@cydm/happy-elves 0.1.0-beta.71 → 0.1.0-beta.73

package/apps/cli/dist/commands/account.js

@@ -2,12 +2,16 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { createInterface } from "node:readline/promises";
-import { CliError, configDir, configPath, generateAccountSecret, ok, parsePairingStartResponse, randomId, readRelayJson, requireRelayUrl, stopLocalDaemon, throwRelayHttpError, withAccountConfigTransaction } from "./lib/index.js";
+import { accountBindingPath, assertNoPendingEnrollmentAuthority, CliError, configDir, configPath, generateAccountSecret, ok, parseControllerConfig, parseDaemonConfig, parseLocalAccountBinding, parsePairingStartResponse, randomId, readLocalAccountBinding, readRelayJson, requireRelayUrl, stopLocalDaemon, throwRelayHttpError, withAccountConfigTransaction, } from "./lib/index.js";
+import { createLocalAccountBindingV1, localAccountBindingMatchesV1, } from "../../../../packages/shared/dist/index.js";
+import { commitAccountSnapshotMutation, } from "./lib/account-snapshot.js";
 const daemonConfigPath = path.join(configDir, "daemon.json");
-const accountConfigFiles = ["config.json", "daemon.json"];
+const accountConfigFiles = ["config.json", "daemon.json", "account.json"];
 const accountCreateRelayTimeoutMs = 15_000;
 function accountConfigTarget(file) {
-    return file === "config.json" ? configPath : daemonConfigPath;
+    if (file === "config.json")
+        return configPath;
+    return file === "daemon.json" ? daemonConfigPath : accountBindingPath;
 }
 export async function confirmReset(flags, testIo) {
     if (flags.json === true) {
@@ -72,8 +76,17 @@ async function copyConfigIfPresent(source, target) {
         const stat = await fs.lstat(source);
         if (!stat.isFile() || stat.isSymbolicLink())
             throw new CliError(`Refusing to copy non-regular config file: ${source}`, "CONFIG_BACKUP_UNSAFE");
-        await fs.copyFile(source, target);
-        await fs.chmod(target, 0o600);
+        const contents = await fs.readFile(source);
+        let handle;
+        try {
+            handle = await fs.open(target, "wx", 0o600);
+            await handle.writeFile(contents);
+            await handle.chmod(0o600);
+            await handle.sync();
+        }
+        finally {
+            await handle?.close().catch(() => undefined);
+        }
         return true;
     }
     catch (error) {
@@ -82,11 +95,41 @@ async function copyConfigIfPresent(source, target) {
         throw error;
     }
 }
+const unsupportedWindowsDirectorySyncCodes = new Set(["EINVAL", "ENOTSUP", "EISDIR", "EPERM"]);
+async function syncDirectory(directory) {
+    let handle;
+    try {
+        handle = await fs.open(directory, "r");
+        await handle.sync();
+    }
+    catch (error) {
+        if (process.platform !== "win32"
+            || !unsupportedWindowsDirectorySyncCodes.has(error.code ?? ""))
+            throw error;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+async function writeSyncedBackupManifest(filePath, contents) {
+    let handle;
+    try {
+        handle = await fs.open(filePath, "wx", 0o600);
+        await handle.writeFile(contents, "utf8");
+        await handle.chmod(0o600);
+        await handle.sync();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
 async function backupAccountConfig(prefix = "account-reset") {
     const stamp = new Date().toISOString().replace(/[:.]/gu, "-");
     const backupsRoot = path.join(configDir, "backups");
+    let rootCreated = false;
     try {
         await fs.mkdir(backupsRoot, { mode: 0o700 });
+        rootCreated = true;
     }
     catch (error) {
         if (error.code !== "EEXIST")
@@ -97,15 +140,24 @@ async function backupAccountConfig(prefix = "account-reset") {
         throw new CliError("Refusing to write an account backup through an unsafe backups path.", "CONFIG_BACKUP_UNSAFE");
     }
     await fs.chmod(backupsRoot, 0o700);
+    if (rootCreated)
+        await syncDirectory(configDir);
     const backupPath = path.join(backupsRoot, `${prefix}-${stamp}-${randomId("backup")}`);
-    await fs.mkdir(backupPath, { mode: 0o700 });
-    await fs.chmod(backupPath, 0o700);
+    const stagingPath = path.join(backupsRoot, `.account-backup-staging-${randomId("backup")}`);
+    await fs.mkdir(stagingPath, { mode: 0o700 });
+    await fs.chmod(stagingPath, 0o700);
+    await syncDirectory(backupsRoot);
     const files = [];
-    if (await copyConfigIfPresent(configPath, path.join(backupPath, "config.json")))
+    if (await copyConfigIfPresent(configPath, path.join(stagingPath, "config.json")))
         files.push("config.json");
-    if (await copyConfigIfPresent(daemonConfigPath, path.join(backupPath, "daemon.json")))
+    if (await copyConfigIfPresent(daemonConfigPath, path.join(stagingPath, "daemon.json")))
         files.push("daemon.json");
-    await fs.writeFile(path.join(backupPath, "manifest.json"), JSON.stringify({ version: 1, createdAt: new Date().toISOString(), files }, null, 2) + "\n", { mode: 0o600 });
+    if (await copyConfigIfPresent(accountBindingPath, path.join(stagingPath, "account.json")))
+        files.push("account.json");
+    await writeSyncedBackupManifest(path.join(stagingPath, "manifest.json"), JSON.stringify({ version: 1, createdAt: new Date().toISOString(), files }, null, 2) + "\n");
+    await syncDirectory(stagingPath);
+    await fs.rename(stagingPath, backupPath);
+    await syncDirectory(backupsRoot);
     return { path: backupPath, files };
 }
 async function requireDaemonStopped() {
@@ -138,18 +190,28 @@ async function requireRegularBackupFile(filePath) {
         throw new CliError(`Account backup contains an unsafe ${path.basename(filePath)}.`, "ACCOUNT_BACKUP_INVALID");
     }
 }
-async function stageAccountRestore(backupPath, files) {
+async function stageAccountRestore(backupPath, requestedFiles) {
     await fs.mkdir(configDir, { recursive: true, mode: 0o700 });
     await fs.chmod(configDir, 0o700);
     const stagingPath = await fs.mkdtemp(path.join(configDir, ".account-restore-"));
     await fs.chmod(stagingPath, 0o700);
+    let files = [...requestedFiles];
+    let controller;
+    let daemon;
+    let binding;
     try {
         for (const file of files) {
             const source = path.join(backupPath, file);
             await requireRegularBackupFile(source);
             const contents = await fs.readFile(source, "utf8");
             try {
-                JSON.parse(contents);
+                const parsed = JSON.parse(contents);
+                if (file === "config.json")
+                    controller = parseControllerConfig(parsed);
+                else if (file === "daemon.json")
+                    daemon = parseDaemonConfig(parsed);
+                else if (file === "account.json")
+                    binding = parseLocalAccountBinding(parsed);
             }
             catch {
                 throw new CliError(`Account backup ${file} is not valid JSON.`, "ACCOUNT_BACKUP_INVALID");
@@ -158,6 +220,38 @@ async function stageAccountRestore(backupPath, files) {
             await fs.writeFile(staged, contents, { mode: 0o600, flag: "wx" });
             await fs.chmod(staged, 0o600);
         }
+        if (controller && daemon &&
+            (controller.relayUrl !== daemon.relayUrl ||
+                controller.accountSecret !== daemon.accountSecret)) {
+            throw new CliError("Account backup Device and Daemon credentials identify different Accounts.", "ACCOUNT_BACKUP_INVALID");
+        }
+        if (binding) {
+            if (controller && !localAccountBindingMatchesV1(binding, {
+                relayUrl: controller.relayUrl,
+                accountSecret: controller.accountSecret,
+            }) ||
+                daemon && !localAccountBindingMatchesV1(binding, {
+                    relayUrl: daemon.relayUrl,
+                    accountId: daemon.accountId,
+                    accountSecret: daemon.accountSecret,
+                })) {
+                throw new CliError("Account backup binding does not match its Device or Daemon credential.", "ACCOUNT_BACKUP_INVALID");
+            }
+        }
+        else if (controller || daemon) {
+            const credential = controller ?? daemon;
+            if (!credential)
+                throw new CliError("Account backup credential is missing.", "ACCOUNT_BACKUP_INVALID");
+            binding = createLocalAccountBindingV1({
+                relayUrl: credential.relayUrl,
+                accountId: daemon?.accountId ?? null,
+                accountSecret: credential.accountSecret,
+            });
+            const stagedBinding = path.join(stagingPath, "account.json");
+            await fs.writeFile(stagedBinding, `${JSON.stringify(binding, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+            await fs.chmod(stagedBinding, 0o600);
+            files = [...files, "account.json"];
+        }
         return { path: stagingPath, files };
     }
     catch (error) {
@@ -184,72 +278,16 @@ async function currentAccountConfigFiles() {
     }
     return existing;
 }
-async function applyAccountRestore(staged) {
-    const existing = await currentAccountConfigFiles();
-    const rollbackPath = await fs.mkdtemp(path.join(configDir, ".account-restore-rollback-"));
-    await fs.chmod(rollbackPath, 0o700);
-    const moved = [];
-    const installed = [];
-    let result;
-    let preserveRollback = false;
-    try {
-        for (const file of existing) {
-            await fs.rename(accountConfigTarget(file), path.join(rollbackPath, file));
-            moved.push(file);
-        }
-        for (const file of staged.files) {
-            const target = accountConfigTarget(file);
-            await fs.rename(path.join(staged.path, file), target);
-            installed.push(file);
-            await fs.chmod(target, 0o600);
-        }
-        result = {
-            restored: staged.files.map(accountConfigTarget),
-            removed: existing.filter((file) => !staged.files.includes(file)).map(accountConfigTarget),
-        };
-    }
-    catch (error) {
-        const rollbackFailures = [];
-        for (const file of [...installed].reverse()) {
-            try {
-                await fs.rm(accountConfigTarget(file), { force: true });
-            }
-            catch (rollbackError) {
-                rollbackFailures.push(`${file} cleanup: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
-            }
-        }
-        for (const file of [...moved].reverse()) {
-            try {
-                const target = accountConfigTarget(file);
-                await fs.rename(path.join(rollbackPath, file), target);
-                await fs.chmod(target, 0o600);
-            }
-            catch (rollbackError) {
-                rollbackFailures.push(`${file} rollback: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);
-            }
-        }
-        const detail = error instanceof Error ? error.message : String(error);
-        if (rollbackFailures.length > 0) {
-            preserveRollback = true;
-            throw new CliError(`Account restore failed and rollback was incomplete: ${detail}. ${rollbackFailures.join("; ")}. Recovery files remain in ${rollbackPath}`, "ACCOUNT_RESTORE_ROLLBACK_FAILED");
-        }
-        throw new CliError(`Account restore failed; the previous configuration was restored: ${detail}`, "ACCOUNT_RESTORE_FAILED");
-    }
-    finally {
-        if (!preserveRollback)
-            await fs.rm(rollbackPath, { recursive: true, force: true });
-    }
-    if (!result)
-        throw new CliError("Account restore did not produce a result", "ACCOUNT_RESTORE_FAILED");
-    return result;
-}
 export async function handleAccount({ domain, action, flags }) {
     if (domain === "account" && action === "create") {
         const created = await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
             // This check intentionally precedes every relay request. Holding the
             // account-wide lease through pairing prevents concurrent creators from
             // producing an orphan remote account and racing the local credential.
-            if (await transaction.controllerExists() || await transaction.daemonExists()) {
+            if (await transaction.accountExists() ||
+                await transaction.controllerExists() ||
+                await transaction.daemonExists()) {
                 throw new CliError("Happy Elves account configuration already exists. Use an invite to recover the existing account; account create never replaces credentials.", "CONFIG_EXISTS");
             }
             const relayUrl = requireRelayUrl(flags);
@@ -280,7 +318,7 @@ export async function handleAccount({ domain, action, flags }) {
                 controllerToken: paired.controllerToken,
                 accountSecret,
             };
-            await transaction.writeController(config, "create");
+            await transaction.writeController(config, "create", paired.accountId);
             return {
                 accountId: paired.accountId,
                 configPath,
@@ -303,15 +341,23 @@ export async function handleAccount({ domain, action, flags }) {
     }
     if (domain === "account" && action === "reset") {
         await confirmReset(flags);
-        const stop = await requireDaemonStopped();
-        const backup = await withAccountConfigTransaction(async () => {
+        // Reject an unknown or malformed ownership boundary before stopping a
+        // healthy Daemon. The locked read below repeats this check at commit.
+        await readLocalAccountBinding();
+        await assertNoPendingEnrollmentAuthority();
+        const { backup, stop } = await withAccountConfigTransaction(async (transaction) => {
+            await transaction.readAccountBinding();
+            await assertNoPendingEnrollmentAuthority();
+            // Lock order is Account config -> verified Daemon lifetime. Local
+            // start/restart use the same order, so no process can reload the old
+            // credential between this stop and the snapshot commit.
+            const stop = await requireDaemonStopped();
             const result = await backupAccountConfig();
-            await fs.rm(configPath, { force: true });
-            await fs.rm(daemonConfigPath, { force: true });
-            return result;
+            await commitAccountSnapshotMutation({}, "reset");
+            return { backup: result, stop };
         });
         ok("account.reset", {
-            removed: [configPath, daemonConfigPath],
+            removed: [configPath, daemonConfigPath, accountBindingPath],
             backup,
             restoreCommand: `happy-elves account restore --from ${JSON.stringify(backup.path)} --yes --json`,
             stop,
@@ -342,11 +388,19 @@ export async function handleAccount({ domain, action, flags }) {
         try {
             const existing = await currentAccountConfigFiles();
             await confirmRestore(flags, files.length === 0 || existing.length > 0);
-            const stop = await requireDaemonStopped();
-            const { preRestoreBackup, restored } = await withAccountConfigTransaction(async () => {
+            await readLocalAccountBinding();
+            await assertNoPendingEnrollmentAuthority();
+            const { preRestoreBackup, restored, stop } = await withAccountConfigTransaction(async (transaction) => {
+                await transaction.readAccountBinding();
+                await assertNoPendingEnrollmentAuthority();
+                const stop = await requireDaemonStopped();
                 const preRestoreBackup = await backupAccountConfig("account-pre-restore");
-                const restored = await applyAccountRestore({ path: staged.path, files });
-                return { preRestoreBackup, restored };
+                const desired = {};
+                for (const file of staged.files) {
+                    desired[file] = await fs.readFile(path.join(staged.path, file), "utf8");
+                }
+                const restored = await commitAccountSnapshotMutation(desired, "restore");
+                return { preRestoreBackup, restored, stop };
             });
             ok("account.restore", {
                 backupPath,

package/apps/cli/dist/commands/config.js

@@ -1,4 +1,4 @@
-import { CliError, configPath, ok, readConfig, redactedControllerConfig, redactedRelayUrl, requireRelayUrl, requireString, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
+import { assertNoPendingEnrollmentAuthority, CliError, configPath, ok, readConfig, redactedControllerConfig, redactedRelayUrl, requireRelayUrl, requireString, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
 export async function handleConfig({ domain, action, flags }) {
     if (domain === "config" && action === "init") {
         const config = {
@@ -7,6 +7,10 @@ export async function handleConfig({ domain, action, flags }) {
             accountSecret: requireString(flags, "secret"),
         };
         await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
+            if (await transaction.accountExists()) {
+                throw new CliError("Account binding already exists. config init never replaces Account ownership.", "CONFIG_EXISTS");
+            }
             if (await transaction.controllerExists()) {
                 throw new CliError("Controller configuration already exists. config init never replaces credentials.", "CONFIG_EXISTS");
             }

package/apps/cli/dist/commands/daemon.js

@@ -2,7 +2,7 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
 import { daemonLifecycleRequestIdV1Schema, } from "../../../../packages/shared/dist/index.js";
-import { assertLocalDaemonRuntimeMatchesConfig, assertLocalDaemonVerified, canonicalRelayUrl, cliErrorFromFetch, CliError, compactText, ControllerClient, configDir, configPath, daemonPidPath, deriveOrchestration, diagnoseInstallation, emitDoctorResult, ensureDaemonRunning, idleSessionStatuses, localDaemonStatus, ok, parsePairingClaimResponse, randomId, readConfig, readDaemonConfig, readDaemonProjectionBaseline, readLocalAuditLog, readOptionalControllerConfig, readRelayJson, redactedDaemonConfig, requirePositional, requireRelayUrl, requireString, showMachine, startDaemonTimeoutMs, stopLocalDaemon, stopSpawnedDaemon, throwRelayHttpError, waitForDaemonReadiness, waitForDaemonSelfReadiness, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
+import { assertLocalDaemonRuntimeMatchesConfig, assertLocalDaemonVerified, assertNoPendingEnrollmentAuthority, canonicalRelayUrl, cliErrorFromFetch, CliError, compactText, ControllerClient, configDir, configPath, daemonPidPath, deriveOrchestration, diagnoseInstallation, emitDoctorResult, ensureDaemonRunning, idleSessionStatuses, localDaemonStatus, ok, parsePairingClaimResponse, randomId, readConfig, readDaemonConfig, readDaemonProjectionBaseline, readLocalAuditLog, readRelayJson, redactedDaemonConfig, requirePositional, requireRelayUrl, requireString, showMachine, startDaemonTimeoutMs, stopLocalDaemon, stopSpawnedDaemon, throwRelayHttpError, waitForDaemonReadiness, waitForDaemonSelfReadiness, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
 function positiveLimit(flags, fallback) {
     const value = flags.limit;
     if (value === undefined)
@@ -208,6 +208,7 @@ export async function handleDaemon({ domain, action, flags }) {
         const machineId = typeof flags["machine-id"] === "string" ? flags["machine-id"] : randomId("mach");
         let daemonConfig;
         await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
             if (await transaction.daemonExists()) {
                 throw new CliError(`Daemon configuration already exists at ${transaction.daemonPath}. Pairing never replaces an existing machine identity; use an explicit account recovery or migration flow.`, "CONFIG_EXISTS");
             }
@@ -309,25 +310,31 @@ export async function handleDaemon({ domain, action, flags }) {
         return true;
     }
     if (domain === "daemon" && action === "start") {
-        assertLocalDaemonVerified(await localDaemonStatus());
-        const config = await readDaemonConfig();
-        assertDaemonRelayOverrideMatches(flags, config);
-        const controllerConfig = await readOptionalControllerConfig();
-        if (controllerConfig)
-            assertControllerCanObserveDaemon(controllerConfig, config);
-        const client = controllerConfig ? new ControllerClient(controllerConfig) : undefined;
-        const baseline = client
-            ? await readDaemonProjectionBaseline(client, config.machineId, { timeoutMs: startDaemonTimeoutMs })
-            : undefined;
-        const daemon = await ensureDaemonRunning(config);
-        const readiness = await waitForLocalDaemonReadiness(client, config, baseline, daemon, daemon.started);
-        const data = {
-            ...readiness.local,
-            started: daemon.started,
-            machineId: readiness.machine?.id ?? config.machineId,
-            relayAuthenticated: readiness.relayAuthenticated,
-            ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
-        };
+        const data = await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
+            assertLocalDaemonVerified(await localDaemonStatus());
+            const config = await transaction.readDaemon();
+            if (!config)
+                throw new CliError("Daemon config not found.", "CONFIG_MISSING");
+            assertDaemonRelayOverrideMatches(flags, config);
+            const controllerConfig = await transaction.readController();
+            if (controllerConfig)
+                assertControllerCanObserveDaemon(controllerConfig, config);
+            const client = controllerConfig ? new ControllerClient(controllerConfig) : undefined;
+            const baseline = client
+                ? await readDaemonProjectionBaseline(client, config.machineId, { timeoutMs: startDaemonTimeoutMs })
+                : undefined;
+            const daemon = await ensureDaemonRunning(config);
+            const readiness = await waitForLocalDaemonReadiness(client, config, baseline, daemon, daemon.started);
+            return {
+                ...readiness.local,
+                started: daemon.started,
+                ...(daemon.autostartNeedsAttention ? { needsAttention: daemon.autostartNeedsAttention } : {}),
+                machineId: readiness.machine?.id ?? config.machineId,
+                relayAuthenticated: readiness.relayAuthenticated,
+                ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
+            };
+        });
         if (wantsJson(flags))
             ok("daemon.start", data);
         else
@@ -350,31 +357,37 @@ export async function handleDaemon({ domain, action, flags }) {
         return true;
     }
     if (domain === "daemon" && action === "restart") {
-        assertLocalDaemonVerified(await localDaemonStatus());
-        const config = await readDaemonConfig();
-        assertDaemonRelayOverrideMatches(flags, config);
-        const controllerConfig = await readOptionalControllerConfig();
-        if (controllerConfig)
-            assertControllerCanObserveDaemon(controllerConfig, config);
-        const client = controllerConfig ? new ControllerClient(controllerConfig) : undefined;
-        const baseline = client
-            ? await readDaemonProjectionBaseline(client, config.machineId, { timeoutMs: startDaemonTimeoutMs })
-            : undefined;
-        const stop = await stopLocalDaemon();
-        if (stop.running || stop.alive) {
-            throw new CliError("Daemon did not stop before the restart deadline; no replacement process was started.", "DAEMON_STOP_FAILED");
-        }
-        const daemon = await ensureDaemonRunning(config);
-        const readiness = await waitForLocalDaemonReadiness(client, config, baseline, daemon, true);
-        ok("daemon.restart", {
-            stop,
-            startedPid: daemon.startedPid ?? readiness.local.pid,
-            pidPath: daemonPidPath,
-            local: readiness.local,
-            machineId: readiness.machine?.id ?? config.machineId,
-            relayAuthenticated: readiness.relayAuthenticated,
-            ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
+        const result = await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
+            assertLocalDaemonVerified(await localDaemonStatus());
+            const config = await transaction.readDaemon();
+            if (!config)
+                throw new CliError("Daemon config not found.", "CONFIG_MISSING");
+            assertDaemonRelayOverrideMatches(flags, config);
+            const controllerConfig = await transaction.readController();
+            if (controllerConfig)
+                assertControllerCanObserveDaemon(controllerConfig, config);
+            const client = controllerConfig ? new ControllerClient(controllerConfig) : undefined;
+            const baseline = client
+                ? await readDaemonProjectionBaseline(client, config.machineId, { timeoutMs: startDaemonTimeoutMs })
+                : undefined;
+            const stop = await stopLocalDaemon();
+            if (stop.running || stop.alive) {
+                throw new CliError("Daemon did not stop before the restart deadline; no replacement process was started.", "DAEMON_STOP_FAILED");
+            }
+            const daemon = await ensureDaemonRunning(config);
+            const readiness = await waitForLocalDaemonReadiness(client, config, baseline, daemon, true);
+            return {
+                stop,
+                startedPid: daemon.startedPid ?? readiness.local.pid,
+                pidPath: daemonPidPath,
+                local: readiness.local,
+                machineId: readiness.machine?.id ?? config.machineId,
+                relayAuthenticated: readiness.relayAuthenticated,
+                ...(readiness.relayAuthenticated === "verified" ? { online: true } : {}),
+            };
         });
+        ok("daemon.restart", result);
         return true;
     }
     if (domain === "daemon" && action === "status" && flags.local === true) {
@@ -506,6 +519,8 @@ function writeHumanDaemonStartOutput(data) {
     if (data.relayAuthenticated === "unverified") {
         console.log("Local daemon identity is ready; relay authentication was not verified because this host has no matching Device credential.");
     }
+    if (data.needsAttention)
+        console.log(`Automatic startup needs attention: ${data.needsAttention}`);
     console.log("This command manages only the paired background daemon; it does not open a browser page.");
     console.log("For setup or browser onboarding, run: happy-elves start");
 }

package/apps/cli/dist/commands/lib/account-snapshot.d.ts

@@ -0,0 +1,13 @@
+declare const snapshotFiles: readonly ["config.json", "daemon.json", "account.json"];
+export type AccountSnapshotFile = (typeof snapshotFiles)[number];
+export type AccountSnapshotContents = Partial<Record<AccountSnapshotFile, string>>;
+type SnapshotMutationHooks = {
+    beforeTarget?(file: AccountSnapshotFile): Promise<void>;
+    afterTarget?(file: AccountSnapshotFile): Promise<void>;
+};
+export declare function recoverAccountSnapshotMutation(): Promise<void>;
+export declare function commitAccountSnapshotMutation(desired: AccountSnapshotContents, operation: "reset" | "restore" | "adopt-device", hooks?: SnapshotMutationHooks): Promise<{
+    restored: string[];
+    removed: string[];
+}>;
+export {};