@skrr-ai/cli 0.1.60 → 0.1.62

package/dist/lib/earnings.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PERIOD_PATTERN = exports.readPayouts = exports.readStatement = exports.readStatements = exports.readAutoPayout = exports.readEarnings = void 0;
+exports.renderEarningsSummary = renderEarningsSummary;
+exports.renderStatementList = renderStatementList;
+exports.renderStatement = renderStatement;
+exports.renderPayoutHistory = renderPayoutHistory;
+const data_provider_1 = require("@skrr-ai/data-provider");
+const format_1 = require("./format");
+/**
+ * earnings.ts — the read-only publisher payout surface (OSK-12272).
+ *
+ * `skrr earnings` reads a publisher's balance, automatic-payout state, monthly
+ * statements and payout history from `/api/connect/*`. It is read-only on
+ * purpose: requesting a payout and switching automatic payouts on move money,
+ * and those routes refuse a daemon credential (`refuseDaemonScope`), so they
+ * stay in the web Earnings page where a signed-in person does them.
+ *
+ * Every read goes through `dataService`, so the path a command reaches is the
+ * same one the web page reads, and copy for server vocabularies comes from
+ * `@skrr-ai/data-provider` (`connectPayouts.ts`), shared with that page.
+ */
+const readEarnings = () => data_provider_1.dataService.getConnectEarnings();
+exports.readEarnings = readEarnings;
+const readAutoPayout = () => data_provider_1.dataService.getConnectAutoPayout();
+exports.readAutoPayout = readAutoPayout;
+const readStatements = (params) => data_provider_1.dataService.getConnectStatements(params);
+exports.readStatements = readStatements;
+const readStatement = (period) => data_provider_1.dataService.getConnectStatement(period);
+exports.readStatement = readStatement;
+const readPayouts = (params) => data_provider_1.dataService.getConnectPayoutHistory(params);
+exports.readPayouts = readPayouts;
+exports.PERIOD_PATTERN = /^\d{4}-(0[1-9]|1[0-2])$/;
+function dollars(usd) {
+    if (usd == null || usd === '')
+        return '-';
+    const trimmed = String(usd).replace(/^\$/, '');
+    return trimmed.startsWith('-') ? `-$${trimmed.slice(1)}` : `$${trimmed}`;
+}
+function day(value) {
+    if (!value)
+        return '-';
+    const date = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(date.getTime()) ? '-' : date.toISOString().slice(0, 10);
+}
+/** `skrr earnings`: the balance, then how and when it is paid out. */
+function renderEarningsSummary(earnings, autoPayout, log) {
+    log('Publisher earnings');
+    log(`  Available:  ${dollars(earnings.usd.available)}`);
+    log(`  Pending:    ${dollars(earnings.usd.pending)}  (on hold until the refund window ends)`);
+    log(`  Lifetime:   ${dollars(earnings.usd.lifetimeEarnings)}`);
+    log('');
+    if (!earnings.connectOnboarded) {
+        log('Payouts:     not set up — set up payouts on the Earnings page to be paid.');
+        return;
+    }
+    log(`Payouts:     minimum ${dollars(earnings.minPayoutUsd)}, at most one per payout window`);
+    if (!autoPayout) {
+        return;
+    }
+    log(`  Window:     every ${autoPayout.cadenceDays} days`);
+    // The same state the web page reads: a date only while it is still ahead,
+    // and an open window says what it is waiting for when the balance is short.
+    const windowState = (0, data_provider_1.connectAutoPayoutWindowState)(autoPayout);
+    if (windowState === 'opens_later') {
+        log(`  Next opens: ${day(autoPayout.windowOpensAt)}`);
+    }
+    else if (windowState === 'open') {
+        log('  Next opens: open now');
+    }
+    else {
+        log(`  Next opens: open now — waiting for the available balance to reach ${dollars(autoPayout.minimumUsd)} (it is ${dollars(autoPayout.availableUsd)})`);
+    }
+    log(`  Automatic:  ${autoPayout.enabled
+        ? 'on — paid out within the hour the window opens, when the available balance meets the minimum'
+        : 'off — turn it on from the Earnings page'}`);
+    const last = (0, data_provider_1.describeConnectAutoPayoutAttempt)(autoPayout.lastAutoPayout);
+    if (last && autoPayout.lastAutoPayout) {
+        log(`  Last automatic payout (${day(autoPayout.lastAutoPayout.at)}): ${last}`);
+    }
+}
+/** `skrr earnings statements`: one row per month, newest first. */
+function renderStatementList(result, log) {
+    if (result.statements.length === 0) {
+        log('No statements yet. A statement is issued on the 1st for the month that just ended.');
+        return;
+    }
+    (0, format_1.renderTable)(result.statements.map((statement) => ({
+        period: statement.period,
+        opening: dollars(statement.openingBalance.totalUsd),
+        net: dollars(statement.netChangeUsd),
+        closing: dollars(statement.closingBalance.totalUsd),
+        available: dollars(statement.closingBalance.availableUsd),
+        reconciles: statement.unreconciled ? `off by ${dollars(statement.unreconciledUsd)}` : 'yes',
+    })), [
+        { key: 'period', header: 'MONTH' },
+        { key: 'opening', header: 'OPENING' },
+        { key: 'net', header: 'NET CHANGE' },
+        { key: 'closing', header: 'CLOSING' },
+        { key: 'available', header: 'OF WHICH AVAILABLE' },
+        { key: 'reconciles', header: 'RECONCILES' },
+    ], log);
+    if (result.hasNextPage && result.nextCursor) {
+        log('');
+        log(`More: skrr earnings statements --cursor ${result.nextCursor}`);
+    }
+}
+function balanceLine(label, balance) {
+    return `${label}${dollars(balance.totalUsd)}  (available ${dollars(balance.availableUsd)}, pending ${dollars(balance.pendingUsd)})`;
+}
+/** `skrr earnings statements <YYYY-MM>`: the whole statement, opening to closing. */
+function renderStatement(statement, log) {
+    log(`Statement for ${statement.period} (UTC)`);
+    log(balanceLine('  Opening balance   ', statement.openingBalance));
+    log(`  ${(0, data_provider_1.describeConnectStatementOpening)(statement.openingBasis)}`);
+    log('');
+    (0, format_1.renderTable)(data_provider_1.CONNECT_STATEMENT_LINES.map((line) => {
+        const entry = statement.activity[line.key];
+        const signed = line.sign === 0
+            ? dollars(entry.amountUsd)
+            : `${line.sign < 0 ? '-' : '+'}${dollars(entry.amountUsd)}`;
+        return {
+            line: line.label,
+            count: String(entry.count),
+            amount: line.sign === 0 ? `${signed} (moved, not added)` : signed,
+        };
+    }), [
+        { key: 'line', header: 'ACTIVITY' },
+        { key: 'count', header: 'COUNT' },
+        { key: 'amount', header: 'AMOUNT' },
+    ], log);
+    log('');
+    log(`  Net change        ${dollars(statement.netChangeUsd)}`);
+    log(balanceLine('  Closing balance   ', statement.closingBalance));
+    const unreconciled = (0, data_provider_1.describeConnectStatementUnreconciled)(statement);
+    if (unreconciled) {
+        log('');
+        log(`  ${unreconciled}`);
+    }
+}
+/** `skrr earnings payouts`: the payout ledger, newest first. */
+function renderPayoutHistory(result, log) {
+    if (result.payouts.length === 0) {
+        log('No payouts yet.');
+        return;
+    }
+    (0, format_1.renderTable)(result.payouts.map((payout) => ({
+        requested: day(payout.requestedAt),
+        amount: dollars(payout.amountUsd),
+        status: payout.status,
+        settled: day(payout.platformSettledAt ?? payout.completedAt),
+        id: payout.id,
+    })), [
+        { key: 'requested', header: 'REQUESTED' },
+        { key: 'amount', header: 'AMOUNT' },
+        { key: 'status', header: 'STATUS' },
+        { key: 'settled', header: 'SETTLED' },
+        { key: 'id', header: 'ID', verbatim: true },
+    ], log);
+    if (result.hasNextPage && result.nextCursor) {
+        log('');
+        log(`More: skrr earnings payouts --cursor ${result.nextCursor}`);
+    }
+}

package/dist/lib/github-oidc.d.ts

@@ -0,0 +1,13 @@
+/**
+ * GitHub Actions OIDC token acquisition for trusted publishing (OSK-12311).
+ *
+ * A workflow opts in with `permissions: id-token: write`; GitHub then exposes
+ * `ACTIONS_ID_TOKEN_REQUEST_URL` / `ACTIONS_ID_TOKEN_REQUEST_TOKEN` to the
+ * job, and this job-level URL is the only place a token can be requested —
+ * the response is what `POST /api/agents/:id/ci-releases` verifies.
+ *
+ * `audience` is what the token asserts it is FOR: the API checks it against
+ * `GITHUB_ACTIONS_OIDC_AUDIENCE` (else `DOMAIN_SERVER`, else `skrr`). Leave it
+ * unset to take the job's default, or pass the deployment's canonical origin.
+ */
+export declare function fetchGitHubActionsOidcToken(audience?: string): Promise<string>;

package/dist/lib/github-oidc.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fetchGitHubActionsOidcToken = fetchGitHubActionsOidcToken;
+/**
+ * GitHub Actions OIDC token acquisition for trusted publishing (OSK-12311).
+ *
+ * A workflow opts in with `permissions: id-token: write`; GitHub then exposes
+ * `ACTIONS_ID_TOKEN_REQUEST_URL` / `ACTIONS_ID_TOKEN_REQUEST_TOKEN` to the
+ * job, and this job-level URL is the only place a token can be requested —
+ * the response is what `POST /api/agents/:id/ci-releases` verifies.
+ *
+ * `audience` is what the token asserts it is FOR: the API checks it against
+ * `GITHUB_ACTIONS_OIDC_AUDIENCE` (else `DOMAIN_SERVER`, else `skrr`). Leave it
+ * unset to take the job's default, or pass the deployment's canonical origin.
+ */
+async function fetchGitHubActionsOidcToken(audience) {
+    const requestUrl = process.env.ACTIONS_ID_TOKEN_REQUEST_URL;
+    const requestToken = process.env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+    if (!requestUrl || !requestToken) {
+        throw new Error('No GitHub OIDC request context: run inside GitHub Actions with ' +
+            '`permissions: id-token: write`, or pass --oidc-token explicitly');
+    }
+    const url = new URL(requestUrl);
+    if (audience) {
+        url.searchParams.set('audience', audience);
+    }
+    const res = await fetch(url, {
+        headers: {
+            authorization: `bearer ${requestToken}`,
+            accept: 'application/json',
+        },
+    });
+    if (!res.ok) {
+        throw new Error(`GitHub OIDC token request failed (${res.status})`);
+    }
+    const body = (await res.json());
+    if (typeof body?.value !== 'string' || body.value.length === 0) {
+        throw new Error('GitHub OIDC token request returned no token');
+    }
+    return body.value;
+}

package/dist/lib/governed-store.d.ts

@@ -90,15 +90,56 @@ export declare function updateOwnLicensePolicy(licenseId: string, body: BundleLi
 export declare function updateWorkspaceLicensePolicy(workspaceId: string, licenseId: string, body: BundleLicensePolicyInput): Promise<{
     license: unknown;
 }>;
-/** `PUT /workspaces/:workspaceId/policy` — which releases a workspace may run. */
+/**
+ * The modes the server's workspace Store policy evaluator honours
+ * (`api/server/services/commerce/WorkspaceStorePolicy.js`). `open` is also
+ * what a workspace with no policy means.
+ */
+export type WorkspaceStorePolicyMode = 'open' | 'deny_all' | 'allowlist';
+/**
+ * The levels a workspace caps a release at (OSK-12262); each name is a mode
+ * the release's own capability manifest reports.
+ */
+export interface StoreCapabilityCeiling {
+    builtinTools?: 'none' | 'allowlist' | 'platform_default';
+    platformCapabilities?: 'not_loaded' | 'listed' | 'unrestricted';
+    delegation?: 'none' | 'specific' | 'all';
+    proactive?: boolean;
+    firstContact?: boolean;
+    sharedData?: 'none' | 'bootstrap' | 'memory' | 'full';
+    /** Allowed `tool:|connector:|data:|network:|secret:` keys; `*` allows all. */
+    permissions?: string[];
+}
+/** `GET /workspaces/:workspaceId/policy` — members read the policy that governs them. */
+export declare function getWorkspaceStorePolicy(workspaceId: string): Promise<{
+    policy: unknown;
+}>;
+/** `PUT /workspaces/:workspaceId/policy` — which releases a workspace may install and run. */
 export declare function setWorkspaceStorePolicy(workspaceId: string, body: {
-    mode: 'deny_all' | 'allowlist';
+    mode: WorkspaceStorePolicyMode;
     allowedReleaseIds: string[];
+    capabilityCeiling?: StoreCapabilityCeiling | null;
     policyId?: string;
     expectedRevision?: number;
 }): Promise<{
     policy: unknown;
 }>;
+/** `POST /workspaces/:workspaceId/store-requests` — a member asks for a refused release. */
+export declare function submitStoreInstallRequest(workspaceId: string, body: {
+    releaseId: string;
+    note?: string;
+    requestId?: string;
+}): Promise<{
+    request: unknown;
+}>;
+/** `GET /workspaces/:workspaceId/store-requests` — the queue (owner) or your own asks (member). */
+export declare function listStoreInstallRequests(workspaceId: string, status?: string): Promise<{
+    requests: unknown[];
+}>;
+/** `POST …/store-requests/:requestId/approve|decline` — the owner's answer. */
+export declare function decideStoreInstallRequest(workspaceId: string, requestId: string, decision: 'approve' | 'decline'): Promise<{
+    request: unknown;
+}>;
 /** `POST /workspaces/:workspaceId/assignments` — give a seat to a member or Space. */
 export declare function assignWorkspaceStoreLicense(workspaceId: string, body: {
     licenseId: string;

package/dist/lib/governed-store.js

@@ -6,7 +6,11 @@ exports.publishGovernedStoreRelease = publishGovernedStoreRelease;
 exports.createGovernedStoreLicense = createGovernedStoreLicense;
 exports.updateOwnLicensePolicy = updateOwnLicensePolicy;
 exports.updateWorkspaceLicensePolicy = updateWorkspaceLicensePolicy;
+exports.getWorkspaceStorePolicy = getWorkspaceStorePolicy;
 exports.setWorkspaceStorePolicy = setWorkspaceStorePolicy;
+exports.submitStoreInstallRequest = submitStoreInstallRequest;
+exports.listStoreInstallRequests = listStoreInstallRequests;
+exports.decideStoreInstallRequest = decideStoreInstallRequest;
 exports.assignWorkspaceStoreLicense = assignWorkspaceStoreLicense;
 const api_fetch_1 = require("./api-fetch");
 const triggers_1 = require("./triggers");
@@ -69,10 +73,30 @@ async function updateOwnLicensePolicy(licenseId, body) {
 async function updateWorkspaceLicensePolicy(workspaceId, licenseId, body) {
     return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/licenses/${encodeURIComponent(licenseId)}/update-policy`, { method: 'PATCH', body });
 }
-/** `PUT /workspaces/:workspaceId/policy` — which releases a workspace may run. */
+/** `GET /workspaces/:workspaceId/policy` — members read the policy that governs them. */
+async function getWorkspaceStorePolicy(workspaceId) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/policy`, { method: 'GET' });
+}
+/** `PUT /workspaces/:workspaceId/policy` — which releases a workspace may install and run. */
 async function setWorkspaceStorePolicy(workspaceId, body) {
     return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/policy`, { method: 'PUT', body });
 }
+/** `POST /workspaces/:workspaceId/store-requests` — a member asks for a refused release. */
+async function submitStoreInstallRequest(workspaceId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/store-requests`, { method: 'POST', body });
+}
+/** `GET /workspaces/:workspaceId/store-requests` — the queue (owner) or your own asks (member). */
+async function listStoreInstallRequests(workspaceId, status) {
+    return (0, api_fetch_1.apiFetch)((0, triggers_1.withQuery)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/store-requests`, status ? { status } : {}), { method: 'GET' });
+}
+/** `POST …/store-requests/:requestId/approve|decline` — the owner's answer. */
+async function decideStoreInstallRequest(workspaceId, requestId, decision) {
+    // Two literal paths — the parity checker reads route coverage from literals.
+    const path = decision === 'approve'
+        ? `/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/store-requests/${encodeURIComponent(requestId)}/approve`
+        : `/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/store-requests/${encodeURIComponent(requestId)}/decline`;
+    return (0, api_fetch_1.apiFetch)(path, { method: 'POST', body: {} });
+}
 /** `POST /workspaces/:workspaceId/assignments` — give a seat to a member or Space. */
 async function assignWorkspaceStoreLicense(workspaceId, body) {
     return (0, api_fetch_1.apiFetch)(`/api/store/governance/workspaces/${encodeURIComponent(workspaceId)}/assignments`, { method: 'POST', body });

package/dist/lib/label-ref.js

@@ -48,6 +48,17 @@ const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
 function looksLikeLabelId(ref) {
     return UUID_RE.test(ref.trim());
 }
+/**
+ * A label id that lost characters in a copy — hex and dashes, but not the
+ * uuid shape. It can NEVER be a label name (names are human words), so it must
+ * not fall into the name path, where the refusal would tell the caller to
+ * create a label literally named `ed3f89d3-875b-…`. The honest message is
+ * "this looks like a truncated id".
+ */
+const ID_SHAPED_RE = /^[0-9a-f-]{20,}$/i;
+function looksLikeTruncatedLabelId(ref) {
+    return !looksLikeLabelId(ref) && ref.includes('-') && ID_SHAPED_RE.test(ref.trim());
+}
 /** Levenshtein, iterative, two rows. Only ever runs on a refusal path. */
 function distance(a, b) {
     if (a === b)
@@ -148,6 +159,11 @@ async function resolveLabelRefs(refs, context) {
             resolved.push(ref);
             continue;
         }
+        if (looksLikeTruncatedLabelId(ref)) {
+            throw new LabelRefError(`"${ref}" looks like a label id but is not a complete one — ` +
+                `an id was probably truncated when copied. ` +
+                `Get the full id with \`labels list --json\`.`);
+        }
         const needle = ref.toLowerCase();
         const matches = vocabulary.filter((row) => (row.name ?? '').toLowerCase() === needle);
         if (matches.length === 1) {

package/dist/lib/managed-execution.d.ts

@@ -0,0 +1,10 @@
+export interface ManagedExecutionAgent {
+    id: string;
+    name: string;
+    position: number;
+}
+/**
+ * Agent Worker has no Machine row. The durable, user-visible relationship is
+ * an Agent's ordered execution policy, which this projection exposes.
+ */
+export declare function managedExecutionAgents(response: unknown): ManagedExecutionAgent[];

package/dist/lib/managed-execution.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.managedExecutionAgents = managedExecutionAgents;
+function agentWorkerPosition(agent) {
+    const policy = agent.executionPolicy;
+    if (Array.isArray(policy?.targets)) {
+        const index = policy.targets.findIndex((target) => Boolean(target) &&
+            typeof target === 'object' &&
+            target.kind === 'agent-worker' &&
+            target.enabled !== false);
+        return index >= 0 ? index + 1 : null;
+    }
+    const executionOrder = agent.executionOrder;
+    if (!Array.isArray(executionOrder))
+        return null;
+    const index = executionOrder.findIndex((target) => Boolean(target) &&
+        typeof target === 'object' &&
+        target.kind === 'agent-worker');
+    return index >= 0 ? index + 1 : null;
+}
+/**
+ * Agent Worker has no Machine row. The durable, user-visible relationship is
+ * an Agent's ordered execution policy, which this projection exposes.
+ */
+function managedExecutionAgents(response) {
+    const envelope = response;
+    const agents = Array.isArray(response)
+        ? response
+        : Array.isArray(envelope?.data)
+            ? envelope.data
+            : Array.isArray(envelope?.agents)
+                ? envelope.agents
+                : [];
+    return agents
+        .filter((agent) => Boolean(agent) && typeof agent === 'object')
+        .map((agent) => ({ agent, position: agentWorkerPosition(agent) }))
+        .filter((entry) => entry.position !== null)
+        .map(({ agent, position }) => {
+        const id = String(agent.id ?? agent._id ?? '');
+        return { id, name: String(agent.name ?? (id || 'Unnamed agent')), position };
+    })
+        .sort((a, b) => a.position - b.position || a.name.localeCompare(b.name));
+}

package/dist/lib/principal-display.d.ts

@@ -0,0 +1,20 @@
+/**
+ * principal-display.ts — render a principal as a name a person recognises.
+ *
+ * WHY
+ * ---
+ * `tasks show`, `comments list` and friends print author/assignee ids verbatim
+ * (`Author: 68ed5a0482dd30a0a610a916`). An id is correct on the wire and
+ * useless at a keyboard — the one thing the column is for is "who is this".
+ *
+ * Resolution is best-effort and bounded to two cheap sources: the caller's own
+ * record (`/api/user`) and the Space member roster (`GET
+ * /api/spaces/:id/members`) when the task has a Space. An unresolvable id
+ * prints unchanged — a roster read failure must never fail the command, so
+ * every fetch is caught.
+ */
+export declare function resolvePrincipalNames(ids: ReadonlyArray<unknown>, options?: {
+    spaceId?: string | null;
+}): Promise<Map<string, string>>;
+/** The name when known, else the id unchanged — never blank. */
+export declare function displayPrincipal(id: unknown, names: Map<string, string> | undefined): string;

package/dist/lib/principal-display.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * principal-display.ts — render a principal as a name a person recognises.
+ *
+ * WHY
+ * ---
+ * `tasks show`, `comments list` and friends print author/assignee ids verbatim
+ * (`Author: 68ed5a0482dd30a0a610a916`). An id is correct on the wire and
+ * useless at a keyboard — the one thing the column is for is "who is this".
+ *
+ * Resolution is best-effort and bounded to two cheap sources: the caller's own
+ * record (`/api/user`) and the Space member roster (`GET
+ * /api/spaces/:id/members`) when the task has a Space. An unresolvable id
+ * prints unchanged — a roster read failure must never fail the command, so
+ * every fetch is caught.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolvePrincipalNames = resolvePrincipalNames;
+exports.displayPrincipal = displayPrincipal;
+const data_provider_1 = require("@skrr-ai/data-provider");
+async function resolvePrincipalNames(ids, options = {}) {
+    const wanted = new Set(ids.filter((id) => typeof id === 'string' && id.length > 0));
+    const names = new Map();
+    if (wanted.size === 0)
+        return names;
+    const add = (id, display) => {
+        const key = typeof id === 'string' ? id : id != null ? String(id) : undefined;
+        const name = typeof display === 'string' && display.trim() ? display.trim() : undefined;
+        if (key && name && wanted.has(key) && !names.has(key))
+            names.set(key, name);
+    };
+    const reads = [
+        data_provider_1.dataService
+            .getUser()
+            .then((me) => {
+            const display = me?.name || me?.username || me?.email;
+            add(me?.id ?? me?._id, display);
+        })
+            .catch(() => undefined),
+    ];
+    if (options.spaceId) {
+        reads.push(data_provider_1.dataService
+            .getSpaceMembers(options.spaceId)
+            .then((members) => {
+            for (const member of members?.users ?? []) {
+                const display = member.user?.name || member.user?.username || member.user?.email;
+                add(member.userId, display);
+                add(member.user?._id, display);
+            }
+            for (const agent of members?.agents ?? []) {
+                add(agent.id, agent.name);
+                add(agent._id, agent.name);
+            }
+        })
+            .catch(() => undefined));
+    }
+    await Promise.all(reads);
+    return names;
+}
+/** The name when known, else the id unchanged — never blank. */
+function displayPrincipal(id, names) {
+    const key = id == null ? '-' : String(id);
+    return names?.get(key) ?? key;
+}

package/dist/lib/space-template-source.d.ts

@@ -0,0 +1,14 @@
+import type { SpaceTemplateSource, SpaceTemplateSourceResponse } from '@skrr-ai/data-provider';
+/**
+ * The `Template:` / `Update:` lines `skrr spaces show` prints for a Space a
+ * template install created. The same states the web notice draws, and for the
+ * same reason each is spelled out: "up to date" is printed only when the check
+ * answered `current`, and a failed check says it failed rather than printing
+ * nothing — silence would read as "no update".
+ */
+export declare function templateSourceLines({ source, check, checkError, baseURL, }: {
+    source: SpaceTemplateSource;
+    check?: SpaceTemplateSourceResponse | null;
+    checkError?: string;
+    baseURL: string;
+}): string[];

package/dist/lib/space-template-source.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.templateSourceLines = templateSourceLines;
+const data_provider_1 = require("@skrr-ai/data-provider");
+const web_url_1 = require("./web-url");
+/**
+ * The `Template:` / `Update:` lines `skrr spaces show` prints for a Space a
+ * template install created. The same states the web notice draws, and for the
+ * same reason each is spelled out: "up to date" is printed only when the check
+ * answered `current`, and a failed check says it failed rather than printing
+ * nothing — silence would read as "no update".
+ */
+function templateSourceLines({ source, check, checkError, baseURL, }) {
+    const title = source.templateTitle?.trim() || source.templateId;
+    const installed = (0, data_provider_1.spaceTemplateVersionLabel)(source);
+    const installedOn = typeof source.installedAt === 'string' ? source.installedAt.slice(0, 10) : undefined;
+    const lines = [
+        `Template:    ${title}${installed ? ` · ${installed}` : ''}${installedOn ? ` (installed ${installedOn})` : ''}`,
+    ];
+    if (checkError) {
+        lines.push(`Update:      check failed (${checkError})`);
+        return lines;
+    }
+    const link = (0, web_url_1.webUrl)(baseURL, { kind: 'spaceTemplate', templateId: source.templateId });
+    switch (check?.status) {
+        case 'update_available': {
+            const latest = (0, data_provider_1.spaceTemplateVersionLabel)(check.latest);
+            lines.push(`Update:      ${latest ? `${latest} available` : 'the template changed since install'}${link ? ` — ${link}` : ''}`);
+            break;
+        }
+        case 'current':
+            lines.push('Update:      up to date');
+            break;
+        case 'unavailable':
+            lines.push('Update:      template no longer available');
+            break;
+        default:
+            lines.push('Update:      not checked');
+    }
+    return lines;
+}

package/dist/lib/step-up.d.ts

@@ -0,0 +1,21 @@
+/**
+ * What the CLI says about step-up authentication before Store publishing
+ * (OSK-12275).
+ *
+ * A public release reaches everyone who installs it, so the server refuses to
+ * publish one, or to move the release buyers are served, on the strength of a
+ * CLI token alone: it answers `STEP_UP_REQUIRED` until this same login has
+ * proved a second factor through `skrr step-up`. The vocabulary (the code, the
+ * reasons, the window) is `@skrr-ai/data-provider`'s; only the sentences live
+ * here, because each reason has a different next step and a refusal that says
+ * "forbidden" would leave a publisher guessing which one applies.
+ */
+import type { TStepUpChallenge } from '@skrr-ai/data-provider';
+/**
+ * The explanation printed when a command is refused with `STEP_UP_REQUIRED`.
+ * `challenge` may be `null` for a body this CLI could not read, which still
+ * gets the ordinary remedy rather than a bare status line.
+ */
+export declare function describeStepUpRequired(challenge: TStepUpChallenge | null, bin: string): string;
+/** The clock time a verification lasts until, in the reader's local time. */
+export declare function formatStepUpExpiry(expiresAt: string | undefined): string;

package/dist/lib/step-up.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeStepUpRequired = describeStepUpRequired;
+exports.formatStepUpExpiry = formatStepUpExpiry;
+const NOTHING_CHANGED = 'Nothing was published or changed.';
+function windowPhrase(windowSeconds) {
+    const minutes = Math.max(1, Math.round((windowSeconds ?? 600) / 60));
+    return `${minutes} minute${minutes === 1 ? '' : 's'}`;
+}
+/**
+ * The explanation printed when a command is refused with `STEP_UP_REQUIRED`.
+ * `challenge` may be `null` for a body this CLI could not read, which still
+ * gets the ordinary remedy rather than a bare status line.
+ */
+function describeStepUpRequired(challenge, bin) {
+    const window = windowPhrase(challenge?.windowSeconds);
+    switch (challenge?.reason) {
+        case 'two_factor_not_enabled':
+            return [
+                `Publishing to the Store needs two-factor authentication, and this account has none. ${NOTHING_CHANGED}`,
+                'Turn it on in the web app (Settings → Account → Two-factor authentication),',
+                `then run \`${bin} step-up\` and run this command again within ${window}.`,
+            ].join('\n');
+        case 'credential_not_session_bound':
+            return [
+                `This credential is not tied to a sign-in session, so it cannot be verified for publishing. ${NOTHING_CHANGED}`,
+                `Run \`${bin} login\`, then \`${bin} step-up\`, and run this command again within ${window}.`,
+            ].join('\n');
+        default:
+            return [
+                `Publishing needs a fresh identity check: a public release reaches everyone who installs it, so this login alone is not enough. ${NOTHING_CHANGED}`,
+                `Run \`${bin} step-up\` and enter the code from your authenticator app, then run this command again within ${window}.`,
+            ].join('\n');
+    }
+}
+/** The clock time a verification lasts until, in the reader's local time. */
+function formatStepUpExpiry(expiresAt) {
+    if (!expiresAt)
+        return 'the end of the verification window';
+    const date = new Date(expiresAt);
+    if (Number.isNaN(date.getTime()))
+        return 'the end of the verification window';
+    return date.toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
+}

package/dist/lib/store-acquisition.d.ts

@@ -0,0 +1,11 @@
+import type { StoreAcquisitionRequest } from '@skrr-ai/data-provider';
+/**
+ * A purchase an agent asked to make, as the lines a terminal shows (OSK-12240).
+ *
+ * The same server copy the web approval card renders: every field comes from
+ * `GET /api/store/acquisition-requests/:id`, which the fulfillment path built
+ * from the listing it resolved. Nothing the requesting agent wrote reaches
+ * these lines. The words themselves come from `@skrr-ai/data-provider`, so the
+ * terminal and the card cannot describe one request two ways.
+ */
+export declare function describeAcquisitionRequestLines(request: StoreAcquisitionRequest): string[];