@skrr-ai/cli 0.1.46 → 0.1.48

package/dist/commands/spaces/members/add.js

@@ -45,6 +45,7 @@ class SpacesMembersAdd extends base_command_1.BaseCommand {
         '<%= config.bin %> spaces members add <space-id> --user <user-id>',
         '<%= config.bin %> spaces members add <space-id> --agent <agent-id> --role editor',
         '<%= config.bin %> spaces members add <space-id> --agent <agent-id> --brief "Owns QA tasks"',
+        '<%= config.bin %> spaces members add <space-id> --agent <agent-id> --expertise browser --expertise frontend',
         '<%= config.bin %> spaces members add <space-id> --user <user-id> --agent <agent-id> --json',
     ];
     static args = {
@@ -67,6 +68,10 @@ class SpacesMembersAdd extends base_command_1.BaseCommand {
         }),
         brief: core_1.Flags.string({ description: 'Member brief to save for every added principal' }),
         'brief-file': core_1.Flags.string({ description: 'Path to a markdown/text brief file' }),
+        expertise: core_1.Flags.string({
+            description: 'Domain label the added members are best suited for (repeatable, ≤20 items, ≤40 chars each)',
+            multiple: true,
+        }),
     };
     async run() {
         this.requireAuth();
@@ -108,19 +113,22 @@ class SpacesMembersAdd extends base_command_1.BaseCommand {
                 public: Boolean(current.public),
                 publicAccessRoleId: current.publicAccessRoleId,
             });
-            if (brief && brief.trim().length > 0) {
+            const expertise = flags.expertise;
+            if ((brief && brief.trim().length > 0) || (expertise && expertise.length > 0)) {
                 const saves = [
                     ...userIds.map((principalId) => data_provider_1.dataService.upsertSpaceBrief({
                         spaceId: args.id,
                         principalType: 'user',
                         principalId,
-                        content: brief,
+                        content: brief && brief.trim().length > 0 ? brief : undefined,
+                        expertise,
                     })),
                     ...agentIds.map((principalId) => data_provider_1.dataService.upsertSpaceBrief({
                         spaceId: args.id,
                         principalType: 'agent',
                         principalId,
-                        content: brief,
+                        content: brief && brief.trim().length > 0 ? brief : undefined,
+                        expertise,
                     })),
                 ];
                 await Promise.all(saves);

package/dist/commands/spaces/members/list.js

@@ -22,8 +22,10 @@ class SpacesMembersList extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(SpacesMembersList);
         let response;
+        let briefs = [];
         try {
             response = await data_provider_1.dataService.getResourcePermissions(data_provider_1.ResourceType.SPACE, args.id);
+            briefs = (await data_provider_1.dataService.listSpaceBriefs(args.id).catch(() => [])).filter((b) => Array.isArray(b.expertise) && b.expertise.length > 0);
         }
         catch (err) {
             this.handleApiError(err);
@@ -41,14 +43,23 @@ class SpacesMembersList extends base_command_1.BaseCommand {
             type: String(p.type ?? '-'),
             name: String(p.name ?? p.email ?? '-'),
             role: (0, space_members_1.spaceRoleLabel)(String(p.accessRoleId ?? '')),
+            expertise: expertiseForPrincipal(briefs, p),
             id: (0, space_members_1.principalIdForDisplay)(p),
         }));
         (0, format_1.renderTable)(rows, [
             { key: 'type', header: 'TYPE' },
             { key: 'name', header: 'NAME', maxWidth: 36 },
             { key: 'role', header: 'ROLE' },
+            { key: 'expertise', header: 'EXPERTISE', maxWidth: 32 },
             { key: 'id', header: 'ID', verbatim: true },
         ], (line) => this.log(line));
     }
 }
 exports.default = SpacesMembersList;
+/** Brief principalId can be an agent UUID or a Mongo _id; match against both. */
+function expertiseForPrincipal(briefs, principal) {
+    const type = String(principal.type ?? '').toLowerCase();
+    const ids = new Set([principal.id, principal.idOnTheSource].filter((v) => v !== undefined).map(String));
+    const brief = briefs.find((b) => String(b.principalType ?? '').toLowerCase() === type && ids.has(String(b.principalId ?? '')));
+    return brief ? brief.expertise.join(', ') : '-';
+}

package/dist/commands/store/governance/artifacts.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance artifacts` — the catalogue, searched by what an
+ * artifact CAN DO rather than what it is called.
+ *
+ * Distinct from `skrr store browse`, which finds published agents to install.
+ * This searches every governed entity type by capability, permission,
+ * verified outcome and cost — the questions you ask when deciding what a
+ * workspace should be licensed for, not which agent you personally want.
+ */
+export default class StoreGovernanceArtifacts extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'entity-type': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        capability: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        permission: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'verified-outcome': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'min-cost-micros': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'max-cost-micros': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/artifacts.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance artifacts` — the catalogue, searched by what an
+ * artifact CAN DO rather than what it is called.
+ *
+ * Distinct from `skrr store browse`, which finds published agents to install.
+ * This searches every governed entity type by capability, permission,
+ * verified outcome and cost — the questions you ask when deciding what a
+ * workspace should be licensed for, not which agent you personally want.
+ */
+class StoreGovernanceArtifacts extends base_command_1.BaseCommand {
+    static description = 'Search the governed store catalogue by capability, permission, verified outcome and cost. For finding an agent to install, use `store browse`.';
+    static examples = [
+        '<%= config.bin %> store governance artifacts --capability code_review',
+        '<%= config.bin %> store governance artifacts --entity-type skill --max-cost-micros 500000',
+    ];
+    static flags = {
+        'entity-type': core_1.Flags.string({
+            description: 'agent, skill, action, service, team, bundle, space_template or connector',
+        }),
+        capability: core_1.Flags.string({ description: 'Capability the artifact provides' }),
+        permission: core_1.Flags.string({ description: 'Permission the artifact requires' }),
+        'verified-outcome': core_1.Flags.string({ description: 'A verified outcome key it claims' }),
+        'min-cost-micros': core_1.Flags.integer({ description: 'Lower bound on cost, in micros' }),
+        'max-cost-micros': core_1.Flags.integer({ description: 'Upper bound on cost, in micros' }),
+        limit: core_1.Flags.integer({ description: 'Maximum rows (1-100)' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernanceArtifacts);
+        let result;
+        try {
+            result = await (0, governed_store_1.searchGovernedStoreArtifacts)({
+                entityType: flags['entity-type'],
+                capability: flags.capability,
+                permission: flags.permission,
+                verifiedOutcome: flags['verified-outcome'],
+                minCostMicros: flags['min-cost-micros'],
+                maxCostMicros: flags['max-cost-micros'],
+                limit: flags.limit,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceArtifacts;

package/dist/commands/store/governance/assign.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/** Give a workspace-held license to a member or a Space. */
+export default class StoreGovernanceAssign extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        to: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'assignment-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/assign.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/** Give a workspace-held license to a member or a Space. */
+class StoreGovernanceAssign extends base_command_1.BaseCommand {
+    static description = 'Assign a workspace-held license to a member or a Space — who actually gets to run it.';
+    static examples = [
+        '<%= config.bin %> store governance assign <workspace-id> --license <id> --to member:<user-id>',
+        '<%= config.bin %> store governance assign <workspace-id> --license <id> --to space:<space-id>',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        license: core_1.Flags.string({ description: 'License to assign', required: true }),
+        to: core_1.Flags.string({
+            description: 'member:<user-id> or space:<space-id>',
+            required: true,
+        }),
+        'assignment-id': core_1.Flags.string({ description: 'Assignment id, for a deterministic retry' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceAssign);
+        // `member:` / `space:` rather than two flags, because the two are mutually
+        // exclusive and a pair of optional flags lets you pass both or neither.
+        const separator = flags.to.indexOf(':');
+        const assigneeType = separator > 0 ? flags.to.slice(0, separator) : '';
+        const assigneeId = separator > 0 ? flags.to.slice(separator + 1) : '';
+        if (!['member', 'space'].includes(assigneeType) || !assigneeId) {
+            this.error(`--to must be member:<user-id> or space:<space-id>, got "${flags.to}"`, {
+                exit: 2,
+            });
+        }
+        let result;
+        try {
+            result = await (0, governed_store_1.assignWorkspaceStoreLicense)(args.workspace, {
+                licenseId: flags.license,
+                assigneeType: assigneeType,
+                assigneeId,
+                ...(flags['assignment-id'] ? { assignmentId: flags['assignment-id'] } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceAssign;

package/dist/commands/store/governance/create-license.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Mint a bundle license against an acquisition (admin).
+ *
+ * A license always cites WHAT paid for it — a commercial order or a contract —
+ * so the body carries that acquisition source. That link is the reason a
+ * license can be audited at all, and it is not something a CLI should let you
+ * omit by defaulting.
+ */
+export default class StoreGovernanceCreateLicense extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/create-license.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Mint a bundle license against an acquisition (admin).
+ *
+ * A license always cites WHAT paid for it — a commercial order or a contract —
+ * so the body carries that acquisition source. That link is the reason a
+ * license can be audited at all, and it is not something a CLI should let you
+ * omit by defaulting.
+ */
+class StoreGovernanceCreateLicense extends base_command_1.BaseCommand {
+    static description = 'Mint a bundle license against a commercial order or contract (admin).';
+    static examples = [
+        '<%= config.bin %> store governance create-license --file ./license.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernanceCreateLicense);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, governed_store_1.createGovernedStoreLicense)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceCreateLicense;

package/dist/commands/store/governance/install-plan.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance install-plan` — what installing this release WOULD do.
+ *
+ * A plan, not an install, and the name says so. It resolves the release
+ * against a license, the workspace policy and the environment you declare, and
+ * answers whether it is permitted and what it would pull. That is the read an
+ * operator wants before spending anything — and the reason it is here rather
+ * than folded into `store install`, which installs.
+ */
+export default class StoreGovernanceInstallPlan extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        release: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/install-plan.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * `skrr store governance install-plan` — what installing this release WOULD do.
+ *
+ * A plan, not an install, and the name says so. It resolves the release
+ * against a license, the workspace policy and the environment you declare, and
+ * answers whether it is permitted and what it would pull. That is the read an
+ * operator wants before spending anything — and the reason it is here rather
+ * than folded into `store install`, which installs.
+ */
+class StoreGovernanceInstallPlan extends base_command_1.BaseCommand {
+    static description = 'Resolve what installing a governed release would do — license, workspace policy and environment. Installs nothing.';
+    static examples = [
+        '<%= config.bin %> store governance install-plan <release-id>',
+        '<%= config.bin %> store governance install-plan <release-id> --workspace <id> --license <id>',
+        '<%= config.bin %> store governance install-plan <release-id> --file ./environment.json',
+    ];
+    static args = {
+        release: core_1.Args.string({ description: 'Release id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        license: core_1.Flags.string({ description: 'License to resolve against' }),
+        workspace: core_1.Flags.string({ description: 'Workspace whose policy applies' }),
+        space: core_1.Flags.string({ description: 'Space the install would land in' }),
+        file: core_1.Flags.string({
+            description: 'JSON with an `environment` object (platformVersion, runtimeKind, …), or -',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceInstallPlan);
+        const extra = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file, { required: false });
+        let result;
+        try {
+            result = await (0, governed_store_1.resolveGovernedStoreInstallPlan)({
+                ...extra,
+                releaseId: args.release,
+                ...(flags.license ? { licenseId: flags.license } : {}),
+                ...(flags.workspace ? { workspaceId: flags.workspace } : {}),
+                ...(flags.space ? { spaceId: flags.space } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceInstallPlan;

package/dist/commands/store/governance/license-policy.d.ts

@@ -0,0 +1,30 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance license-policy` — how a license takes updates.
+ *
+ * ONE command over two endpoints, because the only difference between them is
+ * WHOSE license it is: yours, or the workspace's. `--workspace` picks the
+ * second, and the server resolves the actor from the route rather than from
+ * anything the caller asserts. Two owners can hold licenses over the same
+ * release and may change different things, so the distinction is real — it is
+ * just not a reason to make an operator remember two verb names.
+ *
+ * `--expect-revision` is REQUIRED by the API, not by convenience: an update
+ * policy decides which releases run, and a blind write could silently move a
+ * workspace onto a release somebody else had just pinned away from.
+ */
+export default class StoreGovernanceLicensePolicy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        license: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        policy: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        release: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/license-policy.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance license-policy` — how a license takes updates.
+ *
+ * ONE command over two endpoints, because the only difference between them is
+ * WHOSE license it is: yours, or the workspace's. `--workspace` picks the
+ * second, and the server resolves the actor from the route rather than from
+ * anything the caller asserts. Two owners can hold licenses over the same
+ * release and may change different things, so the distinction is real — it is
+ * just not a reason to make an operator remember two verb names.
+ *
+ * `--expect-revision` is REQUIRED by the API, not by convenience: an update
+ * policy decides which releases run, and a blind write could silently move a
+ * workspace onto a release somebody else had just pinned away from.
+ */
+class StoreGovernanceLicensePolicy extends base_command_1.BaseCommand {
+    static description = 'Set how a bundle license takes updates (manual, pinned or compatible), fenced on the revision you read. Without --workspace it changes a license you hold personally.';
+    static examples = [
+        '<%= config.bin %> store governance license-policy <license-id> --policy pinned --expect-revision 2',
+        '<%= config.bin %> store governance license-policy <license-id> --policy compatible --expect-revision 5 --workspace <workspace-id>',
+    ];
+    static args = {
+        license: core_1.Args.string({ description: 'License id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        policy: core_1.Flags.string({
+            description: 'How the license takes updates',
+            options: ['manual', 'pinned', 'compatible'],
+            required: true,
+        }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'The license revision you are changing (compare-and-set)',
+            required: true,
+        }),
+        release: core_1.Flags.string({
+            description: 'Pin to these release ids (repeatable); only meaningful with --policy pinned',
+            multiple: true,
+        }),
+        workspace: core_1.Flags.string({
+            description: 'Change the license the WORKSPACE holds, rather than your own',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceLicensePolicy);
+        const body = {
+            updatePolicy: flags.policy,
+            expectedRevision: flags['expect-revision'],
+            ...(flags.release?.length ? { selectedReleaseIds: flags.release } : {}),
+        };
+        let result;
+        try {
+            result = flags.workspace
+                ? await (0, governed_store_1.updateWorkspaceLicensePolicy)(flags.workspace, args.license, body)
+                : await (0, governed_store_1.updateOwnLicensePolicy)(args.license, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceLicensePolicy;

package/dist/commands/store/governance/policy.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance policy` — which releases a workspace may run at all.
+ *
+ * `deny_all` and `allowlist` are the two modes the server accepts, and the
+ * command refuses an allowlist with nothing in it: an empty allowlist and
+ * `deny_all` have the same effect but say different things, and a workspace
+ * that reads "allowlist" while permitting nothing is a policy nobody can
+ * explain six months later. If you mean deny everything, say `deny_all`.
+ */
+export default class StoreGovernancePolicy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        mode: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        release: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'policy-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/policy.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance policy` — which releases a workspace may run at all.
+ *
+ * `deny_all` and `allowlist` are the two modes the server accepts, and the
+ * command refuses an allowlist with nothing in it: an empty allowlist and
+ * `deny_all` have the same effect but say different things, and a workspace
+ * that reads "allowlist" while permitting nothing is a policy nobody can
+ * explain six months later. If you mean deny everything, say `deny_all`.
+ */
+class StoreGovernancePolicy extends base_command_1.BaseCommand {
+    static description = 'Set which governed releases a workspace may run. `deny_all`, or an allowlist of release ids.';
+    static examples = [
+        '<%= config.bin %> store governance policy <workspace-id> --mode deny_all',
+        '<%= config.bin %> store governance policy <workspace-id> --mode allowlist --release <id> --release <id>',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        mode: core_1.Flags.string({
+            description: 'deny_all, or allowlist the releases named by --release',
+            options: ['deny_all', 'allowlist'],
+            required: true,
+        }),
+        release: core_1.Flags.string({
+            description: 'Release id to allow (repeatable). Required with --mode allowlist.',
+            multiple: true,
+        }),
+        'policy-id': core_1.Flags.string({ description: 'Policy id, when replacing a specific one' }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'The policy revision you are replacing (compare-and-set)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernancePolicy);
+        const releases = flags.release ?? [];
+        if (flags.mode === 'allowlist' && releases.length === 0) {
+            this.error('An allowlist with no --release permits nothing, which is what --mode deny_all says plainly. Pass at least one release, or say deny_all.', { exit: 2 });
+        }
+        let result;
+        try {
+            result = await (0, governed_store_1.setWorkspaceStorePolicy)(args.workspace, {
+                mode: flags.mode,
+                allowedReleaseIds: releases,
+                ...(flags['policy-id'] ? { policyId: flags['policy-id'] } : {}),
+                ...(flags['expect-revision'] !== undefined
+                    ? { expectedRevision: flags['expect-revision'] }
+                    : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernancePolicy;

package/dist/commands/store/governance/publish-release.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Publish one artifact release into the governed catalogue (admin).
+ *
+ * The body carries verified-outcome evidence, which is why it is a file rather
+ * than flags: evidence is a list of records with sources and timestamps, and
+ * assembling that from a command line is how a claim loses its provenance.
+ */
+export default class StoreGovernancePublishRelease extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/publish-release.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Publish one artifact release into the governed catalogue (admin).
+ *
+ * The body carries verified-outcome evidence, which is why it is a file rather
+ * than flags: evidence is a list of records with sources and timestamps, and
+ * assembling that from a command line is how a claim loses its provenance.
+ */
+class StoreGovernancePublishRelease extends base_command_1.BaseCommand {
+    static description = 'Publish an artifact release into the governed store catalogue (admin).';
+    static examples = [
+        '<%= config.bin %> store governance publish-release --file ./release.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernancePublishRelease);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, governed_store_1.publishGovernedStoreRelease)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernancePublishRelease;

package/dist/commands/tasks/assign.d.ts

@@ -34,8 +34,17 @@ export default class TasksAssign extends BaseCommand {
         'repair-release-pins': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'execution-mode': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         list: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        suggest: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
     private renderMembers;
+    /**
+     * `--suggest`: a deterministic LOOKUP, not a routing decision. Declared
+     * member expertise is intersected with the task's tags (strong match) and
+     * its title/description text (weak match); the caller still chooses the
+     * assignee. This mirrors how the contract stays advisory everywhere else —
+     * the data is shown, the judgment stays with whoever is assigning.
+     */
+    private renderSuggestions;
 }