@skhema/cli 0.3.1 → 0.4.0

package/dist/cli.js

@@ -24,7 +24,7 @@ const pkg = require('../package.json');
 const program = new Command();
 program
     .name('skhema')
-    .description('Skhema CLI — authentication and AI skills management')
+    .description('Skhema CLI — drive the Skhema Public API from your terminal, CI, or agent')
     .version(pkg.version)
     .option('--json', 'Output structured JSON')
     .option('--verbose', 'Verbose output')

package/dist/commands/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/commands/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAuBnC,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AACD,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;CACzD;AASD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,GAChB,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB1D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkF1D"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../src/commands/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAuBnC,UAAU,gBAAgB;IACxB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AACD,UAAU,WAAW;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAA;CACzD;AASD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,WAAW,GAChB,KAAK,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAkB1D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsF1D"}

package/dist/commands/api.js

@@ -63,7 +63,9 @@ export function registerApiCommands(program) {
                 readFile: (p) => readFile(p, 'utf-8'),
                 readStdin,
             });
-            const { client } = await resolveClient();
+            // Meta endpoints (health, openapi) work with no credential; the SDK
+            // still throws (exit 3) for any authed path resolved anonymously.
+            const { client } = await resolveClient({ allowAnonymous: true });
             const data = await client.request(httpMethod, path, {
                 body,
                 query,
@@ -81,7 +83,9 @@ export function registerApiCommands(program) {
         .description('List every live gateway route from /v1/openapi.json')
         .action(async () => {
         await runCommand('api routes', async () => {
-            const { client } = await resolveClient();
+            // Route discovery hits only GET /v1/openapi.json (unauthenticated), so
+            // it works anonymously — part of the first-touch agent experience.
+            const { client } = await resolveClient({ allowAnonymous: true });
             const spec = await client.meta.openapi();
             if (getGlobalOptions().json) {
                 // Under --json the raw spec is the payload (the envelope wraps it).

package/dist/commands/element.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"element.d.ts","sourceRoot":"","sources":["../../src/commands/element.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkBnC;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+P9D"}
+{"version":3,"file":"element.d.ts","sourceRoot":"","sources":["../../src/commands/element.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAkBnC;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwS9D"}

package/dist/commands/element.js

@@ -39,6 +39,40 @@ export function registerElementCommands(program) {
             return data;
         });
     });
+    withWorkspace(element
+        .command('search <query>')
+        .description('Full-text search over the workspace elements')
+        .option('--limit <n>', 'Maximum results')).action(async (query, options) => {
+        await runCommand('element search', async () => {
+            const workspaceId = resolveWorkspaceId(options.workspace);
+            if (options.limit !== undefined && !/^\d+$/.test(options.limit)) {
+                throw new UsageError('--limit must be a positive integer');
+            }
+            const { client } = await resolveClient();
+            const data = await client.elements.search(workspaceId, query, {
+                ...(options.limit !== undefined && {
+                    limit: Number(options.limit),
+                }),
+            });
+            const rows = coerceList(data, 'elements');
+            if (!getGlobalOptions().json) {
+                logHeader(`Search results (${rows.length})`);
+                if (rows.length === 0)
+                    log(chalk.dim('  No matching elements.'));
+                else
+                    logTable(['Id', 'Component', 'Type', 'Content'], rows.map((r) => {
+                        const e = asRecord(r);
+                        return [
+                            String(e.id ?? '—'),
+                            String(e.componentType ?? '—'),
+                            String(e.elementType ?? '—'),
+                            summarize(e.content),
+                        ];
+                    }));
+            }
+            return data;
+        });
+    });
     // No `GET /v1/.../elements/:id` route exists on the gateway, so `element get`
     // fetches the workspace's element list and filters it client-side by id.
     withWorkspace(element.command('get <element-id>').description('Get an element by id')).action(async (elementId, options) => {

package/dist/lib/api/client.d.ts

@@ -1,10 +1,13 @@
 import { SkhemaClient } from '@skhema/sdk';
 /** Which credential source, in precedence order, is backing the client. */
-export type CredentialLane = 'flag' | 'env' | 'stored-key' | 'oauth';
+export type CredentialLane = 'flag' | 'env' | 'stored-key' | 'oauth' | 'anonymous';
 export interface CredentialDescriptor {
     lane: CredentialLane;
-    /** `api-key` for the three key lanes; `oauth` for the stored session. */
-    kind: 'api-key' | 'oauth';
+    /**
+     * `api-key` for the three key lanes; `oauth` for the stored session;
+     * `anonymous` for a credential-less client (meta endpoints only).
+     */
+    kind: 'api-key' | 'oauth' | 'anonymous';
     /** Masked key (`sk_live_...last4`), present for api-key lanes only. */
     maskedKey?: string;
     /** Organization id, when known without a network round-trip (OAuth lane). */
@@ -18,10 +21,22 @@ export interface ResolvedClient {
 }
 /** Mask a raw key to `sk_live_...abcd` — the only safe form to ever print. */
 export declare function maskApiKey(rawKey: string): string;
+/** Options controlling {@link resolveClient}'s behaviour when no credential exists. */
+export interface ResolveClientOptions {
+    /**
+     * When no credential is found, return an anonymous client (meta endpoints
+     * only) instead of throwing {@link AuthRequiredError}. For commands that touch
+     * only the unauthenticated meta endpoints (`api routes`, `api GET /health`).
+     * The SDK still enforces the per-route gate: an anonymous non-meta call throws
+     * {@link AuthError} (exit 3), so authed routes remain protected.
+     */
+    allowAnonymous?: boolean;
+}
 /**
  * Resolve the active credential using the fixed precedence (spec §3.1):
  * `--api-key` flag → `SKHEMA_API_KEY` env → stored key → stored OAuth session.
- * Throws {@link AuthRequiredError} (exit 3) when none is available.
+ * Throws {@link AuthRequiredError} (exit 3) when none is available, unless
+ * `allowAnonymous` is set — then it falls back to a credential-less client.
  */
-export declare function resolveClient(): Promise<ResolvedClient>;
+export declare function resolveClient(options?: ResolveClientOptions): Promise<ResolvedClient>;
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/api/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,aAAa,CAAA;AAO9D,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,KAAK,GAAG,YAAY,GAAG,OAAO,CAAA;AAEpE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAA;IACpB,yEAAyE;IACzE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAA;IACzB,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGjD;AASD;;;;GAIG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,cAAc,CAAC,CA4D7D"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/api/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,YAAY,EAAE,MAAM,aAAa,CAAA;AAO9D,2EAA2E;AAC3E,MAAM,MAAM,cAAc,GACtB,MAAM,GACN,KAAK,GACL,YAAY,GACZ,OAAO,GACP,WAAW,CAAA;AAEf,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,cAAc,CAAA;IACpB;;;OAGG;IACH,IAAI,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,CAAA;IACvC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,YAAY,CAAA;IACpB,UAAU,EAAE,oBAAoB,CAAA;CACjC;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAGjD;AASD,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,cAAc,CAAC,CA0EzB"}

package/dist/lib/api/client.js

@@ -15,9 +15,10 @@ function apiKeyClient(rawKey) {
 /**
  * Resolve the active credential using the fixed precedence (spec §3.1):
  * `--api-key` flag → `SKHEMA_API_KEY` env → stored key → stored OAuth session.
- * Throws {@link AuthRequiredError} (exit 3) when none is available.
+ * Throws {@link AuthRequiredError} (exit 3) when none is available, unless
+ * `allowAnonymous` is set — then it falls back to a credential-less client.
  */
-export async function resolveClient() {
+export async function resolveClient(options = {}) {
     const flagKey = getApiKeyFlag();
     if (flagKey) {
         return {
@@ -66,6 +67,19 @@ export async function resolveClient() {
             },
         };
     }
+    if (options.allowAnonymous) {
+        return {
+            client: createSkhemaClient(undefined, {
+                baseUrl: API_BASE_URL,
+                authBaseUrl: AUTH_BASE_URL,
+            }),
+            credential: {
+                lane: 'anonymous',
+                kind: 'anonymous',
+                source: 'anonymous (meta endpoints only)',
+            },
+        };
+    }
     throw new AuthRequiredError('No credentials found. Run `skhema auth login` for interactive use, or set ' +
         `${API_KEY_ENV_VAR}=sk_live_… (or run \`skhema auth key use <key>\`) for headless/CI use.`);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skhema/cli",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Skhema CLI - Authentication and AI skills management for agent platforms",
   "type": "module",
   "main": "dist/index.js",
@@ -44,7 +44,7 @@
     "commander": "^12.0.0",
     "ora": "^8.0.0",
     "@skhema/agent-sdk": "0.1.4",
-    "@skhema/sdk": "0.1.2"
+    "@skhema/sdk": "0.2.0"
   },
   "devDependencies": {
     "@skhema/linter": "2.2.0",

package/skills/.manifest.json

@@ -1,5 +1,5 @@
 {
-  "syncedAt": "2026-07-09T00:22:20.025Z",
+  "syncedAt": "2026-07-09T00:27:14.921Z",
   "source": "/Users/michaellovell/Desktop/GitHub/skhema-skills",
   "sourceSha": "77561c7dbde8602ca799e5224c65ea18675ee37b",
   "skills": [