@skrr-ai/cli 0.1.46 → 0.1.48

package/dist/lib/enterprise-commerce.d.ts

@@ -0,0 +1,67 @@
+/**
+ * `/api/commerce/admin/enterprise/*` — the enterprise half of the commerce
+ * control plane: workspace profiles, domain verification, commercial
+ * contracts, budget policies, financial documents and finance-close snapshots.
+ *
+ * It lives under the `/api/commerce` mount and under the `skrr enterprise`
+ * TOPIC, and that is deliberate. A mount is where the server happened to put a
+ * router; a topic is what an operator is trying to do. Somebody administering
+ * an enterprise deployment wants its contracts, budgets and audit export in
+ * one place, and does not know or care that one of them is served from a
+ * different router than the others.
+ *
+ * Every route is written out at its own call site rather than composed from a
+ * builder: the parity checker reads a LITERAL there and deliberately refuses a
+ * composed path. Bodies are passed through and validated by the server, so the
+ * CLI never becomes a second declaration of a contract or budget shape.
+ */
+/** `PUT /workspaces/:workspaceId/profile` — the enterprise profile itself. */
+export declare function upsertEnterpriseProfile(workspaceId: string, body: Record<string, unknown>): Promise<unknown>;
+/**
+ * `POST /workspaces/:workspaceId/domains/begin` — start proving a domain.
+ *
+ * Two calls, not one, and the gap between them is the point: `begin` hands
+ * back a challenge you have to publish somewhere you control, and `verify`
+ * goes and looks. A single command that did both would either block on DNS or
+ * report a request as a result.
+ */
+export declare function beginEnterpriseDomainVerification(workspaceId: string, body: Record<string, unknown>): Promise<unknown>;
+/** `POST /workspaces/:workspaceId/domains/verify` — check the published challenge. */
+export declare function verifyEnterpriseDomain(workspaceId: string, body: Record<string, unknown>): Promise<unknown>;
+/**
+ * The contract lifecycle: create → issue (mints it with Stripe) → activate.
+ *
+ * Three doors, because `issue` is the one that reaches an external provider
+ * and `activate` is the one that starts billing. Collapsing them into a
+ * `--state` flag would hide which of those a command is about to do.
+ */
+/** `POST /contracts` — draft a commercial contract. */
+export declare function createEnterpriseContract(body: Record<string, unknown>): Promise<unknown>;
+/** `POST /contracts/:contractId/issue` — mint it with Stripe. Reaches a provider. */
+export declare function issueEnterpriseContract(contractId: string, body?: Record<string, unknown>): Promise<unknown>;
+/** `POST /contracts/:contractId/activate` — it starts billing. */
+export declare function activateEnterpriseContract(contractId: string, body?: Record<string, unknown>): Promise<unknown>;
+/** `POST /budgets` — draft a hierarchical budget policy. */
+export declare function createEnterpriseBudget(body: Record<string, unknown>): Promise<unknown>;
+/** `POST /budgets/:policyId/publish` — it starts constraining spend. */
+export declare function publishEnterpriseBudget(policyId: string, body?: Record<string, unknown>): Promise<unknown>;
+/**
+ * `POST /budgets/evaluate` — what would this spend do, against the published
+ * policies?
+ *
+ * A read shaped like a write: it changes nothing and answers a question about
+ * a hypothetical charge, which is why it is the one budget verb safe to run
+ * whenever you are unsure.
+ */
+export declare function evaluateEnterpriseBudget(body: Record<string, unknown>): Promise<unknown>;
+/**
+ * `POST /financial-documents/manual` — record a document the platform did not
+ * generate.
+ *
+ * `manual` is in the route for a reason and the CLI keeps the word: this is
+ * the door for a document that came from somewhere else, and it is not the
+ * same thing as the platform producing one.
+ */
+export declare function recordEnterpriseFinancialDocument(body: Record<string, unknown>): Promise<unknown>;
+/** `POST /finance-close-snapshots` — freeze a period's figures. */
+export declare function createEnterpriseFinanceCloseSnapshot(body: Record<string, unknown>): Promise<unknown>;

package/dist/lib/enterprise-commerce.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upsertEnterpriseProfile = upsertEnterpriseProfile;
+exports.beginEnterpriseDomainVerification = beginEnterpriseDomainVerification;
+exports.verifyEnterpriseDomain = verifyEnterpriseDomain;
+exports.createEnterpriseContract = createEnterpriseContract;
+exports.issueEnterpriseContract = issueEnterpriseContract;
+exports.activateEnterpriseContract = activateEnterpriseContract;
+exports.createEnterpriseBudget = createEnterpriseBudget;
+exports.publishEnterpriseBudget = publishEnterpriseBudget;
+exports.evaluateEnterpriseBudget = evaluateEnterpriseBudget;
+exports.recordEnterpriseFinancialDocument = recordEnterpriseFinancialDocument;
+exports.createEnterpriseFinanceCloseSnapshot = createEnterpriseFinanceCloseSnapshot;
+const api_fetch_1 = require("./api-fetch");
+/**
+ * `/api/commerce/admin/enterprise/*` — the enterprise half of the commerce
+ * control plane: workspace profiles, domain verification, commercial
+ * contracts, budget policies, financial documents and finance-close snapshots.
+ *
+ * It lives under the `/api/commerce` mount and under the `skrr enterprise`
+ * TOPIC, and that is deliberate. A mount is where the server happened to put a
+ * router; a topic is what an operator is trying to do. Somebody administering
+ * an enterprise deployment wants its contracts, budgets and audit export in
+ * one place, and does not know or care that one of them is served from a
+ * different router than the others.
+ *
+ * Every route is written out at its own call site rather than composed from a
+ * builder: the parity checker reads a LITERAL there and deliberately refuses a
+ * composed path. Bodies are passed through and validated by the server, so the
+ * CLI never becomes a second declaration of a contract or budget shape.
+ */
+/** `PUT /workspaces/:workspaceId/profile` — the enterprise profile itself. */
+async function upsertEnterpriseProfile(workspaceId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/commerce/admin/enterprise/workspaces/${encodeURIComponent(workspaceId)}/profile`, { method: 'PUT', body });
+}
+/**
+ * `POST /workspaces/:workspaceId/domains/begin` — start proving a domain.
+ *
+ * Two calls, not one, and the gap between them is the point: `begin` hands
+ * back a challenge you have to publish somewhere you control, and `verify`
+ * goes and looks. A single command that did both would either block on DNS or
+ * report a request as a result.
+ */
+async function beginEnterpriseDomainVerification(workspaceId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/commerce/admin/enterprise/workspaces/${encodeURIComponent(workspaceId)}/domains/begin`, { method: 'POST', body });
+}
+/** `POST /workspaces/:workspaceId/domains/verify` — check the published challenge. */
+async function verifyEnterpriseDomain(workspaceId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/commerce/admin/enterprise/workspaces/${encodeURIComponent(workspaceId)}/domains/verify`, { method: 'POST', body });
+}
+/**
+ * The contract lifecycle: create → issue (mints it with Stripe) → activate.
+ *
+ * Three doors, because `issue` is the one that reaches an external provider
+ * and `activate` is the one that starts billing. Collapsing them into a
+ * `--state` flag would hide which of those a command is about to do.
+ */
+/** `POST /contracts` — draft a commercial contract. */
+async function createEnterpriseContract(body) {
+    return (0, api_fetch_1.apiFetch)('/api/commerce/admin/enterprise/contracts', { method: 'POST', body });
+}
+/** `POST /contracts/:contractId/issue` — mint it with Stripe. Reaches a provider. */
+async function issueEnterpriseContract(contractId, body = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/commerce/admin/enterprise/contracts/${encodeURIComponent(contractId)}/issue`, { method: 'POST', body });
+}
+/** `POST /contracts/:contractId/activate` — it starts billing. */
+async function activateEnterpriseContract(contractId, body = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/commerce/admin/enterprise/contracts/${encodeURIComponent(contractId)}/activate`, { method: 'POST', body });
+}
+/** `POST /budgets` — draft a hierarchical budget policy. */
+async function createEnterpriseBudget(body) {
+    return (0, api_fetch_1.apiFetch)('/api/commerce/admin/enterprise/budgets', { method: 'POST', body });
+}
+/** `POST /budgets/:policyId/publish` — it starts constraining spend. */
+async function publishEnterpriseBudget(policyId, body = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/commerce/admin/enterprise/budgets/${encodeURIComponent(policyId)}/publish`, { method: 'POST', body });
+}
+/**
+ * `POST /budgets/evaluate` — what would this spend do, against the published
+ * policies?
+ *
+ * A read shaped like a write: it changes nothing and answers a question about
+ * a hypothetical charge, which is why it is the one budget verb safe to run
+ * whenever you are unsure.
+ */
+async function evaluateEnterpriseBudget(body) {
+    return (0, api_fetch_1.apiFetch)('/api/commerce/admin/enterprise/budgets/evaluate', {
+        method: 'POST',
+        body,
+    });
+}
+/**
+ * `POST /financial-documents/manual` — record a document the platform did not
+ * generate.
+ *
+ * `manual` is in the route for a reason and the CLI keeps the word: this is
+ * the door for a document that came from somewhere else, and it is not the
+ * same thing as the platform producing one.
+ */
+async function recordEnterpriseFinancialDocument(body) {
+    return (0, api_fetch_1.apiFetch)('/api/commerce/admin/enterprise/financial-documents/manual', {
+        method: 'POST',
+        body,
+    });
+}
+/** `POST /finance-close-snapshots` — freeze a period's figures. */
+async function createEnterpriseFinanceCloseSnapshot(body) {
+    return (0, api_fetch_1.apiFetch)('/api/commerce/admin/enterprise/finance-close-snapshots', {
+        method: 'POST',
+        body,
+    });
+}

package/dist/lib/enterprise-external-configuration.d.ts

@@ -0,0 +1,60 @@
+/**
+ * `/api/enterprise/external-configuration` — where a workspace's audit and
+ * log export lands, and whether that destination is live.
+ *
+ * Admin-gated on the server (`requireJwtAuth` + `checkAdmin`); the CLI grants
+ * nothing, it only gives the operator a way in that is not a browser. This is
+ * configuration for a deployment, which is the case the CLI exists for.
+ *
+ * Two shapes worth knowing before calling anything here:
+ *
+ * **The write is REVISION-FENCED.** `expectedRevision` is compare-and-set:
+ * present means "replace exactly this revision", absent means "create". That
+ * makes the request self-describing, so `apiFetch` derives one stable
+ * idempotency key from it and a retry after a lost response REPLAYS instead of
+ * colliding — the rule in `packages/data-provider/src/idempotency.ts`. Never
+ * omit it to force a write through; omitting it is a different intent.
+ *
+ * **Activation is a REQUEST, not a result.** `activate` enqueues a
+ * verification job and answers 202. The evidence that the destination really
+ * accepts writes is produced by the writer and verifier workloads, never by
+ * the caller — which is why there is no way to hand it in from here.
+ */
+/** Shape is owned by the service; the CLI prints it and does not interpret it. */
+export interface EnterpriseExternalConfiguration {
+    configurationId?: string;
+    workspaceId?: string;
+    revision?: number;
+    status?: string;
+    configuration?: unknown;
+    updatedBy?: string;
+    updatedAt?: string;
+    [key: string]: unknown;
+}
+export interface EnterpriseExternalConfigurationVerificationJob {
+    id?: string;
+    status?: string;
+    [key: string]: unknown;
+}
+/** `GET /:workspaceId` — 404 when the workspace has never been configured. */
+export declare function getEnterpriseExternalConfiguration(workspaceId: string): Promise<{
+    configuration: EnterpriseExternalConfiguration;
+}>;
+/** `PUT /:workspaceId` — create (no `expectedRevision`) or replace one exact revision. */
+export declare function upsertEnterpriseExternalConfiguration(workspaceId: string, input: {
+    configuration: unknown;
+    configurationId?: string;
+    expectedRevision?: number;
+}): Promise<{
+    configuration: EnterpriseExternalConfiguration;
+}>;
+/** `POST /:workspaceId/activate` — enqueue verification. 202; nothing is live yet. */
+export declare function activateEnterpriseExternalConfiguration(workspaceId: string): Promise<{
+    verificationJob: EnterpriseExternalConfigurationVerificationJob;
+}>;
+/** `POST /:workspaceId/suspend` — stop exporting. Fenced on the exact revision. */
+export declare function suspendEnterpriseExternalConfiguration(workspaceId: string, expectedRevision: number): Promise<{
+    configuration: EnterpriseExternalConfiguration;
+}>;
+/** One readable block for a configuration, shared by every command here. */
+export declare function describeEnterpriseExternalConfiguration(configuration: EnterpriseExternalConfiguration): string[];

package/dist/lib/enterprise-external-configuration.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getEnterpriseExternalConfiguration = getEnterpriseExternalConfiguration;
+exports.upsertEnterpriseExternalConfiguration = upsertEnterpriseExternalConfiguration;
+exports.activateEnterpriseExternalConfiguration = activateEnterpriseExternalConfiguration;
+exports.suspendEnterpriseExternalConfiguration = suspendEnterpriseExternalConfiguration;
+exports.describeEnterpriseExternalConfiguration = describeEnterpriseExternalConfiguration;
+const api_fetch_1 = require("./api-fetch");
+/*
+ * Each route is written out at its own call site, rather than composed by a
+ * `path(id, suffix)` helper. That is not repetition for its own sake: the
+ * parity checker reads a LITERAL at the call site and deliberately refuses to
+ * resolve a composed one, because a path it cannot read is an endpoint it
+ * reports as unreachable — and the cure people reach for is an allowlist entry
+ * for something that was fine. Keeping the route visible here keeps the gate
+ * able to see it.
+ */
+/** `GET /:workspaceId` — 404 when the workspace has never been configured. */
+async function getEnterpriseExternalConfiguration(workspaceId) {
+    return (0, api_fetch_1.apiFetch)(`/api/enterprise/external-configuration/${encodeURIComponent(workspaceId)}`);
+}
+/** `PUT /:workspaceId` — create (no `expectedRevision`) or replace one exact revision. */
+async function upsertEnterpriseExternalConfiguration(workspaceId, input) {
+    return (0, api_fetch_1.apiFetch)(`/api/enterprise/external-configuration/${encodeURIComponent(workspaceId)}`, {
+        method: 'PUT',
+        body: {
+            configuration: input.configuration,
+            ...(input.configurationId ? { configurationId: input.configurationId } : {}),
+            ...(input.expectedRevision !== undefined
+                ? { expectedRevision: input.expectedRevision }
+                : {}),
+        },
+    });
+}
+/** `POST /:workspaceId/activate` — enqueue verification. 202; nothing is live yet. */
+async function activateEnterpriseExternalConfiguration(workspaceId) {
+    return (0, api_fetch_1.apiFetch)(`/api/enterprise/external-configuration/${encodeURIComponent(workspaceId)}/activate`, { method: 'POST', body: {} });
+}
+/** `POST /:workspaceId/suspend` — stop exporting. Fenced on the exact revision. */
+async function suspendEnterpriseExternalConfiguration(workspaceId, expectedRevision) {
+    return (0, api_fetch_1.apiFetch)(`/api/enterprise/external-configuration/${encodeURIComponent(workspaceId)}/suspend`, { method: 'POST', body: { expectedRevision } });
+}
+/** One readable block for a configuration, shared by every command here. */
+function describeEnterpriseExternalConfiguration(configuration) {
+    const lines = [`workspace   ${configuration.workspaceId ?? '(unknown)'}`];
+    if (configuration.configurationId)
+        lines.push(`id          ${configuration.configurationId}`);
+    if (configuration.status)
+        lines.push(`status      ${configuration.status}`);
+    // Printed on every read because it is what the next write must fence on.
+    if (configuration.revision !== undefined)
+        lines.push(`revision    ${configuration.revision}`);
+    if (configuration.updatedAt)
+        lines.push(`updated     ${configuration.updatedAt}`);
+    if (configuration.updatedBy)
+        lines.push(`updated by  ${configuration.updatedBy}`);
+    return lines;
+}

package/dist/lib/first-party-harness.js

@@ -443,17 +443,21 @@ const BYOK_AWS_NON_SECRETS = new Set([
  * credentials. Only the second class is ever something a `skrr code` run is
  * supposed to spend, so only the second class comes back below. `OVERSKY_TOKEN`
  * is the one this whole filter exists for and is covered twice — by name and by
- * the `OVERSKY_` prefix — on purpose.
+ * the `OVERSKY_` prefix — on purpose. `SKRR_TOKEN` is the supported renamed
+ * spelling of the same credential (`cli/src/lib/config.ts` honors both), so it
+ * gets identical name + prefix coverage — a deny-list with a hole is not a
+ * deny-list.
  */
 const ENGINE_NEVER_INHERITS = new Set([
     'OVERSKY_TOKEN',
+    'SKRR_TOKEN',
     'CLAUDE_CODE_OAUTH_TOKEN',
     'LITELLM_MASTER_KEY',
     'GH_TOKEN',
     'GITHUB_TOKEN',
     'NPM_TOKEN',
 ]);
-const ENGINE_NEVER_INHERITS_PREFIXES = ['OVERSKY_', 'AWS_'];
+const ENGINE_NEVER_INHERITS_PREFIXES = ['OVERSKY_', 'SKRR_', 'AWS_'];
 /**
  * The provider credentials this environment offers a BYOK run, by name.
  *
@@ -626,7 +630,17 @@ function engineOwnedEnv(env) {
     }
     if (!(0, auth_core_1.readFirstPartyHarnessEngineEnv)(env, 'home').value)
         return {};
-    return Object.fromEntries(Object.entries(everyName(engineInstructionHome(env))).filter(([name]) => !(typeof env[name] === 'string' && env[name].trim() !== '')));
+    const out = Object.fromEntries(Object.entries(everyName(engineInstructionHome(env))).filter(([name]) => !(typeof env[name] === 'string' && env[name].trim() !== '')));
+    // The current-namespace name (`SKRR_CODE_HOME`) sits under the shared
+    // sanitizer's SKRR_ sweep, so ambient inheritance no longer carries it —
+    // pass the user's own spelling through explicitly, verbatim. Legacy names
+    // (`SKY_CODE_*`) are not under that prefix and still inherit.
+    const currentName = auth_core_1.FIRST_PARTY_HARNESS_ENGINE.env.home;
+    const currentValue = env[currentName];
+    if (typeof currentValue === 'string' && currentValue.trim() !== '') {
+        out[currentName] = currentValue;
+    }
+    return out;
 }
 async function execEngine(args, env = process.env, options = {}) {
     // Move an engine installed under an older binary name onto the canonical one,

package/dist/lib/governed-store.d.ts

@@ -0,0 +1,110 @@
+/**
+ * `/api/store/governance` — who may RUN what, and which exact release.
+ *
+ * Distinct from `skrr store browse|install|releases|update`, which is the
+ * published-AGENT surface: you find one, you get your own copy. This mount is
+ * the licensing and policy plane over the whole artifact catalogue — agents,
+ * skills, actions, services, teams, bundles, space templates and connectors —
+ * where a license grants an owner the right to run a release and a workspace
+ * policy says which releases may run at all.
+ *
+ * Keeping them as one `store` topic with a `governance` subtopic is the
+ * decision this file records. They are the same catalogue seen two ways, and
+ * splitting them into two top-level nouns would repeat the `skrr machines
+ * hosted` collision the parity spec already documents — two surfaces sharing a
+ * word, only one of which has a CLI.
+ *
+ * Every route is written out at its own call site rather than composed from a
+ * builder: the parity checker reads a LITERAL there and deliberately refuses a
+ * composed path, so a helper would turn real coverage into a reported gap.
+ */
+/** Both license-policy doors take this; the actor is what differs. */
+export interface BundleLicensePolicyInput {
+    updatePolicy: 'manual' | 'pinned' | 'compatible';
+    /** Compare-and-set. The server requires it: a license policy is never blind-written. */
+    expectedRevision: number;
+    selectedReleaseIds?: string[];
+}
+export interface StoreArtifactQuery {
+    entityType?: string;
+    capability?: string;
+    permission?: string;
+    verifiedOutcome?: string;
+    minCostMicros?: number;
+    maxCostMicros?: number;
+    limit?: number;
+}
+/**
+ * `GET /artifacts` — search the catalogue by capability, permission and cost.
+ *
+ * The query rides in `withQuery` rather than being interpolated into the
+ * literal: the parity checker reads the LITERAL at the call site, and a query
+ * baked into it resolves to a path no route matches — so a covered endpoint
+ * would report as unreachable.
+ */
+export declare function searchGovernedStoreArtifacts(input: StoreArtifactQuery): Promise<{
+    artifacts: unknown[];
+}>;
+/**
+ * `POST /install-plan` — what installing this release would actually do.
+ *
+ * A PLAN, not an install. It resolves the release against a license, a
+ * workspace policy and the environment you declare, and answers whether the
+ * install is permitted and what it would pull — which is the read an operator
+ * wants before spending anything.
+ */
+export declare function resolveGovernedStoreInstallPlan(body: {
+    releaseId: string;
+    licenseId?: string;
+    workspaceId?: string;
+    spaceId?: string;
+    environment?: Record<string, unknown>;
+}): Promise<{
+    plan: unknown;
+}>;
+/** `POST /admin/releases` — publish one artifact release. Admin. */
+export declare function publishGovernedStoreRelease(body: Record<string, unknown>): Promise<{
+    release: unknown;
+}>;
+/** `POST /admin/licenses` — mint a bundle license against an acquisition. Admin. */
+export declare function createGovernedStoreLicense(body: Record<string, unknown>): Promise<{
+    license: unknown;
+}>;
+/**
+ * `PATCH /licenses/:licenseId/update-policy` — change how a license you hold
+ * AS A PERSON takes updates.
+ */
+export declare function updateOwnLicensePolicy(licenseId: string, body: BundleLicensePolicyInput): Promise<{
+    license: unknown;
+}>;
+/**
+ * `PATCH /workspaces/:workspaceId/licenses/:licenseId/update-policy` — the same
+ * change for a license the WORKSPACE holds.
+ *
+ * A separate door rather than a flag on the one above, because the server
+ * resolves a different actor (`actorOwnerType`) from the route itself. Two
+ * owners can hold licenses over the same release, and which one you are
+ * decides what you may change — so the CLI keeps them distinguishable instead
+ * of inferring it.
+ */
+export declare function updateWorkspaceLicensePolicy(workspaceId: string, licenseId: string, body: BundleLicensePolicyInput): Promise<{
+    license: unknown;
+}>;
+/** `PUT /workspaces/:workspaceId/policy` — which releases a workspace may run. */
+export declare function setWorkspaceStorePolicy(workspaceId: string, body: {
+    mode: 'deny_all' | 'allowlist';
+    allowedReleaseIds: string[];
+    policyId?: string;
+    expectedRevision?: number;
+}): Promise<{
+    policy: unknown;
+}>;
+/** `POST /workspaces/:workspaceId/assignments` — give a seat to a member or Space. */
+export declare function assignWorkspaceStoreLicense(workspaceId: string, body: {
+    licenseId: string;
+    assigneeType: 'member' | 'space';
+    assigneeId: string;
+    assignmentId?: string;
+}): Promise<{
+    assignment: unknown;
+}>;

package/dist/lib/governed-store.js

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.searchGovernedStoreArtifacts = searchGovernedStoreArtifacts;
+exports.resolveGovernedStoreInstallPlan = resolveGovernedStoreInstallPlan;
+exports.publishGovernedStoreRelease = publishGovernedStoreRelease;
+exports.createGovernedStoreLicense = createGovernedStoreLicense;
+exports.updateOwnLicensePolicy = updateOwnLicensePolicy;
+exports.updateWorkspaceLicensePolicy = updateWorkspaceLicensePolicy;
+exports.setWorkspaceStorePolicy = setWorkspaceStorePolicy;
+exports.assignWorkspaceStoreLicense = assignWorkspaceStoreLicense;
+const api_fetch_1 = require("./api-fetch");
+const triggers_1 = require("./triggers");
+/**
+ * `GET /artifacts` — search the catalogue by capability, permission and cost.
+ *
+ * The query rides in `withQuery` rather than being interpolated into the
+ * literal: the parity checker reads the LITERAL at the call site, and a query
+ * baked into it resolves to a path no route matches — so a covered endpoint
+ * would report as unreachable.
+ */
+async function searchGovernedStoreArtifacts(input) {
+    return (0, api_fetch_1.apiFetch)((0, triggers_1.withQuery)('/api/store/governance/artifacts', { ...input }));
+}
+/**
+ * `POST /install-plan` — what installing this release would actually do.
+ *
+ * A PLAN, not an install. It resolves the release against a license, a
+ * workspace policy and the environment you declare, and answers whether the
+ * install is permitted and what it would pull — which is the read an operator
+ * wants before spending anything.
+ */
+async function resolveGovernedStoreInstallPlan(body) {
+    return (0, api_fetch_1.apiFetch)('/api/store/governance/install-plan', {
+        method: 'POST',
+        body,
+    });
+}
+/** `POST /admin/releases` — publish one artifact release. Admin. */
+async function publishGovernedStoreRelease(body) {
+    return (0, api_fetch_1.apiFetch)('/api/store/governance/admin/releases', {
+        method: 'POST',
+        body,
+    });
+}
+/** `POST /admin/licenses` — mint a bundle license against an acquisition. Admin. */
+async function createGovernedStoreLicense(body) {
+    return (0, api_fetch_1.apiFetch)('/api/store/governance/admin/licenses', {
+        method: 'POST',
+        body,
+    });
+}
+/**
+ * `PATCH /licenses/:licenseId/update-policy` — change how a license you hold
+ * AS A PERSON takes updates.
+ */
+async function updateOwnLicensePolicy(licenseId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/governance/licenses/${encodeURIComponent(licenseId)}/update-policy`, { method: 'PATCH', body });
+}
+/**
+ * `PATCH /workspaces/:workspaceId/licenses/:licenseId/update-policy` — the same
+ * change for a license the WORKSPACE holds.
+ *
+ * A separate door rather than a flag on the one above, because the server
+ * resolves a different actor (`actorOwnerType`) from the route itself. Two
+ * owners can hold licenses over the same release, and which one you are
+ * decides what you may change — so the CLI keeps them distinguishable instead
+ * of inferring it.
+ */
+async function updateWorkspaceLicensePolicy(workspaceId, licenseId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/licenses/${encodeURIComponent(licenseId)}/update-policy`, { method: 'PATCH', body });
+}
+/** `PUT /workspaces/:workspaceId/policy` — which releases a workspace may run. */
+async function setWorkspaceStorePolicy(workspaceId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/policy`, { method: 'PUT', body });
+}
+/** `POST /workspaces/:workspaceId/assignments` — give a seat to a member or Space. */
+async function assignWorkspaceStoreLicense(workspaceId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/assignments`, { method: 'POST', body });
+}

package/dist/lib/guest-service-command.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../base-command';
+import { type GuestServiceReply } from './guest-service';
+/**
+ * `skrr service ls|status|logs` — the guest-local read verbs.
+ *
+ * They run INSIDE a Dedicated Runtime guest on the daemon's workload socket;
+ * SO_PEERCRED is the credential, so no login is required and `requireAuth`
+ * is deliberately absent — an agent's Bash tool has no token and needs none.
+ */
+export declare abstract class GuestServiceCommand extends BaseCommand {
+    protected requireGuest(): void;
+    protected guestRead(op: 'list' | 'status' | 'logs', args?: {
+        name?: string;
+        tailBytes?: number;
+    }): Promise<GuestServiceReply>;
+}

package/dist/lib/guest-service-command.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GuestServiceCommand = void 0;
+const base_command_1 = require("../base-command");
+const dedicated_service_1 = require("./dedicated-service");
+const guest_service_1 = require("./guest-service");
+/**
+ * `skrr service ls|status|logs` — the guest-local read verbs.
+ *
+ * They run INSIDE a Dedicated Runtime guest on the daemon's workload socket;
+ * SO_PEERCRED is the credential, so no login is required and `requireAuth`
+ * is deliberately absent — an agent's Bash tool has no token and needs none.
+ */
+class GuestServiceCommand extends base_command_1.BaseCommand {
+    requireGuest() {
+        if (!(0, dedicated_service_1.runningOnDedicatedRuntimeGuest)()) {
+            this.error('This command reads services on a Dedicated Runtime guest, and this is not one. ' +
+                'From your own machine use `skrr machines dedicated service …`.', { exit: 2 });
+        }
+    }
+    async guestRead(op, args = {}) {
+        try {
+            return await (0, guest_service_1.callGuestServiceRead)(op, args);
+        }
+        catch (err) {
+            if (err instanceof dedicated_service_1.DedicatedServiceError)
+                this.error(err.message, { exit: 1 });
+            throw err;
+        }
+    }
+}
+exports.GuestServiceCommand = GuestServiceCommand;

package/dist/lib/guest-service.d.ts

@@ -0,0 +1,67 @@
+import { connect as connectSocket } from 'node:net';
+import { type DedicatedServiceSpec } from './dedicated-service';
+/**
+ * The guest-local service lane — `skrr service propose` and its read verbs,
+ * running INSIDE a Dedicated Runtime guest.
+ *
+ * Design: docs/architecture/dedicated-runtime-always-on-workloads-2026-09-21.md
+ * §5.6 (proposals) and §10.1 (guest-local status). The daemon listens on
+ * `/run/skrr-dedicated-runtime/service-propose/service-propose.sock` inside
+ * a workload-owned, daemon-group directory — the directory mode is the
+ * audience gate, so nothing here carries a token. The wire is one
+ * newline-terminated JSON request per connection:
+ *
+ *   propose → {"verb": "propose", "spec": {...}} — the daemon validates the
+ *             spec and derives `createdBy` from the peer's pid →
+ *             DaemonSession; a claim in the payload is ignored
+ *   reads   → {"verb": "list" | "status" | "logs", "name"?, "tailBytes"?}
+ *
+ * and the daemon answers one JSON line back:
+ *
+ *   {ok: true, ...verb-shaped fields}  or  {ok: false, error}
+ *
+ * The newline is the frame terminator — a document without one is left
+ * unread by design (the daemon cannot distinguish it from a truncated
+ * request).
+ */
+export interface GuestServiceReply {
+    ok?: boolean;
+    proposalId?: string;
+    result?: unknown;
+    error?: string;
+    code?: string;
+    [key: string]: unknown;
+}
+export declare const GUEST_SERVICE_CALL_TIMEOUT_MS = 15000;
+/**
+ * Write one document to the propose socket and read the daemon's one reply.
+ * Half-closing after the write is the "request is complete" signal — a
+ * keep-alive protocol would need framing the design does not specify.
+ */
+export declare function callGuestServiceSocket(document: Record<string, unknown>, options?: {
+    socketPath?: string;
+    timeoutMs?: number;
+    connect?: typeof connectSocket;
+}): Promise<GuestServiceReply>;
+/** `skrr service propose` — hand the daemon a spec, get back a proposal id. */
+export declare function proposeGuestService(spec: DedicatedServiceSpec, options?: {
+    socketPath?: string;
+    connect?: typeof connectSocket;
+}): Promise<{
+    proposalId: string;
+    reply: GuestServiceReply;
+}>;
+/**
+ * `skrr service ls|status|logs` — the read verbs on the same socket. The
+ * daemon returns `result` in whatever shape the verb defines; the commands
+ * render it, they do not reinterpret it.
+ */
+export declare function callGuestServiceRead(op: 'list' | 'status' | 'logs', args?: {
+    name?: string;
+    tailBytes?: number;
+}, options?: {
+    socketPath?: string;
+    connect?: typeof connectSocket;
+}): Promise<GuestServiceReply>;
+/** Parse and validate a spec document read from a file the guest hands the daemon. */
+export declare function readGuestSpecFile(filePath: string): DedicatedServiceSpec;