@gapi/gcli 1.8.240 → 1.8.242

package/.agents/skills/cluster-targeting/SKILL.md

@@ -68,3 +68,26 @@ shared with or generated from gql-fission's copy.
 `jest.config.js` has no `moduleNameMapper` for the `~/` tsconfig path alias
 — new test files must use relative imports (e.g. `'../src/helpers'`), not
 `'~/helpers'`, or the test silently fails to resolve the module.
+
+## Managing a private cluster itself (scaling, topology, autoscale)
+
+The `cluster:*` commands that change or watch ONE cluster
+(`status`, `health`, `scale-events`, `cost`, `scale`,
+`scale:control-planes`, `multi-node`, `single-node`, `autoscale`,
+`load-balancer`) share `commands/cluster/helpers/cluster-change.ts`:
+`resolveClusterTarget` (`--cluster <id>` or `--clusterName <name>`,
+required), `parseIntOption`, and `runClusterChange` (mutate → print →
+`--wait` via `pollUntilReady`; ending in `error` exits non-zero). Their
+selections and types live in `commands/cluster/types.ts` (newer than the
+hand-kept `@introspection`).
+
+`cluster:apply` is the declarative path: the `cluster:` section of
+lambforge.yaml (`ClusterDesired` in `helpers/plan.ts`, also the type of
+`load-spec.ts`'s `cluster`). Keep `planClusterChanges` pure and ordered
+(create | topology → workers → control planes → load balancer →
+autoscale): each step is one background job and the cluster must be
+`ready` before the next. A new cluster setting = a key in `ClusterDesired`,
+a check in `validateDesired`, a step in the plan, a test in
+`test/cluster-apply.spec.ts`, and the README "Declarative clusters" block.
+The server merges partial autoscale input into the stored policy, so the
+plan sends only changed keys.

package/README-CLI.md

@@ -29,10 +29,25 @@ Commands:
   cron:create [options]                                Create cron
   cron:delete [options]                                Delete cron
   cron:list [options]                                  List of all cron jobs for project
+  mq-trigger:list [options]                            List the message-queue triggers of a project
+  mq-trigger:create [options]                          Run a lambda for every message on a RabbitMQ queue
+  mq-trigger:update [options]                          Change a message-queue trigger (same flags as create)
+  mq-trigger:delete [options]                          Delete a message-queue trigger
   cluster:create [options]                             Provision a private Talos cluster for a project (runs in the background - takes several minutes; use --wait to block)
+  cluster:apply [options]                              Make a private cluster match the `cluster:` section of lambforge.yaml: creates it if missing, then applies topology, workers, control planes, load balancer and autoscaling
   cluster:list [options]                               List every private cluster this project has (it may have several - dev/stage/prod, ...)
   cluster:teardown [options]                           Tear down one of a project's clusters (runs in the background - use --wait to block)
   cluster:kubeconfig [options]                         Print (or save) a cluster's raw kubeconfig YAML - only available once it's 'ready'
+  cluster:status [options]                             Every cluster's status, agent, nodes, CPU/memory load, autoscaling and open issues (or one with --cluster)
+  cluster:health [options]                             The latest health report of a cluster's agent, with every node
+  cluster:scale-events [options]                       Manual and autoscaler scale history, newest first
+  cluster:cost [options]                               Month-to-date cost and the monthly estimate of the project's private clusters
+  cluster:scale [options]                              Set the number of worker nodes (1-10) of a multi-node cluster - billed per node-hour
+  cluster:scale:control-planes [options]               Set the number of control-plane nodes (1, 3 or 5)
+  cluster:autoscale [options]                          Change the worker autoscaling policy - only the flags you pass change
+  cluster:multi-node [options]                         Convert a single-node cluster to dedicated worker nodes (required for autoscaling)
+  cluster:single-node [options]                        Convert a multi-node cluster back to a single node (removes the worker nodes)
+  cluster:load-balancer [options]                      Add or remove the cluster's load balancer (billed per hour while enabled)
   rabbitmq:create [options]                            Provision a RabbitMQ broker for a project (a project may have several)
   rabbitmq:list [options]                              List every RabbitMQ broker for a project
   rabbitmq:delete [options]                            Delete a RabbitMQ broker
@@ -491,6 +506,69 @@ Options:
   -p, --project <project>
   -h, --help               display help for command
 
+--- Subcommand: mq-trigger:list ---
+Usage: gcli mq-trigger:list [options]
+
+List the message-queue triggers of a project
+
+Options:
+  -p, --project <project>
+  -h, --help               display help for command
+
+--- Subcommand: mq-trigger:create ---
+Usage: gcli mq-trigger:create [options]
+
+Run a lambda for every message on a RabbitMQ queue
+
+Options:
+  -p, --project <project>
+  -n, --name <name>             Trigger name
+  -l, --lambda <lambda>         Lambda the trigger runs per message
+  --request-topic <queue>       Queue the trigger consumes
+  --response-topic <queue>      Queue for the lambda response
+  --error-topic <queue>         Queue for failed messages
+  --broker <rabbitMqId>         RabbitMQ broker id (see rabbitmq:list) - needed
+                                when several brokers share queue names
+  --max-retries <n>
+  --cool-down-period <seconds>
+  --polling-interval <seconds>
+  --min-replicas <n>
+  --max-replicas <n>
+  --threshold <n>               Messages per replica before scaling out
+  -h, --help                    display help for command
+
+--- Subcommand: mq-trigger:update ---
+Usage: gcli mq-trigger:update [options]
+
+Change a message-queue trigger (same flags as create)
+
+Options:
+  -p, --project <project>
+  -n, --name <name>             Trigger name
+  -l, --lambda <lambda>         Lambda the trigger runs per message
+  --request-topic <queue>       Queue the trigger consumes
+  --response-topic <queue>      Queue for the lambda response
+  --error-topic <queue>         Queue for failed messages
+  --broker <rabbitMqId>         RabbitMQ broker id (see rabbitmq:list) - needed
+                                when several brokers share queue names
+  --max-retries <n>
+  --cool-down-period <seconds>
+  --polling-interval <seconds>
+  --min-replicas <n>
+  --max-replicas <n>
+  --threshold <n>               Messages per replica before scaling out
+  -h, --help                    display help for command
+
+--- Subcommand: mq-trigger:delete ---
+Usage: gcli mq-trigger:delete [options]
+
+Delete a message-queue trigger
+
+Options:
+  -p, --project <project>
+  -n, --name <name>        Trigger name
+  -h, --help               display help for command
+
 --- Subcommand: cluster:create ---
 Usage: gcli cluster:create [options]
 
@@ -508,6 +586,19 @@ Options:
   --wait                     Block until the cluster is ready (or errors)
   -h, --help                 display help for command
 
+--- Subcommand: cluster:apply ---
+Usage: gcli cluster:apply [options]
+
+Make a private cluster match the `cluster:` section of lambforge.yaml: creates it if missing, then applies topology, workers, control planes, load balancer and autoscaling
+
+Options:
+  -p, --project <project>
+  -spec, --spec <spec>     Spec file (default: lambforge.yaml / cluster.yaml)
+  --dry-run                Print the plan, change nothing
+  --yes                    Also apply steps that remove capacity or the load
+                           balancer IP
+  -h, --help               display help for command
+
 --- Subcommand: cluster:list ---
 Usage: gcli cluster:list [options]
 
@@ -539,6 +630,135 @@ Options:
   -o, --output <output>    Write to this file instead of stdout
   -h, --help               display help for command
 
+--- Subcommand: cluster:status ---
+Usage: gcli cluster:status [options]
+
+Every cluster's status, agent, nodes, CPU/memory load, autoscaling and open issues (or one with --cluster)
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:health ---
+Usage: gcli cluster:health [options]
+
+The latest health report of a cluster's agent, with every node
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:scale-events ---
+Usage: gcli cluster:scale-events [options]
+
+Manual and autoscaler scale history, newest first
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --limit <limit>              How many events (default 20)
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:cost ---
+Usage: gcli cluster:cost [options]
+
+Month-to-date cost and the monthly estimate of the project's private clusters
+
+Options:
+  -p, --project <project>
+  -h, --help               display help for command
+
+--- Subcommand: cluster:scale ---
+Usage: gcli cluster:scale [options]
+
+Set the number of worker nodes (1-10) of a multi-node cluster - billed per node-hour
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --workers <workers>          Worker nodes, 1-10
+  --wait                       Block until the cluster settles
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:scale:control-planes ---
+Usage: gcli cluster:scale:control-planes [options]
+
+Set the number of control-plane nodes (1, 3 or 5)
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --count <count>              Control planes: 1, 3 or 5
+  --wait                       Block until the cluster settles
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:autoscale ---
+Usage: gcli cluster:autoscale [options]
+
+Change the worker autoscaling policy - only the flags you pass change
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --enable                     Turn autoscaling on (multi-node clusters only)
+  --disable                    Turn autoscaling off
+  --min <min>                  Minimum workers (1-10)
+  --max <max>                  Maximum workers (1-10)
+  --cpuUp <percent>            Scale up at this CPU % (1-100)
+  --memUp <percent>            Scale up at this memory % (1-100)
+  --cpuDown <percent>          Scale down below this CPU % (1-100)
+  --memDown <percent>          Scale down below this memory % (1-100)
+  --samples <n>                Consecutive readings before acting (1-20)
+  --cooldown <minutes>         Minutes between scale actions (1-1440)
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:multi-node ---
+Usage: gcli cluster:multi-node [options]
+
+Convert a single-node cluster to dedicated worker nodes (required for autoscaling)
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --workers <workers>          Worker nodes, 1-10
+  --wait                       Block until the cluster settles
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:single-node ---
+Usage: gcli cluster:single-node [options]
+
+Convert a multi-node cluster back to a single node (removes the worker nodes)
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --wait                       Block until the cluster settles
+  -h, --help                   display help for command
+
+--- Subcommand: cluster:load-balancer ---
+Usage: gcli cluster:load-balancer [options]
+
+Add or remove the cluster's load balancer (billed per hour while enabled)
+
+Options:
+  -p, --project <project>
+  -c, --cluster <cluster>      Cluster id (see cluster:list)
+  --clusterName <clusterName>  Cluster name instead of --cluster
+  --enable                     Add the load balancer
+  --disable                    Remove the load balancer
+  --wait                       Block until the cluster settles
+  -h, --help                   display help for command
+
 --- Subcommand: rabbitmq:create ---
 Usage: gcli rabbitmq:create [options]
 

package/README.md

@@ -11,6 +11,7 @@ Whether you are deploying scalable serverless functions, managing cloud environm
 - [Managing Infrastructure](#managing-infrastructure)
 - [Serverless Functions (Lambdas)](#serverless-functions-lambdas)
 - [AI Integration (Model Context Protocol)](#ai-integration-model-context-protocol)
+  - [AI agent skill](#ai-agent-skill)
 - [Local AI Models (Ollama runner)](#local-ai-models-ollama-runner)
 - [Build System](#build-system)
 - [Command Reference](#command-reference)
@@ -24,7 +25,7 @@ You can install `gcli` using a pre-built binary or via NPM.
 For a standalone installation without Node.js dependencies:
 
 ```bash
-curl -L "https://github.com/Stradivario/gapi/releases/download/v1.8.198/gcli-linux" -o ~/.local/bin/gcli
+curl -L "https://github.com/Stradivario/gapi/releases/latest/download/gcli-linux" -o ~/.local/bin/gcli
 chmod +x ~/.local/bin/gcli
 ```
 
@@ -46,6 +47,20 @@ For automated pipelines (e.g., GitHub Actions), you can use `npx` with a long-li
   run: npx gcli login --ci --token ${{ secrets.GCLI_AUTH_TOKEN }}
 ```
 
+Create the token in the dashboard (Project → CI/CD) with only the permissions the pipeline needs. Every project command has a permission:
+
+| Permission | Commands |
+|---|---|
+| Lambdas: read / deploy / create / delete | `lambda:get/list/log/build:log/test`, `lambda:update`, `lambda:create`, `lambda:delete` |
+| Environments: read / write / delete | `environment:list/get`, `environment:create/update`, `environment:delete` |
+| Schedules: read / write | `cron:list`, `cron:create/delete` |
+| RabbitMQ: read / install / uninstall | `rabbitmq:list`, `rabbitmq:create`, `rabbitmq:delete` |
+| Queue triggers: read / manage | `mq-trigger:list`, `mq-trigger:create/update/delete` |
+| Plugins: read / install | `plugin:list/installed`, `plugin:install/uninstall` |
+| Clusters: read / scale / create / tear down / kubeconfig | `cluster:list/status/health/scale-events/cost`, `cluster:scale/autoscale/multi-node/single-node/load-balancer/apply`, `cluster:create/apply`, `cluster:teardown`, `cluster:kubeconfig` |
+
+A token can also be limited to some lambdas (lambda, schedule and queue-trigger commands). Typical tokens: *Deploy only* (`lambda:update`), or *DevOps (clusters)* for an infra repo that runs `gcli cluster:apply`. A command the token may not run fails with `ci-token-missing-scope: <operation> needs <permission>`. `runner:*` and `project:list` are personal and not available to CI tokens.
+
 ## Authentication
 
 Before interacting with the platform, you must authenticate. You can log in using an API key or a personal access token.
@@ -95,6 +110,10 @@ gcli environment:get --name 'staging'
 # (omit --clusterId to use the shared cluster - the default). Immutable
 # after creation.
 gcli environment:create --name 'staging' --clusterId '<clusterId>'
+
+# Resize it, or remove it
+gcli environment:update --name 'staging' --maxCpu 800 --maxMemory 1024
+gcli environment:delete --name 'staging'
 ```
 
 ### Private Clusters
@@ -119,17 +138,79 @@ gcli cluster:kubeconfig --cluster '<clusterId>' --output ./kubeconfig.yaml
 gcli cluster:teardown --cluster '<clusterId>' --wait
 ```
 
-`cluster.yaml`:
+Scale, reshape and watch a cluster (the same operations as the dashboard's
+cluster page). Changes run in the background; `--wait` blocks until the
+cluster is `ready` again. `--clusterName <name>` works instead of
+`--cluster <id>` everywhere.
+
+```bash
+# Health, load, autoscaling and open issues of every cluster (or one)
+gcli cluster:status [--cluster '<clusterId>']
+gcli cluster:health --cluster '<clusterId>'        # latest agent report, per node
+gcli cluster:scale-events --cluster '<clusterId>'  # manual + autoscaler history
+gcli cluster:cost                                  # month-to-date + monthly estimate
+
+# Worker nodes (1-10, billed per node-hour) and control planes (1, 3 or 5)
+gcli cluster:scale --cluster '<clusterId>' --workers 3 --wait
+gcli cluster:scale:control-planes --cluster '<clusterId>' --count 3 --wait
+
+# Topology: dedicated workers (needed for autoscaling) or back to one node
+gcli cluster:multi-node --cluster '<clusterId>' --workers 2 --wait
+gcli cluster:single-node --cluster '<clusterId>' --wait
+
+# Autoscaling - only the flags you pass change
+gcli cluster:autoscale --cluster '<clusterId>' --enable --min 2 --max 6
+gcli cluster:autoscale --cluster '<clusterId>' --cpuUp 75 --cpuDown 25 --cooldown 20
+gcli cluster:autoscale --cluster '<clusterId>' --disable
+
+# Load balancer (billed per hour while enabled)
+gcli cluster:load-balancer --cluster '<clusterId>' --enable --wait
+```
+
+#### Declarative clusters (`cluster:apply`)
+
+Write the cluster you want in the `cluster:` section of `lambforge.yaml`
+(or a standalone `cluster.yaml`) and let `cluster:apply` make it so: it
+creates the cluster when it doesn't exist, then applies topology, workers,
+control planes, the load balancer and autoscaling - one change at a time,
+waiting for the cluster to be ready between them. Keys you leave out are
+left as they are.
 
 ```yaml
-name: prod
-imageId: <hcloud-image-id>
-serverType: cpx22
-location: nbg1
-workers: 2
-singleNode: false
+cluster:
+  name: prod
+  # needed only to create it
+  imageId: <hcloud-image-id>
+  serverType: cpx22
+  location: nbg1
+  # desired state
+  singleNode: false        # true = one node runs everything (cheapest, dev/stage)
+  workers: 3               # 1-10; only the initial size while autoscale is enabled
+  controlPlanes: 1         # 1, 3 or 5
+  loadBalancer: true
+  autoscale:
+    enabled: true          # needs singleNode: false
+    minWorkers: 2
+    maxWorkers: 6
+    cpuScaleUpPercent: 70  # scale up above this (of allocatable)
+    memScaleUpPercent: 70
+    cpuScaleDownPercent: 30
+    memScaleDownPercent: 30
+    samplesToScale: 3      # consecutive readings before acting
+    cooldownMinutes: 15
+```
+
+```bash
+gcli cluster:apply --dry-run     # print the plan, change nothing
+gcli cluster:apply               # apply it
+gcli cluster:apply --yes         # also steps that remove capacity or the LB IP
+gcli cluster:apply --spec cluster.yaml
 ```
 
+Steps that remove capacity or release the load balancer's IP (going back to
+`singleNode: true`, `loadBalancer: false`) are skipped unless you pass
+`--yes`. Nodes and the load balancer are billed per started hour.
+
 ### RabbitMQ Brokers
 
 A project may have several RabbitMQ brokers, each optionally scoped to one of its private clusters.
@@ -158,6 +239,21 @@ storage:
   size: SMALL
 ```
 
+### Message-Queue Triggers
+
+A trigger runs a lambda for every message on a RabbitMQ queue (and can publish the response and failures to other queues).
+
+```bash
+gcli mq-trigger:create --name orders --lambda order-handler \
+  --request-topic orders --response-topic orders-done --error-topic orders-failed \
+  --broker '<brokerId>'            # see rabbitmq:list; needed when brokers share queue names
+gcli mq-trigger:update --name orders --max-replicas 5 --threshold 20   # only the flags you pass change
+gcli mq-trigger:list
+gcli mq-trigger:delete --name orders
+```
+
+Scaling flags: `--max-retries`, `--cool-down-period`, `--polling-interval`, `--min-replicas`, `--max-replicas`, `--threshold` (messages per replica).
+
 ### Marketplace Plugins
 
 Plugins (Redis, MongoDB, NATS, FalkorDB, ...) can be installed on the shared cluster or on any private cluster - the same plugin can be installed on several clusters at once.
@@ -285,15 +381,25 @@ options:
     external: []
 ```
 
-The same file can also carry `cluster:`, `rabbitmq:`, and `plugin:` sections, read by `cluster:create`, `rabbitmq:create`, and `plugin:install` respectively (each also accepts its own dedicated `--spec` file, e.g. `cluster.yaml`, if you'd rather keep them separate):
+The same file can also carry `cluster:`, `rabbitmq:`, `plugin:` and `triggers:` sections, read by `cluster:apply` / `cluster:create`, `rabbitmq:create`, `plugin:install` and `cron:create` respectively (each also accepts its own dedicated `--spec` file, e.g. `cluster.yaml`, if you'd rather keep them separate):
 
 ```yaml
-cluster:
+cluster:          # every key: see "Declarative clusters" above
   name: prod
   imageId: <hcloud-image-id>
   serverType: cpx22
   location: nbg1
   workers: 2
+  loadBalancer: false
+  autoscale:
+    enabled: true
+    minWorkers: 2
+    maxWorkers: 5
+
+triggers:
+  time:
+    triggerName: nightly
+    cron: '0 2 * * *'   # cron syntax or @every 5m / @daily
 
 rabbitmq:
   name: events-broker
@@ -361,7 +467,7 @@ gcli lambda:create --project <projectId> --spec ./lambforge.yaml
 `--mcp` and `--mcpGraph <name>` are also available as CLI flags; the array fields
 (`mcpOperations`, `mcpHeaders`, `mcpForwardHeaders`) are spec-only. A full annotated example lives in
 [`example/mcp/lambforge.yaml`](./example/mcp/lambforge.yaml). Client connects at
-`https://<host>/<projectId>/<route>/mcp`.
+`https://<host>/<projectId>/<route>` (with `route: mcp`: `https://<host>/<projectId>/mcp`).
 
 ### Conditional Configuration (Environment-Aware Specs)
 
@@ -638,10 +744,23 @@ gcli environment:update
 
 ### Function Lifecycle
 
+- **List**: `gcli lambda:list` (`--clusterName <name>` for one cluster's lambdas)
 - **Update**: `gcli lambda:update --name 'my-function' --file ./new-index.ts`
 - **Delete**: `gcli lambda:delete --name 'my-function'`
 - **Get Details**: `gcli lambda:get --name 'my-function'`
 
+### Schedules (cron)
+
+One time trigger per lambda. The platform calls the lambda's root with a
+GET and an `X-Fission-Timer-Name` header.
+
+```bash
+gcli cron:create --lambdaName 'my-function' --triggerName nightly --cron '0 2 * * *'
+gcli cron:create                 # reads triggers.time (and function.name) from lambforge.yaml
+gcli cron:list
+gcli cron:delete --lambdaName 'my-function'
+```
+
 ### Monitoring & Testing
 
 Debug your functions directly from the terminal.
@@ -715,6 +834,33 @@ To use this with Claude Desktop or other MCP-compatible tools, add the following
 }
 ```
 
+### AI agent skill
+
+Give a coding agent (Claude Code and other agents that read skills) the
+whole platform. Paste this into the agent:
+
+```text
+Install the Lambforge skill from https://lambforge.com/skills/platform.md and follow its setup.
+```
+
+Or by hand for Claude Code:
+
+```bash
+mkdir -p ~/.claude/skills/lambforge && cd ~/.claude/skills/lambforge
+for f in $(curl -fsSL https://lambforge.com/skills/files.txt); do
+  curl -fsSLO "https://lambforge.com/skills/$f"
+done
+cp platform.md SKILL.md
+claude mcp add --scope user lambforge -- gcli mcp:start
+```
+
+`platform.md` covers setup (install gcli, the login command you run from
+Profile -> CLI - the agent never handles your token, `gcli mcp:start`) and
+the rules, and indexes topic files the agent reads on demand: gcli, MCP
+tools, deploy, REST code and testing, GraphQL and federation, websites,
+MCP servers, secrets, cron and queues, clusters and plugins, operations and
+costs, memory and plans. Source: gql-fission `src/skills/`.
+
 ## Local AI Models (Ollama runner)
 
 Use models running on your own machine in the Lambforge chat - including

package/docs/changelog.d/2026-10-19-ci-token-scopes-mq-trigger-list-create-update-delete-commands-readme-documen.md

@@ -0,0 +1,21 @@
+## 2026-10-19 - ci-token-scopes: mq-trigger:list/create/update/delete commands; README documents CI token permissions per command
+
+**Feature:** ci-token-scopes · **Type:** feat
+
+- New `mq-trigger:list`, `mq-trigger:create`, `mq-trigger:update`,
+  `mq-trigger:delete` (`src/commands/triggers/message-queue/`) - message-queue
+  triggers had an API and a dashboard page but no CLI. Flags: `--name`,
+  `--lambda`, `--request-topic`, `--response-topic`, `--error-topic`,
+  `--broker` (RabbitMQ id), scaling counts; `update` reads the current
+  trigger and sends it with the passed flags on top (the service needs the
+  full spec).
+- README: CI/CD section lists the permission each command needs (CI token
+  scopes now cover every project command, incl. clusters for DevOps
+  tokens) and a Message-Queue Triggers section; `README-CLI.md`
+  regenerated from the built CLI's `--help`.
+- **Test:** `npx jest test/mq-trigger.spec.ts` (flag mapping, create needs
+  lambda + queue, numbers validated, update merged over the current trigger).
+- **Debug:** `docs/features/ci-token-scopes.md`; `ci-token-missing-scope`
+  comes from the services - reissue the token with that permission.
+- **Verification:** jest 75/75; tsc clean; `gcli mq-trigger:create --help`
+  from a fresh build; `release/index.js` restored after the build.

package/docs/changelog.d/2026-10-19-dedicated-platform-cluster-cluster-scaling-topology-load-balancer-and-health-commands-c.md

@@ -0,0 +1,31 @@
+## 2026-10-19 - dedicated-platform-cluster: Cluster scaling, topology, load balancer and health commands (cluster:status, health, scale, autoscale, ...)
+
+**Feature:** dedicated-platform-cluster · **Type:** feat
+
+- New commands (the dashboard cluster page's actions, same
+  cluster-provisioner operations): `cluster:status`, `cluster:health`,
+  `cluster:scale-events`, `cluster:cost`, `cluster:scale --workers`,
+  `cluster:scale:control-planes --count`, `cluster:multi-node`,
+  `cluster:single-node`, `cluster:autoscale` (partial: only the given
+  flags change), `cluster:load-balancer --enable|--disable`. All take
+  `--cluster <id>` or `--clusterName <name>`; mutations take `--wait`
+  (polls until ready; ending in `error` exits non-zero with the reason).
+- `cluster:apply [--spec] [--dry-run] [--yes]`: the `cluster:` section of
+  lambforge.yaml / cluster.yaml is now a desired state (new keys
+  `controlPlanes`, `loadBalancer`, `autoscale.*`; `singleNode`, `workers`
+  as before). It creates the cluster when missing (in the desired shape)
+  and otherwise plans and applies topology → workers → control planes →
+  load balancer → autoscale, waiting for `ready` between jobs; destructive
+  steps need `--yes`. `cluster:create` also passes `controlPlanes` and
+  `loadBalancer` from the spec now.
+- Client-side checks mirror the server's bounds (workers 1-10, control
+  planes 1/3/5, autoscale ranges) so a bad value fails before any request.
+- `README.md` Private Clusters section, regenerated `README-CLI.md`.
+- **Test:** `npx jest --coverage=false` (71 tests; new
+  `test/cluster-scaling.spec.ts`, `test/cluster-apply.spec.ts` (the plan),
+  `test/cluster-apply-command.spec.ts` (dry-run, `--yes`, create, refusals)).
+- **Debug:** slice doc `docs/features/dedicated-platform-cluster.md`.
+- **Verification:** jest 71/71; the built binary's `cluster:apply` read a
+  real lambforge.yaml and rejected `controlPlanes: 2` before any request; tsc + eslint clean; `npm run build` and
+  `--help` checked for every command (`release/index.js` restored after,
+  not a release).

package/docs/changelog.d/2026-10-19-lambforge-agent-skill-readme-points-to-the-lambforge-agent-skill-gcli-mcp-start-fo.md

@@ -0,0 +1,17 @@
+## 2026-10-19 - lambforge-agent-skill: README points to the Lambforge agent skill (gcli + mcp:start for AI agents)
+
+**Feature:** lambforge-agent-skill · **Type:** docs
+
+- README.md "AI agent skill" (under AI Integration): the prompt to paste into
+  an agent (https://lambforge.com/skills/platform.md), the manual Claude Code
+  install (every file from `files.txt`, `platform.md` copied to `SKILL.md`,
+  `claude mcp add --scope user lambforge -- gcli mcp:start`), and what the
+  topic files cover. The skill lives in gql-fission `src/skills/` (canonical
+  doc there).
+- `docs/features/lambforge-agent-skill.md`: which gcli commands the skill
+  quotes - change them, update SKILL.md in the same change.
+- **Test:** none (docs); the commands it lists were checked with
+  `node release/index.js <command> --help`.
+- **Debug:** an agent runs a gcli command that fails → compare SKILL.md with
+  `gcli <command> --help`.
+- **Verification:** no code change.

package/docs/changelog.d/2026-10-19-repo-cron-create-honours-cron-triggername-readme-brought-up-to-da.md

@@ -0,0 +1,21 @@
+## 2026-10-19 - repo: cron:create honours --cron/--triggerName; README brought up to date with every command
+
+**Feature:** repo · **Type:** fix
+
+- `cron:create` declared `--cron` and `--triggerName` but only read them
+  from the spec (`triggers.time` of lambforge.yaml / cron.yaml), so the
+  documented `gcli cron:create --lambdaName x --triggerName nightly --cron
+  '0 2 * * *'` sent an empty schedule. Flags now win, the spec fills gaps,
+  and a missing schedule is a clear error before any request.
+- README: binary install from `releases/latest` (was pinned to v1.8.198);
+  `environment:update/delete`, `lambda:list` and a "Schedules (cron)"
+  section (the commands were missing); `triggers:` in the unified
+  lambforge.yaml; the MCP client URL is `https://<host>/<projectId>/<route>`
+  (the `/mcp` suffix was wrong - see example/mcp/lambforge.yaml); the
+  declarative cluster section. Every command registered in `src/commands`
+  now appears in README.md.
+- **Test:** `npx jest --coverage=false test/cron-create.spec.ts` (flags,
+  flags over yaml, missing schedule).
+- **Debug:** a cron with an empty schedule → an older gcli; upgrade.
+- **Verification:** jest 71/71; a script compared the commands registered in
+  `src/commands` against README.md (no command missing).

package/docs/features/README.md

@@ -31,3 +31,6 @@ Outline (drop sections that don't apply):
 | Feature | Doc | Notes |
 |---|---|---|
 | `local-ai-runners` | [local-ai-runners.md](local-ai-runners.md) | `runner:*` commands; canonical doc in graphql-server |
+| `lambforge-agent-skill` | [lambforge-agent-skill.md](lambforge-agent-skill.md) | The agent skill that teaches gcli + `mcp:start`; canonical doc in gql-fission |
+| `dedicated-platform-cluster` | [dedicated-platform-cluster.md](dedicated-platform-cluster.md) | `cluster:status/health/scale/autoscale/...` commands; canonical doc in lambforge-agent |
+| `ci-token-scopes` | [ci-token-scopes.md](ci-token-scopes.md) | Which permission each command needs; `mq-trigger:*` commands; canonical doc in graphql-server |

package/docs/features/ci-token-scopes.md

@@ -0,0 +1,25 @@
+# ci-token-scopes (gcli slice)
+
+**Canonical doc:** `graphql-server/docs/features/ci-token-scopes.md` ·
+**Since:** 2026-10-19
+
+gcli itself enforces nothing - a CI/CD token (`gcli login --ci --token …`)
+is checked by the services. What this package owns:
+
+- Every project command maps to one permission (README → CI/CD
+  Integration has the table). A refused command prints the service error
+  `ci-token-missing-scope: <operation> needs <scope>` /
+  `ci-token-lambda-not-allowed` / `ci-token-wrong-project`.
+- `mq-trigger:list/create/update/delete`
+  (`src/commands/triggers/message-queue/`, `GraphqlClienAPI.
+  listMessageQueueTriggers / saveMessageQueueTrigger / deleteMessageQueueTrigger`)
+  - the `mq-trigger:*` permissions had no CLI before. `update` reads the
+  current trigger and sends it with the given flags on top
+  (`mergeOverExisting`): the service hands the payload to Fission as the
+  whole spec and picks the cluster by `lambdaName`, so a partial payload
+  would drop settings. Counts are validated as whole numbers
+  (`toTriggerInput`). The trigger types are declared in `gql-client.ts`
+  (not in the bundled introspection yet).
+- Not for CI tokens: `runner:*`, `project:list`, `mcp:start`.
+
+**Test:** `npx jest test/mq-trigger.spec.ts`.