@skrr-ai/cli 0.1.47 → 0.1.48

package/dist/commands/enterprise/domains/verify.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const enterprise_commerce_1 = require("../../../lib/enterprise-commerce");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/** Go and look for the challenge. The server checks; the caller supplies no proof. */
+class EnterpriseDomainsVerify extends base_command_1.BaseCommand {
+    static description = 'Verify a published domain challenge for an enterprise workspace (admin). The platform goes and looks — evidence is never accepted from the caller.';
+    static examples = [
+        '<%= config.bin %> enterprise domains verify <workspace-id> --file ./domain.json',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseDomainsVerify);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, enterprise_commerce_1.verifyEnterpriseDomain)(args.workspace, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = EnterpriseDomainsVerify;

package/dist/commands/enterprise/external-config/activate.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr enterprise external-config activate` — ask for the destination to be
+ * verified, and say plainly that asking is all this did.
+ *
+ * The route answers 202 with a verification job: the evidence that the
+ * destination really accepts writes is produced by the writer and verifier
+ * workloads, never handed in by the caller. A command that printed "activated"
+ * here would be reporting a request as a result — the same collapse a green
+ * pipeline and a deployed commit have already cost this repo three times.
+ */
+export default class EnterpriseExternalConfigActivate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/external-config/activate.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const enterprise_external_configuration_1 = require("../../../lib/enterprise-external-configuration");
+/**
+ * `skrr enterprise external-config activate` — ask for the destination to be
+ * verified, and say plainly that asking is all this did.
+ *
+ * The route answers 202 with a verification job: the evidence that the
+ * destination really accepts writes is produced by the writer and verifier
+ * workloads, never handed in by the caller. A command that printed "activated"
+ * here would be reporting a request as a result — the same collapse a green
+ * pipeline and a deployed commit have already cost this repo three times.
+ */
+class EnterpriseExternalConfigActivate extends base_command_1.BaseCommand {
+    static description = "Request activation of a workspace's enterprise external configuration. This enqueues verification; the destination is not live until verification passes.";
+    static examples = [
+        '<%= config.bin %> enterprise external-config activate <workspace-id>',
+        '<%= config.bin %> enterprise external-config activate <workspace-id> --json',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseExternalConfigActivate);
+        let response;
+        try {
+            response = await (0, enterprise_external_configuration_1.activateEnterpriseExternalConfiguration)(args.workspace);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        const job = response.verificationJob || {};
+        this.log(`Verification requested${job.id ? ` (job ${job.id})` : ''}${job.status ? `, ${job.status}` : ''}.`);
+        this.log('Not live yet: the writer and verifier workloads produce the evidence, and this command ' +
+            'cannot supply it. Re-read with `enterprise external-config show`.');
+    }
+}
+exports.default = EnterpriseExternalConfigActivate;

package/dist/commands/enterprise/external-config/set.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * `skrr enterprise external-config set` — create or replace one exact revision.
+ *
+ * `--expect-revision` is the whole safety story and is deliberately not
+ * optional-by-convenience: WITH it the write is a compare-and-set against the
+ * revision you read, WITHOUT it the write means "there is nothing here yet".
+ * Those are two intents, so the command refuses to guess which one you meant
+ * when the answer is knowable — `show` prints the revision for exactly this.
+ */
+export default class EnterpriseExternalConfigSet extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        create: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'configuration-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/external-config/set.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("node:fs"));
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const enterprise_external_configuration_1 = require("../../../lib/enterprise-external-configuration");
+/**
+ * `skrr enterprise external-config set` — create or replace one exact revision.
+ *
+ * `--expect-revision` is the whole safety story and is deliberately not
+ * optional-by-convenience: WITH it the write is a compare-and-set against the
+ * revision you read, WITHOUT it the write means "there is nothing here yet".
+ * Those are two intents, so the command refuses to guess which one you meant
+ * when the answer is knowable — `show` prints the revision for exactly this.
+ */
+class EnterpriseExternalConfigSet extends base_command_1.BaseCommand {
+    static description = "Create or replace a workspace's enterprise external configuration. Replacing is fenced on the revision you read, so two operators cannot silently overwrite each other.";
+    static examples = [
+        '<%= config.bin %> enterprise external-config set <workspace-id> --file ./export.json --create',
+        '<%= config.bin %> enterprise external-config set <workspace-id> --file ./export.json --expect-revision 3',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        file: core_1.Flags.string({
+            description: 'Path to the configuration JSON, or - to read stdin',
+            required: true,
+        }),
+        'expect-revision': core_1.Flags.integer({
+            description: 'Replace exactly this revision (from `show`). Refused together with --create.',
+        }),
+        create: core_1.Flags.boolean({
+            description: 'This workspace has no configuration yet. Refused together with --expect-revision.',
+        }),
+        'configuration-id': core_1.Flags.string({
+            description: 'Configuration id, when the service needs one',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseExternalConfigSet);
+        const expectedRevision = flags['expect-revision'];
+        if (flags.create && expectedRevision !== undefined) {
+            this.error('--create and --expect-revision are two different intents: one says nothing is there, the other says replace exactly this. Pass one.', { exit: 2 });
+        }
+        if (!flags.create && expectedRevision === undefined) {
+            this.error("Pass --expect-revision <n> (see `enterprise external-config show`) to replace the configuration, or --create when there is none yet. An unfenced replace can overwrite another operator's write.", { exit: 2 });
+        }
+        let raw;
+        try {
+            raw = flags.file === '-' ? fs.readFileSync(0, 'utf8') : fs.readFileSync(flags.file, 'utf8');
+        }
+        catch {
+            this.error(`Could not read ${flags.file === '-' ? 'stdin' : flags.file}`, { exit: 1 });
+            return;
+        }
+        let configuration;
+        try {
+            configuration = JSON.parse(raw);
+        }
+        catch (error) {
+            this.error(`${flags.file} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`, { exit: 1 });
+            return;
+        }
+        let response;
+        try {
+            response = await (0, enterprise_external_configuration_1.upsertEnterpriseExternalConfiguration)(args.workspace, {
+                configuration,
+                configurationId: flags['configuration-id'],
+                expectedRevision,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        for (const line of (0, enterprise_external_configuration_1.describeEnterpriseExternalConfiguration)(response.configuration)) {
+            this.log(line);
+        }
+        // Saying it here because the next command is the one that costs something.
+        this.log('\nStored. It is not exporting yet — run `enterprise external-config activate`.');
+    }
+}
+exports.default = EnterpriseExternalConfigSet;

package/dist/commands/enterprise/external-config/show.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base-command';
+export default class EnterpriseExternalConfigShow extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/external-config/show.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const enterprise_external_configuration_1 = require("../../../lib/enterprise-external-configuration");
+class EnterpriseExternalConfigShow extends base_command_1.BaseCommand {
+    static description = "Show a workspace's enterprise external configuration — where its audit and log export goes, and whether that destination is live.";
+    static examples = [
+        '<%= config.bin %> enterprise external-config show <workspace-id>',
+        '<%= config.bin %> enterprise external-config show <workspace-id> --json',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseExternalConfigShow);
+        let response;
+        try {
+            response = await (0, enterprise_external_configuration_1.getEnterpriseExternalConfiguration)(args.workspace);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        for (const line of (0, enterprise_external_configuration_1.describeEnterpriseExternalConfiguration)(response.configuration)) {
+            this.log(line);
+        }
+        this.log('\nUse --json for the configuration body itself.');
+    }
+}
+exports.default = EnterpriseExternalConfigShow;

package/dist/commands/enterprise/external-config/suspend.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base-command';
+export default class EnterpriseExternalConfigSuspend extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        'expect-revision': import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/external-config/suspend.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const enterprise_external_configuration_1 = require("../../../lib/enterprise-external-configuration");
+class EnterpriseExternalConfigSuspend extends base_command_1.BaseCommand {
+    static description = "Stop a workspace's enterprise external export. Fenced on the revision you read, so it cannot suspend a configuration somebody else has since replaced.";
+    static examples = [
+        '<%= config.bin %> enterprise external-config suspend <workspace-id> --expect-revision 4',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = {
+        'expect-revision': core_1.Flags.integer({
+            description: 'The revision to suspend, from `enterprise external-config show`',
+            required: true,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseExternalConfigSuspend);
+        let response;
+        try {
+            response = await (0, enterprise_external_configuration_1.suspendEnterpriseExternalConfiguration)(args.workspace, flags['expect-revision']);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(response, null, 2));
+            return;
+        }
+        for (const line of (0, enterprise_external_configuration_1.describeEnterpriseExternalConfiguration)(response.configuration)) {
+            this.log(line);
+        }
+    }
+}
+exports.default = EnterpriseExternalConfigSuspend;

package/dist/commands/enterprise/finance/close-snapshot.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base-command';
+/** Freeze a period's figures. A snapshot is a claim about a closed period. */
+export default class EnterpriseFinanceCloseSnapshot extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/finance/close-snapshot.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const enterprise_commerce_1 = require("../../../lib/enterprise-commerce");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/** Freeze a period's figures. A snapshot is a claim about a closed period. */
+class EnterpriseFinanceCloseSnapshot extends base_command_1.BaseCommand {
+    static description = "Create a finance-close snapshot, freezing a period's figures (admin).";
+    static examples = [
+        '<%= config.bin %> enterprise finance close-snapshot --file ./period.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(EnterpriseFinanceCloseSnapshot);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, enterprise_commerce_1.createEnterpriseFinanceCloseSnapshot)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = EnterpriseFinanceCloseSnapshot;

package/dist/commands/enterprise/finance/record-document.d.ts

@@ -0,0 +1,18 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Record a financial document the platform did NOT generate.
+ *
+ * The route says `manual` and the command keeps the word. A document the
+ * platform produced and one somebody typed in are different evidence, and a
+ * verb that read simply "record" would let the second be mistaken for the
+ * first later, when it matters.
+ */
+export default class EnterpriseFinanceRecordDocument extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/finance/record-document.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_command_1 = require("../../../base-command");
+const enterprise_commerce_1 = require("../../../lib/enterprise-commerce");
+const commerce_command_1 = require("../../../lib/commerce-command");
+/**
+ * Record a financial document the platform did NOT generate.
+ *
+ * The route says `manual` and the command keeps the word. A document the
+ * platform produced and one somebody typed in are different evidence, and a
+ * verb that read simply "record" would let the second be mistaken for the
+ * first later, when it matters.
+ */
+class EnterpriseFinanceRecordDocument extends base_command_1.BaseCommand {
+    static description = 'Record a financial document the platform did not generate (admin). Manual entry — it is evidence somebody supplied, not evidence the platform produced.';
+    static examples = [
+        '<%= config.bin %> enterprise finance record-document --file ./invoice.json',
+    ];
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(EnterpriseFinanceRecordDocument);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, enterprise_commerce_1.recordEnterpriseFinancialDocument)(body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = EnterpriseFinanceRecordDocument;

package/dist/commands/enterprise/profile.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr enterprise profile <workspace-id>` — the workspace's enterprise profile.
+ *
+ * A PUT, so this replaces the profile rather than patching it. The command
+ * says so in its description instead of pretending to merge, because a
+ * partial body sent to a replacing endpoint silently drops whatever it omits.
+ */
+export default class EnterpriseProfile extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        workspace: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/enterprise/profile.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const enterprise_commerce_1 = require("../../lib/enterprise-commerce");
+const commerce_command_1 = require("../../lib/commerce-command");
+/**
+ * `skrr enterprise profile <workspace-id>` — the workspace's enterprise profile.
+ *
+ * A PUT, so this replaces the profile rather than patching it. The command
+ * says so in its description instead of pretending to merge, because a
+ * partial body sent to a replacing endpoint silently drops whatever it omits.
+ */
+class EnterpriseProfile extends base_command_1.BaseCommand {
+    static description = "Replace a workspace's enterprise profile (admin). This is a full replace, not a merge — anything your body omits is dropped.";
+    static examples = [
+        '<%= config.bin %> enterprise profile <workspace-id> --file ./profile.json',
+    ];
+    static args = {
+        workspace: core_1.Args.string({ description: 'Workspace id', required: true, ignoreStdin: true }),
+    };
+    static flags = { ...commerce_command_1.jsonBodyFlags };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(EnterpriseProfile);
+        const body = await (0, commerce_command_1.jsonBodyFrom)(this, flags.file);
+        let result;
+        try {
+            result = await (0, enterprise_commerce_1.upsertEnterpriseProfile)(args.workspace, body);
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = EnterpriseProfile;

package/dist/commands/login.d.ts

@@ -66,4 +66,17 @@ export default class Login extends BaseCommand {
      * only when the client can locally confirm the alphabet is wrong.
      */
     private runRecoveryCodeLogin;
+    /**
+     * C3 step 2 — the server accepted the recovery code and staged a
+     * Redis-backed OTP challenge, emailing the code to the account address.
+     * Prompt for it and complete the redemption; /redeem/confirm is the only
+     * endpoint that mints the token pair.
+     */
+    private confirmRecoveryChallenge;
+    /**
+     * A credential-minting flow may persist only a response that carries a
+     * credential. Asserts the token-bearing contract before writeToBackend so
+     * a successful-but-tokenless answer can never clobber the stored bundle.
+     */
+    private assertRedeemResult;
 }

package/dist/commands/login.js

@@ -12,6 +12,7 @@ const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
 const api_fetch_1 = require("../lib/api-fetch");
 const auth_storage_1 = require("../lib/auth-storage");
+const prompt_1 = require("../lib/prompt");
 /**
  * `skrr login`
  *
@@ -337,6 +338,18 @@ class Login extends base_command_1.BaseCommand {
             }
             this.handleApiError(err);
         }
+        // C3 step 2 — a challenge-shaped answer means the server staged an OTP
+        // and emailed it to the account address; complete the redemption with
+        // POST /redeem/confirm, the only endpoint that mints tokens.
+        if (typeof result.challengeId === 'string' && result.challengeId.length > 0) {
+            result = await this.confirmRecoveryChallenge(result.challengeId);
+        }
+        // Persist only a response that actually carries a credential. A
+        // tokenless body (an unexpected shape, or a challenge we could not
+        // complete) must never reach writeToBackend — writing undefined token
+        // fields destroys the stored credential (Keychain delete-all on macOS,
+        // an origin-only cli-auth.json elsewhere) and redeems nothing.
+        this.assertRedeemResult(result);
         // Persist via the CLI's canonical token-save path (Keychain on macOS, file elsewhere).
         (0, auth_storage_1.writeToBackend)({
             token: result.token,
@@ -351,5 +364,69 @@ class Login extends base_command_1.BaseCommand {
             `${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}.`);
         this.log(`Run \`${this.config.bin} whoami\` to confirm your identity.`);
     }
+    /**
+     * C3 step 2 — the server accepted the recovery code and staged a
+     * Redis-backed OTP challenge, emailing the code to the account address.
+     * Prompt for it and complete the redemption; /redeem/confirm is the only
+     * endpoint that mints the token pair.
+     */
+    async confirmRecoveryChallenge(challengeId) {
+        if (!process.stdin.isTTY) {
+            this.error('This server requires a confirmation code that was emailed to the account ' +
+                'address, and there is no terminal to enter it. Run this command ' +
+                'interactively. No credentials were changed.', { exit: 1 });
+        }
+        const otp = await (0, prompt_1.prompt)('Enter the recovery confirmation code from your email: ', {
+            hidden: true,
+        });
+        if (!otp) {
+            this.error('No confirmation code entered; recovery aborted. No credentials were changed.', {
+                exit: 1,
+            });
+        }
+        try {
+            return await (0, api_fetch_1.apiFetch)('/api/auth/recovery/redeem/confirm', {
+                method: 'POST',
+                // Recovery redeem is public — no credential needed.
+                body: { challengeId, otp },
+            });
+        }
+        catch (err) {
+            if (err instanceof api_fetch_1.ApiFetchError) {
+                if (err.status === 401) {
+                    this.error('Confirmation code is incorrect. The challenge was consumed — ' +
+                        'run the command again with the recovery code to receive a new one.', { exit: 1 });
+                }
+                if (err.status === 410) {
+                    this.error('Recovery challenge expired. Run the command again to restart.', { exit: 1 });
+                }
+                if (err.status === 429) {
+                    this.error('Too many recovery attempts. Please wait 15 minutes before trying again.', {
+                        exit: 1,
+                    });
+                }
+            }
+            this.handleApiError(err);
+        }
+    }
+    /**
+     * A credential-minting flow may persist only a response that carries a
+     * credential. Asserts the token-bearing contract before writeToBackend so
+     * a successful-but-tokenless answer can never clobber the stored bundle.
+     */
+    assertRedeemResult(result) {
+        const candidate = result;
+        if (!candidate ||
+            typeof candidate.token !== 'string' ||
+            candidate.token.length === 0 ||
+            typeof candidate.refreshToken !== 'string' ||
+            candidate.refreshToken.length === 0 ||
+            !candidate.user ||
+            typeof candidate.user.email !== 'string' ||
+            candidate.user.email.length === 0) {
+            this.error('Recovery did not return a session — the server answered with an unexpected ' +
+                'response shape. No credentials were changed. Update the skrr CLI if this persists.', { exit: 1 });
+        }
+    }
 }
 exports.default = Login;

package/dist/commands/machines/dedicated/index.js

@@ -28,6 +28,8 @@ class DedicatedMachines extends core_1.Command {
         '<%= config.bin %> machines dedicated spending-limit <lease-id> --cents 30000',
         '<%= config.bin %> machines dedicated health-check <lease-id>',
         '<%= config.bin %> machines dedicated incident-close <lease-id>',
+        '<%= config.bin %> machines dedicated service create <lease-id> --name worker -- node dist/worker.js',
+        '<%= config.bin %> machines dedicated service ls <lease-id>',
         '<%= config.bin %> machines dedicated destroy <lease-id>',
     ];
     async run() {
@@ -51,6 +53,7 @@ class DedicatedMachines extends core_1.Command {
             ['spending-limit', 'change the monthly spending cap'],
             ['health-check', 'probe daemon and disk liveness'],
             ['incident-close', 'close AZ-recovery evidence hold'],
+            ['service', 'declare workloads the machine keeps running'],
             ['destroy', 'stop compute; keep or purge the workspace disk'],
         ];
         this.log('skrr Dedicated Runtime commands:');