@skrr-ai/cli 0.1.47 → 0.1.49

package/dist/commands/native.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nativeProfileFlag = void 0;
+exports.profilePassthrough = profilePassthrough;
+exports.buildNativeArgs = buildNativeArgs;
+exports.forwardNativeCommand = forwardNativeCommand;
+const core_1 = require("@oclif/core");
+const exec_runtime_binary_1 = require("../lib/exec-runtime-binary");
+/**
+ * `--profile` is a GLOBAL flag on the runtime binary, so every `skrr native`
+ * subcommand has to declare it to be reachable — `native status` itself tells
+ * users "use --profile to target one" when sibling profiles have live daemons,
+ * and without this declaration that advice could not be followed (OSK-11100).
+ */
+exports.nativeProfileFlag = {
+    profile: core_1.Flags.string({
+        description: 'Which daemon profile to target — `native status` lists the running ones',
+    }),
+};
+/** The passthrough form of the parsed profile flag, or nothing. */
+function profilePassthrough(profile) {
+    return profile ? ['--profile', profile] : [];
+}
+function buildNativeArgs(passthrough) {
+    return ['native', ...passthrough];
+}
+/**
+ * Forward one `skrr native` command to the daemon.
+ *
+ * Native application control is consent that belongs to the person at the
+ * machine, so the setting lives in that machine's `daemon.json` and a cloud
+ * request can never write it (OSK-11018). The CLI is a bridge for the same
+ * reason `skrr browser` is: the capability is the daemon's, and a second
+ * implementation here would be a second place for the policy to drift.
+ *
+ * Until this existed the setting had NO command at all. The executor's own
+ * refusal told users to "set `nativeUi.enabled` and `nativeUi.allowCloudAgents`
+ * in the local daemon configuration" — a file it did not name — so the product's
+ * answer to "how do I turn this on" was to open a JSON file.
+ */
+async function forwardNativeCommand(command, passthrough) {
+    try {
+        if ((await (0, exec_runtime_binary_1.runtimeBinarySupportsSubcommand)('native')) === false) {
+            command.error('The local `skrr` daemon does not support native application control yet. ' +
+                'Update or reinstall the daemon, then retry `skrr native`.', { exit: 2 });
+        }
+        command.exit(await (0, exec_runtime_binary_1.execRuntimeBinary)(buildNativeArgs(passthrough)));
+    }
+    catch (error) {
+        if (error.message === 'runtime-binary-not-installed') {
+            command.log((0, exec_runtime_binary_1.notInstalledMessage)());
+            command.exit(127);
+        }
+        throw error;
+    }
+}
+/**
+ * `skrr native` is the stable user-facing entry point for native application
+ * control. Keeping it a thin bridge is what stops the REST CLI acquiring its
+ * own copy of the app-scope rules.
+ */
+class Native extends core_1.Command {
+    static description = 'Configure and diagnose native application control on this computer';
+    static examples = [
+        '<%= config.bin %> native status',
+        '<%= config.bin %> native enable --cloud-agents',
+        '<%= config.bin %> native list-apps',
+        '<%= config.bin %> native allow "Slack"',
+    ];
+    static strict = false;
+    async run() {
+        const { argv } = await this.parse(Native);
+        await forwardNativeCommand(this, argv);
+    }
+}
+exports.default = Native;

package/dist/commands/service/index.d.ts

@@ -0,0 +1,14 @@
+import { Command } from '@oclif/core';
+/**
+ * `skrr service` — the guest-local face of declared services.
+ *
+ * These commands run INSIDE a Dedicated Runtime guest, on the daemon's
+ * workload socket — the lane agents use to propose a service to the owner
+ * and to read what services exist. The owner-facing equivalents live at
+ * `skrr machines dedicated service`.
+ */
+export default class ServiceCommands extends Command {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/commands/service/index.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+/**
+ * `skrr service` — the guest-local face of declared services.
+ *
+ * These commands run INSIDE a Dedicated Runtime guest, on the daemon's
+ * workload socket — the lane agents use to propose a service to the owner
+ * and to read what services exist. The owner-facing equivalents live at
+ * `skrr machines dedicated service`.
+ */
+class ServiceCommands extends core_1.Command {
+    static description = 'Services on this Dedicated Runtime — propose one to the owner, or list/status/logs what is declared (guest-local)';
+    static examples = [
+        '<%= config.bin %> service propose --file service.json',
+        '<%= config.bin %> service propose --name worker --cwd /workspace/repos/app -- node dist/worker.js',
+        '<%= config.bin %> service ls',
+        '<%= config.bin %> service status <name>',
+        '<%= config.bin %> service logs <name> --tail 4096',
+    ];
+    async run() {
+        this.log('skrr service commands (run on the machine itself):');
+        this.log('  skrr service propose  ask the owner to declare a service (agent lane)');
+        this.log('  skrr service ls       list declared services');
+        this.log('  skrr service status   one service’s computed state');
+        this.log('  skrr service logs     print a service’s log tail');
+        this.log('');
+        this.log('Owner-side management from your own machine: `skrr machines dedicated service`.');
+    }
+}
+exports.default = ServiceCommands;

package/dist/commands/service/logs.d.ts

@@ -0,0 +1,18 @@
+import { GuestServiceCommand } from '../../lib/guest-service-command';
+/**
+ * `skrr service logs` — a byte tail of a service's stored log, read on the
+ * machine itself (guest-local, read-only, no follow — the owner lane follows
+ * over the relay).
+ */
+export default class ServiceLogs extends GuestServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        tail: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/service/logs.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const guest_service_command_1 = require("../../lib/guest-service-command");
+/**
+ * `skrr service logs` — a byte tail of a service's stored log, read on the
+ * machine itself (guest-local, read-only, no follow — the owner lane follows
+ * over the relay).
+ */
+class ServiceLogs extends guest_service_command_1.GuestServiceCommand {
+    static summary = 'Print a service’s log tail on this machine (guest-local)';
+    static examples = [
+        '<%= config.bin %> service logs <name>',
+        '<%= config.bin %> service logs <name> --tail 4096',
+    ];
+    static args = {
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        tail: core_1.Flags.integer({
+            description: 'Bytes from the end of the stored log to print (daemon rotates at 8 MiB)',
+            min: 0,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the reply as JSON' }),
+    };
+    async run() {
+        this.requireGuest();
+        const { args, flags } = await this.parse(ServiceLogs);
+        const reply = await this.guestRead('logs', {
+            name: args.name,
+            ...(flags.tail !== undefined ? { tailBytes: flags.tail } : {}),
+        });
+        const result = (reply.result ?? reply);
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        // The daemon's `data` is base64 — write the decoded BYTES verbatim; a
+        // utf8 round-trip mangles non-text output (the same rule the owner-lane
+        // `service logs` follows).
+        if (typeof result.data === 'string' && result.data.length > 0) {
+            const bytes = Buffer.from(result.data, 'base64');
+            process.stdout.write(bytes);
+            if (bytes.length > 0 && bytes[bytes.length - 1] !== 0x0a)
+                process.stdout.write('\n');
+            return;
+        }
+        const text = result.log ?? '';
+        if (text)
+            process.stdout.write(text.endsWith('\n') ? text : `${text}\n`);
+    }
+}
+exports.default = ServiceLogs;

package/dist/commands/service/ls.d.ts

@@ -0,0 +1,13 @@
+import { GuestServiceCommand } from '../../lib/guest-service-command';
+/**
+ * `skrr service ls` — the services declared on this machine, read from the
+ * daemon's workload socket (guest-local, read-only).
+ */
+export default class ServiceLs extends GuestServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/service/ls.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const guest_service_command_1 = require("../../lib/guest-service-command");
+const format_1 = require("../../lib/format");
+/**
+ * `skrr service ls` — the services declared on this machine, read from the
+ * daemon's workload socket (guest-local, read-only).
+ */
+class ServiceLs extends guest_service_command_1.GuestServiceCommand {
+    static summary = 'List services declared on this machine (guest-local)';
+    static examples = [
+        '<%= config.bin %> service ls',
+        '<%= config.bin %> service ls --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireGuest();
+        const { flags } = await this.parse(ServiceLs);
+        const reply = await this.guestRead('list');
+        const result = (reply.result ?? reply);
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const services = result.services ?? [];
+        if (services.length === 0) {
+            this.log('No declared services on this machine.');
+            return;
+        }
+        (0, format_1.renderTable)(services.map((svc) => ({
+            // The daemon's list rows name a service only under `spec.name` —
+            // without the fallback every NAME cell renders "-".
+            name: (0, format_1.formatCell)(svc.name ?? svc.spec?.name),
+            status: (0, format_1.formatCell)(svc.status ?? 'unknown'),
+            restart: (0, format_1.formatCell)(svc.restart ?? svc.spec?.restart),
+            createdBy: (0, format_1.formatCell)(svc.createdBy ?? svc.spec?.createdBy),
+        })), [
+            { key: 'name', header: 'NAME', verbatim: true },
+            { key: 'status', header: 'STATUS' },
+            { key: 'restart', header: 'RESTART' },
+            { key: 'createdBy', header: 'CREATED BY' },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = ServiceLs;

package/dist/commands/service/propose.d.ts

@@ -0,0 +1,34 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr service propose` — the agent lane for a service that should keep
+ * running.
+ *
+ * Runs INSIDE a Dedicated Runtime guest: the spec is written to the daemon's
+ * workload socket and lands as a proposal the owner approves or rejects —
+ * nothing runs on the proposal alone. The daemon derives who proposed it
+ * from the calling process, so provenance is real, not a claim in the JSON.
+ */
+export default class ServicePropose extends BaseCommand {
+    static summary: string;
+    static description: string;
+    static examples: string[];
+    static usage: string;
+    static args: {
+        command: import("@oclif/core/lib/interfaces").Arg<string[] | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cwd: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        env: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        restart: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        notify: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'stop-timeout': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'limit-memory': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'limit-cpu': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'limit-pids': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+    private resolveSpec;
+}

package/dist/commands/service/propose.js

@@ -0,0 +1,113 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const dedicated_service_command_1 = require("../../lib/dedicated-service-command");
+const dedicated_service_1 = require("../../lib/dedicated-service");
+const guest_service_1 = require("../../lib/guest-service");
+const exec_1 = require("../machines/hosted/exec");
+/**
+ * `skrr service propose` — the agent lane for a service that should keep
+ * running.
+ *
+ * Runs INSIDE a Dedicated Runtime guest: the spec is written to the daemon's
+ * workload socket and lands as a proposal the owner approves or rejects —
+ * nothing runs on the proposal alone. The daemon derives who proposed it
+ * from the calling process, so provenance is real, not a claim in the JSON.
+ */
+class ServicePropose extends base_command_1.BaseCommand {
+    static summary = 'Propose an always-on service to this machine’s owner (guest-local)';
+    static description = 'Writes a service spec to the machine’s daemon, which parks it as a pending proposal. ' +
+        'The owner approves it with `skrr machines dedicated service approve <lease-id> <name>` — ' +
+        'approval is what makes it run. Runs only on a Dedicated Runtime guest.';
+    static examples = [
+        '<%= config.bin %> service propose --file service.json',
+        '<%= config.bin %> service propose --name worker --cwd /workspace/repos/app -- node dist/worker.js',
+    ];
+    static usage = 'service propose [flags] -- <command...>';
+    static args = {
+        command: core_1.Args.string({
+            description: 'The service command and its arguments, after --',
+            multiple: true,
+            required: false,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        ...dedicated_service_command_1.serviceSpecFlags,
+        file: core_1.Flags.string({ description: 'Read the spec from a service.json file instead of flags' }),
+        json: core_1.Flags.boolean({ description: 'Output the proposal as JSON' }),
+    };
+    async run() {
+        if (!(0, dedicated_service_1.runningOnDedicatedRuntimeGuest)()) {
+            this.error('`skrr service propose` runs inside a Dedicated Runtime guest — this is not one. ' +
+                'To declare a service on your own machine use `skrr machines dedicated service create <lease-id> …`.', { exit: 2 });
+        }
+        const { head, tail } = (0, exec_1.splitExecArgv)(this.argv);
+        const { args, flags } = await this.parse(ServicePropose, head);
+        let spec;
+        try {
+            spec = this.resolveSpec(flags, tail ?? args.command ?? []);
+        }
+        catch (err) {
+            if (err instanceof dedicated_service_1.DedicatedServiceError)
+                this.error(err.message, { exit: 2 });
+            throw err;
+        }
+        const errors = (0, dedicated_service_1.validateServiceSpec)(spec);
+        if (errors.length > 0) {
+            this.error(`The service spec is not valid:\n${errors.map((e) => `  - ${e}`).join('\n')}`, {
+                exit: 2,
+            });
+        }
+        let proposalId;
+        let reply;
+        try {
+            ({ proposalId, reply } = await (0, guest_service_1.proposeGuestService)(spec));
+        }
+        catch (err) {
+            if (err instanceof dedicated_service_1.DedicatedServiceError)
+                this.error(err.message, { exit: 1 });
+            throw err;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ proposalId: proposalId || undefined, spec: (0, dedicated_service_1.specPayload)(spec), reply }, null, 2));
+            return;
+        }
+        this.log(`Proposed service ${spec.name}${proposalId ? ` (proposal ${proposalId})` : ''}. ` +
+            'Nothing runs until the owner approves it with ' +
+            `\`skrr machines dedicated service approve <lease-id> ${spec.name}\`.`);
+    }
+    resolveSpec(flags, argv) {
+        const file = flags.file;
+        const flagSpecUsed = Boolean(flags.name ||
+            flags.cwd ||
+            flags.env?.length ||
+            flags.restart ||
+            flags.notify !== undefined ||
+            flags['stop-timeout'] !== undefined ||
+            flags['limit-memory'] ||
+            flags['limit-cpu'] !== undefined ||
+            flags['limit-pids'] !== undefined);
+        if (file && (flagSpecUsed || argv.length > 0)) {
+            throw new dedicated_service_1.DedicatedServiceError('--file is the whole spec — it cannot be combined with spec flags or a command after --.', 'SPEC_INVALID');
+        }
+        if (file)
+            return (0, guest_service_1.readGuestSpecFile)(file);
+        return (0, dedicated_service_1.specFromFlags)({
+            name: flags.name,
+            argv,
+            cwd: flags.cwd,
+            env: (0, dedicated_service_1.parseEnvEntries)(flags.env),
+            restart: flags.restart,
+            notify: flags.notify,
+            stopTimeoutSeconds: flags['stop-timeout'],
+            limits: {
+                memoryMax: flags['limit-memory'],
+                cpuQuotaPercent: flags['limit-cpu'],
+                pidsMax: flags['limit-pids'],
+            },
+        });
+    }
+}
+exports.default = ServicePropose;

package/dist/commands/service/status.d.ts

@@ -0,0 +1,17 @@
+import { GuestServiceCommand } from '../../lib/guest-service-command';
+/**
+ * `skrr service status` — one service's computed state, read on the machine
+ * itself (guest-local, read-only). The `systemctl status` of a guest: tenant
+ * code sees its own services without a credential or a round-trip to the API.
+ */
+export default class ServiceStatus extends GuestServiceCommand {
+    static summary: string;
+    static examples: string[];
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/service/status.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const guest_service_command_1 = require("../../lib/guest-service-command");
+const format_1 = require("../../lib/format");
+const dedicated_service_1 = require("../../lib/dedicated-service");
+/**
+ * `skrr service status` — one service's computed state, read on the machine
+ * itself (guest-local, read-only). The `systemctl status` of a guest: tenant
+ * code sees its own services without a credential or a round-trip to the API.
+ */
+class ServiceStatus extends guest_service_command_1.GuestServiceCommand {
+    static summary = 'One service’s computed state on this machine (guest-local)';
+    static examples = [
+        '<%= config.bin %> service status <name>',
+        '<%= config.bin %> service status <name> --json',
+    ];
+    static args = {
+        name: core_1.Args.string({ description: 'Service name', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireGuest();
+        const { args, flags } = await this.parse(ServiceStatus);
+        const reply = await this.guestRead('status', { name: args.name });
+        const result = (reply.result ?? reply);
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const spec = result.spec ?? {};
+        this.log(`service ${args.name}`);
+        const row = (label, value) => {
+            const cell = (0, format_1.formatCell)(value);
+            if (cell !== '-')
+                this.log(`  ${label.padEnd(13)}${cell}`);
+        };
+        // detail arrives as a string or a structured object — render its fields.
+        row('status', [result.status, (0, dedicated_service_1.serviceDetailText)(result.detail)].filter(Boolean).join(' — ') || undefined);
+        row('restart', spec.restart);
+        row('command', Array.isArray(spec.command) ? spec.command.join(' ') : spec.shell);
+        row('cwd', spec.cwd);
+        row('updated', spec.updatedAt ? (0, format_1.localStamp)(spec.updatedAt) : undefined);
+        const exits = result.exits ?? [];
+        if (exits.length > 0) {
+            this.log('');
+            this.log('recent exits:');
+            for (const exit of exits.slice(-10)) {
+                this.log(`  ${(0, format_1.localStamp)(exit.at)}  exit ${exit.exitCode ?? '-'}${exit.signal ? ` ${exit.signal}` : ''}`);
+            }
+        }
+    }
+}
+exports.default = ServiceStatus;

package/dist/commands/spaces/auto-executor/runs.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base-command';
+export default class SpacesAutoExecutorRuns extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/spaces/auto-executor/runs.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+const space_output_1 = require("../../../lib/space-output");
+class SpacesAutoExecutorRuns extends base_command_1.BaseCommand {
+    static description = "List a space's recent auto-orchestration runs and its Lead health";
+    static examples = [
+        '<%= config.bin %> spaces auto-executor runs <space-id>',
+        '<%= config.bin %> spaces auto-executor runs <space-id> --limit 50 --json',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Space ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        limit: core_1.Flags.integer({
+            description: 'Maximum runs to return (server clamps to 1..50, default 20)',
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(SpacesAutoExecutorRuns);
+        let result;
+        try {
+            result = await data_provider_1.dataService.getSpaceOrchestrationRuns(args.id, flags.limit);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify((0, space_output_1.withSpacePerspectiveUrl)(this.cliConfig.baseURL, args.id, 'execution', { result }), null, 2));
+            return;
+        }
+        this.log(`Orchestration: ${result.enabled ? 'enabled' : 'disabled'}`);
+        this.log(`Lead health:   ${result.leadHealth}`);
+        if (result.consecutiveFailures > 0) {
+            this.log(`Failures:      ${result.consecutiveFailures} consecutive`);
+        }
+        if (result.lastFailureReason) {
+            this.log(`Last failure:  ${result.lastFailureReason}`);
+        }
+        if (result.runs.length === 0) {
+            this.log('No orchestration runs recorded.');
+            return;
+        }
+        this.log('');
+        for (const run of result.runs) {
+            const when = run.triggeredAt ?? 'unknown-time';
+            const failure = run.failureReason ? ` — ${run.failureReason}` : '';
+            this.log(`${when}  ${run.status}${failure}`);
+        }
+    }
+}
+exports.default = SpacesAutoExecutorRuns;

package/dist/commands/store/governance/artifacts.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance artifacts` — the catalogue, searched by what an
+ * artifact CAN DO rather than what it is called.
+ *
+ * Distinct from `skrr store browse`, which finds published agents to install.
+ * This searches every governed entity type by capability, permission,
+ * verified outcome and cost — the questions you ask when deciding what a
+ * workspace should be licensed for, not which agent you personally want.
+ */
+export default class StoreGovernanceArtifacts extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'entity-type': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        capability: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        permission: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'verified-outcome': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'min-cost-micros': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'max-cost-micros': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/artifacts.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance artifacts` — the catalogue, searched by what an
+ * artifact CAN DO rather than what it is called.
+ *
+ * Distinct from `skrr store browse`, which finds published agents to install.
+ * This searches every governed entity type by capability, permission,
+ * verified outcome and cost — the questions you ask when deciding what a
+ * workspace should be licensed for, not which agent you personally want.
+ */
+class StoreGovernanceArtifacts extends base_command_1.BaseCommand {
+    static description = 'Search the governed store catalogue by capability, permission, verified outcome and cost. For finding an agent to install, use `store browse`.';
+    static examples = [
+        '<%= config.bin %> store governance artifacts --capability code_review',
+        '<%= config.bin %> store governance artifacts --entity-type skill --max-cost-micros 500000',
+    ];
+    static flags = {
+        'entity-type': core_1.Flags.string({
+            description: 'agent, skill, action, service, team, bundle, space_template or connector',
+        }),
+        capability: core_1.Flags.string({ description: 'Capability the artifact provides' }),
+        permission: core_1.Flags.string({ description: 'Permission the artifact requires' }),
+        'verified-outcome': core_1.Flags.string({ description: 'A verified outcome key it claims' }),
+        'min-cost-micros': core_1.Flags.integer({ description: 'Lower bound on cost, in micros' }),
+        'max-cost-micros': core_1.Flags.integer({ description: 'Upper bound on cost, in micros' }),
+        limit: core_1.Flags.integer({ description: 'Maximum rows (1-100)' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernanceArtifacts);
+        let result;
+        try {
+            result = await (0, governed_store_1.searchGovernedStoreArtifacts)({
+                entityType: flags['entity-type'],
+                capability: flags.capability,
+                permission: flags.permission,
+                verifiedOutcome: flags['verified-outcome'],
+                minCostMicros: flags['min-cost-micros'],
+                maxCostMicros: flags['max-cost-micros'],
+                limit: flags.limit,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceArtifacts;

package/dist/commands/store/governance/assign.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/** Give a workspace-held license to a member or a Space. */
+export default class StoreGovernanceAssign extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        to: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'assignment-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}