@skrr-ai/cli 0.1.64 → 0.1.66

package/dist/commands/agents/visibility.d.ts

@@ -10,6 +10,14 @@ export declare function parseCapabilityRationales(entries: readonly string[] | u
     rationales?: Record<string, string>;
     error?: string;
 };
+export declare function parseReleaseDependencies(entries: readonly string[] | undefined): {
+    dependencies?: Array<{
+        entityType: 'skill' | 'action';
+        entityId: string;
+        artifactVersionId: string;
+    }>;
+    error?: string;
+};
 export default class AgentsVisibility extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -27,6 +35,7 @@ export default class AgentsVisibility extends BaseCommand {
         'version-minor': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'capability-rationale': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         language: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        dependency: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/visibility.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseCapabilityRationales = parseCapabilityRationales;
+exports.parseReleaseDependencies = parseReleaseDependencies;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -28,6 +29,23 @@ function parseCapabilityRationales(entries) {
     }
     return { rationales };
 }
+function parseReleaseDependencies(entries) {
+    if (!entries?.length)
+        return {};
+    const dependencies = [];
+    for (const entry of entries) {
+        const match = /^(skill|action):([^@]+)@(store_release_[A-Za-z0-9_-]+)$/.exec(entry);
+        if (!match) {
+            return { error: `--dependency expects skill:<id>@<store-release-id> or action:<id>@<store-release-id>, got "${entry}".` };
+        }
+        dependencies.push({
+            entityType: match[1],
+            entityId: match[2],
+            artifactVersionId: match[3],
+        });
+    }
+    return { dependencies };
+}
 class AgentsVisibility extends base_command_1.BaseCommand {
     static description = 'Set the visibility of an agent (accounts with 2FA need recent step-up for public publishing)';
     static examples = [
@@ -37,6 +55,7 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         '<%= config.bin %> agents visibility <agent-id> --public --json',
         '<%= config.bin %> agents visibility <agent-id> --public --capability-rationale "network:*=Looks up flight prices on the web"',
         '<%= config.bin %> agents visibility <agent-id> --public --language en --language zh-Hans',
+        '<%= config.bin %> agents visibility <agent-id> --public --dependency skill:<skill-id>@<store-release-id>',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
@@ -72,6 +91,10 @@ class AgentsVisibility extends base_command_1.BaseCommand {
             description: 'A language the release works in, as a BCP 47 tag such as en or zh-Hans (repeatable). Shown on the listing as declared by you; the platform does not check it.',
             multiple: true,
         }),
+        dependency: core_1.Flags.string({
+            description: 'Pin an attached Skill or Action to its immutable Store release: skill:<id>@<store-release-id> (repeatable)',
+            multiple: true,
+        }),
     };
     async run() {
         this.requireAuth();
@@ -84,6 +107,12 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         if (rationaleError) {
             this.error(rationaleError, { exit: 1 });
         }
+        const { dependencies, error: dependencyError } = parseReleaseDependencies(flags.dependency);
+        if (dependencyError)
+            this.error(dependencyError, { exit: 1 });
+        if (dependencies && !isPublic) {
+            this.error('--dependency declares pins on a public release; pass it with --public.', { exit: 1 });
+        }
         if (capabilityRationales && !isPublic) {
             this.error('--capability-rationale applies only when publishing with --public.', {
                 exit: 1,
@@ -131,6 +160,7 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 versionMinor: flags['version-minor'],
                 capabilityRationales,
                 supportedLanguages: flags.language,
+                dependencies,
             });
         }
         catch (err) {

package/dist/commands/goals/plan-now.d.ts

@@ -23,6 +23,12 @@ export declare function describePlannerReason(reason: string | null | undefined)
  * saying so.
  */
 export declare function plannerTickDidNotRun(result: GoalPlanNowResponse | undefined): boolean;
+/**
+ * HTTP 202: the tick was handed to the planner worker rather than awaited in
+ * the request. `processed` is absent by design — it is neither a success to
+ * count nor a skip to fail on, it is a hand-off (OSK-12748).
+ */
+export declare function plannerTickAccepted(result: GoalPlanNowResponse | undefined): boolean;
 /** Did the REQUEST give up, as opposed to the tick failing? */
 export declare function isPlannerRequestTimeout(err: unknown): boolean;
 /**

package/dist/commands/goals/plan-now.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describePlannerReason = describePlannerReason;
 exports.plannerTickDidNotRun = plannerTickDidNotRun;
+exports.plannerTickAccepted = plannerTickAccepted;
 exports.isPlannerRequestTimeout = isPlannerRequestTimeout;
 exports.plannerTimeoutMessage = plannerTimeoutMessage;
 const core_1 = require("@oclif/core");
@@ -85,6 +86,14 @@ function describePlannerReason(reason) {
 function plannerTickDidNotRun(result) {
     return result?.ok === false || result?.processed === false;
 }
+/**
+ * HTTP 202: the tick was handed to the planner worker rather than awaited in
+ * the request. `processed` is absent by design — it is neither a success to
+ * count nor a skip to fail on, it is a hand-off (OSK-12748).
+ */
+function plannerTickAccepted(result) {
+    return result?.accepted === true;
+}
 /** Did the REQUEST give up, as opposed to the tick failing? */
 function isPlannerRequestTimeout(err) {
     const status = err?.status;
@@ -163,6 +172,22 @@ class GoalsPlanNow extends base_command_1.BaseCommand {
         }
         const r = result;
         const reasonText = describePlannerReason(r?.reason);
+        if (plannerTickAccepted(r)) {
+            // HTTP 202: the tick was handed to the planner worker — no counts exist
+            // yet, and that is the honest thing to print (OSK-12748). A 502 here used
+            // to mean "gateway gave up mid-run"; accepted means the request ended
+            // BEFORE the run, so nothing was left ambiguously in flight.
+            if (flags.json) {
+                this.log(JSON.stringify(r, null, 2));
+                return;
+            }
+            this.log(`Planner tick accepted for goal ${args.id} — running in the background.`);
+            if (r.backfilledCount) {
+                this.log(`  backfilled:  ${r.backfilledCount} existing task(s) tagged to the space.`);
+            }
+            this.log(`  Watch \`${this.config.bin} goals tasks ${args.id}\` for what it creates.`);
+            return;
+        }
         if (plannerTickDidNotRun(r)) {
             // The backfill runs BEFORE planning and unconditionally, so a skipped
             // tick can still have moved rows. Saying "nothing happened" would be the

package/dist/commands/memory/approvals/issue.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
+const prompt_1 = require("../../../lib/prompt");
 class MemoryApprovalsIssue extends scoped_memory_command_1.ScopedMemoryCommand {
     static description = 'Issue a short-lived user approval for Space PII or Agent-to-Space promotion';
     static flags = {
@@ -35,10 +36,12 @@ class MemoryApprovalsIssue extends scoped_memory_command_1.ScopedMemoryCommand {
                 this.error('--payload JSON is required for --purpose space_pii.', { exit: 2 });
             }
             try {
-                payload = JSON.parse(flags.payload);
+                payload = (0, prompt_1.parseJsonFlag)(flags.payload, '--payload');
             }
-            catch {
-                this.error('--payload must be valid JSON.', { exit: 2 });
+            catch (err) {
+                this.error(err instanceof Error ? err.message : '--payload must be valid JSON.', {
+                    exit: 2,
+                });
             }
         }
         else if (!flags['source-store'] || !flags['source-memory'] || !flags['source-version']) {

package/dist/commands/memory/mounts/resolve.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const data_schemas_1 = require("@skrr-ai/data-schemas");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
 class MemoryMountsResolve extends scoped_memory_command_1.ScopedMemoryCommand {
     static description = 'Resolve the ACL-aware Memory mounts for an Agent session';
@@ -14,7 +13,7 @@ class MemoryMountsResolve extends scoped_memory_command_1.ScopedMemoryCommand {
         this.requireAuth();
         const { flags } = await this.parse(MemoryMountsResolve);
         const response = await this.memoryApi(flags.agent, `/mounts${this.query(flags)}`);
-        const result = { mounts: response.mounts.map((mount) => data_schemas_1.MemoryMountSchema.parse(mount)) };
+        const result = { mounts: response.mounts.map(scoped_memory_command_1.parseMemoryMount) };
         if (flags.json)
             return this.log(JSON.stringify(result, null, 2));
         for (const mount of result.mounts) {

package/dist/commands/memory/save.d.ts

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../../base-command';
+/** Compatibility entry point for a write API removed by canonical Memory Stores. */
 export default class MemorySave extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/memory/save.js

@@ -1,72 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
-const prompt_1 = require("../../lib/prompt");
 const memory_scope_1 = require("../../lib/memory-scope");
-const memory_workspace_guidance_1 = require("../../lib/memory-workspace-guidance");
+/** Compatibility entry point for a write API removed by canonical Memory Stores. */
 class MemorySave extends base_command_1.BaseCommand {
-    static description = 'Create a flat key/value memory in a pool (owner, an agent, user, or workspace)';
+    static description = 'Retired flat memory write; use memory maintain remember or memory topics create';
     static examples = [
-        '<%= config.bin %> memory save --key "user-preference" --value "dark mode"',
-        '<%= config.bin %> memory save --from-json memory.json',
-        '<%= config.bin %> memory save --key "note" --value "remember this" --json',
-        '<%= config.bin %> memory save --key "team-norm" --value "ship on fridays" --tier workspace --pool-workspace ws_123',
-        '<%= config.bin %> memory maintain remember \'{"path":"/notes","claim":"remember this"}\' --agent agent_abc123',
+        '<%= config.bin %> memory maintain remember \'{"path":"/notes","claim":"Remember this."}\' --agent agent_abc123',
+        '<%= config.bin %> memory topics create --help',
     ];
     static flags = {
-        json: core_1.Flags.boolean({ description: 'Output the created memory as JSON' }),
-        'from-json': core_1.Flags.string({
-            description: 'Path to a JSON file (or "-" for stdin) to use as the request body',
-        }),
-        key: core_1.Flags.string({ description: 'Memory key (required unless set via --from-json)' }),
-        value: core_1.Flags.string({ description: 'Memory value (required unless set via --from-json)' }),
+        json: core_1.Flags.boolean({ description: 'Output errors as JSON' }),
+        'from-json': core_1.Flags.string({ description: 'Retired flat memory input' }),
+        key: core_1.Flags.string({ description: 'Retired flat memory key' }),
+        value: core_1.Flags.string({ description: 'Retired flat memory value' }),
         ...memory_scope_1.memoryScopeFlags,
     };
     async run() {
-        this.requireAuth();
         const { flags } = await this.parse(MemorySave);
-        const scope = (0, memory_scope_1.resolveMemoryScopeOrFail)(flags, (m) => this.error(m, { exit: 1 }));
-        let body = {};
-        try {
-            body = await (0, prompt_1.readJsonBody)(flags['from-json']);
-        }
-        catch (err) {
-            this.error(err.message, { exit: 1 });
-        }
-        const payload = (0, prompt_1.mergeDefined)(body, {
-            key: flags.key,
-            value: flags.value,
+        const next = flags.agent
+            ? `skrr memory maintain remember '{"path":"/notes","claim":"your memory"}' --agent ${flags.agent}`
+            : 'skrr memory topics create --help (choose an Agent or Space Store)';
+        this.failWithCliError({
+            code: 'LEGACY_MEMORY_WRITE_REMOVED',
+            message: `Flat memory writes have been retired. Use canonical Memory Stores. Run: ${next}`,
+            exit: 5,
+            retryable: false,
         });
-        if (!payload.key || typeof payload.key !== 'string') {
-            this.error('A key is required. Pass --key "..." or include it in --from-json.', { exit: 1 });
-        }
-        if (!payload.value || typeof payload.value !== 'string') {
-            this.error('A value is required. Pass --value "..." or include it in --from-json.', {
-                exit: 1,
-            });
-        }
-        let result;
-        try {
-            result = await data_provider_1.dataService.createMemory({
-                key: payload.key,
-                value: payload.value,
-            }, scope);
-        }
-        catch (err) {
-            this.handleApiError(err);
-        }
-        const guidance = scope.agentId ? (0, memory_workspace_guidance_1.semanticWorkspaceGuidance)(scope.agentId) : undefined;
-        if (flags.json) {
-            this.log(JSON.stringify(guidance ? { ...result, semanticWorkspace: guidance } : result, null, 2));
-            return;
-        }
-        this.log(`Saved memory ${result.memory.key}`);
-        if (guidance) {
-            this.log(`\n${guidance.message}`);
-            this.log(`To include a fact in that context, run:\n${guidance.nextCommand}`);
-        }
     }
 }
 exports.default = MemorySave;

package/dist/commands/memory/stores/list.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const data_schemas_1 = require("@skrr-ai/data-schemas");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
 class MemoryStoresList extends scoped_memory_command_1.ScopedMemoryCommand {
     static description = 'List Memory Stores mounted for an Agent session';
@@ -15,7 +14,7 @@ class MemoryStoresList extends scoped_memory_command_1.ScopedMemoryCommand {
         const { flags } = await this.parse(MemoryStoresList);
         const response = await this.memoryApi(flags.agent, `/stores${this.query(flags)}`);
         const result = {
-            stores: response.stores.map((store) => data_schemas_1.MountedMemoryStoreSchema.parse(store)),
+            stores: response.stores.map(scoped_memory_command_1.parseMountedMemoryStore),
         };
         if (flags.json)
             return this.log(JSON.stringify(result, null, 2));

package/dist/commands/memory/stores/update.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
+const prompt_1 = require("../../../lib/prompt");
 class MemoryStoresUpdate extends scoped_memory_command_1.ScopedMemoryCommand {
     static description = 'Update Memory Store metadata with revision CAS';
     static flags = {
@@ -18,10 +19,12 @@ class MemoryStoresUpdate extends scoped_memory_command_1.ScopedMemoryCommand {
         const store = await this.resolveStore(flags, { write: true });
         let attributes;
         try {
-            attributes = JSON.parse(flags.attributes);
+            attributes = (0, prompt_1.parseJsonFlag)(flags.attributes, '--attributes');
         }
-        catch {
-            this.error('--attributes must be valid JSON.', { exit: 2 });
+        catch (err) {
+            this.error(err instanceof Error ? err.message : '--attributes must be valid JSON.', {
+                exit: 2,
+            });
         }
         const body = {
             attributes,

package/dist/commands/skills/visibility.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+export default class SkillsVisibility extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        public: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        private: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        price: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/skills/visibility.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+class SkillsVisibility extends base_command_1.BaseCommand {
+    static description = 'Publish or unpublish an owned skill with a governed Store release';
+    static examples = [
+        '<%= config.bin %> store artifacts release skill <skill-id> --versionLabel 1.0 --artifactRef skill:<skill-id> --permission-manifest <json>',
+        '<%= config.bin %> skills visibility <skill-id> --public',
+        '<%= config.bin %> skills visibility <skill-id> --private',
+    ];
+    static args = {
+        id: core_1.Args.string({ description: 'Skill ID', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        public: core_1.Flags.boolean({ description: 'Publish the skill', exclusive: ['private'] }),
+        private: core_1.Flags.boolean({ description: 'Unpublish the skill', exclusive: ['public'] }),
+        price: core_1.Flags.integer({ description: 'Listing price in micro-USD' }),
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(SkillsVisibility);
+        if (!flags.public && !flags.private) {
+            this.error('Pass either --public or --private.', { exit: 2 });
+        }
+        if (flags.private && flags.price !== undefined) {
+            this.error('--price applies only when publishing with --public.', { exit: 2 });
+        }
+        let result;
+        try {
+            result = await data_provider_1.dataService.setSkillVisibility({
+                skillId: args.id,
+                isPublic: flags.public === true,
+                ...(flags.price !== undefined ? { price: flags.price } : {}),
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`Set skill ${args.id} visibility: ${flags.public ? 'public' : 'private'}`);
+    }
+}
+exports.default = SkillsVisibility;

package/dist/commands/store/admissions/approve.d.ts

@@ -11,6 +11,7 @@ export default class StoreAdmissionsApprove extends BaseCommand {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        artifact: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         note: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/store/admissions/approve.js

@@ -13,6 +13,7 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store admissions approve ar_abc123',
         '<%= config.bin %> store admissions approve skill_abc123 --kind skill',
+        '<%= config.bin %> store admissions approve store_release_abc123 --artifact',
     ];
     static args = {
         id: core_1.Args.string({
@@ -22,6 +23,7 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
         }),
     };
     static flags = {
+        artifact: core_1.Flags.boolean({ description: 'The id is a Skill or Action artifact release' }),
         kind: core_1.Flags.string({
             description: 'The id is a listing, not a release',
             options: ['skill', 'action'],
@@ -33,9 +35,13 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreAdmissionsApprove);
         try {
-            const result = flags.kind
-                ? await data_provider_1.dataService.approveStoreListingAdmission(flags.kind, args.id, flags.note)
-                : await data_provider_1.dataService.approveStoreReleaseAdmission(args.id, flags.note);
+            if (flags.artifact && flags.kind)
+                this.error('Use either --artifact or --kind');
+            const result = flags.artifact
+                ? await data_provider_1.dataService.approveStoreArtifactAdmission(args.id, flags.note)
+                : flags.kind
+                    ? await data_provider_1.dataService.approveStoreListingAdmission(flags.kind, args.id, flags.note)
+                    : await data_provider_1.dataService.approveStoreReleaseAdmission(args.id, flags.note);
             if (flags.json) {
                 this.log(JSON.stringify(result, null, 2));
                 return;

package/dist/commands/store/admissions/list.js

@@ -45,6 +45,12 @@ class StoreAdmissionsList extends base_command_1.BaseCommand {
                     name: l.name || '',
                     facets: (l.admission?.facets || []).join(','),
                 })),
+                ...(result.artifacts || []).map((a) => ({
+                    kind: `${a.entityType} artifact`,
+                    id: a.releaseId,
+                    name: `${a.entityId} v${a.versionLabel}`,
+                    facets: (a.admission?.facets || []).join(','),
+                })),
             ];
             if (!rows.length) {
                 this.log('Nothing waiting for review.');

package/dist/commands/store/admissions/refuse.d.ts

@@ -10,6 +10,7 @@ export default class StoreAdmissionsRefuse extends BaseCommand {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };
     static flags: {
+        artifact: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         note: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/store/admissions/refuse.js

@@ -12,6 +12,7 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store admissions refuse ar_abc123 --note "unbounded network egress"',
         '<%= config.bin %> store admissions refuse act_abc123 --kind action --note "reason"',
+        '<%= config.bin %> store admissions refuse store_release_abc123 --artifact --note "reason"',
     ];
     static args = {
         id: core_1.Args.string({
@@ -21,6 +22,7 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
         }),
     };
     static flags = {
+        artifact: core_1.Flags.boolean({ description: 'The id is a Skill or Action artifact release' }),
         kind: core_1.Flags.string({
             description: 'The id is a listing, not a release',
             options: ['skill', 'action'],
@@ -32,9 +34,13 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreAdmissionsRefuse);
         try {
-            const result = flags.kind
-                ? await data_provider_1.dataService.refuseStoreListingAdmission(flags.kind, args.id, flags.note || '')
-                : await data_provider_1.dataService.refuseStoreReleaseAdmission(args.id, flags.note || '');
+            if (flags.artifact && flags.kind)
+                this.error('Use either --artifact or --kind');
+            const result = flags.artifact
+                ? await data_provider_1.dataService.refuseStoreArtifactAdmission(args.id, flags.note || '')
+                : flags.kind
+                    ? await data_provider_1.dataService.refuseStoreListingAdmission(flags.kind, args.id, flags.note || '')
+                    : await data_provider_1.dataService.refuseStoreReleaseAdmission(args.id, flags.note || '');
             if (flags.json) {
                 this.log(JSON.stringify(result, null, 2));
                 return;

package/dist/commands/store/artifacts/release.d.ts

@@ -1,6 +1,8 @@
 import { BaseCommand } from '../../../base-command';
+export declare function parsePermissionManifest(value: string): Record<string, string[]>;
 export default class StoreArtifactsRelease extends BaseCommand {
     static description: string;
+    static examples: string[];
     static args: {
         entityType: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
         entityId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
@@ -8,6 +10,7 @@ export default class StoreArtifactsRelease extends BaseCommand {
     static flags: {
         versionLabel: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         artifactRef: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'permission-manifest': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         price: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         workspaceId: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/store/artifacts/release.js

@@ -1,10 +1,38 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parsePermissionManifest = parsePermissionManifest;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
+const permissionFields = [
+    'tools',
+    'connectors',
+    'dataScopes',
+    'networkDomains',
+    'secretNames',
+];
+function parsePermissionManifest(value) {
+    const parsed = JSON.parse(value);
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error('The permission manifest must be an object');
+    }
+    const manifest = parsed;
+    if (Object.keys(manifest).some((key) => !permissionFields.includes(key)) ||
+        permissionFields.some((key) => {
+            const entries = manifest[key];
+            return (!Array.isArray(entries) ||
+                !entries.every((entry) => typeof entry === 'string' && entry.trim() === entry && entry.length > 0) ||
+                new Set(entries).size !== entries.length);
+        })) {
+        throw new Error('The permission manifest must explicitly declare five arrays of unique, non-empty strings');
+    }
+    return manifest;
+}
 class StoreArtifactsRelease extends base_command_1.BaseCommand {
     static description = 'Publish an immutable dependency release for your own skill or action';
+    static examples = [
+        '<%= config.bin %> store artifacts release skill <skill-id> --versionLabel 1.0 --artifactRef skill:<skill-id> --permission-manifest <json>',
+    ];
     static args = {
         entityType: core_1.Args.string({ required: true, ignoreStdin: true }),
         entityId: core_1.Args.string({ required: true, ignoreStdin: true }),
@@ -12,6 +40,10 @@ class StoreArtifactsRelease extends base_command_1.BaseCommand {
     static flags = {
         versionLabel: core_1.Flags.string({ required: true }),
         artifactRef: core_1.Flags.string({ required: true }),
+        'permission-manifest': core_1.Flags.string({
+            required: true,
+            description: 'Explicit JSON declaration of tools, connectors, dataScopes, networkDomains, and secretNames used by this release',
+        }),
         price: core_1.Flags.integer({ description: 'Price in micro-USD; omit for zero-price' }),
         workspaceId: core_1.Flags.string({ description: 'Publish as this workspace' }),
         json: core_1.Flags.boolean({ description: 'Output JSON' }),
@@ -19,9 +51,19 @@ class StoreArtifactsRelease extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreArtifactsRelease);
+        let permissionManifest;
+        try {
+            permissionManifest = parsePermissionManifest(flags['permission-manifest']);
+        }
+        catch {
+            this.error('--permission-manifest must declare tools, connectors, dataScopes, networkDomains, and secretNames as string arrays', {
+                exit: 2,
+            });
+        }
         const result = await data_provider_1.dataService.publishStoreArtifactRelease(args.entityType, args.entityId, {
             versionLabel: flags.versionLabel,
             artifactRef: flags.artifactRef,
+            permissionManifest,
             ...(flags.price !== undefined ? { price: flags.price } : {}),
             ...(flags.workspaceId ? { publishAs: { workspaceId: flags.workspaceId } } : {}),
         });

package/dist/commands/store/update.js

@@ -51,7 +51,7 @@ class StoreUpdate extends base_command_1.BaseCommand {
         if (!status?.purchased) {
             this.error(`${args.agentId} is not installed from the Store. Install it first: skrr store install ${args.agentId}`, { exit: 1 });
         }
-        if (status.pendingUpdate && !flags.decline) {
+        if (status.pendingUpdate && !flags.decline && !flags.json) {
             this.log(`A ${status.pendingUpdate.versionLabel ?? 'new'} release is waiting for review ` +
                 `(${status.pendingUpdate.reason}).`);
         }
@@ -71,6 +71,10 @@ class StoreUpdate extends base_command_1.BaseCommand {
             // hands back the body as TEXT, so reading `err.body` as an object never
             // saw a code at all and both answers below fell through to a bare error.
             const body = (0, http_error_1.httpBodyOf)(err);
+            // The shared error renderer keeps the server's typed refusal in one JSON
+            // envelope. Human guidance below would corrupt stdout in --json mode.
+            if (flags.json)
+                this.handleApiError(err);
             // Not an update: a new major is a separate purchase. Say which version
             // keeps its free updates, and offer no command — none sells a second
             // major of a listing yet, and `store install` refuses one you own.

package/dist/commands/store/updates.d.ts

@@ -9,7 +9,7 @@ import { BaseCommand } from '../../base-command';
  *
  * Three states, kept apart because they ask for three different things:
  *
- *   ready    a same-major release that will apply cleanly
+ *   ready    a same-major release is available; eligibility is checked on apply
  *   review   one that could not be applied on its own — you and the publisher
  *            both changed the same field, the release widened capabilities, or
  *            the version your copy came from is unknown