@skrr-ai/cli 0.1.94 → 0.1.96

package/dist/commands/commitments/observations.js

@@ -1,8 +1,49 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseObservationWindow = parseObservationWindow;
+exports.renderObservationWindow = renderObservationWindow;
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
+/** Explicit ISO FROM/TO intervals avoid local-time or rolling-window ambiguity. */
+function parseObservationWindow(value) {
+    const parts = value.split('/');
+    const timestamp = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+    const [from, to] = parts.map((entry) => new Date(entry).getTime());
+    const realCalendarDay = (part) => {
+        const day = part.slice(0, 10);
+        const parsed = new Date(`${day}T00:00:00Z`);
+        return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 10) === day;
+    };
+    if (parts.length !== 2 ||
+        !parts.every((part) => timestamp.test(part) && realCalendarDay(part)) ||
+        !Number.isFinite(from) ||
+        !Number.isFinite(to) ||
+        to <= from ||
+        to - from > data_provider_1.OBSERVATION_WINDOW_MAX_MS)
+        throw new Error('Window requires ISO FROM/TO with an explicit timezone and a positive span of at most 90 days');
+    return { from: new Date(from).toISOString(), to: new Date(to).toISOString() };
+}
+function renderObservationWindow(response, log) {
+    // Always announce partial data before showing figures, including baseline truncation.
+    if (response.truncated)
+        log('TRUNCATED: bounded sample only; figures are incomplete.');
+    log('Agent-reported samples; as-of interval coverage is not independent verification.');
+    const display = (label, value) => {
+        const window = value;
+        log(`${label}: [${window.from}, ${window.to})`);
+        log(`Samples: ${window.count}; numeric: ${window.numericCount}; unreadable: ${window.gapCount}; uncovered ms: ${window.gapMs}`);
+        log(`Mean: ${window.mean ?? 'unknown'}; sum: ${window.sum ?? 'unknown'}; first: ${window.first ?? 'unknown'}; last: ${window.last ?? 'unknown'}`);
+    };
+    if (response.baseline) {
+        display('Baseline', response.baseline);
+        display('After', response.after);
+        log(`Comparison: ${response.sufficient ? `delta=${response.delta}; ratio=${response.ratio}` : `unavailable (${response.reason})`}`);
+    }
+    else
+        display('Window', response.summary);
+}
 /**
  * `skrr commitments observations <id>` — what this commitment's runs saw.
  *
@@ -30,6 +71,18 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
     };
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        latest: core_1.Flags.boolean({
+            description: 'Latest recorded attempt per current declared key (not history)',
+        }),
+        key: core_1.Flags.string({ description: 'Observation key for --window' }),
+        window: core_1.Flags.string({
+            description: 'Half-open ISO FROM/TO interval, at most 90 days',
+            dependsOn: ['key'],
+        }),
+        'compare-to': core_1.Flags.string({
+            description: 'Baseline ISO FROM/TO interval',
+            dependsOn: ['window'],
+        }),
         limit: core_1.Flags.integer({ description: 'Rows to include', min: 1, max: 200 }),
         'declared-only': core_1.Flags.boolean({
             description: 'Only keys the operator declared — the rows that can move the loop',
@@ -45,10 +98,42 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(CommitmentsObservations);
+        if (flags.latest && (flags.window || flags.cursor || flags['changed-only'] || flags.since))
+            this.error('--latest cannot be combined with --window, --cursor, --changed-only, or --since');
         let response;
+        if (flags.window) {
+            try {
+                if (flags['declared-only'] || flags['changed-only'] || flags.since || flags.cursor)
+                    this.error('--window cannot be combined with list filters');
+                const query = {
+                    key: flags.key,
+                    ...parseObservationWindow(flags.window),
+                    limit: flags.limit,
+                };
+                const baseline = flags['compare-to'] ? parseObservationWindow(flags['compare-to']) : null;
+                response = baseline
+                    ? await commitments_1.commitmentApi.observationCompare(args.commitmentId, {
+                        ...query,
+                        baselineFrom: baseline.from,
+                        baselineTo: baseline.to,
+                    })
+                    : await commitments_1.commitmentApi.observationSeries(args.commitmentId, query);
+            }
+            catch (err) {
+                this.handleApiError(err);
+            }
+            if (flags.json)
+                this.log(JSON.stringify(response, null, 2));
+            else
+                renderObservationWindow(response, (line) => this.log(line));
+            return;
+        }
+        if (flags.key)
+            this.error('--key requires --window');
         try {
             response = await commitments_1.commitmentApi.observations(args.commitmentId, {
                 limit: flags.limit,
+                latest: flags.latest || undefined,
                 declaredOnly: flags['declared-only'] || undefined,
                 changedOnly: flags['changed-only'] || undefined,
                 since: flags.since,
@@ -66,6 +151,7 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
             // facts; a filter that empties the list must not claim the first
             // (OSK-10953).
             const filters = [
+                flags.latest ? '--latest' : null,
                 flags['declared-only'] ? '--declared-only' : null,
                 flags['changed-only'] ? '--changed-only' : null,
                 flags.since ? `--since ${flags.since}` : null,
@@ -73,6 +159,8 @@ class CommitmentsObservations extends base_command_1.BaseCommand {
             const emptyMessage = filters.length
                 ? `No observations match ${filters.join(' ')}.`
                 : 'No observations recorded.';
+            if (response?.truncated)
+                this.log(`TRUNCATED: ${response.omitted} current keys omitted; increase --limit (max 200).`);
             (0, commitments_1.renderCommitmentObservations)(response, (line) => this.log(line), { emptyMessage });
         }
         (0, commitments_1.renderListPageHint)(response, (line) => this.log(line));

package/dist/commands/commitments/pause.d.ts

@@ -1,7 +1,7 @@
 import { BaseCommand } from '../../base-command';
 /**
  * `skrr commitments pause <id>` — stop the control loop without losing the
- * contract or its history. The kill-switch for a noisy or misfiring commitment.
+ * contract or its history. An already executing turn may continue.
  */
 export default class CommitmentsPause extends BaseCommand {
     static description: string;

package/dist/commands/commitments/pause.js

@@ -6,10 +6,10 @@ const web_url_1 = require("../../lib/web-url");
 const commitments_1 = require("../../lib/commitments");
 /**
  * `skrr commitments pause <id>` — stop the control loop without losing the
- * contract or its history. The kill-switch for a noisy or misfiring commitment.
+ * contract or its history. An already executing turn may continue.
  */
 class CommitmentsPause extends base_command_1.BaseCommand {
-    static description = 'Pause a commitment — its control loop stops checking';
+    static description = 'Pause a commitment — stops new work; a turn already running may continue until it finishes or reaches its deadline';
     static examples = ['<%= config.bin %> commitments pause <commitment-id>'];
     static args = {
         id: core_1.Args.string({ description: 'Commitment ID', required: true, ignoreStdin: true }),
@@ -30,6 +30,7 @@ class CommitmentsPause extends base_command_1.BaseCommand {
             return;
         }
         this.log(`Paused commitment ${args.id}.`);
+        this.log('Stops new work. A turn already running may continue until it finishes or reaches its deadline.');
         // The status write is the fence and it has landed. The teardown of the
         // wake tree behind it is best-effort, and used to be silent — so a pause
         // that left triggers live looked exactly like one that did not. Say which
@@ -39,7 +40,7 @@ class CommitmentsPause extends base_command_1.BaseCommand {
             .teardown;
         if (teardown?.status === 'degraded') {
             this.warn('The control loop is stopped, but some scheduled wakes may not have been retired yet. ' +
-                'They cannot run anything — every wake is refused while this Commitment is paused — ' +
+                'They cannot start new work — every wake is refused while this Commitment is paused — ' +
                 `and the reconciler retries automatically. Check with: skrr commitments trigger-status ${args.id}`);
         }
         (0, commitments_1.renderCommitmentSummary)(commitment, (line) => this.log(line));

package/dist/commands/commitments/preflight.js

@@ -153,7 +153,8 @@ class CommitmentsPreflight extends base_command_1.BaseCommand {
         for (const endpoint of report.endpoints || []) {
             this.log(`  ${endpoint.available ? 'ok   ' : 'BLOCK'} ${endpoint.label || endpoint.destination}` +
                 ` — ${(endpoint.capabilities || []).join(', ') || 'no capabilities'}` +
-                (endpoint.reason ? ` (${endpoint.reason})` : ''));
+                (endpoint.reason ? ` (${endpoint.reason})` : '') +
+                (!endpoint.available && endpoint.detail ? ` — ${endpoint.detail}` : ''));
         }
         this.log(`\nAttention: ${report.attention?.allowed ? 'delivery allowed now' : `suppressed by ${report.attention?.suppressedBy || 'policy'}`}`);
         if (report.verdict === 'blocked')

package/dist/commands/commitments/reports.d.ts

@@ -19,7 +19,9 @@ export default class CommitmentsReports extends BaseCommand {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         add: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         target: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        review: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         on: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         remove: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;

package/dist/commands/commitments/reports.js

@@ -6,16 +6,18 @@ const base_command_1 = require("../../base-command");
 const commitments_1 = require("../../lib/commitments");
 const commitment_terms_1 = require("../../lib/commitment-terms");
 /** Destinations that address one specific place and therefore need a target. */
-const DESTINATIONS_NEEDING_TARGET = new Set(['slack_channel']);
+const DESTINATIONS_NEEDING_TARGET = new Set(Object.values(data_provider_1.COMMITMENT_DESTINATION_REGISTRY)
+    .filter((destination) => destination.requiresTarget)
+    .map((destination) => destination.key));
 /**
  * Keep the CLI safe across a rolling data-provider build. Older installed
  * packages expose the compatibility destination list but not the narrowed
  * authoring list; derive the same restriction instead of crashing command
- * discovery or accidentally offering the inert email transport.
+ * discovery.
  */
 const AUTHORABLE_REPORT_DESTINATIONS = Array.isArray(data_provider_1.COMMITMENT_AUTHORABLE_REPORT_DESTINATIONS)
     ? data_provider_1.COMMITMENT_AUTHORABLE_REPORT_DESTINATIONS
-    : data_provider_1.COMMITMENT_REPORT_DESTINATIONS.filter((destination) => destination !== 'email');
+    : data_provider_1.COMMITMENT_REPORT_DESTINATIONS;
 /**
  * Identity of a report target = destination + its target id. The same channel
  * may legitimately appear twice with different `on` conditions (a digest on
@@ -41,6 +43,7 @@ class CommitmentsReports extends base_command_1.BaseCommand {
         '<%= config.bin %> commitments reports <commitment-id>',
         '<%= config.bin %> commitments reports <commitment-id> --add slack_channel --target C0123456 --on material_change',
         '<%= config.bin %> commitments reports <commitment-id> --add main --on completion',
+        '<%= config.bin %> commitments reports <commitment-id> --add user_notify --target <user-id> --review owner',
         '<%= config.bin %> commitments reports <commitment-id> --remove slack_channel:C0123456',
     ];
     static args = {
@@ -53,12 +56,20 @@ class CommitmentsReports extends base_command_1.BaseCommand {
             options: [...AUTHORABLE_REPORT_DESTINATIONS],
         }),
         target: core_1.Flags.string({
-            description: 'Channel id for slack_channel. App and owner-DM destinations need no target.',
+            description: 'Channel id for slack_channel, or the user id for user_notify. App, owner-DM and email destinations need no target (email goes to your verified account address).',
+        }),
+        review: core_1.Flags.string({
+            description: 'Hold the exact text for approver approval before it is sent to this target (owner)',
+            options: [...data_provider_1.COMMITMENT_REPORT_REVIEW_MODES],
         }),
         on: core_1.Flags.string({
             description: 'When to report (default: material_change)',
             options: [...data_provider_1.COMMITMENT_REPORT_TRIGGERS],
         }),
+        format: core_1.Flags.string({
+            description: 'Optional report format (absent: text)',
+            options: ['text', 'report_v1'],
+        }),
         remove: core_1.Flags.string({
             description: 'Report target to remove: "<destination>" or "<destination>:<target>"',
         }),
@@ -66,6 +77,8 @@ class CommitmentsReports extends base_command_1.BaseCommand {
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(CommitmentsReports);
+        if (flags.format && !flags.add)
+            this.error('--format requires --add.', { exit: 1 });
         if (flags.add && flags.remove) {
             this.error('Pass --add or --remove, not both.', { exit: 1 });
         }
@@ -89,6 +102,9 @@ class CommitmentsReports extends base_command_1.BaseCommand {
         try {
             const current = await (0, commitment_terms_1.loadCommitment)(args.id);
             const reports = current.reports ?? [];
+            if (flags.review && !flags.add) {
+                throw new Error('--review applies to a report being added (--add).');
+            }
             if (flags.add) {
                 const destination = flags.add;
                 if (DESTINATIONS_NEEDING_TARGET.has(destination) && !flags.target) {
@@ -102,8 +118,10 @@ class CommitmentsReports extends base_command_1.BaseCommand {
                 const next = {
                     destination,
                     ...(flags.target ? { destinationTarget: flags.target } : {}),
+                    ...(flags.review ? { review: flags.review } : {}),
                     on: flags.on ?? 'material_change',
                     enabled: true,
+                    ...(flags.format ? { format: flags.format } : {}),
                 };
                 payload = { reports: (0, commitment_terms_1.appendUnique)(reports, next, reportKey, 'Report target') };
             }

package/dist/commands/commitments/update.d.ts

@@ -30,6 +30,7 @@ export default class CommitmentsUpdate extends BaseCommand {
         yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         'from-json': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'if-version': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'task-review-policy': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         title: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'agent-directive': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/commitments/update.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
+const core_1 = require("@oclif/core");
+const commitment_product_1 = require("../../lib/commitment-product");
+const data_provider_2 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 const web_url_1 = require("../../lib/web-url");
@@ -52,6 +54,10 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         'if-version': core_1.Flags.integer({
             description: 'Only update this observed contract version; returns a conflict if it changed',
         }),
+        'task-review-policy': core_1.Flags.string({
+            options: [...data_provider_1.TASK_REVIEW_POLICIES],
+            description: 'Owner choice for generated Tasks; required records a blocker but does not stop the owner close.',
+        }),
         title: core_1.Flags.string({ description: 'New title' }),
         description: core_1.Flags.string({ description: 'New description' }),
         'agent-directive': core_1.Flags.string({
@@ -133,9 +139,22 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
         const wantsCadence = flags.cadence !== undefined ||
             flags['cadence-mode'] !== undefined ||
             flags.timezone !== undefined;
+        let payload;
+        try {
+            payload = await (0, prompt_2.readJsonBody)(flags['from-json']);
+        }
+        catch (err) {
+            this.error(err.message, { exit: 1 });
+        }
+        const authoredDelivery = payload.delivery && typeof payload.delivery === 'object' && !Array.isArray(payload.delivery)
+            ? payload.delivery
+            : undefined;
         // Read-modify-write: only pay the extra round-trip when we must merge.
         let current;
-        if (wantsTarget || wantsCadence) {
+        if (wantsTarget ||
+            wantsCadence ||
+            authoredDelivery ||
+            flags['task-review-policy'] !== undefined) {
             try {
                 const res = await commitments_1.commitmentApi.get(args.id);
                 current = res?.commitment;
@@ -147,11 +166,22 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
                 this.error(`Commitment ${args.id} not found.`, { exit: 4 });
             }
         }
-        let payload;
         try {
-            payload = await (0, prompt_2.readJsonBody)(flags['from-json']);
             if (flags['if-version'] !== undefined)
                 payload.expectedVersion = flags['if-version'];
+            if (authoredDelivery || flags['task-review-policy'] !== undefined) {
+                payload.delivery = {
+                    ...(current?.delivery || { version: 1, mode: 'report_only' }),
+                    ...authoredDelivery,
+                    ...(flags['task-review-policy'] !== undefined
+                        ? { reviewPolicy: (0, commitment_product_1.normalizeTaskReviewPolicy)(flags['task-review-policy']) }
+                        : {}),
+                };
+                payload.expectedVersion ??= current?.version;
+            }
+            const declaredDelivery = payload.delivery;
+            if (declaredDelivery?.reviewPolicy !== undefined)
+                (0, commitment_product_1.normalizeTaskReviewPolicy)(declaredDelivery.reviewPolicy);
             if (flags.title)
                 payload.title = flags.title;
             if (flags.description !== undefined)
@@ -168,7 +198,7 @@ class CommitmentsUpdate extends base_command_1.BaseCommand {
                 // generic PATCH with no ceremony at all, while `commitments delete` —
                 // whose data is all still on disk, and which is now restorable —
                 // prompts. Ceremony should track how hard something is to undo.
-                if ((0, data_provider_1.isTerminalCommitmentStatus)(flags.status)) {
+                if ((0, data_provider_2.isTerminalCommitmentStatus)(flags.status)) {
                     let confirmed;
                     try {
                         confirmed = await (0, prompt_1.confirmDestructive)(`Set ${args.id} to ${flags.status}? This ends the Commitment — making it active again means archiving it first, then resuming.`, flags.yes);

package/dist/commands/daemon/install.js

@@ -84,6 +84,10 @@ class DaemonInstall extends core_1.Command {
             // is how a CLI and its daemon end up on different deployments
             // (OSK-279) without anyone doing anything wrong.
             const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['install', ...(0, daemon_binding_1.bindToCliSession)(argv)]);
+            if (code === 0 &&
+                !argv.some((arg) => ['--json', '--help', '-h'].includes(arg))) {
+                this.log('Coding-agent instructions: sign in with `skrr login`, or review installation choices with `skrr instructions setup`.');
+            }
             this.exit(code);
         }
         catch (err) {

package/dist/commands/generate-recovery-code.d.ts

@@ -6,7 +6,9 @@ import { BaseCommand } from '../base-command';
  * POST /api/auth/recovery/generate. The formatted code is printed
  * exactly once to STDOUT; a warning goes to STDERR.
  *
- * Requires an interactive user session (NOT a CI token).
+ * Requires a user sign-in session (NOT a CI token or PAT). When the server
+ * requests a fresh proof, this command verifies it for recovery_code_generate
+ * on the same session before retrying the generation exactly once.
  * On success: any previously-active recovery code is revoked server-side
  * and the new one is returned.
  *
@@ -19,6 +21,16 @@ export default class GenerateRecoveryCode extends BaseCommand {
     static examples: string[];
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        otp: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'backup-code': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'email-code': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private generate;
+    private proofFor;
+    private nonemptyCode;
+    private refuseUnavailableMethod;
+    private refusePasskeyOnly;
+    private refuseStepUp;
+    private handleGenerationError;
 }

package/dist/commands/generate-recovery-code.js

@@ -1,8 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../base-command");
 const api_fetch_1 = require("../lib/api-fetch");
+const prompt_1 = require("../lib/prompt");
+// Include passkey even though this terminal cannot run a WebAuthn ceremony.
+// The server uses this header when choosing the account's strongest proof:
+// omitting passkey would make a passkey-only account fall back to email.
+// A passkey-only challenge is refused below with a first-party web handoff.
+const STEP_UP_HEADERS = { 'X-Step-Up-Methods': 'passkey,totp,backup_code,email_code' };
+const PURPOSE = data_provider_1.RECOVERY_CODE_GENERATE_STEP_UP_PURPOSE;
 /**
  * `skrr generate-recovery-code`
  *
@@ -10,7 +18,9 @@ const api_fetch_1 = require("../lib/api-fetch");
  * POST /api/auth/recovery/generate. The formatted code is printed
  * exactly once to STDOUT; a warning goes to STDERR.
  *
- * Requires an interactive user session (NOT a CI token).
+ * Requires a user sign-in session (NOT a CI token or PAT). When the server
+ * requests a fresh proof, this command verifies it for recovery_code_generate
+ * on the same session before retrying the generation exactly once.
  * On success: any previously-active recovery code is revoked server-side
  * and the new one is returned.
  *
@@ -22,6 +32,8 @@ class GenerateRecoveryCode extends base_command_1.BaseCommand {
     static description = 'Generate a printable account-recovery code. Shown once — store it safely. Recovery codes use letters A-Z and digits 2-7.';
     static examples = [
         '<%= config.bin %> generate-recovery-code',
+        '<%= config.bin %> generate-recovery-code --otp 123456',
+        '<%= config.bin %> generate-recovery-code --backup-code <unused-code>',
         '<%= config.bin %> generate-recovery-code --json',
     ];
     static flags = {
@@ -29,28 +41,60 @@ class GenerateRecoveryCode extends base_command_1.BaseCommand {
             description: 'Output as JSON (for scripting). Code still printed only once.',
             default: false,
         }),
+        otp: core_1.Flags.string({
+            description: 'Current code from your authenticator app when a fresh proof is required',
+            exclusive: ['backup-code', 'email-code'],
+        }),
+        'backup-code': core_1.Flags.string({
+            description: 'Unused two-factor backup code when a fresh proof is required (it is spent)',
+            exclusive: ['otp', 'email-code'],
+        }),
+        'email-code': core_1.Flags.string({
+            description: 'Previously requested one-time email code when a fresh proof is required',
+            exclusive: ['otp', 'backup-code'],
+        }),
     };
     async run() {
         this.requireAuth();
         const { flags } = await this.parse(GenerateRecoveryCode);
-        // Guard: CI tokens cannot generate recovery codes (server also enforces this).
-        if (this.resolvedCredential.kind === 'ci') {
-            this.error('CI tokens cannot generate recovery codes. Run this command from an interactive session (`skrr login`).', { exit: 2 });
+        // Static credentials cannot mint account recovery credentials.
+        if (this.resolvedCredential.kind === 'ci' || this.resolvedCredential.kind === 'pat') {
+            this.error('CI and personal access tokens cannot generate recovery codes. Sign in with `skrr login` first.', { exit: 2 });
         }
         let result;
         try {
-            result = await (0, api_fetch_1.apiFetch)('/api/auth/recovery/generate', {
-                method: 'POST',
-                credential: this.resolvedCredential,
-            });
+            result = await this.generate();
         }
         catch (err) {
-            if (err instanceof api_fetch_1.ApiFetchError) {
-                if (err.status === 401 || err.status === 403) {
-                    this.error('Not authorized to generate a recovery code. Ensure you are signed in with a user-scope session.', { exit: 1 });
-                }
+            const challenge = err instanceof api_fetch_1.ApiFetchError && err.status === 403 ? (0, data_provider_1.stepUpChallengeFromError)(err) : null;
+            if (!challenge)
+                this.handleGenerationError(err);
+            if (challenge.purpose !== PURPOSE) {
+                this.error('The server asked for verification of a different action. Nothing changed.', {
+                    code: 'STEP_UP_PURPOSE_MISMATCH',
+                    exit: 2,
+                });
+            }
+            if (challenge.reason !== 'no_recent_step_up')
+                this.refuseStepUp(challenge);
+            const proof = await this.proofFor(challenge, flags);
+            try {
+                await (0, api_fetch_1.apiFetch)('/api/auth/step-up', {
+                    method: 'POST',
+                    credential: this.resolvedCredential,
+                    headers: STEP_UP_HEADERS,
+                    body: { purpose: PURPOSE, ...proof },
+                });
+            }
+            catch (verifyError) {
+                this.handleApiError(verifyError);
+            }
+            try {
+                result = await this.generate();
+            }
+            catch (retryError) {
+                this.handleGenerationError(retryError);
             }
-            this.handleApiError(err);
         }
         if (flags.json) {
             // JSON mode: print structured output to stdout for scripting.
@@ -75,5 +119,94 @@ class GenerateRecoveryCode extends base_command_1.BaseCommand {
         process.stderr.write(`  Generated at: ${new Date(result.createdAt).toISOString()}\n`);
         process.stderr.write('\n');
     }
+    generate() {
+        return (0, api_fetch_1.apiFetch)('/api/auth/recovery/generate', {
+            method: 'POST',
+            credential: this.resolvedCredential,
+            headers: STEP_UP_HEADERS,
+        });
+    }
+    async proofFor(challenge, flags) {
+        if (challenge.methods.includes('passkey') &&
+            !challenge.methods.includes('totp') &&
+            !challenge.methods.includes('backup_code')) {
+            this.refusePasskeyOnly();
+        }
+        if (flags.otp !== undefined) {
+            if (!challenge.methods.includes('totp'))
+                this.refuseUnavailableMethod();
+            return { token: this.nonemptyCode(flags.otp) };
+        }
+        if (flags['backup-code'] !== undefined) {
+            if (!challenge.methods.includes('backup_code'))
+                this.refuseUnavailableMethod();
+            return { backupCode: this.nonemptyCode(flags['backup-code']) };
+        }
+        if (flags['email-code'] !== undefined) {
+            if (!challenge.methods.includes('email_code'))
+                this.refuseUnavailableMethod();
+            return { emailCode: this.nonemptyCode(flags['email-code']) };
+        }
+        if (!process.stdin.isTTY) {
+            this.error('A fresh identity check is required. Run this command at a terminal, or pass --otp, --backup-code, or a previously requested --email-code. Nothing changed.', { code: 'STEP_UP_PROOF_REQUIRED', exit: 2 });
+        }
+        if (challenge.methods.includes('totp')) {
+            const entered = await (0, prompt_1.prompt)('Authenticator code: ', {
+                hidden: true,
+                output: process.stderr,
+            });
+            return { token: this.nonemptyCode(entered) };
+        }
+        if (challenge.methods.includes('backup_code')) {
+            const entered = await (0, prompt_1.prompt)('Unused two-factor backup code: ', {
+                hidden: true,
+                output: process.stderr,
+            });
+            return { backupCode: this.nonemptyCode(entered) };
+        }
+        if (challenge.methods.includes('email_code')) {
+            try {
+                await (0, api_fetch_1.apiFetch)('/api/auth/step-up/email-code', {
+                    method: 'POST',
+                    credential: this.resolvedCredential,
+                    headers: STEP_UP_HEADERS,
+                    body: { purpose: PURPOSE },
+                });
+            }
+            catch (requestError) {
+                this.handleApiError(requestError);
+            }
+            process.stderr.write('A one-time code was sent to your account email.\n');
+            const entered = await (0, prompt_1.prompt)('Email code: ', { hidden: true, output: process.stderr });
+            return { emailCode: this.nonemptyCode(entered) };
+        }
+        this.refuseUnavailableMethod();
+    }
+    nonemptyCode(value) {
+        const code = value.trim();
+        if (!code)
+            this.error('A verification code cannot be empty. Nothing changed.', { exit: 2 });
+        return code;
+    }
+    refuseUnavailableMethod() {
+        this.error('This login has no identity-check method the CLI can complete. Use Settings → Account in the web app, or enroll an authenticator and try again. Nothing changed.', { code: 'STEP_UP_METHOD_UNAVAILABLE', exit: 2 });
+    }
+    refusePasskeyOnly() {
+        this.error('This account requires a passkey for this identity check. Open Settings → Account in the web app to generate a recovery code. Nothing changed.', { code: 'STEP_UP_PASSKEY_REQUIRED', exit: 2 });
+    }
+    refuseStepUp(challenge) {
+        if (challenge.reason === 'credential_not_session_bound') {
+            this.error('This credential has no sign-in session for an identity check. Run `skrr login` and try again. Nothing changed.', { code: 'STEP_UP_SESSION_UNBOUND', exit: 2 });
+        }
+        this.refuseUnavailableMethod();
+    }
+    handleGenerationError(err) {
+        if (err instanceof api_fetch_1.ApiFetchError && (err.status === 401 || err.status === 403)) {
+            this.error('Not authorized to generate a recovery code. Sign in with a user-scope session.', {
+                exit: 1,
+            });
+        }
+        this.handleApiError(err);
+    }
 }
 exports.default = GenerateRecoveryCode;

package/dist/commands/grants/create.d.ts

@@ -20,6 +20,7 @@ export default class GrantsCreate extends BaseCommand {
         commitment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         provider: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         label: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        access: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         env: import("@oclif/core/lib/interfaces").OptionFlag<string[], import("@oclif/core/lib/interfaces").CustomOptions>;
         daemon: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;