quoxcli 0.2.0 → 0.4.0

package/lib/commands/kumaSla.js

@@ -0,0 +1,174 @@
+/**
+ * quox kuma sla ... : signed, verifiable uptime reports (NQ-KUMA-7).
+ *
+ * quox kuma sla [--month YYYY-MM | --from <iso> --to <iso>] [--out <file>] [--json]   generate + sign + store
+ * quox kuma sla list                                                                   this org's stored reports
+ * quox kuma sla verify <id|file> [--public-key <base64>]                               recompute the hash, check the signature
+ *
+ * `verify <id>` asks the collector, which checks against its pinned WARD key (trust anchored).
+ * `verify <file>` is fully OFFLINE: it recomputes sha256 over the canonical report and checks the Ed25519
+ * signature with node:crypto. Against the key embedded in the file this proves integrity only (anyone can
+ * mint a keypair); pass --public-key <raw 32 byte base64 WARD key> to pin the signer yourself.
+ *
+ * Exit codes: 0 ok / verified, 1 error, 2 verification FAILED.
+ */
+
+import { readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { createHash, createPublicKey, verify as cryptoVerify } from 'node:crypto';
+import { resolveEndpoint } from '../api/endpoints.js';
+import { line as glyphLine } from '../core/quoxglyph.js';
+
+// Same canonical form as services/collector/lib/bundleSigner.js canonicalize (sorted keys, no whitespace).
+export function canonicalize(val) {
+  if (val === null || val === undefined) return JSON.stringify(val);
+  if (typeof val !== 'object') return JSON.stringify(val);
+  if (Array.isArray(val)) return `[${val.map((v) => canonicalize(v)).join(',')}]`;
+  const keys = Object.keys(val).filter((k) => val[k] !== undefined).sort();
+  return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalize(val[k])}`).join(',')}}`;
+}
+
+const SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+const keyFromRaw = (b64) => {
+  try {
+    const raw = Buffer.from(String(b64 || ''), 'base64');
+    if (raw.length !== 32) return null;
+    return createPublicKey({ key: Buffer.concat([SPKI_PREFIX, raw]), format: 'der', type: 'spki' });
+  } catch { return null; }
+};
+
+/** Offline verification of an export bundle. Mirrors kumaSlaReports.verifyBundle. */
+export function verifyBundleOffline(bundle, { publicKey } = {}) {
+  const out = { valid: false, hash_ok: false, binding_ok: false, signature_ok: false, key_source: 'none', trust_anchored: false };
+  if (!bundle || typeof bundle !== 'object' || !bundle.report || typeof bundle.report !== 'object') return { ...out, reason: 'malformed_bundle' };
+  const sig = bundle.signature;
+  if (!sig || !sig.signature || !sig.message) return { ...out, reason: 'missing_signature' };
+  const recomputed = createHash('sha256').update(canonicalize(bundle.report), 'utf-8').digest('hex');
+  out.recomputed_sha256 = recomputed;
+  out.hash_ok = recomputed === bundle.report_sha256;
+  if (!out.hash_ok) return { ...out, reason: 'report_hash_mismatch' };
+  const r = bundle.report;
+  const expected = r.period ? {
+    kind: 'quox.kuma.sla.report', report_id: bundle.report_id, org_id: r.org_id,
+    period_from: r.period.from, period_to: r.period.to, generated_at: r.generated_at, report_sha256: recomputed,
+  } : null;
+  out.binding_ok = !!expected && canonicalize(expected) === canonicalize(sig.message);
+  if (!out.binding_ok) return { ...out, reason: 'signature_not_bound_to_report' };
+  if (sig.sig_type !== 'ed25519') return { ...out, reason: `unverifiable_sig_type:${sig.sig_type}` };
+  let key = null; let source = 'none';
+  if (publicKey) { key = keyFromRaw(publicKey); source = 'pinned'; if (!key) return { ...out, reason: 'bad_public_key' }; }
+  else { key = keyFromRaw(sig.public_key); source = 'embedded'; }
+  if (!key) return { ...out, reason: 'no_verification_key' };
+  out.key_source = source;
+  try {
+    out.signature_ok = cryptoVerify(null, Buffer.from(canonicalize(sig.message), 'utf-8'), key, Buffer.from(String(sig.signature), 'base64'));
+  } catch (err) { return { ...out, reason: `verify_error:${err.message}` }; }
+  if (!out.signature_ok) return { ...out, reason: 'signature_mismatch' };
+  out.valid = true;
+  out.trust_anchored = source === 'pinned' && !sig.warning;
+  if (sig.warning) out.warning = sig.warning;
+  return out;
+}
+
+const dur = (s) => {
+  if (s === null || s === undefined) return '-';
+  if (s < 60) return `${s}s`;
+  if (s < 3600) return `${Math.floor(s / 60)}m ${s % 60}s`;
+  return `${Math.floor(s / 3600)}h ${Math.floor((s % 3600) / 60)}m`;
+};
+
+export function registerKumaSla(kuma, { client, auth, jsonOut, guard, KumaFail, pad }) {
+  const slaFail = (verb, ep, err) => {
+    const status = err && (err.status ?? err.statusCode);
+    const msg = (err && err.message) || String(err);
+    const head = `quox kuma ${verb}: ${ep.method} ${ep.path} failed${status ? ` with HTTP ${status}` : ''}`;
+    if (status === 422) return new KumaFail(`${head}: Uptime Kuma is not configured for this org (add the uptime_kuma credential in the vault).`);
+    if (status === 404) return new KumaFail(`${head}: not found in this org.`);
+    return new KumaFail(`${head}: ${msg}`);
+  };
+
+  const sla = kuma
+    .command('sla')
+    .description('Signed, verifiable uptime (SLA) report from Kuma heartbeats; `sla verify <id|file>` checks one')
+    .option('--month <YYYY-MM>', 'calendar month (UTC), e.g. 2026-09')
+    .option('--from <iso>', 'range start (with --to)')
+    .option('--to <iso>', 'range end, exclusive')
+    .option('--out <file>', 'also write the signed bundle here for offline verification')
+    .addHelpText('after', '\nExit codes: 0 ok, 1 error, 2 `sla verify` found the report does NOT verify.')
+    .action(guard('sla', async (options) => {
+      auth.requireAuth();
+      if (!options.month && !(options.from && options.to)) throw new KumaFail('quox kuma sla: give --month YYYY-MM, or both --from and --to.');
+      const ep = resolveEndpoint('mon.kuma.sla.create');
+      const body = options.month ? { month: options.month } : { from: options.from, to: options.to };
+      let data;
+      try { data = await client.post(ep.path, { service: ep.service, body }); } catch (err) { throw slaFail('sla', ep, err); }
+      if (!data || data.success === false || data.error || !data.report || !data.signature) {
+        throw new KumaFail(`quox kuma sla: ${ep.method} ${ep.path} returned an error body: ${(data && data.error) || 'response had no report'}`);
+      }
+      if (options.out) {
+        writeFileSync(options.out, `${JSON.stringify({ report_id: data.report_id, report: data.report, report_sha256: data.report_sha256, signature: data.signature }, null, 2)}\n`);
+      }
+      if (jsonOut()) { console.log(JSON.stringify(data, null, 2)); return; }
+      const r = data.report; const ro = r.rollup;
+      console.log(glyphLine('kuma', 'sla', { result: `${r.period.label} · ${ro.uptime_pct === null ? 'no data' : `${ro.uptime_pct}%`}`, status: ro.uptime_pct === null ? 'warn' : 'ok' }));
+      console.log(`Report ${data.report_id}   sha256 ${data.report_sha256}`);
+      console.log(`Period ${r.period.from} to ${r.period.effective_to}${r.period.partial ? '  (partial: the period has not ended)' : ''}`);
+      const rows = [['MONITOR', 'UPTIME', 'OUTAGES', 'DOWNTIME', 'LONGEST', 'MTTR', 'MAINT', 'GAPS']];
+      for (const m of r.monitors) {
+        rows.push([m.name || m.monitor_id, m.status === 'no_data' ? 'no data' : `${m.uptime_pct}%`, m.outages.count, dur(m.outages.total_downtime_seconds), dur(m.outages.longest_seconds), dur(m.outages.mttr_seconds), m.beats.maintenance, m.coverage.gaps.length]);
+      }
+      console.log(`\n${pad(rows).join('\n')}`);
+      console.log(`\nOrg: ${ro.uptime_pct === null ? 'no data' : `${ro.uptime_pct}%`} over ${ro.monitors_with_data}/${ro.monitors_total} monitors with data; ${ro.outages.count} ${ro.outages.count === 1 ? 'outage' : 'outages'}, ${dur(ro.outages.total_downtime_seconds)} down, MTTR ${dur(ro.outages.mttr_seconds)}.`);
+      if (ro.monitors_no_data) console.log(`${ro.monitors_no_data} ${ro.monitors_no_data === 1 ? 'monitor has' : 'monitors have'} no heartbeats in the period: reported as no data, not as 100%.`);
+      console.log(data.trust_anchored ? 'Signed with the WARD key and witnessed.' : 'WARNING: signed with an ephemeral key (no persistent WARD key on this collector): integrity only, not trust anchored.');
+      console.log(`Verify:  quox kuma sla verify ${options.out || data.report_id}`);
+    }));
+
+  sla
+    .command('list')
+    .description('This org\'s stored SLA reports')
+    .action(guard('sla list', async () => {
+      auth.requireAuth();
+      const ep = resolveEndpoint('mon.kuma.sla.list');
+      let data;
+      try { data = await client.get(ep.path, { service: ep.service }); } catch (err) { throw slaFail('sla list', ep, err); }
+      if (!data || data.success === false || data.error || !Array.isArray(data.reports)) {
+        throw new KumaFail(`quox kuma sla list: ${ep.method} ${ep.path} returned an error body: ${(data && data.error) || 'response had no reports array'}`);
+      }
+      if (jsonOut()) { console.log(JSON.stringify(data, null, 2)); return; }
+      console.log(glyphLine('kuma', 'sla list', { result: `${data.reports.length} ${data.reports.length === 1 ? 'report' : 'reports'}`, status: 'ok' }));
+      if (!data.reports.length) { console.log('No reports yet. Generate one: quox kuma sla --month YYYY-MM'); return; }
+      const rows = [['REPORT', 'PERIOD', 'CREATED', 'SHA256']];
+      for (const r of data.reports) rows.push([r.report_id, r.period, r.created_at, String(r.report_sha256).slice(0, 16)]);
+      console.log(pad(rows).join('\n'));
+    }));
+
+  sla
+    .command('verify')
+    .description('Recompute the report hash and check the signature (id: via the collector, pinned WARD key; file: fully offline)')
+    .argument('<id|file>', 'a report id from `quox kuma sla list`, or a bundle file written by `sla --out`')
+    .option('--public-key <base64>', 'offline: pin this raw 32 byte Ed25519 WARD public key instead of trusting the key in the file')
+    .action(guard('sla verify', async (target, options) => {
+      let result;
+      if (existsSync(target)) {
+        let bundle;
+        try { bundle = JSON.parse(readFileSync(target, 'utf-8')); } catch (err) { throw new KumaFail(`quox kuma sla verify: ${target} is not valid JSON: ${err.message}`); }
+        result = { report_id: bundle && bundle.report_id, mode: 'offline', ...verifyBundleOffline(bundle, { publicKey: options.publicKey }) };
+      } else {
+        auth.requireAuth();
+        const ep = resolveEndpoint('mon.kuma.sla.verify', { id: target });
+        let data;
+        try { data = await client.get(ep.path, { service: ep.service }); } catch (err) { throw slaFail('sla verify', ep, err); }
+        if (!data || data.success === false || data.error || typeof data.valid !== 'boolean') {
+          throw new KumaFail(`quox kuma sla verify: ${ep.method} ${ep.path} returned an error body: ${(data && data.error) || 'response had no verdict'}`);
+        }
+        result = { mode: 'collector', ...data };
+      }
+      if (jsonOut()) { console.log(JSON.stringify(result, null, 2)); } else {
+        console.log(glyphLine('kuma', 'sla verify', { result: result.valid ? `verified (${result.mode})` : `NOT verified: ${result.reason}`, status: result.valid ? 'ok' : 'error' }));
+        console.log(`hash ${result.hash_ok ? 'matches' : 'DOES NOT match'}   binding ${result.binding_ok ? 'ok' : 'FAILED'}   signature ${result.signature_ok ? 'valid' : 'INVALID'}   key ${result.key_source}${result.trust_anchored ? ' (trust anchored)' : ' (not trust anchored)'}`);
+        if (result.valid && !result.trust_anchored) console.log('Integrity holds, but the signer was not checked against the WARD key. Pin it with --public-key, or verify by id through the collector.');
+        if (result.warning) console.log(`Warning: ${result.warning}`);
+      }
+      if (!result.valid) process.exitCode = 2;
+    }));
+}

package/lib/commands/licence.js

@@ -5,53 +5,26 @@
  * Phase 1 (instance-local): status reads the lease (never the key), refresh
  * runs the renewal, seats lists/cleans band holders (dry run default).
  *
- * Phase 2 (owner-only, talks to the quox.ai WEBSITE admin API with a separate
- * website session, see core/websiteSession.js): reissue re-bands/extends a
- * licence record, catalogue-sign re-signs the product catalogue. Both are DRY
- * RUN unless --apply. The signing key never leaves the website VM; the CLI
- * never sees, prints or sends key material or licence keys.
+ * Phase 2 (owner-only vendor tooling for the quox.ai website) lives in
+ * lib/vendor/licenceOwner.js and is registered only when that file is present.
+ * lib/vendor/ is excluded from the npm package (quox#1134): the public build
+ * never carries it.
  */
 
-import { writeFileSync } from 'node:fs';
 import { formatOutput, formatDetail, printSuccess, printInfo, printWarning } from '../core/output.js';
 import { resolveEndpoint } from '../api/endpoints.js';
 import { QuoxValidationError } from '../core/errors.js';
-import {
-  DEFAULT_WEBSITE_URL, DEFAULT_WEBSITE_PROFILE, normaliseWebsiteUrl, websiteLogin, websitePost,
-  saveWebsiteSession, clearWebsiteSession, getWebsiteSession,
-} from '../core/websiteSession.js';
 
-const OWNER_HELP = `
-Owner-only (website admin session, dry run unless --apply):
-  website-login       log in to the quox.ai admin API once (password is not stored)
-  reissue <licenseId> band bare paid ids / add ids, re-signed on the website VM
-  catalogue-sign      re-sign the product catalogue with the live key
-See the quox-licensing skill (~/.claude/skills/quox-licensing/SKILL.md).
-`;
-
-const ID_LIST_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/;
-
-export function parseIdList(value, flag) {
-  if (value === undefined) return undefined;
-  const ids = String(value).split(',').map((s) => s.trim()).filter(Boolean);
-  for (const id of ids) {
-    if (!ID_LIST_RE.test(id)) throw new QuoxValidationError(`${flag}: invalid plugin id "${id}"`);
-  }
-  return ids;
+// quox#1134: the owner-only website verbs are vendor tooling, kept out of the published package (package.json
+// "files" excludes lib/vendor/). Present in the dev tree, absent for every npm user.
+let VENDOR_OWNER = null;
+try {
+  VENDOR_OWNER = await import('../vendor/licenceOwner.js');
+} catch (e) {
+  if (!(e?.code === 'ERR_MODULE_NOT_FOUND' && String(e?.message || '').includes('licenceOwner'))) throw e;
 }
 
-export function parseOrgs(value) {
-  if (value === undefined) return undefined;
-  const n = Number(value);
-  if (!Number.isInteger(n) || n < 1 || n > 1000) throw new QuoxValidationError('--orgs must be an integer between 1 and 1000');
-  return n;
-}
-
-function list(arr) {
-  return arr && arr.length ? arr.join(', ') : '(none)';
-}
-
-export function registerLicenceCommands(program, ctx) {
+export function registerLicenceCommands(program, ctx, { owner = VENDOR_OWNER } = {}) {
   const { client, auth } = ctx;
   const fetchImpl = ctx.websiteFetch || globalThis.fetch;
   const json = () => program.opts().output === 'json';
@@ -60,8 +33,8 @@ export function registerLicenceCommands(program, ctx) {
     .command('licence')
     .alias('license')
     .description('Instance licence status, lease refresh and seat bands')
-    .addHelpText('after', OWNER_HELP)
     .action(() => { licence.help(); });
+  if (owner) licence.addHelpText('after', owner.OWNER_HELP);
 
   licence
     .command('status')
@@ -136,9 +109,21 @@ export function registerLicenceCommands(program, ctx) {
     .description('List a plugin band holders; --release-dead frees non-live holders (dry run unless --yes)')
     .argument('<pluginId>', 'plugin id, e.g. notesq')
     .option('--release-dead', 'release holders that are not live orgs (deleted orgs, user: ids)')
+    .option('--release <orgId>', 'release a LIVE org seat (its install of the plugin is disabled); dry run unless --yes')
+    .option('--to <orgId>', 'with --release: hand the freed seat to this org in the same call')
     .option('--yes', 'actually release (otherwise dry run)')
     .action(async (pluginId, opts) => {
       auth.requireAuth();
+      if (opts.to && !opts.release) {
+        const e = new Error('--to only works together with --release <orgId>');
+        e.exitCode = 2;
+        throw e;
+      }
+      if (opts.release && opts.releaseDead) {
+        const e = new Error('use either --release or --release-dead, not both');
+        e.exitCode = 2;
+        throw e;
+      }
       const lep = resolveEndpoint('setup.licensing.seats.list', { pluginId });
       const list = await client.get(lep.path, { service: lep.service });
       let rel = null;
@@ -146,7 +131,15 @@ export function registerLicenceCommands(program, ctx) {
         const rep = resolveEndpoint('setup.licensing.seats.releaseDead', { pluginId });
         rel = await client.post(rep.path, { service: rep.service, body: { dry_run: !opts.yes } });
       }
-      if (json()) { console.log(JSON.stringify({ ...list, release: rel }, null, 2)); return; }
+      let live = null;
+      if (opts.release) {
+        const rp = resolveEndpoint('setup.licensing.seats.release', { pluginId });
+        live = await client.post(rp.path, {
+          service: rp.service,
+          body: { org_id: opts.release, ...(opts.to ? { to_org_id: opts.to } : {}), dry_run: !opts.yes },
+        });
+      }
+      if (json()) { console.log(JSON.stringify({ ...list, release: rel, live_release: live }, null, 2)); return; }
       printInfo(`${pluginId}: ${list.holders.length} holder(s), cap ${list.allowance ?? '(no band)'}`);
       formatOutput({
         columns: ['id', 'name', 'status'],
@@ -160,121 +153,25 @@ export function registerLicenceCommands(program, ctx) {
           printSuccess(`Released ${rel.released.length} non-live holder(s): ${rel.released.join(', ') || '(none)'}`);
         }
       }
-    });
-
-  // ---------------- Phase 2: owner-only, website admin API ----------------
-
-  licence
-    .command('website-login')
-    .description('Log in to the quox.ai website admin API for reissue/catalogue-sign (stores the session cookie only, 0600)')
-    .option('--website-profile <name>', 'website session profile', DEFAULT_WEBSITE_PROFILE)
-    .option('--url <url>', 'website base URL', DEFAULT_WEBSITE_URL)
-    .option('--username <name>', 'website admin username')
-    .option('--password-stdin', 'read the password from stdin (one line) instead of prompting')
-    .action(async (opts) => {
-      normaliseWebsiteUrl(opts.url); // refuse a bad or plain-http URL before asking for a password
-      let { username } = opts;
-      let password;
-      if (opts.passwordStdin) {
-        const chunks = [];
-        for await (const c of process.stdin) chunks.push(Buffer.from(c));
-        password = Buffer.concat(chunks).toString('utf8').split('\n')[0].trim();
-      }
-      if (!username || !password) {
-        const { default: inquirer } = await import('inquirer');
-        if (!username) username = (await inquirer.prompt([{ type: 'input', name: 'u', message: 'Website admin username:' }])).u;
-        if (!password) password = (await inquirer.prompt([{ type: 'password', name: 'p', message: 'Password:', mask: '*' }])).p;
-      }
-      if (!username || !password) throw new QuoxValidationError('username and password are required');
-      const session = await websiteLogin({ url: opts.url, username, password, fetchImpl });
-      password = null;
-      saveWebsiteSession(opts.websiteProfile, session);
-      if (json()) { console.log(JSON.stringify({ profile: opts.websiteProfile, url: session.url, username: session.username, must_change_password: session.must_change_password }, null, 2)); return; }
-      printSuccess(`Website session saved for ${session.username} at ${session.url} (profile ${opts.websiteProfile}, valid ~24h). Password not stored.`);
-      if (session.must_change_password) printWarning('This admin must change their password on the website before licence operations will be allowed (HTTP 403 until then).');
-    });
-
-  licence
-    .command('website-logout')
-    .description('End the website admin session and delete the stored cookie')
-    .option('--website-profile <name>', 'website session profile', DEFAULT_WEBSITE_PROFILE)
-    .action(async (opts) => {
-      if (getWebsiteSession(opts.websiteProfile)) {
-        try { await websitePost(opts.websiteProfile, '/api/admin/logout', {}, { fetchImpl }); } catch { /* session may already be dead */ }
+      if (live) {
+        const who = `${live.org_name || live.org_id} (${live.org_id})`;
+        const loses = live.will_disable_install
+          ? `its install of ${pluginId} goes disabled and the plugin stops working there`
+          : `it loses access to ${pluginId} (no enabled install to disable)`;
+        if (live.dry_run) {
+          printInfo(`DRY RUN: would release the ${pluginId} seat held by ${who}: ${loses}.`);
+          if (live.would_assign_to) printInfo(`DRY RUN: the freed seat would go to ${live.would_assign_to}.`);
+          else printInfo(`Seats are first-come: add --to <orgId> to hand the freed seat to a specific org, otherwise the first org to use ${pluginId} takes it.`);
+          printInfo(`Re-run with --yes to release.`);
+        } else if (live.released) {
+          printSuccess(`Released the ${pluginId} seat held by ${who}: ${loses}.`);
+          if (live.assigned_to) printSuccess(`Seat now held by ${live.assigned_to}.`);
+          else if (opts.to) printWarning(`The seat was freed but ${opts.to} could not take it (see the band with: quox licence seats ${pluginId}).`);
+        } else {
+          printWarning(`Nothing released: ${who} no longer holds a ${pluginId} seat.`);
+        }
       }
-      const had = clearWebsiteSession(opts.websiteProfile);
-      printSuccess(had ? `Website session ${opts.websiteProfile} removed.` : `No website session ${opts.websiteProfile} was stored.`);
     });
 
-  licence
-    .command('reissue')
-    .description('Owner-only: band bare paid ids and add ids on a licence record, re-signed on the website (dry run unless --apply)')
-    .argument('<licenseId>', 'licence id, e.g. lic_abc123')
-    .option('--orgs <n>', 'org band for every banded/added id (default 10)')
-    .option('--add <ids>', 'comma-separated ids to ADD as <id>@orgs=N')
-    .option('--band <ids>', 'comma-separated ids already present to FORCE-band')
-    .option('--apply', 'actually reissue (otherwise dry run, nothing changes)')
-    .option('--website-profile <name>', 'website session profile', DEFAULT_WEBSITE_PROFILE)
-    .action(async (licenseId, opts) => {
-      const body = { dryRun: !opts.apply };
-      const orgs = parseOrgs(opts.orgs);
-      if (orgs !== undefined) body.orgs = orgs;
-      const add = parseIdList(opts.add, '--add');
-      if (add) body.add = add;
-      const band = parseIdList(opts.band, '--band');
-      if (band) body.band = band;
-
-      const d = await websitePost(opts.websiteProfile, `/api/admin/licenses/${encodeURIComponent(licenseId)}/reissue`, body, { fetchImpl });
-      if (json()) { console.log(JSON.stringify(d, null, 2)); return; }
-
-      printInfo(`Licence ${d.license_id}${d.customer_email ? ` (${d.customer_email})` : ''}: max_servers ${d.max_servers ?? '?'}, expires ${d.expires_at || 'never'}`);
-      const removed = new Set(d.diff?.removed || []);
-      const added = new Set(d.diff?.added || []);
-      for (const e of d.current || []) console.log(`  ${removed.has(e) ? '-' : ' '} ${e}`);
-      for (const e of d.next || []) if (added.has(e)) console.log(`  + ${e}`);
-      if (d.unknown_ids?.length) printWarning(`Not issuable (unknown to the signed catalogue), apply will be refused: ${d.unknown_ids.join(', ')}`);
-
-      if (!d.changed) { printSuccess('No change needed: the licence already has these entitlements.'); return; }
-      if (d.dry_run) { printInfo('DRY RUN: nothing changed. Re-run with --apply to reissue.'); return; }
-      printSuccess(`Reissued ${d.license_id}. Audit/backup id: ${d.backup_id}`);
-      printInfo('Instances pick this up on their next lease renewal (~6h). To pull it now, on the instance: quox licence refresh');
-    });
-
-  licence
-    .command('catalogue-sign')
-    .alias('catalog-sign')
-    .description('Owner-only: re-sign the product catalogue with the live key on the website (dry run unless --apply)')
-    .option('--apply', 'actually sign and publish to the website API (otherwise dry run)')
-    .option('--out <path>', 'after --apply, save the signed catalogue (public artifact) here for committing')
-    .option('--website-profile <name>', 'website session profile', DEFAULT_WEBSITE_PROFILE)
-    .action(async (opts) => {
-      if (opts.out && !opts.apply) throw new QuoxValidationError('--out is only meaningful with --apply');
-      const d = await websitePost(opts.websiteProfile, '/api/admin/catalog/sign', { dryRun: !opts.apply }, { fetchImpl });
-      if (opts.out && d.artifact) writeFileSync(opts.out, JSON.stringify(d.artifact, null, 2) + '\n', 'utf8');
-      if (json()) {
-        const { artifact, ...rest } = d;
-        console.log(JSON.stringify({ ...rest, artifact_saved_to: opts.out && artifact ? opts.out : null }, null, 2));
-        return;
-      }
-      const p = d.published || {};
-      formatDetail({
-        published: p.exists ? `${p.verified ? 'verified' : 'NOT VERIFIED'}, sha256 ${p.sha256 ? p.sha256.slice(0, 16) : '?'}..., ${p.generated_at || '?'}` : '(none)',
-        products: `${p.product_count ?? 0} -> ${d.candidate?.product_count ?? '?'}`,
-        governed: `${p.governed_count ?? 0} -> ${d.candidate?.governed_count ?? '?'}`,
-        products_added: list(d.diff?.products_added),
-        products_removed: list(d.diff?.products_removed),
-        products_changed: list(d.diff?.products_changed),
-        governed_added: list(d.diff?.governed_added),
-        governed_removed: list(d.diff?.governed_removed),
-        signing_key: d.signing ? (d.signing.trusted ? `trusted (${d.signing.trusted_key_prefix}...)` : (d.signing.configured ? 'NOT the trusted key: apply will be refused' : 'not configured: apply will be refused')) : '?',
-      }, { title: d.dry_run ? 'Catalogue sign (DRY RUN)' : 'Catalogue sign' });
-      if (d.diff?.governed_added?.length) {
-        printWarning(`Newly governed: ${d.diff.governed_added.join(', ')}. Reissue the owner licence with these ids (quox licence reissue <id> --add ...) and refresh its lease BEFORE instances install this catalogue, or they lock out.`);
-      }
-      if (!d.changed) { printSuccess('No change: the published catalogue already matches.'); return; }
-      if (d.dry_run) { printInfo('DRY RUN: nothing signed. Re-run with --apply to sign.'); return; }
-      printSuccess(`Catalogue signed. sha256 ${d.sha256}, governed ${d.governed_count}, audit id ${d.audit_id}`);
-      if (opts.out) printInfo(`Signed catalogue saved to ${opts.out}.`);
-      printInfo('The website container copy does not survive a rebuild: commit the artifact to quox-website api/data/signed-catalog.json and quox-dashboard services/auth/data/signed-catalog.json (use --out to save it).');
-    });
+  if (owner) owner.registerLicenceOwnerCommands(licence, { json, fetchImpl });
 }