NerionX CLI

NerionX CLI — Go-owned interactive and automation-safe brand onboarding, Brand Kit lifecycle, Hub operations, fleet planning/control, and governed Docker-agent runtime (blueprint §8).

Implementation status

The repository's native Go binary owns onboarding/profile management, Brand Kit Docker lifecycle, identity/config, catalog sync, review-first generation, orders/inventory, DNS/SSL, webhook/feed operations, backup/migration gates, fleet planning/control, and the Docker v2 control client. nerionx-agent is the separate mTLS, allowlist-only host reconciler. nerionx legacy is retained only for explicit monorepo/platform-maintenance compatibility.

The native binaries are publicly distributed from install.nerionx.dev; the governed tag workflow tests, packages, signs, publishes, and externally installs each immutable release. The npm package is no longer part of the release flow — the TypeScript CLI survives only as the monorepo legacy platform-maintenance commands. See the Go UX and migration contract. See Docker Agent v2 for host registration and safety controls.

Build the Go CLI from source

With Go 1.26 or the pinned container toolchain:

cd packages/cli
go build -trimpath -o dist-go/nerionx ./cmd/nerionx
go build -trimpath -o dist-go/nerionx-agent ./cmd/nerionx-agent
./dist-go/nerionx --help

# No host Go installation required:
docker run --rm -v "$PWD:/src" -w /src golang:1.26.5 \
  go build -trimpath -o dist-go/nerionx-linux ./cmd/nerionx

Install the native CLI and agent on macOS or Linux with curl -fsSL https://install.nerionx.dev/install.sh | bash; Windows users run irm https://install.nerionx.dev/install.ps1 | iex. Do not install from npm: that package is the superseded TypeScript CLI, is no longer released, and shadows the native binary on PATH.

After installation, run type -a nerionx, nerionx --version, and nerionx --help. Native help starts with NerionX CLI (Go). If an older launcher appears first, remove it or put the native install directory earlier in PATH, then refresh the command cache with rehash (zsh) or hash -r (bash).

Brand Kit lifecycle commands also require the Docker Compose CLI plugin. Run docker compose version in the same shell before nerionx init; a standalone docker-compose executable by itself does not satisfy the CLI preflight.

The governed release produces checksummed macOS/Linux archives for amd64 and arm64 plus a Windows amd64 ZIP. install-native.sh installs both nerionx and nerionx-agent on macOS/Linux; install-native.ps1 does the same on Windows and supports optional PATH and Cosign verification.

Registration and approval

Every new brand needs a valid business profile and operator approval. The CLI collects and validates the same required business data rather than bypassing onboarding:

nerionx start
# Or go directly to a named profile:
nerionx create brand --profile 'CityPharmacy'
nerionx request approval --profile 'CityPharmacy'

In an interactive terminal, nerionx start opens a full-screen Bubble Tea wizard. Use the arrow keys or Tab to move, Space to order multi-select choices, A to add any valid ISO code beyond the common choices, Enter to validate and continue, Esc to go back, and Ctrl+C to cancel safely. The wizard groups contact, business, address, market, language, currency, and reviewer-note fields, shows inline validation, and presents a final review before saving. Consent, password, and email-code prompts also use Bubble Tea; passwords stay masked. Redirected input and CI retain the line-oriented fallback, while --non-interactive never opens either interface.

The profile includes the applicant name, valid email and international phone, company and trading names, complete company address, valid website, one or more regions, languages and currencies, plus an optional note. The approval command asks for explicit Terms acceptance and a secure account password, emails a verification code, and submits only after Hub verifies the account. The first language and currency supplied become the profile defaults.

Automation can provide every business field explicitly. --non-interactive fails on the first missing or invalid field instead of opening a prompt:

nerionx create brand --profile CityPharmacy \
  --first-name Ada --last-name Lovelace --email [email protected] \
  --phone +41445550123 --company-name 'City Pharmacy GmbH' \
  --trading-name 'City Pharmacy' --address-line1 '1 Market Street' \
  --city Zurich --postal-code 8001 --country CH \
  --website citypharmacy.example --regions CH,DE \
  --languages de,fr --currencies CHF,EUR --non-interactive

Approval is interactive by default because the account password and emailed verification code must not be placed in shell history. Add --request-approval to continue directly. For CI, inject NERIONX_ACCOUNT_PASSWORD and NERIONX_VERIFICATION_CODE through a secret manager and add --accept-terms, --non-interactive, and --json; never pass either secret as a command-line flag.

Manage multiple local profiles without editing JSON:

nerionx profile list
nerionx profile show CityPharmacy
nerionx profile edit CityPharmacy
nerionx profile use CityPharmacy

One personal account, independent brands

Sign in once with your personal email, then explicitly choose the approved brand and environment for runtime credentials. A personal profile requires full name, phone and physical address; it remains separate from every business profile.

nerionx account login --email [email protected] --hub-url https://api.nerionx.dev
nerionx account profile --details-file personal-profile.json
nerionx account brands
nerionx login --account --email [email protected] --brand BRAND_ID --environment live
nerionx init --dir ./alpha --port-base 33100

personal-profile.json contains fullName, phone, and address (line1, optional line2, city, optional region, postalCode, countryCode). Keep this personal-data file private. Passwords are prompted or supplied through NERIONX_ACCOUNT_PASSWORD; they are never saved in the account configuration.

Each local business profile is linked to its Hub, account, application and, once approved, brand. Add another profile and request its approval using the same account. The professional contact email is collected separately; automation can supply NERIONX_BRAND_CONTACT_EMAIL. Verify that address in the specific Hub application before approval. An incomplete personal profile blocks submission, not saving a draft. Rejected applications are corrected in their Hub application.

Both CLI paths use version 2 configuration and separate credentials by Hub, brand and environment. Migration creates a backup and preserves private file permissions. Ambiguous targets and conflicting selectors fail before effects. The installed directory supplies runtime context even when another brand is selected in the account's local configuration.

Register infrastructure with nerionx account infrastructure --details-file infrastructure.json (id UUID and name), then bind each installed kit:

nerionx account deployments --infrastructure INFRASTRUCTURE_ID --dir ./alpha
nerionx account deployments --infrastructure INFRASTRUCTURE_ID

Use nonoverlapping seven-port ranges and separate directories for each brand. The Hub reserves all seven ports, public domains and directories. Rebinding an unchanged legacy installation can add its previously unrecorded ports only when no other deployment reserves them.

up and immutable update persist operation identity before effects. After an interruption, rerun the same command with its original arguments; status shows its recorded phase. Another Go or TypeScript writer cannot take the installation's lock. Updates require --spoke-digest sha256:... --storefront-digest sha256:...; mutable update tags are rejected. Failed updates preserve the original image snapshot for rollback.

Database-only backups now carry an identity and content manifest. Restore requires the original brand, environment and installation, stopped application services, and --yes; Go and TypeScript backups are interoperable. These commands target installed BrandKits. Keep the manifest with the SQL file. Legacy SQL without that manifest must use a separately reviewed recovery procedure. Full application recovery additionally requires the existing Spoke backup workflow, including assets and configuration, and its offline restore command.

After removing the selected kit's resources with down --volumes --yes, retire its binding with account deployments --retire --infrastructure ID --instance INSTANCE_ID --resource-version VERSION. Infrastructure retirement lists and refuses remaining active deployments. Retiring records never deletes runtime resources automatically or removes another brand's data.

nerionx brand:create and nerionx provision remain local monorepo deployment commands for platform developers. They do not replace Hub approval.

Run the TypeScript compatibility CLI from a monorepo checkout:

pnpm --filter @nerionx/cli build
node packages/cli/bin/nerionx.js --help

Run a Brand Kit (local or server)

init and up drive Docker directly — same two commands on a laptop and on a server. Migrations run inside the Spoke image (the provision compose profile), so no monorepo, pnpm, or Medusa toolchain is needed on the host.

mkdir my-brand && cd my-brand
nerionx login --account               # owner email/password; obtains the approved brand's key
nerionx init --slug my-brand          # compose + .env + secrets, authenticated image pulls
nerionx up                            # infra → brand DB → migrations → spoke + storefront
nerionx agent setup                   # provider/model, private key, exact editorial brief

nerionx status                        # container status
nerionx logs spoke --follow           # tail one service
nerionx down                          # stop (add --volumes to delete data)
nerionx update \
  --spoke-digest sha256:<64-hex> \
  --storefront-digest sha256:<64-hex> # verify immutable release images and recreate
nerionx theme refresh                 # take a storefront fix the update shipped

init is idempotent: existing secrets and .env values are kept, and only missing ones are generated. The compose template ships inside this package, so it is version-locked to the CLI rather than fetched at install time.

init prepares files and images; it does not start services. Its JSON result reports state: "scaffolded" and running: false. Run up and require its readiness result before treating the kit as running.

start --dir <kit> resumes from the current profile and running kit. After approval, it distinguishes login, installation, an unreachable runtime and the saved AI setup step. An inspected kit offers Continue AI setup. It does not send an already-installed owner back through init.

agent setup opens a private, resumable wizard for the canonical DeepSeek text runtime. Select the model explicitly, enter a key in the hidden prompt, and optionally import a JSON file containing editorial_brief (or guidance). The exact text, including whitespace and Unicode, is retained. Do this later saves an explicit deferred state, disables AI settings, and retains the saved key and brief. agent status --json is read-only and never prompts.

nerionx agent setup --llm deepseek/MODEL --import-intent brief.json
nerionx agent setup --verify          # credentials/balance; no generation
nerionx agent setup --defer --json
nerionx agent status --dir ./my-brand --json

For automation, --set-api-key --non-interactive reads NERIONX_PROVIDER_API_KEY from the process environment; there is no key-value CLI flag. The CLI sends it over the kit's signed owner endpoint (HTTPS, except loopback); Spoke encrypts it before storage. Output contains only keyConfigured, never the key, ciphertext or a partial-key hint. Configuration is bound to the current brand and settings version. After a conflict or lost response, inspect agent status before repeating an edit.

Saved settings, a recent balance check, runtime availability and a run's eligibility are separate states. generationReady stays false for this setup projection; it cannot certify a workload or grant publication. Verification reports known funding, authentication and cooldown failures and exits nonzero when the check fails. A missing runtime allocation is reported explicitly. DeepSeek text configuration does not configure an image provider. doctor reports an AI warning until run eligibility has its own evidence, even when the store's order prerequisites pass.

init saves the Hub-verified HUB_BRAND_ID alongside its matching credential and passes the identity to Spoke for owner theme and AI commands. An existing kit cannot be rebound to another brand by changing the active login. For a kit created before this binding was included, sign in to its original brand, run nerionx init --dir KIT --force --tag RELEASE_TAG, then nerionx up --dir KIT. This refreshes the bundled Compose template while retaining the kit identity, database volumes and existing secrets. Preserve any custom Compose changes before using --force. Offline scaffolds without approved login metadata remain unbound until initialization can verify their brand.

For a new install, init also atomically creates owner-only .nerionx-identity.json. Its nxk_ instance ID derives the Compose project and is carried by every service, volume, network, and readiness response. Existing pre-identity kits with live Compose resources keep their current project and resource names; the CLI does not synthesize an identity for them. Mutating commands take one per-kit lock and fail with NX_LOCKED when another mutation is already running.

update no longer accepts mutable tags. Supply the exact Spoke and Storefront digests published for the same Brand Kit release. The CLI pulls each immutable reference, independently checks Docker Engine's observed repository digest, then writes an owner-only image override. A mismatch prevents recreation.

Air-gapped / self-hosted registry

No reach to registry.nerionx.dev (regulated vertical or a closed brand network)? Distribute the images yourself — the runtime stays containerized (no npm/toolchain on the brand box):

# On a machine that CAN pull the images — save them into one portable bundle:
nerionx kit export --out ./nerionx-kit-latest

# Carry the folder into the private network, then on the target host:
nerionx kit import ./nerionx-kit-latest       # docker load — needs no registry
nerionx init --offline --slug my-brand        # scaffold; skips docker login + pull
nerionx up                                    # boots from the loaded images

# Or seed a registry you host (Zot / registry:2 / Harbor) so many hosts pull it:
nerionx kit import ./nerionx-kit-latest --registry registry.internal:5000 --push

See the air-gap runbook.

Config (~/.nerionx/config.json)

The active profile name is kept in config.json; business-profile data is kept separately in ~/.nerionx/profiles.json with owner-only file permissions.

nerionx login
nerionx config set hubUrl http://localhost:9000
nerionx select --slug my-brand
nerionx config get
nerionx config sync-identity

Approved-brand workflow

nerionx create brand --profile 'CityPharmacy'
# The command offers to request approval immediately. To resume later:
nerionx request approval --profile 'CityPharmacy'

# Continue after NerionX approves the application.
nerionx login --account --profile 'CityPharmacy' # hidden owner-password prompt
mkdir mybranda && cd mybranda
nerionx init --slug mybranda          # reuses the key for a non-interactive registry login
nerionx up
nerionx request ssl mybranda.com
nerionx check ssl mybranda.com
nerionx pull products --initial
nerionx generate products

The CLI signs in through the existing account API, verifies the account's active approved brand, and issues a live key scoped to that brand through the same guarded endpoint as the setup guide. No browser key-generation step is needed. Pending applicants cannot obtain a key, and an operator account cannot substitute for the brand owner. Accounts currently belong to one brand; use --brand <slug-or-id> to require that exact brand before a key is issued.

Use --email <owner-email> when signing in without a local profile. Without an explicit API key, login defaults to account login. Automation injects NERIONX_ACCOUNT_PASSWORD from a secret manager and passes --non-interactive --json; passwords and sessions are never printed or saved. The verified brand key is stored in the existing private CLI configuration. Repeated login reuses the saved key after verification and does not rotate deployed keys. If a saved key cannot be verified, login fails without issuing another key; restore connectivity or use logout before signing in for a new key. Previously issued keys remain active until deliberately revoked.

Existing-key automation remains supported through NERIONX_API_KEY and nerionx login --non-interactive --json. Account login requires HTTPS, except for a local development Hub on loopback. The API client does not follow redirects.

Commands

| Category | Commands | | -------------------- | ---------------------------------------------------------------------------------------------------- | | Go onboarding | start, create brand --profile <name> [--non-interactive], request approval --profile <name> | | Go profile context | profile list, profile show/edit [name], profile use <name> | | Brand Kit | init [--offline], up, down, status, logs [service], update | | Air-gap / self-host | kit export, kit import [--registry <host> --push] | | Identity | login, logout, config get/set/sync-identity | | Hub connection | login/logout, config sync-identity, hub status, hub health, security rotate-keys | | Domains | request dns-ready, request ssl [domain], check ssl <domain> | | Catalog | pull products --initial\|--recent, sync [--force-event-bus], push | | AI | agent, agent status, generate products/pages; secrets use env/hidden input, never flags | | Pricing | pricing --sku, --product --set, --shipping --set, --floor, --sync-rates | | Theme | theme status/export/validate/diff/import/preview/publish/rollback/history/receipt/check-links | | Orders | orders list, orders get <id>, inventory reserve | | Integrations | webhook, webhook --add | | Ops | health [--verbose], security rotate-keys, service restart, db migrate/backup/restore | | Fleet | fleet generate/status/drafts/pause/resume/retry/cancel, fleet docker plan/apply/status/reconcile | | Platform development | brand:create, provision, migrate:native-*, hub db-backup/db-restore, destroy brand |

Legacy aliases: brand:create, ssl check|request. Platform-development commands never replace the Hub business-profile and approval workflow. Normal brand-owner categories in this table are Go-owned. Direct monorepo provisioning, one-time legacy-schema migrations, Hub database administration, and local-development teardown remain explicitly available through nerionx legacy; they are not part of the native brand-owner runtime.

Sensitive AI configuration supports both safe interaction and automation:

# Interactive hidden-key prompt (the key is never placed in shell history)
nerionx agent --llm anthropic/claude-sonnet-4-6 --set-api-key

# One-liner automation: inject the secret through the process environment
NERIONX_PROVIDER_API_KEY="$PROVIDER_KEY" nerionx agent \
  --llm anthropic/claude-sonnet-4-6 --set-api-key --non-interactive

nerionx pricing --product --set 'markup=25%'
nerionx pricing --shipping --set 'FR=10,BE=10' --currency EUR
nerionx pricing --sku NX-1001 --floor 29.90 --currency EUR

# Cross-brand fleet mutations require a separately scoped bearer token.
NERIONX_FLEET_TOKEN="$FLEET_TOKEN" \
  nerionx fleet generate --file campaign.yaml --apply --yes --json

Local platform-development workflow

From a monorepo checkout only, brand:create / provision can create a local Spoke for development. They fail if the checkout cannot be found and do not create or approve a Hub registration.

env $(grep -v '^#' .env.my-brand | xargs) pnpm --filter @nerionx/spoke dev

See brand-provisioning runbook.

Native theme lifecycle

The owner CLI edits the installed Online Store Liquid theme. Exports contain its actual settings, templates, sections, CSS, images and fonts. They preserve the existing layout and do not substitute a default token palette.

nerionx theme status --dir ./kit --json
nerionx theme export --dir ./kit --theme THEME_ID --state draft --file theme.json
# Edit file bodies or base64 assets in theme.json, retaining its source identity.
nerionx theme validate --dir ./kit --file theme.json --json
nerionx theme diff --dir ./kit --file theme.json --json
nerionx theme import --dir ./kit --file theme.json --request-id edit-001 --json
# Use the revision returned by import; open the previewUrl and inspect the result.
nerionx theme preview --dir ./kit --theme THEME_ID --revision 2 --file review.json
nerionx theme publish --dir ./kit --file review.json --request-id publish-001 --json
nerionx theme history --dir ./kit --theme THEME_ID --json

Import creates a draft. Publication requires the saved preview review and rejects edits made after that review or a change to the active theme. Previews pin both text and binary assets to the chosen revision. --json emits one JSON result; validation failures include field paths and return a nonzero exit code. The Spoke derives brand authority from its Hub connection and checks the kit's owner HMAC; a worker's scoped AI grant cannot publish a theme.

To recover a lost response, use theme receipt --request-id edit-001, or retry the exact original command with the same ID. A different command using that ID is rejected. To restore an older full revision:

nerionx theme rollback --dir ./kit --theme THEME_ID --revision 1 --expected-revision 2 --request-id restore-001 --json
# Preview the new draft revision returned above, then publish that review explicitly.

Rollback restores removed files and exact binary assets as a new draft. Older revisions recorded before full asset snapshots are explicitly unavailable for full rollback; their missing historical image/font bytes cannot be recovered from a text-only snapshot. The currently served legacy assets are captured before the first draft edit. theme refresh separately reinstalls the built-in theme and is not a rollback command.

A bundle supports up to 2,000 files and 32 MiB decoded content, transferred in a bounded 48 MiB request. Binary files use canonical base64 under assets/. Theme commands require matching Spoke and storefront versions that implement this lifecycle; installing only a new CLI does not upgrade an existing kit's images.

Before launch, run nerionx theme check-links --url http://localhost:8000/fr --json for each intended locale. This reads public header/footer/navigation destinations without credentials and reports missing pages, omitted links, locale fallbacks, HTTP errors and incomplete checks. It does not certify authenticated or external journeys. See the navigation check details.

Review and start a bounded AI run

Inspect nerionx ai runtime capabilities --dir KIT --json first. Once an operator has assigned resources and configured the execution policy, import a versioned content contract with ai contracts import --file contract.json, then prepare a review using ai runs plan --file limits.json --out review.json. Preparation checks model availability and balance without generating content. Inspect the saved review before ai runs start --file review.json --approve-spend-usd AMOUNT. The amount must match the exact USD ceiling; the server verifies it against the stored plan. Retry the same file after an interrupted start to recover its run.

Run limits include failed attempts and corrections. Starting a run never publishes content. See the admission contract and operator prerequisites for the input formats and release/acceptance boundaries.

To retry one failed generation item, inspect its current controlVersion and latest generation task ID, then run nerionx ai runs retry --run RUN_ID --item ITEM_ID --task TASK_ID --request-id RETRY_ID --expected-version N --dir KIT --json. The worker must have physically finished without producing a result. The retry uses the same input and retains earlier drafts, requests, spending, time and artifact limits. It allows at most two owner retries per item. A paused run stays paused until resumed. Reuse the exact request after a lost response to recover its receipt; inspect again before any different command. This does not regenerate accepted content or publish it. Both CLI and Spoke must support selected retry.

Operators with local Docker access can inspect assigned resources with ai operator allocation show --dir KIT --json, then apply a reviewed allocation file with ai operator allocation apply --file allocation.json --expected-version N --approve-brand BRAND_ID --dir KIT --json. The exact retry recovers its still-current allocation; changed or superseded versions fail without resetting the usage ledger. Allocation setup does not start generation. See the allocation format and remaining host prerequisites.

For actual Linux execution hosts, ai operator hosts identity, hosts enroll, hosts list and hosts run provide persistent enrollment and private credential recovery. The host runner checks every configured BrandKit's identity, origin, allocation and partition, then polls with credentials held in memory. It emits NDJSON status changes and retains its ledger across restart. Follow the host enrollment and restart flow.

Review, publish and recover content

After the runtime reports draft_accepted, use nerionx content publish plan --file publication.json --out publication-review.json --dir KIT --json. The private review binds that exact candidate and its generation assessment to the current destination and proposed incoming/outgoing link revisions. Inspect it again with nerionx content publish plan-show --plan REQUEST_ID --dir KIT --json. Retry the original request ID to recover the same review after an interrupted response. A changed request requires a new ID.

Render the exact proposed fields and link patches with the installed theme using nerionx content publish preview --file publication-review.json --out preview.html --dir KIT --json. The HTML and .html.json receipt are private files. Add --incoming-link INDEX to preview an incoming source page. The command rechecks stored dependencies and saves content/HTML/theme hashes without publishing. It reports server HTML only; open the file locally for visual inspection. Keep the CLI, Spoke and storefront on matching releases for these commands.

Collect durable HTTP and private preview evidence with nerionx content publish observe --file publication-review.json --out observations.json --dir KIT --json. Use content publish observations --plan REQUEST_ID to recover the same bundle after restart, and content publish observation-page --plan REQUEST_ID --document PAGE_ID --out page.html to export a verified page privately. Saved evidence is time-limited and does not verify browser visibility or authorize publication.

Capture the saved pages in isolated Chromium at desktop and mobile widths with nerionx content publish observe-browser --file publication-review.json --out browser.json --dir KIT --json. This collects HTTP evidence first and starts the kit's browser service when that service is present in its Compose template. Current releases supply Chromium in the Spoke image and templates/browser-seccomp.json in the CLI; existing kits need the matching Compose template and sandbox profile to enable this service. It receives no owner/provider/database credentials. Retrieve the same saved bundle using content publish browser-observations --plan REQUEST_ID, or export a private screenshot using content publish browser-artifact --plan REQUEST_ID --document PAGE_ID --width 390 --kind screenshot --out page.png. Use --width 1440 for desktop or --kind dom --out page.html for the exact captured DOM. Files use mode 0600; stdout contains metadata, never artifact bytes. Evidence expires for new critic jobs but remains available as immutable history. The browser uses saved HTML and installed storefront assets; this does not prove public deployment, visual design acceptance, indexing, or publication authority. See browser scope and deployment.

Planning records unexecuted checks without calling a model. With an explicitly configured publication critic and an enrolled host, run nerionx content publish check --file publication-review.json --request CHECK_ID --dir KIT --json. This queues a separate critic conversation within the original run's spending, request and time limits. Reuse CHECK_ID for an exact retry. Inspect tasks using nerionx content publish reviews --run RUN_ID --dir KIT --json, then retrieve private findings with nerionx content publish review --run RUN_ID --review REVIEW_ID --out findings.json --dir KIT --json.

The critic cannot grant publication authority or invent live/rendered evidence. Once the release gates qualify the exact plan, prepare the owner proposal with nerionx content publish prepare-release --file publication-review.json --review REVIEW_ID --out proposal.json --dir KIT --json. Review that proposal, then record an explicit decision using nerionx content publish decide --file proposal.json --decision approve --request APPROVAL_ID --reason "Reviewed exact proposal" --out approved.json --dir KIT --json. Use --decision reject to reject it. This approval binds the proposal's content, links, evidence and revisions; changing them requires a new review.

Apply the approved release with nerionx content publish apply --file approved.json --request APPLY_ID --reason "Apply approved release" --out applied.json --dir KIT --json. The server rechecks the current gates and destination revisions before writing. A plan with a future scheduleAt waits until that time; the scheduled job may execute only the recorded exact owner approval and still rechecks the gates. Approval and a successful write do not prove that the public page is correct. Run content publish verify --file applied.json --request VERIFY_ID --reason "Verify public result" --out verified.json --dir KIT --json and inspect the saved desktop/mobile verification artifacts.

Retrieve current state with content publish status --release RELEASE_ID --out status.json --dir KIT --json or the durable audit with content publish history --release RELEASE_ID --out history.json --dir KIT --json. Use cancel, unpublish or rollback with the latest receipt, a new action's --request, --reason and a separate --out file. Keep the original input and reuse its request ID when retrying an interrupted action. Recovery remains conditional on the release state and current revisions; it cannot overwrite intervening edits.

These controls shipped in CLI 0.5.36 with matching Spoke/storefront releases. CLI 0.5.37 also includes selected failed-generation retry. Source version 0.5.38 adds content publish preview --component-page INDEX, alongside the owner draft edit/regenerate/reject and host-drain controls. Product archive transitions, component placements and truthful date previews require its matching Spoke and storefront release. The index selects the plan's componentPlacements array; --incoming-link continues to select its links array. They are mutually exclusive. Resolve missing facts, placement versions and failed reviews before approval. Source version 0.5.39 also makes owner, catalog and verbose health commands use the selected kit's SPOKE_PORT when no explicit SPOKE_BASE_URL or SPOKE_URL is configured. Explicit origins retain precedence, so two local kits can use different ports without sending authenticated commands to the first kit. A source version bump is not evidence of signed publication or installed QA. See the publication policy, evidence and lifecycle requirements.