Capabilities & entitlements

Every Shipmoor surface — the CLI’s paid commands, the skills installer, the harness, the IDE extension — answers “is this feature on?” the same way: by reading one machine-readable contract from the CLI. This page is that contract from the user’s side.

Reading your state

shipmoor capabilities --json     # identity + the per-feature capability map
shipmoor whoami --json           # identity only

capabilities --json (shipmoor.capabilities.v1) is a superset of whoami --json (shipmoor.identity.v1): the same identity fields, plus a capabilities object keyed by feature:

{
  "schema_version": "shipmoor.capabilities.v1",
  "authenticated": true,
  "plan": "ic",
  "entitlements": ["cli_pro", "ide_extension_pro", "agent_harness", "agent_skills", "intent_scan", "repair_guidance"],
  "capabilities": {
    "community_scan": { "enabled": true,  "entitlement": "community_scan", "tier": "community" },
    "intent_scan":    { "enabled": true,  "entitlement": "intent_scan",    "tier": "ic" },
    "team_policy":    { "enabled": false, "entitlement": "team_policy",    "tier": "team" }
  }
}

The capabilities map is the authoritative per-feature gate — capabilities.<name>.enabled is what every Shipmoor tool checks. plan and tier are informational; nothing should switch on them.

The vocabulary

The entitlement names are defined once, product-wide, and the capability map covers the fixed set:

Note the entitlements array in the payload lists paid grants only — community capabilities are enabled but not listed there. An unauthenticated payload reports plan: "community" with an empty list, never null.

Grace and expiry, per-feature

The capability map reflects license state automatically:

• Active or trialing — the IC capabilities report enabled: true (a trial is indistinguishable from active in the contract).
• Expired, within grace — still enabled: true; identity carries reason: expired_in_grace so tools can nudge a re-login without cutting you off.
• Past grace — IC capabilities flip to enabled: false and the payload reads as community. expires_at / grace_until are kept so a tool can tell you why.

For tool builders

If you’re scripting against this surface, the contract’s consumer rules are simple and strict:

• Gate on schema_version before parsing.
• Gate features on capabilities.<name>.enabled — never on plan or tier.
• Treat unknown fields, entitlement strings, and reason codes as ignorable, degrading to “hide paid affordances.”
• Never read raw license tokens; this JSON is the only sanctioned surface.

The contract is additive: new entitlements and reason codes appear without a version bump. See Output contracts & schemas.

Next

• Sign in & licensing — where the underlying license comes from.
• Plans & tiers — the tiers behind the vocabulary.
• Output contracts & schemas — scan.v1, capabilities.v1, identity.v1 together.