When didbot operate --fingerprint admits a key that didbot register parked, the server now mints no account token for it, and bot.did.createAccount answers accountToken: null. The machine that parked the key signs in with that key and keeps its own session, so the operator's machine no longer holds a second live credential for the host. The CLI stores nothing for a parked admission and prints that the host signs itself in. If an older server still sends a token, the CLI drops it without writing it. Direct creates (--kind, --oidc, no parked key) still hand the session to the operator's machine.
The lexicon lists accountToken as nullable. A CLI built before this change cannot parse the null and fails a parked admission, so roll out the new client before the new server.
Owner decision: lexicon. accountToken is required in lexicons/bot/did/createAccount.json. This PR makes it nullable, so a parked-key admission can answer with no token. That's a lexicon field change. The alternative with no lexicon change is for the server to keep minting the token and revoke it at once, while the CLI discards it. Rollout: ship the client before the server; old clients misread null.
🤖 Generated with Claude Code