@skrr-ai/cli 0.1.94 → 0.1.96

package/dist/commands/machines/list.js

@@ -37,16 +37,16 @@ class MachinesList extends base_command_1.BaseCommand {
         catch (err) {
             this.handleApiError(err);
         }
+        const all = machines ?? [];
+        const shown = flags.all ? all : all.filter((m) => (0, machines_1.isReachableMachine)(m));
         if (flags.json) {
-            this.log(JSON.stringify(machines, null, 2));
+            this.log(JSON.stringify(shown, null, 2));
             return;
         }
-        if (!machines || machines.length === 0) {
+        if (all.length === 0) {
             this.log('No machines. Install a daemon with `skrr harnesses install-token`.');
             return;
         }
-        const all = machines;
-        const shown = flags.all ? all : all.filter((m) => (0, machines_1.isReachableMachine)(m));
         if (shown.length === 0) {
             this.log(`No machine is reachable right now (${(0, machines_1.hiddenMachinesSummary)(all)}) — see them with --all.`);
             return;

package/dist/commands/measures/confirm.d.ts

@@ -1,11 +1,5 @@
 import { BaseCommand } from '../../base-command';
-/**
- * `skrr measures confirm` — turn a claim into ground truth.
- *
- * This is the human-in-the-loop step whose `agentOutcome` equivalent shipped
- * with zero callers, which left every value claim in the system permanently
- * unverified.
- */
+/** Confirm a reading and display the server-derived attribution. */
 export default class MeasuresConfirm extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/measures/confirm.js

@@ -1,17 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const measures_1 = require("../../lib/measures");
-/**
- * `skrr measures confirm` — turn a claim into ground truth.
- *
- * This is the human-in-the-loop step whose `agentOutcome` equivalent shipped
- * with zero callers, which left every value claim in the system permanently
- * unverified.
- */
+/** Confirm a reading and display the server-derived attribution. */
 class MeasuresConfirm extends base_command_1.BaseCommand {
-    static description = 'Confirm an observation (marks it as ground truth)';
+    static description = 'Confirm an observation with credential-derived evidence attribution';
     static examples = [
         '<%= config.bin %> measures confirm <measure-id> --at 2026-07-28T00:00:00Z',
         '<%= config.bin %> measures confirm <measure-id> --latest',
@@ -22,7 +17,9 @@ class MeasuresConfirm extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         at: core_1.Flags.string({ description: 'observedAt of the reading to confirm (ISO-8601)' }),
-        latest: core_1.Flags.boolean({ description: 'Confirm the most recent unconfirmed reading' }),
+        latest: core_1.Flags.boolean({
+            description: 'Confirm the most recent reading lacking person confirmation',
+        }),
     };
     async run() {
         this.requireAuth();
@@ -33,19 +30,23 @@ class MeasuresConfirm extends base_command_1.BaseCommand {
                 this.error('Specify --at <iso-instant> or --latest.');
             }
             const measure = await measures_1.measureApi.get(args.measureId);
-            const unconfirmed = measure.observations.filter((o) => !o.confirmed);
-            if (unconfirmed.length === 0) {
-                this.log('Nothing to confirm — every reading is already confirmed.');
+            const selection = (0, data_provider_1.latestConfirmableMeasureReading)(measure.observations);
+            if (selection.ambiguous) {
+                this.error('Multiple retained readings have the same timestamp; the existing confirmation endpoint cannot distinguish them. No confirmation was sent.');
+            }
+            const unconfirmed = selection.reading;
+            if (!unconfirmed) {
+                this.log('Nothing to confirm — no eligible reading lacking person confirmation is available.');
                 return;
             }
-            observedAt = unconfirmed[unconfirmed.length - 1].observedAt;
+            observedAt = unconfirmed.observedAt;
         }
         const measure = await measures_1.measureApi.confirm(args.measureId, observedAt);
         if (flags.json) {
             this.log(JSON.stringify(measure, null, 2));
             return;
         }
-        this.log(`Confirmed. ${measure.rollup.confirmedCount}/${measure.rollup.observationCount} readings are ground truth.`);
+        this.log((0, measures_1.recordConfirmationForObservation)(measure.observations.find((o) => Date.parse(o.observedAt) === Date.parse(observedAt))).message);
     }
 }
 exports.default = MeasuresConfirm;

package/dist/commands/measures/list.d.ts

@@ -1,11 +1,5 @@
 import { BaseCommand } from '../../base-command';
-/**
- * `skrr measures list` — what an agent is supposed to move.
- *
- * The CONFIRMED column is `confirmed/total`: an agent-reported reading is a
- * claim until a human confirms it, and collapsing the two would reproduce the
- * unverified-self-estimate problem with a unit attached.
- */
+/** Read numeric movement alongside server-derived evidence counts. */
 export default class MeasuresList extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/measures/list.js

@@ -4,13 +4,7 @@ const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const measures_1 = require("../../lib/measures");
 const triggers_1 = require("../../lib/triggers");
-/**
- * `skrr measures list` — what an agent is supposed to move.
- *
- * The CONFIRMED column is `confirmed/total`: an agent-reported reading is a
- * claim until a human confirms it, and collapsing the two would reproduce the
- * unverified-self-estimate problem with a unit attached.
- */
+/** Read numeric movement alongside server-derived evidence counts. */
 class MeasuresList extends base_command_1.BaseCommand {
     static description = 'List measures (numeric outcomes with unit + baseline)';
     static examples = [

package/dist/commands/measures/record.js

@@ -23,8 +23,8 @@ class MeasuresRecord extends base_command_1.BaseCommand {
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         source: core_1.Flags.string({
-            description: 'Where the reading came from (manual entries are immediately confirmed ground truth)',
-            options: [...measures_1.MEASURE_OBSERVATION_SOURCES],
+            description: 'Declared source; credential-derived evidence is reported by the server',
+            options: [...measures_1.MEASURE_WRITABLE_SOURCES],
             default: 'manual',
         }),
         at: core_1.Flags.string({ description: 'Observation instant (ISO-8601); defaults to now' }),
@@ -44,13 +44,13 @@ class MeasuresRecord extends base_command_1.BaseCommand {
             note: flags.note,
             evidence: flags.evidence,
         });
-        const confirmation = (0, measures_1.recordConfirmationForSource)(flags.source);
+        const confirmation = (0, measures_1.recordConfirmationForObservation)(measure.observations.at(-1));
         if (flags.json) {
             this.log(JSON.stringify({ ...measure, record: { source: flags.source, confirmation } }, null, 2));
             return;
         }
         const r = measure.rollup;
-        this.log(`Recorded ${value} on ${measure.label}${confirmation.status === 'confirmed' ? ' and confirmed.' : '.'}`);
+        this.log(`Recorded ${value} on ${measure.label}.`);
         if (r.delta !== null) {
             this.log(`  ${r.baseline} → ${r.latest} (${r.delta > 0 ? '+' : ''}${r.delta}) — ${r.improved === null
                 ? 'no direction'

package/dist/commands/measures/show.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base-command';
+export default class MeasuresShow extends BaseCommand {
+    static description: string;
+    static args: {
+        measureId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/measures/show.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const measures_1 = require("../../lib/measures");
+class MeasuresShow extends base_command_1.BaseCommand {
+    static description = 'Show measure readings, credential provenance and target revisions';
+    static args = { measureId: core_1.Args.string({ required: true, ignoreStdin: true }) };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output as JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args, flags } = await this.parse(MeasuresShow);
+        const measure = await measures_1.measureApi.get(args.measureId);
+        if (flags.json) {
+            this.log(JSON.stringify(measure, null, 2));
+            return;
+        }
+        this.log(`${measure.label} (${measure.id})`);
+        for (const o of measure.observations)
+            this.log(`${o.observedAt} ${o.value}: ${o.provenance ? (0, data_provider_1.describeMeasureEvidence)(o.provenance.level, o.provenance.confirmedBy || o.provenance.recordedBy) : 'Before provenance tracking'}; declared ${o.source}; by ${o.provenance?.recordedBy?.kind || 'unattributed'} via ${o.provenance?.recordedBy?.via || 'unknown'}`);
+        for (const revision of measure.revisions || [])
+            this.log(`${revision.at} ${revision.by.kind} via ${revision.by.via}: ${revision.changes.map((c) => `${c.field} ${JSON.stringify(c.from)} → ${JSON.stringify(c.to)}`).join(', ')}`);
+    }
+}
+exports.default = MeasuresShow;

package/dist/commands/northstars/governance/configure.d.ts

@@ -29,6 +29,7 @@ export default class NorthstarsGovernanceConfigure extends BaseCommand {
         'min-interval-hours': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'max-interval-hours': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'max-relative-change': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'max-observation-runs-per-day': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'max-runs-per-day': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'max-concurrent-runs': import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         'critical-reserve': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/northstars/governance/configure.js

@@ -84,8 +84,13 @@ class NorthstarsGovernanceConfigure extends base_command_1.BaseCommand {
         'max-relative-change': core_1.Flags.string({
             description: 'Largest single-step relative change a bounded-auto adjustment may make (0..1)',
         }),
+        'max-observation-runs-per-day': core_1.Flags.integer({
+            description: 'Opt-in portfolio observation runs per UTC day',
+            min: 0,
+            max: 10000,
+        }),
         'max-runs-per-day': core_1.Flags.integer({
-            description: 'Portfolio-wide observation budget (execution, NOT attention)',
+            description: 'Portfolio-wide action run budget (execution, NOT attention)',
             min: 0,
             max: 10000,
         }),
@@ -145,6 +150,8 @@ class NorthstarsGovernanceConfigure extends base_command_1.BaseCommand {
         if (Object.keys(cadencePolicy).length)
             body.cadencePolicy = cadencePolicy;
         const executionBudget = {};
+        if (flags['max-observation-runs-per-day'] !== undefined)
+            executionBudget.maxObservationRunsPerDay = flags['max-observation-runs-per-day'];
         if (flags['max-runs-per-day'] !== undefined) {
             executionBudget.maxRunsPerDay = flags['max-runs-per-day'];
         }

package/dist/commands/proposals/discard.d.ts

@@ -0,0 +1,5 @@
+import { ProposalDecisionCommand } from '../../lib/proposal-decision-command';
+export default class ProposalsDiscard extends ProposalDecisionCommand {
+    static description: string;
+    static decision: "discard";
+}

package/dist/commands/proposals/discard.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const proposal_decision_command_1 = require("../../lib/proposal-decision-command");
+class ProposalsDiscard extends proposal_decision_command_1.ProposalDecisionCommand {
+    static description = 'Discard one displayed proposal through its domain authority';
+    static decision = 'discard';
+}
+exports.default = ProposalsDiscard;

package/dist/commands/proposals/keep.d.ts

@@ -0,0 +1,5 @@
+import { ProposalDecisionCommand } from '../../lib/proposal-decision-command';
+export default class ProposalsKeep extends ProposalDecisionCommand {
+    static description: string;
+    static decision: "keep";
+}

package/dist/commands/proposals/keep.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const proposal_decision_command_1 = require("../../lib/proposal-decision-command");
+class ProposalsKeep extends proposal_decision_command_1.ProposalDecisionCommand {
+    static description = 'Keep one displayed proposal through its domain authority';
+    static decision = 'keep';
+}
+exports.default = ProposalsKeep;

package/dist/commands/proposals/list.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base-command';
+export default class ProposalsList extends BaseCommand {
+    static description: string;
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        kind: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        disposition: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'commitment-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'agent-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        sort: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/proposals/list.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const proposals_1 = require("../../lib/proposals");
+const format_1 = require("../../lib/format");
+/** A snoozed proposal reads `proposed` in its disposition; the wake time is what tells them apart. */
+function noteFor(row) {
+    if (row.sourceStatus === 'snoozed' && row.snoozedUntil)
+        return `snoozed until ${row.snoozedUntil}`;
+    if (!row.canDecide && row.undecidableReason && row.undecidableReason !== 'settled')
+        return data_provider_1.PROPOSAL_UNDECIDABLE_TEXT[row.undecidableReason];
+    return '—';
+}
+class ProposalsList extends base_command_1.BaseCommand {
+    static description = 'List the bounded proposal inbox and source coverage';
+    static flags = {
+        json: core_1.Flags.boolean(),
+        kind: core_1.Flags.string({ options: [...data_provider_1.PROPOSAL_KINDS] }),
+        disposition: core_1.Flags.string({ options: [...data_provider_1.PROPOSAL_DISPOSITIONS] }),
+        'commitment-id': core_1.Flags.string(),
+        'agent-id': core_1.Flags.string(),
+        limit: core_1.Flags.integer({ min: 1, max: 100, default: 50 }),
+        cursor: core_1.Flags.string(),
+        sort: core_1.Flags.string({ options: ['recent', 'value'], default: 'recent' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(ProposalsList);
+        let result;
+        try {
+            result = await proposals_1.proposalApi.list({
+                kind: flags.kind,
+                disposition: flags.disposition,
+                commitmentId: flags['commitment-id'],
+                agentId: flags['agent-id'],
+                limit: flags.limit,
+                cursor: flags.cursor,
+                sort: flags.sort,
+            });
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+        if (flags.json) {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        (0, format_1.renderTable)(result.data.map((row) => ({
+            id: row.id,
+            title: row.title,
+            disposition: row.disposition,
+            basis: row.economics?.basis || 'unknown',
+            deadline: row.deadline || '—',
+            note: noteFor(row),
+        })), [
+            { key: 'id', header: 'PROPOSAL', verbatim: true },
+            { key: 'title', header: 'TITLE' },
+            { key: 'disposition', header: 'DISPOSITION' },
+            { key: 'basis', header: 'BASIS' },
+            { key: 'deadline', header: 'DEADLINE' },
+            { key: 'note', header: 'NOTE' },
+        ], (line) => this.log(line));
+        if (!result.coverage.complete)
+            this.log(`Partial coverage: ${result.coverage.sources
+                .filter((source) => source.status !== 'available')
+                .map((source) => `${source.kind}:${source.status}`)
+                .join(', ')}`);
+        if (result.nextCursor)
+            this.log(`Next cursor: ${result.nextCursor}`);
+    }
+}
+exports.default = ProposalsList;

package/dist/commands/proposals/show.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base-command';
+export default class ProposalsShow extends BaseCommand {
+    static description: string;
+    static args: {
+        kind: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/proposals/show.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const proposals_1 = require("../../lib/proposals");
+class ProposalsShow extends base_command_1.BaseCommand {
+    static description = 'Show one viewer-scoped proposal and its frozen revision';
+    static args = {
+        kind: core_1.Args.string({ required: true, options: [...data_provider_1.PROPOSAL_KINDS], ignoreStdin: true }),
+        id: core_1.Args.string({ required: true, ignoreStdin: true }),
+    };
+    static flags = { json: core_1.Flags.boolean() };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(ProposalsShow);
+        let result;
+        try {
+            result = await proposals_1.proposalApi.show(args.kind, args.id);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = ProposalsShow;

package/dist/commands/proposals/snooze.d.ts

@@ -0,0 +1,5 @@
+import { ProposalDecisionCommand } from '../../lib/proposal-decision-command';
+export default class ProposalsSnooze extends ProposalDecisionCommand {
+    static description: string;
+    static decision: "snooze";
+}

package/dist/commands/proposals/snooze.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const proposal_decision_command_1 = require("../../lib/proposal-decision-command");
+class ProposalsSnooze extends proposal_decision_command_1.ProposalDecisionCommand {
+    static description = 'Snooze one displayed proposal through its domain authority';
+    static decision = 'snooze';
+}
+exports.default = ProposalsSnooze;

package/dist/commands/security/overview.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base-command';
+/** A single read of the three owner-only Security Center surfaces. */
+export default class SecurityOverview extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/security/overview.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+function rows(value, name) {
+    if (!Array.isArray(value))
+        throw new Error(`Security overview: invalid ${name} response`);
+    if (value.some((row) => row === null || typeof row !== 'object' || Array.isArray(row))) {
+        throw new Error(`Security overview: invalid ${name} row`);
+    }
+    return value;
+}
+function hasMore(value, name) {
+    if (typeof value !== 'boolean') {
+        throw new Error(`Security overview: invalid ${name} pagination`);
+    }
+    return value;
+}
+function activeTokens(value) {
+    const tokens = rows(value, 'access tokens');
+    // A missing or unfamiliar state must not turn an active credential into a
+    // reassuring "None". Validate the whole list before filtering it.
+    if (tokens.some((row) => typeof row.state !== 'string' || !['active', 'expired', 'revoked'].includes(row.state))) {
+        throw new Error('Security overview: invalid access token state');
+    }
+    return tokens.filter((row) => row.state === 'active');
+}
+function string(value) {
+    return typeof value === 'string' ? value : null;
+}
+/** Explicit allow-lists: the sessions API also returns a full IP address. */
+function safeSession(row) {
+    return {
+        id: string(row.id) ?? '',
+        kind: string(row.kind) ?? 'unknown',
+        device: string(row.device) ?? 'Unknown device',
+        label: string(row.label),
+        daemonId: string(row.daemonId),
+        network: string(row.network),
+        country: string(row.country),
+        createdAt: string(row.createdAt),
+        lastActiveAt: string(row.lastActiveAt),
+        current: row.current === true,
+    };
+}
+function safeActivity(row) {
+    const device = row.device && typeof row.device === 'object' && !Array.isArray(row.device)
+        ? row.device
+        : {};
+    const session = row.session && typeof row.session === 'object' && !Array.isArray(row.session)
+        ? row.session
+        : {};
+    return {
+        id: string(row.id) ?? '',
+        action: string(row.action) ?? 'unknown',
+        outcome: string(row.outcome) ?? 'unknown',
+        method: string(row.method),
+        device: string(device.label),
+        network: string(row.network),
+        country: string(row.country),
+        newDevice: row.newDevice === true,
+        reportedNotMe: row.reportedNotMe === true,
+        createdAt: string(row.createdAt) ?? '',
+        sessionId: string(session.id),
+    };
+}
+function safeToken(row) {
+    return {
+        id: string(row.id) ?? '',
+        name: string(row.name) ?? '',
+        lastFour: string(row.lastFour) ?? '',
+        scopes: Array.isArray(row.scopes)
+            ? row.scopes.filter((v) => typeof v === 'string')
+            : [],
+        expiresAt: string(row.expiresAt),
+        lastUsedAt: string(row.lastUsedAt),
+    };
+}
+/** A single read of the three owner-only Security Center surfaces. */
+class SecurityOverview extends base_command_1.BaseCommand {
+    static description = 'Review active sessions, recent security activity, and access tokens';
+    static examples = [
+        '<%= config.bin %> security overview',
+        '<%= config.bin %> security overview --limit 50 --json',
+    ];
+    static flags = {
+        limit: core_1.Flags.integer({
+            description: 'Sessions and events to show (default 25, maximum 100)',
+            min: 1,
+            max: 100,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(SecurityOverview);
+        const limit = flags.limit ?? 25;
+        let sessionPage;
+        let activityPage;
+        let tokenPage;
+        try {
+            // All three reads must succeed. A partial response could claim an
+            // account has no sessions or tokens when a Security Center read failed.
+            [sessionPage, activityPage, tokenPage] = await Promise.all([
+                (0, api_fetch_1.apiFetch)(`/api/auth/sessions/refresh?limit=${limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)(`/api/user/security-activity?limit=${limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)('/api/user/access-tokens', {
+                    credential: this.resolvedCredential,
+                }),
+            ]);
+            const sessions = rows(sessionPage?.sessions, 'sessions').map(safeSession);
+            const activity = rows(activityPage?.events, 'activity').map(safeActivity);
+            const accessTokens = activeTokens(tokenPage?.accessTokens).map(safeToken);
+            const overview = {
+                sessions,
+                sessionsHaveMore: hasMore(sessionPage?.hasMore, 'sessions'),
+                activity,
+                activityHasMore: hasMore(activityPage?.hasMore, 'activity'),
+                accessTokens,
+            };
+            if (flags.json) {
+                this.log(JSON.stringify(overview, null, 2));
+                return;
+            }
+            this.log(`Active sessions (${sessions.length}${overview.sessionsHaveMore ? '+' : ''}):`);
+            for (const s of sessions) {
+                this.log(`  ${s.id}  ${s.current ? '[this session] ' : ''}${s.label || s.device}  ${s.kind}  ${s.country || s.network || 'unknown location'}  last active ${s.lastActiveAt || 'unknown'}`);
+            }
+            if (!sessions.length)
+                this.log('  None.');
+            this.log(`Recent security activity (${activity.length}${overview.activityHasMore ? '+' : ''}):`);
+            for (const event of activity) {
+                this.log(`  ${event.createdAt}  ${event.action} (${event.outcome})  ${event.device || 'unknown device'}  ${event.country || event.network || 'unknown location'}${event.newDevice ? '  NEW DEVICE' : ''}${event.reportedNotMe ? '  REPORTED' : ''}  ${event.id}`);
+            }
+            if (!activity.length)
+                this.log('  None.');
+            this.log(`Active access tokens (${accessTokens.length}):`);
+            for (const token of accessTokens) {
+                this.log(`  ${token.id}  ${token.name}  …${token.lastFour}  expires ${token.expiresAt || 'unknown'}`);
+            }
+            if (!accessTokens.length)
+                this.log('  None.');
+            if (overview.sessionsHaveMore || overview.activityHasMore) {
+                this.log('More sessions or events are available in Account settings; increase --limit to see up to 100 here.');
+            }
+            this.log('To review an unfamiliar sign-in and secure your account, open Account settings > Security activity.');
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = SecurityOverview;

package/dist/commands/signals/monitors/create.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../../base-command';
+export default class MonitorsCreate extends BaseCommand {
+    static description: string;
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'from-json': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/signals/monitors/create.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../../base-command");
+const signals_1 = require("../../../lib/signals");
+const prompt_1 = require("../../../lib/prompt");
+class MonitorsCreate extends base_command_1.BaseCommand {
+    static description = 'Validate, then create, a Signal Monitor (a repeated monitorId answers 409: use revise)';
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+        'from-json': core_1.Flags.string({
+            description: 'Monitor definition JSON file path, or - for stdin',
+            required: true,
+        }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(MonitorsCreate);
+        const body = await (0, prompt_1.readJsonBody)(flags['from-json']);
+        // Validation runs first so a refusal never reaches the writer, and the
+        // compiled summary is shown before anything is persisted.
+        const validation = await signals_1.signalsApi.validateMonitor(body);
+        if (!flags.json)
+            this.log(JSON.stringify(validation, null, 2));
+        const result = await signals_1.signalsApi.createMonitor(body);
+        this.log(JSON.stringify(flags.json ? { validation, ...result } : result, null, 2));
+    }
+}
+exports.default = MonitorsCreate;

package/dist/commands/signals/monitors/list.d.ts

@@ -0,0 +1,8 @@
+import { BaseCommand } from '../../../base-command';
+export default class MonitorsList extends BaseCommand {
+    static description: string;
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}