@skrr-ai/cli 0.1.95 → 0.1.96

package/dist/lib/space-usage.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getSpaceUsage = void 0;
+exports.formatSpaceSpend = formatSpaceSpend;
+const data_provider_1 = require("@skrr-ai/data-provider");
+const getSpaceUsage = (spaceId, window = '30d') => data_provider_1.dataService.getSpaceUsage(spaceId, window);
+exports.getSpaceUsage = getSpaceUsage;
+/** A positive amount under one cent must not print as $0.00; a measured zero stays $0.00. */
+const usd = (amount) => amount > 0 && amount < 0.01 ? '<$0.01' : `$${amount.toFixed(2)}`;
+function formatSpaceSpend(summary) {
+    const attribution = `Attribution since: ${summary.coverage.attributionSince || 'not certified'}; not attributed: ${summary.coverage.notAttributed.join(', ')}`;
+    if (summary.runCount === 0)
+        return `No runs in window\n${attribution}`;
+    const cost = summary.costUsd === null ? 'Not fully attributed' : usd(summary.costUsd);
+    const known = summary.knownCostUsd === null ? 'unavailable' : usd(summary.knownCostUsd);
+    return `${cost}; known subtotal ${known}; ${summary.runCount} cost records; ${summary.byCostStatus.unavailable} unavailable, ${summary.byCostStatus.partial} partial\n${attribution}`;
+}

package/dist/lib/stewardship-output.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceGrantReport, WorkspaceStewardshipReport } from './workspaces';
+export declare function printStewardshipCoverage(report: WorkspaceGrantReport, log: (line: string) => void): void;
+export declare function printWorkspaceGrants(report: WorkspaceGrantReport, log: (line: string) => void): void;
+export declare function printWorkspaceStewardship(report: WorkspaceStewardshipReport, log: (line: string) => void): void;

package/dist/lib/stewardship-output.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.printStewardshipCoverage = printStewardshipCoverage;
+exports.printWorkspaceGrants = printWorkspaceGrants;
+exports.printWorkspaceStewardship = printWorkspaceStewardship;
+const format_1 = require("./format");
+function printStewardshipCoverage(report, log) {
+    if (report.coverage.complete) {
+        log('Coverage: complete within the bounded sources.');
+        return;
+    }
+    log('Coverage: incomplete. Unreadable sources do not confirm absence.');
+    for (const source of report.coverage.sources) {
+        if (source.status === 'unavailable')
+            log(`${source.name}: unavailable`);
+        else if (source.truncated)
+            log(`${source.name}: truncated at 200 rows`);
+    }
+}
+function printWorkspaceGrants(report, log) {
+    printStewardshipCoverage(report, log);
+    printGrantRows(report, log);
+}
+function printGrantRows(report, log) {
+    if (report.grants === null) {
+        log('Grants: unavailable.');
+        return;
+    }
+    if (!report.grants.length) {
+        log('No workspace Grants observed.');
+        return;
+    }
+    (0, format_1.renderTable)(report.grants.map((row) => ({
+        id: row.id,
+        label: row.label,
+        owner: row.ownerUserId,
+        active: row.active ? 'yes' : 'no',
+        expires: row.expiresAt ?? '',
+        envKeys: row.credential?.envKeys.join(', ') ?? '',
+        referencedBy: row.referencedBy === null
+            ? 'unavailable'
+            : `${row.referencedBy.join(', ')}${row.referencesTruncated ? ' (truncated)' : ''}`,
+    })), [
+        { key: 'id', header: 'ID' },
+        { key: 'label', header: 'LABEL' },
+        { key: 'owner', header: 'OWNER' },
+        { key: 'active', header: 'ACTIVE' },
+        { key: 'expires', header: 'EXPIRES' },
+        { key: 'envKeys', header: 'ENV NAMES' },
+        { key: 'referencedBy', header: 'REFERENCED BY' },
+    ], log);
+}
+function printWorkspaceStewardship(report, log) {
+    printStewardshipCoverage(report, log);
+    log(`Membership: ${report.membership.status}${report.membership.role ? ` (${report.membership.role})` : ''}`);
+    for (const [name, rows] of [
+        ['Commitments', report.commitments],
+        ['Approver seats', report.approverSeats],
+    ]) {
+        log(`${name}: ${rows === null ? 'unavailable' : rows.length}`);
+        if (rows?.length)
+            (0, format_1.renderTable)(rows.map((row) => ({
+                id: row.id,
+                title: row.title ?? '',
+                status: row.status ?? '',
+                agentId: row.agentId ?? '',
+            })), [
+                { key: 'id', header: 'ID' },
+                { key: 'title', header: 'TITLE' },
+                { key: 'status', header: 'STATUS' },
+                { key: 'agentId', header: 'EXECUTOR' },
+            ], log);
+    }
+    log(`Authored Agents: ${report.agents === null ? 'unavailable' : report.agents.length}`);
+    if (report.agents?.length)
+        (0, format_1.renderTable)(report.agents.map((row) => ({ id: row.id, name: row.name ?? '' })), [
+            { key: 'id', header: 'ID' },
+            { key: 'name', header: 'NAME' },
+        ], log);
+    log('Grants:');
+    printGrantRows(report, log);
+}

package/dist/lib/task-asset-upload.d.ts

@@ -1,4 +1,4 @@
-import type { WorkResourceKind } from '@skrr-ai/data-provider';
+import type { WorkResourceKind, TaskResourceWriteReceipt } from '@skrr-ai/data-provider';
 export type TaskAssetRole = 'input' | 'evidence' | 'deliverable';
 /**
  * What the bytes ARE in the work ledger, for an upload that is the archived
@@ -24,6 +24,8 @@ export interface TaskAssetLedgerResource {
     expectationIds?: string[];
 }
 export interface UploadedTaskAsset {
+    /** The canonical Task relationship and exact Resource version recorded by this upload. */
+    resourceReceipt?: TaskResourceWriteReceipt;
     id: string;
     /**
      * sha256 (hex) of the bytes the server STORED, as the server recorded them.

package/dist/lib/task-asset-upload.js

@@ -148,6 +148,7 @@ async function uploadTaskAssetFile(opts) {
         filename,
         mimeType,
         deduplicated: result.deduplicated === true,
+        ...(result.resourceReceipt ? { resourceReceipt: result.resourceReceipt } : {}),
     };
 }
 /**

package/dist/lib/task-economics.d.ts

@@ -0,0 +1,16 @@
+export declare function economicsFromFlags(flags: {
+    savings?: string;
+    per?: string;
+    effort?: string;
+    risk?: string;
+}, existing?: unknown): {
+    savings?: {
+        amount: number;
+        currency: "USD";
+        per: "month" | "year" | "once";
+    } | undefined;
+    effortHours?: number | undefined;
+    risk?: "low" | "medium" | "high" | undefined;
+    confidence?: "low" | "medium" | "high" | undefined;
+    rationale?: string | undefined;
+} | undefined;

package/dist/lib/task-economics.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.economicsFromFlags = economicsFromFlags;
+const data_provider_1 = require("@skrr-ai/data-provider");
+function economicsFromFlags(flags, existing) {
+    if ([flags.savings, flags.per, flags.effort, flags.risk].every((value) => value === undefined))
+        return undefined;
+    if ((flags.savings === undefined) !== (flags.per === undefined))
+        throw new Error('--savings and --per must be supplied together (USD/month, year or once).');
+    for (const value of [flags.savings, flags.effort])
+        if (value !== undefined && value.trim() === '')
+            throw new Error('Economic amounts must be explicit nonnegative numbers.');
+    const content = existing && typeof existing === 'object' ? existing : {};
+    return data_provider_1.ProposalEconomicsInputSchema.parse({
+        ...content,
+        ...(flags.savings !== undefined
+            ? { savings: { amount: Number(flags.savings), currency: 'USD', per: flags.per } }
+            : {}),
+        ...(flags.effort !== undefined ? { effortHours: Number(flags.effort) } : {}),
+        ...(flags.risk !== undefined ? { risk: flags.risk } : {}),
+    });
+}

package/dist/lib/triggers.d.ts

@@ -1,4 +1,4 @@
-import { type EmbeddedActionRef, type TriggerPreflightReport } from '@skrr-ai/data-provider';
+import { type EmbeddedActionRef, type TriggerPreflightReport, type TriggerSensorConfig } from '@skrr-ai/data-provider';
 export declare const TRIGGER_KINDS: readonly ["schedule", "once", "event", "stochastic", "self_scheduled", "on_demand", "form", "chat_message"];
 export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscriber", "space_oracle", "space_subscriber", "key_result_watcher", "task_watcher", "goal_watcher", "entity_reminder"];
 /**
@@ -18,7 +18,7 @@ export declare const TRIGGER_SCOPE_KINDS: readonly ["agent", "group_chat_subscri
  * capability was live and unreachable. `watch_until` and `sensor_poll` had been
  * in that state for longer.
  */
-export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover"];
+export declare const TRIGGER_EXECUTOR_MODES: readonly ["send_message", "run_only", "enqueue_group_chat_agent_turn", "enqueue_assistant_turn", "enqueue_space_assistant_turn", "proactive_orchestrator_check", "auto_dream_orchestrator", "task_schedule_fire", "goal_planner_tick", "morning_briefing", "builtin_action", "task_execute", "watch_until", "sensor_poll", "external_work_task", "notify_user", "space_cycle_rollover", "workflow_signal"];
 export declare const TRIGGER_EVENT_FILTER_MODES: readonly ["equals", "contains", "in_set"];
 export declare const TRIGGER_CONCURRENCY_POLICIES: readonly ["coalesce_if_active", "allow_parallel"];
 export declare const TRIGGER_FORM_RESPONSE_MODES: readonly ["thank_you_page", "redirect_url", "run_complete"];
@@ -85,7 +85,9 @@ export interface TriggerDefinition {
         kind?: string;
         refs?: Record<string, unknown>;
     };
-    execution?: Record<string, unknown>;
+    execution?: Record<string, unknown> & {
+        sensor?: TriggerSensorConfig;
+    };
     schedule?: Record<string, unknown>;
     once?: Record<string, unknown>;
     event?: Record<string, unknown>;
@@ -341,6 +343,12 @@ export declare function nextRunLabel(trigger: TriggerDefinition): string;
  *     (OSK-7711).
  */
 export declare function armedLabel(trigger: TriggerDefinition): string;
+/**
+ * A keyed sensor that is still ENABLED but degraded (an item has failed for
+ * dozens of polls) reads `yes` in ARMED, which is true and not the whole story.
+ * Marked here so the list says it, not only `triggers show`.
+ */
+export declare function degradedMarker(trigger: TriggerDefinition): string;
 export declare function renderTriggerList(triggers: TriggerDefinition[], log: (line: string) => void): void;
 /**
  * The `duplicate_subscription` warning a create response may carry, as the

package/dist/lib/triggers.js

@@ -29,6 +29,7 @@ exports.fetchAgentScopedTrigger = fetchAgentScopedTrigger;
 exports.scopeLabel = scopeLabel;
 exports.nextRunLabel = nextRunLabel;
 exports.armedLabel = armedLabel;
+exports.degradedMarker = degradedMarker;
 exports.renderTriggerList = renderTriggerList;
 exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
@@ -99,6 +100,9 @@ exports.TRIGGER_EXECUTOR_MODES = [
     'external_work_task',
     'notify_user',
     'space_cycle_rollover',
+    // Resolve a workflow step an agent parked with `workflow_await`, when this
+    // trigger's event arrives. Needs `--workflow-event-key`.
+    'workflow_signal',
 ];
 exports.TRIGGER_EVENT_FILTER_MODES = ['equals', 'contains', 'in_set'];
 exports.TRIGGER_CONCURRENCY_POLICIES = ['coalesce_if_active', 'allow_parallel'];
@@ -748,6 +752,15 @@ function armedLabel(trigger) {
     }
     return 'yes';
 }
+/**
+ * A keyed sensor that is still ENABLED but degraded (an item has failed for
+ * dozens of polls) reads `yes` in ARMED, which is true and not the whole story.
+ * Marked here so the list says it, not only `triggers show`.
+ */
+function degradedMarker(trigger) {
+    const reason = trigger.execution?.sensor?.state?.degradedReason;
+    return reason ? ' (degraded)' : '';
+}
 function renderTriggerList(triggers, log) {
     if (triggers.length === 0) {
         log('No triggers.');
@@ -756,7 +769,7 @@ function renderTriggerList(triggers, log) {
     (0, format_1.renderTable)(triggers.map((trigger) => ({
         id: trigger.id ?? '-',
         kind: trigger.kind ?? '-',
-        enabled: armedLabel(trigger),
+        enabled: `${armedLabel(trigger)}${degradedMarker(trigger)}`,
         scope: scopeLabel(trigger),
         next: nextRunLabel(trigger),
         label: trigger.label ?? '',
@@ -768,6 +781,12 @@ function renderTriggerList(triggers, log) {
         { key: 'next', header: 'NEXT/LAST', maxWidth: 24 },
         { key: 'label', header: 'LABEL', maxWidth: 32 },
     ], log);
+    const degraded = triggers.filter((t) => degradedMarker(t));
+    if (degraded.length > 0) {
+        log('');
+        log(`${degraded.length} trigger(s) are enabled but degraded — ` +
+            'see `Degraded:` in `triggers show <id>`.');
+    }
     const unsynced = triggers.filter((t) => armedLabel(t).startsWith('!'));
     if (unsynced.length > 0) {
         log('');
@@ -872,6 +891,44 @@ function renderTriggerSummary(trigger, log, options = {}) {
         log(`Label:    ${trigger.label}`);
     if (trigger.execution?.mode)
         log(`Mode:     ${String(trigger.execution.mode)}`);
+    const sensor = trigger.execution?.mode === 'sensor_poll' ? trigger.execution.sensor : undefined;
+    if (sensor?.measureSink) {
+        log(`Measure:  ${sensor.measureSink.measureId} — platform fetched, unconfirmed`);
+        if (sensor.state?.lastSinkError)
+            log(`Sink:     ${sensor.state.lastSinkError}`);
+        else if (sensor.state?.lastSinkAt)
+            log(`Sink:     last reading ${sensor.state.lastSinkValue ?? '-'} at ${sensor.state.lastSinkAt}`);
+        else
+            log('Sink:     awaiting a numeric reading');
+    }
+    // A keyed sensor can be quietly blind (items held back, unreadable, failing).
+    // Each count is printed, and zero is printed too: "0" and "absent" must read
+    // differently from a sensor that has never been counted.
+    if (sensor?.cursor?.mode === 'keyed' && sensor.state) {
+        const st = sensor.state;
+        const n = (v) => v ?? 0;
+        log(`Keyed:    deferred ${n(st.deferredCount)}, unreadable ${n(st.unreadableCount)}, failed ${n(st.failedItemCount)}, quarantined ${n(st.quarantinedCount)}, duplicates ${n(st.duplicateCount)}, unsubjected ${n(st.unsubjectedCount)} (cumulative)`);
+    }
+    if (sensor?.cursor?.mode === 'keyed' && sensor.state) {
+        const st = sensor.state;
+        // A reseed publishes nothing by design, so it is the one change nothing
+        // else records: say when it happened, why, and how often.
+        if (st.reseededAt) {
+            const why = st.reseededReason
+                ? (data_provider_1.KEYED_RESEED_COPY[st.reseededReason] ?? st.reseededReason)
+                : 'reason not recorded';
+            log(`Reseeded: ${st.reseededAt} (${st.reseededReason ?? 'unknown'}: ${why}); ${st.reseedCount ?? 1} time(s); nothing was published for it`);
+        }
+        if (st.itemFailurePolls)
+            log(`Items:    failing for ${st.itemFailurePolls} poll(s) in a row`);
+    }
+    // The sensor is degraded, not just carrying a line of text: say it first.
+    if (sensor?.state?.degradedReason)
+        log(`Degraded: ${sensor.state.degradedReason}`);
+    if (sensor?.state?.consecutiveErrors)
+        log(`Errors:   ${sensor.state.consecutiveErrors} feed failure(s) in a row (the sensor disables itself if the feed keeps failing)`);
+    if (sensor?.state?.lastError)
+        log(`Problem:  ${sensor.state.lastError}`);
     // An `external_work_task` writes into someone else's system, and which
     // contract governs that write — and whether it posts by itself — was readable
     // only by pulling `execution.effectPolicy` out of raw JSON. A trigger that can

package/dist/lib/usage-discovery.d.ts

@@ -23,6 +23,14 @@ import type { CommandManifest } from './command-manifest';
  * only then whether the bound is still the right size.
  */
 export declare const USAGE_OVERVIEW_TOKEN_BUDGET = 240;
+/**
+ * Topics listed under another domain instead of as their own overview line.
+ * Every command keeps its own id (`skrr proposals list`); only the discovery
+ * grouping changes, and `skrr usage <folded>` resolves to the host page, which
+ * names the folded topic in an `Includes:` line so it stays reachable.
+ * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ */
+export declare const USAGE_DOMAIN_FOLDS: Readonly<Record<string, string>>;
 export declare const USAGE_DOMAIN_TOKEN_BUDGET = 500;
 export type UsageCommand = {
     command: string;
@@ -46,6 +54,8 @@ export type UsageReference = {
     object: 'sky_usage_reference';
     generatedFrom: 'oclif.manifest.json';
     domain: string;
+    /** Topics folded into this domain (see `USAGE_DOMAIN_FOLDS`). */
+    includes?: string[];
     tokenBudget: number;
     estimatedTokens: number;
     page: number;

package/dist/lib/usage-discovery.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.USAGE_DOMAIN_TOKEN_BUDGET = exports.USAGE_OVERVIEW_TOKEN_BUDGET = void 0;
+exports.USAGE_DOMAIN_TOKEN_BUDGET = exports.USAGE_DOMAIN_FOLDS = exports.USAGE_OVERVIEW_TOKEN_BUDGET = void 0;
 exports.estimateUsageTokens = estimateUsageTokens;
 exports.usageDomains = usageDomains;
 exports.buildUsageOverview = buildUsageOverview;
@@ -34,6 +34,14 @@ const command_manifest_1 = require("./command-manifest");
  * only then whether the bound is still the right size.
  */
 exports.USAGE_OVERVIEW_TOKEN_BUDGET = 240;
+/**
+ * Topics listed under another domain instead of as their own overview line.
+ * Every command keeps its own id (`skrr proposals list`); only the discovery
+ * grouping changes, and `skrr usage <folded>` resolves to the host page, which
+ * names the folded topic in an `Includes:` line so it stays reachable.
+ * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ */
+exports.USAGE_DOMAIN_FOLDS = { proposals: 'inbox' };
 exports.USAGE_DOMAIN_TOKEN_BUDGET = 500;
 const GENERIC_FLAGS = new Set(['bare', 'help', 'json', 'token', 'workspace']);
 /**
@@ -74,7 +82,8 @@ function buildUsageOverview(manifest, bin = 'skrr') {
 }
 /** Return case-insensitive manifest domain names without inventing aliases. */
 function resolveUsageDomain(manifest, value) {
-    const needle = value.trim().toLowerCase();
+    const trimmed = value.trim().toLowerCase();
+    const needle = exports.USAGE_DOMAIN_FOLDS[trimmed] ?? trimmed;
     return usageDomains(manifest).find(({ domain }) => domain.toLowerCase() === needle)?.domain;
 }
 /**
@@ -95,10 +104,12 @@ function buildUsageReference(manifest, domainInput, options = {}) {
     if (!Number.isInteger(requested) || index < 0 || index >= pages.length)
         return undefined;
     const data = pages[index];
+    const includes = foldedTopics(manifest, domain);
     const draft = {
         object: 'sky_usage_reference',
         generatedFrom: 'oclif.manifest.json',
         domain,
+        ...(includes.length > 0 ? { includes } : {}),
         tokenBudget: exports.USAGE_DOMAIN_TOKEN_BUDGET,
         estimatedTokens: 0,
         page: requested,
@@ -122,6 +133,8 @@ function renderUsageReference(reference, bin = 'skrr') {
         `${reference.domain} commands — page ${reference.page}/${reference.pages} ` +
             `(${reference.commandCount} total; manifest-derived).`,
     ];
+    if (reference.includes?.length)
+        lines.push(`Includes: ${reference.includes.join(', ')}.`);
     for (const command of reference.data) {
         const flags = command.keyFlags.length > 0 ? ` Flags: ${command.keyFlags.join(', ')}.` : '';
         lines.push(`${bin} ${command.command} — ${command.description}.${flags} Example: ${command.example}`);
@@ -167,13 +180,21 @@ function auditUsageBudgets(manifest, bin = 'skrr') {
 function groupEntries(manifest) {
     const grouped = new Map();
     for (const entry of (0, command_manifest_1.visibleCommandEntries)(manifest)) {
-        const domain = entry.id.split(':')[0];
+        const topic = entry.id.split(':')[0];
+        const domain = exports.USAGE_DOMAIN_FOLDS[topic] ?? topic;
         const existing = grouped.get(domain) ?? [];
         existing.push(entry);
         grouped.set(domain, existing);
     }
     return grouped;
 }
+function foldedTopics(manifest, domain) {
+    const present = new Set((0, command_manifest_1.visibleCommandEntries)(manifest).map((entry) => entry.id.split(':')[0]));
+    return Object.entries(exports.USAGE_DOMAIN_FOLDS)
+        .filter(([topic, host]) => host === domain && present.has(topic))
+        .map(([topic]) => topic)
+        .sort();
+}
 function usageCommand(entry, bin) {
     const flags = Object.entries(entry.flags)
         .filter(([, value]) => !value.hidden)

package/dist/lib/workflow-run-budget.d.ts

@@ -0,0 +1,12 @@
+type RunLike = Record<string, unknown>;
+/**
+ * Human lines for a run's duration budget and for a run the budget stopped.
+ *
+ * The server derives `budget` per read and stamps `error.code =
+ * WORKFLOW_RUN_DEADLINE` on a run it cancelled; this only words them. A run with
+ * neither prints nothing: no budget is not "0 minutes left".
+ */
+export declare function describeRunBudget(run: RunLike): string[];
+/** The status cell, naming a time-limit stop where the plain status would hide it. */
+export declare function runStatusLabel(run: RunLike): string;
+export {};

package/dist/lib/workflow-run-budget.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeRunBudget = describeRunBudget;
+exports.runStatusLabel = runStatusLabel;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Human lines for a run's duration budget and for a run the budget stopped.
+ *
+ * The server derives `budget` per read and stamps `error.code =
+ * WORKFLOW_RUN_DEADLINE` on a run it cancelled; this only words them. A run with
+ * neither prints nothing: no budget is not "0 minutes left".
+ */
+function describeRunBudget(run) {
+    const lines = [];
+    const error = run.error;
+    if (error?.code === data_provider_1.WORKFLOW_RUN_DEADLINE) {
+        lines.push(`Stopped: ${error.code}${error.message ? ` - ${error.message}` : ''}`);
+    }
+    const budget = run.budget;
+    if (budget && Number.isFinite(budget.maxDurationMs)) {
+        const limit = (0, data_provider_1.describeWorkflowDuration)(budget.maxDurationMs);
+        if (budget.exceeded)
+            lines.push(`Time limit: ${limit}, exceeded (deadline ${budget.deadlineAt})`);
+        else if (budget.remainingMs > 0)
+            lines.push(`Time limit: ${limit}, ${(0, data_provider_1.describeWorkflowDuration)(budget.remainingMs)} left (deadline ${budget.deadlineAt})`);
+        else
+            lines.push(`Time limit: ${limit} (deadline ${budget.deadlineAt})`);
+    }
+    return lines;
+}
+/** The status cell, naming a time-limit stop where the plain status would hide it. */
+function runStatusLabel(run) {
+    const status = String(run.status ?? '-');
+    return run.error?.code === data_provider_1.WORKFLOW_RUN_DEADLINE
+        ? `${status} (time limit)`
+        : status;
+}

package/dist/lib/workspaces.d.ts

@@ -1,3 +1,51 @@
+import type { GrantPublic } from '@skrr-ai/data-schemas';
+export interface StewardshipSource {
+    name: string;
+    status: 'available' | 'unavailable';
+    truncated: boolean;
+    code?: string;
+}
+export interface StewardshipCoverage {
+    complete: boolean;
+    truncated: boolean;
+    sources: StewardshipSource[];
+}
+export type WorkspaceGrantMetadata = Omit<GrantPublic, 'credential' | 'createdAt' | 'updatedAt'> & {
+    ownerUserId: string;
+    credential: (NonNullable<GrantPublic['credential']> & {
+        fingerprint?: string;
+    }) | null;
+    createdAt?: string;
+    updatedAt?: string;
+    referencedBy: string[] | null;
+    referencesTruncated: boolean;
+};
+export interface WorkspaceGrantReport {
+    workspaceId: string;
+    grants: WorkspaceGrantMetadata[] | null;
+    coverage: StewardshipCoverage;
+}
+export interface StewardshipCommitmentMetadata {
+    id: string;
+    title?: string;
+    status?: string;
+    agentId?: string;
+}
+export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
+    memberUserId: string;
+    membership: {
+        status: 'active' | 'absent' | 'unavailable';
+        role?: string;
+    };
+    commitments: StewardshipCommitmentMetadata[] | null;
+    approverSeats: StewardshipCommitmentMetadata[] | null;
+    agents: Array<{
+        id: string;
+        name?: string;
+    }> | null;
+}
+export declare function getWorkspaceStewardship(workspaceId: string, memberUserId: string): Promise<WorkspaceStewardshipReport>;
+export declare function listWorkspaceGrants(workspaceId: string): Promise<WorkspaceGrantReport>;
 /**
  * The workspaces this account belongs to.
  *

package/dist/lib/workspaces.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkspaceStewardship = getWorkspaceStewardship;
+exports.listWorkspaceGrants = listWorkspaceGrants;
 exports.describeUnselectedWorkspace = describeUnselectedWorkspace;
 exports.listWorkspaces = listWorkspaces;
 exports.ambientWorkspaceId = ambientWorkspaceId;
@@ -10,6 +12,12 @@ exports.getWorkspace = getWorkspace;
 exports.matchWorkspace = matchWorkspace;
 const api_fetch_1 = require("./api-fetch");
 const triggers_1 = require("./triggers");
+async function getWorkspaceStewardship(workspaceId, memberUserId) {
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/members/${encodeURIComponent(memberUserId)}`);
+}
+async function listWorkspaceGrants(workspaceId) {
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/grants`);
+}
 /**
  * The server's workspace document can include presentation metadata such as an
  * avatar source. This CLI surface is a selector, not a workspace export: keep

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -129,3 +129,7 @@ export interface CliHandoffDpopProofResponse {
     proof: string;
 }
 export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;
+/** Persisted credential families; deployed values must not change. */
+export declare const DELEGATED_AGENT_CLI_ID_PREFIX = "oversky-daemon-agent-cli-";
+export declare const WORKLOAD_CLI_ID_PREFIX = "oversky-daemon-workload-cli-";
+export declare function classifyCliFamilyId(id: unknown): 'agent' | 'workload' | 'person';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -18,7 +18,7 @@
  * must produce the full shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
+exports.WORKLOAD_CLI_ID_PREFIX = exports.DELEGATED_AGENT_CLI_ID_PREFIX = exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
 exports.parseCliHandoffDescriptor = parseCliHandoffDescriptor;
 exports.normalizeHandoffModes = normalizeHandoffModes;
 exports.advertisedHandoffModes = advertisedHandoffModes;
@@ -26,6 +26,7 @@ exports.descriptorOffersAccessToken = descriptorOffersAccessToken;
 exports.descriptorOffersDpop = descriptorOffersDpop;
 exports.parseCliHandoffTokenResponse = parseCliHandoffTokenResponse;
 exports.parseCliHandoffDpopProofResponse = parseCliHandoffDpopProofResponse;
+exports.classifyCliFamilyId = classifyCliFamilyId;
 /**
  * What a caller may redeem the descriptor secret for.
  *  - `refresh_family`: the legacy durable mint (90-day cli-scope family).
@@ -143,3 +144,15 @@ function parseCliHandoffDpopProofResponse(value) {
         return null;
     return { proof: v.proof };
 }
+/** Persisted credential families; deployed values must not change. */
+exports.DELEGATED_AGENT_CLI_ID_PREFIX = 'oversky-daemon-agent-cli-';
+exports.WORKLOAD_CLI_ID_PREFIX = 'oversky-daemon-workload-cli-';
+function classifyCliFamilyId(id) {
+    if (typeof id !== 'string')
+        return 'person';
+    if (id.startsWith(exports.DELEGATED_AGENT_CLI_ID_PREFIX))
+        return 'agent';
+    if (id.startsWith(exports.WORKLOAD_CLI_ID_PREFIX))
+        return 'workload';
+    return 'person';
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/githubPushRefusal.d.ts

@@ -0,0 +1,9 @@
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+export declare const GITHUB_WORKFLOW_PERMISSION_REQUIRED = "github_workflow_permission_required";
+export type GitHubPushRefusal = {
+    code: typeof GITHUB_WORKFLOW_PERMISSION_REQUIRED;
+    tokenKind: 'github_app' | 'oauth_app' | 'personal_access_token' | 'unknown';
+    paths: string[];
+};
+export declare function isWorkflowPath(value: unknown): boolean;
+export declare function classifyGitHubPushRefusal(text: unknown): GitHubPushRefusal | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/githubPushRefusal.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED = void 0;
+exports.isWorkflowPath = isWorkflowPath;
+exports.classifyGitHubPushRefusal = classifyGitHubPushRefusal;
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED = 'github_workflow_permission_required';
+function workflowPath(value) {
+    if (typeof value !== 'string' || value.length > 240)
+        return null;
+    const path = value.replaceAll('\\', '/');
+    if (!/^\.github\/workflows\/[A-Za-z0-9_. /-]+$/.test(path))
+        return null;
+    const parts = path.split('/');
+    if (parts.some((part) => !part.trim() || part !== part.trim() || part === '.' || part === '..'))
+        return null;
+    return path;
+}
+function isWorkflowPath(value) {
+    return workflowPath(value) !== null;
+}
+function classifyGitHubPushRefusal(text) {
+    if (typeof text !== 'string')
+        return null;
+    // Bound parsing work. Git prints the rejection LAST, after any amount of
+    // progress output, so keep the tail; truncated diagnostics keep the generic refusal.
+    const input = text.slice(-64 * 1024);
+    const pattern = /refusing to allow (?:a|an) (GitHub App|OAuth App|Personal Access Token) to create or update workflow [`'"]([^`'"\r\n]+)[`'"] without [`'"]workflows?[`'"] (?:permission|scope)/gi;
+    const paths = [];
+    let tokenKind = 'unknown';
+    for (const match of input.matchAll(pattern)) {
+        const path = workflowPath(match[2]);
+        if (!path)
+            continue;
+        if (tokenKind === 'unknown') {
+            tokenKind =
+                match[1].toLowerCase() === 'github app'
+                    ? 'github_app'
+                    : match[1].toLowerCase() === 'oauth app'
+                        ? 'oauth_app'
+                        : 'personal_access_token';
+        }
+        if (!paths.includes(path))
+            paths.push(path);
+        if (paths.length === 10)
+            break;
+    }
+    return paths.length ? { code: exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED, tokenKind, paths } : null;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.d.ts

@@ -129,3 +129,7 @@ export interface CliHandoffDpopProofResponse {
     proof: string;
 }
 export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;
+/** Persisted credential families; deployed values must not change. */
+export declare const DELEGATED_AGENT_CLI_ID_PREFIX = "oversky-daemon-agent-cli-";
+export declare const WORKLOAD_CLI_ID_PREFIX = "oversky-daemon-workload-cli-";
+export declare function classifyCliFamilyId(id: unknown): 'agent' | 'workload' | 'person';