@cydm/happy-elves 0.1.0-beta.8 → 0.1.0-beta.80

package/README.md

@@ -5,11 +5,19 @@ Public beta CLI for Happy Elves.
 ## Hosted relay
 
 ```bash
-happy-elves account create --relay https://relay.happyelves.ai --device-name "CLI" --json
+happy-elves start
+```
+
+Reconnect this Device to an existing Account with a one-time invite from Settings → Devices → Add Device (the CLI command name is retained for compatibility):
+
+```bash
+happy-elves remote join-controller --url "<invite-url>" --recover-controller --json
 ```
 
 ## Self-host relay
 
 ```bash
+HAPPY_ELVES_ENV=production \
+HAPPY_ELVES_ALLOWED_ORIGINS=https://your-controller.example \
 happy-elves relay serve --host 0.0.0.0 --port 8787 --json
 ```

package/apps/cli/dist/commands/account.d.ts

@@ -1,2 +1,6 @@
 import type { CommandInput } from "./command.js";
+export declare function confirmReset(flags: Record<string, string | boolean>, testIo?: {
+    interactive: boolean;
+    question?: () => Promise<string>;
+}): Promise<void>;
 export declare function handleAccount({ domain, action, flags }: CommandInput): Promise<boolean>;

package/apps/cli/dist/commands/account.js

@@ -1,51 +1,419 @@
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { configDir, configPath, generateAccountSecret, ok, parsePairingStartResponse, randomId, readRelayJson, requireRelayUrl, stopLocalDaemon, throwRelayHttpError, writeConfig } from "./lib/index.js";
+import { createInterface } from "node:readline/promises";
+import { accountBindingPath, assertNoPendingEnrollmentAuthority, CliError, configDir, configPath, generateAccountSecret, ok, parseControllerConfig, parseDaemonConfig, parseLocalAccountBinding, parsePairingStartResponse, randomId, readLocalAccountBinding, readRelayJson, requireRelayUrl, stopLocalDaemon, throwRelayHttpError, withAccountConfigTransaction, } from "./lib/index.js";
+import { createLocalAccountBindingV1, localAccountBindingMatchesV1, } from "../../../../packages/shared/dist/index.js";
+import { commitAccountSnapshotMutation, } from "./lib/account-snapshot.js";
+const daemonConfigPath = path.join(configDir, "daemon.json");
+const accountConfigFiles = ["config.json", "daemon.json", "account.json"];
+const accountCreateRelayTimeoutMs = 15_000;
+function accountConfigTarget(file) {
+    if (file === "config.json")
+        return configPath;
+    return file === "daemon.json" ? daemonConfigPath : accountBindingPath;
+}
+export async function confirmReset(flags, testIo) {
+    if (flags.json === true) {
+        if (flags.yes === true)
+            return;
+        throw new CliError("account reset --json requires --yes", "CONFIRMATION_REQUIRED");
+    }
+    const interactive = testIo?.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if (!interactive) {
+        if (flags.yes === true)
+            return;
+        throw new CliError("account reset requires --yes in non-interactive mode", "CONFIRMATION_REQUIRED");
+    }
+    if (testIo?.question) {
+        const answer = await testIo.question();
+        if (answer.trim() !== "RESET")
+            throw new CliError("Account reset cancelled", "CONFIRMATION_REQUIRED");
+        return;
+    }
+    const prompt = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await prompt.question("Type RESET to remove this controller and daemon configuration: ");
+        if (answer.trim() !== "RESET")
+            throw new CliError("Account reset cancelled", "CONFIRMATION_REQUIRED");
+    }
+    finally {
+        prompt.close();
+    }
+}
+async function confirmRestore(flags, requiresConfirmation, testIo) {
+    if (!requiresConfirmation)
+        return;
+    if (flags.json === true) {
+        if (flags.yes === true)
+            return;
+        throw new CliError("account restore --json requires --yes when replacing or removing configuration", "CONFIRMATION_REQUIRED");
+    }
+    const interactive = testIo?.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if (!interactive) {
+        if (flags.yes === true)
+            return;
+        throw new CliError("account restore requires --yes in non-interactive mode when replacing or removing configuration", "CONFIRMATION_REQUIRED");
+    }
+    if (testIo?.question) {
+        const answer = await testIo.question();
+        if (answer.trim() !== "RESTORE")
+            throw new CliError("Account restore cancelled", "CONFIRMATION_REQUIRED");
+        return;
+    }
+    const prompt = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer = await prompt.question("Type RESTORE to replace the current controller and daemon configuration: ");
+        if (answer.trim() !== "RESTORE")
+            throw new CliError("Account restore cancelled", "CONFIRMATION_REQUIRED");
+    }
+    finally {
+        prompt.close();
+    }
+}
+async function copyConfigIfPresent(source, target) {
+    try {
+        const stat = await fs.lstat(source);
+        if (!stat.isFile() || stat.isSymbolicLink())
+            throw new CliError(`Refusing to copy non-regular config file: ${source}`, "CONFIG_BACKUP_UNSAFE");
+        const contents = await fs.readFile(source);
+        let handle;
+        try {
+            handle = await fs.open(target, "wx", 0o600);
+            await handle.writeFile(contents);
+            await handle.chmod(0o600);
+            await handle.sync();
+        }
+        finally {
+            await handle?.close().catch(() => undefined);
+        }
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+const unsupportedWindowsDirectorySyncCodes = new Set(["EINVAL", "ENOTSUP", "EISDIR", "EPERM"]);
+async function syncDirectory(directory) {
+    let handle;
+    try {
+        handle = await fs.open(directory, "r");
+        await handle.sync();
+    }
+    catch (error) {
+        if (process.platform !== "win32"
+            || !unsupportedWindowsDirectorySyncCodes.has(error.code ?? ""))
+            throw error;
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+async function writeSyncedBackupManifest(filePath, contents) {
+    let handle;
+    try {
+        handle = await fs.open(filePath, "wx", 0o600);
+        await handle.writeFile(contents, "utf8");
+        await handle.chmod(0o600);
+        await handle.sync();
+    }
+    finally {
+        await handle?.close().catch(() => undefined);
+    }
+}
+async function backupAccountConfig(prefix = "account-reset") {
+    const stamp = new Date().toISOString().replace(/[:.]/gu, "-");
+    const backupsRoot = path.join(configDir, "backups");
+    let rootCreated = false;
+    try {
+        await fs.mkdir(backupsRoot, { mode: 0o700 });
+        rootCreated = true;
+    }
+    catch (error) {
+        if (error.code !== "EEXIST")
+            throw error;
+    }
+    const backupsStat = await fs.lstat(backupsRoot);
+    if (!backupsStat.isDirectory() || backupsStat.isSymbolicLink()) {
+        throw new CliError("Refusing to write an account backup through an unsafe backups path.", "CONFIG_BACKUP_UNSAFE");
+    }
+    await fs.chmod(backupsRoot, 0o700);
+    if (rootCreated)
+        await syncDirectory(configDir);
+    const backupPath = path.join(backupsRoot, `${prefix}-${stamp}-${randomId("backup")}`);
+    const stagingPath = path.join(backupsRoot, `.account-backup-staging-${randomId("backup")}`);
+    await fs.mkdir(stagingPath, { mode: 0o700 });
+    await fs.chmod(stagingPath, 0o700);
+    await syncDirectory(backupsRoot);
+    const files = [];
+    if (await copyConfigIfPresent(configPath, path.join(stagingPath, "config.json")))
+        files.push("config.json");
+    if (await copyConfigIfPresent(daemonConfigPath, path.join(stagingPath, "daemon.json")))
+        files.push("daemon.json");
+    if (await copyConfigIfPresent(accountBindingPath, path.join(stagingPath, "account.json")))
+        files.push("account.json");
+    await writeSyncedBackupManifest(path.join(stagingPath, "manifest.json"), JSON.stringify({ version: 1, createdAt: new Date().toISOString(), files }, null, 2) + "\n");
+    await syncDirectory(stagingPath);
+    await fs.rename(stagingPath, backupPath);
+    await syncDirectory(backupsRoot);
+    return { path: backupPath, files };
+}
+async function requireDaemonStopped() {
+    let stop;
+    try {
+        stop = await stopLocalDaemon();
+    }
+    catch (error) {
+        if (error instanceof CliError && ["DAEMON_PID_UNVERIFIED", "DAEMON_PID_VERSION_UNSUPPORTED", "DAEMON_PID_INVALID"].includes(error.code))
+            throw error;
+        throw new CliError(`Could not stop the local daemon: ${error instanceof Error ? error.message : String(error)}`, "DAEMON_STOP_FAILED");
+    }
+    if (stop.running) {
+        throw new CliError(`The local daemon${stop.pid ? ` (pid ${stop.pid})` : ""} did not stop. Configuration was not changed; stop it and retry.`, "DAEMON_STOP_FAILED");
+    }
+    return stop;
+}
+async function requireRegularBackupFile(filePath) {
+    let stat;
+    try {
+        stat = await fs.lstat(filePath);
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new CliError(`Account backup is missing ${path.basename(filePath)}.`, "ACCOUNT_BACKUP_INVALID");
+        }
+        throw error;
+    }
+    if (!stat.isFile() || stat.isSymbolicLink()) {
+        throw new CliError(`Account backup contains an unsafe ${path.basename(filePath)}.`, "ACCOUNT_BACKUP_INVALID");
+    }
+}
+async function stageAccountRestore(backupPath, requestedFiles) {
+    await fs.mkdir(configDir, { recursive: true, mode: 0o700 });
+    await fs.chmod(configDir, 0o700);
+    const stagingPath = await fs.mkdtemp(path.join(configDir, ".account-restore-"));
+    await fs.chmod(stagingPath, 0o700);
+    let files = [...requestedFiles];
+    let controller;
+    let daemon;
+    let binding;
+    try {
+        for (const file of files) {
+            const source = path.join(backupPath, file);
+            await requireRegularBackupFile(source);
+            const contents = await fs.readFile(source, "utf8");
+            try {
+                const parsed = JSON.parse(contents);
+                if (file === "config.json")
+                    controller = parseControllerConfig(parsed);
+                else if (file === "daemon.json")
+                    daemon = parseDaemonConfig(parsed);
+                else if (file === "account.json")
+                    binding = parseLocalAccountBinding(parsed);
+            }
+            catch {
+                throw new CliError(`Account backup ${file} is not valid JSON.`, "ACCOUNT_BACKUP_INVALID");
+            }
+            const staged = path.join(stagingPath, file);
+            await fs.writeFile(staged, contents, { mode: 0o600, flag: "wx" });
+            await fs.chmod(staged, 0o600);
+        }
+        if (controller && daemon &&
+            (controller.relayUrl !== daemon.relayUrl ||
+                controller.accountSecret !== daemon.accountSecret)) {
+            throw new CliError("Account backup Device and Daemon credentials identify different Accounts.", "ACCOUNT_BACKUP_INVALID");
+        }
+        if (binding) {
+            if (controller && !localAccountBindingMatchesV1(binding, {
+                relayUrl: controller.relayUrl,
+                accountSecret: controller.accountSecret,
+            }) ||
+                daemon && !localAccountBindingMatchesV1(binding, {
+                    relayUrl: daemon.relayUrl,
+                    accountId: daemon.accountId,
+                    accountSecret: daemon.accountSecret,
+                })) {
+                throw new CliError("Account backup binding does not match its Device or Daemon credential.", "ACCOUNT_BACKUP_INVALID");
+            }
+        }
+        else if (controller || daemon) {
+            const credential = controller ?? daemon;
+            if (!credential)
+                throw new CliError("Account backup credential is missing.", "ACCOUNT_BACKUP_INVALID");
+            binding = createLocalAccountBindingV1({
+                relayUrl: credential.relayUrl,
+                accountId: daemon?.accountId ?? null,
+                accountSecret: credential.accountSecret,
+            });
+            const stagedBinding = path.join(stagingPath, "account.json");
+            await fs.writeFile(stagedBinding, `${JSON.stringify(binding, null, 2)}\n`, { mode: 0o600, flag: "wx" });
+            await fs.chmod(stagedBinding, 0o600);
+            files = [...files, "account.json"];
+        }
+        return { path: stagingPath, files };
+    }
+    catch (error) {
+        await fs.rm(stagingPath, { recursive: true, force: true });
+        throw error;
+    }
+}
+async function currentAccountConfigFiles() {
+    const existing = [];
+    for (const file of accountConfigFiles) {
+        const target = accountConfigTarget(file);
+        try {
+            const stat = await fs.lstat(target);
+            if (!stat.isFile() || stat.isSymbolicLink()) {
+                throw new CliError(`Refusing to replace unsafe account config: ${target}`, "ACCOUNT_RESTORE_UNSAFE");
+            }
+            existing.push(file);
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                continue;
+            throw error;
+        }
+    }
+    return existing;
+}
 export async function handleAccount({ domain, action, flags }) {
     if (domain === "account" && action === "create") {
-        const relayUrl = requireRelayUrl(flags);
-        const deviceId = typeof flags["device-id"] === "string" ? flags["device-id"] : randomId("dev");
-        const deviceName = typeof flags["device-name"] === "string" ? flags["device-name"] : os.hostname();
-        const accountSecret = generateAccountSecret();
-        const response = await fetch(`${relayUrl}/api/pairing/start`, {
-            method: "POST",
-            headers: { "content-type": "application/json" },
-            body: JSON.stringify({ deviceId, deviceName }),
-        });
-        if (!response.ok) {
-            await throwRelayHttpError(response, "Account creation failed");
-        }
-        const paired = parsePairingStartResponse(await readRelayJson(response, "Account creation response is not valid JSON"));
-        const config = {
-            relayUrl,
-            controllerToken: paired.controllerToken,
-            accountSecret,
-        };
-        await writeConfig(config);
-        ok("account.create", {
-            accountId: paired.accountId,
-            configPath,
-            relayUrl,
-            controllerToken: paired.controllerToken,
-            accountSecret,
-            pairingCode: paired.pairingCode,
-            expiresAt: paired.expiresAt,
+        const created = await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
+            // This check intentionally precedes every relay request. Holding the
+            // account-wide lease through pairing prevents concurrent creators from
+            // producing an orphan remote account and racing the local credential.
+            if (await transaction.accountExists() ||
+                await transaction.controllerExists() ||
+                await transaction.daemonExists()) {
+                throw new CliError("Happy Elves account configuration already exists. Use an invite to recover the existing account; account create never replaces credentials.", "CONFIG_EXISTS");
+            }
+            const relayUrl = requireRelayUrl(flags);
+            const deviceId = typeof flags["device-id"] === "string" ? flags["device-id"] : randomId("dev");
+            const deviceName = typeof flags["device-name"] === "string" ? flags["device-name"] : os.hostname();
+            const accountSecret = generateAccountSecret();
+            let response;
+            try {
+                response = await fetch(`${relayUrl}/api/pairing/start`, {
+                    method: "POST",
+                    headers: { "content-type": "application/json" },
+                    body: JSON.stringify({ deviceId, deviceName, surface: "cli" }),
+                    signal: AbortSignal.timeout(accountCreateRelayTimeoutMs),
+                });
+            }
+            catch (error) {
+                if (error.name === "TimeoutError") {
+                    throw new CliError("Timed out creating the account at the relay. No local configuration was written.", "RELAY_TIMEOUT");
+                }
+                throw error;
+            }
+            if (!response.ok) {
+                await throwRelayHttpError(response, "Account creation failed");
+            }
+            const paired = parsePairingStartResponse(await readRelayJson(response, "Account creation response is not valid JSON"));
+            const config = {
+                relayUrl,
+                controllerToken: paired.controllerToken,
+                accountSecret,
+            };
+            await transaction.writeController(config, "create", paired.accountId);
+            return {
+                accountId: paired.accountId,
+                configPath,
+                relayUrl,
+                deviceId,
+                controllerToken: paired.controllerToken,
+                accountSecret,
+                pairingCode: paired.pairingCode,
+                expiresAt: paired.expiresAt,
+            };
         });
+        if (flags["reveal-secrets"] === true) {
+            ok("account.create", created);
+        }
+        else {
+            const { controllerToken: _controllerToken, accountSecret: _accountSecret, ...safeCreated } = created;
+            ok("account.create", safeCreated);
+        }
         return true;
     }
     if (domain === "account" && action === "reset") {
-        const stop = await stopLocalDaemon().catch((error) => ({
-            error: error instanceof Error ? error.message : String(error),
-        }));
-        await fs.rm(configPath, { force: true });
-        await fs.rm(path.join(configDir, "daemon.json"), { force: true });
+        await confirmReset(flags);
+        // Reject an unknown or malformed ownership boundary before stopping a
+        // healthy Daemon. The locked read below repeats this check at commit.
+        await readLocalAccountBinding();
+        await assertNoPendingEnrollmentAuthority();
+        const { backup, stop } = await withAccountConfigTransaction(async (transaction) => {
+            await transaction.readAccountBinding();
+            await assertNoPendingEnrollmentAuthority();
+            // Lock order is Account config -> verified Daemon lifetime. Local
+            // start/restart use the same order, so no process can reload the old
+            // credential between this stop and the snapshot commit.
+            const stop = await requireDaemonStopped();
+            const result = await backupAccountConfig();
+            await commitAccountSnapshotMutation({}, "reset");
+            return { backup: result, stop };
+        });
         ok("account.reset", {
-            removed: [configPath, path.join(configDir, "daemon.json")],
+            removed: [configPath, daemonConfigPath, accountBindingPath],
+            backup,
+            restoreCommand: `happy-elves account restore --from ${JSON.stringify(backup.path)} --yes --json`,
             stop,
         });
         return true;
     }
+    if (domain === "account" && action === "restore") {
+        const backupPath = typeof flags.from === "string" && flags.from.trim() ? path.resolve(flags.from) : undefined;
+        if (!backupPath)
+            throw new CliError("Missing --from", "MISSING_ARGUMENT");
+        const manifestPath = path.join(backupPath, "manifest.json");
+        let manifest;
+        try {
+            await requireRegularBackupFile(manifestPath);
+            manifest = JSON.parse(await fs.readFile(manifestPath, "utf8"));
+        }
+        catch (error) {
+            throw new CliError(`Invalid account backup: ${error instanceof Error ? error.message : String(error)}`, "ACCOUNT_BACKUP_INVALID");
+        }
+        if (manifest.version !== 1 ||
+            !Array.isArray(manifest.files) ||
+            !manifest.files.every((file) => accountConfigFiles.includes(file)) ||
+            new Set(manifest.files).size !== manifest.files.length) {
+            throw new CliError("Account backup manifest is invalid", "ACCOUNT_BACKUP_INVALID");
+        }
+        const files = manifest.files;
+        const staged = await stageAccountRestore(backupPath, files);
+        try {
+            const existing = await currentAccountConfigFiles();
+            await confirmRestore(flags, files.length === 0 || existing.length > 0);
+            await readLocalAccountBinding();
+            await assertNoPendingEnrollmentAuthority();
+            const { preRestoreBackup, restored, stop } = await withAccountConfigTransaction(async (transaction) => {
+                await transaction.readAccountBinding();
+                await assertNoPendingEnrollmentAuthority();
+                const stop = await requireDaemonStopped();
+                const preRestoreBackup = await backupAccountConfig("account-pre-restore");
+                const desired = {};
+                for (const file of staged.files) {
+                    desired[file] = await fs.readFile(path.join(staged.path, file), "utf8");
+                }
+                const restored = await commitAccountSnapshotMutation(desired, "restore");
+                return { preRestoreBackup, restored, stop };
+            });
+            ok("account.restore", {
+                backupPath,
+                ...restored,
+                preRestoreBackup,
+                restorePreviousCommand: `happy-elves account restore --from ${JSON.stringify(preRestoreBackup.path)} --yes --json`,
+                stop,
+            });
+        }
+        finally {
+            await fs.rm(staged.path, { recursive: true, force: true });
+        }
+        return true;
+    }
     return false;
 }
-//# sourceMappingURL=account.js.map

package/apps/cli/dist/commands/app.js

@@ -1,19 +1,20 @@
 import { handleAccount } from "./account.js";
-import { handleCancel } from "./cancel.js";
 import { handleCollect } from "./collect.js";
 import { handleConfig } from "./config.js";
 import { handleDaemon } from "./daemon.js";
+import { handleDiagnostics } from "./diagnostics.js";
+import { handleGateway } from "./gateway.js";
 import { handleLoop } from "./loop.js";
 import { handleMachine } from "./machine.js";
+import { handleMemory } from "./memory.js";
+import { handleOrchestrator } from "./orchestrator.js";
 import { handleRelay } from "./relay.js";
 import { handleRemote } from "./remote.js";
-import { handleResult } from "./result.js";
-import { handleRun } from "./run.js";
 import { handleSession } from "./session.js";
+import { handleSkill } from "./skill.js";
 import { handleToken } from "./token.js";
-import { handleWait } from "./wait.js";
-import { handleWorkspace } from "./workspace.js";
-import { commandUsage, commandUsageText, handleCliError, parseCliFlags, startBootstrap, topLevelDoctor, topLevelStatus, usage, usageText } from "./lib/index.js";
+import { handleTurn } from "./turn.js";
+import { buildIdentity, cliVersion, commandUsage, commandUsageText, handleCliError, ok, parseCliFlags, skillText, startBootstrap, topLevelDoctor, topLevelStatus, usage, usageText } from "./lib/index.js";
 export { handleCliError };
 const domainHandlers = [
     handleAccount,
@@ -22,26 +23,43 @@ const domainHandlers = [
     handleToken,
     handleLoop,
     handleDaemon,
+    handleDiagnostics,
     handleRelay,
     handleMachine,
-    handleWorkspace,
+    handleMemory,
+    handleGateway,
+    handleOrchestrator,
     handleSession,
-    handleRun,
-    handleResult,
-    handleWait,
+    handleSkill,
+    handleTurn,
     handleCollect,
-    handleCancel,
 ];
-const directSessionIdCommands = new Set(["run", "result", "wait", "collect", "cancel"]);
 export async function main() {
-    const argv = process.argv.slice(2);
+    const rawArgv = process.argv.slice(2);
+    const argv = rawArgv[0] === "--" ? rawArgv.slice(1) : rawArgv;
     const [domain] = argv;
     if (!domain)
         usage();
+    if (domain === "--skill") {
+        console.log(skillText());
+        return;
+    }
     if (domain === "--help" || domain === "-h" || domain === "help") {
         console.log(usageText());
         return;
     }
+    if (domain === "--version" || domain === "-v") {
+        console.log(cliVersion());
+        return;
+    }
+    if (domain === "version") {
+        const { flags } = parseCliFlags(argv.slice(1));
+        if (flags.json === true)
+            ok("version", buildIdentity());
+        else
+            console.log(cliVersion());
+        return;
+    }
     const topLevelHelpRequested = argv[1] === "help" || argv.slice(1).some((arg) => arg === "--help" || arg === "-h");
     if (topLevelHelpRequested && commandUsageText(domain)) {
         console.log(commandUsageText(domain));
@@ -62,13 +80,9 @@ export async function main() {
         await topLevelStatus(flags);
         return;
     }
-    let action = argv[1];
-    let rest = argv.slice(2);
-    if (directSessionIdCommands.has(domain) && action?.startsWith("-")) {
-        action = undefined;
-        rest = argv.slice(1);
-    }
-    if (!directSessionIdCommands.has(domain) && (!action || action.startsWith("-")) && commandUsageText(domain)) {
+    const action = argv[1];
+    const rest = argv.slice(2);
+    if ((!action || action.startsWith("-")) && commandUsageText(domain)) {
         commandUsage(domain);
     }
     const { positional, flags } = parseCliFlags(rest);
@@ -83,4 +97,3 @@ export async function main() {
     }
     usage();
 }
-//# sourceMappingURL=app.js.map

package/apps/cli/dist/commands/collect.js

@@ -1,4 +1,4 @@
-import { CliError, ControllerClient, ok, parseEventCursor, printConciseEvents, readConfig, requirePositional, wantsJson, wantsVerbose } from "./lib/index.js";
+import { CliError, ControllerClient, conciseEvents, ok, parseEventCursor, printConciseEvents, readConfig, requirePositional, wantsJson, wantsVerbose } from "./lib/index.js";
 export async function handleCollect({ domain, action, flags }) {
     if (domain !== "collect")
         return false;
@@ -14,7 +14,13 @@ export async function handleCollect({ domain, action, flags }) {
     const lastEventId = events.at(-1)?.id;
     const nextSince = lastEventId === undefined ? (since ?? null) : `cursor_${lastEventId}`;
     if (wantsJson(flags) || wantsVerbose(flags)) {
-        ok("session.collect", { sessionId, cursor: nextSince, nextSince, events }, { sessionId });
+        ok("session.collect", {
+            sessionId,
+            debugOnly: true,
+            cursor: nextSince,
+            nextSince,
+            ...(wantsVerbose(flags) ? { events } : { events: conciseEvents(events) }),
+        }, { sessionId });
     }
     else {
         printConciseEvents(events);
@@ -22,4 +28,3 @@ export async function handleCollect({ domain, action, flags }) {
     }
     return true;
 }
-//# sourceMappingURL=collect.js.map

package/apps/cli/dist/commands/command.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=command.js.map

package/apps/cli/dist/commands/config.js

@@ -1,4 +1,4 @@
-import { configPath, ok, readConfig, redactedControllerConfig, requireRelayUrl, requireString, wantsJson, writeConfig } from "./lib/index.js";
+import { assertNoPendingEnrollmentAuthority, CliError, configPath, ok, readConfig, redactedControllerConfig, redactedRelayUrl, requireRelayUrl, requireString, wantsJson, withAccountConfigTransaction } from "./lib/index.js";
 export async function handleConfig({ domain, action, flags }) {
     if (domain === "config" && action === "init") {
         const config = {
@@ -6,8 +6,20 @@ export async function handleConfig({ domain, action, flags }) {
             controllerToken: requireString(flags, "token"),
             accountSecret: requireString(flags, "secret"),
         };
-        await writeConfig(config);
-        ok("config.init", { path: configPath, relayUrl: config.relayUrl });
+        await withAccountConfigTransaction(async (transaction) => {
+            await assertNoPendingEnrollmentAuthority();
+            if (await transaction.accountExists()) {
+                throw new CliError("Account binding already exists. config init never replaces Account ownership.", "CONFIG_EXISTS");
+            }
+            if (await transaction.controllerExists()) {
+                throw new CliError("Controller configuration already exists. config init never replaces credentials.", "CONFIG_EXISTS");
+            }
+            if (await transaction.daemonExists()) {
+                throw new CliError("A daemon configuration already exists. Recover a controller with a same-account invite instead of creating an unverifiable split configuration.", "CONFIG_SPLIT_BRAIN");
+            }
+            await transaction.writeController(config, "create");
+        });
+        ok("config.init", { path: configPath, relayUrl: redactedRelayUrl(config.relayUrl) });
         return true;
     }
     if (domain === "config" && action === "show") {
@@ -16,7 +28,7 @@ export async function handleConfig({ domain, action, flags }) {
             const redacted = redactedControllerConfig(config);
             console.log(`Config: ${configPath}`);
             console.log(`Relay: ${redacted.relayUrl}`);
-            console.log(`Controller token: ${redacted.hasControllerToken ? "configured" : "missing"}`);
+            console.log(`Device credential: ${redacted.hasControllerToken ? "configured" : "missing"}`);
             console.log(`Account secret: ${redacted.hasAccountSecret ? "configured" : "missing"}`);
             return true;
         }
@@ -28,4 +40,3 @@ export async function handleConfig({ domain, action, flags }) {
     }
     return false;
 }
-//# sourceMappingURL=config.js.map