@skrr-ai/cli 0.1.47 → 0.1.48

package/dist/commands/store/governance/policy.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance policy` — which releases a workspace may run at all.
+ *
+ * `deny_all` and `allowlist` are the two modes the server accepts, and the
+ * command refuses an allowlist with nothing in it: an empty allowlist and
+ * `deny_all` have the same effect but say different things, and a workspace
+ * that reads "allowlist" while permitting nothing is a policy nobody can
+ * explain six months later. If you mean deny everything, say `deny_all`.
+ */
+export default class StoreGovernancePolicy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        mode: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        release: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'policy-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/policy.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance policy` — which releases a workspace may run at all.
+ *
+ * `deny_all` and `allowlist` are the two modes the server accepts, and the
+ * command refuses an allowlist with nothing in it: an empty allowlist and
+ * `deny_all` have the same effect but say different things, and a workspace
+ * that reads "allowlist" while permitting nothing is a policy nobody can
+ * explain six months later. If you mean deny everything, say `deny_all`.
+ */
+class StoreGovernancePolicy extends base_command_1.BaseCommand {
+    static description = 'Set which governed releases a workspace may run. `deny_all`, or an allowlist of release ids.';
+    static examples = [
+        '<%= config.bin %> store governance policy <workspace-id> --mode deny_all',
+        '<%= config.bin %> store governance policy <workspace-id> --mode allowlist --release <id> --release <id>',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        mode: core_1.Flags.string({
+            description: 'deny_all, or allowlist the releases named by --release',
+            options: ['deny_all', 'allowlist'],
+            required: true,
+        }),
+        release: core_1.Flags.string({
+            description: 'Release id to allow (repeatable). Required with --mode allowlist.',
+            multiple: true,
+        }),
+        'policy-id': core_1.Flags.string({ description: 'Policy id, when replacing a specific one' }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'The policy revision you are replacing (compare-and-set)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernancePolicy);
+        const releases = flags.release ?? [];
+        if (flags.mode === 'allowlist' && releases.length === 0) {
+            this.error('An allowlist with no --release permits nothing, which is what --mode deny_all says plainly. Pass at least one release, or say deny_all.', { exit: 2 });
+        }
+        let result;
+        try {
+            result = await (0, governed_store_1.setWorkspaceStorePolicy)(args.workspace, {
+                mode: flags.mode,
+                allowedReleaseIds: releases,
+                ...(flags['policy-id'] ? { policyId: flags['policy-id'] } : {}),
+                ...(flags['expect-revision'] !== undefined
+                    ? { expectedRevision: flags['expect-revision'] }
+                    : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernancePolicy;

package/dist/commands/store/governance/publish-release.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Publish one artifact release into the governed catalogue (admin).
+ *
+ * The body carries verified-outcome evidence, which is why it is a file rather
+ * than flags: evidence is a list of records with sources and timestamps, and
+ * assembling that from a command line is how a claim loses its provenance.
+ */
+export default class StoreGovernancePublishRelease extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/publish-release.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Publish one artifact release into the governed catalogue (admin).
+ *
+ * The body carries verified-outcome evidence, which is why it is a file rather
+ * than flags: evidence is a list of records with sources and timestamps, and
+ * assembling that from a command line is how a claim loses its provenance.
+ */
+class StoreGovernancePublishRelease extends base_command_1.BaseCommand {
+    static description = 'Publish an artifact release into the governed store catalogue (admin).';
+    static examples = [
+        '<%= config.bin %> store governance publish-release --file ./release.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernancePublishRelease);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, governed_store_1.publishGovernedStoreRelease)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernancePublishRelease;

package/dist/commands/tasks/deliverable/add.d.ts

@@ -25,7 +25,22 @@ export default class TasksDeliverableAdd extends BaseCommand {
         expectation: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'run-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'no-upload': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Archive the bytes and let the upload's own ledger receipt BE the
+     * Deliverable record.
+     *
+     * One record, not two: the receipt is keyed on the same coordinate this
+     * command would have recorded, so the archived copy and the citation are one
+     * Resource rather than a path nobody can open beside an opaque blob nobody
+     * can match to it.
+     *
+     * Returns false when the file cannot be archived and the caller should fall
+     * back to recording the coordinate alone.
+     */
+    private archive;
 }

package/dist/commands/tasks/deliverable/add.js

@@ -1,8 +1,44 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
+const task_asset_upload_1 = require("../../../lib/task-asset-upload");
 const outbox_1 = require("../../../lib/outbox");
 const api_fetch_1 = require("../../../lib/api-fetch");
 const session_task_endpoints_1 = require("../../../lib/session-task-endpoints");
@@ -68,6 +104,15 @@ class TasksDeliverableAdd extends base_command_1.BaseCommand {
         expectation: core_1.Flags.string({ multiple: true, description: 'Expectation id this satisfies' }),
         'run-id': core_1.Flags.string({ description: 'Run that produced it' }),
         'idempotency-key': core_1.Flags.string({ description: 'Stable retry key' }),
+        file: core_1.Flags.string({
+            description: "Archive THIS file as the Deliverable's exact content, when the bytes are somewhere " +
+                'other than the coordinate. Without it a coordinate that already names a readable ' +
+                'local file is archived automatically.',
+        }),
+        'no-upload': core_1.Flags.boolean({
+            description: 'Record the coordinate only. The Deliverable stays `locator_only`: nothing pins which ' +
+                'revision it is, and nobody can open it from the web app.',
+        }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
@@ -84,6 +129,45 @@ class TasksDeliverableAdd extends base_command_1.BaseCommand {
             this.error('--status and deprecated --lifecycle cannot disagree', { exit: 1 });
         }
         const status = flags.status || flags.lifecycle;
+        // A bare path has no global meaning and nothing to open — the CLI's own
+        // help says so. Archiving the bytes is what turns it into something a
+        // person can click and a digest can pin, so a coordinate that already
+        // names a readable local file is archived by default.
+        //
+        // Not when the caller is pinning an EXTERNAL system's version
+        // (--provider/--version/--content-digest): that names a revision in
+        // somebody else's namespace, and a local file of the same name is not
+        // evidence about it.
+        const pinsExternalVersion = Boolean(flags.provider || flags.version || flags['content-digest']);
+        const archivePath = flags['no-upload']
+            ? null
+            : flags.file
+                ? flags.file
+                : pinsExternalVersion
+                    ? null
+                    : localFileFor(parsed.value);
+        if (flags.file && flags['no-upload']) {
+            this.error('--file and --no-upload cannot both be given', { exit: 1 });
+        }
+        let archiveRefused = false;
+        if (archivePath) {
+            const uploaded = await this.archive({
+                taskId: args.task,
+                filePath: archivePath,
+                identity: parsed.value.identity,
+                title: flags.title,
+                expectationIds: flags.expectation,
+                requestedStatus: status,
+                json: Boolean(flags.json),
+                // `--file` is an instruction; a coordinate that happens to name a file
+                // is an inference. Only the inference is size-bounded.
+                auto: !flags.file,
+            });
+            if (uploaded)
+                return;
+            // It tried and said why; the closing hint below would only repeat it.
+            archiveRefused = true;
+        }
         let result;
         try {
             const payload = {
@@ -116,6 +200,96 @@ class TasksDeliverableAdd extends base_command_1.BaseCommand {
         }
         const where = parsed.value.location ? ` at ${parsed.value.location}` : '';
         this.log(`Recorded Deliverable ${result.link.id}: ${parsed.value.kind}:${parsed.value.identity}${where} (${status || 'local'}; self reported).`);
+        if (!pinsExternalVersion && !flags['no-upload'] && !archiveRefused) {
+            this.log('No copy was archived, so nothing pins this version and it cannot be opened from the ' +
+                'web app. Pass --file <path> to archive the bytes.');
+        }
+    }
+    /**
+     * Archive the bytes and let the upload's own ledger receipt BE the
+     * Deliverable record.
+     *
+     * One record, not two: the receipt is keyed on the same coordinate this
+     * command would have recorded, so the archived copy and the citation are one
+     * Resource rather than a path nobody can open beside an opaque blob nobody
+     * can match to it.
+     *
+     * Returns false when the file cannot be archived and the caller should fall
+     * back to recording the coordinate alone.
+     */
+    async archive(opts) {
+        let stat;
+        try {
+            stat = fs.statSync(opts.filePath);
+        }
+        catch {
+            this.error(`File not found: ${opts.filePath}`, { exit: 1 });
+            return false;
+        }
+        if (!stat.isFile()) {
+            this.error(`Not a regular file: ${opts.filePath}`, { exit: 1 });
+            return false;
+        }
+        // The platform archives a file of any supported size under its own name.
+        // What is bounded is the INFERENCE: `deliverable add code:…@build/out.bin`
+        // should not quietly send 400 MB because the coordinate resolved to a
+        // path. Naming the file with --file says do it anyway, and the only limit
+        // left is the platform's own.
+        if (opts.auto && stat.size > data_provider_1.TASK_ATTACHMENT_MAX_BYTES) {
+            const mb = Math.floor(data_provider_1.TASK_ATTACHMENT_MAX_BYTES / (1024 * 1024));
+            this.warn(`${path.basename(opts.filePath)} is larger than ${mb} MB, so it was not archived ` +
+                'automatically. Pass --file to archive it anyway.');
+            return false;
+        }
+        let asset;
+        try {
+            asset = await (0, task_asset_upload_1.uploadTaskAssetFile)({
+                taskId: opts.taskId,
+                filePath: opts.filePath,
+                role: 'deliverable',
+                ledger: {
+                    identity: opts.identity,
+                    title: opts.title,
+                    expectationIds: opts.expectationIds,
+                },
+            });
+        }
+        catch (err) {
+            this.handleApiError(err);
+            return false;
+        }
+        if (opts.json) {
+            this.log(JSON.stringify({ archived: asset, identity: opts.identity }, null, 2));
+            return true;
+        }
+        this.log(`Recorded Deliverable ${opts.identity} — archived copy ${asset.id} ` +
+            `(sha256 pinned; observed available; self reported).`);
+        if (opts.requestedStatus && opts.requestedStatus !== 'available') {
+            // Not silent: the platform WATCHED these bytes land, which is a stronger
+            // and verified statement than the one that was asked for. Who vouched
+            // is unchanged — still `self_reported`, still nobody else's word.
+            this.log(`--status ${opts.requestedStatus} did not apply: an archived copy is observed available.`);
+        }
+        return true;
     }
 }
 exports.default = TasksDeliverableAdd;
+/**
+ * The local file a coordinate already names, if it names one. `location` is
+ * checked first because it is where the thing IS; `identity` is the fallback
+ * for the common `file:docs/x.md` with no location.
+ */
+function localFileFor(value) {
+    for (const candidate of [value.location, value.identity]) {
+        if (!candidate)
+            continue;
+        try {
+            if (fs.statSync(candidate).isFile())
+                return candidate;
+        }
+        catch {
+            /* not a local file */
+        }
+    }
+    return null;
+}

package/dist/commands/tasks/deliverable/archive.d.ts

@@ -0,0 +1,35 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr tasks deliverable archive <task>`
+ *
+ * Backfill for Deliverables recorded before archiving existed, or recorded
+ * with `--no-upload`. They are bare coordinates: nothing pins which revision
+ * they are, and nobody can open them from the web app.
+ *
+ * This is a CLI command and not a server migration, and that is not a
+ * shortcut. A Deliverable recorded as `docs/policies/payout.md` names a file
+ * the server has never seen and cannot reach — the bytes exist on the machine
+ * that produced them. Only something running THERE can archive them, so the
+ * backfill has to be a command someone runs in the working tree, not a job
+ * that sweeps a collection.
+ *
+ * What it will not do: guess. A row is archived only when its own coordinate
+ * resolves to a readable regular file relative to the current directory. Every
+ * row it skips is reported with the reason, because a backfill that silently
+ * covers 3 of 5 is worse than one that covers none.
+ */
+export default class TasksDeliverableArchive extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        task: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        task: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'dry-run': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'max-bytes': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private report;
+}

package/dist/commands/tasks/deliverable/archive.js

@@ -0,0 +1,205 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const task_resolver_1 = require("../../../lib/task-resolver");
+const task_asset_upload_1 = require("../../../lib/task-asset-upload");
+/**
+ * `skrr tasks deliverable archive <task>`
+ *
+ * Backfill for Deliverables recorded before archiving existed, or recorded
+ * with `--no-upload`. They are bare coordinates: nothing pins which revision
+ * they are, and nobody can open them from the web app.
+ *
+ * This is a CLI command and not a server migration, and that is not a
+ * shortcut. A Deliverable recorded as `docs/policies/payout.md` names a file
+ * the server has never seen and cannot reach — the bytes exist on the machine
+ * that produced them. Only something running THERE can archive them, so the
+ * backfill has to be a command someone runs in the working tree, not a job
+ * that sweeps a collection.
+ *
+ * What it will not do: guess. A row is archived only when its own coordinate
+ * resolves to a readable regular file relative to the current directory. Every
+ * row it skips is reported with the reason, because a backfill that silently
+ * covers 3 of 5 is worse than one that covers none.
+ */
+class TasksDeliverableArchive extends base_command_1.BaseCommand {
+    static description = 'Archive the bytes of Deliverables that are still bare coordinates.\n' +
+        '\n' +
+        'Run it from the directory their paths are relative to — usually the repository root. ' +
+        'Each row whose coordinate resolves to a readable local file is uploaded and recorded ' +
+        'against those exact bytes, converging onto the SAME Deliverable rather than adding a ' +
+        'second one. Rows that already carry an archived copy are left alone.';
+    static examples = [
+        '<%= config.bin %> tasks deliverable archive <task-id> --dry-run',
+        '<%= config.bin %> tasks deliverable archive <task-id>',
+    ];
+    static args = {
+        task: core_1.Args.string({ required: false, ignoreStdin: true, description: 'Task id or ref' }),
+    };
+    static flags = {
+        task: core_1.Flags.string({ description: 'Task id; overrides runtime context' }),
+        'dry-run': core_1.Flags.boolean({
+            description: 'Report what would be archived and upload nothing',
+        }),
+        'max-bytes': core_1.Flags.integer({
+            description: `Skip files larger than this (default ${data_provider_1.TASK_ATTACHMENT_MAX_BYTES})`,
+            default: data_provider_1.TASK_ATTACHMENT_MAX_BYTES,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(TasksDeliverableArchive);
+        const task = (0, task_resolver_1.resolveTaskIdentity)({ positionalId: args.task, flagTask: flags.task });
+        let listed;
+        try {
+            listed = await data_provider_1.dataService.listTaskDeliverables(task.id);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        const plan = (listed.data || []).map((row) => classify(row, flags['max-bytes']));
+        const actionable = plan.filter((entry) => entry.action === 'archive');
+        if (flags['dry-run']) {
+            const report = { taskId: task.id, dryRun: true, plan };
+            if (flags.json)
+                return this.log(JSON.stringify(report, null, 2));
+            return this.report(plan, []);
+        }
+        const results = [];
+        for (const entry of actionable) {
+            try {
+                const asset = await (0, task_asset_upload_1.uploadTaskAssetFile)({
+                    taskId: task.id,
+                    filePath: entry.filePath,
+                    role: 'deliverable',
+                    ledger: {
+                        identity: entry.identity,
+                        title: entry.title,
+                        expectationIds: entry.expectationIds,
+                    },
+                });
+                results.push({ identity: entry.identity, ok: true, attachmentId: asset.id });
+            }
+            catch (error) {
+                results.push({
+                    identity: entry.identity,
+                    ok: false,
+                    reason: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        if (flags.json) {
+            return this.log(JSON.stringify({ taskId: task.id, plan, results }, null, 2));
+        }
+        this.report(plan, results);
+        if (results.some((entry) => !entry.ok)) {
+            this.error(`${results.filter((entry) => !entry.ok).length} Deliverable(s) failed to archive`, {
+                exit: 1,
+            });
+        }
+    }
+    report(plan, results) {
+        const byIdentity = new Map(results.map((entry) => [entry.identity, entry]));
+        for (const entry of plan) {
+            const outcome = byIdentity.get(entry.identity);
+            if (entry.action === 'archive' && !outcome) {
+                this.log(`would archive  ${entry.identity}  (${entry.filePath})`);
+            }
+            else if (outcome?.ok) {
+                this.log(`archived       ${entry.identity}  → ${outcome.attachmentId}`);
+            }
+            else if (outcome) {
+                this.log(`FAILED         ${entry.identity}  — ${outcome.reason}`);
+            }
+            else {
+                this.log(`skipped        ${entry.identity}  — ${entry.reason}`);
+            }
+        }
+        if (!plan.length)
+            this.log('No Deliverables recorded.');
+    }
+}
+exports.default = TasksDeliverableArchive;
+/**
+ * One row's verdict. Every `skip` carries the reason it was skipped — the
+ * whole point of the command is that a partial backfill says which part.
+ */
+function classify(row, maxBytes) {
+    const identity = row.identity || row.location || row.title || '';
+    const base = {
+        linkId: row.linkId,
+        identity,
+        title: row.title,
+        expectationIds: row.expectationIds,
+        action: 'skip',
+    };
+    if (row.managedContentRef) {
+        return { ...base, reason: 'already archived' };
+    }
+    if (!identity) {
+        return { ...base, reason: 'no coordinate to resolve' };
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(row.location || identity)) {
+        return { ...base, reason: 'remote locator — nothing local to archive' };
+    }
+    for (const candidate of [row.location, identity]) {
+        if (!candidate)
+            continue;
+        let stat;
+        try {
+            stat = fs.statSync(candidate);
+        }
+        catch {
+            continue;
+        }
+        if (!stat.isFile())
+            continue;
+        if (stat.size > maxBytes) {
+            return {
+                ...base,
+                reason: `${path.basename(candidate)} is ${stat.size} bytes, over the ${maxBytes} limit`,
+            };
+        }
+        return { ...base, action: 'archive', filePath: candidate };
+    }
+    return { ...base, reason: 'no readable local file at this coordinate' };
+}

package/dist/commands/tasks/labels/detach.js

@@ -21,6 +21,9 @@ class TasksLabelsDetach extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output the updated task as JSON' }),
         'label-id': core_1.Flags.string({
+            // Same alias `attach` carries: `--label` is what `spaces labels
+            // remove` takes, and the two directions should spell one flag alike.
+            aliases: ['label'],
             description: 'Label to detach — id, or a name from `skrr labels list --applicable-to task` (repeatable)',
             multiple: true,
             required: true,

package/dist/commands/tasks/labels/suggest.d.ts

@@ -0,0 +1,24 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Ask the lightweight model which of the DECLARED labels fit this task —
+ * `POST /api/tasks/:taskId/labels/suggest`, the on-demand half of the
+ * create-time `_labelGuidance` hint. The server keeps the suggestion off the
+ * task-create path (the hottest write in the product); this command is how a
+ * caller pays for one suggestion when it actually wants it.
+ *
+ * Same contract as create: the model may only CHOOSE from the declared
+ * vocabulary, a label the task already wears is never suggested, and a
+ * suggestion is a proposal, not a write — attach is still the caller's
+ * decision (`tasks labels attach --label <id>`).
+ */
+export default class TasksLabelsSuggest extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}