The CLI keeps this computer's state in <home>/.maleta. <home> is MALETA_CLI_HOME when the variable is set; otherwise, it is the home directory reported by the operating system.

#Files in .maleta

Private files kept by the CLI
File	Contents	Lifecycle
`credentials.json`	Device credentials in version `1` format.	Created by login and removed by `maleta logout`.
`state.json`	Managed state using schema `1`: binding, resources, and per-file ownership proof.	Updated atomically by device commands.
`state.corrupt-<timestamp>.json`	Quarantined copy of an invalid or unrecognized `state.json`.	Created when the CLI can move invalid state out of the active path.
`watch.lock`	JSON containing `pid`, `startedAt`, and `hostname`.	Exists while a watch holds the lock; a lock from a stopped process is reclaimed on the next acquisition.

#Device credentials

version: 1required
Literal version of the credentials format.
apiOrigin: stringrequired
API origin associated with the credentials.
deviceId: stringrequired
Non-empty identifier for this device.
token: stringrequired
Non-empty token used to authenticate the device.

MALETA_DEVICE_TOKEN overrides the file in CI or on headless machines. In that case, deviceId is env and MALETA_API_ORIGIN can set the API origin.

#state.json schema

stateVersion: 1required
Literal version of the state schema.
deviceId: string | nullrequired
Device this history belongs to; null after logout or before the first binding.
binding: ManagedBinding | nullrequired
Cloud Maleta followed on this computer and the last applied revision; null when there is no binding.
resources: ManagedResource[]required
Resources from the bound Maleta that the CLI currently manages.
pendingRemoval: ManagedResource[]required
Resources no longer listed by the account that await maleta prune; watch does not remove them.
orphaned: ManagedResource[]required
Resources left on disk after detach, logout, or an identity change; they also await maleta prune.

#Managed resources and files

ManagedResource and ManagedFile fields
Object	Field	Type and meaning
`ManagedResource`	`label`	string: label of the plan that produced the resource.
`ManagedResource`	`name`	string: destination directory name and part of the resource identity.
`ManagedResource`	`skillId`	string \| null: skill identifier, when present.
`ManagedResource`	`destination`	string: resolved destination directory.
`ManagedResource`	`files`	`ManagedFile[]`: per-file ownership records.
`ManagedFile`	`path`	string: path relative to the destination, using POSIX separators.
`ManagedFile`	`sha256`	string: 64-character lowercase hexadecimal SHA-256 hash of the recorded bytes.
`ManagedFile`	`bytes`	integer >= 0: recorded file size.
`ManagedFile`	`origin`	`"written" \| "adopted"`: the CLI wrote the file or found the same bytes already present.

#Binding record

cloudMaletaId: stringrequired
Non-empty identifier of the bound Cloud Maleta.
documentId: stringrequired
Non-empty identifier of the materialized document.
name: stringrequired
Display name of the bound Maleta.
appliedRevision: integer >= 0required
Materialized revision; 0 means nothing has been applied yet.
appliedStatus: "applied" | "conflict"required
conflict makes the next watch fetch and retry the revision.
appliedAt: stringrequired
Recorded timestamp for the application state.

#Proof before removal

Ownership is tracked per file. origin: "written" proves that the CLI created or updated the file; it is removed only if it is still a regular file, remains inside the destination, and its SHA-256 still matches sha256.

origin: "adopted" marks bytes that already existed and matched; the CLI never removes that file.
A modified file, symlink, unsafe path, or unrecorded entry blocks removal of the resource.
Directories are removed only when empty; user-added contents remain.
maleta watch only records candidates in pendingRemoval; only maleta prune --yes removes them.

#Missing or invalid state

A missing or unreadable state.json is not treated as empty history: state becomes untrusted and all removal is disabled. Invalid JSON or an unrecognized schema is moved, when possible, to state.corrupt-<timestamp>.json.

#Logout and detach

Local state changes
Command	Credentials and binding	Resources
`maleta logout`	Attempts to revoke the session, removes `credentials.json`, and sets `deviceId` and `binding` to `null`.	Moves `resources` and `pendingRemoval` to `orphaned`; it does not remove destination files.
`maleta detach`	Removes the account binding and sets `binding` to `null`; it keeps the credentials and `deviceId`.	Moves `resources` and `pendingRemoval` to `orphaned`; it does not remove destination files.

Search documentation

CLI local state