@skrr-ai/cli 0.1.36 → 0.1.38

package/dist/lib/bulk-task-targets.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.listSpaceTaskTargets = listSpaceTaskTargets;
+exports.bulkFailureMessage = bulkFailureMessage;
 exports.applyToTaskTargets = applyToTaskTargets;
 exports.formatBulkOutcome = formatBulkOutcome;
 exports.parseStatusFilter = parseStatusFilter;
@@ -34,6 +35,38 @@ async function listSpaceTaskTargets(options) {
  * semantics match `skrr tasks bulk-update`). `apply` returns whether the task
  * actually changed (already-satisfied tasks are reported as no-ops).
  */
+/**
+ * The server's reason for a failed per-task write, not the transport's.
+ *
+ * A bulk run used to record `err.message`, which for a dataService call is the
+ * transport line — `HTTP 400 Bad Request — PATCH https://…/api/tasks/<id>` — so
+ * `tasks actions attach --all-in-space` printed that once per task and named
+ * neither the ref nor the rule that refused it (OSK-9652). The same call made
+ * for a single task goes through `handleApiError`, which reads the body. This
+ * reads it the same way: `message`, then `error`, plus the first validation
+ * detail when the server sent one.
+ */
+function bulkFailureMessage(err) {
+    const e = err;
+    if (e && typeof e.body === 'string' && e.body.trim()) {
+        try {
+            const body = JSON.parse(e.body);
+            const reason = [body.message, body.error].find((value) => typeof value === 'string' && value.trim().length > 0);
+            if (reason) {
+                const detail = Array.isArray(body.details) ? body.details[0] : undefined;
+                const detailText = detail && typeof detail.message === 'string'
+                    ? ` — ${Array.isArray(detail.path) && detail.path.length ? `${detail.path.join('.')}: ` : ''}${detail.message}`
+                    : '';
+                const status = typeof e.status === 'number' ? ` (HTTP ${e.status})` : '';
+                return `${reason}${detailText}${status}`;
+            }
+        }
+        catch {
+            /* not JSON: fall back to the transport message below */
+        }
+    }
+    return err instanceof Error ? err.message : String(err);
+}
 async function applyToTaskTargets(targets, apply) {
     const result = { succeeded: [], failed: [] };
     for (const target of targets) {
@@ -46,7 +79,7 @@ async function applyToTaskTargets(targets, apply) {
             result.failed.push({
                 id: target.id,
                 label,
-                error: err instanceof Error ? err.message : String(err),
+                error: bulkFailureMessage(err),
             });
         }
     }

package/dist/lib/cli-installers.d.ts

@@ -0,0 +1,130 @@
+/** Matches `ManagedCliAuthenticationState` in `daemon/src/cli-installers.ts`. */
+export interface ManagedCliAuthentication {
+    status: 'ready' | 'interactive-required' | 'headless-key-required';
+    source: 'environment' | 'browser' | 'none';
+    message: string;
+}
+/**
+ * Matches `ManagedCliProviderState` in `daemon/src/cli-installers.ts`.
+ *
+ * Every field optional on purpose: this crosses a version boundary. The daemon
+ * on the other end may be older than this CLI (they ship separately, and this
+ * machine routinely runs a daemon bundled inside the desktop app), so a missing
+ * field has to read as "this daemon does not say", never as a falsy answer.
+ */
+export interface ManagedCliProviderState {
+    provider?: string;
+    displayName?: string;
+    binaryName?: string;
+    installed?: boolean;
+    available?: boolean;
+    version?: string;
+    minVersion?: string;
+    meetsMinimum?: boolean;
+    resolvedPath?: string | null;
+    source?: string;
+    installable?: boolean;
+    installDisabledReason?: string | null;
+    platformSupported?: boolean;
+    authentication?: ManagedCliAuthentication | null;
+    job?: {
+        id?: string;
+        status?: string;
+    } | null;
+}
+export interface CliInstallersResponse {
+    daemonId?: string;
+    enabled?: boolean;
+    platform?: string;
+    /** Absent from a daemon older than the field — render as "not reported". */
+    daemonVersion?: string;
+    providers?: ManagedCliProviderState[];
+}
+/**
+ * Providers the platform knows about that this daemon did not offer.
+ *
+ * The inventory is whatever the CONNECTED daemon supports, and an older daemon
+ * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * running 0.8.35 answers with six providers instead of seven. Observed here —
+ * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
+ * disappeared from the install list between two page loads, with nothing on
+ * either screen to explain it. A provider that silently stops existing reads as
+ * dropped support.
+ *
+ * This works WITHOUT a daemon update, which is the point: `daemonVersion` only
+ * helps once apps ship a daemon that reports it, whereas the shared vocabulary
+ * is already on this side of the wire. Naming the gap is what turns "Devin is
+ * gone" into "this daemon is older than Devin".
+ */
+export declare function providersNotOffered(offered: readonly ManagedCliProviderState[] | undefined, known: readonly string[]): string[];
+export declare function listCliInstallers(daemonId: string, credential?: unknown): Promise<CliInstallersResponse>;
+/**
+ * The one-word readiness verdict for a provider, and whether it is good news.
+ *
+ * Four states, and the fourth is the one that matters most to get right:
+ * `unknown`. A provider whose recipe declares no credential resolver reports
+ * `authentication: null`, and that is NOT `ready` — this daemon simply has no
+ * way to read that vendor's credential state. Collapsing the two is the exact
+ * failure `d878b79581` was written to stop, so the word is different and the
+ * detail says why.
+ */
+export declare function readinessOf(provider: ManagedCliProviderState): {
+    label: string;
+    detail: string;
+    ok: boolean;
+};
+/** A job the daemon runs to install one managed provider. */
+export interface ManagedCliInstallJob {
+    id: string;
+    status: 'queued' | 'running' | 'succeeded' | 'failed';
+    error?: string;
+    log?: string[];
+}
+export interface StartInstallResponse {
+    started?: boolean;
+    provider?: ManagedCliProviderState;
+    job?: {
+        id?: string;
+        status?: string;
+    };
+}
+export declare function startManagedCliInstall(daemonId: string, provider: string, credential?: unknown): Promise<StartInstallResponse>;
+export declare function readManagedCliInstallJob(daemonId: string, jobId: string, credential?: unknown): Promise<{
+    job?: ManagedCliInstallJob;
+}>;
+/** A 100 MB download over a hotel connection is the case this has to survive. */
+export declare const INSTALL_MAX_WAIT_MS: number;
+export declare const INSTALL_POLL_INTERVAL_MS = 2000;
+export type FollowJobOutcome = {
+    kind: 'settled';
+    job: ManagedCliInstallJob;
+}
+/** The daemon is still working. NOT a failure — see below. */
+ | {
+    kind: 'timeout';
+    jobId: string;
+} | {
+    kind: 'missing';
+    jobId: string;
+};
+/**
+ * Poll an install job to completion, printing each new log line once.
+ *
+ * The daemon writes the only account of a download the user is waiting on
+ * ("Fetching the signed release manifest", "Verified and installed …"), so the
+ * loop relays it; printing only the unseen tail keeps a poll from repeating the
+ * whole log each time.
+ *
+ * A timeout is returned, never thrown as a failure. Saying "install failed"
+ * because this process ran out of patience is a lie that sends someone to debug
+ * a download that is going fine — so the caller decides the wording, and both
+ * callers say the daemon is still working.
+ */
+export declare function followManagedCliInstallJob(input: {
+    daemonId: string;
+    jobId: string;
+    credential?: unknown;
+    onLogLine?: (line: string) => void;
+    maxWaitMs?: number;
+    pollIntervalMs?: number;
+}): Promise<FollowJobOutcome>;

package/dist/lib/cli-installers.js

@@ -0,0 +1,145 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INSTALL_POLL_INTERVAL_MS = exports.INSTALL_MAX_WAIT_MS = void 0;
+exports.providersNotOffered = providersNotOffered;
+exports.listCliInstallers = listCliInstallers;
+exports.readinessOf = readinessOf;
+exports.startManagedCliInstall = startManagedCliInstall;
+exports.readManagedCliInstallJob = readManagedCliInstallJob;
+exports.followManagedCliInstallJob = followManagedCliInstallJob;
+/**
+ * The daemon's managed-CLI installer inventory, as the CLI reads it.
+ *
+ * ## Why this file exists
+ *
+ * `GET /api/daemons/:id/cli-installers` is where `d878b79581` put the answer to
+ * "is this harness actually usable" — `installed`, and for providers whose
+ * credential state the daemon can read, one of `ready` /
+ * `interactive-required` / `headless-key-required`. The whole point of that
+ * change was to stop surfaces answering "is the binary there" instead.
+ *
+ * The CLI called the route from exactly one place (`commands/code/install.ts`),
+ * for one provider, to read one field, and showed the user none of it. So from
+ * the CLI there was no way to learn that a harness listed as `online` had no
+ * binary at all — which is the state this account's `skrr-code` row was in.
+ *
+ * The shape lives here rather than beside a command because two commands read
+ * it now. Root `CLAUDE.md`: a second declaration is how a surface silently
+ * drifts from the server that produced it.
+ */
+const data_provider_1 = require("@skrr-ai/data-provider");
+const api_fetch_1 = require("./api-fetch");
+/**
+ * Providers the platform knows about that this daemon did not offer.
+ *
+ * The inventory is whatever the CONNECTED daemon supports, and an older daemon
+ * legitimately supports fewer: `devin` arrived in daemon 0.8.43, so a machine
+ * running 0.8.35 answers with six providers instead of seven. Observed here —
+ * the desktop app restarted the daemon from its bundled 0.8.35 copy and Devin
+ * disappeared from the install list between two page loads, with nothing on
+ * either screen to explain it. A provider that silently stops existing reads as
+ * dropped support.
+ *
+ * This works WITHOUT a daemon update, which is the point: `daemonVersion` only
+ * helps once apps ship a daemon that reports it, whereas the shared vocabulary
+ * is already on this side of the wire. Naming the gap is what turns "Devin is
+ * gone" into "this daemon is older than Devin".
+ */
+function providersNotOffered(offered, known) {
+    // Canonicalize BOTH sides. An older daemon answers under the spelling it was
+    // built with — the 0.8.35 build reports the first-party harness as
+    // `sky-code`, so a raw comparison against `skrr-code` reported it missing on
+    // a machine where it is installed and working. Caught by running this against
+    // the very daemon the finding was about: the first version of this helper
+    // said "Not offered: devin, skrr-code" when only `devin` was true.
+    const canonical = (value) => typeof value === 'string' ? String((0, data_provider_1.canonicalHarnessProvider)(value) ?? value) : '';
+    const seen = new Set((offered ?? []).map((provider) => canonical(provider.provider)).filter(Boolean));
+    return known.filter((provider) => !seen.has(canonical(provider)));
+}
+async function listCliInstallers(daemonId, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers`, { credential: credential });
+}
+/**
+ * The one-word readiness verdict for a provider, and whether it is good news.
+ *
+ * Four states, and the fourth is the one that matters most to get right:
+ * `unknown`. A provider whose recipe declares no credential resolver reports
+ * `authentication: null`, and that is NOT `ready` — this daemon simply has no
+ * way to read that vendor's credential state. Collapsing the two is the exact
+ * failure `d878b79581` was written to stop, so the word is different and the
+ * detail says why.
+ */
+function readinessOf(provider) {
+    if (provider.platformSupported === false) {
+        return { label: 'unsupported', detail: 'Not available on this platform.', ok: false };
+    }
+    if (!provider.installed) {
+        // `available` without `meetsMinimum` is a REAL third case and reads very
+        // differently from "not installed": the binary is right there and too old.
+        if (provider.available && provider.meetsMinimum === false) {
+            return {
+                label: 'too-old',
+                detail: provider.minVersion
+                    ? `Found ${provider.version || 'an older build'}; needs ${provider.minVersion} or newer.`
+                    : 'The installed build is older than the minimum this harness needs.',
+                ok: false,
+            };
+        }
+        return {
+            label: 'not-installed',
+            detail: provider.installDisabledReason || 'No binary for this provider on this machine.',
+            ok: false,
+        };
+    }
+    const auth = provider.authentication;
+    if (!auth) {
+        return {
+            label: 'unknown',
+            detail: 'Installed. This daemon cannot read this provider’s credential state.',
+            ok: false,
+        };
+    }
+    return { label: auth.status, detail: auth.message, ok: auth.status === 'ready' };
+}
+async function startManagedCliInstall(daemonId, provider, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/${encodeURIComponent(provider)}/install`, { method: 'POST', body: {}, credential: credential });
+}
+async function readManagedCliInstallJob(daemonId, jobId, credential) {
+    return (0, api_fetch_1.apiFetch)(`/api/daemons/${encodeURIComponent(daemonId)}/cli-installers/jobs/${encodeURIComponent(jobId)}`, { credential: credential });
+}
+/** A 100 MB download over a hotel connection is the case this has to survive. */
+exports.INSTALL_MAX_WAIT_MS = 10 * 60_000;
+exports.INSTALL_POLL_INTERVAL_MS = 2_000;
+/**
+ * Poll an install job to completion, printing each new log line once.
+ *
+ * The daemon writes the only account of a download the user is waiting on
+ * ("Fetching the signed release manifest", "Verified and installed …"), so the
+ * loop relays it; printing only the unseen tail keeps a poll from repeating the
+ * whole log each time.
+ *
+ * A timeout is returned, never thrown as a failure. Saying "install failed"
+ * because this process ran out of patience is a lie that sends someone to debug
+ * a download that is going fine — so the caller decides the wording, and both
+ * callers say the daemon is still working.
+ */
+async function followManagedCliInstallJob(input) {
+    const deadline = Date.now() + (input.maxWaitMs ?? exports.INSTALL_MAX_WAIT_MS);
+    let printed = 0;
+    for (;;) {
+        const res = await readManagedCliInstallJob(input.daemonId, input.jobId, input.credential);
+        const job = res.job;
+        if (!job)
+            return { kind: 'missing', jobId: input.jobId };
+        if (input.onLogLine) {
+            for (const line of (job.log ?? []).slice(printed))
+                input.onLogLine(line);
+            printed = (job.log ?? []).length;
+        }
+        if (job.status === 'succeeded' || job.status === 'failed')
+            return { kind: 'settled', job };
+        if (Date.now() > deadline)
+            return { kind: 'timeout', jobId: input.jobId };
+        await new Promise((resolve) => setTimeout(resolve, input.pollIntervalMs ?? exports.INSTALL_POLL_INTERVAL_MS));
+    }
+}

package/dist/lib/command-miss.js

@@ -104,17 +104,65 @@ function describeCommandMiss(config, id) {
     // command id, so a whole-string comparison finds nothing and the reader is
     // told only that they are wrong — when the useful answer is "that topic
     // exists and here is what it does have".
+    const typedId = parts.join(':');
+    const spokenId = `${config.bin} ${parts.join(' ')}`;
+    // The id IS registered and the lookup still could not produce it. That is not
+    // a typo, so the "is not a command" wording below would be false — and worse,
+    // the suggestion search then finds the id itself and hands the reader their
+    // own input back:
+    //
+    //     $ skrr agents list --help
+    //         Error: `skrr agents list` is not a command.
+    //         Did you mean: `skrr agents list`?
+    //
+    // Observed against a real build, for ten commands in a row, and it is actively
+    // misleading rather than merely unhelpful: a dogfood run read it as proof that
+    // a shipped release had not shipped its commands. The two facts come from two
+    // sources — `findCommand` loads, `commandIDs` lists — and when they disagree
+    // the honest thing to report is the disagreement, which has a known cause and
+    // a next step.
+    if (config.commandIDs.includes(typedId) || config.topicNames.includes(typedId)) {
+        return (`\`${spokenId}\` is registered but could not be loaded from this build.\n` +
+            `Its compiled output is missing or stale — run \`npm --prefix cli run build\` in a ` +
+            `development checkout, or reinstall the CLI.`);
+    }
     const siblings = config.commandIDs.filter((c) => c.startsWith(`${parts[0]}:`));
-    const suggestions = siblings.length
+    const suggestions = (siblings.length
         ? nearestCommands(parts.slice(0, 2).join(':'), siblings)
-        : nearestCommands(parts.join(':'), [...config.commandIDs, ...config.topicNames]);
-    return (`\`${config.bin} ${parts.join(' ')}\` is not a command.` +
-        (suggestions.length
-            ? `\nDid you mean: ${suggestions
+        : nearestCommands(typedId, [...config.commandIDs, ...config.topicNames]))
+        // A suggestion identical to what was typed is an echo, not a correction.
+        // It can outrank real alternatives too, since nothing is closer to the id
+        // than the id, so it costs a suggestion slot as well as the reader's trust.
+        .filter((candidate) => candidate !== typedId);
+    if (suggestions.length) {
+        return (`\`${spokenId}\` is not a command.` +
+            `\nDid you mean: ${suggestions
                 .map((s) => `\`${config.bin} ${s.split(':').join(' ')}\``)
-                .join(', ')}?`
-            : `\nRun \`${config.bin} --help\` to see the topics.`));
+                .join(', ')}?`);
+    }
+    // The topic the reader typed is real, and nothing in it is spelled like what
+    // they asked for — a different word for it, not a typo. "See the topics"
+    // sent them back to the top level to rediscover the topic they had already
+    // found; what they need is what THIS topic has (OSK-9723: `skrr dm send`,
+    // where `dm` has no `send` at all).
+    if (siblings.length) {
+        const topic = parts[0];
+        const shown = siblings
+            .map((id) => id
+            .slice(topic.length + 1)
+            .split(':')
+            .join(' '))
+            .sort()
+            .slice(0, MAX_TOPIC_LISTING);
+        const more = siblings.length > shown.length ? ', …' : '';
+        return (`\`${spokenId}\` is not a command.\n` +
+            `\`${config.bin} ${topic}\` has: ${shown.map((c) => `\`${c}\``).join(', ')}${more}.\n` +
+            `See \`${config.bin} ${topic} --help\`.`);
+    }
+    return `\`${spokenId}\` is not a command.\nRun \`${config.bin} --help\` to see the topics.`;
 }
+/** Enough to scan at a glance; the topic's own `--help` has the rest. */
+const MAX_TOPIC_LISTING = 10;
 /** Adapt an oclif `Config` to the lookup shape above. */
 function lookupFromConfig(config) {
     return {

package/dist/lib/dedicated-lease-command.d.ts

@@ -65,3 +65,16 @@ export declare abstract class DedicatedLeaseCommand extends BaseCommand {
 }
 /** The same transient verdict BaseCommand gives an ordinary API call. */
 export declare function dedicatedRuntimeApiErrorRetryable(err: unknown): boolean;
+/**
+ * Accept the id our own output printed.
+ *
+ * `skrr machines list --all` renders a Dedicated Runtime's MACHINE identity,
+ * which the server builds as `lease:${leaseId}` (`machineIdentityForHarness`).
+ * The lease routes want the bare `rtl_…`. Pasting the one you were just shown
+ * therefore 404'd, and the refusal blamed workspace scope — sending you to try
+ * `--workspace` when the fix was deleting six characters.
+ *
+ * Only the prefixes this product itself prints are stripped, so a genuinely
+ * unknown id still fails as an unknown id rather than being silently reshaped.
+ */
+export declare function stripMachineIdentityPrefix(ref: string): string;

package/dist/lib/dedicated-lease-command.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DedicatedLeaseCommand = exports.DEDICATED_LEASE_ARG_DESCRIPTION = exports.DEDICATED_SELF_LEASE = exports.dedicatedWaitFlags = void 0;
 exports.dedicatedRuntimeApiErrorRetryable = dedicatedRuntimeApiErrorRetryable;
+exports.stripMachineIdentityPrefix = stripMachineIdentityPrefix;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../base-command");
 const api_fetch_1 = require("./api-fetch");
@@ -51,7 +52,7 @@ class DedicatedLeaseCommand extends base_command_1.BaseCommand {
      */
     async resolveLeaseArg(lease) {
         if (lease !== exports.DEDICATED_SELF_LEASE)
-            return lease;
+            return stripMachineIdentityPrefix(lease);
         const descriptor = (0, daemonBroker_1.readBootstrap)(daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR);
         if (!descriptor?.daemonId) {
             this.error('`self` means the Dedicated Runtime this command runs on, and this is not one (or its daemon is not running). Pass a lease id.', { exit: 2 });
@@ -226,3 +227,23 @@ function dedicatedRuntimeApiErrorRetryable(err) {
     }
     return (0, base_command_1.isRetryableFailure)(err.status, body);
 }
+/**
+ * Accept the id our own output printed.
+ *
+ * `skrr machines list --all` renders a Dedicated Runtime's MACHINE identity,
+ * which the server builds as `lease:${leaseId}` (`machineIdentityForHarness`).
+ * The lease routes want the bare `rtl_…`. Pasting the one you were just shown
+ * therefore 404'd, and the refusal blamed workspace scope — sending you to try
+ * `--workspace` when the fix was deleting six characters.
+ *
+ * Only the prefixes this product itself prints are stripped, so a genuinely
+ * unknown id still fails as an unknown id rather than being silently reshaped.
+ */
+function stripMachineIdentityPrefix(ref) {
+    const trimmed = ref.trim();
+    for (const prefix of ['lease:', 'dedicated-runtime:']) {
+        if (trimmed.startsWith(prefix))
+            return trimmed.slice(prefix.length);
+    }
+    return trimmed;
+}

package/dist/lib/dedicated-machines.d.ts

@@ -389,10 +389,57 @@ export type DedicatedCopyPlan = {
 export declare function parseDedicatedCopyEndpoints(source: string, destination: string): DedicatedCopyPlan;
 export declare function dedicatedLeaseId(lease: DedicatedLease | HarnessLease | undefined | null): string;
 export declare function dedicatedLeaseState(lease: DedicatedLease | HarnessLease | undefined | null): string;
+/**
+ * What `destroy` should say when it keeps the workspace — or null when it does
+ * not.
+ *
+ * A destroy under retention class standard/extended archives the lease and keeps
+ * its workspace volume, which keeps billing storage until it is purged. Nothing
+ * said so at the moment it mattered: `destroy` printed the new state and exited,
+ * `list` showed `archived` in the same column as `terminated`, and the one way to
+ * find out was the bill (OSK-9593).
+ */
+export declare function dedicatedDestroyRetentionNote(priorLease: DedicatedLease | undefined | null, opts: {
+    purge: boolean;
+    retain: boolean;
+    bin: string;
+}): string | null;
+/**
+ * Month-to-date Dedicated Runtime spend for the scope a `list` shows.
+ *
+ * `billing.currentMonthSpendCents` is the SCOPE's spend for the product — the
+ * server aggregates by owner scope, not by lease — so every row carried the same
+ * figure, and a column headed MONTH/CAP on per-machine rows read as that
+ * machine's cost when it was every machine's (OSK-9576). It is said once instead.
+ */
+export declare function dedicatedScopeMonthSpendCents(leases: Array<DedicatedLease | undefined | null>): number | null;
+/**
+ * A lease's own cap, marked when the scope's spend has reached it. The mark is
+ * left off a terminal lease: its cap can no longer stop anything, and
+ * "$11.06/$10.00 OVER" on a machine terminated days ago read as that machine
+ * having overrun.
+ */
+export declare function dedicatedLeaseCapCell(lease: DedicatedLease | undefined | null): string;
+/**
+ * A lease's STATUS cell. `archived` and `terminated` are both "gone" to read, and
+ * only one of them is still charging — so a lease billing retained storage says
+ * so (OSK-9593).
+ */
+export declare function dedicatedLeaseStatusCell(lease: DedicatedLease | undefined | null): string;
 export declare function dedicatedLeaseDisplayName(lease: DedicatedLease | HarnessLease | undefined | null): string;
 /** `$12.34` — cents are what the API speaks; dollars are what a person reads. */
 export declare function formatUsdCents(cents: number | null | undefined): string;
-/** `this month $1.23 of $500.00 cap`, or why that sentence cannot be written. */
+/**
+ * `$1.23 this month for machines of this type · $500.00 cap for this machine`,
+ * or why that sentence cannot be written.
+ *
+ * The two figures are different scopes and the sentence has to say so. The spend
+ * is a shared pot the server computes for (owner, team, machineProduct), so every
+ * lease of the same product reports the same number — a machine created minutes
+ * ago with no active seconds still reports the month's total. The cap is this
+ * lease's own. Printed as "$1.23 this month of $500.00 cap" the only available
+ * reading was that this machine had spent it.
+ */
 export declare function dedicatedSpendSummary(lease: DedicatedLease): string;
 /**
  * The human rendering of `machines dedicated show`, as lines.
@@ -461,12 +508,15 @@ interface CatalogSize {
     vcpus?: number;
     memoryGiB?: number;
     accelerator?: string;
+    rateCentsPerHour?: number | null;
 }
 interface CatalogPriceLine {
     label?: string;
     display?: string;
     amountCents?: number | null;
     cadence?: string;
+    /** `charge` is billed, `hold` is reserved at start, `limit` is a cap. Absent means `charge`. */
+    kind?: 'charge' | 'hold' | 'limit';
 }
 export interface DedicatedCatalog {
     availability: string;
@@ -480,9 +530,15 @@ export interface DedicatedCatalog {
     };
     retentionClasses: string[];
     backupProfiles: string[];
+    /** Server-declared: what create applies when a flag is omitted. */
+    defaultSizePreset?: string;
+    defaultRetentionClass?: string;
+    defaultBackupProfile?: string;
     defaultMonthlySpendingLimitCents?: number | null;
     maxUserMonthlySpendingLimitCents?: number | null;
     priceLines: CatalogPriceLine[];
+    /** The price book the quoted prices come from — what a later pricing question cites. */
+    priceBookVersion?: string;
     headline?: string;
 }
 /**
@@ -493,6 +549,44 @@ export interface DedicatedCatalog {
  * gated by server flags — so this is where a caller learns which ones exist.
  */
 export declare function dedicatedCatalogFromProducts(payload: unknown): DedicatedCatalog | null;
+/**
+ * The catalog's size rows: spec, the size's own hourly price, and which one
+ * `create` uses by default. The rows used to carry spec alone, sorted by name,
+ * so the $1.40/hr tier came first with nothing saying what it cost or that
+ * $0.65/hr standard was the default; a reader had to join two blocks by name.
+ */
+export declare function dedicatedCatalogSizeLines(catalog: DedicatedCatalog): string[];
+export interface DedicatedCreateChoices {
+    name: string;
+    sizePreset: string;
+    storageGb?: number;
+    retentionClass?: string;
+    spendingLimitCents?: number;
+}
+/**
+ * What a create is about to buy, in the words and numbers the catalog uses.
+ *
+ * `create` provisioned a billable machine the moment it ran — no confirmation,
+ * no dry run, and every omitted flag silently took a paid default — while
+ * `destroy` asked first. A loop probing size validation bought two real
+ * machines, one of them $1.40/hr (OSK-9592). This is what `create` now shows
+ * before it asks, and what `--dry-run` prints instead of creating.
+ *
+ * Every default comes from the catalog, never from this file: a CLI that
+ * restates a default it does not own is how `--storage-gb` once billed twice the
+ * product's disk. A value the catalog does not declare is shown as "server
+ * default" rather than guessed.
+ */
+export declare function dedicatedCreateSummary(catalog: DedicatedCatalog | null, choices: DedicatedCreateChoices): string[];
+/**
+ * The catalog's money lines, grouped by what each amount IS.
+ *
+ * A start hold and a monthly cap used to print under "Prices" beside the hourly
+ * rates, so starting a machine read as a 33c charge and "$500 default monthly
+ * cap" read as a bill (OSK-9536). A line with no `kind` comes from a server that
+ * predates it and is shown the way every line used to be: as a charge.
+ */
+export declare function dedicatedCatalogPriceLineOutput(priceLines: CatalogPriceLine[], priceBookVersion?: string): string[];
 /**
  * The product refusal code the server sent (`DEDICATED_RUNTIME_NOT_ASSIGNABLE`,
  * …), for `this.error(message, { code })`. Without it a `--json` caller got the