@arcadiasystems/morse-cli 0.8.0 → 0.10.0

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to `@arcadiasystems/morse-cli` are documented here. The
 format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and this
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.10.0] - 2026-09-10
+
+### Added
+
+- **Encrypted commands work on mainnet when you bring a Seal credential.** Mainnet pins no key servers because every operator there is commercial, and the CLI previously had no way to be pointed at one, so `entry add-encrypted`, `entry decrypt` and `file upload --encrypt` simply could not run there.
+
+  `MORSE_SEAL_API_KEY` supplies a credential for Mysten's committee, whose object id and aggregator the SDK already exports; `MORSE_SEAL_API_KEY_NAME` overrides the header for operators that want something other than `X-API-Key`. `MORSE_SEAL_KEY_SERVERS` takes a JSON array of `{ objectId, weight }` for a non-committee operator and wins when both are set. Neither is a flag: a credential in argv leaks through `ps` and shell history, the same reason the signing key is not one.
+
+- **The credential is checked before anything is encrypted.** Seal reads key-server public keys from chain but fetches key shares from the operator, so a wrong credential would let `encrypt` succeed and fail only at `decrypt`, leaving the user paying to store content nobody can read. That exact shape shipped once as the mainnet Seal default, and an unchecked API key would have reintroduced it user-side. Only an explicit `401` or `403` refuses; any other outcome, including the check being unreachable, proceeds, because a flaky pre-flight must never block a working key.
+
+  Verified live: a full encrypt and decrypt round trip on testnet through `MORSE_SEAL_KEY_SERVERS` (the same code path a credential takes), and a bogus `MORSE_SEAL_API_KEY` refused against the real Mysten aggregator with the pre-flight message rather than producing unreadable ciphertext.
+
+## [0.9.0] - 2026-09-10
+### Fixed (config state, found in a whole-package bug hunt)
+
+- **A one-off `--network` permanently rewrote the profile's stored network.** `updateActiveProfile` resolved the network the same way `resolveSettings` does (flag > env > stored > default) and then wrote the result back, even though the caller was only changing the account, publication or collection. So `morse --network testnet use --clear` against a mainnet profile left `"network": "testnet"` on disk, and every later command silently targeted the wrong chain with nothing said. Every active-state mutation was affected: `account import`, `account use`, `use`, `use --clear`, `publication create`, `publication delete`, `collection create`, `collection delete`. An existing profile now keeps its stored network; only a profile being created takes the resolved one. Flags and env vars are per-invocation overrides again, as `CLAUDE.md`'s precedence rule always said.
+- **`config add` on an existing profile destroyed every field it was not given.** It replaced the profile object instead of merging, so `config add default --network testnet` on a profile that had an `rpc`, `uploadRelay`, `account`, `publication` or `collection` silently dropped all of them. The command has always been documented as "create or **update**". It merges now.
+- **`config remove` deleted a profile with no confirmation.** Every other destructive command confirms and honours `--yes`; this one took no `GlobalOptions` at all, so there was not even a flag to skip. It deletes a profile plus its account, publication and collection links and can silently reassign the default, so it now says which profile and, when relevant, what the default becomes.
+- **Collection selection ignored which publication a collection belonged to.** `collection create` selected the new collection as active even when created under an explicit `-P` pointing at some other publication, pairing the active publication with a collection it does not contain. `collection delete` had the mirror bug, clearing a still-valid active collection whenever a same-named one was deleted from an unrelated publication. Collection names are scoped per publication, so both now check the publication too. The existing test asserted the old behaviour and passed vacuously, with no profile written; it has been given a real one and joined by cases for both mismatch directions.
+- `file register --public --recipient` is now refused, matching `file upload`. A public file is readable by anyone, so a recipient list on one is a contradiction rather than a no-op.
+- `--max-tip` help text says it only applies alongside `--upload-relay`.
+
+
+### Fixed
+
+- **`morse file list` works again, on every network.** It walked `suix_queryEvents` over JSON-RPC, which public Sui fullnodes have retired: they answer every JSON-RPC method with "Method not found". The command has been failing on testnet and mainnet alike unless the user passed `--indexer-url` at a source that still spoke the old protocol.
+
+  gRPC is the documented replacement for most Sui reads, but `@mysten/sui`'s gRPC client exposes no event API at all, so it could not be the answer here. Events now come from a Sui GraphQL endpoint, defaulting to the canonical Mysten one for the network. `--indexer-url` still overrides it and now means "a Sui GraphQL endpoint".
+
+  The querier is hand-rolled over `fetch` against one query with one cursor, rather than pulling in a GraphQL client, keeping the dependency surface as-is. A GraphQL error or a non-2xx response raises a network `CliError` (exit 5) rather than an empty page, because reporting "No files" for a broken endpoint is the worst available answer.
+
+  Verified live: a file uploaded to testnet appears in `file list` with no `--indexer-url`, `--hydrate` and `--json` both work against it, and deleting the file reconciles it back out of the listing.
+
+### Changed
+
+- `--indexer-url` now expects a Sui GraphQL endpoint rather than a `suix_queryEvents` JSON-RPC source. Anyone relying on the old flag against a JSON-RPC indexer needs a GraphQL one instead; the previous behaviour could not have been working against a public fullnode regardless.
+- Listing on localnet requires `--indexer-url`, since there is no canonical GraphQL endpoint for it. Previously it would have used the local RPC URL and failed.
+
 ## [0.8.0] - 2026-09-10
 
 Usability pass. Nothing is renamed or removed; every existing spelling keeps working.

package/README.md

@@ -6,15 +6,14 @@ content entries from your terminal, signing with a locally encrypted key.
 Content is stored on [Walrus](https://walrus.xyz); private entries are encrypted
 with [Seal](https://github.com/MystenLabs/seal).
 
-> Status: v0.8.0. Mainnet and testnet are both supported for public content;
+> Status: v0.10.0. Mainnet and testnet are both supported for public content;
 > the command surface is stable.
 >
-> **Encrypted commands are testnet-only.** `entry add-encrypted`, `entry
-> decrypt`, `file upload --encrypt` (and `--recipient`, which implies it), and
-> decrypting a downloaded file all need Seal key servers. Testnet has an open
-> set; mainnet does not, because every mainnet Seal operator is commercial, and
-> the CLI has no flag or env var for supplying one. These commands exit 2 on
-> mainnet with an explanation.
+> **Encrypted commands need Seal key servers.** Testnet has an open set, so
+> they work there out of the box. Mainnet has none, because every mainnet Seal
+> operator is commercial: supply your own credential via `MORSE_SEAL_API_KEY`
+> (see [Seal on mainnet](#seal-on-mainnet)), or these commands exit 2 with an
+> explanation.
 >
 > Everything that does not encrypt works on both networks, including
 > `file upload --public`, `file download` of a public file, and the whole
@@ -114,6 +113,9 @@ Environment variables (override the config file, overridden by flags):
 | `MORSE_NETWORK` | `--network` | `mainnet`, `testnet`, or `localnet`. |
 | `MORSE_WALRUS_UPLOAD_RELAY` | `--upload-relay` | Upload through a Walrus relay instead of the direct fanout. `auto` picks the canonical relay for the network. |
 | `MORSE_WALRUS_MAX_TIP` | `--max-tip` | Cap the relay's per-upload tip, in MIST. Defaults to 10000000 (0.01 SUI). |
+| `MORSE_SEAL_API_KEY` | (none) | Credential for Mysten's Seal committee, enabling encrypted commands on mainnet. |
+| `MORSE_SEAL_API_KEY_NAME` | (none) | Header name for that credential. Defaults to `X-API-Key`. |
+| `MORSE_SEAL_KEY_SERVERS` | (none) | JSON array of `{ objectId, weight }` for a non-committee Seal operator. Wins over `MORSE_SEAL_API_KEY`. |
 | `MORSE_RPC_URL` | `--rpc` | Sui RPC URL override. |
 | `MORSE_ADDRESS` | (no flag) | Active account address, selecting which keystore to use. |
 | `MORSE_PUBLICATION` | `-P, --publication` | Active publication id. |
@@ -281,13 +283,13 @@ also returns the raw `sealIdPrefix` and `sealNonce` as hex, usable as `--prefix`
 
 `file list` reconstructs the file set from contract events. `RecipientFile`
 objects have no on-chain owner index for the shared case, so listing is
-event-derived, not a direct query. By default the command reads events via
-`suix_queryEvents` on the configured Sui RPC. That endpoint is **deprecated**
-(Mysten is sunsetting it), so listing may degrade or stop working on the public
-RPC over time; point `--indexer-url <url>` at any source that speaks
-`suix_queryEvents` (a self-hosted indexer, a third-party endpoint) to stay in
-control. Results are best-effort and eventually consistent (subject to indexer
-lag and retention). Summary rows omit `blobId`/`blobObjectId`; add `--hydrate`
+event-derived, not a direct query. The command reads events from a Sui GraphQL
+endpoint, defaulting to the canonical Mysten one for the network. It used to use
+`suix_queryEvents` over JSON-RPC, which public fullnodes have since retired;
+`@mysten/sui`'s gRPC client exposes no event API, so GraphQL is the transport
+that remains. Point `--indexer-url <url>` at a different GraphQL endpoint (a
+self-hosted indexer, a third-party endpoint) to stay in control. Results are
+best-effort and eventually consistent (subject to indexer lag and retention). Summary rows omit `blobId`/`blobObjectId`; add `--hydrate`
 to fetch the full record per file (one read each) when you need them.
 
 ## Output and scripting
@@ -348,9 +350,10 @@ to fetch the full record per file (one read each) when you need them.
   an operator, use the SDK directly for now.
 - `localnet` is accepted as a network but has no canonical deployment, so it
   fails at startup unless you point the SDK at your own package and registry.
-- `file list` walks a JSON-RPC event query that public Sui fullnodes have
-  retired, so it needs `--indexer-url` pointing at a source that serves the same
-  query. This affects testnet as well as mainnet.
+- `file list` reads events from a Sui GraphQL endpoint, defaulting to the
+  canonical one for the network. `--indexer-url` points it at a different
+  GraphQL endpoint. There is no canonical endpoint for localnet, so listing
+  there requires the flag.
 
 ## Command spellings
 
@@ -371,6 +374,41 @@ for works. These are aliases, not separate commands:
 
 `publication` also answers to `pub`.
 
+## Seal on mainnet
+
+Encrypted commands need Seal key servers. Testnet pins an open set, so they
+work there with no setup. Mainnet pins none: every mainnet Seal operator is
+commercial, so you bring your own.
+
+The usual route is a credential for Mysten's decentralized committee, which
+the CLI already knows the object id and aggregator for:
+
+```sh
+export MORSE_SEAL_API_KEY=your-key-here
+morse --network mainnet file upload ./secret.pdf --encrypt -r 0xrecipient
+```
+
+For an operator that is not the committee, give the servers directly:
+
+```sh
+export MORSE_SEAL_KEY_SERVERS='[{"objectId":"0x...","weight":1}]'
+```
+
+Entries may carry `aggregatorUrl`, `apiKeyName` and `apiKey`; Seal requires
+`aggregatorUrl` on a committee-mode server and forbids it on an independent
+one. `MORSE_SEAL_KEY_SERVERS` takes precedence when both are set.
+
+**Neither is a flag, deliberately.** A credential in argv leaks through `ps`
+and shell history, the same reason the signing key is never a flag either.
+
+Before encrypting anything, the CLI checks the credential against the operator
+and refuses if it comes back `401` or `403`. This matters more than it looks:
+Seal reads key-server public keys from chain but fetches key *shares* from the
+operator, so a bad credential would let encryption succeed and fail only at
+decryption, leaving you paying to store content nobody can ever read. Any other
+outcome, including the check being offline, proceeds normally, because a flaky
+check must never block a working key.
+
 ## When uploads fail: the upload relay
 
 A Walrus upload pushes slivers to every storage node in the committee at once,

package/dist/index.js

@@ -148,7 +148,7 @@ import { Command } from "commander";
 // package.json
 var package_default = {
   name: "@arcadiasystems/morse-cli",
-  version: "0.8.0",
+  version: "0.10.0",
   description: "Command-line interface for the Morse decentralized CMS on Sui.",
   license: "MIT",
   type: "module",
@@ -203,7 +203,7 @@ var package_default = {
     prepublishOnly: "bun run check && bun run build"
   },
   dependencies: {
-    "@arcadiasystems/morse-sdk": "^0.7.0",
+    "@arcadiasystems/morse-sdk": "^0.8.0",
     "@mysten/seal": "1.1.3",
     "@mysten/sui": "2.16.2",
     "@mysten/walrus": "1.1.6",
@@ -220,7 +220,7 @@ var package_default = {
 var DEFAULT_MAX_TIP_MIST = 1e7;
 function buildProgram() {
   const program = new Command;
-  program.name("morse").description("Command-line interface for the Morse decentralized CMS on Sui.").version(package_default.version, "-V, --version", "Print the version and exit").option("--network <network>", "Sui network: mainnet, testnet, or localnet [env: MORSE_NETWORK]").option("-p, --profile <name>", "Config profile to use [env: MORSE_PROFILE]").option("--rpc <url>", "Override the Sui RPC URL [env: MORSE_RPC_URL]").option("--upload-relay <url|auto>", "Upload Walrus blobs through a relay instead of fanning out to every storage node; 'auto' picks the canonical relay for the network. Costs a tip per upload [env: MORSE_WALRUS_UPLOAD_RELAY]").option("--max-tip <mist>", `Cap the per-upload relay tip, in MIST (default: ${DEFAULT_MAX_TIP_MIST}) [env: MORSE_WALRUS_MAX_TIP]`).option("--json", "Output machine-readable JSON on stdout").option("-q, --quiet", "Suppress progress and informational output").option("-y, --yes", "Assume yes for confirmation prompts").option("--debug", "Print stack traces on error").enablePositionalOptions().showHelpAfterError().exitOverride();
+  program.name("morse").description("Command-line interface for the Morse decentralized CMS on Sui.").version(package_default.version, "-V, --version", "Print the version and exit").option("--network <network>", "Sui network: mainnet, testnet, or localnet [env: MORSE_NETWORK]").option("-p, --profile <name>", "Config profile to use [env: MORSE_PROFILE]").option("--rpc <url>", "Override the Sui RPC URL [env: MORSE_RPC_URL]").option("--upload-relay <url|auto>", "Upload Walrus blobs through a relay instead of fanning out to every storage node; 'auto' picks the canonical relay for the network. Costs a tip per upload [env: MORSE_WALRUS_UPLOAD_RELAY]").option("--max-tip <mist>", `Cap the per-upload relay tip, in MIST (default: ${DEFAULT_MAX_TIP_MIST}). Only applies with --upload-relay [env: MORSE_WALRUS_MAX_TIP]`).option("--json", "Output machine-readable JSON on stdout").option("-q, --quiet", "Suppress progress and informational output").option("-y, --yes", "Assume yes for confirmation prompts").option("--debug", "Print stack traces on error").enablePositionalOptions().showHelpAfterError().exitOverride();
   return program;
 }
 
@@ -559,7 +559,7 @@ async function updateActiveProfile(opts, patch, env = process.env) {
   const config = await loadConfig();
   const profileName = opts.profile ?? env.MORSE_PROFILE ?? config.defaultProfile;
   const existing = config.profiles[profileName];
-  const network = coerceNetwork(opts.network ?? env.MORSE_NETWORK ?? existing?.network ?? "testnet");
+  const network = existing?.network ?? coerceNetwork(opts.network ?? env.MORSE_NETWORK ?? "testnet");
   const merged = { ...existing, network, ...patch };
   const profiles = { ...config.profiles, [profileName]: merged };
   const defaultProfile = Object.keys(config.profiles).length === 0 ? profileName : config.defaultProfile;
@@ -988,7 +988,136 @@ import {
   RpcRecipientFilesReader
 } from "@arcadiasystems/morse-sdk";
 import { SuiGrpcClient } from "@mysten/sui/grpc";
-import { SuiJsonRpcClient } from "@mysten/sui/jsonRpc";
+
+// src/config/seal.ts
+import { MAINNET_SEAL_COMMITTEE } from "@arcadiasystems/morse-sdk";
+var DEFAULT_API_KEY_NAME = "X-API-Key";
+function sealServersFromEnv(env = process.env) {
+  const explicit = env.MORSE_SEAL_KEY_SERVERS;
+  if (explicit !== undefined && explicit.length > 0) {
+    return { servers: parseKeyServers(explicit) };
+  }
+  const apiKey = env.MORSE_SEAL_API_KEY;
+  if (apiKey === undefined || apiKey.length === 0) {
+    return;
+  }
+  const apiKeyName = env.MORSE_SEAL_API_KEY_NAME ?? DEFAULT_API_KEY_NAME;
+  return {
+    servers: MAINNET_SEAL_COMMITTEE.map((server) => ({
+      ...server,
+      apiKeyName,
+      apiKey
+    })),
+    ...MAINNET_SEAL_COMMITTEE[0]?.aggregatorUrl === undefined ? {} : { verifyUrl: MAINNET_SEAL_COMMITTEE[0].aggregatorUrl },
+    apiKeyName,
+    apiKey
+  };
+}
+async function assertSealCredentialAccepted(env, fetchImpl = fetch) {
+  if (env.verifyUrl === undefined || env.apiKey === undefined) {
+    return;
+  }
+  let status;
+  try {
+    const response = await fetchImpl(`${env.verifyUrl}/v1/service`, {
+      headers: { [env.apiKeyName ?? DEFAULT_API_KEY_NAME]: env.apiKey }
+    });
+    status = response.status;
+  } catch {
+    return;
+  }
+  if (status === 401 || status === 403) {
+    throw new UsageError(`The Seal operator at ${env.verifyUrl} rejected your credential (HTTP ${status}). Encrypting anyway would produce content you could never decrypt, so this stops here. Check MORSE_SEAL_API_KEY.`);
+  }
+}
+function parseKeyServers(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (cause) {
+    throw new UsageError(`MORSE_SEAL_KEY_SERVERS is not valid JSON: ${String(cause)}`);
+  }
+  if (!Array.isArray(parsed) || parsed.length === 0) {
+    throw new UsageError('MORSE_SEAL_KEY_SERVERS must be a non-empty JSON array of { objectId, weight } entries, e.g. [{"objectId":"0x...","weight":1}].');
+  }
+  return parsed.map((entry, index) => {
+    if (typeof entry !== "object" || entry === null) {
+      throw new UsageError(`MORSE_SEAL_KEY_SERVERS[${index}] is not an object.`);
+    }
+    const { objectId, weight } = entry;
+    if (typeof objectId !== "string" || !objectId.startsWith("0x")) {
+      throw new UsageError(`MORSE_SEAL_KEY_SERVERS[${index}].objectId must be a 0x-prefixed object id.`);
+    }
+    if (typeof weight !== "number" || !Number.isInteger(weight) || weight < 1) {
+      throw new UsageError(`MORSE_SEAL_KEY_SERVERS[${index}].weight must be a positive integer.`);
+    }
+    return entry;
+  });
+}
+
+// src/cli/graphql-events.ts
+function canonicalGraphqlUrl(network) {
+  if (network === "mainnet" || network === "testnet") {
+    return `https://graphql.${network}.sui.io/graphql`;
+  }
+  return;
+}
+var QUERY = `query Events($type: String!, $first: Int!, $after: String) {
+  events(filter: { type: $type }, first: $first, after: $after) {
+    pageInfo { hasNextPage endCursor }
+    nodes { timestamp contents { json type { repr } } }
+  }
+}`;
+
+class GraphqlEventQuerier {
+  #url;
+  #fetch;
+  constructor(url, fetchImpl = fetch) {
+    this.#url = url;
+    this.#fetch = fetchImpl;
+  }
+  async queryEvents(params) {
+    const body = JSON.stringify({
+      query: QUERY,
+      variables: {
+        type: params.query.MoveEventType,
+        first: params.limit ?? 50,
+        after: typeof params.cursor === "string" ? params.cursor : null
+      }
+    });
+    let response;
+    try {
+      response = await this.#fetch(this.#url, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body,
+        ...params.signal === undefined ? {} : { signal: params.signal }
+      });
+    } catch (cause) {
+      throw new CliError(`Could not reach the event source at ${this.#url}.`, ExitCode.Network, { cause });
+    }
+    if (!response.ok) {
+      throw new CliError(`Event source at ${this.#url} returned HTTP ${response.status}.`, ExitCode.Network);
+    }
+    const payload = await response.json();
+    if (payload.errors && payload.errors.length > 0) {
+      throw new CliError(`Event source rejected the query: ${payload.errors[0]?.message ?? "unknown error"}`, ExitCode.Network);
+    }
+    const events = payload.data?.events;
+    const nodes = events?.nodes ?? [];
+    return {
+      data: nodes.map((node) => ({
+        type: node.contents?.type?.repr ?? "",
+        parsedJson: node.contents?.json ?? {},
+        timestampMs: node.timestamp == null ? null : String(Date.parse(node.timestamp) || 0)
+      })),
+      hasNextPage: Boolean(events?.pageInfo?.hasNextPage),
+      nextCursor: events?.pageInfo?.endCursor ?? null
+    };
+  }
+}
+
+// src/cli/context.ts
 async function buildReadContext(command) {
   const opts = globalOptions(command);
   const output = outputFor(command);
@@ -1051,11 +1180,12 @@ async function buildContentContext(command) {
     walrus
   };
 }
-function assertSealAvailable(config) {
-  if (config.sealKeyServers.length > 0) {
-    return;
+function buildSeal(config, client) {
+  const fromEnv = sealServersFromEnv();
+  if (fromEnv === undefined && config.sealKeyServers.length === 0) {
+    throw new CliError(`Encrypted commands are not available on ${config.network}: it pins no Seal key servers, because every operator there is commercial. Set MORSE_SEAL_API_KEY if you have a credential for Mysten's committee, or MORSE_SEAL_KEY_SERVERS to a JSON array for another operator. Otherwise use --network testnet.`, ExitCode.Usage);
   }
-  throw new CliError(`Encrypted commands are not available on ${config.network}. Seal key servers there are operated commercially and the CLI cannot yet be pointed at one. Use --network testnet, or drive @arcadiasystems/morse-sdk directly with your own seal.serverConfigs.`, ExitCode.Usage);
+  return DefaultSealAdapter.fromMorseConfig(config, fromEnv === undefined ? {} : { serverConfigs: fromEnv.servers }, client);
 }
 function walrusWriteConfig(base, network) {
   const host = resolveUploadRelay(base.settings.uploadRelay, network);
@@ -1070,6 +1200,10 @@ function walrusWriteConfig(base, network) {
 }
 async function buildEncryptContext(command) {
   const ctx = await buildContentContext(command);
+  const fromEnv = sealServersFromEnv();
+  if (fromEnv !== undefined) {
+    await assertSealCredentialAccepted(fromEnv);
+  }
   return { ...ctx, seal: lazySeal(ctx) };
 }
 function walrusReadAdapter(base, network, viaAggregator) {
@@ -1098,8 +1232,7 @@ async function buildDecryptContext(command, opts = {}) {
   if (network === "localnet") {
     throw new CliError("Seal decryption is not available on localnet. Use testnet or mainnet.", ExitCode.Usage);
   }
-  assertSealAvailable(base.config);
-  const seal = DefaultSealAdapter.fromMorseConfig(base.config, {}, base.client);
+  const seal = buildSeal(base.config, base.client);
   return {
     ...base,
     keypair,
@@ -1127,8 +1260,7 @@ async function buildFileDownloadContext(command, opts = {}) {
 function lazySeal(base) {
   let adapter;
   return () => {
-    assertSealAvailable(base.config);
-    adapter ??= DefaultSealAdapter.fromMorseConfig(base.config, {}, base.client);
+    adapter ??= buildSeal(base.config, base.client);
     return adapter;
   };
 }
@@ -1138,16 +1270,16 @@ async function buildFileListContext(command, opts = {}) {
   if (originPackageId === undefined) {
     throw new CliError("File listing is unavailable on this network: no recipientFileEventOriginPackageId in the config. Use testnet, or supply a config that sets it.", ExitCode.Usage);
   }
-  const events = new SuiJsonRpcClient({
-    network: base.settings.network,
-    url: opts.indexerUrl ?? base.config.rpcUrl
-  });
+  const indexerUrl = opts.indexerUrl ?? canonicalGraphqlUrl(base.settings.network);
+  if (indexerUrl === undefined) {
+    throw new CliError(`File listing has no canonical event source for ${base.settings.network}. Pass --indexer-url pointing at a Sui GraphQL endpoint.`, ExitCode.Usage);
+  }
   return {
     ...base,
     filesReader: RpcRecipientFilesReader.fromConfig(base.client, {
       packageId: base.config.packageId
     }),
-    events,
+    events: new GraphqlEventQuerier(indexerUrl),
     eventTypes: buildRecipientFileEventTypes(originPackageId)
   };
 }
@@ -1528,6 +1660,9 @@ async function runCollectionList(ctx, options) {
     collections: publication.collections
   });
 }
+function isActivePublication(ctx, target) {
+  return ctx.settings.publication === target;
+}
 async function runCollectionCreate(ctx, name, options, gopts) {
   const id = await resolvePublication(ctx, options.publication);
   const storageMode = coerceStorageMode(options.mode);
@@ -1543,8 +1678,11 @@ async function runCollectionCreate(ctx, name, options, gopts) {
     storageMode,
     signal: ctx.signal
   });
-  await updateActiveProfile(gopts, { collection: name });
-  ctx.output.result(`Created collection "${name}". Selected as the active collection. (tx: ${result.digest})`, result);
+  const selected = isActivePublication(ctx, id);
+  if (selected) {
+    await updateActiveProfile(gopts, { collection: name });
+  }
+  ctx.output.result(`Created collection "${name}".${selected ? " Selected as the active collection." : ""} (tx: ${result.digest})`, result);
 }
 async function runCollectionDelete(ctx, name, options, gopts) {
   const id = await resolvePublication(ctx, options.publication);
@@ -1566,7 +1704,7 @@ async function runCollectionDelete(ctx, name, options, gopts) {
     name,
     signal: ctx.signal
   });
-  if (ctx.settings.collection === name) {
+  if (ctx.settings.collection === name && isActivePublication(ctx, id)) {
     await updateActiveProfile(gopts, { collection: undefined });
   }
   ctx.output.result(`Deleted collection "${name}". (tx: ${result.digest})`, result);
@@ -1606,6 +1744,7 @@ async function runConfigAdd(output, name, options) {
   const profiles = {
     ...cfg.profiles,
     [name]: {
+      ...cfg.profiles[name],
       network,
       ...options.rpc === undefined ? {} : { rpc: options.rpc },
       ...options.uploadRelay === undefined ? {} : { uploadRelay: options.uploadRelay }
@@ -1627,11 +1766,19 @@ async function runConfigUse(output, name) {
   await saveConfig({ ...cfg, defaultProfile: name });
   output.result(`Default profile set to "${name}".`, { defaultProfile: name });
 }
-async function runConfigRemove(output, name) {
+async function runConfigRemove(output, name, gopts = {}, signal) {
   const cfg = await loadConfig();
   requireProfile(cfg, name);
   const { [name]: _removed, ...rest } = cfg.profiles;
   const defaultProfile = cfg.defaultProfile === name ? Object.keys(rest)[0] ?? "default" : cfg.defaultProfile;
+  const reassigns = cfg.defaultProfile === name && defaultProfile !== name;
+  const proceed = await confirm(`Delete profile "${name}"?${reassigns ? ` The default becomes "${defaultProfile}".` : ""}`, {
+    assumeYes: Boolean(gopts.yes),
+    ...signal === undefined ? {} : { signal }
+  });
+  if (!proceed) {
+    cancelled();
+  }
   await saveConfig({ ...cfg, profiles: rest, defaultProfile });
   output.result(`Removed profile "${name}".`, {
     removed: name,
@@ -1654,7 +1801,7 @@ function registerConfigCommands(program) {
     await runConfigUse(outputFor(command), name);
   });
   config.command("remove <name>").alias("delete").description("Delete a profile").action(async (name, _options, command) => {
-    await runConfigRemove(outputFor(command), name);
+    await runConfigRemove(outputFor(command), name, globalOptions(command), sigintSignal());
   });
 }
 function requireProfile(config, name) {
@@ -2129,6 +2276,9 @@ async function runFileRegister(ctx, options) {
     throw new UsageError("Pass --public or --encrypted, not both.");
   }
   const recipients = (options.recipient ?? []).map((r) => toSuiAddress4(r));
+  if (options.public && recipients.length > 0) {
+    throw new UsageError("--recipient applies to encrypted files; a public file is readable by anyone.");
+  }
   const blobId = toWalrusBlobId(options.blobId);
   const size = parseByteSize(options.size, "--size");
   const blobObjectId = options.blobObjectId === undefined ? undefined : toBlobObjectId(options.blobObjectId);

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@arcadiasystems/morse-cli",
-	"version": "0.8.0",
+	"version": "0.10.0",
 	"description": "Command-line interface for the Morse decentralized CMS on Sui.",
 	"license": "MIT",
 	"type": "module",
@@ -55,7 +55,7 @@
 		"prepublishOnly": "bun run check && bun run build"
 	},
 	"dependencies": {
-		"@arcadiasystems/morse-sdk": "^0.7.0",
+		"@arcadiasystems/morse-sdk": "^0.8.0",
 		"@mysten/seal": "1.1.3",
 		"@mysten/sui": "2.16.2",
 		"@mysten/walrus": "1.1.6",