@skrr-ai/cli 0.1.65 → 0.1.67

package/dist/commands/agents/visibility.d.ts

@@ -10,6 +10,14 @@ export declare function parseCapabilityRationales(entries: readonly string[] | u
     rationales?: Record<string, string>;
     error?: string;
 };
+export declare function parseReleaseDependencies(entries: readonly string[] | undefined): {
+    dependencies?: Array<{
+        entityType: 'skill' | 'action';
+        entityId: string;
+        artifactVersionId: string;
+    }>;
+    error?: string;
+};
 export default class AgentsVisibility extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -27,6 +35,7 @@ export default class AgentsVisibility extends BaseCommand {
         'version-minor': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'capability-rationale': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         language: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        dependency: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/visibility.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseCapabilityRationales = parseCapabilityRationales;
+exports.parseReleaseDependencies = parseReleaseDependencies;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -28,6 +29,23 @@ function parseCapabilityRationales(entries) {
     }
     return { rationales };
 }
+function parseReleaseDependencies(entries) {
+    if (!entries?.length)
+        return {};
+    const dependencies = [];
+    for (const entry of entries) {
+        const match = /^(skill|action):([^@]+)@(store_release_[A-Za-z0-9_-]+)$/.exec(entry);
+        if (!match) {
+            return { error: `--dependency expects skill:<id>@<store-release-id> or action:<id>@<store-release-id>, got "${entry}".` };
+        }
+        dependencies.push({
+            entityType: match[1],
+            entityId: match[2],
+            artifactVersionId: match[3],
+        });
+    }
+    return { dependencies };
+}
 class AgentsVisibility extends base_command_1.BaseCommand {
     static description = 'Set the visibility of an agent (accounts with 2FA need recent step-up for public publishing)';
     static examples = [
@@ -37,6 +55,7 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         '<%= config.bin %> agents visibility <agent-id> --public --json',
         '<%= config.bin %> agents visibility <agent-id> --public --capability-rationale "network:*=Looks up flight prices on the web"',
         '<%= config.bin %> agents visibility <agent-id> --public --language en --language zh-Hans',
+        '<%= config.bin %> agents visibility <agent-id> --public --dependency skill:<skill-id>@<store-release-id>',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
@@ -72,6 +91,10 @@ class AgentsVisibility extends base_command_1.BaseCommand {
             description: 'A language the release works in, as a BCP 47 tag such as en or zh-Hans (repeatable). Shown on the listing as declared by you; the platform does not check it.',
             multiple: true,
         }),
+        dependency: core_1.Flags.string({
+            description: 'Pin an attached Skill or Action to its immutable Store release: skill:<id>@<store-release-id> (repeatable)',
+            multiple: true,
+        }),
     };
     async run() {
         this.requireAuth();
@@ -84,6 +107,12 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         if (rationaleError) {
             this.error(rationaleError, { exit: 1 });
         }
+        const { dependencies, error: dependencyError } = parseReleaseDependencies(flags.dependency);
+        if (dependencyError)
+            this.error(dependencyError, { exit: 1 });
+        if (dependencies && !isPublic) {
+            this.error('--dependency declares pins on a public release; pass it with --public.', { exit: 1 });
+        }
         if (capabilityRationales && !isPublic) {
             this.error('--capability-rationale applies only when publishing with --public.', {
                 exit: 1,
@@ -131,6 +160,7 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 versionMinor: flags['version-minor'],
                 capabilityRationales,
                 supportedLanguages: flags.language,
+                dependencies,
             });
         }
         catch (err) {

package/dist/commands/logout.js

@@ -35,9 +35,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.shouldSkipLocalLogout = shouldSkipLocalLogout;
 const core_1 = require("@oclif/core");
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
 const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
@@ -112,21 +109,6 @@ function shouldSkipLocalLogout(input) {
 function platformManagedHandoff() {
     return (0, dedicated_service_1.runningOnDedicatedRuntimeGuest)() && Boolean((0, daemonBroker_1.findBrokeredHandoffDescriptor)());
 }
-/**
- * Whether this computer has a configured skrr background service — the file
- * `skrr daemon install` writes, which a logout deliberately does not remove
- * (the service's OWN credential is what becomes unreadable; OSK-12483).
- * The daemon's profile dir is `~/.skrr/profiles/<name>` for every profile,
- * including `default`.
- */
-function daemonConfigPresent(profile) {
-    try {
-        return fs.existsSync(path.join(os.homedir(), '.skrr', 'profiles', profile, 'daemon.json'));
-    }
-    catch {
-        return false;
-    }
-}
 const SIGN_IN_AGAIN = 'To sign in again, run `skrr login`.';
 class Logout extends base_command_1.BaseCommand {
     static description = 'Sign out and clear locally-stored tokens. ' +
@@ -214,39 +196,36 @@ class Logout extends base_command_1.BaseCommand {
         (0, auth_storage_1.clearAllBackends)();
         // Sweep the credentials this product wrote under its PREVIOUS brand.
         //
-        // Without this, logout removed only the current service and still reported
-        // an unqualified "Signed out." — leaving the pre-rename CLI credential, the
-        // pre-rename daemon credentials and BOTH KEKs on the machine, so the sealed
-        // envelope and the key that unwraps it were both still there. `--all-devices`
-        // is documented for "a stolen-laptop incident", which is precisely when that
-        // is the wrong outcome.
-        //
-        // Reported rather than silent: this destroys credentials, and one of them
-        // may belong to a still-installed `oversky` binary.
-        const sweptLegacy = keychain.deleteLegacyBrandEntries();
-        // L11/L12 — also wipe shared device-identity + envelope artifacts.
-        // These files live under ~/.skrr/profiles/default/ and are shared
-        // with the daemon, so a `skrr logout` here also rotates the daemon's
-        // identity on the next start. Each call is wrapped so a single
-        // cleanup failure (permissions, transient fs error) doesn't break
-        // the local logout — the user already saw "Signed out" intent.
-        try {
-            await (0, device_identity_1.resetDeviceIdentity)({ profile: 'default', clearOnDisk: true });
-        }
-        catch {
-            /* best-effort */
-        }
-        try {
-            (0, device_identity_1.clearEnrollmentMarker)('default');
-        }
-        catch {
-            /* best-effort */
-        }
-        try {
-            await (0, cred_envelope_1.resetCredEnvelope)({ profile: 'default', clearOnDisk: true });
-        }
-        catch {
-            /* best-effort */
+        // Ordinary logout clears retired CLI slots only. The explicit
+        // all-devices operation also clears retired daemon credentials and KEKs.
+        // Removing those during a CLI-only logout would break a running daemon's
+        // next restart or refresh (OSK-12483).
+        const sweptLegacy = keychain.deleteLegacyBrandEntries({
+            includeMachineCredentials: flags['all-devices'],
+        });
+        // Device identity and the wrapped DEK belong to the daemon as well as the
+        // CLI. Preserve both for a CLI-only logout. An explicit all-devices logout
+        // revokes daemon sessions and may then clear this profile's machine keys.
+        if (flags['all-devices']) {
+            const profile = keychain.getActiveProfile();
+            try {
+                await (0, device_identity_1.resetDeviceIdentity)({ profile, clearOnDisk: true });
+            }
+            catch {
+                /* best-effort */
+            }
+            try {
+                (0, device_identity_1.clearEnrollmentMarker)(profile);
+            }
+            catch {
+                /* best-effort */
+            }
+            try {
+                await (0, cred_envelope_1.resetCredEnvelope)({ profile, clearOnDisk: true });
+            }
+            catch {
+                /* best-effort */
+            }
         }
         // Strip any stray token/refreshToken from cli-config.json too —
         // `migrateAuthOutOfConfig` should have done this at init time, but
@@ -300,18 +279,8 @@ class Logout extends base_command_1.BaseCommand {
         }
         else {
             this.log(SIGN_IN_AGAIN);
-            // OSK-12483 — the shared envelope wipe above also orphans THIS machine's
-            // daemon credential (it is sealed under the DEK just deleted). The
-            // running daemon keeps working on its in-memory copy, but its next start
-            // cannot read the stored one and needs `skrr daemon login` — a plain
-            // `skrr login` mints a cli-scope credential and does not re-enroll it.
-            // Say that now, while the person is still looking at a screen; otherwise
-            // the daemon simply never comes back and nothing anywhere names why.
-            // `daemon.json` is written when the service is installed/configured and
-            // survives this logout.
-            if (daemonConfigPresent(keychain.getActiveProfile())) {
-                this.log("This also signs out this computer's skrr background service — it will need " +
-                    '`skrr daemon login` before it runs again.');
+            if (!flags['all-devices']) {
+                this.log('The skrr background service keeps its own sign-in and may provide CLI access.');
             }
         }
         if (sweptLegacy.length > 0) {

package/dist/commands/memory/mounts/resolve.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const data_schemas_1 = require("@skrr-ai/data-schemas");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
 class MemoryMountsResolve extends scoped_memory_command_1.ScopedMemoryCommand {
     static description = 'Resolve the ACL-aware Memory mounts for an Agent session';
@@ -14,7 +13,7 @@ class MemoryMountsResolve extends scoped_memory_command_1.ScopedMemoryCommand {
         this.requireAuth();
         const { flags } = await this.parse(MemoryMountsResolve);
         const response = await this.memoryApi(flags.agent, `/mounts${this.query(flags)}`);
-        const result = { mounts: response.mounts.map((mount) => data_schemas_1.MemoryMountSchema.parse(mount)) };
+        const result = { mounts: response.mounts.map(scoped_memory_command_1.parseMemoryMount) };
         if (flags.json)
             return this.log(JSON.stringify(result, null, 2));
         for (const mount of result.mounts) {

package/dist/commands/memory/save.d.ts

@@ -1,4 +1,5 @@
 import { BaseCommand } from '../../base-command';
+/** Compatibility entry point for a write API removed by canonical Memory Stores. */
 export default class MemorySave extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/memory/save.js

@@ -1,72 +1,33 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
-const prompt_1 = require("../../lib/prompt");
 const memory_scope_1 = require("../../lib/memory-scope");
-const memory_workspace_guidance_1 = require("../../lib/memory-workspace-guidance");
+/** Compatibility entry point for a write API removed by canonical Memory Stores. */
 class MemorySave extends base_command_1.BaseCommand {
-    static description = 'Create a flat key/value memory in a pool (owner, an agent, user, or workspace)';
+    static description = 'Retired flat memory write; use memory maintain remember or memory topics create';
     static examples = [
-        '<%= config.bin %> memory save --key "user-preference" --value "dark mode"',
-        '<%= config.bin %> memory save --from-json memory.json',
-        '<%= config.bin %> memory save --key "note" --value "remember this" --json',
-        '<%= config.bin %> memory save --key "team-norm" --value "ship on fridays" --tier workspace --pool-workspace ws_123',
-        '<%= config.bin %> memory maintain remember \'{"path":"/notes","claim":"remember this"}\' --agent agent_abc123',
+        '<%= config.bin %> memory maintain remember \'{"path":"/notes","claim":"Remember this."}\' --agent agent_abc123',
+        '<%= config.bin %> memory topics create --help',
     ];
     static flags = {
-        json: core_1.Flags.boolean({ description: 'Output the created memory as JSON' }),
-        'from-json': core_1.Flags.string({
-            description: 'Path to a JSON file (or "-" for stdin) to use as the request body',
-        }),
-        key: core_1.Flags.string({ description: 'Memory key (required unless set via --from-json)' }),
-        value: core_1.Flags.string({ description: 'Memory value (required unless set via --from-json)' }),
+        json: core_1.Flags.boolean({ description: 'Output errors as JSON' }),
+        'from-json': core_1.Flags.string({ description: 'Retired flat memory input' }),
+        key: core_1.Flags.string({ description: 'Retired flat memory key' }),
+        value: core_1.Flags.string({ description: 'Retired flat memory value' }),
         ...memory_scope_1.memoryScopeFlags,
     };
     async run() {
-        this.requireAuth();
         const { flags } = await this.parse(MemorySave);
-        const scope = (0, memory_scope_1.resolveMemoryScopeOrFail)(flags, (m) => this.error(m, { exit: 1 }));
-        let body = {};
-        try {
-            body = await (0, prompt_1.readJsonBody)(flags['from-json']);
-        }
-        catch (err) {
-            this.error(err.message, { exit: 1 });
-        }
-        const payload = (0, prompt_1.mergeDefined)(body, {
-            key: flags.key,
-            value: flags.value,
+        const next = flags.agent
+            ? `skrr memory maintain remember '{"path":"/notes","claim":"your memory"}' --agent ${flags.agent}`
+            : 'skrr memory topics create --help (choose an Agent or Space Store)';
+        this.failWithCliError({
+            code: 'LEGACY_MEMORY_WRITE_REMOVED',
+            message: `Flat memory writes have been retired. Use canonical Memory Stores. Run: ${next}`,
+            exit: 5,
+            retryable: false,
         });
-        if (!payload.key || typeof payload.key !== 'string') {
-            this.error('A key is required. Pass --key "..." or include it in --from-json.', { exit: 1 });
-        }
-        if (!payload.value || typeof payload.value !== 'string') {
-            this.error('A value is required. Pass --value "..." or include it in --from-json.', {
-                exit: 1,
-            });
-        }
-        let result;
-        try {
-            result = await data_provider_1.dataService.createMemory({
-                key: payload.key,
-                value: payload.value,
-            }, scope);
-        }
-        catch (err) {
-            this.handleApiError(err);
-        }
-        const guidance = scope.agentId ? (0, memory_workspace_guidance_1.semanticWorkspaceGuidance)(scope.agentId) : undefined;
-        if (flags.json) {
-            this.log(JSON.stringify(guidance ? { ...result, semanticWorkspace: guidance } : result, null, 2));
-            return;
-        }
-        this.log(`Saved memory ${result.memory.key}`);
-        if (guidance) {
-            this.log(`\n${guidance.message}`);
-            this.log(`To include a fact in that context, run:\n${guidance.nextCommand}`);
-        }
     }
 }
 exports.default = MemorySave;

package/dist/commands/memory/stores/list.js

@@ -1,7 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
-const data_schemas_1 = require("@skrr-ai/data-schemas");
 const scoped_memory_command_1 = require("../../../lib/scoped-memory-command");
 class MemoryStoresList extends scoped_memory_command_1.ScopedMemoryCommand {
     static description = 'List Memory Stores mounted for an Agent session';
@@ -15,7 +14,7 @@ class MemoryStoresList extends scoped_memory_command_1.ScopedMemoryCommand {
         const { flags } = await this.parse(MemoryStoresList);
         const response = await this.memoryApi(flags.agent, `/stores${this.query(flags)}`);
         const result = {
-            stores: response.stores.map((store) => data_schemas_1.MountedMemoryStoreSchema.parse(store)),
+            stores: response.stores.map(scoped_memory_command_1.parseMountedMemoryStore),
         };
         if (flags.json)
             return this.log(JSON.stringify(result, null, 2));

package/dist/commands/store/admissions/approve.js

@@ -13,6 +13,7 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store admissions approve ar_abc123',
         '<%= config.bin %> store admissions approve skill_abc123 --kind skill',
+        '<%= config.bin %> store admissions approve store_release_abc123 --kind artifact',
         '<%= config.bin %> store admissions approve store_release_abc123 --artifact',
     ];
     static args = {
@@ -25,8 +26,8 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
     static flags = {
         artifact: core_1.Flags.boolean({ description: 'The id is a Skill or Action artifact release' }),
         kind: core_1.Flags.string({
-            description: 'The id is a listing, not a release',
-            options: ['skill', 'action'],
+            description: 'The id is a skill/action listing or a Store artifact release',
+            options: ['skill', 'action', 'artifact'],
         }),
         note: core_1.Flags.string({ description: 'Decision note' }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
@@ -35,9 +36,10 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreAdmissionsApprove);
         try {
-            if (flags.artifact && flags.kind)
-                this.error('Use either --artifact or --kind');
-            const result = flags.artifact
+            if (flags.artifact && flags.kind && flags.kind !== 'artifact') {
+                this.error('Use either --artifact or a listing --kind');
+            }
+            const result = flags.artifact || flags.kind === 'artifact'
                 ? await data_provider_1.dataService.approveStoreArtifactAdmission(args.id, flags.note)
                 : flags.kind
                     ? await data_provider_1.dataService.approveStoreListingAdmission(flags.kind, args.id, flags.note)

package/dist/commands/store/admissions/list.js

@@ -9,7 +9,7 @@ const base_command_1 = require("../../../base-command");
  * not the publisher.
  */
 class StoreAdmissionsList extends base_command_1.BaseCommand {
-    static description = 'List releases and listings awaiting capability-tiered review (store_curation)';
+    static description = 'List Agent releases, artifact releases and listings awaiting capability-tiered review (store_curation)';
     static examples = [
         '<%= config.bin %> store admissions list',
         '<%= config.bin %> store admissions list --state refused --json',
@@ -28,8 +28,22 @@ class StoreAdmissionsList extends base_command_1.BaseCommand {
             const result = await data_provider_1.dataService.getStoreReleaseAdmissions({
                 state: flags.state === 'refused' ? 'refused' : 'pending_review',
             });
+            const artifacts = [...(result.artifacts || [])];
+            let after = result.artifactNextCursor;
+            const seen = new Set();
+            while (after) {
+                if (seen.has(after))
+                    throw new Error('Artifact admission queue returned a repeated cursor');
+                seen.add(after);
+                const page = await data_provider_1.dataService.getStoreReleaseAdmissions({
+                    state: flags.state === 'refused' ? 'refused' : 'pending_review',
+                    artifactAfter: after,
+                });
+                artifacts.push(...(page.artifacts || []));
+                after = page.artifactNextCursor;
+            }
             if (flags.json) {
-                this.log(JSON.stringify(result, null, 2));
+                this.log(JSON.stringify({ ...result, artifacts, artifactNextCursor: null }, null, 2));
                 return;
             }
             const rows = [
@@ -45,7 +59,7 @@ class StoreAdmissionsList extends base_command_1.BaseCommand {
                     name: l.name || '',
                     facets: (l.admission?.facets || []).join(','),
                 })),
-                ...(result.artifacts || []).map((a) => ({
+                ...artifacts.map((a) => ({
                     kind: `${a.entityType} artifact`,
                     id: a.releaseId,
                     name: `${a.entityId} v${a.versionLabel}`,

package/dist/commands/store/admissions/refuse.js

@@ -12,6 +12,7 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store admissions refuse ar_abc123 --note "unbounded network egress"',
         '<%= config.bin %> store admissions refuse act_abc123 --kind action --note "reason"',
+        '<%= config.bin %> store admissions refuse store_release_abc123 --kind artifact --note "reason"',
         '<%= config.bin %> store admissions refuse store_release_abc123 --artifact --note "reason"',
     ];
     static args = {
@@ -24,8 +25,8 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
     static flags = {
         artifact: core_1.Flags.boolean({ description: 'The id is a Skill or Action artifact release' }),
         kind: core_1.Flags.string({
-            description: 'The id is a listing, not a release',
-            options: ['skill', 'action'],
+            description: 'The id is a skill/action listing or a Store artifact release',
+            options: ['skill', 'action', 'artifact'],
         }),
         note: core_1.Flags.string({ description: 'Why the refusal — required', required: true }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
@@ -34,9 +35,10 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreAdmissionsRefuse);
         try {
-            if (flags.artifact && flags.kind)
-                this.error('Use either --artifact or --kind');
-            const result = flags.artifact
+            if (flags.artifact && flags.kind && flags.kind !== 'artifact') {
+                this.error('Use either --artifact or a listing --kind');
+            }
+            const result = flags.artifact || flags.kind === 'artifact'
                 ? await data_provider_1.dataService.refuseStoreArtifactAdmission(args.id, flags.note || '')
                 : flags.kind
                     ? await data_provider_1.dataService.refuseStoreListingAdmission(flags.kind, args.id, flags.note || '')

package/dist/commands/store/install.js

@@ -60,18 +60,18 @@ class StoreInstall extends base_command_1.BaseCommand {
         // The server still refuses a second install of a listing you own — this is
         // the friendly read that says so before a quote or a prompt (OSK-12287:
         // `installs` is the read model; `purchased` answers membership cheaply).
+        let alreadyInstalled = false;
         try {
             const owned = await data_provider_1.dataService.getPurchasedAgents();
-            if ((owned?.purchasedAgentIds ?? []).includes(args.agentId)) {
-                this.error(`${args.agentId} is already installed. See it: skrr store updates, or update it: skrr store update ${args.agentId}`, { exit: 1 });
-            }
+            alreadyInstalled = (owned?.purchasedAgentIds ?? []).includes(args.agentId);
         }
         catch (err) {
             // A read failure must not block an install — the server re-checks anyway.
-            if (err.exit)
-                throw err;
             this.warn(`Could not check what you own (${err.message}); continuing.`);
         }
+        if (alreadyInstalled) {
+            this.error(`${args.agentId} is already installed. See it: skrr store updates, or update it: skrr store update ${args.agentId}`, { exit: 1 });
+        }
         // What installing would charge NOW, resolved by the server the way the
         // install resolves it (OSK-12240). The install then pins what was shown, so
         // a listing whose price moved in between is refused rather than charged.

package/dist/commands/store/update.js

@@ -51,7 +51,7 @@ class StoreUpdate extends base_command_1.BaseCommand {
         if (!status?.purchased) {
             this.error(`${args.agentId} is not installed from the Store. Install it first: skrr store install ${args.agentId}`, { exit: 1 });
         }
-        if (status.pendingUpdate && !flags.decline) {
+        if (status.pendingUpdate && !flags.decline && !flags.json) {
             this.log(`A ${status.pendingUpdate.versionLabel ?? 'new'} release is waiting for review ` +
                 `(${status.pendingUpdate.reason}).`);
         }
@@ -71,6 +71,10 @@ class StoreUpdate extends base_command_1.BaseCommand {
             // hands back the body as TEXT, so reading `err.body` as an object never
             // saw a code at all and both answers below fell through to a bare error.
             const body = (0, http_error_1.httpBodyOf)(err);
+            // The shared error renderer keeps the server's typed refusal in one JSON
+            // envelope. Human guidance below would corrupt stdout in --json mode.
+            if (flags.json)
+                this.handleApiError(err);
             // Not an update: a new major is a separate purchase. Say which version
             // keeps its free updates, and offer no command — none sells a second
             // major of a listing yet, and `store install` refuses one you own.

package/dist/commands/store/updates.d.ts

@@ -9,7 +9,7 @@ import { BaseCommand } from '../../base-command';
  *
  * Three states, kept apart because they ask for three different things:
  *
- *   ready    a same-major release that will apply cleanly
+ *   ready    a same-major release is available; eligibility is checked on apply
  *   review   one that could not be applied on its own — you and the publisher
  *            both changed the same field, the release widened capabilities, or
  *            the version your copy came from is unknown

package/dist/commands/store/updates.js

@@ -14,7 +14,7 @@ const format_1 = require("../../lib/format");
  *
  * Three states, kept apart because they ask for three different things:
  *
- *   ready    a same-major release that will apply cleanly
+ *   ready    a same-major release is available; eligibility is checked on apply
  *   review   one that could not be applied on its own — you and the publisher
  *            both changed the same field, the release widened capabilities, or
  *            the version your copy came from is unknown
@@ -82,7 +82,7 @@ class StoreUpdates extends base_command_1.BaseCommand {
                     channel: install.updatePolicy ?? 'manual',
                     have,
                     waiting: update.versionLabel ?? '-',
-                    detail: 'available; changes and capabilities are checked when you update',
+                    detail: 'available; checked on apply',
                 });
             }
             if (install.stopReason) {
@@ -122,7 +122,7 @@ class StoreUpdates extends base_command_1.BaseCommand {
             { key: 'detail', header: 'WHY', maxWidth: 46 },
         ], (line) => this.log(line));
         this.log('');
-        this.log('ready  → skrr store update <agent>');
+        this.log('ready  → available; checks run on apply: skrr store update <agent>');
         this.log('review → skrr store update <agent> --strategy replace   (takes the publisher version)');
         this.log('widened → skrr store update <agent> --accept-capabilities   (or --decline to keep yours)');
         // No command: `store install` refuses a listing you already own, and