@skrr-ai/cli 0.1.8

package/dist/commands/pair.js

@@ -0,0 +1,351 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildPairAad = buildPairAad;
+exports.decryptResponse = decryptResponse;
+exports.persistPairCredentials = persistPairCredentials;
+exports.base64urlEncode = base64urlEncode;
+const core_1 = require("@oclif/core");
+const tweetnacl_1 = __importDefault(require("tweetnacl"));
+const qrcode_terminal_1 = __importDefault(require("qrcode-terminal"));
+const auth_storage_1 = require("../lib/auth-storage");
+const base_command_1 = require("../base-command");
+const api_fetch_1 = require("../lib/api-fetch");
+const PUBLIC_KEY_BYTES = tweetnacl_1.default.box.publicKeyLength; // 32
+const SECRET_KEY_BYTES = tweetnacl_1.default.box.secretKeyLength; // 32
+const NONCE_BYTES = tweetnacl_1.default.box.nonceLength; // 24
+// H16 — feature-flag check evaluated AT MODULE LOAD so oclif sees a
+// stable `hidden` value when it builds the manifest. Toggling at
+// runtime would require a manifest rebuild anyway; capturing once
+// matches oclif's static-class-field model.
+const PAIR_FEATURE_ENABLED = process.env.OVERSKY_ENABLE_PAIR === '1';
+/**
+ * Canonical AAD bytes for the pair-response (C4). Mobile builds the
+ * same string, ASCII-encodes, prepends a 2-byte big-endian length, and
+ * appends to the ciphertext bundle. The CLI rebuilds locally and
+ * compares before decrypting — so a tampered or misdirected ciphertext
+ * fails AAD before tweetnacl ever sees it.
+ *
+ * Format: `oversky:pair:v1:daemonId=<daemonId>:responseUserId=<responseUserId>`
+ *
+ * The version tag (`v1`) lets us evolve the AAD shape later without
+ * silently accepting old payloads.
+ */
+function buildPairAad(daemonId, responseUserId) {
+    const canonical = `oversky:pair:v1:daemonId=${daemonId}:responseUserId=${responseUserId}`;
+    return new TextEncoder().encode(canonical);
+}
+class Pair extends base_command_1.BaseCommand {
+    static description = PAIR_FEATURE_ENABLED
+        ? 'Pair this daemon to an skrr account via the mobile app.'
+        : "Pair this daemon to an skrr account via the mobile app (mobile app integration pending; use 'oversky login' for now).";
+    // H16 — hide from `--help` output unless the feature flag is on at
+    // module load. oclif consults this static field when generating the
+    // top-level command list.
+    static hidden = !PAIR_FEATURE_ENABLED;
+    static examples = ['<%= config.bin %> pair', '<%= config.bin %> pair --no-qr'];
+    static flags = {
+        'no-qr': core_1.Flags.boolean({
+            description: 'Skip the QR rendering and only print the pairing URL.',
+            default: false,
+        }),
+        'poll-timeout': core_1.Flags.integer({
+            description: 'Maximum seconds to poll before giving up (default: 300).',
+            default: 300,
+        }),
+    };
+    async run() {
+        // H16 — runtime gate. Even if the user discovered the command name,
+        // we explicitly bail with a clear message and `EX_USAGE` (64) so
+        // CI scripts can distinguish "user error" from "command failed".
+        if (!PAIR_FEATURE_ENABLED) {
+            this.error('`skrr pair` is not yet available — mobile app integration is pending. Use `oversky login` instead.', { exit: 64 });
+        }
+        const { flags } = await this.parse(Pair);
+        // Step 1 — generate the CLI's ephemeral X25519 box keypair.
+        const keypair = tweetnacl_1.default.box.keyPair();
+        const publicKeyB64url = base64urlEncode(keypair.publicKey);
+        // Step 2 — ask the server to open a pairing window.
+        let start;
+        try {
+            start = await (0, api_fetch_1.apiFetch)('/api/auth/pair/start', {
+                method: 'POST',
+                body: { publicKey: publicKeyB64url },
+                // The /start endpoint is anonymous; no credential needed. Pass
+                // the resolved one anyway — apiFetch tolerates an authed call to
+                // an anon endpoint.
+                credential: this.resolvedCredential,
+            });
+        }
+        catch (err) {
+            if (err instanceof api_fetch_1.ApiFetchError && err.status === 409) {
+                this.error('A pairing request already exists for this CLI session — wait for it to expire or restart the CLI.', { exit: 1 });
+            }
+            if (err instanceof api_fetch_1.ApiFetchError && err.status === 503) {
+                // H5 — global active-row cap. Surface the Retry-After hint.
+                this.error('skrr pair-request capacity is temporarily exhausted. Wait ~60s and try `skrr pair` again.', { exit: 1 });
+            }
+            this.handleApiError(err);
+        }
+        if (typeof start.pairId !== 'string' ||
+            start.pairId.length === 0 ||
+            typeof start.pairSecret !== 'string' ||
+            start.pairSecret.length === 0) {
+            this.error('Server did not return a pairId/pairSecret. Update your skrr server.', {
+                exit: 1,
+            });
+        }
+        const expiresAt = new Date(start.expiresAt);
+        const pairingUrl = `oversky://pair?pk=${start.publicKey}`;
+        // Step 3 — render the QR + URL.
+        process.stderr.write('\n');
+        process.stderr.write('  Open the skrr mobile app and scan this QR code to pair this daemon:\n');
+        process.stderr.write('\n');
+        if (!flags['no-qr']) {
+            const qr = renderQr(pairingUrl);
+            if (qr)
+                process.stderr.write(qr);
+        }
+        process.stderr.write('  Or open this URL on your phone:\n');
+        process.stderr.write(`    ${pairingUrl}\n`);
+        process.stderr.write('\n');
+        process.stderr.write(`  Pairing window expires at ${expiresAt.toISOString()}.\n`);
+        process.stderr.write('\n');
+        process.stderr.write('  Waiting for approval...\n');
+        // Step 4 — poll for the response.
+        const pollIntervalMs = Math.max(500, start.pollIntervalMs || 1000);
+        const pollDeadline = Math.min(Date.now() + flags['poll-timeout'] * 1000, expiresAt.getTime());
+        let pollResult = null;
+        while (Date.now() < pollDeadline) {
+            await sleep(pollIntervalMs);
+            try {
+                const res = await (0, api_fetch_1.apiFetch)('/api/auth/pair/poll', {
+                    method: 'POST',
+                    // H5 — authenticate by holder-of-secret, not holder-of-publicKey.
+                    // The pairSecret was returned to us once on /start; the server
+                    // stored only its hash and compares constant-time.
+                    body: { pairId: start.pairId, pairSecret: start.pairSecret },
+                    credential: this.resolvedCredential,
+                });
+                if (res.state === 'authorized') {
+                    pollResult = res;
+                    break;
+                }
+                if (res.state === 'expired') {
+                    this.error('Pairing window expired before the mobile app responded. Run `skrr pair` again.', {
+                        exit: 1,
+                    });
+                }
+                // 'pending' — keep polling.
+            }
+            catch (err) {
+                if (err instanceof api_fetch_1.ApiFetchError && err.status === 429) {
+                    // Back off doubly on rate limit.
+                    await sleep(pollIntervalMs);
+                    continue;
+                }
+                this.handleApiError(err);
+            }
+        }
+        if (!pollResult || !pollResult.response) {
+            this.error('Pairing timed out without a response. Run `skrr pair` again.', { exit: 1 });
+        }
+        // Step 5 — verify AAD, then decrypt the response (C4).
+        if (!pollResult.daemonId || !pollResult.responseUserId) {
+            this.error('Pairing response missing daemonId or responseUserId — refusing to decrypt without AAD context.', { exit: 1 });
+        }
+        const plaintext = decryptResponse(pollResult.response, keypair.secretKey, {
+            expectedDaemonId: pollResult.daemonId,
+            expectedResponseUserId: pollResult.responseUserId,
+        });
+        if (!plaintext) {
+            this.error('Pairing response failed to decrypt — the mobile app may be sending a malformed payload, or the AAD did not match.', { exit: 1 });
+        }
+        // Step 6 — install the credentials via the canonical token-save path.
+        // C4 — persist the dataEncryptionKey when the mobile app sends one.
+        // Until Tier 1 #1's mobile half ships, the field will be null and
+        // the daemon's machine-DEK path takes over instead.
+        persistPairCredentials(plaintext, this.cliConfig.baseURL);
+        process.stderr.write('\n');
+        process.stderr.write('  Pairing complete. Daemon ready.\n');
+        if (plaintext.daemonId) {
+            process.stderr.write(`  Daemon ID: ${plaintext.daemonId}\n`);
+        }
+        if (plaintext.dataEncryptionKey) {
+            process.stderr.write('  Data encryption key installed.\n');
+        }
+        process.stderr.write('\n');
+    }
+}
+exports.default = Pair;
+/**
+ * Decrypt the pairing response. Returns null on any failure (bad format,
+ * decryption mismatch, malformed JSON, AAD mismatch) — the caller surfaces
+ * a uniform "decrypt failed" error to the user. See
+ * `docs/daemon-pair-protocol.md` for the byte layout.
+ *
+ * Bundle layout (mobile-encoded):
+ *   nonce (24 bytes) || mobilePublicKey (32 bytes) || ciphertext
+ *     || lenAad (2 bytes, big-endian) || aad
+ *
+ * The trailing `lenAad || aad` is XSalsa20-Poly1305's "no native AAD slot"
+ * workaround (C4): the canonical AAD is sealed alongside the ciphertext so
+ * any tampered/misdirected payload fails verification BEFORE tweetnacl
+ * sees a single byte of plaintext. The CLI rebuilds the AAD locally from
+ * `expectedDaemonId` + `expectedResponseUserId` and constant-time compares
+ * — a leaked QR + race attack that swapped the daemonId at the server gets
+ * rejected here.
+ */
+function decryptResponse(responseB64, cliSecretKey, opts) {
+    if (typeof responseB64 !== 'string' || responseB64.length === 0)
+        return null;
+    if (cliSecretKey.length !== SECRET_KEY_BYTES)
+        return null;
+    let bundle;
+    try {
+        bundle = base64Decode(responseB64);
+    }
+    catch {
+        return null;
+    }
+    if (bundle.length < NONCE_BYTES + PUBLIC_KEY_BYTES + 1)
+        return null;
+    let cipher;
+    let trailerAad = null;
+    if (opts) {
+        // C4 — bundle MUST carry a trailing `lenAad || aad`. The 2-byte
+        // length is big-endian unsigned — caps AAD at 65535 bytes (way
+        // more headroom than the canonical AAD ever needs).
+        const expectedAad = buildPairAad(opts.expectedDaemonId, opts.expectedResponseUserId);
+        if (bundle.length < NONCE_BYTES + PUBLIC_KEY_BYTES + 2 + 1)
+            return null;
+        const lenOffset = bundle.length - expectedAad.length - 2;
+        if (lenOffset < NONCE_BYTES + PUBLIC_KEY_BYTES + 1)
+            return null;
+        const lenAad = (bundle[lenOffset] << 8) | bundle[lenOffset + 1];
+        if (lenAad !== expectedAad.length)
+            return null;
+        const trailerStart = lenOffset;
+        const aadStart = lenOffset + 2;
+        if (trailerStart < NONCE_BYTES + PUBLIC_KEY_BYTES + 1)
+            return null;
+        trailerAad = bundle.slice(aadStart, aadStart + lenAad);
+        if (!constantTimeBytesEqual(trailerAad, expectedAad)) {
+            // AAD mismatch — refuse to decrypt. Do NOT log or surface the
+            // mismatch shape; uniform null fits the "uniform terminal state"
+            // model the rest of the command relies on.
+            return null;
+        }
+        cipher = bundle.slice(NONCE_BYTES + PUBLIC_KEY_BYTES, trailerStart);
+    }
+    else {
+        cipher = bundle.slice(NONCE_BYTES + PUBLIC_KEY_BYTES);
+    }
+    const nonce = bundle.slice(0, NONCE_BYTES);
+    const mobilePublicKey = bundle.slice(NONCE_BYTES, NONCE_BYTES + PUBLIC_KEY_BYTES);
+    const plaintextBytes = tweetnacl_1.default.box.open(cipher, nonce, mobilePublicKey, cliSecretKey);
+    if (!plaintextBytes)
+        return null;
+    let json;
+    try {
+        json = JSON.parse(Buffer.from(plaintextBytes).toString('utf8'));
+    }
+    catch {
+        return null;
+    }
+    if (!isValidPlaintext(json))
+        return null;
+    return json;
+}
+/**
+ * Persist the pairing credentials. Token + refreshToken go to the
+ * canonical auth backend (keychain or file); the optional
+ * dataEncryptionKey is preserved alongside (C4) — until Tier 1 #1's
+ * mobile half ships, this field will typically be null and the daemon
+ * derives its machine-DEK locally instead.
+ *
+ * Exported for tests so the persistence path can be exercised without
+ * spinning the full oclif runtime.
+ */
+function persistPairCredentials(plaintext, serverOrigin) {
+    (0, auth_storage_1.writeToBackend)({
+        token: plaintext.token,
+        ...(plaintext.refreshToken ? { refreshToken: plaintext.refreshToken } : {}),
+    }, { serverOrigin, clearReauth: true });
+    if (plaintext.dataEncryptionKey) {
+        // The unified `writeToBackend` API only carries token+refresh
+        // today. For now, persist the DEK as a sibling field on the next
+        // bundle write so it survives a CLI restart. When the daemon
+        // machine-DEK seam lands, this is the call site that flips to the
+        // L12 Keychain helper.
+        const existing = (0, auth_storage_1.readFromBackend)(serverOrigin);
+        if (existing.bundle) {
+            (0, auth_storage_1.writeToBackend)({
+                ...existing.bundle,
+                // dataEncryptionKey is not in the AuthBundle type yet; this is
+                // the deliberate seam for the daemon-side L12 path. We append
+                // through a typed cast so the bundle survives a round-trip.
+                ...{ dataEncryptionKey: plaintext.dataEncryptionKey },
+            });
+        }
+    }
+    // TODO: mobile DEK not yet available — daemon machine-DEK path will
+    // skip this branch entirely until Tier 1 #1's mobile half ships.
+}
+function isValidPlaintext(v) {
+    if (!v || typeof v !== 'object')
+        return false;
+    const o = v;
+    if (typeof o.token !== 'string' || o.token.length === 0)
+        return false;
+    if (typeof o.refreshToken !== 'string' || o.refreshToken.length === 0)
+        return false;
+    if (o.daemonId !== null && typeof o.daemonId !== 'string')
+        return false;
+    if (o.dataEncryptionKey !== null && typeof o.dataEncryptionKey !== 'string')
+        return false;
+    return true;
+}
+/** base64url encode (no padding) — what the protocol uses for publicKey. */
+function base64urlEncode(bytes) {
+    return Buffer.from(bytes)
+        .toString('base64')
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=+$/, '');
+}
+/** Standard base64 decode — what the protocol uses for the response bundle. */
+function base64Decode(s) {
+    // Permissive: the protocol says base64 (with padding), but a well-meaning
+    // mobile-side base64url encoder would also work. Accept both.
+    const normalized = s.replace(/-/g, '+').replace(/_/g, '/');
+    const buf = Buffer.from(normalized, 'base64');
+    return new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+}
+/** Constant-time Uint8Array equality. */
+function constantTimeBytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++) {
+        diff |= a[i] ^ b[i];
+    }
+    return diff === 0;
+}
+function renderQr(text) {
+    try {
+        let out = '';
+        qrcode_terminal_1.default.generate(text, { small: true }, (rendered) => {
+            out = rendered;
+        });
+        return out;
+    }
+    catch {
+        return '';
+    }
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/dist/commands/payments/wallet.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base-command';
+export default class PaymentsWallet extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/payments/wallet.js

@@ -0,0 +1,81 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+const format_1 = require("../../lib/format");
+class PaymentsWallet extends base_command_1.BaseCommand {
+    static description = 'Show wallet status: balance, monthly spend, and recent payments';
+    static examples = [
+        '<%= config.bin %> payments wallet',
+        '<%= config.bin %> payments wallet --json',
+        '<%= config.bin %> payments wallet --limit 5',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        limit: core_1.Flags.integer({
+            description: 'Number of recent payments to show',
+            default: 10,
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(PaymentsWallet);
+        let status;
+        let history;
+        try {
+            [status, history] = await Promise.all([
+                (0, api_fetch_1.apiFetch)('/api/wallet/status', {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)(`/api/wallet/history?limit=${flags.limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+            ]);
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify({ status, history }, null, 2));
+            return;
+        }
+        // Wallet status block
+        this.log('Wallet Status');
+        this.log(`  Enabled:        ${status.enabled ? 'yes' : 'no'}`);
+        this.log(`  Address:        ${status.address ?? '(not provisioned)'}`);
+        this.log(`  Balance:        ${status.balance} USDC`);
+        this.log(`  Monthly spent:  ${status.monthlySpent} USDC`);
+        this.log(`  Monthly limit:  ${status.monthlyLimit} USDC`);
+        this.log(`  Remaining:      ${status.remaining} USDC`);
+        // Two unrelated balances, and only this one used to be reachable from the
+        // CLI — so anyone looking for "my balance" found USDC and drew the wrong
+        // conclusion about their usage ceiling. Name the other one.
+        this.log('');
+        this.log('This is the x402 crypto wallet, in USDC. Your hosted USAGE balance —');
+        this.log('the ceiling that refuses a turn — is `skrr balance show`.');
+        const payments = history.payments ?? [];
+        if (payments.length === 0) {
+            this.log('');
+            this.log('No recent payments.');
+            return;
+        }
+        this.log('');
+        this.log(`Recent Payments (${payments.length} of ${history.total})`);
+        const rows = payments.map((p) => ({
+            date: p.createdAt ? new Date(p.createdAt).toISOString().slice(0, 10) : '-',
+            amount: p.amountUsdc != null ? `${p.amountUsdc} USDC` : p.amount != null ? `${p.amount}` : '-',
+            recipient: String(p.recipient ?? '-'),
+            status: String(p.status ?? '-'),
+            description: String(p.description ?? '-'),
+        }));
+        (0, format_1.renderTable)(rows, [
+            { key: 'date', header: 'DATE' },
+            { key: 'amount', header: 'AMOUNT' },
+            { key: 'recipient', header: 'RECIPIENT', maxWidth: 30 },
+            { key: 'status', header: 'STATUS' },
+            { key: 'description', header: 'DESCRIPTION', maxWidth: 50 },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = PaymentsWallet;

package/dist/commands/projects/activity.d.ts

@@ -0,0 +1,25 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * `skrr projects activity <project> --space <space>` — recent activity across
+ * the project's member tasks.
+ *
+ * The feed carries a fan-in cap: a project with more member tasks than the cap
+ * reports only its most recently touched ones, and the response says so with
+ * `truncated`. That flag is PRINTED rather than swallowed — a silently partial
+ * audit trail reads exactly like a complete one, which is the whole reason the
+ * server bothers to send it.
+ */
+export default class ProjectsActivity extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        before: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/projects/activity.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+const projects_1 = require("../../lib/projects");
+/**
+ * `skrr projects activity <project> --space <space>` — recent activity across
+ * the project's member tasks.
+ *
+ * The feed carries a fan-in cap: a project with more member tasks than the cap
+ * reports only its most recently touched ones, and the response says so with
+ * `truncated`. That flag is PRINTED rather than swallowed — a silently partial
+ * audit trail reads exactly like a complete one, which is the whole reason the
+ * server bothers to send it.
+ */
+class ProjectsActivity extends base_command_1.BaseCommand {
+    static description = "Show recent activity across a project's tasks";
+    static examples = [
+        '<%= config.bin %> projects activity OSK-P-12 --space OSK-S-3',
+        '<%= config.bin %> projects activity <project-id> --space <space> --limit 100',
+        '<%= config.bin %> projects activity <project-id> --space <space> --before <cursor> --json',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Project — id, ref (OSK-P-12), or qualified ref (OSK-S-3/OSK-P-12)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        space: core_1.Flags.string({
+            description: 'Owning space — id, ref, or name. Needed only for a bare ref (OSK-P-12); an id or a qualified ref `<space>/<project>` resolves on its own.',
+        }),
+        limit: core_1.Flags.integer({ description: 'Maximum events to return (server caps at 200)' }),
+        before: core_1.Flags.string({
+            description: 'Page backwards — pass the `nextCursor` from the previous response',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output the raw activity response as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(ProjectsActivity);
+        const { projectRef, spaceId } = await this.resolveProjectReference(args.id, flags.space);
+        let result;
+        try {
+            result = await data_provider_1.dataService.listSpaceProjectActivity(spaceId, projectRef, {
+                before: flags.before,
+                limit: flags.limit,
+            });
+        }
+        catch (err) {
+            this.handleApiError(err, { subject: `project ${projectRef}` });
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const items = Array.isArray(result.items) ? result.items : [];
+        if (items.length === 0) {
+            this.log('No activity.');
+            return;
+        }
+        (0, format_1.renderTable)(items.map((item) => (0, projects_1.toProjectActivityRow)(item)), [
+            { key: 'when', header: 'WHEN' },
+            { key: 'event', header: 'EVENT' },
+            { key: 'entity', header: 'ENTITY', maxWidth: 44 },
+            { key: 'actor', header: 'ACTOR', maxWidth: 30 },
+        ], (line) => this.log(line));
+        if (result.truncated) {
+            this.log('');
+            this.log('Note: this project has more member tasks than the activity fan-in cap — the feed covers only its most recently touched ones.');
+        }
+        if (result.nextCursor) {
+            this.log(`More: --before ${result.nextCursor}`);
+        }
+    }
+}
+exports.default = ProjectsActivity;

package/dist/commands/projects/archive.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+/**
+ * Same verb shape as `goals archive` — one command, `--unarchive` to restore.
+ * Archive rides the DELETE route (which archives by default); unarchive is a
+ * PATCH with `archived: false`. Hard deletion is `skrr projects delete`.
+ */
+export default class ProjectsArchive extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        unarchive: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/projects/archive.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+/**
+ * Same verb shape as `goals archive` — one command, `--unarchive` to restore.
+ * Archive rides the DELETE route (which archives by default); unarchive is a
+ * PATCH with `archived: false`. Hard deletion is `skrr projects delete`.
+ */
+class ProjectsArchive extends base_command_1.BaseCommand {
+    static description = 'Archive a project (reversible — use --unarchive to restore)';
+    static examples = [
+        '<%= config.bin %> projects archive <project-id> --space <space>',
+        '<%= config.bin %> projects archive <project-id> --space <space> --unarchive',
+    ];
+    static args = {
+        id: core_1.Args.string({
+            description: 'Project ID or ref (OSK-P-12)',
+            required: true,
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the result as JSON' }),
+        space: core_1.Flags.string({
+            description: 'Owning space — id, ref, or name. Needed only for a bare ref (OSK-P-12); an id or a qualified ref `<space>/<project>` resolves on its own.',
+        }),
+        unarchive: core_1.Flags.boolean({ description: 'Unarchive the project instead of archiving it' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(ProjectsArchive);
+        const { projectRef, spaceId } = await this.resolveProjectReference(args.id, flags.space);
+        let result;
+        try {
+            result = flags.unarchive
+                ? await data_provider_1.dataService.updateSpaceProject({
+                    spaceId,
+                    projectId: projectRef,
+                    archived: false,
+                })
+                : await data_provider_1.dataService.deleteSpaceProject({ spaceId, projectId: projectRef });
+        }
+        catch (err) {
+            this.handleApiError(err, { subject: `project ${projectRef}` });
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        this.log(`Project ${projectRef} ${flags.unarchive ? 'unarchived' : 'archived'}`);
+    }
+}
+exports.default = ProjectsArchive;

package/dist/commands/projects/create.d.ts

@@ -0,0 +1,19 @@
+import { BaseCommand } from '../../base-command';
+export default class ProjectsCreate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        space: import("@oclif/core/lib/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static flags: {
+        space: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        title: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        icon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        color: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        order: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'external-key': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}