Add org entitlements command

README.md

@@ -724,6 +724,8 @@ Automated authentication for web services. The `run` command orchestrates the fu
 
 ### Org
 
+- `kernel org entitlements` - Show the organization's effective plan, feature access, and limits
+  - `--output json`, `-o json` - Output the raw entitlement response
 - `kernel org limits get` - Show the organization's concurrency limit and the default per-project cap applied to projects without an explicit override
   - `--output json`, `-o json` - Output raw JSON object
 - `kernel org limits set` - Set the default per-project concurrency cap applied to projects without an explicit override

cmd/org.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 
 	"github.com/kernel/cli/pkg/util"
@@ -19,8 +20,14 @@ type OrgLimitsService interface {
 	Update(ctx context.Context, body kernel.OrganizationLimitUpdateParams, opts ...option.RequestOption) (res *kernel.OrgLimits, err error)
 }
 
+// OrgEntitlementsService defines the organization entitlements operation used by the CLI.
+type OrgEntitlementsService interface {
+	Get(ctx context.Context, opts ...option.RequestOption) (res *kernel.OrgEntitlements, err error)
+}
+
 type OrgCmd struct {
-	limits OrgLimitsService
+	limits       OrgLimitsService
+	entitlements OrgEntitlementsService
 }
 
 type OrgLimitsGetInput struct {
@@ -32,6 +39,32 @@ type OrgLimitsSetInput struct {
 	Output                              string
 }
 
+type OrgEntitlementsInput struct {
+	Output string
+}
+
+func (c OrgCmd) Entitlements(ctx context.Context, in OrgEntitlementsInput) error {
+	if err := validateJSONOutput(in.Output); err != nil {
+		return err
+	}
+
+	entitlements, err := c.entitlements.Get(ctx)
+	if err != nil {
+		return util.CleanedUpSdkError{Err: err}
+	}
+
+	if in.Output == "json" {
+		if entitlements == nil {
+			fmt.Println("null")
+			return nil
+		}
+		return util.PrintPrettyJSON(entitlements)
+	}
+
+	renderOrgEntitlements(entitlements)
+	return nil
+}
+
 func (c OrgCmd) LimitsGet(ctx context.Context, in OrgLimitsGetInput) error {
 	if err := validateJSONOutput(in.Output); err != nil {
 		return err
@@ -125,6 +158,81 @@ func orgLimitFieldPresent(field respjson.Field) bool {
 	return field.Raw() != respjson.Omitted
 }
 
+func renderOrgEntitlements(entitlements *kernel.OrgEntitlements) {
+	if entitlements == nil {
+		pterm.Info.Println("No organization entitlements found")
+		return
+	}
+
+	PrintTableNoPad(orgEntitlementRows(entitlements), true)
+}
+
+func orgEntitlementRows(entitlements *kernel.OrgEntitlements) pterm.TableData {
+	status := formatNullableEntitlementString(entitlements.Plan.Status, entitlements.Plan.JSON.Status)
+	trialEndsAt := "unknown"
+	if entitlements.Plan.JSON.TrialEndsAt.Raw() == respjson.Null {
+		trialEndsAt = "none"
+	} else if entitlements.Plan.JSON.TrialEndsAt.Valid() {
+		trialEndsAt = util.FormatLocal(entitlements.Plan.TrialEndsAt)
+	}
+
+	features := entitlements.Features
+	limits := entitlements.Limits
+	return pterm.TableData{
+		{"Category", "Entitlement", "Value"},
+		{"Plan", "Contractual plan", entitlements.Plan.ID},
+		{"Plan", "Effective plan", entitlements.Plan.EffectiveID},
+		{"Plan", "Status", status},
+		{"Plan", "Trialing", fmt.Sprintf("%t", entitlements.Plan.IsTrialing)},
+		{"Plan", "Trial ends at", trialEndsAt},
+		{"Feature", "Profiles", fmt.Sprintf("%t", features.Profiles.Enabled)},
+		{"Feature", "File I/O", fmt.Sprintf("%t", features.FileIo.Enabled)},
+		{"Feature", "Browser replays", fmt.Sprintf("%t", features.BrowserReplays.Enabled)},
+		{"Feature", "Browser replay retention (days)", fmt.Sprintf("%d", features.BrowserReplays.RetentionDays)},
+		{"Feature", "Browser extensions", fmt.Sprintf("%t", features.BrowserExtensions.Enabled)},
+		{"Feature", "Max stored extensions", formatEntitlementLimitValue(features.BrowserExtensions.MaxStoredPerOrg, features.BrowserExtensions.JSON.MaxStoredPerOrg)},
+		{"Feature", "Browser pools", fmt.Sprintf("%t", features.BrowserPools.Enabled)},
+		{"Feature", "Managed auth", fmt.Sprintf("%t", features.ManagedAuth.Enabled)},
+		{"Feature", "Max managed auth connections", formatEntitlementLimitValue(features.ManagedAuth.MaxConnections, features.ManagedAuth.JSON.MaxConnections)},
+		{"Feature", "Health check minimum (seconds)", fmt.Sprintf("%d", features.ManagedAuth.HealthCheckIntervalMinSeconds)},
+		{"Feature", "Health check default (seconds)", fmt.Sprintf("%d", features.ManagedAuth.HealthCheckIntervalDefaultSeconds)},
+		{"Feature", "Health check maximum (seconds)", fmt.Sprintf("%d", features.ManagedAuth.HealthCheckIntervalMaxSeconds)},
+		{"Feature", "Credentials", fmt.Sprintf("%t", features.Credentials.Enabled)},
+		{"Feature", "Credential providers", fmt.Sprintf("%t", features.CredentialProviders.Enabled)},
+		{"Feature", "Managed proxies", fmt.Sprintf("%t", features.ManagedProxies.Enabled)},
+		{"Feature", "Custom proxies", fmt.Sprintf("%t", features.CustomProxies.Enabled)},
+		{"Feature", "Proxy bypass hosts", fmt.Sprintf("%t", features.ProxyBypassHosts.Enabled)},
+		{"Feature", "GPU", fmt.Sprintf("%t", features.GPU.Enabled)},
+		{"Limit", "Max concurrent browsers", fmt.Sprintf("%d", limits.MaxConcurrentBrowsers)},
+		{"Limit", "Max concurrent invocations", fmt.Sprintf("%d", limits.MaxConcurrentInvocations)},
+		{"Limit", "Default max concurrent invocations per app", fmt.Sprintf("%d", limits.DefaultMaxConcurrentInvocationsPerApp)},
+	}
+}
+
+func formatNullableEntitlementString(value string, field respjson.Field) string {
+	if field.Raw() == respjson.Null {
+		return "none"
+	}
+	if !field.Valid() {
+		return "unknown"
+	}
+	var decoded string
+	if err := json.Unmarshal([]byte(field.Raw()), &decoded); err != nil {
+		return "unknown"
+	}
+	return value
+}
+
+func formatEntitlementLimitValue(value int64, field respjson.Field) string {
+	if field.Raw() == respjson.Null {
+		return "unlimited"
+	}
+	if !field.Valid() {
+		return "unknown"
+	}
+	return fmt.Sprintf("%d", value)
+}
+
 // --- Cobra wiring ---
 
 var orgCmd = &cobra.Command{
@@ -160,9 +268,20 @@ var orgLimitsSetCmd = &cobra.Command{
 	RunE:  runOrgLimitsSet,
 }
 
+var orgEntitlementsCmd = &cobra.Command{
+	Use:   "entitlements",
+	Short: "Get effective organization entitlements",
+	Long:  "Show the authenticated organization's effective feature access and limits after applying its plan, trial, status, and organization-specific overrides. Unlimited values are shown as unlimited.",
+	Args:  cobra.NoArgs,
+	RunE:  runOrgEntitlements,
+}
+
 func getOrgHandler(cmd *cobra.Command) OrgCmd {
 	client := getKernelClient(cmd)
-	return OrgCmd{limits: &client.Organization.Limits}
+	return OrgCmd{
+		limits:       &client.Organization.Limits,
+		entitlements: &client.Organization.Entitlements,
+	}
 }
 
 func runOrgLimitsGet(cmd *cobra.Command, args []string) error {
@@ -184,12 +303,20 @@ func runOrgLimitsSet(cmd *cobra.Command, args []string) error {
 	})
 }
 
+func runOrgEntitlements(cmd *cobra.Command, args []string) error {
+	c := getOrgHandler(cmd)
+	output, _ := cmd.Flags().GetString("output")
+	return c.Entitlements(cmd.Context(), OrgEntitlementsInput{Output: output})
+}
+
 func init() {
 	addJSONOutputFlag(orgLimitsGetCmd)
 	orgLimitsSetCmd.Flags().Int64("default-project-max-concurrent-sessions", 0, "Default maximum concurrent browsers for projects without an explicit override (0 to remove the default)")
 	addJSONOutputFlag(orgLimitsSetCmd)
+	addJSONOutputFlag(orgEntitlementsCmd)
 
 	orgLimitsCmd.AddCommand(orgLimitsGetCmd)
 	orgLimitsCmd.AddCommand(orgLimitsSetCmd)
 	orgCmd.AddCommand(orgLimitsCmd)
+	orgCmd.AddCommand(orgEntitlementsCmd)
 }