@skrr-ai/cli 0.1.47 → 0.1.49

package/dist/commands/store/governance/assign.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/** Give a workspace-held license to a member or a Space. */
+class StoreGovernanceAssign extends base_command_1.BaseCommand {
+    static description = 'Assign a workspace-held license to a member or a Space — who actually gets to run it.';
+    static examples = [
+        '<%= config.bin %> store governance assign <workspace-id> --license <id> --to member:<user-id>',
+        '<%= config.bin %> store governance assign <workspace-id> --license <id> --to space:<space-id>',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        license: core_1.Flags.string({ description: 'License to assign', required: true }),
+        to: core_1.Flags.string({
+            description: 'member:<user-id> or space:<space-id>',
+            required: true,
+        }),
+        'assignment-id': core_1.Flags.string({ description: 'Assignment id, for a deterministic retry' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceAssign);
+        // `member:` / `space:` rather than two flags, because the two are mutually
+        // exclusive and a pair of optional flags lets you pass both or neither.
+        const separator = flags.to.indexOf(':');
+        const assigneeType = separator > 0 ? flags.to.slice(0, separator) : '';
+        const assigneeId = separator > 0 ? flags.to.slice(separator + 1) : '';
+        if (!['member', 'space'].includes(assigneeType) || !assigneeId) {
+            this.error(`--to must be member:<user-id> or space:<space-id>, got "${flags.to}"`, {
+                exit: 2,
+            });
+        }
+        let result;
+        try {
+            result = await (0, governed_store_1.assignWorkspaceStoreLicense)(args.workspace, {
+                licenseId: flags.license,
+                assigneeType: assigneeType,
+                assigneeId,
+                ...(flags['assignment-id'] ? { assignmentId: flags['assignment-id'] } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceAssign;

package/dist/commands/store/governance/create-license.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Mint a bundle license against an acquisition (admin).
+ *
+ * A license always cites WHAT paid for it — a commercial order or a contract —
+ * so the body carries that acquisition source. That link is the reason a
+ * license can be audited at all, and it is not something a CLI should let you
+ * omit by defaulting.
+ */
+export default class StoreGovernanceCreateLicense extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/create-license.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Mint a bundle license against an acquisition (admin).
+ *
+ * A license always cites WHAT paid for it — a commercial order or a contract —
+ * so the body carries that acquisition source. That link is the reason a
+ * license can be audited at all, and it is not something a CLI should let you
+ * omit by defaulting.
+ */
+class StoreGovernanceCreateLicense extends base_command_1.BaseCommand {
+    static description = 'Mint a bundle license against a commercial order or contract (admin).';
+    static examples = [
+        '<%= config.bin %> store governance create-license --file ./license.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernanceCreateLicense);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, governed_store_1.createGovernedStoreLicense)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceCreateLicense;

package/dist/commands/store/governance/install-plan.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance install-plan` — what installing this release WOULD do.
+ *
+ * A plan, not an install, and the name says so. It resolves the release
+ * against a license, the workspace policy and the environment you declare, and
+ * answers whether it is permitted and what it would pull. That is the read an
+ * operator wants before spending anything — and the reason it is here rather
+ * than folded into `store install`, which installs.
+ */
+export default class StoreGovernanceInstallPlan extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        release: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/install-plan.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * `skrr store governance install-plan` — what installing this release WOULD do.
+ *
+ * A plan, not an install, and the name says so. It resolves the release
+ * against a license, the workspace policy and the environment you declare, and
+ * answers whether it is permitted and what it would pull. That is the read an
+ * operator wants before spending anything — and the reason it is here rather
+ * than folded into `store install`, which installs.
+ */
+class StoreGovernanceInstallPlan extends base_command_1.BaseCommand {
+    static description = 'Resolve what installing a governed release would do — license, workspace policy and environment. Installs nothing.';
+    static examples = [
+        '<%= config.bin %> store governance install-plan <release-id>',
+        '<%= config.bin %> store governance install-plan <release-id> --workspace <id> --license <id>',
+        '<%= config.bin %> store governance install-plan <release-id> --file ./environment.json',
+    ];
+    static args = {
+        release: core_1.Args.string({ description: 'Release id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        license: core_1.Flags.string({ description: 'License to resolve against' }),
+        workspace: core_1.Flags.string({ description: 'Workspace whose policy applies' }),
+        space: core_1.Flags.string({ description: 'Space the install would land in' }),
+        file: core_1.Flags.string({
+            description: 'JSON with an `environment` object (platformVersion, runtimeKind, …), or -',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceInstallPlan);
+        const extra = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file, { required: false });
+        let result;
+        try {
+            result = await (0, governed_store_1.resolveGovernedStoreInstallPlan)({
+                ...extra,
+                releaseId: args.release,
+                ...(flags.license ? { licenseId: flags.license } : {}),
+                ...(flags.workspace ? { workspaceId: flags.workspace } : {}),
+                ...(flags.space ? { spaceId: flags.space } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceInstallPlan;

package/dist/commands/store/governance/license-policy.d.ts

@@ -0,0 +1,30 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance license-policy` — how a license takes updates.
+ *
+ * ONE command over two endpoints, because the only difference between them is
+ * WHOSE license it is: yours, or the workspace's. `--workspace` picks the
+ * second, and the server resolves the actor from the route rather than from
+ * anything the caller asserts. Two owners can hold licenses over the same
+ * release and may change different things, so the distinction is real — it is
+ * just not a reason to make an operator remember two verb names.
+ *
+ * `--expect-revision` is REQUIRED by the API, not by convenience: an update
+ * policy decides which releases run, and a blind write could silently move a
+ * workspace onto a release somebody else had just pinned away from.
+ */
+export default class StoreGovernanceLicensePolicy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        license: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        policy: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        release: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/license-policy.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance license-policy` — how a license takes updates.
+ *
+ * ONE command over two endpoints, because the only difference between them is
+ * WHOSE license it is: yours, or the workspace's. `--workspace` picks the
+ * second, and the server resolves the actor from the route rather than from
+ * anything the caller asserts. Two owners can hold licenses over the same
+ * release and may change different things, so the distinction is real — it is
+ * just not a reason to make an operator remember two verb names.
+ *
+ * `--expect-revision` is REQUIRED by the API, not by convenience: an update
+ * policy decides which releases run, and a blind write could silently move a
+ * workspace onto a release somebody else had just pinned away from.
+ */
+class StoreGovernanceLicensePolicy extends base_command_1.BaseCommand {
+    static description = 'Set how a bundle license takes updates (manual, pinned or compatible), fenced on the revision you read. Without --workspace it changes a license you hold personally.';
+    static examples = [
+        '<%= config.bin %> store governance license-policy <license-id> --policy pinned --expect-revision 2',
+        '<%= config.bin %> store governance license-policy <license-id> --policy compatible --expect-revision 5 --workspace <workspace-id>',
+    ];
+    static args = {
+        license: core_1.Args.string({ description: 'License id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        policy: core_1.Flags.string({
+            description: 'How the license takes updates',
+            options: ['manual', 'pinned', 'compatible'],
+            required: true,
+        }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'The license revision you are changing (compare-and-set)',
+            required: true,
+        }),
+        release: core_1.Flags.string({
+            description: 'Pin to these release ids (repeatable); only meaningful with --policy pinned',
+            multiple: true,
+        }),
+        workspace: core_1.Flags.string({
+            description: 'Change the license the WORKSPACE holds, rather than your own',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernanceLicensePolicy);
+        const body = {
+            updatePolicy: flags.policy,
+            expectedRevision: flags['expect-revision'],
+            ...(flags.release?.length ? { selectedReleaseIds: flags.release } : {}),
+        };
+        let result;
+        try {
+            result = flags.workspace
+                ? await (0, governed_store_1.updateWorkspaceLicensePolicy)(flags.workspace, args.license, body)
+                : await (0, governed_store_1.updateOwnLicensePolicy)(args.license, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernanceLicensePolicy;

package/dist/commands/store/governance/policy.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr store governance policy` — which releases a workspace may run at all.
+ *
+ * `deny_all` and `allowlist` are the two modes the server accepts, and the
+ * command refuses an allowlist with nothing in it: an empty allowlist and
+ * `deny_all` have the same effect but say different things, and a workspace
+ * that reads "allowlist" while permitting nothing is a policy nobody can
+ * explain six months later. If you mean deny everything, say `deny_all`.
+ */
+export default class StoreGovernancePolicy extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        mode: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        release: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'policy-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/policy.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+/**
+ * `skrr store governance policy` — which releases a workspace may run at all.
+ *
+ * `deny_all` and `allowlist` are the two modes the server accepts, and the
+ * command refuses an allowlist with nothing in it: an empty allowlist and
+ * `deny_all` have the same effect but say different things, and a workspace
+ * that reads "allowlist" while permitting nothing is a policy nobody can
+ * explain six months later. If you mean deny everything, say `deny_all`.
+ */
+class StoreGovernancePolicy extends base_command_1.BaseCommand {
+    static description = 'Set which governed releases a workspace may run. `deny_all`, or an allowlist of release ids.';
+    static examples = [
+        '<%= config.bin %> store governance policy <workspace-id> --mode deny_all',
+        '<%= config.bin %> store governance policy <workspace-id> --mode allowlist --release <id> --release <id>',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        mode: core_1.Flags.string({
+            description: 'deny_all, or allowlist the releases named by --release',
+            options: ['deny_all', 'allowlist'],
+            required: true,
+        }),
+        release: core_1.Flags.string({
+            description: 'Release id to allow (repeatable). Required with --mode allowlist.',
+            multiple: true,
+        }),
+        'policy-id': core_1.Flags.string({ description: 'Policy id, when replacing a specific one' }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'The policy revision you are replacing (compare-and-set)',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreGovernancePolicy);
+        const releases = flags.release ?? [];
+        if (flags.mode === 'allowlist' && releases.length === 0) {
+            this.error('An allowlist with no --release permits nothing, which is what --mode deny_all says plainly. Pass at least one release, or say deny_all.', { exit: 2 });
+        }
+        let result;
+        try {
+            result = await (0, governed_store_1.setWorkspaceStorePolicy)(args.workspace, {
+                mode: flags.mode,
+                allowedReleaseIds: releases,
+                ...(flags['policy-id'] ? { policyId: flags['policy-id'] } : {}),
+                ...(flags['expect-revision'] !== undefined
+                    ? { expectedRevision: flags['expect-revision'] }
+                    : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernancePolicy;

package/dist/commands/store/governance/publish-release.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Publish one artifact release into the governed catalogue (admin).
+ *
+ * The body carries verified-outcome evidence, which is why it is a file rather
+ * than flags: evidence is a list of records with sources and timestamps, and
+ * assembling that from a command line is how a claim loses its provenance.
+ */
+export default class StoreGovernancePublishRelease extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/governance/publish-release.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const governed_store_1 = require("../../../lib/governed-store");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Publish one artifact release into the governed catalogue (admin).
+ *
+ * The body carries verified-outcome evidence, which is why it is a file rather
+ * than flags: evidence is a list of records with sources and timestamps, and
+ * assembling that from a command line is how a claim loses its provenance.
+ */
+class StoreGovernancePublishRelease extends base_command_1.BaseCommand {
+    static description = 'Publish an artifact release into the governed store catalogue (admin).';
+    static examples = [
+        '<%= config.bin %> store governance publish-release --file ./release.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreGovernancePublishRelease);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, governed_store_1.publishGovernedStoreRelease)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StoreGovernancePublishRelease;

package/dist/commands/tasks/deliverable/add.d.ts

@@ -25,7 +25,22 @@ export default class TasksDeliverableAdd extends BaseCommand {
         expectation: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'run-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'idempotency-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'no-upload': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Archive the bytes and let the upload's own ledger receipt BE the
+     * Deliverable record.
+     *
+     * One record, not two: the receipt is keyed on the same coordinate this
+     * command would have recorded, so the archived copy and the citation are one
+     * Resource rather than a path nobody can open beside an opaque blob nobody
+     * can match to it.
+     *
+     * Returns false when the file cannot be archived and the caller should fall
+     * back to recording the coordinate alone.
+     */
+    private archive;
 }