@skrr-ai/cli 0.1.108 → 0.1.109

package/dist/lib/daemonBrokerRefusal.js

@@ -5,6 +5,7 @@ exports.describeBrokerRefusal = describeBrokerRefusal;
 exports.describeGuestDaemonUnavailable = describeGuestDaemonUnavailable;
 exports.describeLocalDaemonUnavailable = describeLocalDaemonUnavailable;
 exports.describeBrokerFailure = describeBrokerFailure;
+const daemon_command_hint_1 = require("./daemon-command-hint");
 /**
  * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
  * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
@@ -89,12 +90,12 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
     }
     else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
         remedy =
-            `Run \`${bin} daemon login\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
+            `Run \`${(0, daemon_command_hint_1.daemonCommandHint)('login', { bin })}\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
                 `\`${bin} login\` signs this CLI in on its own instead.`;
     }
     else if (DAEMON_RELOGIN_CODES.has(code) || failure.reason === 'daemon_not_authed') {
         remedy =
-            `Run \`${bin} daemon login\` to sign the background service in again, then retry. ` +
+            `Run \`${(0, daemon_command_hint_1.daemonCommandHint)('login', { bin })}\` to sign the background service in again, then retry. ` +
                 `\`${bin} login\` signs this CLI in on its own instead.`;
     }
     else if (failure.reason === 'ci_token_refused') {

package/dist/lib/daemonHandoff.js

@@ -256,7 +256,8 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         return {
             status: 'skipped',
             reason: 'unsupported-daemon',
-            detail: 'the installed daemon predates `accept-handoff`; run `skrr daemon login` once',
+            // The remedy is named by the caller, spelled for the profile (OSK-16435).
+            detail: 'the installed daemon is too old to accept a hand-off',
         };
     }
     // Ask the daemon which id it will bind, rather than deriving it here. The id

package/dist/lib/deployed-build.d.ts

@@ -0,0 +1,43 @@
+/**
+ * What the server this CLI talks to is running: the commit its API was built
+ * from and the commit its web shell was built from (OSK-15497).
+ *
+ * Both are public facts the server already publishes for anyone:
+ *   - the API: `GET /api/health` → `build.commit`, baked into the image once at
+ *     build time by the release pipeline;
+ *   - the web: `GET /web-version.json` → `sha`, written into the shell when it
+ *     is published.
+ *
+ * They are read separately and shown separately because they legitimately
+ * differ: a release that changes only API code keeps the published shell, and
+ * a frontend-only release keeps the API image. Collapsing them into one
+ * "deployed version" would be wrong whenever that happens, which is often.
+ *
+ * Neither read needs a credential, and neither failure is the user's problem,
+ * so a failure is reported as "could not read" with the reason, never as an
+ * error that fails `doctor`.
+ */
+export type BuildCommitRead = {
+    /** The 40-hex commit, or null when the server did not name one. */
+    commit: string | null;
+    /** Where it was read from, so a reader can check it themselves. */
+    source: string;
+    /** Why there is no commit: unreadable, or the server reports an unstamped build. */
+    error: string | null;
+};
+export type DeployedBuild = {
+    api: BuildCommitRead;
+    web: BuildCommitRead;
+};
+type FetchLike = (url: string, init?: {
+    headers?: Record<string, string>;
+    signal?: AbortSignal;
+}) => Promise<{
+    ok: boolean;
+    status: number;
+    json: () => Promise<unknown>;
+}>;
+export declare function readDeployedBuild(baseURL: string, fetchImpl?: FetchLike): Promise<DeployedBuild>;
+/** The lines `skrr doctor` prints under the server. */
+export declare function deployedBuildLines(build: DeployedBuild): string[];
+export {};

package/dist/lib/deployed-build.js

@@ -0,0 +1,66 @@
+"use strict";
+/**
+ * What the server this CLI talks to is running: the commit its API was built
+ * from and the commit its web shell was built from (OSK-15497).
+ *
+ * Both are public facts the server already publishes for anyone:
+ *   - the API: `GET /api/health` → `build.commit`, baked into the image once at
+ *     build time by the release pipeline;
+ *   - the web: `GET /web-version.json` → `sha`, written into the shell when it
+ *     is published.
+ *
+ * They are read separately and shown separately because they legitimately
+ * differ: a release that changes only API code keeps the published shell, and
+ * a frontend-only release keeps the API image. Collapsing them into one
+ * "deployed version" would be wrong whenever that happens, which is often.
+ *
+ * Neither read needs a credential, and neither failure is the user's problem,
+ * so a failure is reported as "could not read" with the reason, never as an
+ * error that fails `doctor`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readDeployedBuild = readDeployedBuild;
+exports.deployedBuildLines = deployedBuildLines;
+const COMMIT = /^[a-f0-9]{40}$/;
+const TIMEOUT_MS = 5_000;
+async function readCommit(url, pick, unstamped, fetchImpl) {
+    try {
+        const res = await fetchImpl(url, {
+            headers: { accept: 'application/json' },
+            signal: AbortSignal.timeout(TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return { commit: null, source: url, error: `HTTP ${res.status}` };
+        const value = pick(await res.json());
+        if (typeof value === 'string' && COMMIT.test(value)) {
+            return { commit: value, source: url, error: null };
+        }
+        return { commit: null, source: url, error: unstamped };
+    }
+    catch (err) {
+        return {
+            commit: null,
+            source: url,
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+async function readDeployedBuild(baseURL, fetchImpl = fetch) {
+    const origin = baseURL.replace(/\/+$/, '');
+    const [api, web] = await Promise.all([
+        readCommit(`${origin}/api/health`, (body) => body?.build?.commit, 'the server does not report the commit its API was built from', fetchImpl),
+        readCommit(`${origin}/web-version.json`, (body) => body?.sha, 'the published web shell carries no commit', fetchImpl),
+    ]);
+    return { api, web };
+}
+const short = (sha) => sha.slice(0, 12);
+/** The lines `skrr doctor` prints under the server. */
+function deployedBuildLines(build) {
+    const describe = (read) => read.commit ? short(read.commit) : `unknown (${read.error ?? 'no commit'})`;
+    const lines = [`Deployed: API ${describe(build.api)} · web ${describe(build.web)}`];
+    if (build.api.commit && build.web.commit && build.api.commit !== build.web.commit) {
+        lines.push('          Built from different commits. That is normal: a release that changes only ' +
+            'one of them keeps the other as it was.');
+    }
+    return lines;
+}

package/dist/lib/grants.d.ts

@@ -1,4 +1,5 @@
 import type { GrantAccess, GrantAccessSource } from '@skrr-ai/data-provider';
+import { type TableColumn } from './format';
 export declare const GRANT_PRINCIPAL_KINDS: readonly ["agent", "commitment"];
 export declare const GRANT_CREDENTIAL_KINDS: readonly ["env", "bearer", "basic", "json"];
 export interface GrantPrincipal {
@@ -20,7 +21,8 @@ export interface Grant {
         configured: boolean;
         kind?: string;
         envKeys: string[];
-        fingerprint?: string;
+        /** When the value was last set (create or rotate). Never a digest of it. */
+        setAt?: string;
     } | null;
     tools: string[];
     runtime: {
@@ -58,4 +60,28 @@ export declare const grantApi: {
  * gate that could drift.
  */
 export declare function parseEnvPairs(pairs: string[]): Record<string, string>;
+/** The cells every Grant table shows, in one place (OSK-15357). */
+export type GrantTableCells = {
+    id: string;
+    label: string;
+    provider: string;
+    access: string;
+    principal: string;
+    credential: string;
+    runtime: string;
+    state: string;
+};
+/**
+ * One Grant as table cells. `skrr grants list` and `skrr workspaces grants`
+ * both read this, so a column with the same header means the same thing in
+ * both and the two tables can be compared by eye. They used not to: the
+ * workspace table printed capabilities under ACCESS while this one printed the
+ * declared access class.
+ */
+export declare function grantTableCells(g: Pick<Grant, 'id' | 'label' | 'provider' | 'access' | 'accessSource' | 'credential' | 'revokedAt' | 'active'> & {
+    principal?: Partial<GrantPrincipal> | null;
+    runtime?: Partial<Grant['runtime']> | null;
+}): GrantTableCells;
+/** The shared columns, in order; a caller may add its own around them. */
+export declare const GRANT_TABLE_COLUMNS: Array<TableColumn<GrantTableCells>>;
 export declare function renderGrantList(grants: Grant[], log: (line: string) => void): void;

package/dist/lib/grants.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.grantApi = exports.GRANT_CREDENTIAL_KINDS = exports.GRANT_PRINCIPAL_KINDS = void 0;
+exports.GRANT_TABLE_COLUMNS = exports.grantApi = exports.GRANT_CREDENTIAL_KINDS = exports.GRANT_PRINCIPAL_KINDS = void 0;
 exports.parseEnvPairs = parseEnvPairs;
+exports.grantTableCells = grantTableCells;
 exports.renderGrantList = renderGrantList;
 /**
  * grants.ts — client for the Grant vault (`/api/grants/*`).
@@ -51,35 +52,52 @@ function parseEnvPairs(pairs) {
     }
     return out;
 }
-function renderGrantList(grants, log) {
-    if (grants.length === 0) {
-        log('No grants.');
-        return;
-    }
-    (0, format_1.renderTable)(grants.map((g) => ({
+/**
+ * One Grant as table cells. `skrr grants list` and `skrr workspaces grants`
+ * both read this, so a column with the same header means the same thing in
+ * both and the two tables can be compared by eye. They used not to: the
+ * workspace table printed capabilities under ACCESS while this one printed the
+ * declared access class.
+ */
+function grantTableCells(g) {
+    const principal = g.principal ?? null;
+    let state = 'expired';
+    if (g.revokedAt)
+        state = 'revoked';
+    else if (g.active)
+        state = 'active';
+    return {
         id: g.id,
         label: g.label,
-        provider: g.provider,
+        provider: g.provider || '—',
         access: g.access
             ? `${g.access} (${g.accessSource === 'attested' ? 'attested' : 'declared, not verified'})`
             : 'undeclared',
-        principal: g.principal.agentId || g.principal.commitmentId || g.principal.kind,
+        principal: principal?.agentId || principal?.commitmentId || principal?.kind || '—',
         // NAMES only. This is the audit surface; a value never reaches the CLI.
         credential: g.credential?.configured
             ? g.credential.envKeys.join(',') || g.credential.kind || 'set'
             : '-',
-        runtime: [g.runtime.sandbox ? 'sandbox' : null, g.runtime.daemon ? 'daemon' : null]
+        runtime: [g.runtime?.sandbox ? 'sandbox' : null, g.runtime?.daemon ? 'daemon' : null]
             .filter(Boolean)
             .join('+') || 'none',
-        state: g.revokedAt ? 'revoked' : g.active ? 'active' : 'expired',
-    })), [
-        { key: 'label', header: 'LABEL', maxWidth: 26 },
-        { key: 'provider', header: 'PROVIDER', maxWidth: 12 },
-        { key: 'access', header: 'ACCESS', maxWidth: 32 },
-        { key: 'principal', header: 'PRINCIPAL', maxWidth: 24 },
-        { key: 'credential', header: 'VARIABLES', maxWidth: 34 },
-        { key: 'runtime', header: 'RUNTIME', maxWidth: 16 },
-        { key: 'state', header: 'STATE', maxWidth: 8 },
-        { key: 'id', header: 'ID', verbatim: true },
-    ], log);
+        state,
+    };
+}
+/** The shared columns, in order; a caller may add its own around them. */
+exports.GRANT_TABLE_COLUMNS = [
+    { key: 'label', header: 'LABEL', maxWidth: 26 },
+    { key: 'provider', header: 'PROVIDER', maxWidth: 12 },
+    { key: 'access', header: 'ACCESS', maxWidth: 32 },
+    { key: 'principal', header: 'PRINCIPAL', maxWidth: 24 },
+    { key: 'credential', header: 'VARIABLES', maxWidth: 34 },
+    { key: 'runtime', header: 'RUNTIME', maxWidth: 16 },
+    { key: 'state', header: 'STATE', maxWidth: 8 },
+];
+function renderGrantList(grants, log) {
+    if (grants.length === 0) {
+        log('No grants.');
+        return;
+    }
+    (0, format_1.renderTable)(grants.map((g) => grantTableCells(g)), [...exports.GRANT_TABLE_COLUMNS, { key: 'id', header: 'ID', verbatim: true }], log);
 }

package/dist/lib/json-mode.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Whether a `skrr` invocation asked for JSON — ONE definition.
+ *
+ * `BaseCommand` decides this for a command that is running. A command that was
+ * never found has no `BaseCommand`: the `command_not_found` hook runs before one
+ * exists, so it asked nothing and printed prose to stderr, and a script that
+ * piped `--json` output to `jq` got "parse error: Invalid numeric literal"
+ * instead of the refusal (OSK-16434). Both now read the same rule, so a flag
+ * added to one cannot be missing from the other.
+ */
+export declare function wantsJsonFromArgv(argv: readonly string[], env?: NodeJS.ProcessEnv): boolean;

package/dist/lib/json-mode.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wantsJsonFromArgv = wantsJsonFromArgv;
+/**
+ * Whether a `skrr` invocation asked for JSON — ONE definition.
+ *
+ * `BaseCommand` decides this for a command that is running. A command that was
+ * never found has no `BaseCommand`: the `command_not_found` hook runs before one
+ * exists, so it asked nothing and printed prose to stderr, and a script that
+ * piped `--json` output to `jq` got "parse error: Invalid numeric literal"
+ * instead of the refusal (OSK-16434). Both now read the same rule, so a flag
+ * added to one cannot be missing from the other.
+ */
+function wantsJsonFromArgv(argv, env = process.env) {
+    return (argv.includes('--json') ||
+        argv.includes('--ndjson') ||
+        env.SKY_JSON === '1' ||
+        env.OVERSKY_CLI_JSON === '1');
+}

package/dist/lib/json-output.d.ts

@@ -28,4 +28,29 @@ export declare function stripStorageFields(value: Json): Json;
  * untouched, as is JSON with nothing to strip, so existing formatting survives.
  */
 export declare function stripStorageFieldsFromText(text: string): string;
+/**
+ * The outcome marker for a `--json` RESULT document (OSK-16425).
+ *
+ * A failure prints `{ok:false, error:{...}}` on stdout, so that agents get the
+ * refusal structured. A success printed whatever the server sent, with no `ok`
+ * at all — so a script could not test one field for both, and a projection such
+ * as `jq '{id, title}'` turned the error document into `{"id":null,"title":null}`,
+ * which reads as an empty success. The reporter's own diagnosis of a failed
+ * command was wrong for exactly that reason.
+ *
+ * Adding `ok` here, to a document a command already holds, is truthful by
+ * construction: the caller knows whether the command succeeded when it prints.
+ * It is NOT done to text in `BaseCommand.log`, the way storage fields are
+ * stripped, because `log` cannot see the exit status to come: `doctor`,
+ * `tasks wait`, `outbox retry` and `code install` print a document and then
+ * exit non-zero, and stamping `ok:true` on those would assert a success the
+ * exit code denies.
+ *
+ * Only an object can carry it. An array is returned as it is, and so is an
+ * object that already says `ok` — that command's own meaning wins. `ok` is put
+ * first so it is the first thing read.
+ */
+export declare function withOk<T>(value: T, ok?: boolean): T | ({
+    ok: boolean;
+} & Record<string, unknown>);
 export {};

package/dist/lib/json-output.js

@@ -20,6 +20,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stripStorageFields = stripStorageFields;
 exports.stripStorageFieldsFromText = stripStorageFieldsFromText;
+exports.withOk = withOk;
 function usableId(value) {
     return (typeof value === 'string' && value.length > 0) || typeof value === 'number';
 }
@@ -76,3 +77,32 @@ function stripStorageFieldsFromText(text) {
         return text;
     return JSON.stringify(stripped, null, text.includes('\n') ? 2 : undefined);
 }
+/**
+ * The outcome marker for a `--json` RESULT document (OSK-16425).
+ *
+ * A failure prints `{ok:false, error:{...}}` on stdout, so that agents get the
+ * refusal structured. A success printed whatever the server sent, with no `ok`
+ * at all — so a script could not test one field for both, and a projection such
+ * as `jq '{id, title}'` turned the error document into `{"id":null,"title":null}`,
+ * which reads as an empty success. The reporter's own diagnosis of a failed
+ * command was wrong for exactly that reason.
+ *
+ * Adding `ok` here, to a document a command already holds, is truthful by
+ * construction: the caller knows whether the command succeeded when it prints.
+ * It is NOT done to text in `BaseCommand.log`, the way storage fields are
+ * stripped, because `log` cannot see the exit status to come: `doctor`,
+ * `tasks wait`, `outbox retry` and `code install` print a document and then
+ * exit non-zero, and stamping `ok:true` on those would assert a success the
+ * exit code denies.
+ *
+ * Only an object can carry it. An array is returned as it is, and so is an
+ * object that already says `ok` — that command's own meaning wins. `ok` is put
+ * first so it is the first thing read.
+ */
+function withOk(value, ok = true) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return value;
+    if (Object.prototype.hasOwnProperty.call(value, 'ok'))
+        return value;
+    return { ok, ...value };
+}

package/dist/lib/list-output.d.ts

@@ -64,6 +64,15 @@ export declare function limitNote(requested: number | undefined, rowCount: numbe
 };
 /** The text-mode twin of a warning: one `Note:` line a person can act on. */
 export declare function warningLines(warnings: readonly ListWarning[] | undefined): string[];
+/**
+ * The note a TABLE prints when it was given a JSON-only projection flag. `--compact` and
+ * `--fields` shape JSON output; on the table they did nothing and said nothing, so `--compact`
+ * looked broken (OSK-15374). Empty when neither flag was given.
+ */
+export declare function textModeProjectionNotes(flags: {
+    fields?: string;
+    compact?: boolean;
+}): string[];
 export type ListOutput = {
     stdout: string[];
     stderr: string[];

package/dist/lib/list-output.js

@@ -7,6 +7,7 @@ exports.toListEnvelope = toListEnvelope;
 exports.shapeListResponse = shapeListResponse;
 exports.limitNote = limitNote;
 exports.warningLines = warningLines;
+exports.textModeProjectionNotes = textModeProjectionNotes;
 exports.renderListOutput = renderListOutput;
 /**
  * Shared output shaping for `skrr` LIST commands (agent-surface audit
@@ -29,6 +30,7 @@ exports.renderListOutput = renderListOutput;
  * Pure functions, no oclif: the commands own I/O, this owns the shape.
  */
 const core_1 = require("@oclif/core");
+const json_output_1 = require("./json-output");
 /**
  * The navigation projection per resource: enough to identify a row, decide
  * whether it matters and fetch it with `show`. Allowlists, not drop-lists, so a
@@ -206,7 +208,11 @@ function shapeListResponse(response, options) {
     if (limit.warning)
         warnings.push(limit.warning);
     return {
-        ...envelope,
+        // A list that reached this shaper succeeded; a failure never does, and prints
+        // `{ok:false, error}`. Saying so lets a script test one field for both, and
+        // keeps a projection of a failure from reading as an empty list (OSK-16425).
+        // The server's own `ok`, if it sent one, is kept.
+        ...(0, json_output_1.withOk)(envelope),
         data,
         ...(limit.applied !== undefined ? { limit_applied: limit.applied } : {}),
         ...(options.filterApplied ? { filter_applied: options.filterApplied } : {}),
@@ -247,6 +253,19 @@ function limitNote(requested, rowCount, hasMore) {
 function warningLines(warnings) {
     return (warnings ?? []).map((w) => `Note: ${w.hint}`);
 }
+/**
+ * The note a TABLE prints when it was given a JSON-only projection flag. `--compact` and
+ * `--fields` shape JSON output; on the table they did nothing and said nothing, so `--compact`
+ * looked broken (OSK-15374). Empty when neither flag was given.
+ */
+function textModeProjectionNotes(flags) {
+    const given = [flags.fields ? '--fields' : null, flags.compact ? '--compact' : null].filter(Boolean);
+    if (given.length === 0)
+        return [];
+    return [
+        `Note: ${given.join(' and ')} ${given.length > 1 ? 'shape' : 'shapes'} JSON output only; the table is unchanged. Add --json (or --ndjson) to apply ${given.length > 1 ? 'them' : 'it'}.`,
+    ];
+}
 /**
  * Render a shaped list for `--json` (pretty envelope) or `--ndjson` (rows one per
  * line, `_meta` on stderr). Pure; the caller writes the lines.

package/dist/lib/local-daemon-readiness.d.ts

@@ -0,0 +1,90 @@
+/**
+ * Whether the local daemon is actually signed in and connected — as opposed to
+ * having been handed a credential (OSK-16437).
+ *
+ * `skrr login` used to print "The local daemon was signed in too" the moment
+ * `accept-handoff` exited 0. That means the credential was WRITTEN. It says
+ * nothing about a daemon using it, and a handoff that wrote a credential for a
+ * service that was not running, or that the server then refused, left a login
+ * that announced success on one line and failed to verify it on the next, with
+ * nothing saying which was true. `skrr daemon start` learned the same lesson
+ * ("a supervisor's successful `kickstart` means only that it accepted the
+ * request") and asks the daemon itself; this is that question for login.
+ *
+ * Two probes, in order of how directly they answer:
+ *
+ *   1. the loopback identity endpoint of THIS profile's daemon, which says it is
+ *      connected as this account on this server — the only proof;
+ *   2. `skrrd status --json`, asked only once the first has not answered, to say
+ *      WHY: the server refused the credential, the service is not running, or it
+ *      is running and has not connected yet. Those have different fixes.
+ */
+export type LocalDaemonReadiness = {
+    state: 'connected';
+    daemonId: string;
+} | {
+    state: 'reauth_required';
+    profile: string;
+    reason: string | null;
+    command: string;
+} | {
+    state: 'not_running';
+    profile: string;
+    runtimeStatus: string | null;
+} | {
+    state: 'not_connected';
+    profile: string;
+} | {
+    state: 'unreadable';
+    profile: string;
+};
+export interface ReadinessDeps {
+    /** One look at the loopback identity endpoint; the daemon id when it is connected as us. */
+    inspect: () => Promise<string | null>;
+    /** `skrrd status --json` for this profile. */
+    status: () => Promise<{
+        stdout: string;
+        code: number;
+    }>;
+    now: () => number;
+    sleep: (ms: number) => Promise<void>;
+}
+export interface ConfirmOptions {
+    /** How long a daemon that is still starting gets. */
+    waitMs?: number;
+    pollMs?: number;
+    /** How long a service that reads `stopped` is given before it is believed. */
+    stoppedGraceMs?: number;
+    /** Progress, printed once and only when the first look found nothing. */
+    log?: (line: string) => void;
+    deps?: Partial<ReadinessDeps>;
+}
+export declare function confirmLocalDaemonSignedIn(options?: ConfirmOptions): Promise<LocalDaemonReadiness>;
+/**
+ * What `skrr login` prints about a daemon that was handed a credential and did
+ * not come up with it: what happened, why, and the one command. Pure, so every
+ * state can be read without a daemon.
+ */
+export declare function describeUnreadyLocalDaemon(readiness: Exclude<LocalDaemonReadiness, {
+    state: 'connected';
+}>, commands: {
+    status: string;
+    logs: string;
+    start: string;
+}): string[];
+/**
+ * The end of `skrr login` for a daemon that was handed a credential: wait for it
+ * to connect, then say ONE true thing. "Signed in too" only for a daemon that
+ * verified connected as this account; otherwise what happened, why, and the one
+ * command — and never both, which is what the login used to do.
+ */
+export declare function reportLocalDaemonAfterHandoff(options: {
+    /** `skrr login` may have been handed the daemon's account/deployment line already. */
+    deliveredDetail: string;
+    bin: string;
+    log: (line: string) => void;
+    confirm?: typeof confirmLocalDaemonSignedIn;
+}): Promise<{
+    daemonId?: string;
+    notReady: boolean;
+}>;