@skrr-ai/cli 0.1.94 → 0.1.95

package/dist/commands/code/update.js

@@ -1,242 +1,163 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const auth_core_1 = require("@skrr-ai/auth-core");
-const base_command_1 = require("../../base-command");
-const cli_installers_1 = require("../../lib/cli-installers");
-const daemon_target_1 = require("../../lib/daemon-target");
-const first_party_harness_1 = require("../../lib/first-party-harness");
-/**
- * `skrr code update` — pull the engine's signed release down through the daemon.
- *
- * ── Why this command exists ────────────────────────────────────────────────
- *
- * The update verb has been API-exposed and daemon-implemented since OSK-10096 —
- * `POST /api/daemons/:id/cli-installers/:provider/update` re-fetches the signed
- * manifest and installs whatever the channel points at. But the only CLI that
- * reached it was `skrr harnesses install <provider> --update`: a flag on a
- * command a `code` user has no reason to read. On stable that left no
- * discoverable path at all — `code install` answered "Already installed." with
- * no next step, and the channel moving past the installed build was invisible
- * from the surface that owns the engine (OSK-10650).
- *
- * So this adds a SURFACE and no mechanism. Same route `harnesses install
- * --update` posts, same inventory pre-check, same 504 recovery — one update
- * path, spelled where the engine's users look.
- */
-class CodeUpdate extends base_command_1.BaseCommand {
-    static description = `Update the ${auth_core_1.FIRST_PARTY_HARNESS.displayName} engine on this machine, through the daemon`;
+const first_party_harness_update_1 = require("../../lib/first-party-harness-update");
+const first_party_harness_startup_update_1 = require("../../lib/first-party-harness-startup-update");
+/** The default target is this computer; an explicit daemon keeps the remote API path. */
+class CodeUpdate extends core_1.Command {
+    static description = `Check or update the local ${auth_core_1.FIRST_PARTY_HARNESS.displayName} signed release; use --daemon to update another machine`;
     static examples = [
         '<%= config.bin %> code update',
+        '<%= config.bin %> code update --check',
         '<%= config.bin %> code update --daemon <daemon-id>',
-        '<%= config.bin %> code update --json',
+        '<%= config.bin %> code update --rollback',
     ];
     static flags = {
-        daemon: core_1.Flags.string({
-            description: 'Which daemon runs the update. Defaults to this machine on a Dedicated Runtime, otherwise to the only active one; required when you have several.',
-        }),
+        daemon: core_1.Flags.string({ description: 'Run the update on this daemon instead of this computer' }),
         wait: core_1.Flags.boolean({
             default: true,
             allowNo: true,
-            description: 'Follow the update job until it finishes. --no-wait returns the job id.',
+            description: 'Wait for completion. --no-wait returns the local process or remote job.',
         }),
         json: core_1.Flags.boolean({ description: 'Emit the result as JSON' }),
+        check: core_1.Flags.boolean({
+            description: 'Check the signed release channel without downloading or changing the engine',
+        }),
+        'target-version': core_1.Flags.string({ description: 'Install this exact signed release' }),
+        'allow-downgrade': core_1.Flags.boolean({
+            description: 'Allow an explicitly pinned older signed release',
+        }),
+        rollback: core_1.Flags.boolean({ description: 'Restore the previous verified release' }),
+        'startup-checks': core_1.Flags.string({
+            options: ['on', 'off'],
+            description: 'Enable or disable new-session update checks without updating the engine',
+        }),
     };
     async run() {
-        const { flags } = await this.parse(CodeUpdate);
-        const daemonId = this.updateTarget(await this.resolveTarget(flags.daemon));
-        // Ask the inventory before posting: a daemon older than managed updates has
-        // no handler for the request and would leave it to time out, and an engine
-        // that updates some other way has a reason the daemon already words.
-        let inventory;
-        try {
-            inventory = await (0, cli_installers_1.listCliInstallers)(daemonId, this.resolvedCredential);
-        }
-        catch (err) {
-            this.handleApiError(err);
-        }
-        const row = (inventory.providers ?? []).find((p) => (0, auth_core_1.isFirstPartyHarnessProvider)(p.provider));
-        if (!row) {
-            this.failWithCliError({
-                message: `${auth_core_1.FIRST_PARTY_HARNESS.displayName} is not installed on ${daemonId}. ` +
-                    `Install it with \`${this.config.bin} code install\`.`,
-                code: 'NOT_INSTALLED',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        if (row.updatable === undefined) {
-            this.failWithCliError({
-                message: `The daemon ${daemonId} (${inventory.daemonVersion ?? 'version not reported'}) cannot update ${auth_core_1.FIRST_PARTY_HARNESS.displayName}: it predates managed updates. ` +
-                    `Update the daemon, then run this again.`,
-                code: 'DAEMON_UPDATE_UNSUPPORTED',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        if (!row.updatable) {
-            this.failWithCliError({
-                message: row.updateDisabledReason?.trim() ||
-                    `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: the daemon cannot update it here.`,
-                code: 'CLI_NOT_UPDATABLE',
-                exit: 1,
-                retryable: false,
-            });
+        // Preserve all authenticated remote flags (--profile, --workspace, --token)
+        // without importing or initializing the auth stack for a local operation.
+        if (this.argv.some((arg) => arg === '--daemon' || arg.startsWith('--daemon='))) {
+            const { default: RemoteCodeUpdate } = await Promise.resolve().then(() => __importStar(require('../../lib/first-party-harness-remote-update')));
+            await this.parse(RemoteCodeUpdate);
+            await RemoteCodeUpdate.run(this.argv, this.config);
+            return;
         }
-        const start = await this.start(daemonId, flags.json === true);
-        if (!start)
+        const { flags } = await this.parse(CodeUpdate);
+        if (flags['startup-checks']) {
+            if (flags.daemon ||
+                flags.check ||
+                flags.rollback ||
+                flags['target-version'] ||
+                flags['allow-downgrade'] ||
+                !flags.wait)
+                this.error('--startup-checks changes only the local preference; use it without other update controls.');
+            const setting = (0, first_party_harness_startup_update_1.configureCodeStartupChecks)(flags['startup-checks'] === 'on');
+            if (flags.json)
+                this.log(JSON.stringify({
+                    component: 'code',
+                    state: 'configured',
+                    startupChecks: setting.enabled,
+                    preferencesPath: setting.preferencesPath,
+                }, null, 2));
+            else
+                this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} startup update checks ${setting.enabled ? 'enabled' : 'disabled'}. Change this with \`skrr code update --startup-checks ${setting.enabled ? 'off' : 'on'}\`.`);
             return;
-        const jobId = start.job?.id;
-        if (!start.started || !jobId) {
-            if (flags.json) {
-                this.log(JSON.stringify({ daemonId, ...start }, null, 2));
+        }
+        if (flags.rollback &&
+            (flags.check || flags['target-version'] || flags['allow-downgrade'] || !flags.wait))
+            this.error('--rollback cannot be combined with --check, --target-version, --allow-downgrade or --no-wait.');
+        if (flags['allow-downgrade'] && !flags['target-version'])
+            this.error('--allow-downgrade requires --target-version.');
+        const options = {
+            version: flags['target-version'],
+            allowDowngrade: flags['allow-downgrade'],
+            force: true,
+        };
+        try {
+            const current = (0, first_party_harness_update_1.getLocalCodeUpdateStatus)();
+            if (!flags.check && !flags.rollback && !current.activePath && current.owner === 'managed') {
+                const missing = {
+                    ...current,
+                    state: 'failed',
+                    code: 'NOT_INSTALLED',
+                    message: `${auth_core_1.FIRST_PARTY_HARNESS.displayName} is not installed on this computer. Run \`skrr code install\`.`,
+                };
+                if (flags.json)
+                    this.log(JSON.stringify(missing, null, 2));
+                else
+                    this.log((0, first_party_harness_update_1.formatLocalCodeUpdate)(missing));
+                process.exitCode = 1;
                 return;
             }
-            this.log(start.alreadyRunning
-                ? `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: an install or update is already running (job ${start.job?.id ?? 'unknown'}).`
-                : `${auth_core_1.FIRST_PARTY_HARNESS.displayName}: ${start.provider?.updateDisabledReason?.trim() || 'the daemon started no update job.'}`);
-            return;
-        }
-        if (!flags.wait) {
-            if (flags.json) {
-                this.log(JSON.stringify({ daemonId, ...start }, null, 2));
+            if (!flags.check && !flags.rollback && !flags.wait) {
+                const queued = await (0, first_party_harness_update_1.startLocalCodeUpdate)(options);
+                if (flags.json)
+                    this.log(JSON.stringify(queued, null, 2));
+                else
+                    this.log(`${auth_core_1.FIRST_PARTY_HARNESS.displayName} update queued (process ${queued.pid}). Results: ${queued.logPath}; status: skrr code doctor.`);
                 return;
             }
-            this.log(`Update started on ${daemonId} — job ${jobId}.`);
-            return;
-        }
-        if (!flags.json) {
-            this.logToStderr(`Updating ${auth_core_1.FIRST_PARTY_HARNESS.displayName} ${row.version ? `${row.version} ` : ''}on ${daemonId}…`);
-        }
-        const job = await this.follow(daemonId, jobId, flags.json === true);
-        if (!job)
-            return;
-        if (flags.json) {
-            this.log(JSON.stringify({ daemonId, job }, null, 2));
-            if (job.status !== 'succeeded')
+            const result = flags.check
+                ? await (0, first_party_harness_update_1.checkLocalCodeUpdate)(options)
+                : flags.rollback
+                    ? (0, first_party_harness_update_1.rollbackLocalCode)()
+                    : await (0, first_party_harness_update_1.updateLocalCode)({
+                        ...options,
+                        onProgress: flags.json ? undefined : (line) => this.logToStderr(line),
+                    });
+            if (flags.json)
+                this.log(JSON.stringify(result, null, 2));
+            else
+                this.log((0, first_party_harness_update_1.formatLocalCodeUpdate)(result));
+            if (result.state === 'failed' || result.state === 'check-failed')
                 process.exitCode = 1;
-            return;
-        }
-        if (job.status === 'failed') {
-            this.failWithCliError({
-                message: job.error || 'The update failed and the daemon gave no reason.',
-                code: 'UPDATE_FAILED',
-                exit: 1,
-                retryable: false,
-            });
         }
-        this.log((0, cli_installers_1.updateOutcomeLine)(job) ??
-            `${auth_core_1.FIRST_PARTY_HARNESS.displayName} updated${job.installedVersion ? ` to ${job.installedVersion}` : ''}.`);
-    }
-    /** Which daemon the update targets, by the rule every daemon-picking command shares. */
-    async resolveTarget(explicit) {
-        try {
-            return await (0, daemon_target_1.resolveDaemonTarget)({
-                explicit,
-                local: (0, daemon_target_1.localMachine)({ baseURL: this.cliConfig?.baseURL }),
-                listActiveDaemons: () => (0, daemon_target_1.listConnectedDaemons)(this.resolvedCredential),
-            });
-        }
-        catch (err) {
-            this.handleApiError(err);
-        }
-    }
-    /**
-     * The daemon id to update through, or the refusal — identical rules to
-     * `code install`: a Dedicated Runtime's own machine is image-managed, several
-     * connected daemons get named rather than guessed.
-     */
-    updateTarget(target) {
-        if (target.kind === 'daemon')
-            return target.daemonId;
-        if (target.kind === 'this-machine') {
-            this.failWithCliError({
-                message: target.explicit
-                    ? first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE
-                    : `${first_party_harness_1.DEDICATED_RUNTIME_ENGINE_MESSAGE} This command updates the machine it runs on; ` +
-                        'to update another of your machines, name it with --daemon.',
-                code: 'DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        if (target.kind === 'none') {
-            this.failWithCliError({
-                message: 'No daemon is connected for this account, so nothing can perform the update. ' +
-                    `Start the background service on this computer with \`${this.config.bin} daemon start\`, then run this again.`,
-                code: 'NO_DAEMON',
-                exit: 1,
-                retryable: false,
-            });
-        }
-        const { daemons } = target;
-        const choices = daemons
-            .slice(0, 10)
-            .map((d) => `  ${d.id}  ${d.name || '—'}`)
-            .join('\n');
-        this.failWithCliError({
-            message: `${daemons.length} connected daemons — say which machine should update the engine:\n${choices}\n` +
-                `Pass one with --daemon, or see each daemon id in the DAEMON ID column of \`${this.config.bin} harnesses list\`.`,
-            code: 'AMBIGUOUS_DAEMON',
-            exit: 1,
-            retryable: false,
-        });
-    }
-    /**
-     * Start the update, and survive a gateway that cut the request off — the same
-     * 504 recovery `harnesses install --update` uses: the relay can drop the
-     * answer while the daemon runs the job it started, so on a server-side
-     * failure we ask the daemon and follow the job it reports.
-     */
-    async start(daemonId, json) {
-        try {
-            return await (0, cli_installers_1.startManagedCliUpdate)(daemonId, PROVIDER, this.resolvedCredential);
-        }
-        catch (err) {
-            const status = err.status ?? 0;
-            if (status >= 500 || status === 408) {
-                const job = await (0, cli_installers_1.jobStartedDespiteTimeout)(daemonId, PROVIDER, this.resolvedCredential);
-                if (job?.id) {
-                    if (!json) {
-                        this.logToStderr(`The request to ${daemonId} did not come back (HTTP ${status}), but the daemon started job ${job.id}. Following it.`);
-                    }
-                    return { started: true, job };
-                }
+        catch (error) {
+            if (flags.json) {
+                this.log(JSON.stringify({
+                    component: 'code',
+                    state: 'failed',
+                    error: error instanceof Error ? error.message : String(error),
+                }));
+                process.exitCode = 1;
             }
-            this.handleApiError(err);
-            return undefined;
-        }
-    }
-    /** Follow a job to its end, or report why it could not be followed (and return nothing). */
-    async follow(daemonId, jobId, json) {
-        const outcome = await (0, cli_installers_1.followManagedCliInstallJob)({
-            daemonId,
-            jobId,
-            credential: this.resolvedCredential,
-            onLogLine: json ? undefined : (line) => this.logToStderr(`  ${line}`),
-        });
-        if (outcome.kind === 'missing') {
-            this.failWithCliError({
-                message: `The daemon no longer has update job ${jobId}.`,
-                code: 'JOB_MISSING',
-                exit: 1,
-                retryable: false,
-            });
-            return undefined;
-        }
-        if (outcome.kind === 'timeout') {
-            this.failWithCliError({
-                message: `Still updating after ${Math.round(cli_installers_1.INSTALL_MAX_WAIT_MS / 60000)} minutes — the daemon is ` +
-                    `still working on job ${jobId}. Check \`${this.config.bin} code doctor\` in a while.`,
-                code: 'UPDATE_PENDING',
-                exit: 1,
-                retryable: true,
-            });
-            return undefined;
+            else
+                this.error(error instanceof Error ? error : String(error));
         }
-        return outcome.job;
     }
 }
 exports.default = CodeUpdate;
-/** Same canonical provider id `code install` posts — read from the identity module. */
-const PROVIDER = auth_core_1.FIRST_PARTY_HARNESS.provider;

package/dist/commands/daemon/install.js

@@ -84,6 +84,10 @@ class DaemonInstall extends core_1.Command {
             // is how a CLI and its daemon end up on different deployments
             // (OSK-279) without anyone doing anything wrong.
             const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...(0, daemon_binding_1.bindToCliSession)(argv)]);
+            if (code === 0 &&
+                !argv.some((arg) => ['--json', '--help', '-h'].includes(arg))) {
+                this.log('Coding-agent instructions: sign in with `skrr login`, or review installation choices with `skrr instructions setup`.');
+            }
             this.exit(code);
         }
         catch (err) {

package/dist/commands/generate-recovery-code.d.ts

@@ -6,7 +6,9 @@ import { BaseCommand } from '../base-command';
  * POST /api/auth/recovery/generate. The formatted code is printed
  * exactly once to STDOUT; a warning goes to STDERR.
  *
- * Requires an interactive user session (NOT a CI token).
+ * Requires a user sign-in session (NOT a CI token or PAT). When the server
+ * requests a fresh proof, this command verifies it for recovery_code_generate
+ * on the same session before retrying the generation exactly once.
  * On success: any previously-active recovery code is revoked server-side
  * and the new one is returned.
  *
@@ -19,6 +21,16 @@ export default class GenerateRecoveryCode extends BaseCommand {
     static examples: string[];
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        otp: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'backup-code': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'email-code': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private generate;
+    private proofFor;
+    private nonemptyCode;
+    private refuseUnavailableMethod;
+    private refusePasskeyOnly;
+    private refuseStepUp;
+    private handleGenerationError;
 }

package/dist/commands/generate-recovery-code.js

@@ -1,8 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../base-command");
 const api_fetch_1 = require("../lib/api-fetch");
+const prompt_1 = require("../lib/prompt");
+// Include passkey even though this terminal cannot run a WebAuthn ceremony.
+// The server uses this header when choosing the account's strongest proof:
+// omitting passkey would make a passkey-only account fall back to email.
+// A passkey-only challenge is refused below with a first-party web handoff.
+const STEP_UP_HEADERS = { 'X-Step-Up-Methods': 'passkey,totp,backup_code,email_code' };
+const PURPOSE = data_provider_1.RECOVERY_CODE_GENERATE_STEP_UP_PURPOSE;
 /**
  * `skrr generate-recovery-code`
  *
@@ -10,7 +18,9 @@ const api_fetch_1 = require("../lib/api-fetch");
  * POST /api/auth/recovery/generate. The formatted code is printed
  * exactly once to STDOUT; a warning goes to STDERR.
  *
- * Requires an interactive user session (NOT a CI token).
+ * Requires a user sign-in session (NOT a CI token or PAT). When the server
+ * requests a fresh proof, this command verifies it for recovery_code_generate
+ * on the same session before retrying the generation exactly once.
  * On success: any previously-active recovery code is revoked server-side
  * and the new one is returned.
  *
@@ -22,6 +32,8 @@ class GenerateRecoveryCode extends base_command_1.BaseCommand {
     static description = 'Generate a printable account-recovery code. Shown once — store it safely. Recovery codes use letters A-Z and digits 2-7.';
     static examples = [
         '<%= config.bin %> generate-recovery-code',
+        '<%= config.bin %> generate-recovery-code --otp 123456',
+        '<%= config.bin %> generate-recovery-code --backup-code <unused-code>',
         '<%= config.bin %> generate-recovery-code --json',
     ];
     static flags = {
@@ -29,28 +41,60 @@ class GenerateRecoveryCode extends base_command_1.BaseCommand {
             description: 'Output as JSON (for scripting). Code still printed only once.',
             default: false,
         }),
+        otp: core_1.Flags.string({
+            description: 'Current code from your authenticator app when a fresh proof is required',
+            exclusive: ['backup-code', 'email-code'],
+        }),
+        'backup-code': core_1.Flags.string({
+            description: 'Unused two-factor backup code when a fresh proof is required (it is spent)',
+            exclusive: ['otp', 'email-code'],
+        }),
+        'email-code': core_1.Flags.string({
+            description: 'Previously requested one-time email code when a fresh proof is required',
+            exclusive: ['otp', 'backup-code'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { flags } = await this.parse(GenerateRecoveryCode);
-        // Guard: CI tokens cannot generate recovery codes (server also enforces this).
-        if (this.resolvedCredential.kind === 'ci') {
-            this.error('CI tokens cannot generate recovery codes. Run this command from an interactive session (`skrr login`).', { exit: 2 });
+        // Static credentials cannot mint account recovery credentials.
+        if (this.resolvedCredential.kind === 'ci' || this.resolvedCredential.kind === 'pat') {
+            this.error('CI and personal access tokens cannot generate recovery codes. Sign in with `skrr login` first.', { exit: 2 });
         }
         let result;
         try {
-            result = await (0, api_fetch_1.apiFetch)('/api/auth/recovery/generate', {
-                method: 'POST',
-                credential: this.resolvedCredential,
-            });
+            result = await this.generate();
         }
         catch (err) {
-            if (err instanceof api_fetch_1.ApiFetchError) {
-                if (err.status === 401 || err.status === 403) {
-                    this.error('Not authorized to generate a recovery code. Ensure you are signed in with a user-scope session.', { exit: 1 });
-                }
+            const challenge = err instanceof api_fetch_1.ApiFetchError && err.status === 403 ? (0, data_provider_1.stepUpChallengeFromError)(err) : null;
+            if (!challenge)
+                this.handleGenerationError(err);
+            if (challenge.purpose !== PURPOSE) {
+                this.error('The server asked for verification of a different action. Nothing changed.', {
+                    code: 'STEP_UP_PURPOSE_MISMATCH',
+                    exit: 2,
+                });
+            }
+            if (challenge.reason !== 'no_recent_step_up')
+                this.refuseStepUp(challenge);
+            const proof = await this.proofFor(challenge, flags);
+            try {
+                await (0, api_fetch_1.apiFetch)('/api/auth/step-up', {
+                    method: 'POST',
+                    credential: this.resolvedCredential,
+                    headers: STEP_UP_HEADERS,
+                    body: { purpose: PURPOSE, ...proof },
+                });
+            }
+            catch (verifyError) {
+                this.handleApiError(verifyError);
+            }
+            try {
+                result = await this.generate();
+            }
+            catch (retryError) {
+                this.handleGenerationError(retryError);
             }
-            this.handleApiError(err);
         }
         if (flags.json) {
             // JSON mode: print structured output to stdout for scripting.
@@ -75,5 +119,94 @@ class GenerateRecoveryCode extends base_command_1.BaseCommand {
         process.stderr.write(`  Generated at: ${new Date(result.createdAt).toISOString()}\n`);
         process.stderr.write('\n');
     }
+    generate() {
+        return (0, api_fetch_1.apiFetch)('/api/auth/recovery/generate', {
+            method: 'POST',
+            credential: this.resolvedCredential,
+            headers: STEP_UP_HEADERS,
+        });
+    }
+    async proofFor(challenge, flags) {
+        if (challenge.methods.includes('passkey') &&
+            !challenge.methods.includes('totp') &&
+            !challenge.methods.includes('backup_code')) {
+            this.refusePasskeyOnly();
+        }
+        if (flags.otp !== undefined) {
+            if (!challenge.methods.includes('totp'))
+                this.refuseUnavailableMethod();
+            return { token: this.nonemptyCode(flags.otp) };
+        }
+        if (flags['backup-code'] !== undefined) {
+            if (!challenge.methods.includes('backup_code'))
+                this.refuseUnavailableMethod();
+            return { backupCode: this.nonemptyCode(flags['backup-code']) };
+        }
+        if (flags['email-code'] !== undefined) {
+            if (!challenge.methods.includes('email_code'))
+                this.refuseUnavailableMethod();
+            return { emailCode: this.nonemptyCode(flags['email-code']) };
+        }
+        if (!process.stdin.isTTY) {
+            this.error('A fresh identity check is required. Run this command at a terminal, or pass --otp, --backup-code, or a previously requested --email-code. Nothing changed.', { code: 'STEP_UP_PROOF_REQUIRED', exit: 2 });
+        }
+        if (challenge.methods.includes('totp')) {
+            const entered = await (0, prompt_1.prompt)('Authenticator code: ', {
+                hidden: true,
+                output: process.stderr,
+            });
+            return { token: this.nonemptyCode(entered) };
+        }
+        if (challenge.methods.includes('backup_code')) {
+            const entered = await (0, prompt_1.prompt)('Unused two-factor backup code: ', {
+                hidden: true,
+                output: process.stderr,
+            });
+            return { backupCode: this.nonemptyCode(entered) };
+        }
+        if (challenge.methods.includes('email_code')) {
+            try {
+                await (0, api_fetch_1.apiFetch)('/api/auth/step-up/email-code', {
+                    method: 'POST',
+                    credential: this.resolvedCredential,
+                    headers: STEP_UP_HEADERS,
+                    body: { purpose: PURPOSE },
+                });
+            }
+            catch (requestError) {
+                this.handleApiError(requestError);
+            }
+            process.stderr.write('A one-time code was sent to your account email.\n');
+            const entered = await (0, prompt_1.prompt)('Email code: ', { hidden: true, output: process.stderr });
+            return { emailCode: this.nonemptyCode(entered) };
+        }
+        this.refuseUnavailableMethod();
+    }
+    nonemptyCode(value) {
+        const code = value.trim();
+        if (!code)
+            this.error('A verification code cannot be empty. Nothing changed.', { exit: 2 });
+        return code;
+    }
+    refuseUnavailableMethod() {
+        this.error('This login has no identity-check method the CLI can complete. Use Settings → Account in the web app, or enroll an authenticator and try again. Nothing changed.', { code: 'STEP_UP_METHOD_UNAVAILABLE', exit: 2 });
+    }
+    refusePasskeyOnly() {
+        this.error('This account requires a passkey for this identity check. Open Settings → Account in the web app to generate a recovery code. Nothing changed.', { code: 'STEP_UP_PASSKEY_REQUIRED', exit: 2 });
+    }
+    refuseStepUp(challenge) {
+        if (challenge.reason === 'credential_not_session_bound') {
+            this.error('This credential has no sign-in session for an identity check. Run `skrr login` and try again. Nothing changed.', { code: 'STEP_UP_SESSION_UNBOUND', exit: 2 });
+        }
+        this.refuseUnavailableMethod();
+    }
+    handleGenerationError(err) {
+        if (err instanceof api_fetch_1.ApiFetchError && (err.status === 401 || err.status === 403)) {
+            this.error('Not authorized to generate a recovery code. Sign in with a user-scope session.', {
+                exit: 1,
+            });
+        }
+        this.handleApiError(err);
+    }
 }
 exports.default = GenerateRecoveryCode;

package/dist/commands/instructions/guide.d.ts

@@ -0,0 +1,20 @@
+import { Command } from '@oclif/core';
+export default class InstructionsGuide extends Command {
+    static baseFlags: {
+        bare: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        token: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        profile: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        raw: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    static description: string;
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        offline: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}