@skrr-ai/cli 0.1.95 → 0.1.97

package/dist/lib/workflow-run-budget.js

@@ -0,0 +1,37 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeRunBudget = describeRunBudget;
+exports.runStatusLabel = runStatusLabel;
+const data_provider_1 = require("@skrr-ai/data-provider");
+/**
+ * Human lines for a run's duration budget and for a run the budget stopped.
+ *
+ * The server derives `budget` per read and stamps `error.code =
+ * WORKFLOW_RUN_DEADLINE` on a run it cancelled; this only words them. A run with
+ * neither prints nothing: no budget is not "0 minutes left".
+ */
+function describeRunBudget(run) {
+    const lines = [];
+    const error = run.error;
+    if (error?.code === data_provider_1.WORKFLOW_RUN_DEADLINE) {
+        lines.push(`Stopped: ${error.code}${error.message ? ` - ${error.message}` : ''}`);
+    }
+    const budget = run.budget;
+    if (budget && Number.isFinite(budget.maxDurationMs)) {
+        const limit = (0, data_provider_1.describeWorkflowDuration)(budget.maxDurationMs);
+        if (budget.exceeded)
+            lines.push(`Time limit: ${limit}, exceeded (deadline ${budget.deadlineAt})`);
+        else if (budget.remainingMs > 0)
+            lines.push(`Time limit: ${limit}, ${(0, data_provider_1.describeWorkflowDuration)(budget.remainingMs)} left (deadline ${budget.deadlineAt})`);
+        else
+            lines.push(`Time limit: ${limit} (deadline ${budget.deadlineAt})`);
+    }
+    return lines;
+}
+/** The status cell, naming a time-limit stop where the plain status would hide it. */
+function runStatusLabel(run) {
+    const status = String(run.status ?? '-');
+    return run.error?.code === data_provider_1.WORKFLOW_RUN_DEADLINE
+        ? `${status} (time limit)`
+        : status;
+}

package/dist/lib/workspaces.d.ts

@@ -1,3 +1,51 @@
+import type { GrantPublic } from '@skrr-ai/data-schemas';
+export interface StewardshipSource {
+    name: string;
+    status: 'available' | 'unavailable';
+    truncated: boolean;
+    code?: string;
+}
+export interface StewardshipCoverage {
+    complete: boolean;
+    truncated: boolean;
+    sources: StewardshipSource[];
+}
+export type WorkspaceGrantMetadata = Omit<GrantPublic, 'credential' | 'createdAt' | 'updatedAt'> & {
+    ownerUserId: string;
+    credential: (NonNullable<GrantPublic['credential']> & {
+        fingerprint?: string;
+    }) | null;
+    createdAt?: string;
+    updatedAt?: string;
+    referencedBy: string[] | null;
+    referencesTruncated: boolean;
+};
+export interface WorkspaceGrantReport {
+    workspaceId: string;
+    grants: WorkspaceGrantMetadata[] | null;
+    coverage: StewardshipCoverage;
+}
+export interface StewardshipCommitmentMetadata {
+    id: string;
+    title?: string;
+    status?: string;
+    agentId?: string;
+}
+export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
+    memberUserId: string;
+    membership: {
+        status: 'active' | 'absent' | 'unavailable';
+        role?: string;
+    };
+    commitments: StewardshipCommitmentMetadata[] | null;
+    approverSeats: StewardshipCommitmentMetadata[] | null;
+    agents: Array<{
+        id: string;
+        name?: string;
+    }> | null;
+}
+export declare function getWorkspaceStewardship(workspaceId: string, memberUserId: string): Promise<WorkspaceStewardshipReport>;
+export declare function listWorkspaceGrants(workspaceId: string): Promise<WorkspaceGrantReport>;
 /**
  * The workspaces this account belongs to.
  *

package/dist/lib/workspaces.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.getWorkspaceStewardship = getWorkspaceStewardship;
+exports.listWorkspaceGrants = listWorkspaceGrants;
 exports.describeUnselectedWorkspace = describeUnselectedWorkspace;
 exports.listWorkspaces = listWorkspaces;
 exports.ambientWorkspaceId = ambientWorkspaceId;
@@ -10,6 +12,12 @@ exports.getWorkspace = getWorkspace;
 exports.matchWorkspace = matchWorkspace;
 const api_fetch_1 = require("./api-fetch");
 const triggers_1 = require("./triggers");
+async function getWorkspaceStewardship(workspaceId, memberUserId) {
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/members/${encodeURIComponent(memberUserId)}`);
+}
+async function listWorkspaceGrants(workspaceId) {
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/grants`);
+}
 /**
  * The server's workspace document can include presentation metadata such as an
  * avatar source. This CLI surface is a selector, not a workspace export: keep

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -129,3 +129,7 @@ export interface CliHandoffDpopProofResponse {
     proof: string;
 }
 export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;
+/** Persisted credential families; deployed values must not change. */
+export declare const DELEGATED_AGENT_CLI_ID_PREFIX = "oversky-daemon-agent-cli-";
+export declare const WORKLOAD_CLI_ID_PREFIX = "oversky-daemon-workload-cli-";
+export declare function classifyCliFamilyId(id: unknown): 'agent' | 'workload' | 'person';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -18,7 +18,7 @@
  * must produce the full shape.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
+exports.WORKLOAD_CLI_ID_PREFIX = exports.DELEGATED_AGENT_CLI_ID_PREFIX = exports.CLI_HANDOFF_ERROR_DPOP_UNAVAILABLE = exports.CLI_HANDOFF_ERROR_DPOP_PROOF_REFUSED = exports.CLI_HANDOFF_DPOP_PROOF_PATH = exports.CLI_HANDOFF_ERROR_DPOP_REQUIRED = exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
 exports.parseCliHandoffDescriptor = parseCliHandoffDescriptor;
 exports.normalizeHandoffModes = normalizeHandoffModes;
 exports.advertisedHandoffModes = advertisedHandoffModes;
@@ -26,6 +26,7 @@ exports.descriptorOffersAccessToken = descriptorOffersAccessToken;
 exports.descriptorOffersDpop = descriptorOffersDpop;
 exports.parseCliHandoffTokenResponse = parseCliHandoffTokenResponse;
 exports.parseCliHandoffDpopProofResponse = parseCliHandoffDpopProofResponse;
+exports.classifyCliFamilyId = classifyCliFamilyId;
 /**
  * What a caller may redeem the descriptor secret for.
  *  - `refresh_family`: the legacy durable mint (90-day cli-scope family).
@@ -143,3 +144,15 @@ function parseCliHandoffDpopProofResponse(value) {
         return null;
     return { proof: v.proof };
 }
+/** Persisted credential families; deployed values must not change. */
+exports.DELEGATED_AGENT_CLI_ID_PREFIX = 'oversky-daemon-agent-cli-';
+exports.WORKLOAD_CLI_ID_PREFIX = 'oversky-daemon-workload-cli-';
+function classifyCliFamilyId(id) {
+    if (typeof id !== 'string')
+        return 'person';
+    if (id.startsWith(exports.DELEGATED_AGENT_CLI_ID_PREFIX))
+        return 'agent';
+    if (id.startsWith(exports.WORKLOAD_CLI_ID_PREFIX))
+        return 'workload';
+    return 'person';
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/githubPushRefusal.d.ts

@@ -0,0 +1,9 @@
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+export declare const GITHUB_WORKFLOW_PERMISSION_REQUIRED = "github_workflow_permission_required";
+export type GitHubPushRefusal = {
+    code: typeof GITHUB_WORKFLOW_PERMISSION_REQUIRED;
+    tokenKind: 'github_app' | 'oauth_app' | 'personal_access_token' | 'unknown';
+    paths: string[];
+};
+export declare function isWorkflowPath(value: unknown): boolean;
+export declare function classifyGitHubPushRefusal(text: unknown): GitHubPushRefusal | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/githubPushRefusal.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED = void 0;
+exports.isWorkflowPath = isWorkflowPath;
+exports.classifyGitHubPushRefusal = classifyGitHubPushRefusal;
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED = 'github_workflow_permission_required';
+function workflowPath(value) {
+    if (typeof value !== 'string' || value.length > 240)
+        return null;
+    const path = value.replaceAll('\\', '/');
+    if (!/^\.github\/workflows\/[A-Za-z0-9_. /-]+$/.test(path))
+        return null;
+    const parts = path.split('/');
+    if (parts.some((part) => !part.trim() || part !== part.trim() || part === '.' || part === '..'))
+        return null;
+    return path;
+}
+function isWorkflowPath(value) {
+    return workflowPath(value) !== null;
+}
+function classifyGitHubPushRefusal(text) {
+    if (typeof text !== 'string')
+        return null;
+    // Bound parsing work. Git prints the rejection LAST, after any amount of
+    // progress output, so keep the tail; truncated diagnostics keep the generic refusal.
+    const input = text.slice(-64 * 1024);
+    const pattern = /refusing to allow (?:a|an) (GitHub App|OAuth App|Personal Access Token) to create or update workflow [`'"]([^`'"\r\n]+)[`'"] without [`'"]workflows?[`'"] (?:permission|scope)/gi;
+    const paths = [];
+    let tokenKind = 'unknown';
+    for (const match of input.matchAll(pattern)) {
+        const path = workflowPath(match[2]);
+        if (!path)
+            continue;
+        if (tokenKind === 'unknown') {
+            tokenKind =
+                match[1].toLowerCase() === 'github app'
+                    ? 'github_app'
+                    : match[1].toLowerCase() === 'oauth app'
+                        ? 'oauth_app'
+                        : 'personal_access_token';
+        }
+        if (!paths.includes(path))
+            paths.push(path);
+        if (paths.length === 10)
+            break;
+    }
+    return paths.length ? { code: exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED, tokenKind, paths } : null;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.d.ts

@@ -129,3 +129,7 @@ export interface CliHandoffDpopProofResponse {
     proof: string;
 }
 export declare function parseCliHandoffDpopProofResponse(value: unknown): CliHandoffDpopProofResponse | null;
+/** Persisted credential families; deployed values must not change. */
+export declare const DELEGATED_AGENT_CLI_ID_PREFIX = "oversky-daemon-agent-cli-";
+export declare const WORKLOAD_CLI_ID_PREFIX = "oversky-daemon-workload-cli-";
+export declare function classifyCliFamilyId(id: unknown): 'agent' | 'workload' | 'person';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.js

@@ -133,3 +133,15 @@ export function parseCliHandoffDpopProofResponse(value) {
         return null;
     return { proof: v.proof };
 }
+/** Persisted credential families; deployed values must not change. */
+export const DELEGATED_AGENT_CLI_ID_PREFIX = 'oversky-daemon-agent-cli-';
+export const WORKLOAD_CLI_ID_PREFIX = 'oversky-daemon-workload-cli-';
+export function classifyCliFamilyId(id) {
+    if (typeof id !== 'string')
+        return 'person';
+    if (id.startsWith(DELEGATED_AGENT_CLI_ID_PREFIX))
+        return 'agent';
+    if (id.startsWith(WORKLOAD_CLI_ID_PREFIX))
+        return 'workload';
+    return 'person';
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/githubPushRefusal.d.ts

@@ -0,0 +1,9 @@
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+export declare const GITHUB_WORKFLOW_PERMISSION_REQUIRED = "github_workflow_permission_required";
+export type GitHubPushRefusal = {
+    code: typeof GITHUB_WORKFLOW_PERMISSION_REQUIRED;
+    tokenKind: 'github_app' | 'oauth_app' | 'personal_access_token' | 'unknown';
+    paths: string[];
+};
+export declare function isWorkflowPath(value: unknown): boolean;
+export declare function classifyGitHubPushRefusal(text: unknown): GitHubPushRefusal | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/githubPushRefusal.js

@@ -0,0 +1,44 @@
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+export const GITHUB_WORKFLOW_PERMISSION_REQUIRED = 'github_workflow_permission_required';
+function workflowPath(value) {
+    if (typeof value !== 'string' || value.length > 240)
+        return null;
+    const path = value.replaceAll('\\', '/');
+    if (!/^\.github\/workflows\/[A-Za-z0-9_. /-]+$/.test(path))
+        return null;
+    const parts = path.split('/');
+    if (parts.some((part) => !part.trim() || part !== part.trim() || part === '.' || part === '..'))
+        return null;
+    return path;
+}
+export function isWorkflowPath(value) {
+    return workflowPath(value) !== null;
+}
+export function classifyGitHubPushRefusal(text) {
+    if (typeof text !== 'string')
+        return null;
+    // Bound parsing work. Git prints the rejection LAST, after any amount of
+    // progress output, so keep the tail; truncated diagnostics keep the generic refusal.
+    const input = text.slice(-64 * 1024);
+    const pattern = /refusing to allow (?:a|an) (GitHub App|OAuth App|Personal Access Token) to create or update workflow [`'"]([^`'"\r\n]+)[`'"] without [`'"]workflows?[`'"] (?:permission|scope)/gi;
+    const paths = [];
+    let tokenKind = 'unknown';
+    for (const match of input.matchAll(pattern)) {
+        const path = workflowPath(match[2]);
+        if (!path)
+            continue;
+        if (tokenKind === 'unknown') {
+            tokenKind =
+                match[1].toLowerCase() === 'github app'
+                    ? 'github_app'
+                    : match[1].toLowerCase() === 'oauth app'
+                        ? 'oauth_app'
+                        : 'personal_access_token';
+        }
+        if (!paths.includes(path))
+            paths.push(path);
+        if (paths.length === 10)
+            break;
+    }
+    return paths.length ? { code: GITHUB_WORKFLOW_PERMISSION_REQUIRED, tokenKind, paths } : null;
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -14,6 +14,16 @@
         "default": "./dist/cjs/index.js"
       }
     },
+    "./github-push-refusal": {
+      "import": {
+        "types": "./dist/esm/githubPushRefusal.d.ts",
+        "default": "./dist/esm/githubPushRefusal.js"
+      },
+      "require": {
+        "types": "./dist/cjs/githubPushRefusal.d.ts",
+        "default": "./dist/cjs/githubPushRefusal.js"
+      }
+    },
     "./refresh-classification": {
       "import": {
         "types": "./dist/esm/refreshClassification.d.ts",