@ardennguyen/zalo-agent-cli 2.5.8 → 3.0.0

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@ardennguyen/zalo-agent-cli",
-    "version": "2.5.8",
-    "description": "CLI tool for Zalo automation — multi-account, proxy, bank transfers, QR payments, Official Account API v3.0",
+    "version": "3.0.0",
+    "description": "CLI and MCP server for Zalo automation, on its own Zalo-protocol engine — multi-account, proxy, bank transfers, QR payments, Official Account API v3.0",
     "type": "module",
     "bin": {
         "zalo-agent": "src/index.js"
@@ -12,18 +12,16 @@
         "DISCLAIMER.md",
         "LICENSE",
         "NOTICE",
-        "patches/",
         "src/"
     ],
     "scripts": {
-        "test": "node --test src/*.test.js src/**/*.test.js tests/unit/*.test.js tests/cli/*.test.js",
+        "test": "node --test tests/unit/*.test.js tests/cli/*.test.js",
         "lint": "eslint --max-warnings 0 src/ tests/",
         "lint:fix": "eslint src/ tests/ --fix",
         "format": "prettier --write src/ tests/",
         "format:check": "prettier --check src/ tests/",
-        "release": "npm version patch -m 'release: v%s' && git push origin main --tags",
+        "release": "echo 'Releases go through a PR into main - see docs/RELEASE.md' && exit 1",
         "prepublishOnly": "npm run lint && npm test",
-        "prepare": "patch-package",
         "test:unit": "node --test tests/unit/*.test.js",
         "test:cli": "node --test tests/cli/*.test.js",
         "test:e2e": "node tests/run-e2e.js",
@@ -37,10 +35,12 @@
         "vietnam",
         "proxy",
         "vietqr",
-        "zca-js",
         "official-account",
         "zalo-oa",
-        "webhook"
+        "webhook",
+        "mcp",
+        "mcp-server",
+        "model-context-protocol"
     ],
     "repository": {
         "type": "git",
@@ -52,31 +52,49 @@
         "access": "public"
     },
     "engines": {
-        "node": ">=22"
+        "node": ">=22.19.0"
     },
     "dependencies": {
         "@modelcontextprotocol/sdk": "^1.32.1",
-        "better-sqlite3": "^13.0.3",
+        "better-sqlite3-multiple-ciphers": "13.0.3",
         "chalk": "^5.6.2",
         "commander": "^15.0.0",
         "express": "^5.2.1",
         "google-protobuf": "^3.21.4",
         "https-proxy-agent": "^9.1.0",
         "image-size": "^2.0.4",
-        "undici": "^8.5.0",
-        "zca-js": "2.2.0",
-        "zod": "^4.4.3"
+        "qrcode-generator": "^2.0.4",
+        "tough-cookie": "^5.1.2",
+        "undici": "^8.12.4",
+        "ws": "^8.21.3",
+        "zod": "^4.6.7"
     },
-    "bundleDependencies": [
-        "zca-js"
-    ],
     "devDependencies": {
+        "acorn": "^8.19.0",
         "eslint": "^10.0.3",
-        "patch-package": "^8.0.1",
         "prettier": "^3.8.1"
     },
+    "peerDependencies": {
+        "@aws-sdk/client-kms": "^3.0.0",
+        "@azure/identity": ">=4.0.0",
+        "@azure/keyvault-keys": ">=4.0.0",
+        "@google-cloud/kms": ">=4.0.0"
+    },
+    "peerDependenciesMeta": {
+        "@aws-sdk/client-kms": {
+            "optional": true
+        },
+        "@azure/identity": {
+            "optional": true
+        },
+        "@azure/keyvault-keys": {
+            "optional": true
+        },
+        "@google-cloud/kms": {
+            "optional": true
+        }
+    },
     "allowScripts": {
-        "better-sqlite3@13.0.3": true,
-        "@ardennguyen/zalo-agent-cli@2.5.4": true
+        "better-sqlite3-multiple-ciphers@13.0.3": false
     }
 }

package/src/commands/account.js

@@ -3,10 +3,9 @@
  * Includes export for headless/CI credential transfer.
  */
 
-import { writeFileSync, chmodSync } from "fs";
-import { resolve } from "path";
+import { writeFileSync, chmodSync, existsSync } from "fs";
+import { resolve, join } from "path";
 import {
-    loginWithQR,
     loginWithCredentials,
     extractCredentials,
     clearSession,
@@ -14,13 +13,25 @@ import {
     autoLogin,
     isLoggedIn,
 } from "../core/zalo-client.js";
-import { saveCredentials, loadCredentials } from "../core/credentials.js";
+import { saveCredentials, loadCredentials, getAccountDir, readSavedDevice } from "../core/credentials.js";
+import { describeLoginDevice, loginDeviceChange } from "../core/device-since.js";
+import { initDb, summarizeCloudItems } from "../core/db.js";
+import { describeAccountStatus, readAccountStatus } from "../core/account-status.js";
+import { describeDevices, summarizeCompanion } from "../core/account-devices.js";
+import { createTrustStore } from "../zalo/trust-store.js";
 import { listAccounts, getActive, setActive, addAccount, removeAccount, getAccount } from "../core/accounts.js";
-import { serverLogout, reportLogout, lockHolder } from "../core/logout.js";
+import { serverLogout, reportLogout, lockHolder, describeTrustedDevice } from "../core/logout.js";
 import { maskProxy } from "../utils/proxy-helpers.js";
-import { displayQR, getQRPath } from "../utils/qr-display.js";
-import { startQrServer } from "../utils/qr-http-server.js";
+import { resolveLoginPublicUrl, runQrLogin } from "../core/qr-login-flow.js";
+import { clearKickMarker, kickFile } from "../core/kick-marker.js";
 import { success, error, info, warning, output } from "../utils/output.js";
+import { guardSubcommand } from "../core/confirm-guard.js";
+import { changeProvider, hasKeyring, migrateAccount, rekeyAccount, securityStatus } from "../core/keystore/index.js";
+// Registers the encrypted stores' rekey handlers: a rekey without them would drop the key zalo.db is under.
+import { fullSecurityStatus, migrateStores, storesStatus } from "../core/keystore/stores.js";
+import { mediaStatus } from "../core/media-store.js";
+import { PROVIDER_NAMES, PROVIDER_SECTIONS, readStorageFile, writeStorageFile } from "../core/keystore/config.js";
+import { inTestSandbox } from "../core/keystore/providers.js";
 
 export function registerAccountCommands(program) {
     const account = program.command("account").description("Manage multiple Zalo accounts with proxy");
@@ -53,18 +64,29 @@ export function registerAccountCommands(program) {
         .option("-p, --proxy <url>", "Dedicated proxy URL for this account")
         .option("-n, --name <label>", "Friendly label", "")
         .option("--qr-url", "Start local HTTP server to view QR in browser (for VPS/headless)")
+        .option(
+            "--public-url <url>",
+            "Print the QR page as <url>/zalo/qr/<one-time token>, for a reverse proxy that routes /zalo/qr/ to the QR port (https, or http on localhost; or ZALO_MCP_PUBLIC_URL / publicUrl in mcp-config.json)",
+        )
         .action(async (opts) => {
+            const pub = resolveLoginPublicUrl(opts.publicUrl);
+            if (pub.error) {
+                error(`Invalid public URL: ${pub.error}.`);
+                process.exit(1);
+            }
             if (opts.proxy) info(`Using proxy: ${maskProxy(opts.proxy)}`);
             info("Generating QR code... Scan with Zalo mobile app.");
 
-            let qrServer = null;
+            let login = null;
             try {
-                const { ownId } = await loginWithQR(opts.proxy, (event) => {
-                    displayQR(event);
-                    if (!qrServer) {
-                        qrServer = startQrServer(getQRPath());
-                    }
+                // The same QR flow as `login`: the page says how it ended, and an expired code is offered again.
+                login = await runQrLogin({
+                    proxy: opts.proxy,
+                    jsonMode: process.env.ZALO_JSON_MODE === "1",
+                    qrUrl: Boolean(opts.qrUrl),
+                    publicUrl: pub.publicUrl,
                 });
+                const { ownId } = login;
 
                 // Fetch display name from Zalo profile
                 let displayName = opts.name || "";
@@ -75,15 +97,19 @@ export function registerAccountCommands(program) {
                 } catch {}
 
                 const creds = extractCredentials();
+                const device = loginDeviceChange(readSavedDevice(ownId), creds.imei);
                 saveCredentials(ownId, creds);
+                // A new login ends a kick: `fleet status` stops saying `kicked` before the daemon is back.
+                clearKickMarker(kickFile(getAccountDir(ownId)));
                 addAccount(ownId, displayName, opts.proxy);
                 success(
                     `Account logged in: ${displayName} (${ownId})${opts.proxy ? ` via ${maskProxy(opts.proxy)}` : ""}`,
                 );
+                info(describeLoginDevice(device, Date.now()));
+                await login.finish("done");
             } catch (e) {
                 error(`Login failed: ${e.message}`);
-            } finally {
-                if (qrServer) qrServer.close();
+                await (login?.finish ?? e.finish)?.("failed", e.message);
             }
         });
 
@@ -115,7 +141,7 @@ export function registerAccountCommands(program) {
 
             clearSession();
             try {
-                await loginWithCredentials(creds, acc?.proxy || null);
+                await loginWithCredentials(creds, acc?.proxy || null, { ownId: ownerId });
                 setActive(ownerId);
                 success(`Switched to ${ownerId}`);
             } catch (e) {
@@ -141,7 +167,7 @@ export function registerAccountCommands(program) {
             // leaving a half-logged-out account behind.
             const holder = lockHolder(ownerId);
             if (holder !== null) {
-                warning(
+                error(
                     `Removal aborted: a "listen"/"mcp" daemon (pid ${holder}) is still running for ${ownerId}. Stop it, then re-run — nothing was changed.`,
                 );
                 return;
@@ -153,10 +179,15 @@ export function registerAccountCommands(program) {
             // case where autoLogin() can give us a live API session to end;
             // a non-active account's server-side session (if any) is left
             // alone, same as this command always did.
+            let remote = null;
             if (getActive()?.ownId === ownerId) {
                 await autoLogin(program.opts().json);
                 if (isLoggedIn()) {
-                    reportLogout(await serverLogout(getApi()), { success, warning, info });
+                    const saved = loadCredentials(ownerId);
+                    remote = await serverLogout(getApi(), {
+                        savedLogin: saved ? { creds: saved, proxy: acc.proxy || null, ownId: ownerId } : null,
+                    });
+                    reportLogout(remote, { success, warning, info });
                 } else {
                     warning(
                         `Could not establish a session to invalidate remotely for ${ownerId} (continuing with local removal)`,
@@ -165,16 +196,20 @@ export function registerAccountCommands(program) {
                 clearSession();
             }
 
+            const trustNote = describeTrustedDevice(ownerId, "deleted");
             const { removed, wiped, skippedLocked } = removeAccount(ownerId);
             if (skippedLocked) {
-                warning(
+                error(
                     `Removal aborted: a "listen" daemon (pid ${skippedLocked.pid}) is still running for ${ownerId}. Stop it, then re-run.`,
                 );
                 info("Credentials and account registration were left untouched.");
                 return;
             }
             if (removed) {
-                success(`Account ${ownerId} removed${wiped ? " — local data deleted" : ""}`);
+                output({ removed: true, ownId: ownerId, localDataDeleted: wiped, remote }, program.opts().json, () => {
+                    success(`Account ${ownerId} removed${wiped ? " — local data deleted" : ""}`);
+                    if (trustNote && wiped) info(trustNote);
+                });
             } else {
                 error(`Account not found: ${ownerId}`);
             }
@@ -185,7 +220,8 @@ export function registerAccountCommands(program) {
         .description("Show currently active account")
         .action(() => {
             const active = getActive();
-            const safe = active ? { ...active, proxy: maskProxy(active.proxy) } : null;
+            // No active account is an answer, not a failure; --json says so with an object, never a bare null.
+            const safe = active ? { ...active, proxy: maskProxy(active.proxy) } : { active: null };
             output(safe, program.opts().json, () => {
                 if (!active) {
                     info("No active account.");
@@ -226,9 +262,44 @@ export function registerAccountCommands(program) {
             writeFileSync(outPath, JSON.stringify(exportData, null, 2), "utf-8");
             chmodSync(outPath, 0o600);
 
-            success(`Exported to ${outPath}`);
-            warning("This file contains login credentials. Keep it secure and do not commit to git.");
-            info(`Import on another machine: zalo-agent login --credentials ${opts.output}`);
+            // Never the credentials themselves on stdout: the file holds them.
+            output({ exported: true, ownId: acc.ownId, file: outPath }, program.opts().json, () => {
+                success(`Exported to ${outPath}`);
+                warning("This file contains login credentials. Keep it secure and do not commit to git.");
+                info(`Import on another machine: zalo-agent login --credentials ${opts.output}`);
+            });
+        });
+
+    account
+        .command("status")
+        .description(
+            "Show the account's plans (read-only): the zBusiness package, the zCloud plan with its usage and limits",
+        )
+        .action(async () => {
+            try {
+                // Like `devices`: "account" subcommands skip the preAction login, so do it here.
+                await autoLogin(program.opts().json);
+                const ownId = getActive()?.ownId ?? null;
+                // The local index is read only when this machine has a database for the account: asking must not
+                // create one.
+                let dbFile = null;
+                if (ownId) {
+                    const file = join(getAccountDir(ownId), "zalo.db");
+                    if (existsSync(file)) dbFile = file;
+                }
+                if (dbFile) initDb(dbFile);
+                const status = await readAccountStatus(getApi(), {
+                    ownId,
+                    localIndex: () => (dbFile ? summarizeCloudItems() : null),
+                });
+                output(status, program.opts().json, () => {
+                    for (const line of describeAccountStatus(status)) info(line);
+                });
+                if (!status.sources.length) process.exitCode = 1;
+            } catch (e) {
+                error(`Failed to read the account's plans: ${e.message}`);
+                process.exitCode = 1;
+            }
         });
 
     account
@@ -241,31 +312,289 @@ export function registerAccountCommands(program) {
                 // flows), so trigger it here — same pattern mcp.js uses.
                 await autoLogin(program.opts().json);
                 // getListDevice() returns { devices: {...} } directly —
-                // zca-js's resolveResponse() unwraps result.data itself
-                // when called with no callback, so there's no extra .data
+                // the session's reply decoding unwraps result.data itself,
+                // so there's no extra .data
                 // layer to destructure here (confirmed against the real
                 // API: destructuring .data silently produced undefined).
                 const result = await getApi().getListDevice();
                 const devices = result?.devices;
-                const companions = devices?.companions || [];
-                output({ devices }, program.opts().json, () => {
-                    if (!devices) {
-                        info("No device data returned.");
-                        return;
+                // Which entry is this CLI: the companion identity saved by the official QR login, if there is one.
+                const saved = createTrustStore(getAccountDir).load(String(getApi().getOwnId()));
+                const mine = { companionId: saved?.companionId ?? null };
+                const companions = (devices?.companions || []).map((c) => summarizeCompanion(c, mine));
+                output({ devices, companions }, program.opts().json, () => {
+                    for (const line of describeDevices(devices, mine)) console.log(`  ${line}`);
+                });
+            } catch (e) {
+                error(`Failed to list devices: ${e.message}`);
+            }
+        });
+    registerSecurityCommands(account, program);
+
+    // It ends the session and deletes the account's data: --yes to act, --dry-run to preview (src/core/confirm-guard.js).
+    guardSubcommand(account, "remove", "account.remove", { target: (ownerId) => ({ ownerId }) });
+    // It writes the login out in plaintext: --yes to write it, --dry-run to preview.
+    guardSubcommand(account, "export", "account.export", {
+        target: (ownerId, opts) => ({ ownerId, output: resolve(opts.output) }),
+    });
+}
+
+/**
+ * The account(s) a security command acts on: the one named, else the active one, else (with `all`) every registered
+ * account.
+ *
+ * @param {string|undefined} ownerId
+ * @param {{all?: boolean}} [opts]
+ * @returns {string[]}
+ */
+function targetAccounts(ownerId, { all = false } = {}) {
+    if (ownerId) {
+        if (!getAccount(ownerId)) throw new Error(`Account not found: ${ownerId}`);
+        return [ownerId];
+    }
+    if (all) return listAccounts().map((a) => a.ownId);
+    const active = getActive();
+    if (!active) throw new Error("No active account: name one, or log in first");
+    return [active.ownId];
+}
+
+/** Refuse while a daemon holds the account: it keeps the account's keys in memory and would write under old ones. */
+function refuseWhileDaemon(ownId) {
+    const holder = lockHolder(ownId);
+    if (holder !== null) {
+        throw new Error(
+            `a "listen"/"mcp" daemon (pid ${holder}) is running for ${ownId}: stop it first, then re-run (nothing was changed)`,
+        );
+    }
+}
+
+/**
+ * Log in to one account for the key layer (the dkey layer needs a live login), then let the session go.
+ *
+ * @param {string} ownId
+ */
+async function loginForKeys(ownId) {
+    const creds = loadCredentials(ownId);
+    if (!creds) throw new Error(`no saved login for ${ownId}: log in first`);
+    const acc = getAccount(ownId);
+    clearSession();
+    try {
+        // loginWithCredentials hands the live login to the key layer (src/core/zalo-client.js).
+        await loginWithCredentials(creds, acc?.proxy || null, { ownId });
+    } catch (e) {
+        throw new Error(
+            `the dkey layer needs a live login and Zalo could not be reached or refused it (${e.message}); the account's data stays locked until it can`,
+        );
+    } finally {
+        clearSession();
+    }
+}
+
+/** Whether a step for this account needs the dkey of a live login. */
+function needsLogin(ownId) {
+    const s = securityStatus(ownId);
+    return Boolean(s.dkeyLayer.configured || s.dkeyLayer.active) && !s.dkeyLayer.unlockedInThisProcess;
+}
+
+/**
+ * `account security …`: the at-rest protection of the account's files (src/core/keystore/, docs/security.md).
+ *
+ * @param {import("commander").Command} account
+ * @param {import("commander").Command} program
+ */
+function registerSecurityCommands(account, program) {
+    const security = account
+        .command("security")
+        .description("At-rest protection of the account's saved files: status, migrate, rekey, provider");
+    const json = () => program.opts().json;
+    const fail = (e) => {
+        error(e.message);
+        process.exitCode = 1;
+    };
+
+    security
+        .command("status [ownerId]")
+        .description(
+            "Show how the account's files are protected: key provider, dkey layer, keyring version, which files are sealed and whether the message database is encrypted (never key material)",
+        )
+        .option("--all", "Every registered account")
+        .action((ownerId, opts) => {
+            try {
+                const reports = targetAccounts(ownerId, opts).map((id) => fullSecurityStatus(id));
+                output(opts.all ? { accounts: reports } : reports[0], json(), () => {
+                    for (const r of reports) describeSecurity(r);
+                });
+            } catch (e) {
+                fail(e);
+            }
+        });
+
+    security
+        .command("migrate [ownerId]")
+        .description(
+            "Seal every file still in plaintext and encrypt the message database (each verified before the plaintext is removed), and apply the dkey layer setting; idempotent",
+        )
+        .option("--all", "Every registered account")
+        .action(async (ownerId, opts) => {
+            try {
+                const results = [];
+                for (const id of targetAccounts(ownerId, opts)) {
+                    refuseWhileDaemon(id);
+                    let files = migrateAccount(id);
+                    let login = null;
+                    if (hasKeyring(id) && needsLogin(id)) {
+                        try {
+                            await loginForKeys(id);
+                            login = "done";
+                            files = migrateAccount(id);
+                        } catch (e) {
+                            login = e.message;
+                        }
                     }
-                    console.log(`  This session (master): ${devices.masterId}`);
-                    console.log(`  Last updated:          ${new Date(devices.lastUpdateTs).toLocaleString()}`);
-                    if (!companions.length) {
-                        info("No other devices/sessions linked to this account.");
-                    } else {
-                        console.log(`  Other linked sessions (${companions.length}):`);
-                        for (const c of companions) {
-                            console.log(`    - ${JSON.stringify(c)}`);
+                    // The databases after the login: with the dkey layer on, their key opens only then.
+                    files = [...files, ...migrateStores(id)];
+                    if (files.some((f) => f.result === "failed" || f.result === "locked")) process.exitCode = 1;
+                    results.push({ ownId: id, files, login, dkeyLayer: securityStatus(id).dkeyLayer });
+                }
+                output(opts.all ? { accounts: results } : results[0], json(), () => {
+                    for (const r of results) {
+                        info(`Account ${r.ownId}`);
+                        for (const f of r.files) {
+                            const n = f.sealed ? ` (${f.sealed} file(s))` : "";
+                            const line = `  ${f.kind.padEnd(24)} ${f.result}${n}${f.error ? `: ${f.error}` : ""}`;
+                            if (f.result === "failed" || f.result === "locked") warning(line);
+                            else console.log(line);
                         }
+                        if (r.login && r.login !== "done") warning(`  ${r.login}`);
                     }
                 });
             } catch (e) {
-                error(`Failed to list devices: ${e.message}`);
+                fail(e);
             }
         });
+
+    security
+        .command("rekey [ownerId]")
+        .description(
+            "Make new keys for the account, re-seal every file and re-encrypt the message database under them (the old keys are kept until it is done)",
+        )
+        .action(async (ownerId) => {
+            try {
+                const [id] = targetAccounts(ownerId);
+                refuseWhileDaemon(id);
+                if (needsLogin(id)) await loginForKeys(id);
+                // The encrypted stores re-encrypt themselves in rekeyAccount (their handlers, registered by
+                // keystore/stores.js); this reports where each one ended up.
+                const res = rekeyAccount(id);
+                const databases = storesStatus(id).map((d) => ({
+                    kind: d.kind,
+                    state: d.state,
+                    ...(d.state === "encrypted" ? { currentKey: d.currentKey } : {}),
+                }));
+                const m = mediaStatus(id);
+                const media = {
+                    sealed: m.sealed,
+                    staleKey: m.staleKey,
+                    plaintext: m.plaintext,
+                    unreadable: m.unreadable,
+                };
+                output(
+                    { ownId: id, rekeyed: true, resealed: res.resealed, keys: res.keys, databases, media },
+                    json(),
+                    () => {
+                        success(`Account ${id}: new keys, ${res.resealed} file(s) re-sealed`);
+                        for (const d of databases) {
+                            info(`  ${d.kind}: ${d.state}${d.currentKey ? ", under the new key" : ""}`);
+                        }
+                        info(`  media: ${media.sealed} file(s) sealed, ${media.staleKey} not under the new key`);
+                    },
+                );
+            } catch (e) {
+                fail(e);
+            }
+        });
+
+    security
+        .command("provider <name> [ownerId]")
+        .description(
+            `Protect the keyring with another key provider (${PROVIDER_NAMES.filter((p) => p !== "test").join(", ")}): re-wraps the keys of the account (default: every account with a keyring) and makes it the default for new ones; options given for one account (a tenant's --key) are kept for that account only`,
+        )
+        .option("--scope <scope>", "dpapi: CurrentUser (default) or LocalMachine")
+        .option("--backend <backend>", "kms: aws, gcp, azure or vault")
+        .option("--key <key>", "kms: the key ARN/id, key name, key URL or transit key name")
+        .option("--with-key <mode>", "systemd-creds: auto, host, tpm2 or host+tpm2")
+        .option("--passphrase-file <path>", "passphrase: read it from this file instead of asking")
+        .action((name, ownerId, opts) => {
+            try {
+                // `test` is the offline sandbox's own provider, refused anywhere else (src/core/keystore/providers.js).
+                if (!PROVIDER_NAMES.includes(name) || (name === "test" && !inTestSandbox())) {
+                    throw new Error(`unknown key provider "${name}"`);
+                }
+                const extra = {
+                    ...(opts.scope ? { scope: opts.scope } : {}),
+                    ...(opts.backend ? { backend: opts.backend } : {}),
+                    ...(opts.key ? { key: opts.key } : {}),
+                    ...(opts.withKey ? { withKey: opts.withKey } : {}),
+                    ...(opts.passphraseFile ? { file: resolve(opts.passphraseFile) } : {}),
+                };
+                const ids = ownerId
+                    ? targetAccounts(ownerId)
+                    : listAccounts()
+                          .map((a) => a.ownId)
+                          .filter((id) => hasKeyring(id));
+                ids.forEach(refuseWhileDaemon);
+                const changed = ids.map((id) => ({ ownId: id, ...changeProvider(id, name, extra) }));
+                // New keyrings follow: the provider and its (non-secret) options go into storage.json. For a named
+                // account the options go under accounts.<id> (a tenant's KMS key), so the default stays as it was.
+                const settings = readStorageFile();
+                const section = PROVIDER_SECTIONS[name];
+                const next = { ...settings, provider: name };
+                if (section && Object.keys(extra).length) {
+                    if (ownerId) {
+                        next.accounts = { ...(settings.accounts ?? {}) };
+                        for (const id of ids) {
+                            const own = next.accounts[id] ?? {};
+                            next.accounts[id] = { ...own, [section]: { ...(own[section] ?? {}), ...extra } };
+                        }
+                    } else next[section] = { ...(settings[section] ?? {}), ...extra };
+                }
+                writeStorageFile(next);
+                output({ provider: name, accounts: changed }, json(), () => {
+                    for (const c of changed) success(`Account ${c.ownId}: keyring moved from ${c.from} to ${c.to}`);
+                    info(`New accounts use "${name}" (storage.json)`);
+                });
+            } catch (e) {
+                fail(e);
+            }
+        });
+}
+
+/** The human form of `account security status`. */
+function describeSecurity(r) {
+    info(`Account ${r.ownId}`);
+    if (r.keyringError) warning(`  Keyring: ${r.keyringError}`);
+    if (r.configError) warning(`  storage.json: ${r.configError}`);
+    console.log(
+        `  Keyring:    ${r.keyring ? `version ${r.keyring.version}, created ${r.keyring.createdAt}` : "none yet (made on the first seal)"}`,
+    );
+    if (r.keyring?.rekeyInProgress) warning("  A rekey did not finish: run `account security rekey` again");
+    const configured =
+        r.configuredProvider && r.provider && r.configuredProvider !== r.provider.name
+            ? ` (configured: ${r.configuredProvider})`
+            : "";
+    console.log(`  Provider:   ${r.provider ? JSON.stringify(r.provider) : "-"}${configured}`);
+    const pending =
+        r.dkeyLayer.configured !== r.dkeyLayer.active
+            ? ` (configured ${r.dkeyLayer.configured ? "on" : "off"}: applied at the next login)`
+            : "";
+    console.log(`  dkey layer: ${r.dkeyLayer.active ? "on" : "off"}${pending}`);
+    for (const f of r.files) {
+        const counts =
+            f.kind === "media"
+                ? `  (${f.sealed} sealed, ${f.plaintext} plaintext${f.unreadable ? `, ${f.unreadable} unreadable` : ""}` +
+                  `${f.staleKey ? `, ${f.staleKey} under an old key` : ""}${f.capped ? ", counted up to 50,000" : ""})`
+                : "";
+        console.log(`  ${f.kind.padEnd(24)} ${f.state.padEnd(10)} ${f.key} key${counts}`);
+    }
+    if (r.plaintextFiles) warning(`  ${r.plaintextFiles} file(s) still plaintext: run "account security migrate"`);
 }