@skrr-ai/cli 0.1.79 → 0.1.81

package/dist/base-command.d.ts

@@ -52,6 +52,10 @@ export declare abstract class BaseCommand extends Command {
      * from here.
      */
     protected resolvedCredential: ResolvedCredential;
+    /** Re-authorize a long-lived transport using this command's credential
+     * source. A daemon handoff is redeemed again; its refresh family is never
+     * borrowed or written into the CLI's own login. */
+    protected refreshTransportToken(): Promise<string>;
     /**
      * Where `resolvedCredential` really came from when its `source` slot cannot
      * say — an in-memory daemon hand-off or Agent session token is recorded as

package/dist/base-command.js

@@ -155,6 +155,25 @@ class BaseCommand extends core_1.Command {
      * from here.
      */
     resolvedCredential;
+    /** Re-authorize a long-lived transport using this command's credential
+     * source. A daemon handoff is redeemed again; its refresh family is never
+     * borrowed or written into the CLI's own login. */
+    async refreshTransportToken() {
+        if (this.credentialProvenance?.kind === 'daemon-handoff') {
+            const result = await (0, daemonBroker_1.redeemBrokeredHandoffToken)(true);
+            if (!result?.accessToken)
+                throw new Error('The local daemon could not renew CLI authentication.');
+            this.resolvedCredential = { token: result.accessToken, source: 'env-token',
+                kind: (0, auth_core_1.classifyTokenKind)(result.accessToken) };
+        }
+        else {
+            this.resolvedCredential = (await (0, refresh_1.ensureFreshCliCredential)({ credential: this.resolvedCredential,
+                bareMode: this.bareMode })).credential;
+        }
+        if (!this.resolvedCredential.token)
+            throw new Error('CLI authentication is unavailable.');
+        return this.resolvedCredential.token;
+    }
     /**
      * Where `resolvedCredential` really came from when its `source` slot cannot
      * say — an in-memory daemon hand-off or Agent session token is recorded as
@@ -399,7 +418,10 @@ class BaseCommand extends core_1.Command {
                 }
                 else if ((this.brokerRefusal =
                     (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
-                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin))) {
+                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin) ??
+                        // A laptop daemon that is down or mid-restart is not the person
+                        // being signed out (OSK-13222).
+                        (0, daemonBrokerRefusal_1.describeLocalDaemonUnavailable)(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
                 }
                 else if (autoResult.outcome.reason === 'rate_limited') {
@@ -760,7 +782,11 @@ class BaseCommand extends core_1.Command {
                 // Same code as the plain case — scripts branch on NOT_SIGNED_IN — with
                 // the daemon's answer in the message and in `details.broker`.
                 this.failWithCliError({
-                    message: `Not signed in. ${refusal.headline}\n→ ${refusal.remedy}`,
+                    // A daemon that is down or restarting holds the person's sign-in; it
+                    // has not been lost, so the sentence must not say it has (OSK-13222).
+                    message: refusal.daemonUnavailable
+                        ? `No credential from the skrr background service. ${refusal.headline}\n→ ${refusal.remedy}`
+                        : `Not signed in. ${refusal.headline}\n→ ${refusal.remedy}`,
                     code: 'NOT_SIGNED_IN',
                     exit: 2,
                     retryable: refusal.transient,
@@ -1169,11 +1195,15 @@ class BaseCommand extends core_1.Command {
                 // `login` sends a CI job to do the one thing it cannot, and hides the
                 // real mistake (dogfood OSK-4693). Name the credential instead.
                 const presentedCiToken = Boolean(this.resolvedCredential?.token?.startsWith('osk_ci_'));
+                // A personal access token (OSK-13208) has no session behind it to renew
+                // and no daemon to ask: the server's own reason (expired, revoked) IS
+                // the answer, and the repair is a new token, not `login`.
+                const presentedPat = Boolean(this.resolvedCredential?.token?.startsWith('osk_pat_'));
                 // OSK-12116 — the 401 is usually the SECOND failure: the token expired
                 // (routine) and renewing it was refused (the fault). The server's code
                 // for the retry is `TOKEN_EXPIRED`, which names the routine half; the
                 // latched refresh refusal names the half the reader can act on.
-                const refreshRefusal = presentedCiToken
+                const refreshRefusal = presentedCiToken || presentedPat
                     ? null
                     : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
                         bin: this.config.bin,
@@ -1183,7 +1213,7 @@ class BaseCommand extends core_1.Command {
                 // refused refresh, and the daemon refused too. Its reason decides the
                 // repair (OSK-12149, OSK-12151), and on a Dedicated guest there is no
                 // login to run, so its remedy replaces the generic "Run login".
-                const brokerRefusal = presentedCiToken || !e.brokerFailure
+                const brokerRefusal = presentedCiToken || presentedPat || !e.brokerFailure
                     ? null
                     : (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin);
                 const renewal = refreshRefusal
@@ -1202,6 +1232,12 @@ class BaseCommand extends core_1.Command {
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
                             `not accept it — sign in with \`${this.config.bin} login\` instead.`;
                 }
+                else if (presentedPat) {
+                    authMessage =
+                        `Authentication failed: ${bodyMessage || 'the personal access token was refused.'} ` +
+                            `Create a new token with \`${this.config.bin} tokens create\` from a signed-in terminal ` +
+                            `and update the secret that sets SKRR_TOKEN.`;
+                }
                 else if (brokerRefusal) {
                     authMessage = `Authentication failed. ${renewal} ${brokerRefusal.headline}\n→ ${brokerRefusal.remedy}`;
                 }

package/dist/commands/agents/visibility.d.ts

@@ -1,3 +1,4 @@
+import type { StoreReleaseLicense } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
 /**
  * `--capability-rationale <permission-key>=<note>` → the publisher notes a
@@ -18,6 +19,16 @@ export declare function parseReleaseDependencies(entries: readonly string[] | un
     }>;
     error?: string;
 };
+/**
+ * `--license` / `--remix` → the `license` declaration a public release carries
+ * (SUP11). Values are already constrained by the flags' `options`; this only
+ * enforces the pairing the flags cannot express: a remix grant is part of a
+ * license declaration, so it is meaningless without one.
+ */
+export declare function buildReleaseLicense(licenseId: string | undefined, remix: string | undefined): {
+    license?: StoreReleaseLicense;
+    error?: string;
+};
 export default class AgentsVisibility extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -36,6 +47,9 @@ export default class AgentsVisibility extends BaseCommand {
         'capability-rationale': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         language: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         dependency: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        remix: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'source-visibility': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/visibility.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseCapabilityRationales = parseCapabilityRationales;
 exports.parseReleaseDependencies = parseReleaseDependencies;
+exports.buildReleaseLicense = buildReleaseLicense;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -48,6 +49,25 @@ function parseReleaseDependencies(entries) {
     }
     return { dependencies };
 }
+/**
+ * `--license` / `--remix` → the `license` declaration a public release carries
+ * (SUP11). Values are already constrained by the flags' `options`; this only
+ * enforces the pairing the flags cannot express: a remix grant is part of a
+ * license declaration, so it is meaningless without one.
+ */
+function buildReleaseLicense(licenseId, remix) {
+    if (!licenseId) {
+        return remix
+            ? { error: '--remix is part of a license declaration; pass it with --license <id>.' }
+            : {};
+    }
+    return {
+        license: {
+            id: licenseId,
+            ...(remix ? { remix: remix } : {}),
+        },
+    };
+}
 class AgentsVisibility extends base_command_1.BaseCommand {
     static description = 'Set the visibility of an agent';
     static examples = [
@@ -57,6 +77,8 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         '<%= config.bin %> agents visibility <agent-id> --public --capability-rationale "network:*=Looks up flight prices on the web"',
         '<%= config.bin %> agents visibility <agent-id> --public --language en --language zh-Hans',
         '<%= config.bin %> agents visibility <agent-id> --public --dependency skill:<skill-id>@<store-release-id>',
+        '<%= config.bin %> agents visibility <agent-id> --public --license mit --remix attributed --source-visibility public',
+        '<%= config.bin %> agents visibility <agent-id> --public --license proprietary --source-visibility sealed',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
@@ -96,6 +118,18 @@ class AgentsVisibility extends base_command_1.BaseCommand {
             description: 'Pin an attached Skill or Action to its immutable Store release: skill:<id>@<store-release-id> (repeatable)',
             multiple: true,
         }),
+        license: core_1.Flags.string({
+            description: 'The license the public release is offered under. Recorded on the release and shown on the listing; proprietary grants no reuse',
+            options: [...data_provider_1.STORE_RELEASE_LICENSE_IDS],
+        }),
+        remix: core_1.Flags.string({
+            description: "Whether a buyer's installed copy may be published as a derived listing: attributed (the fork credits this release) or none. Needs --license; defaults to none",
+            options: [...data_provider_1.STORE_RELEASE_REMIX_GRANTS],
+        }),
+        'source-visibility': core_1.Flags.string({
+            description: "Who may read the release's source, independent of price: licensed (license holders), public (anyone who sees the listing) or sealed (you only). Omit to keep the price-derived rule",
+            options: [...data_provider_1.STORE_RELEASE_SOURCE_VISIBILITIES],
+        }),
     };
     async run() {
         this.requireAuth();
@@ -128,6 +162,15 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 exit: 1,
             });
         }
+        const { license, error: licenseError } = buildReleaseLicense(flags.license, flags.remix);
+        if (licenseError)
+            this.error(licenseError, { exit: 1 });
+        const sourceVisibility = flags['source-visibility'];
+        // The server refuses both declarations with isPublic: false — they are
+        // terms of a public release, and an unpublish creates none.
+        if ((license || sourceVisibility) && !isPublic) {
+            this.error('--license, --remix and --source-visibility are terms of a public release; pass them with --public.', { exit: 1 });
+        }
         let result;
         try {
             result = await data_provider_1.dataService.setAgentVisibility({
@@ -141,6 +184,8 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 capabilityRationales,
                 supportedLanguages: flags.language,
                 dependencies,
+                license,
+                sourceVisibility,
             });
         }
         catch (err) {
@@ -152,6 +197,13 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         }
         const label = isPublic ? 'public' : 'private';
         this.log(`Set agent ${args.id} visibility: ${label}`);
+        const recorded = result;
+        if (recorded?.license) {
+            this.log(`License: ${recorded.license.id} (remix: ${recorded.license.remix})`);
+        }
+        if (recorded?.sourceVisibility) {
+            this.log(`Source visibility: ${recorded.sourceVisibility}`);
+        }
     }
 }
 exports.default = AgentsVisibility;

package/dist/commands/create-token.d.ts

@@ -43,7 +43,6 @@ import { BaseCommand } from '../base-command';
  */
 export default class CreateToken extends BaseCommand {
     static description: string;
-    static aliases: string[];
     static examples: string[];
     static flags: {
         name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/create-token.js

@@ -49,7 +49,9 @@ const api_fetch_1 = require("../lib/api-fetch");
 class CreateToken extends base_command_1.BaseCommand {
     static description = 'Create a long-lived token for bootstrapping a daemon on a CI/headless machine. ' +
         'Printed exactly once. Not accepted by `skrr` commands themselves.';
-    static aliases = ['tokens:create'];
+    // `tokens:create` used to alias this command. It now names personal access
+    // tokens (OSK-13208), the credential `skrr` itself accepts; this one only
+    // bootstraps a daemon, and sharing the name is what sent CI here.
     static examples = [
         '<%= config.bin %> create-token --name "github-actions-prod" --ttl 1y',
         '<%= config.bin %> create-token --name "local-ci" --ttl 30d',

package/dist/commands/inbox/index.js

@@ -8,6 +8,7 @@ const base_command_1 = require("../../base-command");
 const inbox_1 = require("../../lib/inbox");
 const format_1 = require("../../lib/format");
 const agentic_stream_1 = require("../../lib/agentic-stream");
+const dpop_auth_1 = require("../../lib/dpop-auth");
 /**
  * Stop `--follow` on Ctrl-C or SIGTERM, and end with the status a shell
  * reports for that signal (130 / 143).
@@ -241,11 +242,12 @@ class Inbox extends base_command_1.BaseCommand {
         const wsURL = (0, agentic_stream_1.toWebSocketOrigin)(this.cliConfig.baseURL);
         const socket = (0, socket_io_client_1.io)(wsURL, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: this.resolvedCredential.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
-            },
+            }, wsURL),
             extraHeaders: process.env.OVERSKY_WORKSPACE_ID
                 ? { 'X-Workspace-Id': process.env.OVERSKY_WORKSPACE_ID }
                 : undefined,

package/dist/commands/list-tokens.d.ts

@@ -8,7 +8,6 @@ import { BaseCommand } from '../base-command';
  */
 export default class ListTokens extends BaseCommand {
     static description: string;
-    static aliases: string[];
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         all: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/list-tokens.js

@@ -13,7 +13,7 @@ const api_fetch_1 = require("../lib/api-fetch");
  */
 class ListTokens extends base_command_1.BaseCommand {
     static description = 'List your long-lived CI tokens';
-    static aliases = ['tokens:list'];
+    // No `tokens:list` alias: `skrr tokens` is personal access tokens (OSK-13208).
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         all: core_1.Flags.boolean({

package/dist/commands/login.d.ts

@@ -12,9 +12,14 @@ import { BaseCommand } from '../base-command';
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI callers should NOT use this command — use
- *   skrr create-token --name <name> --ttl 365
- * and set `OVERSKY_TOKEN=osk_ci_...` in the CI environment.
+ * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
+ * `skrr create-token` mints an `osk_ci_*` token, and that token only
+ * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
+ * command rejects it with 401 (see create-token.ts and base-command.ts). What
+ * works today is a session minted for the machine with
+ * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
+ * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
+ * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /

package/dist/commands/login.js

@@ -27,9 +27,14 @@ const prompt_1 = require("../lib/prompt");
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI callers should NOT use this command — use
- *   skrr create-token --name <name> --ttl 365
- * and set `OVERSKY_TOKEN=osk_ci_...` in the CI environment.
+ * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
+ * `skrr create-token` mints an `osk_ci_*` token, and that token only
+ * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
+ * command rejects it with 401 (see create-token.ts and base-command.ts). What
+ * works today is a session minted for the machine with
+ * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
+ * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
+ * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /
@@ -60,7 +65,12 @@ class Login extends base_command_1.BaseCommand {
         'Set OVERSKY_SKIP_DAEMON_BROKER=1 to skip step 1 (--device-code skips it too). After signing ' +
         'in, skrr also signs the background service in, and on an interactive first login on a ' +
         'computer without it, offers to install it. Set SKRR_SKIP_DAEMON_HANDOFF=1 to skip that ' +
-        'optional setup; it does not skip step 1.';
+        'optional setup; it does not skip step 1.\n\n' +
+        'With no person to approve a sign-in (CI, a provisioning script): mint a session for that ' +
+        'machine with `skrr token mint --for <id>` and run this command there with ' +
+        'OVERSKY_REFRESH_TOKEN and OVERSKY_CLI_ID set. The refresh token rotates when used, so one ' +
+        'minted session serves one machine. Tokens from `skrr create-token` only bring up a ' +
+        'background service (`skrrd`); skrr commands reject them.';
     static examples = [
         '<%= config.bin %> login',
         '<%= config.bin %> login --env prod',

package/dist/commands/machines/dedicated/ssh-proxy.js

@@ -44,6 +44,7 @@ class DedicatedMachinesSshProxy extends dedicated_lease_command_1.DedicatedLease
             code = await (0, dedicated_ssh_1.runSshProxy)({
                 baseURL: this.cliConfig.baseURL,
                 token: this.resolvedCredential.token,
+                getToken: () => this.refreshTransportToken(),
                 leaseId: lease,
                 input: process.stdin,
                 output: process.stdout,

package/dist/commands/revoke-token.d.ts

@@ -11,7 +11,6 @@ import { BaseCommand } from '../base-command';
  */
 export default class RevokeToken extends BaseCommand {
     static description: string;
-    static aliases: string[];
     static args: {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };

package/dist/commands/revoke-token.js

@@ -15,7 +15,7 @@ const api_fetch_1 = require("../lib/api-fetch");
  */
 class RevokeToken extends base_command_1.BaseCommand {
     static description = 'Revoke a long-lived CI token by ID or unique prefix';
-    static aliases = ['tokens:revoke'];
+    // No `tokens:revoke` alias: `skrr tokens` is personal access tokens (OSK-13208).
     static args = {
         id: core_1.Args.string({
             name: 'id',

package/dist/commands/spaces/workflows/events.js

@@ -4,6 +4,7 @@ exports.workflowEventStreamHeaders = workflowEventStreamHeaders;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../../base-command");
 const workspace_header_1 = require("../../../lib/workspace-header");
+const dpop_auth_1 = require("../../../lib/dpop-auth");
 function workflowEventStreamHeaders(token, env = process.env) {
     return (0, workspace_header_1.withWorkspaceHeader)({
         Accept: 'text/event-stream',
@@ -31,8 +32,14 @@ class SpacesWorkflowsEvents extends base_command_1.BaseCommand {
             this.error('--after must be an ISO-8601 timestamp', { exit: 2 });
         }
         const path = `/api/spaces/${encodeURIComponent(args.spaceId)}/workflows/runs/${encodeURIComponent(args.runId)}/events/stream${flags.after ? `?after=${encodeURIComponent(flags.after)}` : ''}`;
-        const response = await fetch(`${this.cliConfig.baseURL.replace(/\/+$/, '')}${path}`, {
-            headers: workflowEventStreamHeaders(this.resolvedCredential.token),
+        const streamUrl = `${this.cliConfig.baseURL.replace(/\/+$/, '')}${path}`;
+        const token = this.resolvedCredential.token;
+        const response = await fetch(streamUrl, {
+            headers: {
+                ...workflowEventStreamHeaders(token),
+                // OSK-12020 — a DPoP-bound hand-off token proves possession here too.
+                ...(await (0, dpop_auth_1.dpopHeadersFor)(token, 'GET', streamUrl)),
+            },
         });
         if (!response.ok || !response.body) {
             const body = await response.text();

package/dist/commands/store/follow.d.ts

@@ -8,6 +8,7 @@ export default class StoreFollow extends BaseCommand {
     };
     static flags: {
         undo: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        status: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/store/follow.js

@@ -18,13 +18,19 @@ class StoreFollow extends base_command_1.BaseCommand {
         }),
     };
     static flags = {
-        undo: core_1.Flags.boolean({ description: 'Unfollow the publisher' }),
+        undo: core_1.Flags.boolean({ description: 'Unfollow the publisher', exclusive: ['status'] }),
+        status: core_1.Flags.boolean({ description: 'Show whether you follow the publisher; change nothing' }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreFollow);
         try {
+            if (flags.status) {
+                const overlay = await data_provider_1.dataService.getStorePublisherFollowOverlay(args.handle);
+                this.log(JSON.stringify(overlay, null, 2));
+                return;
+            }
             const result = flags.undo
                 ? await data_provider_1.dataService.unfollowStorePublisherByHandle(args.handle)
                 : await data_provider_1.dataService.followStorePublisherByHandle(args.handle);

package/dist/commands/store/follows/list.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base-command';
+/** The publishers you follow, newest first, one page at a time. */
+export default class StoreFollowsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/follows/list.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/** The publishers you follow, newest first, one page at a time. */
+class StoreFollowsList extends base_command_1.BaseCommand {
+    static description = 'List the store publishers you follow';
+    static examples = [
+        '<%= config.bin %> store follows list',
+        '<%= config.bin %> store follows list --cursor <next>',
+    ];
+    static flags = {
+        cursor: core_1.Flags.string({ description: 'Continue from a previous page' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreFollowsList);
+        try {
+            const result = await data_provider_1.dataService.getStorePublisherFollows(flags.cursor);
+            this.log(JSON.stringify(result, null, 2));
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = StoreFollowsList;

package/dist/commands/store/follows/remove.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Remove a follow by its follow id — the one way to drop a follow whose
+ * publisher has since renamed, hidden or lost its handle.
+ */
+export default class StoreFollowsRemove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        followId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/follows/remove.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/**
+ * Remove a follow by its follow id — the one way to drop a follow whose
+ * publisher has since renamed, hidden or lost its handle.
+ */
+class StoreFollowsRemove extends base_command_1.BaseCommand {
+    static description = 'Remove a follow by id (works even when the publisher no longer has a public handle)';
+    static examples = ['<%= config.bin %> store follows remove pf_abc123'];
+    static args = {
+        followId: core_1.Args.string({
+            description: 'Follow id (from `store follows list`)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(StoreFollowsRemove);
+        try {
+            const result = await data_provider_1.dataService.unfollowStorePublisherById(args.followId);
+            if (flags.json) {
+                this.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            this.log(result.removed ? `Removed ${args.followId}.` : `${args.followId} was not followed.`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = StoreFollowsRemove;

package/dist/commands/store/publishers/profile/draft.d.ts

@@ -0,0 +1,17 @@
+import { BaseCommand } from '../../../../base-command';
+/**
+ * Replace the profile draft. `--revision` is required: a draft is a whole
+ * document, and writing one without naming the revision you edited would
+ * silently overwrite a change made meanwhile in the browser.
+ */
+export default class StorePublishersProfileDraft extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'publish-as': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        revision: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/publishers/profile/draft.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../../base-command");
+const publisher_profile_flags_1 = require("../../../../lib/publisher-profile-flags");
+/**
+ * Replace the profile draft. `--revision` is required: a draft is a whole
+ * document, and writing one without naming the revision you edited would
+ * silently overwrite a change made meanwhile in the browser.
+ */
+class StorePublishersProfileDraft extends base_command_1.BaseCommand {
+    static description = 'Replace your publisher profile draft from a JSON file (compare-and-set on --revision)';
+    static examples = [
+        '<%= config.bin %> store publishers profile draft --file draft.json --revision 7',
+    ];
+    static flags = {
+        'publish-as': publisher_profile_flags_1.publishAsFlag,
+        file: core_1.Flags.string({ description: 'JSON file holding the draft', required: true }),
+        revision: core_1.Flags.integer({
+            description: 'The revision you edited (from `profile show`); a stale one is refused',
+            required: true,
+            min: 0,
+        }),
+        json: publisher_profile_flags_1.jsonFlag,
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StorePublishersProfileDraft);
+        let draft;
+        try {
+            draft = (0, publisher_profile_flags_1.readDraftFile)(flags.file);
+        }
+        catch (err) {
+            this.error(err.message);
+        }
+        try {
+            const result = await data_provider_1.dataService.replaceStorePublisherProfileDraft({
+                publishAs: flags['publish-as'],
+                expectedRevision: flags.revision,
+                draft,
+            });
+            if (flags.json) {
+                this.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            this.log(`Draft saved at revision ${result.profile.revision}. Nothing is public until you publish.`);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = StorePublishersProfileDraft;

package/dist/commands/store/publishers/profile/handle.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../../../base-command';
+/** Rename your public handle. The server refuses a lookalike of an existing one. */
+export default class StorePublishersProfileHandle extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        handle: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        'publish-as': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}