@skrr-ai/cli 0.1.19 → 0.1.21

package/dist/lib/triggers.d.ts

@@ -18,7 +18,7 @@ export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscri
  * capability was live and unreachable. `watch_until` and `sensor_poll` had been
  * in that state for longer.
  */
-export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover"];
+export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover"];
 export declare const TRIGGER_EVENT_FILTER_MODES: readonly ["equals", "contains", "in_set"];
 export declare const TRIGGER_CONCURRENCY_POLICIES: readonly ["coalesce_if_active", "allow_parallel"];
 export declare const TRIGGER_FORM_RESPONSE_MODES: readonly ["thank_you_page", "redirect_url", "run_complete"];
@@ -95,6 +95,16 @@ export interface TriggerDefinition {
     chatMessage?: Record<string, unknown>;
     audit?: Record<string, unknown>;
     webhook?: Record<string, unknown>;
+    /**
+     * Server-DERIVED: maintained by a managed producer, so the mutation routes
+     * refuse to edit or remove it. Optional because a server predating the field
+     * omits it, which correctly reads as "not producer-owned".
+     *
+     * Declared here rather than inferred, and never re-derived from an id prefix
+     * or an execution mode — the route owns that policy and a local copy is free
+     * to disagree with the route that does the refusing.
+     */
+    producerOwned?: boolean;
     createdAt?: string;
     updatedAt?: string;
 }
@@ -327,7 +337,16 @@ export declare function armedStateLabel(enabled: boolean | undefined): string;
  * parentheses for scripts.
  */
 export declare function writeModeLabel(writeMode: string): string;
-export declare function renderTriggerSummary(trigger: TriggerDefinition, log: (line: string) => void): void;
+/**
+ * Where an external caller POSTs to fire this trigger.
+ *
+ * Same origin as every other `/api/...` call the CLI makes, so it is built from
+ * the configured base URL rather than guessed.
+ */
+export declare function webhookIngestUrl(baseURL: string, triggerId: string): string;
+export declare function renderTriggerSummary(trigger: TriggerDefinition, log: (line: string) => void, options?: {
+    baseURL?: string;
+}): void;
 export declare function renderLegacyRuns(runs: LegacyTriggerRun[], log: (line: string) => void): void;
 export declare function renderFireAudit(fires: TriggerFireRecord[], log: (line: string) => void): void;
 /**

package/dist/lib/triggers.js

@@ -32,6 +32,7 @@ exports.renderTriggerList = renderTriggerList;
 exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
 exports.writeModeLabel = writeModeLabel;
+exports.webhookIngestUrl = webhookIngestUrl;
 exports.renderTriggerSummary = renderTriggerSummary;
 exports.renderLegacyRuns = renderLegacyRuns;
 exports.renderFireAudit = renderFireAudit;
@@ -86,6 +87,11 @@ exports.TRIGGER_EXECUTOR_MODES = [
     'goal_planner_tick',
     'morning_briefing',
     'builtin_action',
+    // The author-visible way to run a Task from a trigger. Its internal sibling
+    // `task_schedule_fire` sits two lines up and the server refuses it from any
+    // non-managed caller, so without this entry a headless operator could author
+    // every kind of task watcher except one that does the task.
+    'task_execute',
     // User-authorable capabilities the server allows on the agent scope.
     'watch_until',
     'sensor_poll',
@@ -784,11 +790,40 @@ function writeModeLabel(writeMode) {
             return writeMode;
     }
 }
-function renderTriggerSummary(trigger, log) {
+/**
+ * Kinds that expose a signed inbound HTTP channel. Mirrors `WEBHOOK_KINDS` in
+ * `api/server/routes/triggers.js`, which is what actually decides — this copy
+ * only chooses whether to PRINT a URL, so being behind costs a missing hint
+ * rather than a wrong answer.
+ */
+const WEBHOOK_INGEST_KINDS = new Set(['on_demand', 'form', 'chat_message']);
+/**
+ * Where an external caller POSTs to fire this trigger.
+ *
+ * Same origin as every other `/api/...` call the CLI makes, so it is built from
+ * the configured base URL rather than guessed.
+ */
+function webhookIngestUrl(baseURL, triggerId) {
+    return `${String(baseURL).replace(/\/+$/, '')}/api/triggers/webhook/${encodeURIComponent(triggerId)}`;
+}
+function renderTriggerSummary(trigger, log, options = {}) {
     log(`ID:       ${trigger.id ?? '-'}`);
     log(`Kind:     ${trigger.kind ?? '-'}`);
     log(`Armed:    ${armedStateLabel(trigger.enabled)}`);
     log(`Scope:    ${scopeLabel(trigger)}`);
+    /*
+     * Say when the row is not yours to change.
+     *
+     * `producerOwned` is derived by the server and reported on every trigger read.
+     * Without it a headless operator reads `skrr triggers show task-schedule:<id>`,
+     * sees an ordinary-looking trigger, runs `triggers delete`, and learns from a
+     * 409 — for a row that was never editable. Same argument the `Contract:` /
+     * `Writes:` lines below were added under: a trigger with a property this
+     * consequential should state it at the moment it is read.
+     */
+    if (trigger.producerOwned === true) {
+        log('Managed:  by the platform — not editable here; change the object that owns it');
+    }
     if (trigger.label)
         log(`Label:    ${trigger.label}`);
     if (trigger.execution?.mode)
@@ -809,6 +844,18 @@ function renderTriggerSummary(trigger, log) {
     if (trigger.webhook?.configured !== undefined) {
         log(`Webhook:  ${trigger.webhook.configured ? 'configured' : 'not configured'}`);
     }
+    /*
+     * The endpoint, not just "configured".
+     *
+     * An `on_demand` trigger exists so something outside the platform can fire it,
+     * and the CLI could report that a secret was set while never saying where to
+     * send it — the one fact the integration cannot be built without. Printed for
+     * every webhook-bearing kind, whether or not a secret has been minted yet, so
+     * "what is my URL" never requires a rotate.
+     */
+    if (options.baseURL && trigger.id && WEBHOOK_INGEST_KINDS.has(String(trigger.kind))) {
+        log(`Webhook URL: POST ${webhookIngestUrl(options.baseURL, trigger.id)}`);
+    }
 }
 function renderLegacyRuns(runs, log) {
     if (runs.length === 0) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refreshClassification.js

@@ -22,8 +22,9 @@ Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get:
 Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return types_js_1.TransientAuthFailure; } });
 /**
  * Maps server-supplied error codes to the canonical PermanentAuthReason values
- * exported from types.ts. Only the four values present in PermanentAuthReason
- * are listed; anything else falls through to 'REFRESH_INVALID'.
+ * exported from types.ts. `REFRESH_MISSING` is a server protocol code rather
+ * than a user-facing reason; it maps to `REFRESH_INVALID` because an identical
+ * retry cannot gain the credential the server says was absent.
  */
 const PERMANENT_CODE_SET = new Set([
     'REFRESH_INVALID',
@@ -63,6 +64,12 @@ function classifyRefreshResponse(status, body) {
     }
     // 401 — auth failure; check for known permanent code
     if (status === 401) {
+        if (body?.code === 'REFRESH_MISSING') {
+            return {
+                kind: 'failure',
+                failure: new types_js_1.PermanentAuthFailure('REFRESH_INVALID', body.message ?? 'Refresh token missing'),
+            };
+        }
         const code = body?.code;
         if (code && PERMANENT_CODE_SET.has(code)) {
             return {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/refreshClassification.js

@@ -23,8 +23,9 @@ import { PermanentAuthFailure, TransientAuthFailure } from './types.js';
 export { PermanentAuthFailure, TransientAuthFailure };
 /**
  * Maps server-supplied error codes to the canonical PermanentAuthReason values
- * exported from types.ts. Only the four values present in PermanentAuthReason
- * are listed; anything else falls through to 'REFRESH_INVALID'.
+ * exported from types.ts. `REFRESH_MISSING` is a server protocol code rather
+ * than a user-facing reason; it maps to `REFRESH_INVALID` because an identical
+ * retry cannot gain the credential the server says was absent.
  */
 const PERMANENT_CODE_SET = new Set([
     'REFRESH_INVALID',
@@ -64,6 +65,12 @@ export function classifyRefreshResponse(status, body) {
     }
     // 401 — auth failure; check for known permanent code
     if (status === 401) {
+        if (body?.code === 'REFRESH_MISSING') {
+            return {
+                kind: 'failure',
+                failure: new PermanentAuthFailure('REFRESH_INVALID', body.message ?? 'Refresh token missing'),
+            };
+        }
         const code = body?.code;
         if (code && PERMANENT_CODE_SET.has(code)) {
             return {