRecordingTranscriptGenerated, `{
+		"schema": "2.0",
+		"header": {
+			"event_id": "ev_rec_transcript_001",
+			"event_type": "vc.recording.recording_transcript_generated_v1",
+			"create_time": "1761782400100"
+		},
+		"event": {
+			"unique_key": "recording_001",
+			"source": "recording_bean",
+			"transcript_items": [
+				{
+					"speaker": {
+						"id": {
+							"open_id": "ou_0f8bf7acdf2ae69553ecbdbfbbd10a53",
+							"union_id": "on_bc03f16d781bff4178a5d11e48eb1867",
+							"user_id": null
+						},
+						"user_type": 100,
+						"user_role": 1,
+						"user_name": "Alice"
+					},
+					"text": "hello world",
+					"language": "en_us",
+					"start_time_ms": "1761782399000",
+					"end_time_ms": "1761782400000",
+					"sentence_id": "987654321"
+				},
+				{
+					"speaker": {
+						"user_name": "Bob"
+					},
+					"text": "second sentence",
+					"language": "en_us",
+					"start_time_ms": "1761782401000",
+					"end_time_ms": "1761782402000",
+					"sentence_id": "987654322"
+				}
+			]
+		}
+	}`)
+	if got == nil {
+		t.Fatal("Process output is nil")
+	}
+	var out VCRecordingTranscriptGeneratedOutput
+	if err := json.Unmarshal(got, &out); err != nil {
+		t.Fatalf("Process output is not valid JSON: %v\nraw=%s", err, string(got))
+	}
+
+	if out.Type != eventTypeRecordingTranscriptGenerated {
+		t.Errorf("Type = %q", out.Type)
+	}
+	if out.UniqueKey != "recording_001" || out.Source != "recording_bean" {
+		t.Errorf("UniqueKey/Source = %q/%q", out.UniqueKey, out.Source)
+	}
+	if out.EventTime != recordingTestEventTime(1761782400100) {
+		t.Errorf("EventTime = %q", out.EventTime)
+	}
+	if len(out.TranscriptItems) != 2 {
+		t.Fatalf("TranscriptItems len = %d, want 2", len(out.TranscriptItems))
+	}
+	item := out.TranscriptItems[0]
+	if item.SpeakerName != "Alice" || item.Text != "hello world" {
+		t.Errorf("Transcript speaker/text = %q/%q", item.SpeakerName, item.Text)
+	}
+	if item.StartTime != recordingTestEventTime(1761782399000) || item.EndTime != recordingTestEventTime(1761782400000) {
+		t.Errorf("Transcript timing = %q/%q", item.StartTime, item.EndTime)
+	}
+	if item.SentenceID != "987654321" {
+		t.Errorf("SentenceID = %q, want 987654321", item.SentenceID)
+	}
+	if out.TranscriptItems[1].SpeakerName != "Bob" || out.TranscriptItems[1].SentenceID != "987654322" {
+		t.Errorf("second transcript item = %+v", out.TranscriptItems[1])
+	}
+	itemJSON, err := json.Marshal(item)
+	if err != nil {
+		t.Fatalf("marshal transcript item: %v", err)
+	}
+	var itemFields map[string]any
+	if err := json.Unmarshal(itemJSON, &itemFields); err != nil {
+		t.Fatalf("unmarshal transcript item JSON: %v", err)
+	}
+	wantItemFields := map[string]bool{
+		"speaker_name": true,
+		"text":         true,
+		"start_time":   true,
+		"end_time":     true,
+		"sentence_id":  true,
+	}
+	for gotField := range itemFields {
+		if !wantItemFields[gotField] {
+			t.Errorf("Transcript item should not contain field %q, got %s", gotField, string(itemJSON))
+		}
+	}
+	for wantField := range wantItemFields {
+		if _, ok := itemFields[wantField]; !ok {
+			t.Errorf("Transcript item missing field %q, got %s", wantField, string(itemJSON))
+		}
+	}
+	for _, unexpected := range []string{
+		`"seq_id"`,
+		`"speaker"`,
+		`"user_open_id"`,
+		`"user_type"`,
+		`"user_role"`,
+		`"language"`,
+		`"start_time_ms"`,
+		`"end_time_ms"`,
+		`"sequence_id"`,
+		`"transcript_item"`,
+	} {
+		if strings.Contains(string(got), unexpected) {
+			t.Errorf("Transcript output should not contain %s, got %s", unexpected, string(got))
+		}
+	}
+	if !strings.Contains(string(got), `"sentence_id":"987654321"`) {
+		t.Errorf("Transcript output should contain sentence_id, got %s", string(got))
+	}
+}
+
+func TestProcessVCRecordingEnded(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	out := runRecordingProcess[VCRecordingEndedOutput](t, eventTypeRecordingEnded, processVCRecordingEnded, `{
+		"schema": "2.0",
+		"header": {
+			"event_id": "ev_rec_end_001",
+			"event_type": "vc.recording.recording_ended_v1",
+			"create_time": "1761782400200"
+		},
+		"event": {
+			"unique_key": "recording_001",
+			"source": "recording_bean",
+			"object_type": "minutes",
+			"object_id": "minute_token_001"
+		}
+	}`)
+
+	if out.Type != eventTypeRecordingEnded {
+		t.Errorf("Type = %q", out.Type)
+	}
+	if out.UniqueKey != "recording_001" || out.Source != "recording_bean" {
+		t.Errorf("UniqueKey/Source = %q/%q", out.UniqueKey, out.Source)
+	}
+	if out.EventTime != recordingTestEventTime(1761782400200) {
+		t.Errorf("EventTime = %q", out.EventTime)
+	}
+}
+
+func TestProcessVCRecordingEnded_DropsObjectMetadata(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	got := runRecordingProcessRaw(t, eventTypeRecordingEnded, processVCRecordingEnded, `{
+		"schema": "2.0",
+		"header": {
+			"event_id": "ev_rec_end_001",
+			"event_type": "vc.recording.recording_ended_v1",
+			"create_time": "1761782400200"
+		},
+		"event": {
+			"unique_key": "recording_001",
+			"source": "recording_bean",
+			"object_type": "minutes",
+			"object_id": "minute_token_001"
+		}
+	}`)
+
+	if strings.Contains(string(got), "object_type") || strings.Contains(string(got), "object_id") {
+		t.Fatalf("ended output should drop object metadata, got %s", string(got))
+	}
+}
+
+func TestProcessVCRecording_DropsTimestampField(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	got := runRecordingProcessRaw(t, eventTypeRecordingStarted, processVCRecordingStarted, `{
+		"schema": "2.0",
+		"header": {
+			"event_id": "ev_rec_start_001",
+			"event_type": "vc.recording.recording_started_v1",
+			"create_time": "1761782400000"
+		},
+		"event": {
+			"unique_key": "recording_001",
+			"source": "recording_bean"
+		}
+	}`)
+
+	if strings.Contains(string(got), `"timestamp"`) {
+		t.Fatalf("recording output should use event_time instead of timestamp, got %s", string(got))
+	}
+	if !strings.Contains(string(got), `"event_time":"`+recordingTestEventTime(1761782400000)+`"`) {
+		t.Fatalf("recording output should include ISO 8601 event_time, got %s", string(got))
+	}
+}
+
+func TestProcessVCRecording_NonRecordingBeanFiltered(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	for _, tc := range []struct {
+		name      string
+		eventType string
+		process   event.ProcessFunc
+		payload   string
+	}{
+		{
+			name:      "started",
+			eventType: eventTypeRecordingStarted,
+			process:   processVCRecordingStarted,
+			payload: `{
+				"schema": "2.0",
+				"header": {"event_id": "ev_rec_start_001", "event_type": "vc.recording.recording_started_v1"},
+				"event": {"unique_key": "recording_001", "source": "software_recording"}
+			}`,
+		},
+		{
+			name:      "transcript",
+			eventType: eventTypeRecordingTranscriptGenerated,
+			process:   processVCRecordingTranscriptGenerated,
+			payload: `{
+				"schema": "2.0",
+				"header": {"event_id": "ev_rec_transcript_001", "event_type": "vc.recording.recording_transcript_generated_v1"},
+				"event": {"unique_key": "recording_001", "source": "software_recording", "transcript_items": []}
+			}`,
+		},
+		{
+			name:      "ended",
+			eventType: eventTypeRecordingEnded,
+			process:   processVCRecordingEnded,
+			payload: `{
+				"schema": "2.0",
+				"header": {"event_id": "ev_rec_end_001", "event_type": "vc.recording.recording_ended_v1"},
+				"event": {"unique_key": "recording_001", "source": "software_recording"}
+			}`,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			got := runRecordingProcessRaw(t, tc.eventType, tc.process, tc.payload)
+			if got != nil {
+				t.Fatalf("non-recording_bean event should be filtered, got %s", string(got))
+			}
+		})
+	}
+}
+
+func TestProcessVCRecording_MalformedPayloadPassthrough(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	for _, tc := range []struct {
+		name      string
+		eventType string
+		process   event.ProcessFunc
+	}{
+		{name: "started", eventType: eventTypeRecordingStarted, process: processVCRecordingStarted},
+		{name: "transcript", eventType: eventTypeRecordingTranscriptGenerated, process: processVCRecordingTranscriptGenerated},
+		{name: "ended", eventType: eventTypeRecordingEnded, process: processVCRecordingEnded},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			raw := &event.RawEvent{
+				EventType: tc.eventType,
+				Payload:   json.RawMessage(`not json`),
+				Timestamp: time.Now(),
+			}
+			got, err := tc.process(context.Background(), nil, raw, nil)
+			if err != nil {
+				t.Fatalf("Process should swallow parse errors, got %v", err)
+			}
+			if string(got) != "not json" {
+				t.Errorf("malformed fallback output = %q, want original bytes", string(got))
+			}
+		})
+	}
+}
+
+func TestVCRecording_PreConsumeSubscriptionLifecycle(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	for _, tc := range []struct {
+		eventType string
+	}{
+		{eventTypeRecordingStarted},
+		{eventTypeRecordingTranscriptGenerated},
+		{eventTypeRecordingEnded},
+	} {
+		t.Run(tc.eventType, func(t *testing.T) {
+			def, ok := event.Lookup(tc.eventType)
+			if !ok {
+				t.Fatalf("%s should be registered via Keys()", tc.eventType)
+			}
+
+			type call struct {
+				method string
+				path   string
+				body   any
+			}
+			var calls []call
+			rt := &stubAPIClient{
+				callFn: func(_ context.Context, method, path string, body any) (json.RawMessage, error) {
+					calls = append(calls, call{method: method, path: path, body: body})
+					return json.RawMessage(`{"code":0,"msg":"success","data":{}}`), nil
+				},
+			}
+
+			cleanup, err := def.PreConsume(context.Background(), rt, nil)
+			if err != nil {
+				t.Fatalf("PreConsume error: %v", err)
+			}
+			if cleanup == nil {
+				t.Fatal("cleanup must not be nil")
+			}
+			if len(calls) != 1 {
+				t.Fatalf("calls after subscribe = %d, want 1", len(calls))
+			}
+			if calls[0].method != "POST" || calls[0].path != pathRecordingSubscribe {
+				t.Fatalf("subscribe call = %+v", calls[0])
+			}
+			assertSubscriptionRequest(t, calls[0].body, tc.eventType)
+
+			cleanup()
+			if len(calls) != 2 {
+				t.Fatalf("calls after cleanup = %d, want 2", len(calls))
+			}
+			if calls[1].method != "POST" || calls[1].path != pathRecordingUnsubscribe {
+				t.Fatalf("unsubscribe call = %+v", calls[1])
+			}
+			assertSubscriptionRequest(t, calls[1].body, tc.eventType)
+		})
+	}
+}
+
+func runRecordingProcess[T any](t *testing.T, eventType string, process event.ProcessFunc, payload string) T {
+	t.Helper()
+	got := runRecordingProcessRaw(t, eventType, process, payload)
+	if got == nil {
+		t.Fatal("Process output is nil")
+	}
+	var out T
+	if err := json.Unmarshal(got, &out); err != nil {
+		t.Fatalf("Process output is not valid JSON: %v\nraw=%s", err, string(got))
+	}
+	return out
+}
+
+func runRecordingProcessRaw(t *testing.T, eventType string, process event.ProcessFunc, payload string) json.RawMessage {
+	t.Helper()
+	raw := &event.RawEvent{
+		EventType: eventType,
+		Payload:   json.RawMessage(payload),
+		Timestamp: time.Now(),
+	}
+	got, err := process(context.Background(), nil, raw, nil)
+	if err != nil {
+		t.Fatalf("Process error: %v", err)
+	}
+	return got
+}
+
+func recordingTestEventTime(millis int64) string {
+	return time.UnixMilli(millis).Local().Format(time.RFC3339)
+}

events/vc/recording_transcript_generated.go

@@ -0,0 +1,163 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package vc
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"time"
+
+	"github.com/larksuite/cli/internal/event"
+)
+
+// VCRecordingTranscriptItemOutput is one flattened transcript item for recording events.
+type VCRecordingTranscriptItemOutput struct {
+	SpeakerName string `json:"speaker_name,omitempty" desc:"Speaker display name"`
+	Text        string `json:"text,omitempty"         desc:"Transcript text"`
+	StartTime   string `json:"start_time,omitempty"   desc:"Transcript item start time in RFC3339 / ISO 8601 with the current system timezone"`
+	EndTime     string `json:"end_time,omitempty"     desc:"Transcript item end time in RFC3339 / ISO 8601 with the current system timezone"`
+	SentenceID  string `json:"sentence_id,omitempty"  desc:"Transcript sentence ID"`
+}
+
+// VCRecordingTranscriptGeneratedOutput is the flattened shape for vc.recording.recording_transcript_generated_v1.
+type VCRecordingTranscriptGeneratedOutput struct {
+	Type            string                            `json:"type"                       desc:"Event type; always vc.recording.recording_transcript_generated_v1"`
+	EventID         string                            `json:"event_id,omitempty"         desc:"Globally unique event ID; safe for deduplication"`
+	EventTime       string                            `json:"event_time,omitempty"       desc:"Time when this batch of transcript items was generated, in RFC3339 / ISO 8601 with the current system timezone"`
+	UniqueKey       string                            `json:"unique_key,omitempty"       desc:"Unique key generated for one recording_bean recording session"`
+	Source          string                            `json:"source,omitempty"           desc:"Recording source; always recording_bean"`
+	TranscriptItems []VCRecordingTranscriptItemOutput `json:"transcript_items,omitempty" desc:"Generated transcript items"`
+}
+
+type recordingTranscriptGeneratedEnvelope struct {
+	Header struct {
+		EventID    string `json:"event_id"`
+		EventType  string `json:"event_type"`
+		CreateTime string `json:"create_time"`
+	} `json:"header"`
+	Event recordingTranscriptGeneratedEvent `json:"event"`
+}
+
+type recordingTranscriptGeneratedEvent struct {
+	UniqueKey       string                               `json:"unique_key"`
+	Source          string                               `json:"source"`
+	TranscriptItems []recordingTranscriptGeneratedItemIn `json:"transcript_items"`
+}
+
+type recordingTranscriptGeneratedItemIn struct {
+	Speaker     *recordingTranscriptGeneratedSpeakerIn `json:"speaker"`
+	Text        string                                 `json:"text"`
+	StartTimeMs recordingTranscriptGeneratedString     `json:"start_time_ms"`
+	EndTimeMs   recordingTranscriptGeneratedString     `json:"end_time_ms"`
+	SentenceID  string                                 `json:"sentence_id"`
+}
+
+type recordingTranscriptGeneratedSpeakerIn struct {
+	UserName string `json:"user_name"`
+}
+
+type recordingTranscriptGeneratedString string
+
+func processVCRecordingTranscriptGenerated(_ context.Context, _ event.APIClient, raw *event.RawEvent, _ map[string]string) (json.RawMessage, error) {
+	envelope, ok := parseRecordingTranscriptGeneratedEnvelope(raw)
+	if !ok {
+		return raw.Payload, nil
+	}
+	if !isRecordingTranscriptGeneratedBeanEvent(envelope) {
+		return nil, nil
+	}
+	out := &VCRecordingTranscriptGeneratedOutput{
+		Type:            recordingTranscriptGeneratedEventType(envelope, raw),
+		EventID:         envelope.Header.EventID,
+		EventTime:       recordingTranscriptGeneratedEventTime(envelope.Header.CreateTime),
+		UniqueKey:       envelope.Event.UniqueKey,
+		Source:          envelope.Event.Source,
+		TranscriptItems: recordingTranscriptItems(envelope.Event.TranscriptItems),
+	}
+	return json.Marshal(out)
+}
+
+func parseRecordingTranscriptGeneratedEnvelope(raw *event.RawEvent) (*recordingTranscriptGeneratedEnvelope, bool) {
+	var envelope recordingTranscriptGeneratedEnvelope
+	if err := json.Unmarshal(raw.Payload, &envelope); err != nil {
+		return nil, false
+	}
+	return &envelope, true
+}
+
+func isRecordingTranscriptGeneratedBeanEvent(envelope *recordingTranscriptGeneratedEnvelope) bool {
+	return envelope != nil && envelope.Event.Source == "recording_bean"
+}
+
+func recordingTranscriptGeneratedEventType(envelope *recordingTranscriptGeneratedEnvelope, raw *event.RawEvent) string {
+	if envelope != nil && envelope.Header.EventType != "" {
+		return envelope.Header.EventType
+	}
+	return raw.EventType
+}
+
+func recordingTranscriptGeneratedEventTime(raw string) string {
+	return recordingTranscriptGeneratedMillisToLocalRFC3339(raw)
+}
+
+func recordingTranscriptGeneratedMillisToLocalRFC3339(raw string) string {
+	if raw == "" {
+		return ""
+	}
+	millis, err := strconv.ParseInt(raw, 10, 64)
+	if err != nil {
+		return ""
+	}
+	return time.UnixMilli(millis).Local().Format(time.RFC3339)
+}
+
+func recordingTranscriptItems(items []recordingTranscriptGeneratedItemIn) []VCRecordingTranscriptItemOutput {
+	if len(items) == 0 {
+		return nil
+	}
+	out := make([]VCRecordingTranscriptItemOutput, 0, len(items))
+	for _, item := range items {
+		out = append(out, recordingTranscriptItem(item))
+	}
+	return out
+}
+
+func recordingTranscriptItem(item recordingTranscriptGeneratedItemIn) VCRecordingTranscriptItemOutput {
+	return VCRecordingTranscriptItemOutput{
+		SpeakerName: recordingSpeakerName(item.Speaker),
+		Text:        item.Text,
+		StartTime:   recordingTranscriptGeneratedMillisToLocalRFC3339(item.StartTimeMs.String()),
+		EndTime:     recordingTranscriptGeneratedMillisToLocalRFC3339(item.EndTimeMs.String()),
+		SentenceID:  item.SentenceID,
+	}
+}
+
+func recordingSpeakerName(speaker *recordingTranscriptGeneratedSpeakerIn) string {
+	if speaker == nil {
+		return ""
+	}
+	return speaker.UserName
+}
+
+func (s *recordingTranscriptGeneratedString) UnmarshalJSON(data []byte) error {
+	if string(data) == "null" {
+		return nil
+	}
+	var str string
+	if err := json.Unmarshal(data, &str); err == nil {
+		*s = recordingTranscriptGeneratedString(str)
+		return nil
+	}
+	var num json.Number
+	if err := json.Unmarshal(data, &num); err != nil {
+		return err
+	}
+	*s = recordingTranscriptGeneratedString(num.String())
+	return nil
+}
+
+func (s recordingTranscriptGeneratedString) String() string {
+	return string(s)
+}

events/vc/register.go

@@ -11,13 +11,18 @@ import (
 )
 
 const (
-	eventTypeMeetingEnded  = "vc.meeting.participant_meeting_ended_v1"
-	eventTypeNoteGenerated = "vc.note.generated_v1"
+	eventTypeMeetingEnded                 = "vc.meeting.participant_meeting_ended_v1"
+	eventTypeNoteGenerated                = "vc.note.generated_v1"
+	eventTypeRecordingStarted             = "vc.recording.recording_started_v1"
+	eventTypeRecordingTranscriptGenerated = "vc.recording.recording_transcript_generated_v1"
+	eventTypeRecordingEnded               = "vc.recording.recording_ended_v1"
 
-	pathMeetingSubscribe   = "/open-apis/vc/v1/meetings/subscription"
-	pathMeetingUnsubscribe = "/open-apis/vc/v1/meetings/unsubscription"
-	pathNoteSubscribe      = "/open-apis/vc/v1/notes/subscription"
-	pathNoteUnsubscribe    = "/open-apis/vc/v1/notes/unsubscription"
+	pathMeetingSubscribe     = "/open-apis/vc/v1/meetings/subscription"
+	pathMeetingUnsubscribe   = "/open-apis/vc/v1/meetings/unsubscription"
+	pathNoteSubscribe        = "/open-apis/vc/v1/notes/subscription"
+	pathNoteUnsubscribe      = "/open-apis/vc/v1/notes/unsubscription"
+	pathRecordingSubscribe   = "/open-apis/vc/v1/recordings/subscription"
+	pathRecordingUnsubscribe = "/open-apis/vc/v1/recordings/unsubscription"
 
 	pathNoteDetailFmt = "/open-apis/vc/v1/notes/%s"
 )
@@ -57,5 +62,53 @@ func Keys() []event.KeyDefinition {
 			},
 			RequiredConsoleEvents: []string{eventTypeNoteGenerated},
 		},
+		{
+			Key:         eventTypeRecordingStarted,
+			DisplayName: "Recording started",
+			Description: "Triggered when a recording_bean recording starts; only generated when connected to Feishu software.",
+			EventType:   eventTypeRecordingStarted,
+			Schema: event.SchemaDef{
+				Custom: &event.SchemaSpec{Type: reflect.TypeOf(VCRecordingStartedOutput{})},
+			},
+			Process:    processVCRecordingStarted,
+			PreConsume: subscriptionPreConsume(eventTypeRecordingStarted, pathRecordingSubscribe, pathRecordingUnsubscribe),
+			Scopes:     []string{"vc:recording:read"},
+			AuthTypes: []string{
+				"user",
+			},
+			RequiredConsoleEvents: []string{eventTypeRecordingStarted},
+		},
+		{
+			Key:         eventTypeRecordingTranscriptGenerated,
+			DisplayName: "Recording transcript generated",
+			Description: "Triggered when recording_bean transcript items are generated; only generated when connected to Feishu software.",
+			EventType:   eventTypeRecordingTranscriptGenerated,
+			Schema: event.SchemaDef{
+				Custom: &event.SchemaSpec{Type: reflect.TypeOf(VCRecordingTranscriptGeneratedOutput{})},
+			},
+			Process:    processVCRecordingTranscriptGenerated,
+			PreConsume: subscriptionPreConsume(eventTypeRecordingTranscriptGenerated, pathRecordingSubscribe, pathRecordingUnsubscribe),
+			Scopes:     []string{"vc:recording:read"},
+			AuthTypes: []string{
+				"user",
+			},
+			RequiredConsoleEvents: []string{eventTypeRecordingTranscriptGenerated},
+		},
+		{
+			Key:         eventTypeRecordingEnded,
+			DisplayName: "Recording ended",
+			Description: "Triggered when a recording_bean recording ends and uploads successfully; only generated when connected to Feishu software.",
+			EventType:   eventTypeRecordingEnded,
+			Schema: event.SchemaDef{
+				Custom: &event.SchemaSpec{Type: reflect.TypeOf(VCRecordingEndedOutput{})},
+			},
+			Process:    processVCRecordingEnded,
+			PreConsume: subscriptionPreConsume(eventTypeRecordingEnded, pathRecordingSubscribe, pathRecordingUnsubscribe),
+			Scopes:     []string{"vc:recording:read"},
+			AuthTypes: []string{
+				"user",
+			},
+			RequiredConsoleEvents: []string{eventTypeRecordingEnded},
+		},
 	}
 }

events/whiteboard/native.go

@@ -0,0 +1,23 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package whiteboard
+
+// BoardWhiteboardUpdatedV1Data is the flattened whiteboard updated source payload.
+type BoardWhiteboardUpdatedV1Data struct {
+	// WhiteboardID is the id of the whiteboard whose content was updated.
+	WhiteboardID string `json:"whiteboard_id"`
+	// OperatorIDs lists the operators that produced this update batch.
+	OperatorIDs []OperatorID `json:"operator_ids"`
+}
+
+// OperatorID identifies an operator that produced the whiteboard update,
+// expressed in the three Lark identity formats.
+type OperatorID struct {
+	// OpenID is the operator's open_id within the current app.
+	OpenID string `json:"open_id"`
+	// UnionID is the operator's union_id across apps under the same ISV.
+	UnionID string `json:"union_id"`
+	// UserID is the operator's user_id within the tenant.
+	UserID string `json:"user_id"`
+}

events/whiteboard/preconsume.go

@@ -0,0 +1,56 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package whiteboard
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/event"
+	"github.com/larksuite/cli/internal/validate"
+)
+
+// cleanupTimeout bounds how long the unsubscribe call has to finish during
+// PreConsume cleanup so a stuck OAPI cannot block process shutdown.
+const cleanupTimeout = 5 * time.Second
+
+// whiteboardSubscriptionPreConsume calls the whiteboard event subscribe OAPI
+// and returns a cleanup that invokes the matching unsubscribe.
+//
+// board.whiteboard.updated_v1 is subscribed per-whiteboard (by whiteboard_id),
+// so the path contains a :whiteboard_id placeholder that must be supplied via params.
+func whiteboardSubscriptionPreConsume(eventType string) func(context.Context, event.APIClient, map[string]string) (func() error, error) {
+	return func(ctx context.Context, rt event.APIClient, params map[string]string) (func() error, error) {
+		if rt == nil {
+			return nil, errs.NewInternalError(errs.SubtypeUnknown,
+				"runtime API client is required for pre-consume subscription")
+		}
+		whiteboardID := params["whiteboard_id"]
+		if whiteboardID == "" {
+			return nil, errs.NewValidationError(errs.SubtypeInvalidArgument,
+				"param whiteboard_id is required for %s", eventType).
+				WithParam("--param").
+				WithHint("pass it as --param whiteboard_id=<id>; run `lark-cli event schema %s` for details", eventType)
+		}
+		encoded := validate.EncodePathSegment(whiteboardID)
+		subscribePath := fmt.Sprintf("/open-apis/board/v1/whiteboards/%s/subscribe", encoded)
+		unsubscribePath := fmt.Sprintf("/open-apis/board/v1/whiteboards/%s/unsubscribe", encoded)
+
+		body := map[string]string{"event_type": eventType}
+		if _, err := rt.CallAPI(ctx, "POST", subscribePath, body); err != nil {
+			return nil, err
+		}
+
+		return func() error {
+			cleanupCtx, cancel := context.WithTimeout(context.Background(), cleanupTimeout)
+			defer cancel()
+			if _, err := rt.CallAPI(cleanupCtx, "POST", unsubscribePath, body); err != nil {
+				return err
+			}
+			return nil
+		}, nil
+	}
+}

events/whiteboard/preconsume_test.go

@@ -0,0 +1,212 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package whiteboard
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"sync"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/event"
+)
+
+// recordedCall captures a single APIClient invocation for assertion.
+type recordedCall struct {
+	method string
+	path   string
+	body   interface{}
+}
+
+// fakeAPIClient is a minimal event.APIClient stub that records calls and
+// can be configured to fail when the request path matches errOnPath.
+type fakeAPIClient struct {
+	mu        sync.Mutex
+	calls     []recordedCall
+	errOnPath string
+}
+
+// CallAPI records the invocation and optionally returns a simulated error
+// when the path contains the configured errOnPath substring.
+func (f *fakeAPIClient) CallAPI(_ context.Context, method, path string, body interface{}) (json.RawMessage, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	f.calls = append(f.calls, recordedCall{method: method, path: path, body: body})
+	if f.errOnPath != "" && strings.Contains(path, f.errOnPath) {
+		return nil, errors.New("simulated subscribe failure")
+	}
+	return json.RawMessage(`{}`), nil
+}
+
+// TestWhiteboardSubscriptionPreConsume_MissingWhiteboardID verifies that the
+// PreConsume hook fails fast with an actionable error when whiteboard_id
+// is absent from the params map.
+func TestWhiteboardSubscriptionPreConsume_MissingWhiteboardID(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	pc := whiteboardSubscriptionPreConsume(eventTypeWhiteboardUpdated)
+	cleanup, err := pc(context.Background(), &fakeAPIClient{}, map[string]string{})
+	if err == nil {
+		t.Fatalf("expected error when whiteboard_id missing")
+	}
+	if cleanup != nil {
+		t.Fatalf("expected nil cleanup on error")
+	}
+	if !strings.Contains(err.Error(), "whiteboard_id") {
+		t.Fatalf("error should mention whiteboard_id, got: %v", err)
+	}
+	var ve *errs.ValidationError
+	if !errors.As(err, &ve) {
+		t.Fatalf("expected *errs.ValidationError, got %T: %v", err, err)
+	}
+	if ve.Subtype != errs.SubtypeInvalidArgument || ve.Param != "--param" {
+		t.Errorf("subtype/param = %s/%q, want %s/%q", ve.Subtype, ve.Param, errs.SubtypeInvalidArgument, "--param")
+	}
+	if ve.Hint == "" {
+		t.Error("missing whiteboard_id should carry a hint")
+	}
+}
+
+// TestWhiteboardSubscriptionPreConsume_NilRuntime verifies that PreConsume
+// returns an error when the runtime APIClient dependency is missing.
+func TestWhiteboardSubscriptionPreConsume_NilRuntime(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	pc := whiteboardSubscriptionPreConsume(eventTypeWhiteboardUpdated)
+	_, err := pc(context.Background(), nil, map[string]string{"whiteboard_id": "wb1"})
+	if err == nil {
+		t.Fatalf("expected error when runtime client is nil")
+	}
+	if p, ok := errs.ProblemOf(err); !ok || p.Category != errs.CategoryInternal {
+		t.Errorf("nil-runtime invariant should be a typed internal error, got %T: %v", err, err)
+	}
+}
+
+// TestWhiteboardSubscriptionPreConsume_SubscribeError verifies that a
+// failed subscribe call surfaces the error and skips registering a cleanup,
+// so no spurious unsubscribe is invoked.
+func TestWhiteboardSubscriptionPreConsume_SubscribeError(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	pc := whiteboardSubscriptionPreConsume(eventTypeWhiteboardUpdated)
+	rt := &fakeAPIClient{errOnPath: "/subscribe"}
+	cleanup, err := pc(context.Background(), rt, map[string]string{"whiteboard_id": "wb1"})
+	if err == nil {
+		t.Fatalf("expected error from subscribe call")
+	}
+	if cleanup != nil {
+		t.Fatalf("expected nil cleanup when subscribe fails")
+	}
+	// only the failed subscribe call should have been made; no unsubscribe.
+	if len(rt.calls) != 1 {
+		t.Fatalf("expected exactly 1 call (subscribe), got %d", len(rt.calls))
+	}
+}
+
+// TestWhiteboardSubscriptionPreConsume_SubscribeAndCleanup verifies the full
+// happy-path: subscribe is called once with the correct method/path/body,
+// and the returned cleanup invokes the matching unsubscribe.
+func TestWhiteboardSubscriptionPreConsume_SubscribeAndCleanup(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	pc := whiteboardSubscriptionPreConsume(eventTypeWhiteboardUpdated)
+	rt := &fakeAPIClient{}
+	cleanup, err := pc(context.Background(), rt, map[string]string{"whiteboard_id": "wb1"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if cleanup == nil {
+		t.Fatalf("expected non-nil cleanup")
+	}
+
+	if len(rt.calls) != 1 {
+		t.Fatalf("expected 1 call after subscribe, got %d", len(rt.calls))
+	}
+	got := rt.calls[0]
+	if got.method != "POST" {
+		t.Errorf("subscribe method: got %q, want POST", got.method)
+	}
+	wantSubPath := "/open-apis/board/v1/whiteboards/wb1/subscribe"
+	if got.path != wantSubPath {
+		t.Errorf("subscribe path: got %q, want %q", got.path, wantSubPath)
+	}
+	body, _ := got.body.(map[string]string)
+	if body["event_type"] != eventTypeWhiteboardUpdated {
+		t.Errorf("subscribe body event_type: got %q, want %q", body["event_type"], eventTypeWhiteboardUpdated)
+	}
+
+	cleanup()
+	if len(rt.calls) != 2 {
+		t.Fatalf("expected 2 calls after cleanup, got %d", len(rt.calls))
+	}
+	got2 := rt.calls[1]
+	if got2.method != "POST" {
+		t.Errorf("unsubscribe method: got %q, want POST", got2.method)
+	}
+	wantUnsubPath := "/open-apis/board/v1/whiteboards/wb1/unsubscribe"
+	if got2.path != wantUnsubPath {
+		t.Errorf("unsubscribe path: got %q, want %q", got2.path, wantUnsubPath)
+	}
+	body2, _ := got2.body.(map[string]string)
+	if body2["event_type"] != eventTypeWhiteboardUpdated {
+		t.Errorf("unsubscribe body event_type: got %q, want %q", body2["event_type"], eventTypeWhiteboardUpdated)
+	}
+}
+
+// TestWhiteboardSubscriptionPreConsume_PathSegmentEncoded verifies that
+// whiteboard_id values containing reserved URL characters are properly
+// path-segment encoded so they cannot escape into adjacent path segments.
+func TestWhiteboardSubscriptionPreConsume_PathSegmentEncoded(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	pc := whiteboardSubscriptionPreConsume(eventTypeWhiteboardUpdated)
+	rt := &fakeAPIClient{}
+	// 含特殊字符的 whiteboard_id 应被 path-segment 编码，避免越界到其他 path 段。
+	_, err := pc(context.Background(), rt, map[string]string{"whiteboard_id": "wb/1?evil"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if len(rt.calls) != 1 {
+		t.Fatalf("expected 1 call, got %d", len(rt.calls))
+	}
+	if strings.Contains(rt.calls[0].path, "wb/1?evil") {
+		t.Errorf("whiteboard_id was not encoded; path: %s", rt.calls[0].path)
+	}
+}
+
+// TestWhiteboardUpdatedV1HasPreConsume ensures the registered EventKey for
+// board.whiteboard.updated_v1 wires the PreConsume hook and declares the
+// required whiteboard_id parameter.
+func TestWhiteboardUpdatedV1HasPreConsume(t *testing.T) {
+	t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+	keys := Keys()
+	for _, k := range keys {
+		if k.Key == eventTypeWhiteboardUpdated {
+			if k.PreConsume == nil {
+				t.Fatalf("EventKey %s should have PreConsume hook", eventTypeWhiteboardUpdated)
+			}
+			if len(k.Params) == 0 {
+				t.Fatalf("EventKey %s should declare whiteboard_id param", eventTypeWhiteboardUpdated)
+			}
+			var found bool
+			for _, p := range k.Params {
+				if p.Name == "whiteboard_id" && p.Required {
+					found = true
+				}
+			}
+			if !found {
+				t.Fatalf("EventKey %s must declare required whiteboard_id param", eventTypeWhiteboardUpdated)
+			}
+			return
+		}
+	}
+	t.Fatalf("EventKey %s not registered", eventTypeWhiteboardUpdated)
+}
+
+// 确保 event.APIClient 接口与本测试 mock 一致。
+var _ event.APIClient = (*fakeAPIClient)(nil)

events/whiteboard/register.go

@@ -0,0 +1,48 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package whiteboard registers Board-domain EventKeys.
+package whiteboard
+
+import (
+	"reflect"
+
+	"github.com/larksuite/cli/internal/event"
+	"github.com/larksuite/cli/internal/event/schemas"
+)
+
+// eventTypeWhiteboardUpdated is the OAPI event type for whiteboard content updates.
+const eventTypeWhiteboardUpdated = "board.whiteboard.updated_v1"
+
+// Keys returns all Board-domain EventKey definitions.
+func Keys() []event.KeyDefinition {
+	return []event.KeyDefinition{
+		{
+			Key:         eventTypeWhiteboardUpdated,
+			DisplayName: "Whiteboard updated",
+			Description: "Pushed when the whiteboard content is updated.",
+			EventType:   eventTypeWhiteboardUpdated,
+			Params: []event.ParamDef{
+				{
+					Name:        "whiteboard_id",
+					Type:        event.ParamString,
+					Required:    true,
+					Description: "Whiteboard id to subscribe; subscription is per-whiteboard.",
+				},
+			},
+			Schema: event.SchemaDef{
+				Native: &event.SchemaSpec{Type: reflect.TypeOf(BoardWhiteboardUpdatedV1Data{})},
+				FieldOverrides: map[string]schemas.FieldMeta{
+					"/event/whiteboard_id":           {Kind: "whiteboard_id", Description: "whiteboard id to subscribe"},
+					"/event/operator_ids/*/open_id":  {Kind: "open_id"},
+					"/event/operator_ids/*/union_id": {Kind: "union_id"},
+					"/event/operator_ids/*/user_id":  {Kind: "user_id"},
+				},
+			},
+			PreConsume:            whiteboardSubscriptionPreConsume(eventTypeWhiteboardUpdated),
+			Scopes:                []string{"board:whiteboard:node:read"},
+			AuthTypes:             []string{"user", "bot"},
+			RequiredConsoleEvents: []string{eventTypeWhiteboardUpdated},
+		},
+	}
+}

go.mod

@@ -27,6 +27,8 @@ require (
 	gopkg.in/yaml.v3 v3.0.1
 )
 
+require github.com/apache/arrow/go/v17 v17.0.0
+
 require (
 	github.com/atotto/clipboard v0.1.4 // indirect
 	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
@@ -42,13 +44,17 @@ require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
+	github.com/goccy/go-json v0.10.3 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
+	github.com/google/flatbuffers v24.3.25+incompatible // indirect
 	github.com/gopherjs/gopherjs v1.17.2 // indirect
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/itchyny/timefmt-go v0.1.6 // indirect
 	github.com/jtolds/gls v4.20.0+incompatible // indirect
+	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.8 // indirect
 	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-localereader v0.0.1 // indirect
@@ -57,10 +63,16 @@ require (
 	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
 	github.com/muesli/cancelreader v0.2.2 // indirect
 	github.com/muesli/termenv v0.16.0 // indirect
+	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/smarty/assertions v1.15.0 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
+	github.com/zeebo/xxh3 v1.0.2 // indirect
+	golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 // indirect
+	golang.org/x/mod v0.18.0 // indirect
+	golang.org/x/tools v0.22.0 // indirect
+	golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
 )

go.sum

@@ -2,6 +2,8 @@ github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
+github.com/apache/arrow/go/v17 v17.0.0 h1:RRR2bdqKcdbss9Gxy2NS/hK8i4LDMh23L6BbkN5+F54=
+github.com/apache/arrow/go/v17 v17.0.0/go.mod h1:jR7QHkODl15PfYyjM2nU+yTLScZ/qfj7OSUZmJ8putc=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
 github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
@@ -52,12 +54,16 @@ github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkp
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6baUTXGLOoWe4PQhGxaX0KpnayAqC48p4=
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
+github.com/goccy/go-json v0.10.3 h1:KZ5WoDbxAIgm2HNbYckL0se1fHD6rz5j4ywS6ebzDqA=
+github.com/goccy/go-json v0.10.3/go.mod h1:oq7eo15ShAhp70Anwd5lgX2pLfOS3QCiwU/PULtXL6M=
 github.com/godbus/dbus/v5 v5.2.2 h1:TUR3TgtSVDmjiXOgAAyaZbYmIeP3DPkld3jgKGV8mXQ=
 github.com/godbus/dbus/v5 v5.2.2/go.mod h1:3AAv2+hPq5rdnr5txxxRwiGjPXamgoIHgz9FPBfOp3c=
 github.com/gofrs/flock v0.8.1 h1:+gYjHKf32LDeiEEFhQaotPbLuUXjY5ZqxKgXy7n59aw=
 github.com/gofrs/flock v0.8.1/go.mod h1:F1TvTiK9OcQqauNUHlbJvyl9Qa1QvF/gOUDKA14jxHU=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
+github.com/google/flatbuffers v24.3.25+incompatible h1:CX395cjN9Kke9mmalRoL3d81AtFUxJM+yDthflgJGkI=
+github.com/google/flatbuffers v24.3.25+incompatible/go.mod h1:1AeVuKshWv4vARoZatz6mlQ0JxURH0Kv5+zNeJKJCa8=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gopherjs/gopherjs v1.17.2 h1:fQnZVsXk8uxXIStYb0N4bGk7jeyTalG/wsZjQ25dO0g=
@@ -74,11 +80,16 @@ github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
 github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8=
 github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck=
+github.com/klauspost/compress v1.17.9 h1:6KIumPrER1LHsvBVuDa0r5xaG0Es51mhhB9BQB2qeMA=
+github.com/klauspost/compress v1.17.9/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/cpuid/v2 v2.2.8 h1:+StwCXwm9PdpiEkPyzBXIy+M9KUb4ODm0Zarf1kS5BM=
+github.com/klauspost/cpuid/v2 v2.2.8/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
 github.com/kr/pretty v0.1.0 h1:L/CwN0zerZDmRFUapSPitk6f+Q3+0za1rQkzVuMiMFI=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
 github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
 github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/larksuite/oapi-sdk-go/v3 v3.5.4 h1:U2S9x9LrfH++ZqJ+YAiUlqzCWJmVXhFdS8Z7rIBH8H0=
 github.com/larksuite/oapi-sdk-go/v3 v3.5.4/go.mod h1:ZEplY+kwuIrj/nqw5uSCINNATcH3KdxSN7y+UxYY5fI=
 github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
@@ -97,6 +108,8 @@ github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELU
 github.com/muesli/cancelreader v0.2.2/go.mod h1:3XuTXfFS2VjM+HTLZY9Ak0l6eUKfijIfMUZ4EgX0QYo=
 github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
+github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
+github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
@@ -133,14 +146,20 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/zalando/go-keyring v0.2.8 h1:6sD/Ucpl7jNq10rM2pgqTs0sZ9V3qMrqfIIy5YPccHs=
 github.com/zalando/go-keyring v0.2.8/go.mod h1:tsMo+VpRq5NGyKfxoBVjCuMrG47yj8cmakZDO5QGii0=
+github.com/zeebo/assert v1.3.0 h1:g7C04CbJuIDKNPFHmsk4hwZDO5O+kntRxzaUoNXj+IQ=
+github.com/zeebo/assert v1.3.0/go.mod h1:Pq9JiuJQpG8JLJdtkwrJESF0Foym2/D9XMU5ciN/wJ0=
+github.com/zeebo/xxh3 v1.0.2 h1:xZmwmqxHZA8AI603jOQ0tMqmBr9lPeFwGg6d+xy9DC0=
+github.com/zeebo/xxh3 v1.0.2/go.mod h1:5NWz9Sef7zIDm2JHfFlcQvNekmcEl9ekUZQQKCYaDcA=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
-golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
+golang.org/x/exp v0.0.0-20240222234643-814bf88cf225 h1:LfspQV/FYTatPTr/3HzIcmiUFH7PGP+OQ6mgDYo3yuQ=
+golang.org/x/exp v0.0.0-20240222234643-814bf88cf225/go.mod h1:CxmFvTBINI24O/j8iY7H1xHzx2i4OsyguNBmN/uPtqc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+golang.org/x/mod v0.18.0 h1:5+9lSbEzPSdWkH32vYPBwEpX8KwDbM52Ud9xBUvNlb0=
+golang.org/x/mod v0.18.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -156,6 +175,7 @@ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5h
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
 golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
@@ -169,10 +189,16 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
+golang.org/x/tools v0.22.0 h1:gqSGLZqv+AI9lIQzniJ0nZDRG5GBPsSi+DRNHWNz6yA=
+golang.org/x/tools v0.22.0/go.mod h1:aCwcsjqvq7Yqt6TNyX7QMU2enbQ/Gt0bo6krSeEri+c=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
+golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
+gonum.org/v1/gonum v0.15.0 h1:2lYxjRbTYyxkJxlhC+LvJIx3SsANPdRybu1tGj9/OrQ=
+gonum.org/v1/gonum v0.15.0/go.mod h1:xzZVBJBtS+Mz4q0Yl2LJTk+OxOg4jiXZ7qBoM0uISGo=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

internal/apicatalog/catalog.go

@@ -0,0 +1,396 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+// Package apicatalog is the single navigation Module over the API metadata. It
+// owns every "which services/resources/methods exist and how does a path
+// resolve" question that was previously duplicated across cmd/schema,
+// cmd/service, internal/schema and internal/registry. It depends only on
+// internal/meta; registry is the source Adapter (EmbeddedCatalog/RuntimeCatalog),
+// so apicatalog never imports registry.
+package apicatalog
+
+import (
+	"sort"
+	"strings"
+
+	"github.com/larksuite/cli/internal/meta"
+)
+
+// Source records whether a catalog includes the remote overlay. It is carried
+// so callers (and tests) can assert determinism instead of guessing.
+type Source string
+
+const (
+	SourceEmbedded Source = "embedded" // compiled-in metadata only; deterministic
+	SourceRuntime  Source = "runtime"  // embedded + remote overlay
+)
+
+// MethodFilter optionally drops methods (e.g. by identity in strict mode).
+// A nil filter includes everything.
+type MethodFilter func(meta.Method) bool
+
+// Catalog is a navigation view over services with a name index. It owns its
+// ordering — New sorts by name — so WalkMethods/Resolve/Complete are
+// deterministic regardless of how the source adapter ordered its input.
+type Catalog struct {
+	source   Source
+	services []meta.Service
+	byName   map[string]meta.Service
+}
+
+// New builds a Catalog over the given services, owning its navigation order:
+// the slice is copied and sorted by name so callers may pass any order and the
+// ordering contract is not delegated to the adapter. The copy is shallow —
+// meta.Service values share their Resources maps, which are treated as
+// read-only.
+func New(source Source, services []meta.Service) Catalog {
+	sorted := append([]meta.Service(nil), services...)
+	sort.Slice(sorted, func(i, j int) bool { return sorted[i].Name < sorted[j].Name })
+	byName := make(map[string]meta.Service, len(sorted))
+	for _, s := range sorted {
+		byName[s.Name] = s
+	}
+	return Catalog{source: source, services: sorted, byName: byName}
+}
+
+// Source reports embedded vs runtime.
+func (c Catalog) Source() Source { return c.source }
+
+// Services returns the services in name order. Treat the result as read-only:
+// it is the Catalog's own ordered slice and its element Resources maps are
+// shared.
+func (c Catalog) Services() []meta.Service { return c.services }
+
+// Service looks up one service by name.
+func (c Catalog) Service(name string) (meta.Service, bool) {
+	s, ok := c.byName[name]
+	return s, ok
+}
+
+// Resolve maps a path (already split into segments) to a Target. An empty path
+// is TargetAll. Failures return a *ResolveError carrying the available
+// candidates so the command layer can render a hint.
+func (c Catalog) Resolve(parts []string) (Target, error) {
+	if len(parts) == 0 {
+		return Target{Kind: TargetAll}, nil
+	}
+	svc, ok := c.byName[parts[0]]
+	if !ok {
+		return Target{}, &ResolveError{Kind: ErrService, Subject: parts[0], Candidates: c.serviceNames()}
+	}
+	if len(parts) == 1 {
+		return Target{Kind: TargetService, Service: svc}, nil
+	}
+	res, path, remaining, ok := findResource(svc, parts[1:])
+	if !ok {
+		return Target{}, &ResolveError{
+			Kind:       ErrResource,
+			Subject:    svc.Name + "." + strings.Join(parts[1:], "."),
+			Candidates: resourceNames(svc),
+		}
+	}
+	resPath := strings.Join(path, ".")
+	if len(remaining) == 0 {
+		return Target{Kind: TargetResource, Service: svc, Resource: &ResourceRef{Service: svc, Resource: res, Path: path}}, nil
+	}
+	methodName := remaining[0]
+	m, ok := res.Method(methodName)
+	if !ok {
+		return Target{}, &ResolveError{
+			Kind:       ErrMethod,
+			Subject:    svc.Name + "." + resPath + "." + methodName,
+			Candidates: methodNames(res),
+		}
+	}
+	if len(remaining) > 1 {
+		// Method exists but trailing segments don't resolve — reject so a typo
+		// doesn't silently return this method's schema.
+		return Target{}, &ResolveError{
+			Kind:     ErrPath,
+			Subject:  svc.Name + "." + resPath + "." + strings.Join(remaining, "."),
+			Method:   methodName,
+			Trailing: strings.Join(remaining[1:], "."),
+		}
+	}
+	return Target{Kind: TargetMethod, Service: svc, Method: &MethodRef{Service: svc, Resource: res, ResourcePath: path, Method: m}}, nil
+}
+
+// MethodRefs returns the method refs selected by a resolved Target, filtered:
+// TargetAll -> every method, TargetService / TargetResource -> that subtree,
+// TargetMethod -> the single method if it passes the filter (else empty). It
+// unifies WalkMethods/ServiceMethods/ResourceMethods so the command layer maps a
+// Target to refs in one call instead of re-deciding the walker per Kind.
+func (c Catalog) MethodRefs(target Target, filter MethodFilter) []MethodRef {
+	switch target.Kind {
+	case TargetService:
+		return ServiceMethods(target.Service, filter)
+	case TargetResource:
+		return ResourceMethods(*target.Resource, filter)
+	case TargetMethod:
+		if filter != nil && !filter(target.Method.Method) {
+			return nil
+		}
+		return []MethodRef{*target.Method}
+	case TargetAll:
+		return c.WalkMethods(filter)
+	default:
+		// Unknown / zero-value Kind: return nothing rather than silently
+		// dumping every method (the safe direction for an invalid Target).
+		return nil
+	}
+}
+
+// WalkMethods returns one MethodRef per method across all services (optionally
+// filtered), recursing nested resources, in a deterministic order: services by
+// name, resources by name, methods by name.
+func (c Catalog) WalkMethods(filter MethodFilter) []MethodRef {
+	var out []MethodRef
+	for _, svc := range c.services {
+		out = append(out, ServiceMethods(svc, filter)...)
+	}
+	return out
+}
+
+// ServiceMethods returns the method refs of one service (filtered), recursing
+// nested resources, in deterministic resource/method name order.
+func ServiceMethods(svc meta.Service, filter MethodFilter) []MethodRef {
+	var out []MethodRef
+	walkResources(svc, svc.ResourceList(), nil, filter, &out)
+	return out
+}
+
+// ResourceMethods returns the method refs under one resource (filtered), using
+// the resource's resolved path as the base and recursing nested resources.
+func ResourceMethods(r ResourceRef, filter MethodFilter) []MethodRef {
+	var out []MethodRef
+	for _, m := range r.Resource.MethodList() {
+		if filter == nil || filter(m) {
+			out = append(out, MethodRef{Service: r.Service, Resource: r.Resource, ResourcePath: r.Path, Method: m})
+		}
+	}
+	walkResources(r.Service, r.Resource.SubResources(), r.Path, filter, &out)
+	return out
+}
+
+func walkResources(svc meta.Service, resources []meta.Resource, parentPath []string, filter MethodFilter, out *[]MethodRef) {
+	for _, res := range resources {
+		path := append(append([]string(nil), parentPath...), res.Name)
+		for _, m := range res.MethodList() {
+			if filter == nil || filter(m) {
+				*out = append(*out, MethodRef{Service: svc, Resource: res, ResourcePath: path, Method: m})
+			}
+		}
+		walkResources(svc, res.SubResources(), path, filter, out)
+	}
+}
+
+// Complete returns shell-completion candidates for the schema path argument,
+// supporting both the legacy single dotted arg ("im.reac") and the
+// space-separated form ("im reactions"). noSpace mirrors cobra's
+// ShellCompDirectiveNoSpace (so "service." / "service.resource." stay open for
+// the next segment). Filtering uses the caller's MethodFilter so strict-mode
+// unavailable methods are hidden.
+func (c Catalog) Complete(args []string, toComplete string, filter MethodFilter) (completions []string, noSpace bool) {
+	// Case 1: legacy single dotted arg — no resolved args yet.
+	if len(args) == 0 {
+		parts := strings.Split(toComplete, ".")
+		if len(parts) <= 1 {
+			for _, name := range c.serviceNames() {
+				if strings.HasPrefix(name, toComplete) {
+					completions = append(completions, name+".")
+				}
+			}
+			return completions, true
+		}
+		svc, ok := c.byName[parts[0]]
+		if !ok {
+			return nil, false
+		}
+		completions = c.completeDotted(svc, strings.Join(parts[1:], "."), filter)
+		allTrailingDot := len(completions) > 0
+		for _, comp := range completions {
+			if !strings.HasSuffix(comp, ".") {
+				allTrailingDot = false
+				break
+			}
+		}
+		return completions, allTrailingDot
+	}
+
+	// Case 2: space-separated form — args holds resolved segments.
+	svc, ok := c.byName[args[0]]
+	if !ok {
+		return nil, false
+	}
+	resource, _, _, ok := findResource(svc, args[1:])
+	if !ok {
+		// No resource matched yet — suggest top-level resources reachable in the
+		// current identity mode.
+		return completeChildren(svc.ResourceList(), nil, toComplete, filter), false
+	}
+	// Positioned in a resource — offer its methods and its sub-resources, so the
+	// next segment can drill deeper, symmetric to findResource's descent.
+	return completeChildren(resource.SubResources(), resource.MethodList(), toComplete, filter), false
+}
+
+// completeDotted suggests dotted completions for the text after the service
+// segment. It descends fully-typed "resource." segments (longest match per
+// level, so flat dotted keys like "chat.members" and genuinely nested resources
+// both resolve), then offers the reachable sub-resources (as "…name.") and the
+// methods (as "…name") of the level it lands in whose names extend the trailing
+// partial token. This descent is symmetric to findResource, so completion can
+// reach every method Resolve can.
+func (c Catalog) completeDotted(svc meta.Service, afterService string, filter MethodFilter) []string {
+	subs := svc.ResourceList()
+	base := svc.Name
+	rest := afterService
+	var here *meta.Resource // resource we're positioned in; nil at the service root
+	for {
+		matched, n, ok := longestResourceFollowedByDot(subs, rest)
+		if !ok {
+			break
+		}
+		base += "." + matched.Name
+		rest = rest[n:]
+		r := matched
+		here = &r
+		subs = matched.SubResources()
+	}
+
+	var out []string
+	for _, sub := range subs {
+		if strings.HasPrefix(sub.Name, rest) && resourceReachable(sub, filter) {
+			out = append(out, base+"."+sub.Name+".")
+		}
+	}
+	if here != nil {
+		for _, m := range here.MethodList() {
+			if (filter == nil || filter(m)) && strings.HasPrefix(m.Name, rest) {
+				out = append(out, base+"."+m.Name)
+			}
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// completeChildren returns the sorted next-segment candidates at one level: the
+// (filtered) methods and the reachable sub-resources whose names extend prefix.
+// Methods are terminal; sub-resources are bare names the caller drills into on
+// the next segment.
+func completeChildren(subResources []meta.Resource, methods []meta.Method, prefix string, filter MethodFilter) []string {
+	var out []string
+	for _, m := range methods {
+		if (filter == nil || filter(m)) && strings.HasPrefix(m.Name, prefix) {
+			out = append(out, m.Name)
+		}
+	}
+	for _, sub := range subResources {
+		if strings.HasPrefix(sub.Name, prefix) && resourceReachable(sub, filter) {
+			out = append(out, sub.Name)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
+
+// longestResourceFollowedByDot finds the longest resource in resources whose
+// name is a fully-typed segment of text (text begins with "name."), returning
+// it, the byte length consumed (incl. the dot), and whether one matched.
+func longestResourceFollowedByDot(resources []meta.Resource, text string) (meta.Resource, int, bool) {
+	best := meta.Resource{}
+	bestLen := -1
+	for _, r := range resources {
+		if len(r.Name) > bestLen && strings.HasPrefix(text, r.Name+".") {
+			best = r
+			bestLen = len(r.Name)
+		}
+	}
+	if bestLen < 0 {
+		return meta.Resource{}, 0, false
+	}
+	return best, len(best.Name) + 1, true
+}
+
+// findResource resolves a resource path against a service, descending nested
+// resources. At each level it consumes the longest leading run of parts that
+// names a resource at that level, so both flat dotted keys ("chat.members")
+// and genuinely nested resources ("spaces" > "items") resolve. This descent is
+// symmetric to walkResources, which guarantees every path WalkMethods emits
+// resolves back (the round-trip contract). Returns the deepest matched resource
+// (Name injected), its path segments, the unconsumed remainder, and whether
+// anything matched.
+//
+// Descent is greedy and resource-first: the one ambiguous case is a resource
+// that has BOTH a method and a sub-resource of the same name — the sub-resource
+// wins and shadows the method, so Resolve can never reach that method. Real
+// metadata never collides the two, so this is theoretical.
+func findResource(svc meta.Service, parts []string) (res meta.Resource, path []string, remaining []string, ok bool) {
+	level := svc.Resources
+	remaining = parts
+	for len(remaining) > 0 {
+		matched, name, n := longestResourcePrefix(level, remaining)
+		if n == 0 {
+			break
+		}
+		matched.Name = name
+		res = matched
+		path = append(path, name)
+		remaining = remaining[n:]
+		level = matched.Resources
+		ok = true
+	}
+	return res, path, remaining, ok
+}
+
+// longestResourcePrefix finds the longest leading run of segs (joined by ".")
+// that names a resource in level, returning the resource, its dotted name, and
+// the number of segments consumed (0 if none match). Longest-first lets a flat
+// dotted key win over its single leading segment when present.
+func longestResourcePrefix(level map[string]meta.Resource, segs []string) (meta.Resource, string, int) {
+	for i := len(segs); i >= 1; i-- {
+		name := strings.Join(segs[:i], ".")
+		if r, ok := level[name]; ok {
+			return r, name, i
+		}
+	}
+	return meta.Resource{}, "", 0
+}
+
+// resourceReachable reports whether a resource exposes a method reachable under
+// the filter — directly or in any nested sub-resource (a nil filter accepts any
+// method). A resource whose methods are all filtered out but which contains a
+// reachable nested method is still offerable, so completion can drill into it.
+func resourceReachable(res meta.Resource, filter MethodFilter) bool {
+	for _, m := range res.MethodList() {
+		if filter == nil || filter(m) {
+			return true
+		}
+	}
+	for _, sub := range res.SubResources() {
+		if resourceReachable(sub, filter) {
+			return true
+		}
+	}
+	return false
+}
+
+func (c Catalog) serviceNames() []string {
+	names := make([]string, len(c.services))
+	for i, s := range c.services {
+		names[i] = s.Name
+	}
+	return names // c.services is already name-sorted
+}
+
+func resourceNames(svc meta.Service) []string { return sortedKeys(svc.Resources) }
+func methodNames(res meta.Resource) []string  { return sortedKeys(res.Methods) }
+
+func sortedKeys[V any](m map[string]V) []string {
+	keys := make([]string, 0, len(m))
+	for k := range m {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+	return keys
+}

internal/apicatalog/catalog_test.go

@@ -0,0 +1,340 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package apicatalog_test
+
+import (
+	"errors"
+	"reflect"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/internal/apicatalog"
+	"github.com/larksuite/cli/internal/meta"
+)
+
+// testCatalog builds a small embedded catalog: services drive (no resources)
+// and im with a dotted resource (chat.members), a multi-method resource
+// (reactions, where list is user-only), and images.
+func testCatalog() apicatalog.Catalog {
+	im := meta.ServiceFromMap(map[string]interface{}{
+		"name": "im",
+		"resources": map[string]interface{}{
+			"chat.members": map[string]interface{}{
+				"methods": map[string]interface{}{"create": map[string]interface{}{}},
+			},
+			"reactions": map[string]interface{}{
+				"methods": map[string]interface{}{
+					"create": map[string]interface{}{},
+					"list":   map[string]interface{}{"accessTokens": []interface{}{"user"}},
+				},
+			},
+			"images": map[string]interface{}{
+				"methods": map[string]interface{}{"create": map[string]interface{}{}},
+			},
+		},
+	})
+	drive := meta.ServiceFromMap(map[string]interface{}{"name": "drive"})
+	return apicatalog.New(apicatalog.SourceEmbedded, []meta.Service{drive, im}) // already name-sorted
+}
+
+func TestNew_PreservesOrderAndLookup(t *testing.T) {
+	c := testCatalog()
+	if c.Source() != apicatalog.SourceEmbedded {
+		t.Fatalf("source = %q", c.Source())
+	}
+	names := []string{}
+	for _, s := range c.Services() {
+		names = append(names, s.Name)
+	}
+	if !reflect.DeepEqual(names, []string{"drive", "im"}) {
+		t.Errorf("Services order = %v, want [drive im]", names)
+	}
+	if _, ok := c.Service("im"); !ok {
+		t.Error("Service(im) not found")
+	}
+	if _, ok := c.Service("nope"); ok {
+		t.Error("Service(nope) should not be found")
+	}
+}
+
+// TestNew_SortsAndIsolatesInput pins the ordering contract New owns: it sorts
+// arbitrary input by service name and shallow-copies the slice so later caller
+// mutation can't reorder the Catalog.
+func TestNew_SortsAndIsolatesInput(t *testing.T) {
+	in := []meta.Service{
+		meta.ServiceFromMap(map[string]interface{}{"name": "zeta"}),
+		meta.ServiceFromMap(map[string]interface{}{"name": "alpha"}),
+	}
+	c := apicatalog.New(apicatalog.SourceEmbedded, in)
+
+	names := func() []string {
+		var out []string
+		for _, s := range c.Services() {
+			out = append(out, s.Name)
+		}
+		return out
+	}
+	if got := names(); !reflect.DeepEqual(got, []string{"alpha", "zeta"}) {
+		t.Errorf("New did not sort unsorted input: %v", got)
+	}
+
+	// Mutating the caller's slice afterward must not reorder the Catalog.
+	in[0] = meta.ServiceFromMap(map[string]interface{}{"name": "MUTATED"})
+	if got := names(); !reflect.DeepEqual(got, []string{"alpha", "zeta"}) {
+		t.Errorf("Catalog order changed after caller mutated its input slice: %v", got)
+	}
+}
+
+func TestWalkMethods_AllAndFiltered(t *testing.T) {
+	c := testCatalog()
+
+	all := c.WalkMethods(nil)
+	got := map[string]bool{}
+	for _, r := range all {
+		got[r.SchemaPath()] = true
+	}
+	want := []string{
+		"im.chat.members.create",
+		"im.images.create",
+		"im.reactions.create",
+		"im.reactions.list",
+	}
+	if len(all) != len(want) {
+		t.Fatalf("WalkMethods(nil) = %d refs, want %d (%v)", len(all), len(want), got)
+	}
+	for _, w := range want {
+		if !got[w] {
+			t.Errorf("WalkMethods(nil) missing %q", w)
+		}
+	}
+
+	// Deterministic order: services by name, resources by name, methods by name.
+	var order []string
+	for _, r := range all {
+		order = append(order, r.SchemaPath())
+	}
+	if !reflect.DeepEqual(order, want) {
+		t.Errorf("WalkMethods order = %v, want %v", order, want)
+	}
+
+	// Filter to bot-only ("tenant"): reactions.list (user-only) drops; methods
+	// with no accessTokens are permissive and stay.
+	botOnly := func(m meta.Method) bool {
+		if m.AccessTokens == nil {
+			return true
+		}
+		for _, tok := range m.AccessTokens {
+			if tok == "tenant" {
+				return true
+			}
+		}
+		return false
+	}
+	filtered := c.WalkMethods(botOnly)
+	for _, r := range filtered {
+		if r.SchemaPath() == "im.reactions.list" {
+			t.Error("filtered walk should drop user-only im.reactions.list")
+		}
+	}
+	if len(filtered) != len(all)-1 {
+		t.Errorf("filtered walk = %d, want %d", len(filtered), len(all)-1)
+	}
+}
+
+func TestMethodRef_Paths_DottedResourceStaysOneSegment(t *testing.T) {
+	c := testCatalog()
+	target, err := c.Resolve([]string{"im", "chat.members", "create"})
+	if err != nil {
+		t.Fatalf("resolve: %v", err)
+	}
+	if target.Kind != apicatalog.TargetMethod {
+		t.Fatalf("kind = %v", target.Kind)
+	}
+	m := target.Method
+	if m.SchemaPath() != "im.chat.members.create" {
+		t.Errorf("SchemaPath = %q", m.SchemaPath())
+	}
+	if !reflect.DeepEqual(m.CommandPath(), []string{"im", "chat.members", "create"}) {
+		t.Errorf("CommandPath = %v", m.CommandPath())
+	}
+	if m.ResourceName() != "chat.members" {
+		t.Errorf("ResourceName = %q, want chat.members (one segment)", m.ResourceName())
+	}
+	if m.Method.Name != "create" {
+		t.Errorf("Method.Name not injected: %q", m.Method.Name)
+	}
+}
+
+func TestResolve_DottedAndSplitFormsEquivalent(t *testing.T) {
+	c := testCatalog()
+	// schema.ParsePath splits both "im.chat.members.create" and
+	// "im chat.members create" into segments; findResource's longest-prefix
+	// must resolve the dotted resource either way.
+	a, errA := c.Resolve([]string{"im", "chat", "members", "create"}) // fully split
+	b, errB := c.Resolve([]string{"im", "chat.members", "create"})    // resource as one segment
+	if errA != nil || errB != nil {
+		t.Fatalf("errA=%v errB=%v", errA, errB)
+	}
+	if a.Method.SchemaPath() != b.Method.SchemaPath() || a.Method.SchemaPath() != "im.chat.members.create" {
+		t.Errorf("forms diverged: %q vs %q", a.Method.SchemaPath(), b.Method.SchemaPath())
+	}
+}
+
+func TestResolve_Targets(t *testing.T) {
+	c := testCatalog()
+	if tg, _ := c.Resolve(nil); tg.Kind != apicatalog.TargetAll {
+		t.Errorf("empty -> %v, want all", tg.Kind)
+	}
+	if tg, _ := c.Resolve([]string{"im"}); tg.Kind != apicatalog.TargetService || tg.Service.Name != "im" {
+		t.Errorf("[im] -> %v/%q", tg.Kind, tg.Service.Name)
+	}
+	if tg, _ := c.Resolve([]string{"im", "reactions"}); tg.Kind != apicatalog.TargetResource || tg.Resource.SchemaPath() != "im.reactions" {
+		t.Errorf("[im reactions] -> %v", tg.Kind)
+	}
+}
+
+func TestResolve_Errors(t *testing.T) {
+	c := testCatalog()
+	cases := []struct {
+		parts []string
+		kind  apicatalog.ResolveErrorKind
+	}{
+		{[]string{"nope"}, apicatalog.ErrService},
+		{[]string{"im", "nope"}, apicatalog.ErrResource},
+		{[]string{"im", "reactions", "nope"}, apicatalog.ErrMethod},
+		{[]string{"im", "reactions", "list", "extra"}, apicatalog.ErrPath},
+	}
+	for _, tc := range cases {
+		_, err := c.Resolve(tc.parts)
+		var re *apicatalog.ResolveError
+		if !errors.As(err, &re) {
+			t.Errorf("%v -> err %v, want *ResolveError", tc.parts, err)
+			continue
+		}
+		if re.Kind != tc.kind {
+			t.Errorf("%v -> kind %q, want %q", tc.parts, re.Kind, tc.kind)
+		}
+		if tc.kind != apicatalog.ErrPath && len(re.Candidates) == 0 {
+			t.Errorf("%v -> expected candidates", tc.parts)
+		}
+	}
+}
+
+// nestedCatalog adds a genuinely nested resource (spaces > items) on top of a
+// flat dotted resource (chat.members), so the round-trip contract is exercised
+// for real nesting — not just flat dotted keys.
+func nestedCatalog() apicatalog.Catalog {
+	im := meta.ServiceFromMap(map[string]interface{}{
+		"name": "im",
+		"resources": map[string]interface{}{
+			"chat.members": map[string]interface{}{
+				"methods": map[string]interface{}{"create": map[string]interface{}{}},
+			},
+			"spaces": map[string]interface{}{
+				"methods": map[string]interface{}{"create": map[string]interface{}{}},
+				"resources": map[string]interface{}{
+					"items": map[string]interface{}{
+						"methods": map[string]interface{}{"get": map[string]interface{}{}},
+					},
+				},
+			},
+		},
+	})
+	return apicatalog.New(apicatalog.SourceEmbedded, []meta.Service{im})
+}
+
+// TestResolve_WalkMethodsRoundTrip is the core catalog contract: every method
+// WalkMethods emits must Resolve back to the same method — both from its dotted
+// SchemaPath (fully split) and from its CommandPath (resource as one segment).
+// This pins findResource's nested-resource descent symmetric to walkResources,
+// so "traversable" implies "resolvable".
+func TestResolve_WalkMethodsRoundTrip(t *testing.T) {
+	for _, c := range []apicatalog.Catalog{testCatalog(), nestedCatalog()} {
+		for _, ref := range c.WalkMethods(nil) {
+			want := ref.SchemaPath()
+			for _, parts := range [][]string{
+				strings.Split(want, "."), // fully-split dotted form
+				ref.CommandPath(),        // command form (resource stays one segment)
+			} {
+				tg, err := c.Resolve(parts)
+				if err != nil {
+					t.Errorf("round-trip %v: %v", parts, err)
+					continue
+				}
+				if tg.Kind != apicatalog.TargetMethod {
+					t.Errorf("round-trip %v: kind=%v, want method", parts, tg.Kind)
+					continue
+				}
+				if tg.Method.SchemaPath() != want {
+					t.Errorf("round-trip %v: resolved to %q, want %q", parts, tg.Method.SchemaPath(), want)
+				}
+			}
+		}
+	}
+}
+
+// TestComplete_Nested pins completion closure for genuinely nested resources:
+// both the dotted and space forms must reach a nested method, symmetric to
+// Resolve (findResource descends, so completion must too).
+func TestComplete_Nested(t *testing.T) {
+	c := nestedCatalog()
+
+	// dotted: under a resource, offer its methods AND its sub-resources
+	if comps, ns := c.Complete(nil, "im.spaces.", nil); !reflect.DeepEqual(comps, []string{"im.spaces.create", "im.spaces.items."}) || ns {
+		t.Errorf("Complete([], im.spaces.) = %v noSpace=%v, want [im.spaces.create im.spaces.items.] false", comps, ns)
+	}
+	// dotted: drill into the nested sub-resource's method
+	if comps, ns := c.Complete(nil, "im.spaces.items.", nil); !reflect.DeepEqual(comps, []string{"im.spaces.items.get"}) || ns {
+		t.Errorf("Complete([], im.spaces.items.) = %v noSpace=%v, want [im.spaces.items.get] false", comps, ns)
+	}
+	// dotted: partial sub-resource name -> the sub-resource (NoSpace, more to type)
+	if comps, ns := c.Complete(nil, "im.spaces.it", nil); !reflect.DeepEqual(comps, []string{"im.spaces.items."}) || !ns {
+		t.Errorf("Complete([], im.spaces.it) = %v noSpace=%v, want [im.spaces.items.] true", comps, ns)
+	}
+	// space form: under a resource, offer methods AND sub-resources
+	if comps, _ := c.Complete([]string{"im", "spaces"}, "", nil); !reflect.DeepEqual(comps, []string{"create", "items"}) {
+		t.Errorf("Complete([im spaces], '') = %v, want [create items]", comps)
+	}
+	// space form: drill into the nested sub-resource's methods
+	if comps, _ := c.Complete([]string{"im", "spaces", "items"}, "", nil); !reflect.DeepEqual(comps, []string{"get"}) {
+		t.Errorf("Complete([im spaces items], '') = %v, want [get]", comps)
+	}
+}
+
+func TestComplete(t *testing.T) {
+	c := testCatalog()
+
+	// dotted: service prefix -> "im." (NoSpace)
+	if comps, ns := c.Complete(nil, "i", nil); !reflect.DeepEqual(comps, []string{"im."}) || !ns {
+		t.Errorf("Complete([], i) = %v noSpace=%v", comps, ns)
+	}
+	// dotted: resource prefix -> "im.reactions." (NoSpace)
+	if comps, _ := c.Complete(nil, "im.rea", nil); !reflect.DeepEqual(comps, []string{"im.reactions."}) {
+		t.Errorf("Complete([], im.rea) = %v", comps)
+	}
+	// space form: resource candidates under im (deterministic order)
+	comps, ns := c.Complete([]string{"im"}, "", nil)
+	if !reflect.DeepEqual(comps, []string{"chat.members", "images", "reactions"}) || ns {
+		t.Errorf("Complete([im], '') = %v noSpace=%v", comps, ns)
+	}
+	// space form: method candidates under reactions
+	if comps, _ := c.Complete([]string{"im", "reactions"}, "", nil); !reflect.DeepEqual(comps, []string{"create", "list"}) {
+		t.Errorf("Complete([im reactions], '') = %v", comps)
+	}
+	// filter applied: bot-only hides user-only list
+	botOnly := func(m meta.Method) bool {
+		if m.AccessTokens == nil {
+			return true
+		}
+		for _, tok := range m.AccessTokens {
+			if tok == "tenant" {
+				return true
+			}
+		}
+		return false
+	}
+	if comps, _ := c.Complete([]string{"im", "reactions"}, "", botOnly); !reflect.DeepEqual(comps, []string{"create"}) {
+		t.Errorf("Complete with bot filter = %v, want [create]", comps)
+	}
+}

internal/apicatalog/methodref.go

@@ -0,0 +1,75 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package apicatalog
+
+import (
+	"strings"
+
+	"github.com/larksuite/cli/internal/meta"
+)
+
+// TargetKind classifies what a schema/command path resolves to.
+type TargetKind string
+
+const (
+	TargetAll      TargetKind = "all"      // empty path: every method
+	TargetService  TargetKind = "service"  // <service>
+	TargetResource TargetKind = "resource" // <service> <resource...>
+	TargetMethod   TargetKind = "method"   // <service> <resource...> <method>
+)
+
+// Target is the result of Catalog.Resolve. Resource and Method are populated
+// only for TargetResource and TargetMethod respectively.
+type Target struct {
+	Kind     TargetKind
+	Service  meta.Service
+	Resource *ResourceRef
+	Method   *MethodRef
+}
+
+// ResourceRef identifies one resource within a service. Path holds the resource
+// path segments (one element for the common flat dotted resource like
+// "chat.members"; multiple for genuinely nested resources).
+type ResourceRef struct {
+	Service  meta.Service
+	Resource meta.Resource
+	Path     []string
+}
+
+// MethodRef identifies one method, carrying the full navigation context so the
+// command path and schema path can be derived without re-walking the catalog.
+type MethodRef struct {
+	Service      meta.Service
+	Resource     meta.Resource
+	ResourcePath []string
+	Method       meta.Method
+}
+
+// SchemaPath is the dotted "service.resource" identifier.
+func (r ResourceRef) SchemaPath() string {
+	return r.Service.Name + "." + strings.Join(r.Path, ".")
+}
+
+// ServiceName returns the owning service name.
+func (r MethodRef) ServiceName() string { return r.Service.Name }
+
+// ResourceName is the dotted resource path, e.g. "chat.members".
+func (r MethodRef) ResourceName() string { return strings.Join(r.ResourcePath, ".") }
+
+// MethodName returns the method's own name.
+func (r MethodRef) MethodName() string { return r.Method.Name }
+
+// SchemaPath is the dotted "service.resource.method" identifier, e.g.
+// "im.chat.members.create".
+func (r MethodRef) SchemaPath() string {
+	return r.Service.Name + "." + strings.Join(r.ResourcePath, ".") + "." + r.Method.Name
+}
+
+// CommandPath is the CLI argv segments, e.g. ["im", "chat.members", "create"].
+func (r MethodRef) CommandPath() []string {
+	out := make([]string, 0, len(r.ResourcePath)+2)
+	out = append(out, r.Service.Name)
+	out = append(out, r.ResourcePath...)
+	return append(out, r.Method.Name)
+}

internal/apicatalog/path.go

@@ -0,0 +1,31 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package apicatalog
+
+import "strings"
+
+// ParsePath normalizes positional command arguments into the path segments
+// Resolve consumes. It accepts two equivalent forms:
+//
+//	im.messages.reply  -> single arg, split on "."
+//	im messages reply  -> multiple args, used as-is
+//
+// "im chat.members bots" as a single quoted arg is NOT supported; quote
+// arguments individually if your shell needs it. A resource keeps its internal
+// dots when passed as one segment (e.g. "chat.members"); findResource's
+// longest-prefix descent resolves both the split and the one-segment forms to
+// the same target. Returns nil for zero args (bare invocation -> TargetAll).
+func ParsePath(args []string) []string {
+	switch len(args) {
+	case 0:
+		return nil
+	case 1:
+		if strings.Contains(args[0], ".") {
+			return strings.Split(args[0], ".")
+		}
+		return []string{args[0]}
+	default:
+		return args
+	}
+}

internal/apicatalog/path_test.go

@@ -1,11 +1,13 @@
 // Copyright (c) 2026 Lark Technologies Pte. Ltd.
 // SPDX-License-Identifier: MIT
 
-package schema
+package apicatalog_test
 
 import (
 	"reflect"
 	"testing"
+
+	"github.com/larksuite/cli/internal/apicatalog"
 )
 
 func TestParsePath(t *testing.T) {
@@ -25,7 +27,7 @@ func TestParsePath(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			got := ParsePath(tt.args)
+			got := apicatalog.ParsePath(tt.args)
 			if !reflect.DeepEqual(got, tt.want) {
 				t.Errorf("ParsePath(%v) = %v, want %v", tt.args, got, tt.want)
 			}

internal/apicatalog/resolveerror.go

@@ -0,0 +1,30 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package apicatalog
+
+// ResolveErrorKind classifies a Resolve failure so the command layer can render
+// the right hint without re-deriving what was being looked up.
+type ResolveErrorKind string
+
+const (
+	ErrService  ResolveErrorKind = "service"
+	ErrResource ResolveErrorKind = "resource"
+	ErrMethod   ResolveErrorKind = "method"
+	ErrPath     ResolveErrorKind = "path" // method exists but trailing segments don't resolve
+)
+
+// ResolveError is returned by Catalog.Resolve. Subject is the dotted thing that
+// failed to resolve; Candidates lists the available names at that level (nil for
+// ErrPath, which instead carries the matched Method and the unresolved Trailing).
+type ResolveError struct {
+	Kind       ResolveErrorKind
+	Subject    string
+	Candidates []string
+	Method     string
+	Trailing   string
+}
+
+func (e *ResolveError) Error() string {
+	return "unknown " + string(e.Kind) + ": " + e.Subject
+}

internal/auth/device_flow.go

@@ -47,6 +47,7 @@ type DeviceFlowResult struct {
 // OAuthEndpoints contains the OAuth endpoint URLs.
 type OAuthEndpoints struct {
 	DeviceAuthorization string
+	Revoke              string
 	Token               string
 }
 
@@ -55,6 +56,7 @@ func ResolveOAuthEndpoints(brand core.LarkBrand) OAuthEndpoints {
 	ep := core.ResolveEndpoints(brand)
 	return OAuthEndpoints{
 		DeviceAuthorization: ep.Accounts + PathDeviceAuthorization,
+		Revoke:              ep.Accounts + PathOAuthRevoke,
 		Token:               ep.Open + PathOAuthTokenV2,
 	}
 }

internal/auth/device_flow_test.go

@@ -31,6 +31,9 @@ func TestResolveOAuthEndpoints_Feishu(t *testing.T) {
 	if ep.DeviceAuthorization != "https://accounts.feishu.cn/oauth/v1/device_authorization" {
 		t.Errorf("DeviceAuthorization = %q", ep.DeviceAuthorization)
 	}
+	if ep.Revoke != "https://accounts.feishu.cn/oauth/v1/revoke" {
+		t.Errorf("Revoke = %q", ep.Revoke)
+	}
 	if ep.Token != "https://open.feishu.cn/open-apis/authen/v2/oauth/token" {
 		t.Errorf("Token = %q", ep.Token)
 	}
@@ -42,6 +45,9 @@ func TestResolveOAuthEndpoints_Lark(t *testing.T) {
 	if ep.DeviceAuthorization != "https://accounts.larksuite.com/oauth/v1/device_authorization" {
 		t.Errorf("DeviceAuthorization = %q", ep.DeviceAuthorization)
 	}
+	if ep.Revoke != "https://accounts.larksuite.com/oauth/v1/revoke" {
+		t.Errorf("Revoke = %q", ep.Revoke)
+	}
 	if ep.Token != "https://open.larksuite.com/open-apis/authen/v2/oauth/token" {
 		t.Errorf("Token = %q", ep.Token)
 	}

internal/auth/paths.go

@@ -7,6 +7,8 @@ package auth
 const (
 	// PathDeviceAuthorization is the endpoint for device authorization.
 	PathDeviceAuthorization = "/oauth/v1/device_authorization"
+	// PathOAuthRevoke is the endpoint for revoking an OAuth token.
+	PathOAuthRevoke = "/oauth/v1/revoke"
 	// PathAppRegistration is the endpoint for application registration.
 	PathAppRegistration = "/oauth/v1/app/registration"
 	// PathOAuthTokenV2 is the endpoint for requesting an OAuth token (v2).

internal/auth/revoke.go

@@ -0,0 +1,131 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/core"
+)
+
+// RevokeToken revokes a previously issued OAuth token.
+func RevokeToken(httpClient *http.Client, appId, appSecret string, brand core.LarkBrand, token, tokenTypeHint string) error {
+	endpoints := ResolveOAuthEndpoints(brand)
+
+	form := url.Values{}
+	form.Set("client_id", appId)
+	form.Set("client_secret", appSecret)
+	form.Set("token", token)
+	if tokenTypeHint != "" {
+		form.Set("token_type_hint", tokenTypeHint)
+	}
+
+	req, err := http.NewRequest(http.MethodPost, endpoints.Revoke, strings.NewReader(form.Encode()))
+	if err != nil {
+		return errs.NewInternalError(errs.SubtypeUnknown, "token revoke request creation failed: %v", err).WithCause(err)
+	}
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+
+	resp, err := httpClient.Do(req)
+	if err != nil {
+		return errs.NewNetworkError(errs.SubtypeNetworkTransport, "token revoke transport error: %v", err).WithCause(err)
+	}
+	defer resp.Body.Close()
+	logHTTPResponse(resp)
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return errs.NewInternalError(errs.SubtypeInvalidResponse, "token revoke read error: %v", err).WithCause(err)
+	}
+
+	if resp.StatusCode >= 400 {
+		return revokeHTTPStatusError(resp.StatusCode, body)
+	}
+
+	if len(body) == 0 {
+		return nil
+	}
+
+	var data map[string]interface{}
+	if err := json.Unmarshal(body, &data); err != nil {
+		return nil
+	}
+
+	if code := getInt(data, "code", 0); code != 0 {
+		msg := getStr(data, "msg")
+		if msg == "" {
+			msg = getStr(data, "message")
+		}
+		if msg == "" {
+			msg = "unknown error"
+		}
+		return errs.NewAPIError(errs.SubtypeUnknown, "token revoke failed [%d]: %s", code, msg).
+			WithCode(code).
+			WithCause(errors.New(msg))
+	}
+
+	if errStr := getStr(data, "error"); errStr != "" {
+		msg := getStr(data, "error_description")
+		if msg == "" {
+			msg = errStr
+		}
+		return errs.NewAPIError(errs.SubtypeUnknown, "token revoke failed: %s", msg).
+			WithCause(errors.New(msg))
+	}
+
+	return nil
+}
+
+func revokeHTTPStatusError(status int, body []byte) error {
+	msg := formatOAuthErrorBody(body)
+	cause := errors.New(strings.TrimSpace(string(body)))
+	if strings.TrimSpace(string(body)) == "" {
+		cause = errors.New(msg)
+	}
+	if status >= http.StatusInternalServerError {
+		return errs.NewNetworkError(errs.SubtypeNetworkServer, "token revoke failed: HTTP %d: %s", status, msg).
+			WithCode(status).
+			WithRetryable().
+			WithCause(cause)
+	}
+	subtype := errs.SubtypeUnknown
+	if status == http.StatusNotFound {
+		subtype = errs.SubtypeNotFound
+	}
+	return errs.NewAPIError(subtype, "token revoke failed: HTTP %d: %s", status, msg).
+		WithCode(status).
+		WithCause(cause)
+}
+
+func formatOAuthErrorBody(body []byte) string {
+	trimmed := strings.TrimSpace(string(body))
+	if trimmed == "" {
+		return "empty response"
+	}
+
+	var data map[string]interface{}
+	if err := json.Unmarshal(body, &data); err != nil {
+		return trimmed
+	}
+
+	if msg := getStr(data, "error_description"); msg != "" {
+		return msg
+	}
+	if msg := getStr(data, "msg"); msg != "" {
+		return msg
+	}
+	if msg := getStr(data, "message"); msg != "" {
+		return msg
+	}
+	if msg := getStr(data, "error"); msg != "" {
+		return msg
+	}
+	return trimmed
+}

internal/auth/revoke_test.go

@@ -0,0 +1,207 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package auth
+
+import (
+	"errors"
+	"net/http"
+	"net/url"
+	"strings"
+	"testing"
+
+	"github.com/larksuite/cli/errs"
+	"github.com/larksuite/cli/internal/core"
+	"github.com/larksuite/cli/internal/httpmock"
+)
+
+type revokeRoundTripFunc func(*http.Request) (*http.Response, error)
+
+func (fn revokeRoundTripFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return fn(req)
+}
+
+type errReadCloser struct {
+	err error
+}
+
+func (r errReadCloser) Read(_ []byte) (int, error) {
+	return 0, r.err
+}
+
+func (r errReadCloser) Close() error {
+	return nil
+}
+
+func TestRevokeToken_PostsExpectedForm(t *testing.T) {
+	reg := &httpmock.Registry{}
+	t.Cleanup(func() { reg.Verify(t) })
+
+	stub := &httpmock.Stub{
+		Method: "POST",
+		URL:    PathOAuthRevoke,
+		Body:   map[string]interface{}{"code": 0},
+		BodyFilter: func(body []byte) bool {
+			values, err := url.ParseQuery(string(body))
+			if err != nil {
+				return false
+			}
+			return values.Get("client_id") == "cli_a" &&
+				values.Get("client_secret") == "secret_b" &&
+				values.Get("token") == "user-access-token" &&
+				values.Get("token_type_hint") == "access_token"
+		},
+	}
+	reg.Register(stub)
+
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	if err != nil {
+		t.Fatalf("RevokeToken() error = %v", err)
+	}
+	if got := stub.CapturedHeaders.Get("Content-Type"); got != "application/x-www-form-urlencoded" {
+		t.Fatalf("Content-Type = %q", got)
+	}
+}
+
+func TestRevokeToken_DoFailureReturnsTypedNetworkError(t *testing.T) {
+	sentinel := errors.New("transport down")
+	httpClient := &http.Client{
+		Transport: revokeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return nil, sentinel
+		}),
+	}
+
+	err := RevokeToken(httpClient, "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed error, got %T", err)
+	}
+	if p.Category != errs.CategoryNetwork || p.Subtype != errs.SubtypeNetworkTransport {
+		t.Fatalf("problem = %#v, want network/transport", p)
+	}
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("expected cause %v to be preserved, got %v", sentinel, err)
+	}
+}
+
+func TestRevokeToken_ReportsHTTPError(t *testing.T) {
+	reg := &httpmock.Registry{}
+	t.Cleanup(func() { reg.Verify(t) })
+
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    PathOAuthRevoke,
+		Status: 400,
+		Body:   map[string]interface{}{"error": "invalid_token"},
+	})
+
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed error, got %T", err)
+	}
+	if p.Category != errs.CategoryAPI || p.Code != 400 {
+		t.Fatalf("problem = %#v, want api error with HTTP 400", p)
+	}
+	if !strings.Contains(err.Error(), "invalid_token") {
+		t.Fatalf("expected invalid_token error, got %v", err)
+	}
+}
+
+func TestRevokeToken_ReportsOAuthCodeErrorAsTypedAPIError(t *testing.T) {
+	reg := &httpmock.Registry{}
+	t.Cleanup(func() { reg.Verify(t) })
+
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    PathOAuthRevoke,
+		Body: map[string]interface{}{
+			"code": 12345,
+			"msg":  "invalid revoke state",
+		},
+	})
+
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed error, got %T", err)
+	}
+	if p.Category != errs.CategoryAPI || p.Code != 12345 {
+		t.Fatalf("problem = %#v, want api error with code 12345", p)
+	}
+	if !strings.Contains(err.Error(), "invalid revoke state") {
+		t.Fatalf("expected oauth error message, got %v", err)
+	}
+}
+
+func TestRevokeToken_ReportsOAuthErrorFieldAsTypedAPIError(t *testing.T) {
+	reg := &httpmock.Registry{}
+	t.Cleanup(func() { reg.Verify(t) })
+
+	reg.Register(&httpmock.Stub{
+		Method: "POST",
+		URL:    PathOAuthRevoke,
+		Body: map[string]interface{}{
+			"error":             "invalid_token",
+			"error_description": "token already expired",
+		},
+	})
+
+	err := RevokeToken(httpmock.NewClient(reg), "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed error, got %T", err)
+	}
+	if p.Category != errs.CategoryAPI {
+		t.Fatalf("problem = %#v, want api error", p)
+	}
+	if !strings.Contains(err.Error(), "token already expired") {
+		t.Fatalf("expected oauth error_description, got %v", err)
+	}
+}
+
+func TestRevokeToken_ReadFailureReturnsTypedInternalError(t *testing.T) {
+	sentinel := errors.New("read failed")
+	httpClient := &http.Client{
+		Transport: revokeRoundTripFunc(func(req *http.Request) (*http.Response, error) {
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Body:       errReadCloser{err: sentinel},
+				Header:     make(http.Header),
+			}, nil
+		}),
+	}
+
+	err := RevokeToken(httpClient, "cli_a", "secret_b", core.BrandFeishu, "user-access-token", "access_token")
+	if err == nil {
+		t.Fatal("expected error")
+	}
+	p, ok := errs.ProblemOf(err)
+	if !ok {
+		t.Fatalf("expected typed error, got %T", err)
+	}
+	if p.Category != errs.CategoryInternal || p.Subtype != errs.SubtypeInvalidResponse {
+		t.Fatalf("problem = %#v, want internal/invalid_response", p)
+	}
+	if !errors.Is(err, sentinel) {
+		t.Fatalf("expected cause %v to be preserved, got %v", sentinel, err)
+	}
+	if !strings.Contains(err.Error(), "token revoke read error") {
+		t.Fatalf("expected read error message, got %v", err)
+	}
+	if _, ok := err.(*errs.InternalError); !ok {
+		t.Fatalf("expected *errs.InternalError, got %T", err)
+	}
+}

internal/cmdutil/factory.go

@@ -6,6 +6,7 @@ package cmdutil
 import (
 	"context"
 	"io"
+	"io/fs"
 	"net/http"
 	"strings"
 
@@ -43,6 +44,8 @@ type Factory struct {
 	Credential *credential.CredentialProvider
 
 	FileIOProvider fileio.Provider // file transfer provider (default: local filesystem)
+
+	SkillContent fs.FS // embedded skill tree (rooted at the skill list); nil when the build embeds no skills
 }
 
 // ResolveFileIO resolves a FileIO instance using the current execution context.

internal/cmdutil/factory_default.go

@@ -100,9 +100,19 @@ func safeRedirectPolicy(req *http.Request, via []*http.Request) error {
 	return nil
 }
 
+// warnIfProxied is a test seam for the proxy-warning gate. Production wires it
+// to transport.WarnIfProxied; tests swap in a spy to count invocations. It is
+// needed because the real function is guarded by an internal sync.Once, so
+// calling it directly would only fire on the first test (see
+// factory_proxy_warn_test.go). The terminal check is the IOStreams
+// .StderrIsTerminal field, which tests set directly.
+var warnIfProxied = transport.WarnIfProxied
+
 func cachedHttpClientFunc(f *Factory) func() (*http.Client, error) {
 	return sync.OnceValues(func() (*http.Client, error) {
-		transport.WarnIfProxied(f.IOStreams.ErrOut)
+		if f.IOStreams.StderrIsTerminal {
+			warnIfProxied(f.IOStreams.ErrOut)
+		}
 
 		var rt http.RoundTripper = transport.Shared()
 		rt = &RetryTransport{Base: rt}
@@ -129,7 +139,9 @@ func cachedLarkClientFunc(f *Factory) func() (*lark.Client, error) {
 			lark.WithLogLevel(larkcore.LogLevelError),
 			lark.WithHeaders(BaseSecurityHeaders()),
 		}
-		transport.WarnIfProxied(f.IOStreams.ErrOut)
+		if f.IOStreams.StderrIsTerminal {
+			warnIfProxied(f.IOStreams.ErrOut)
+		}
 		opts = append(opts, lark.WithHttpClient(&http.Client{
 			Transport:     buildSDKTransport(),
 			CheckRedirect: safeRedirectPolicy,

internal/cmdutil/factory_proxy_warn_test.go

@@ -0,0 +1,85 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package cmdutil
+
+import (
+	"io"
+	"testing"
+
+	_ "github.com/larksuite/cli/extension/credential/env" // registers the env-backed account provider
+	"github.com/larksuite/cli/internal/envvars"
+)
+
+// installProxyWarnSpy replaces warnIfProxied with a counter for one test and
+// restores it on cleanup. Returns a pointer to the call count so the caller can
+// assert how many times the warning fired. The terminal state is controlled via
+// the IOStreams.StderrIsTerminal field, not a seam.
+func installProxyWarnSpy(t *testing.T) *int {
+	t.Helper()
+	prevWarn := warnIfProxied
+	t.Cleanup(func() { warnIfProxied = prevWarn })
+	calls := 0
+	warnIfProxied = func(io.Writer) { calls++ }
+	return &calls
+}
+
+var proxyWarnGateCases = []struct {
+	name     string
+	terminal bool
+	want     int
+}{
+	{"terminal stderr warns once", true, 1},
+	{"non-terminal stderr stays silent", false, 0},
+}
+
+// TestCachedHttpClientFunc_ProxyWarnGate verifies the http-client init path
+// invokes WarnIfProxied only when stderr is an interactive terminal.
+func TestCachedHttpClientFunc_ProxyWarnGate(t *testing.T) {
+	for _, tc := range proxyWarnGateCases {
+		t.Run(tc.name, func(t *testing.T) {
+			calls := installProxyWarnSpy(t)
+
+			fn := cachedHttpClientFunc(&Factory{IOStreams: &IOStreams{
+				ErrOut: io.Discard, StderrIsTerminal: tc.terminal,
+			}})
+			if _, err := fn(); err != nil {
+				t.Fatalf("http client init: %v", err)
+			}
+
+			if *calls != tc.want {
+				t.Errorf("WarnIfProxied calls = %d, want %d", *calls, tc.want)
+			}
+		})
+	}
+}
+
+// TestCachedLarkClientFunc_ProxyWarnGate verifies the lark-client init path
+// invokes WarnIfProxied only when stderr is an interactive terminal. The gate
+// runs after ResolveAccount, so an env-backed credential is wired up to let
+// account resolution succeed without network or config files.
+func TestCachedLarkClientFunc_ProxyWarnGate(t *testing.T) {
+	for _, tc := range proxyWarnGateCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Setenv(envvars.CliAppID, "env-app")
+			t.Setenv(envvars.CliAppSecret, "env-secret")
+			t.Setenv(envvars.CliDefaultAs, "")
+			t.Setenv(envvars.CliUserAccessToken, "")
+			t.Setenv(envvars.CliTenantAccessToken, "")
+			t.Setenv("LARKSUITE_CLI_CONFIG_DIR", t.TempDir())
+
+			calls := installProxyWarnSpy(t)
+
+			// normalizeStreams copies the struct (out := *s), so the
+			// StderrIsTerminal field survives into f.IOStreams.
+			f := NewDefault(&IOStreams{ErrOut: io.Discard, StderrIsTerminal: tc.terminal}, InvocationContext{})
+			if _, err := cachedLarkClientFunc(f)(); err != nil {
+				t.Fatalf("lark client init: %v", err)
+			}
+
+			if *calls != tc.want {
+				t.Errorf("WarnIfProxied calls = %d, want %d", *calls, tc.want)
+			}
+		})
+	}
+}

internal/cmdutil/fileupload.go

@@ -12,23 +12,9 @@ import (
 
 	"github.com/larksuite/cli/extension/fileio"
 	"github.com/larksuite/cli/internal/output"
-	"github.com/larksuite/cli/internal/registry"
 	larkcore "github.com/larksuite/oapi-sdk-go/v3/core"
 )
 
-// DetectFileFields returns field names with type "file" in the method's requestBody.
-func DetectFileFields(method map[string]interface{}) []string {
-	rb, _ := method["requestBody"].(map[string]interface{})
-	var fields []string
-	for name, field := range rb {
-		f, _ := field.(map[string]interface{})
-		if registry.GetStrFromMap(f, "type") == "file" {
-			fields = append(fields, name)
-		}
-	}
-	return fields
-}
-
 // ParseFileFlag parses a --file flag value into its components.
 // The format is either "path" or "field=path". When no explicit "field="
 // prefix is present, defaultField is used as the field name.

internal/cmdutil/identity.go

@@ -10,22 +10,6 @@ import (
 	"github.com/larksuite/cli/internal/core"
 )
 
-// AccessTokensToIdentities converts from_meta accessTokens (e.g. ["tenant", "user"])
-// to CLI identity names (e.g. ["bot", "user"]).
-func AccessTokensToIdentities(tokens []interface{}) []string {
-	var identities []string
-	for _, t := range tokens {
-		if ts, ok := t.(string); ok {
-			if ts == "tenant" {
-				identities = append(identities, "bot")
-			} else {
-				identities = append(identities, ts)
-			}
-		}
-	}
-	return identities
-}
-
 // PrintIdentity outputs the current identity to stderr so callers (including AI agents)
 // can see which identity is being used for the API call.
 func PrintIdentity(w io.Writer, as core.Identity, config *core.CliConfig, autoDetected bool) {

internal/cmdutil/identity_test.go

@@ -11,54 +11,6 @@ import (
 	"github.com/larksuite/cli/internal/core"
 )
 
-func TestAccessTokensToIdentities(t *testing.T) {
-	tests := []struct {
-		name   string
-		tokens []interface{}
-		want   []string
-	}{
-		{
-			name:   "tenant becomes bot",
-			tokens: []interface{}{"tenant"},
-			want:   []string{"bot"},
-		},
-		{
-			name:   "user stays user",
-			tokens: []interface{}{"user"},
-			want:   []string{"user"},
-		},
-		{
-			name:   "tenant and user",
-			tokens: []interface{}{"tenant", "user"},
-			want:   []string{"bot", "user"},
-		},
-		{
-			name:   "empty list",
-			tokens: []interface{}{},
-			want:   nil,
-		},
-		{
-			name:   "non-string values skipped",
-			tokens: []interface{}{"tenant", 42, "user"},
-			want:   []string{"bot", "user"},
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			got := AccessTokensToIdentities(tt.tokens)
-			if len(got) != len(tt.want) {
-				t.Fatalf("len: want %d, got %d (%v)", len(tt.want), len(got), got)
-			}
-			for i := range got {
-				if got[i] != tt.want[i] {
-					t.Errorf("[%d] want %s, got %s", i, tt.want[i], got[i])
-				}
-			}
-		})
-	}
-}
-
 func TestPrintIdentity_BotExplicit(t *testing.T) {
 	var buf bytes.Buffer
 	PrintIdentity(&buf, core.AsBot, nil, false)

internal/cmdutil/iostreams.go

@@ -18,17 +18,28 @@ type IOStreams struct {
 	Out        io.Writer
 	ErrOut     io.Writer
 	IsTerminal bool
+	// StderrIsTerminal reports whether ErrOut is an interactive terminal.
+	// Advisory warnings written to stderr (e.g. the proxy notice) gate on this
+	// so they stay out of non-interactive output (pipes, CI, agent runs).
+	// Computed once in NewIOStreams, mirroring IsTerminal; tests assign it
+	// directly like cmd/config/bind_test.go does for IsTerminal.
+	StderrIsTerminal bool
 }
 
 // NewIOStreams builds an IOStreams from arbitrary readers/writers.
-// IsTerminal is derived from in's underlying *os.File, if any; non-file
-// readers (bytes.Buffer, strings.Reader, …) yield IsTerminal=false.
+// IsTerminal / StderrIsTerminal are derived from in's / errOut's underlying
+// *os.File, if any; non-file streams (bytes.Buffer, strings.Reader, …) yield
+// false.
 func NewIOStreams(in io.Reader, out, errOut io.Writer) *IOStreams {
 	isTerminal := false
 	if f, ok := in.(*os.File); ok {
 		isTerminal = term.IsTerminal(int(f.Fd()))
 	}
-	return &IOStreams{In: in, Out: out, ErrOut: errOut, IsTerminal: isTerminal}
+	stderrIsTerminal := false
+	if f, ok := errOut.(*os.File); ok {
+		stderrIsTerminal = term.IsTerminal(int(f.Fd()))
+	}
+	return &IOStreams{In: in, Out: out, ErrOut: errOut, IsTerminal: isTerminal, StderrIsTerminal: stderrIsTerminal}
 }
 
 // SystemIO creates an IOStreams wired to the process's standard file descriptors.

internal/cmdutil/json.go

@@ -34,7 +34,9 @@ func ParseOptionalBody(httpMethod, data string, stdin io.Reader, fileIO fileio.F
 	return body, nil
 }
 
-// ParseJSONMap parses a JSON string into a map. Returns an empty map if input is empty.
+// ParseJSONMap parses a JSON string into a map. Returns an empty (never nil) map
+// for empty input or the JSON literal null, so callers can always overlay onto
+// the result without a nil-map panic.
 // Supports stdin (-), @file, @@-escape, and single-quote stripping via ResolveInput.
 func ParseJSONMap(input, label string, stdin io.Reader, fileIO fileio.FileIO) (map[string]any, error) {
 	resolved, err := ResolveInput(input, stdin, fileIO)
@@ -48,5 +50,10 @@ func ParseJSONMap(input, label string, stdin io.Reader, fileIO fileio.FileIO) (m
 	if err := json.Unmarshal([]byte(resolved), &result); err != nil {
 		return nil, output.ErrValidation("%s invalid format, expected JSON object", label)
 	}
+	if result == nil {
+		// `null` unmarshals into a nil map without error; normalize it so the
+		// returned map is always writable, matching the empty-input case.
+		return map[string]any{}, nil
+	}
 	return result, nil
 }

internal/cmdutil/json_test.go

@@ -47,6 +47,7 @@ func TestParseJSONMap(t *testing.T) {
 		wantErr bool
 	}{
 		{"empty input", "", "--params", 0, false},
+		{"json null", "null", "--params", 0, false},
 		{"valid json", `{"a":"1","b":"2"}`, "--params", 2, false},
 		{"invalid json", `{bad}`, "--params", 0, true},
 		{"json array", `[1,2]`, "--data", 0, true},
@@ -61,6 +62,12 @@ func TestParseJSONMap(t *testing.T) {
 			if !tt.wantErr && len(got) != tt.wantLen {
 				t.Errorf("ParseJSONMap() returned map with %d keys, want %d", len(got), tt.wantLen)
 			}
+			// A successful parse must yield a non-nil, writable map: callers
+			// overlay onto it (params[k]=v), so `null` — which unmarshals to a
+			// nil map without error — must normalize to {} like empty input.
+			if !tt.wantErr && got == nil {
+				t.Error("ParseJSONMap() = nil map on success, want non-nil")
+			}
 		})
 	}
 }

internal/cmdutil/risk.go

@@ -3,17 +3,20 @@
 
 package cmdutil
 
-import "github.com/spf13/cobra"
+import (
+	"github.com/larksuite/cli/internal/core"
+	"github.com/spf13/cobra"
+)
 
 const riskLevelAnnotationKey = "risk_level"
 
-// Risk level constants — the three-tier convention used across the CLI.
-// Use these in place of string literals so the typo radius is one place,
-// not every call site.
+// Risk level constants — aliases of the canonical core.Risk* values, re-exported
+// here so command code gets the risk vocabulary and the SetRisk/GetRisk helpers
+// from one package. core is the single source of truth.
 const (
-	RiskRead          = "read"
-	RiskWrite         = "write"
-	RiskHighRiskWrite = "high-risk-write"
+	RiskRead          = core.RiskRead
+	RiskWrite         = core.RiskWrite
+	RiskHighRiskWrite = core.RiskHighRiskWrite
 )
 
 // SetRisk stores a command's static risk level on cobra annotations so the

internal/core/risk.go

@@ -0,0 +1,15 @@
+// Copyright (c) 2026 Lark Technologies Pte. Ltd.
+// SPDX-License-Identifier: MIT
+
+package core
+
+// Risk levels — the three-tier convention used across the CLI. They live here,
+// at the leaf, so the envelope renderer (internal/schema) and the command
+// toolkit (internal/cmdutil) share one vocabulary without a renderer depending
+// on command utilities. Framework confirmation gating acts only on
+// RiskHighRiskWrite.
+const (
+	RiskRead          = "read"
+	RiskWrite         = "write"
+	RiskHighRiskWrite = "high-risk-write"
+)

internal/core/types.go

@@ -22,6 +22,12 @@ func ParseBrand(value string) LarkBrand {
 	return BrandFeishu
 }
 
+// OAuthTokenV3Path is the unified OAuth 2.0 Token Endpoint path on the accounts
+// domain. It serves every grant type (client_credentials for TAT,
+// authorization_code / device_code / refresh_token for UAT) and replaces the
+// legacy per-token endpoints (e.g. /open-apis/auth/v3/tenant_access_token/internal).
+const OAuthTokenV3Path = "/oauth/v3/token"
+
 // Endpoints holds resolved endpoint URLs for different Lark services.
 type Endpoints struct {
 	Open     string // e.g. "https://open.feishu.cn"

internal/core/types_test.go

@@ -42,6 +42,11 @@ func TestResolveEndpoints_EmptyDefaultsToFeishu(t *testing.T) {
 	if ep.Open != "https://open.feishu.cn" {
 		t.Errorf("Open = %q, want feishu.cn for empty brand", ep.Open)
 	}
+	// The unified OAuth v3 Token Endpoint mints TAT on the accounts domain;
+	// pin the default-brand host so a stray non-production domain revert is caught.
+	if ep.Accounts != "https://accounts.feishu.cn" {
+		t.Errorf("Accounts = %q, want accounts.feishu.cn for empty brand", ep.Accounts)
+	}
 }
 
 func TestResolveOpenBaseURL(t *testing.T) {

internal/credential/default_provider.go

@@ -19,33 +19,44 @@ import (
 	extcred "github.com/larksuite/cli/extension/credential"
 )
 
-// classifyTATResponseCode wraps a non-zero TAT endpoint response code into the
-// canonical typed error. The TAT mint endpoint reports invalid credentials
-// with two distinct codes:
+// classifyTATResponseCode wraps a deterministic (non-transient) failure from the
+// unified Token Endpoint into the canonical typed errs.* error. The v3 endpoint
+// reports failures using the OAuth 2.0 model — an `error` string plus an
+// optional numeric `code` — instead of the legacy `{code, msg}` shape.
 //
-//   - 10003: bad app_id format or non-existent app_id ("invalid param")
-//   - 10014: invalid app_secret ("app secret invalid")
-//
-// Both surface as CategoryConfig/InvalidClient from the user's perspective —
-// the configured credentials cannot mint a tenant access token. 10014 is
-// globally mapped in codemeta (TAT-mint-specific variant of OAuth 99991543).
-// 10003 is NOT globally mapped because in other Lark endpoints it carries
-// unrelated semantics (e.g. task API uses 10003 for permission denied), so
-// the override stays local to this TAT call site instead of leaking into the
-// shared codemeta table.
-func classifyTATResponseCode(code int, msg, brand, appID string) error {
-	if code == 10003 {
+// invalid_client / unauthorized_client mean the configured app_id/app_secret
+// cannot mint a token; from the user's perspective that is the same actionable
+// CategoryConfig/InvalidClient failure the legacy 10003/10014 codes produced.
+// Every other deterministic error falls through to BuildAPIError, which still
+// yields a typed error so probe callers (errs.IsTyped) surface it rather than
+// swallowing it. Transient/server-side failures (5xx / server_error) are
+// filtered out by FetchTAT before this is called, so they stay untyped.
+func classifyTATResponseCode(code int, oauthErr, errDesc, brand, appID string) error {
+	msg := errDesc
+	if msg == "" {
+		msg = oauthErr
+	}
+	switch oauthErr {
+	case "invalid_client", "unauthorized_client":
 		return errs.NewConfigError(errs.SubtypeInvalidClient, "%s", msg).
 			WithCode(code).
 			WithHint("%s", errclass.ConfigHint(errs.SubtypeInvalidClient))
 	}
-	return errclass.BuildAPIError(map[string]any{
+	if err := errclass.BuildAPIError(map[string]any{
 		"code": code,
 		"msg":  msg,
 	}, errclass.ClassifyContext{
 		Brand: brand,
 		AppID: appID,
-	})
+	}); err != nil {
+		return err
+	}
+	// BuildAPIError returns nil for code 0 (Feishu's success convention), but this
+	// function is only reached once FetchTAT has ruled out success — a non-credential
+	// OAuth error (e.g. invalid_scope) can arrive with code 0 and is still a
+	// deterministic rejection. Back it with a typed APIError so callers never receive
+	// the ("", nil) "empty token, no error" pair.
+	return errs.NewAPIError(errs.SubtypeUnknown, "%s", msg).WithCode(code)
 }
 
 // DefaultAccountProvider resolves account from config.json via keychain.
@@ -146,8 +157,8 @@ func (p *DefaultTokenProvider) resolveUAT(ctx context.Context) (*TokenResult, er
 	return &TokenResult{Token: token, Scopes: scopes}, nil
 }
 
-// resolveTAT resolves a tenant access token. Result is cached after first call.
-// NOTE: Uses sync.Once — only the context from the first call is used.
+// resolveTAT resolves a tenant access token. The result is cached after the first
+// call via sync.Once — only the context from the first call is used.
 func (p *DefaultTokenProvider) resolveTAT(ctx context.Context) (*TokenResult, error) {
 	p.tatOnce.Do(func() {
 		p.tatResult, p.tatErr = p.doResolveTAT(ctx)