@skrr-ai/cli 0.1.46 → 0.1.48

package/dist/commands/code/update.js

@@ -0,0 +1,242 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
+const base_command_1 = require("../../base-command");
+const cli_installers_1 = require("../../lib/cli-installers");
+const daemon_target_1 = require("../../lib/daemon-target");
+const first_party_harness_1 = require("../../lib/first-party-harness");
+/**
+ * `skrr code update` — pull the engine's signed release down through the daemon.
+ *
+ * ── Why this command exists ────────────────────────────────────────────────
+ *
+ * The update verb has been API-exposed and daemon-implemented since OSK-10096 —
+ * `POST /api/daemons/:id/cli-installers/:provider/update` re-fetches the signed
+ * manifest and installs whatever the channel points at. But the only CLI that
+ * reached it was `skrr harnesses install <provider> --update`: a flag on a
+ * command a `code` user has no reason to read. On stable that left no
+ * discoverable path at all — `code install` answered "Already installed." with
+ * no next step, and the channel moving past the installed build was invisible
+ * from the surface that owns the engine (OSK-10650).
+ *
+ * So this adds a SURFACE and no mechanism. Same route `harnesses install
+ * --update` posts, same inventory pre-check, same 504 recovery — one update
+ * path, spelled where the engine's users look.
+ */
+class CodeUpdate extends base_command_1.BaseCommand {
+    static description = `Update the ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine on this machine, through the daemon`;
+    static examples = [
+        '<%= config.bin %> code update',
+        '<%= config.bin %> code update --daemon <daemon-id>',
+        '<%= config.bin %> code update --json',
+    ];
+    static flags = {
+        daemon: core_1.Flags.string({
+            description: 'Which daemon runs the update. Defaults to this machine on a Dedicated Runtime, otherwise to the only active one; required when you have several.',
+        }),
+        wait: core_1.Flags.boolean({
+            default: true,
+            allowNo: true,
+            description: 'Follow the update job until it finishes. --no-wait returns the job id.',
+        }),
+        json: core_1.Flags.boolean({ description: 'Emit the result as JSON' }),
+    };
+    async run() {
+        const { flags } = await this.parse(CodeUpdate);
+        const daemonId = this.updateTarget(await this.resolveTarget(flags.daemon));
+        // Ask the inventory before posting: a daemon older than managed updates has
+        // no handler for the request and would leave it to time out, and an engine
+        // that updates some other way has a reason the daemon already words.
+        let inventory;
+        try {
+            inventory = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        const row = (inventory.providers ?? []).find((p) => (0, auth_core_1.isFirstPartyHarnessProvider)(p.provider));
+        if (!row) {
+            this.failWithCliError({
+                message: `${auth_core_1.FIRST_PARTY_HARNESS.displayName} is not installed on ${daemonId}. ` +
+                    `Install it with \`${this.config.bin} code install\`.`,
+                code: 'NOT_INSTALLED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (row.updatable === undefined) {
+            this.failWithCliError({
+                message: `The daemon ${daemonId} (${inventory.daemonVersion ?? 'version not reported'}) cannot update ${auth_core_1.FIRST_PARTY_HARNESS.displayName}: it predates managed updates. ` +
+                    `Update the daemon, then run this again.`,
+                code: 'DAEMON_UPDATE_UNSUPPORTED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (!row.updatable) {
+            this.failWithCliError({
+                message: row.updateDisabledReason?.trim() ||
+                    `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: the daemon cannot update it here.`,
+                code: 'CLI_NOT_UPDATABLE',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        const start = await this.start(daemonId, flags.json === true);
+        if (!start)
+            return;
+        const jobId = start.job?.id;
+        if (!start.started || !jobId) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...start }, null, 2));
+                return;
+            }
+            this.log(start.alreadyRunning
+                ? `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: an install or update is already running (job ${start.job?.id ?? 'unknown'}).`
+                : `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: ${start.provider?.updateDisabledReason?.trim() || 'the daemon started no update job.'}`);
+            return;
+        }
+        if (!flags.wait) {
+            if (flags.json) {
+                this.log(JSON.stringify({ daemonId, ...start }, null, 2));
+                return;
+            }
+            this.log(`Update started on ${daemonId} — job ${jobId}.`);
+            return;
+        }
+        if (!flags.json) {
+            this.logToStderr(`Updating ${auth_core_1.FIRST_PARTY_HARNESS.displayName} ${row.version ? `${row.version} ` : ''}on ${daemonId}…`);
+        }
+        const job = await this.follow(daemonId, jobId, flags.json === true);
+        if (!job)
+            return;
+        if (flags.json) {
+            this.log(JSON.stringify({ daemonId, job }, null, 2));
+            if (job.status !== 'succeeded')
+                process.exitCode = 1;
+            return;
+        }
+        if (job.status === 'failed') {
+            this.failWithCliError({
+                message: job.error || 'The update failed and the daemon gave no reason.',
+                code: 'UPDATE_FAILED',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        this.log((0, cli_installers_1.updateOutcomeLine)(job) ??
+            `${auth_core_1.FIRST_PARTY_HARNESS.displayName} updated${job.installedVersion ? ` to ${job.installedVersion}` : ''}.`);
+    }
+    /** Which daemon the update targets, by the rule every daemon-picking command shares. */
+    async resolveTarget(explicit) {
+        try {
+            return await (0, daemon_target_1.resolveDaemonTarget)({
+                explicit,
+                local: (0, daemon_target_1.localMachine)({ baseURL: this.cliConfig?.baseURL }),
+                listActiveDaemons: () => (0, daemon_target_1.listConnectedDaemons)(this.resolvedCredential),
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+    /**
+     * The daemon id to update through, or the refusal — identical rules to
+     * `code install`: a Dedicated Runtime's own machine is image-managed, several
+     * connected daemons get named rather than guessed.
+     */
+    updateTarget(target) {
+        if (target.kind === 'daemon')
+            return target.daemonId;
+        if (target.kind === 'this-machine') {
+            this.failWithCliError({
+                message: target.explicit
+                    ? first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE
+                    : `${first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE} This command updates the machine it runs on; ` +
+                        'to update another of your machines, name it with --daemon.',
+                code: 'DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        if (target.kind === 'none') {
+            this.failWithCliError({
+                message: 'No daemon is connected for this account, so nothing can perform the update. ' +
+                    `Start the background service on this computer with \`${this.config.bin} daemon start\`, then run this again.`,
+                code: 'NO_DAEMON',
+                exit: 1,
+                retryable: false,
+            });
+        }
+        const { daemons } = target;
+        const choices = daemons
+            .slice(0, 10)
+            .map((d) => `  ${d.id}  ${d.name || '—'}`)
+            .join('\n');
+        this.failWithCliError({
+            message: `${daemons.length} connected daemons — say which machine should update the engine:\n${choices}\n` +
+                `Pass one with --daemon, or see each daemon id in the DAEMON ID column of \`${this.config.bin} harnesses list\`.`,
+            code: 'AMBIGUOUS_DAEMON',
+            exit: 1,
+            retryable: false,
+        });
+    }
+    /**
+     * Start the update, and survive a gateway that cut the request off — the same
+     * 504 recovery `harnesses install --update` uses: the relay can drop the
+     * answer while the daemon runs the job it started, so on a server-side
+     * failure we ask the daemon and follow the job it reports.
+     */
+    async start(daemonId, json) {
+        try {
+            return await (0, cli_installers_1.startManagedCliUpdate)(daemonId, PROVIDER, this.resolvedCredential);
+        }
+        catch (err) {
+            const status = err.status ?? 0;
+            if (status >= 500 || status === 408) {
+                const job = await (0, cli_installers_1.jobStartedDespiteTimeout)(daemonId, PROVIDER, this.resolvedCredential);
+                if (job?.id) {
+                    if (!json) {
+                        this.logToStderr(`The request to ${daemonId} did not come back (HTTP ${status}), but the daemon started job ${job.id}. Following it.`);
+                    }
+                    return { started: true, job };
+                }
+            }
+            this.handleApiError(err);
+            return undefined;
+        }
+    }
+    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
+    async follow(daemonId, jobId, json) {
+        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
+            daemonId,
+            jobId,
+            credential: this.resolvedCredential,
+            onLogLine: json ? undefined : (line) => this.logToStderr(`  ${line}`),
+        });
+        if (outcome.kind === 'missing') {
+            this.failWithCliError({
+                message: `The daemon no longer has update job ${jobId}.`,
+                code: 'JOB_MISSING',
+                exit: 1,
+                retryable: false,
+            });
+            return undefined;
+        }
+        if (outcome.kind === 'timeout') {
+            this.failWithCliError({
+                message: `Still updating after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is ` +
+                    `still working on job ${jobId}. Check \`${this.config.bin} code doctor\` in a while.`,
+                code: 'UPDATE_PENDING',
+                exit: 1,
+                retryable: true,
+            });
+            return undefined;
+        }
+        return outcome.job;
+    }
+}
+exports.default = CodeUpdate;
+/** Same canonical provider id `code install` posts — read from the identity module. */
+const PROVIDER = auth_core_1.FIRST_PARTY_HARNESS.provider;

package/dist/commands/commerce/entitlements/explain.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr commerce entitlements explain` — WHY a subject can or cannot do a thing.
+ *
+ * The read that pays for this whole topic. "This account says it cannot do X"
+ * is a support question, and the answer is a trace through offers, contracts
+ * and grants. Tracing it from a terminal — and pasting the JSON into the
+ * ticket — is the case a console makes slow.
+ *
+ * The body is passed through because the question has a real shape (subject,
+ * capability, scope type and id) that the server validates. It is a QUESTION,
+ * so nothing is mutated by asking it.
+ */
+export default class CommerceEntitlementsExplain extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commerce/entitlements/explain.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const commerce_1 = require("../../../lib/commerce");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * `skrr commerce entitlements explain` — WHY a subject can or cannot do a thing.
+ *
+ * The read that pays for this whole topic. "This account says it cannot do X"
+ * is a support question, and the answer is a trace through offers, contracts
+ * and grants. Tracing it from a terminal — and pasting the JSON into the
+ * ticket — is the case a console makes slow.
+ *
+ * The body is passed through because the question has a real shape (subject,
+ * capability, scope type and id) that the server validates. It is a QUESTION,
+ * so nothing is mutated by asking it.
+ */
+class CommerceEntitlementsExplain extends base_command_1.BaseCommand {
+    static description = 'Explain why a subject does or does not hold a capability at a scope (admin). A question — it changes nothing.';
+    static examples = [
+        '<%= config.bin %> commerce entitlements explain --file ./question.json',
+        'echo \'{"subject":{...},"capability":"...","scopeType":"workspace","scopeId":"..."}\' | <%= config.bin %> commerce entitlements explain --file -',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(CommerceEntitlementsExplain);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, commerce_1.explainCommerceEntitlement)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = CommerceEntitlementsExplain;

package/dist/commands/commerce/incidents/audit.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * What was DONE to an incident, as opposed to what it is.
+ *
+ * Kept a separate verb from `show` because the two answer different questions
+ * and one of them is the one you need when an incident looks resolved and
+ * nobody remembers who resolved it.
+ */
+export default class CommerceIncidentsAudit extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        kind: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        incident: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commerce/incidents/audit.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const commerce_1 = require("../../../lib/commerce");
+/**
+ * What was DONE to an incident, as opposed to what it is.
+ *
+ * Kept a separate verb from `show` because the two answer different questions
+ * and one of them is the one you need when an incident looks resolved and
+ * nobody remembers who resolved it.
+ */
+class CommerceIncidentsAudit extends base_command_1.BaseCommand {
+    static description = 'Show the audit trail of one marketplace incident — who acted on it and when (admin).';
+    static examples = ['<%= config.bin %> commerce incidents audit integrity <incident-id>'];
+    static args = {
+        kind: core_1.Args.string({ description: 'Incident kind', required: true, ignoreStdin: true }),
+        incident: core_1.Args.string({ description: 'Incident id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(CommerceIncidentsAudit);
+        let result;
+        try {
+            result = await (0, commerce_1.listMarketplaceIncidentAudit)(args.kind, args.incident);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = CommerceIncidentsAudit;

package/dist/commands/commerce/incidents/list.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr commerce incidents list <kind>` — the marketplace incident queue.
+ *
+ * `kind` stays a free positional rather than an enum here: the server owns the
+ * set of incident kinds, and hard-coding it in the CLI is the second
+ * declaration that drifts. An unknown kind is refused by the API with its own
+ * message, which is more useful than a stale list of options.
+ */
+export default class CommerceIncidentsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        kind: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        status: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commerce/incidents/list.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const commerce_1 = require("../../../lib/commerce");
+/**
+ * `skrr commerce incidents list <kind>` — the marketplace incident queue.
+ *
+ * `kind` stays a free positional rather than an enum here: the server owns the
+ * set of incident kinds, and hard-coding it in the CLI is the second
+ * declaration that drifts. An unknown kind is refused by the API with its own
+ * message, which is more useful than a stale list of options.
+ */
+class CommerceIncidentsList extends base_command_1.BaseCommand {
+    static description = 'List marketplace incidents of one kind — the queue an operator triages (admin).';
+    static examples = [
+        '<%= config.bin %> commerce incidents list integrity',
+        '<%= config.bin %> commerce incidents list fulfillment --limit 50',
+    ];
+    static args = {
+        kind: core_1.Args.string({
+            description: 'Incident kind, as the API defines it (e.g. integrity, fulfillment)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        status: core_1.Flags.string({ description: 'Filter by status, when the API supports one' }),
+        limit: core_1.Flags.integer({ description: 'Maximum rows to return' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommerceIncidentsList);
+        let result;
+        try {
+            result = await (0, commerce_1.listMarketplaceIncidents)(args.kind, {
+                status: flags.status,
+                limit: flags.limit,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = CommerceIncidentsList;

package/dist/commands/commerce/incidents/resolve.d.ts

@@ -0,0 +1,23 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr commerce incidents resolve` — close an INTEGRITY incident.
+ *
+ * Integrity only, and not a flag on a generic verb. A fulfillment problem is
+ * RETRIED — the work runs again and the system decides. An integrity incident
+ * is RESOLVED — a person looked and stated a conclusion. Those are different
+ * acts with different evidence behind them, and a single `incidents fix` that
+ * chose between them by inspecting the kind would let a retry be recorded as a
+ * human judgement.
+ */
+export default class CommerceIncidentsResolve extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        incident: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commerce/incidents/resolve.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const commerce_1 = require("../../../lib/commerce");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * `skrr commerce incidents resolve` — close an INTEGRITY incident.
+ *
+ * Integrity only, and not a flag on a generic verb. A fulfillment problem is
+ * RETRIED — the work runs again and the system decides. An integrity incident
+ * is RESOLVED — a person looked and stated a conclusion. Those are different
+ * acts with different evidence behind them, and a single `incidents fix` that
+ * chose between them by inspecting the kind would let a retry be recorded as a
+ * human judgement.
+ */
+class CommerceIncidentsResolve extends base_command_1.BaseCommand {
+    static description = 'Resolve an integrity incident with a stated resolution (admin). For a fulfillment problem use `commerce incidents retry` — running the work again is not the same act as somebody deciding.';
+    static examples = [
+        '<%= config.bin %> commerce incidents resolve <incident-id> --file ./resolution.json',
+    ];
+    static args = {
+        incident: core_1.Args.string({
+            description: 'Integrity incident id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommerceIncidentsResolve);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, commerce_1.resolveIntegrityIncident)(args.incident, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = CommerceIncidentsResolve;

package/dist/commands/commerce/incidents/retry.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr commerce incidents retry` — run a fulfillment reconciliation again.
+ *
+ * The id is a 64-char hex digest on the server, not an opaque row id: the
+ * reconciliation is addressed by WHAT it reconciles, which is what makes a
+ * retry idempotent rather than a second attempt at a different thing. The CLI
+ * does not validate the shape — a wrong id should be refused by the authority
+ * that owns the format, with its own message.
+ */
+export default class CommerceIncidentsRetry extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        reconciliation: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commerce/incidents/retry.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const commerce_1 = require("../../../lib/commerce");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * `skrr commerce incidents retry` — run a fulfillment reconciliation again.
+ *
+ * The id is a 64-char hex digest on the server, not an opaque row id: the
+ * reconciliation is addressed by WHAT it reconciles, which is what makes a
+ * retry idempotent rather than a second attempt at a different thing. The CLI
+ * does not validate the shape — a wrong id should be refused by the authority
+ * that owns the format, with its own message.
+ */
+class CommerceIncidentsRetry extends base_command_1.BaseCommand {
+    static description = 'Retry a marketplace fulfillment reconciliation (admin). Running the work again — not a statement that somebody judged it; for that see `commerce incidents resolve`.';
+    static examples = [
+        '<%= config.bin %> commerce incidents retry <reconciliation-id>',
+        '<%= config.bin %> commerce incidents retry <reconciliation-id> --file ./retry.json',
+    ];
+    static args = {
+        reconciliation: core_1.Args.string({
+            description: 'Fulfillment reconciliation id',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(CommerceIncidentsRetry);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file, { required: false });
+        let result;
+        try {
+            result = await (0, commerce_1.retryFulfillmentReconciliation)(args.reconciliation, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = CommerceIncidentsRetry;

package/dist/commands/commerce/incidents/show.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base-command';
+export default class CommerceIncidentsShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        kind: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        incident: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/commerce/incidents/show.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const commerce_1 = require("../../../lib/commerce");
+class CommerceIncidentsShow extends base_command_1.BaseCommand {
+    static description = 'Show one marketplace incident (admin).';
+    static examples = ['<%= config.bin %> commerce incidents show integrity <incident-id>'];
+    static args = {
+        kind: core_1.Args.string({ description: 'Incident kind', required: true, ignoreStdin: true }),
+        incident: core_1.Args.string({ description: 'Incident id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(CommerceIncidentsShow);
+        let result;
+        try {
+            result = await (0, commerce_1.getMarketplaceIncident)(args.kind, args.incident);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = CommerceIncidentsShow;

package/dist/commands/commerce/offers/approve.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Step 2: somebody signs off. The server records WHO from the credential, so
+ * there is no `--actor` here — an approval a caller could attribute to someone
+ * else is not an approval.
+ */
+export default class CommerceOffersApprove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        offer: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}