@skrr-ai/cli 0.1.47 → 0.1.48

package/dist/commands/service/propose.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const dedicated_service_command_1 = require("../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../lib/dedicated-service");
+const guest_service_1 = require("../../lib/guest-service");
+const exec_1 = require("../machines/hosted/exec");
+/**
+ * `skrr service propose` — the agent lane for a service that should keep
+ * running.
+ *
+ * Runs INSIDE a Dedicated Runtime guest: the spec is written to the daemon's
+ * workload socket and lands as a proposal the owner approves or rejects —
+ * nothing runs on the proposal alone. The daemon derives who proposed it
+ * from the calling process, so provenance is real, not a claim in the JSON.
+ */
+class ServicePropose extends base_command_1.BaseCommand {
+    static summary = 'Propose an always-on service to this machine’s owner (guest-local)';
+    static description = 'Writes a service spec to the machine’s daemon, which parks it as a pending proposal. ' +
+        'The owner approves it with `skrr machines dedicated service approve <lease-id> <name>` — ' +
+        'approval is what makes it run. Runs only on a Dedicated Runtime guest.';
+    static examples = [
+        '<%= config.bin %> service propose --file service.json',
+        '<%= config.bin %> service propose --name worker --cwd /workspace/repos/app -- node dist/worker.js',
+    ];
+    static usage = 'service propose [flags] -- <command...>';
+    static args = {
+        command: core_1.Args.string({
+            description: 'The service command and its arguments, after --',
+            multiple: true,
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        ...dedicated_service_command_1.serviceSpecFlags,
+        file: core_1.Flags.string({ description: 'Read the spec from a service.json file instead of flags' }),
+        json: core_1.Flags.boolean({ description: 'Output the proposal as JSON' }),
+    };
+    async run() {
+        if (!(0, dedicated_service_1.runningOnDedicatedRuntimeGuest)()) {
+            this.error('`skrr service propose` runs inside a Dedicated Runtime guest — this is not one. ' +
+                'To declare a service on your own machine use `skrr machines dedicated service create <lease-id> …`.', { exit: 2 });
+        }
+        const { head, tail } = (0, exec_1.splitExecArgv)(this.argv);
+        const { args, flags } = await this.parse(ServicePropose, head);
+        let spec;
+        try {
+            spec = this.resolveSpec(flags, tail ?? args.command ?? []);
+        }
+        catch (err) {
+            if (err instanceof dedicated_service_1.DedicatedServiceError)
+                this.error(err.message, { exit: 2 });
+            throw err;
+        }
+        const errors = (0, dedicated_service_1.validateServiceSpec)(spec);
+        if (errors.length > 0) {
+            this.error(`The service spec is not valid:\n${errors.map((e) => `  - ${e}`).join('\n')}`, {
+                exit: 2,
+            });
+        }
+        let proposalId;
+        let reply;
+        try {
+            ({ proposalId, reply } = await (0, guest_service_1.proposeGuestService)(spec));
+        }
+        catch (err) {
+            if (err instanceof dedicated_service_1.DedicatedServiceError)
+                this.error(err.message, { exit: 1 });
+            throw err;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ proposalId: proposalId || undefined, spec: (0, dedicated_service_1.specPayload)(spec), reply }, null, 2));
+            return;
+        }
+        this.log(`Proposed service ${spec.name}${proposalId ? ` (proposal ${proposalId})` : ''}. ` +
+            'Nothing runs until the owner approves it with ' +
+            `\`skrr machines dedicated service approve <lease-id> ${spec.name}\`.`);
+    }
+    resolveSpec(flags, argv) {
+        const file = flags.file;
+        const flagSpecUsed = Boolean(flags.name ||
+            flags.cwd ||
+            flags.env?.length ||
+            flags.restart ||
+            flags.notify !== undefined ||
+            flags['stop-timeout'] !== undefined ||
+            flags['limit-memory'] ||
+            flags['limit-cpu'] !== undefined ||
+            flags['limit-pids'] !== undefined);
+        if (file && (flagSpecUsed || argv.length > 0)) {
+            throw new dedicated_service_1.DedicatedServiceError('--file is the whole spec — it cannot be combined with spec flags or a command after --.', 'SPEC_INVALID');
+        }
+        if (file)
+            return (0, guest_service_1.readGuestSpecFile)(file);
+        return (0, dedicated_service_1.specFromFlags)({
+            name: flags.name,
+            argv,
+            cwd: flags.cwd,
+            env: (0, dedicated_service_1.parseEnvEntries)(flags.env),
+            restart: flags.restart,
+            notify: flags.notify,
+            stopTimeoutSeconds: flags['stop-timeout'],
+            limits: {
+                memoryMax: flags['limit-memory'],
+                cpuQuotaPercent: flags['limit-cpu'],
+                pidsMax: flags['limit-pids'],
+            },
+        });
+    }
+}
+exports.default = ServicePropose;

package/dist/commands/service/status.d.ts

@@ -0,0 +1,17 @@
+import { GuestServiceCommand } from '../../lib/guest-service-command';
+/**
+ * `skrr service status` — one service's computed state, read on the machine
+ * itself (guest-local, read-only). The `systemctl status` of a guest: tenant
+ * code sees its own services without a credential or a round-trip to the API.
+ */
+export default class ServiceStatus extends GuestServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/service/status.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const guest_service_command_1 = require("../../lib/guest-service-command");
+const format_1 = require("../../lib/format");
+const dedicated_service_1 = require("../../lib/dedicated-service");
+/**
+ * `skrr service status` — one service's computed state, read on the machine
+ * itself (guest-local, read-only). The `systemctl status` of a guest: tenant
+ * code sees its own services without a credential or a round-trip to the API.
+ */
+class ServiceStatus extends guest_service_command_1.GuestServiceCommand {
+    static summary = 'One service’s computed state on this machine (guest-local)';
+    static examples = [
+        '<%= config.bin %> service status <name>',
+        '<%= config.bin %> service status <name> --json',
+    ];
+    static args = {
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireGuest();
+        const { args, flags } = await this.parse(ServiceStatus);
+        const reply = await this.guestRead('status', { name: args.name });
+        const result = (reply.result ?? reply);
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const spec = result.spec ?? {};
+        this.log(`service ${args.name}`);
+        const row = (label, value) => {
+            const cell = (0, format_1.formatCell)(value);
+            if (cell !== '-')
+                this.log(`  ${label.padEnd(13)}${cell}`);
+        };
+        // detail arrives as a string or a structured object — render its fields.
+        row('status', [result.status, (0, dedicated_service_1.serviceDetailText)(result.detail)].filter(Boolean).join(' — ') || undefined);
+        row('restart', spec.restart);
+        row('command', Array.isArray(spec.command) ? spec.command.join(' ') : spec.shell);
+        row('cwd', spec.cwd);
+        row('updated', spec.updatedAt ? (0, format_1.localStamp)(spec.updatedAt) : undefined);
+        const exits = result.exits ?? [];
+        if (exits.length > 0) {
+            this.log('');
+            this.log('recent exits:');
+            for (const exit of exits.slice(-10)) {
+                this.log(`  ${(0, format_1.localStamp)(exit.at)}  exit ${exit.exitCode ?? '-'}${exit.signal ? ` ${exit.signal}` : ''}`);
+            }
+        }
+    }
+}
+exports.default = ServiceStatus;

package/dist/commands/spaces/auto-executor/runs.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base-command';
+export default class SpacesAutoExecutorRuns extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/spaces/auto-executor/runs.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const space_output_1 = require("../../../lib/space-output");
+class SpacesAutoExecutorRuns extends base_command_1.BaseCommand {
+    static description = "List a space's recent auto-orchestration runs and its Lead health";
+    static examples = [
+        '<%= config.bin %> spaces auto-executor runs <space-id>',
+        '<%= config.bin %> spaces auto-executor runs <space-id> --limit 50 --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Space ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        limit: core_1.Flags.integer({
+            description: 'Maximum runs to return (server clamps to 1..50, default 20)',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(SpacesAutoExecutorRuns);
+        let result;
+        try {
+            result = await data_provider_1.dataService.getSpaceOrchestrationRuns(args.id, flags.limit);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify((0, space_output_1.withSpacePerspectiveUrl)(this.cliConfig.baseURL, args.id, 'execution', { result }), null, 2));
+            return;
+        }
+        this.log(`Orchestration: ${result.enabled ? 'enabled' : 'disabled'}`);
+        this.log(`Lead health:   ${result.leadHealth}`);
+        if (result.consecutiveFailures > 0) {
+            this.log(`Failures:      ${result.consecutiveFailures} consecutive`);
+        }
+        if (result.lastFailureReason) {
+            this.log(`Last failure:  ${result.lastFailureReason}`);
+        }
+        if (result.runs.length === 0) {
+            this.log('No orchestration runs recorded.');
+            return;
+        }
+        this.log('');
+        for (const run of result.runs) {
+            const when = run.triggeredAt ?? 'unknown-time';
+            const failure = run.failureReason ? ` — ${run.failureReason}` : '';
+            this.log(`${when}  ${run.status}${failure}`);
+        }
+    }
+}
+exports.default = SpacesAutoExecutorRuns;

package/dist/commands/store/governance/artifacts.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance artifacts` — the catalogue, searched by what an
+ * artifact CAN DO rather than what it is called.
+ *
+ * Distinct from `skrr store browse`, which finds published agents to install.
+ * This searches every governed entity type by capability, permission,
+ * verified outcome and cost — the questions you ask when deciding what a
+ * workspace should be licensed for, not which agent you personally want.
+ */
+export default class StoreGovernanceArtifacts extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'entity-type': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        capability: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        permission: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'verified-outcome': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'min-cost-micros': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'max-cost-micros': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/artifacts.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance artifacts` — the catalogue, searched by what an
+ * artifact CAN DO rather than what it is called.
+ *
+ * Distinct from `skrr store browse`, which finds published agents to install.
+ * This searches every governed entity type by capability, permission,
+ * verified outcome and cost — the questions you ask when deciding what a
+ * workspace should be licensed for, not which agent you personally want.
+ */
+class StoreGovernanceArtifacts extends base_command_1.BaseCommand {
+    static description = 'Search the governed store catalogue by capability, permission, verified outcome and cost. For finding an agent to install, use `store browse`.';
+    static examples = [
+        '<%= config.bin %> store governance artifacts --capability code_review',
+        '<%= config.bin %> store governance artifacts --entity-type skill --max-cost-micros 500000',
+    ];
+    static flags = {
+        'entity-type': core_1.Flags.string({
+            description: 'agent, skill, action, service, team, bundle, space_template or connector',
+        }),
+        capability: core_1.Flags.string({ description: 'Capability the artifact provides' }),
+        permission: core_1.Flags.string({ description: 'Permission the artifact requires' }),
+        'verified-outcome': core_1.Flags.string({ description: 'A verified outcome key it claims' }),
+        'min-cost-micros': core_1.Flags.integer({ description: 'Lower bound on cost, in micros' }),
+        'max-cost-micros': core_1.Flags.integer({ description: 'Upper bound on cost, in micros' }),
+        limit: core_1.Flags.integer({ description: 'Maximum rows (1-100)' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernanceArtifacts);
+        let result;
+        try {
+            result = await (0, governed_store_1.searchGovernedStoreArtifacts)({
+                entityType: flags['entity-type'],
+                capability: flags.capability,
+                permission: flags.permission,
+                verifiedOutcome: flags['verified-outcome'],
+                minCostMicros: flags['min-cost-micros'],
+                maxCostMicros: flags['max-cost-micros'],
+                limit: flags.limit,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceArtifacts;

package/dist/commands/store/governance/assign.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/** Give a workspace-held license to a member or a Space. */
+export default class StoreGovernanceAssign extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        to: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'assignment-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/assign.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/** Give a workspace-held license to a member or a Space. */
+class StoreGovernanceAssign extends base_command_1.BaseCommand {
+    static description = 'Assign a workspace-held license to a member or a Space — who actually gets to run it.';
+    static examples = [
+        '<%= config.bin %> store governance assign <workspace-id> --license <id> --to member:<user-id>',
+        '<%= config.bin %> store governance assign <workspace-id> --license <id> --to space:<space-id>',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        license: core_1.Flags.string({ description: 'License to assign', required: true }),
+        to: core_1.Flags.string({
+            description: 'member:<user-id> or space:<space-id>',
+            required: true,
+        }),
+        'assignment-id': core_1.Flags.string({ description: 'Assignment id, for a deterministic retry' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceAssign);
+        // `member:` / `space:` rather than two flags, because the two are mutually
+        // exclusive and a pair of optional flags lets you pass both or neither.
+        const separator = flags.to.indexOf(':');
+        const assigneeType = separator > 0 ? flags.to.slice(0, separator) : '';
+        const assigneeId = separator > 0 ? flags.to.slice(separator + 1) : '';
+        if (!['member', 'space'].includes(assigneeType) || !assigneeId) {
+            this.error(`--to must be member:<user-id> or space:<space-id>, got "${flags.to}"`, {
+                exit: 2,
+            });
+        }
+        let result;
+        try {
+            result = await (0, governed_store_1.assignWorkspaceStoreLicense)(args.workspace, {
+                licenseId: flags.license,
+                assigneeType: assigneeType,
+                assigneeId,
+                ...(flags['assignment-id'] ? { assignmentId: flags['assignment-id'] } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceAssign;

package/dist/commands/store/governance/create-license.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Mint a bundle license against an acquisition (admin).
+ *
+ * A license always cites WHAT paid for it — a commercial order or a contract —
+ * so the body carries that acquisition source. That link is the reason a
+ * license can be audited at all, and it is not something a CLI should let you
+ * omit by defaulting.
+ */
+export default class StoreGovernanceCreateLicense extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/create-license.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Mint a bundle license against an acquisition (admin).
+ *
+ * A license always cites WHAT paid for it — a commercial order or a contract —
+ * so the body carries that acquisition source. That link is the reason a
+ * license can be audited at all, and it is not something a CLI should let you
+ * omit by defaulting.
+ */
+class StoreGovernanceCreateLicense extends base_command_1.BaseCommand {
+    static description = 'Mint a bundle license against a commercial order or contract (admin).';
+    static examples = [
+        '<%= config.bin %> store governance create-license --file ./license.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernanceCreateLicense);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, governed_store_1.createGovernedStoreLicense)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceCreateLicense;

package/dist/commands/store/governance/install-plan.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance install-plan` — what installing this release WOULD do.
+ *
+ * A plan, not an install, and the name says so. It resolves the release
+ * against a license, the workspace policy and the environment you declare, and
+ * answers whether it is permitted and what it would pull. That is the read an
+ * operator wants before spending anything — and the reason it is here rather
+ * than folded into `store install`, which installs.
+ */
+export default class StoreGovernanceInstallPlan extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        release: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/install-plan.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * `skrr store governance install-plan` — what installing this release WOULD do.
+ *
+ * A plan, not an install, and the name says so. It resolves the release
+ * against a license, the workspace policy and the environment you declare, and
+ * answers whether it is permitted and what it would pull. That is the read an
+ * operator wants before spending anything — and the reason it is here rather
+ * than folded into `store install`, which installs.
+ */
+class StoreGovernanceInstallPlan extends base_command_1.BaseCommand {
+    static description = 'Resolve what installing a governed release would do — license, workspace policy and environment. Installs nothing.';
+    static examples = [
+        '<%= config.bin %> store governance install-plan <release-id>',
+        '<%= config.bin %> store governance install-plan <release-id> --workspace <id> --license <id>',
+        '<%= config.bin %> store governance install-plan <release-id> --file ./environment.json',
+    ];
+    static args = {
+        release: core_1.Args.string({ description: 'Release id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        license: core_1.Flags.string({ description: 'License to resolve against' }),
+        workspace: core_1.Flags.string({ description: 'Workspace whose policy applies' }),
+        space: core_1.Flags.string({ description: 'Space the install would land in' }),
+        file: core_1.Flags.string({
+            description: 'JSON with an `environment` object (platformVersion, runtimeKind, …), or -',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceInstallPlan);
+        const extra = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file, { required: false });
+        let result;
+        try {
+            result = await (0, governed_store_1.resolveGovernedStoreInstallPlan)({
+                ...extra,
+                releaseId: args.release,
+                ...(flags.license ? { licenseId: flags.license } : {}),
+                ...(flags.workspace ? { workspaceId: flags.workspace } : {}),
+                ...(flags.space ? { spaceId: flags.space } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceInstallPlan;

package/dist/commands/store/governance/license-policy.d.ts

@@ -0,0 +1,30 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance license-policy` — how a license takes updates.
+ *
+ * ONE command over two endpoints, because the only difference between them is
+ * WHOSE license it is: yours, or the workspace's. `--workspace` picks the
+ * second, and the server resolves the actor from the route rather than from
+ * anything the caller asserts. Two owners can hold licenses over the same
+ * release and may change different things, so the distinction is real — it is
+ * just not a reason to make an operator remember two verb names.
+ *
+ * `--expect-revision` is REQUIRED by the API, not by convenience: an update
+ * policy decides which releases run, and a blind write could silently move a
+ * workspace onto a release somebody else had just pinned away from.
+ */
+export default class StoreGovernanceLicensePolicy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        license: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        policy: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        release: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/license-policy.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance license-policy` — how a license takes updates.
+ *
+ * ONE command over two endpoints, because the only difference between them is
+ * WHOSE license it is: yours, or the workspace's. `--workspace` picks the
+ * second, and the server resolves the actor from the route rather than from
+ * anything the caller asserts. Two owners can hold licenses over the same
+ * release and may change different things, so the distinction is real — it is
+ * just not a reason to make an operator remember two verb names.
+ *
+ * `--expect-revision` is REQUIRED by the API, not by convenience: an update
+ * policy decides which releases run, and a blind write could silently move a
+ * workspace onto a release somebody else had just pinned away from.
+ */
+class StoreGovernanceLicensePolicy extends base_command_1.BaseCommand {
+    static description = 'Set how a bundle license takes updates (manual, pinned or compatible), fenced on the revision you read. Without --workspace it changes a license you hold personally.';
+    static examples = [
+        '<%= config.bin %> store governance license-policy <license-id> --policy pinned --expect-revision 2',
+        '<%= config.bin %> store governance license-policy <license-id> --policy compatible --expect-revision 5 --workspace <workspace-id>',
+    ];
+    static args = {
+        license: core_1.Args.string({ description: 'License id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        policy: core_1.Flags.string({
+            description: 'How the license takes updates',
+            options: ['manual', 'pinned', 'compatible'],
+            required: true,
+        }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'The license revision you are changing (compare-and-set)',
+            required: true,
+        }),
+        release: core_1.Flags.string({
+            description: 'Pin to these release ids (repeatable); only meaningful with --policy pinned',
+            multiple: true,
+        }),
+        workspace: core_1.Flags.string({
+            description: 'Change the license the WORKSPACE holds, rather than your own',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceLicensePolicy);
+        const body = {
+            updatePolicy: flags.policy,
+            expectedRevision: flags['expect-revision'],
+            ...(flags.release?.length ? { selectedReleaseIds: flags.release } : {}),
+        };
+        let result;
+        try {
+            result = flags.workspace
+                ? await (0, governed_store_1.updateWorkspaceLicensePolicy)(flags.workspace, args.license, body)
+                : await (0, governed_store_1.updateOwnLicensePolicy)(args.license, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceLicensePolicy;