@atrib/cli 0.1.0

package/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship made available under
+      the License, as indicated by a copyright notice that is included in
+      or attached to the work (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean, as submitted to the Licensor for inclusion
+      in the Work by the copyright owner or by an individual or Legal Entity
+      authorized to submit on behalf of the copyright owner. For the purposes
+      of this definition, "submitted" means any form of electronic, verbal,
+      or written communication sent to the Licensor or its representatives,
+      including but not limited to communication on electronic mailing lists,
+      source code control systems, and issue tracking systems that are managed
+      by, or on behalf of, the Licensor for the purpose of discussing and
+      improving the Work, but excluding communication that is conspicuously
+      marked or otherwise designated in writing by the copyright owner as
+      "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any Legal Entity on behalf of
+      whom a Contribution has been received by the Licensor and subsequently
+      incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a cross-claim
+      or counterclaim in a lawsuit) alleging that the Work or a Contribution
+      incorporated within the Work constitutes direct or contributory patent
+      infringement, then any patent licenses granted to You under this License
+      for that Work shall terminate as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative Works
+          a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, You must include a readable copy of the attribution
+          notices contained within such NOTICE file, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own license statement for Your modifications and
+      may provide additional grant of rights to use, modify, or distribute
+      those modifications in accordance with this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or reproducing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or exemplary damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or all other
+      commercial damages or losses), even if such Contributor has been
+      advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format in question. Also, an optional
+      "Statement of Purpose" appears after the copyright notice.
+
+   Copyright 2025-2026 Atrib contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+   implied. See the License for the specific language governing
+   permissions and limitations under the License.

package/README.md

@@ -0,0 +1,85 @@
+# `@atrib/cli`
+
+**The atrib operator CLI. Generate Ed25519 keypairs, manage them in macOS Keychain, and publish identity claims to the atrib directory (spec §6).**
+
+```bash
+npx @atrib/cli keygen --keychain
+# Generates an Ed25519 keypair. Stores the seed in macOS Keychain
+# under service "atrib-creator" (or --service NAME). Prints only the
+# public key to stdout.
+```
+
+The CLI is the operator-side companion to the SDK packages: producers (`@atrib/mcp`, `@atrib/agent`) read keys from environment variables or Keychain entries; this CLI is what creates and manages those entries.
+
+## Subcommands
+
+### `keygen`
+
+Generate a new Ed25519 keypair. Without `--keychain`, prints both seed and pubkey to stdout in env-var format (suitable for piping to `.env`). With `--keychain`, the seed is stored in macOS Keychain and only the pubkey is printed.
+
+```bash
+atrib keygen
+# ATRIB_PRIVATE_KEY=<base64url-32-byte-seed>
+# ATRIB_PUBLIC_KEY=<base64url-32-byte-pubkey>
+
+atrib keygen --keychain --service atrib-creator-claude-code
+# pubkey: <base64url-32-byte-pubkey>
+# (seed stored in Keychain under service=atrib-creator-claude-code)
+```
+
+### `export-pubkey --keychain`
+
+Read a seed from Keychain and print the derived public key only. Useful for confirming which identity a Keychain entry maps to.
+
+```bash
+atrib export-pubkey --keychain --service atrib-creator-claude-code
+# pubkey: <base64url-32-byte-pubkey>
+```
+
+### `delete-key --keychain`
+
+Remove a Keychain entry. Operator-confirmable destructive operation.
+
+### `publish-claim --keychain`
+
+Publish an `IdentityClaim` to the atrib directory (spec §6.1), optionally with a §6.7 capability envelope. The seed is read from Keychain, the claim is canonicalized + signed, and POST'd to `--directory URL` (defaults to `https://directory.atrib.dev/v6`).
+
+```bash
+atrib publish-claim --keychain \
+  --service atrib-creator-claude-code \
+  --display-name "My Agent" \
+  --organization "My Org" \
+  --email "ops@my-org.example.com" \
+  --url "https://my-tool.example.com" \
+  --tool-names search,fetch \
+  --event-types tool_call \
+  --max-amount-currency USD --max-amount-value 100 \
+  --expires-at 2027-01-01T00:00:00Z
+```
+
+Capability envelope fields are optional; an empty envelope means "any tool, any event_type, no payment limits, no expiry."
+
+### `revoke --keychain`
+
+Revoke a key per spec §1.9 (key rotation and revocation). Emits a `key_revocation` record to the log endpoint, signed by the key being retired.
+
+## macOS Keychain integration
+
+Keychain support requires macOS (`security` binary). On other platforms the CLI exits with a clear error directing operators to the `--key-file` alternative used by the SDK packages.
+
+Service naming convention (matches what `@atrib/mcp` and `@atrib/agent` look up):
+
+- `atrib-creator-<agent>`: agent-scoped (e.g. `atrib-creator-claude-code`)
+- `atrib-creator`: generic fallback
+
+## Install
+
+```bash
+npm install -g @atrib/cli
+# or use one-off:
+npx @atrib/cli keygen --keychain
+```
+
+## License
+
+Apache-2.0.

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,416 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * atrib CLI entry point (§5.6.1).
+ *
+ * Subcommands:
+ *   keygen [--keychain] [--service NAME]    Generate an Ed25519 keypair.
+ *   export-pubkey --keychain [--service NAME]   Print the pubkey for a Keychain entry.
+ *   delete-key --keychain [--service NAME]   Remove a Keychain entry.
+ *   publish-claim --keychain [--service NAME] [--display-name NAME] [--organization ORG] [--email EMAIL] [--url URL]
+ *                  [--directory URL] [--capabilities-file PATH] [--tool-names CSV] [--event-types CSV]
+ *                  [--max-amount-currency USD --max-amount-value 100] [--counterparties CSV] [--expires-at ISO8601]
+ *                                            Publish an IdentityClaim (§6.1) to the
+ *                                            directory, optionally with a §6.7 capability
+ *                                            envelope. Reads the seed from Keychain.
+ */
+import { isKeychainSupported, KeychainError, KeychainNotSupportedError, loadSeed, resolveServiceAccount, storeSeed, deleteSeed, } from './keychain.js';
+import { keygen, printKeypair } from './keygen.js';
+import { base64urlDecode, getPublicKey, base64urlEncode } from '@atrib/mcp';
+import { signClaim } from '@atrib/directory';
+import { signRecord, genesisChainRoot, sha256, hexEncode, canonicalRecord } from '@atrib/mcp';
+import { readFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+const VERSION = '0.2.0';
+const HELP = `atrib CLI v${VERSION}
+
+Usage:
+  atrib keygen [--keychain] [--service NAME]
+      Generate an Ed25519 keypair. Without --keychain, prints both keys to
+      stdout in env-var format. With --keychain (macOS only), the seed is
+      stored in the Keychain and only the public key is printed.
+
+  atrib export-pubkey --keychain [--service NAME]
+      Read a seed from Keychain and print the derived public key only.
+
+  atrib delete-key --keychain [--service NAME]
+      Remove a Keychain entry.
+
+  atrib revoke {--keychain [--service NAME] | --key-file PATH} --reason {rotation|retirement|compromise} [--successor PUBKEY] [--log URL] [--context-id HEX] [--dry-run]
+      Submit a §1.9 key_revocation record signed by the key being retired.
+      --reason rotation requires --successor (the new active key).
+      The retired key remains valid for any record with log_index < the
+      revocation's log_index; later records signed by it are flagged
+      'revoked_after_revocation' by §1.9.3-aware verifiers.
+
+  atrib publish-claim {--keychain [--service NAME] | --key-file PATH} [options]
+      Publish an IdentityClaim (§6.1) to a directory, optionally with a
+      §6.7 capability envelope (D051). Reads the signing seed from
+      Keychain or a base64url-encoded file. Subject options:
+          --display-name NAME      Human-readable name (most common)
+          --organization ORG       Organization name
+          --email EMAIL            Contact email
+          --url URL                Homepage URL
+          --handle HANDLE          Social handle (e.g., @atrib)
+      Capability envelope options (all optional):
+          --capabilities-file PATH JSON file with the full envelope
+          --tool-names CSV         Comma-separated allowed tool names
+          --event-types CSV        Comma-separated allowed event types
+          --counterparties CSV     Comma-separated counterparty keys
+          --max-amount-currency C  Currency code (e.g., USD)
+          --max-amount-value N     Numeric amount (requires --max-amount-currency)
+          --expires-at ISO8601     Capability expiration (e.g., 2027-01-01T00:00:00Z)
+      Where to publish:
+          --directory URL          Default: https://directory.atrib.dev/v6
+          --dry-run                Print the signed claim without POSTing
+
+  atrib help                  Show this help message
+  atrib --version             Show version
+
+Defaults:
+  --service defaults to "atrib-creator". Use a custom name when running
+  multiple agents on one machine, or for merchant/witness keys.
+
+Notes:
+  Keychain mode shells out to /usr/bin/security and is currently macOS-only.
+  Linux users can integrate libsecret via the callback-mode keystore (see
+  @atrib/mcp middleware options).
+`;
+function parseFlags(args) {
+    const flags = { keychain: false };
+    const stringFlags = [
+        { flag: '--service', key: 'service' },
+        { flag: '--key-file', key: 'keyFile' },
+        { flag: '--reason', key: 'reason' },
+        { flag: '--successor', key: 'successor' },
+        { flag: '--log', key: 'log' },
+        { flag: '--context-id', key: 'contextId' },
+        { flag: '--display-name', key: 'displayName' },
+        { flag: '--organization', key: 'organization' },
+        { flag: '--email', key: 'email' },
+        { flag: '--url', key: 'url' },
+        { flag: '--handle', key: 'handle' },
+        { flag: '--directory', key: 'directory' },
+        { flag: '--capabilities-file', key: 'capabilitiesFile' },
+        { flag: '--tool-names', key: 'toolNames' },
+        { flag: '--event-types', key: 'eventTypes' },
+        { flag: '--counterparties', key: 'counterparties' },
+        { flag: '--max-amount-currency', key: 'maxAmountCurrency' },
+        { flag: '--max-amount-value', key: 'maxAmountValue' },
+        { flag: '--expires-at', key: 'expiresAt' },
+    ];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (arg === '--keychain') {
+            flags.keychain = true;
+            continue;
+        }
+        if (arg === '--dry-run') {
+            flags.dryRun = true;
+            continue;
+        }
+        const sf = stringFlags.find((s) => s.flag === arg);
+        if (sf) {
+            const value = args[i + 1];
+            if (!value)
+                throw new Error(`${arg} requires a value`);
+            flags[sf.key] = value;
+            i++;
+            continue;
+        }
+    }
+    return flags;
+}
+async function runKeygen(flags) {
+    const keys = await keygen();
+    if (!flags.keychain) {
+        printKeypair(keys);
+        return;
+    }
+    if (!isKeychainSupported()) {
+        throw new KeychainNotSupportedError('Keychain integration is currently macOS-only. Run without --keychain.');
+    }
+    storeSeed(keys.privateKey, flags.service ? { service: flags.service } : {});
+    const { service, account } = resolveServiceAccount(flags.service ? { service: flags.service } : {});
+    // Print only the pubkey + Keychain location. The seed never leaves
+    // the call to storeSeed.
+    console.log(`ATRIB_PUBLIC_KEY=${keys.publicKey}`);
+    console.log(`# Seed stored in macOS Keychain (service=${service}, account=${account})`);
+    console.log(`# Retrieve with: atrib export-pubkey --keychain${flags.service ? ` --service ${service}` : ''}`);
+}
+async function runExportPubkey(flags) {
+    if (!flags.keychain) {
+        throw new Error('export-pubkey currently requires --keychain.');
+    }
+    const seed = loadSeed(flags.service ? { service: flags.service } : {});
+    if (!seed) {
+        const { service, account } = resolveServiceAccount(flags.service ? { service: flags.service } : {});
+        throw new Error(`No Keychain entry found for service=${service} account=${account}.`);
+    }
+    const seedBytes = base64urlDecode(seed);
+    if (seedBytes.length !== 32) {
+        throw new Error(`Stored seed is not 32 bytes (got ${seedBytes.length}). Re-run keygen.`);
+    }
+    const pub = await getPublicKey(seedBytes);
+    console.log(`ATRIB_PUBLIC_KEY=${base64urlEncode(pub)}`);
+    // Zero the seed bytes after use.
+    seedBytes.fill(0);
+}
+function buildClaimSubject(flags) {
+    const subject = {};
+    if (flags.displayName)
+        subject.display_name = flags.displayName;
+    if (flags.organization)
+        subject.organization = flags.organization;
+    if (flags.email)
+        subject.email = flags.email;
+    if (flags.url)
+        subject.url = flags.url;
+    if (flags.handle)
+        subject.handle = flags.handle;
+    if (Object.keys(subject).length === 0) {
+        throw new Error('publish-claim needs at least one of: --display-name, --organization, --email, --url, --handle');
+    }
+    return subject;
+}
+function buildCapabilities(flags) {
+    // File takes precedence and replaces all other capability flags.
+    if (flags.capabilitiesFile) {
+        const raw = readFileSync(flags.capabilitiesFile, 'utf-8');
+        return JSON.parse(raw);
+    }
+    const env = {};
+    if (flags.toolNames)
+        env.tool_names = flags.toolNames.split(',').map((s) => s.trim()).filter(Boolean);
+    if (flags.eventTypes)
+        env.event_types = flags.eventTypes.split(',').map((s) => s.trim()).filter(Boolean);
+    if (flags.counterparties)
+        env.counterparties = flags.counterparties.split(',').map((s) => s.trim()).filter(Boolean);
+    if (flags.maxAmountCurrency || flags.maxAmountValue) {
+        if (!flags.maxAmountCurrency || !flags.maxAmountValue) {
+            throw new Error('--max-amount-currency and --max-amount-value must be set together');
+        }
+        const value = Number(flags.maxAmountValue);
+        if (!Number.isFinite(value))
+            throw new Error(`--max-amount-value not a number: ${flags.maxAmountValue}`);
+        env.max_amount = { currency: flags.maxAmountCurrency, value };
+    }
+    if (flags.expiresAt) {
+        const ts = Date.parse(flags.expiresAt);
+        if (Number.isNaN(ts))
+            throw new Error(`--expires-at not a valid ISO8601 timestamp: ${flags.expiresAt}`);
+        env.expires_at = ts;
+    }
+    return Object.keys(env).length > 0 ? env : undefined;
+}
+async function loadSigningSeed(flags) {
+    if (flags.keychain) {
+        const seed = loadSeed(flags.service ? { service: flags.service } : {});
+        if (!seed) {
+            const { service, account } = resolveServiceAccount(flags.service ? { service: flags.service } : {});
+            throw new Error(`No Keychain entry for service=${service} account=${account}.`);
+        }
+        const bytes = base64urlDecode(seed);
+        if (bytes.length !== 32)
+            throw new Error(`Stored seed is not 32 bytes (got ${bytes.length}).`);
+        return bytes;
+    }
+    if (flags.keyFile) {
+        const raw = readFileSync(flags.keyFile, 'utf-8').trim();
+        const bytes = base64urlDecode(raw);
+        if (bytes.length !== 32)
+            throw new Error(`Key file ${flags.keyFile} did not decode to 32 bytes (got ${bytes.length}).`);
+        return bytes;
+    }
+    throw new Error('publish-claim needs --keychain (with optional --service NAME) or --key-file PATH.');
+}
+async function runRevoke(flags) {
+    const reason = flags.reason;
+    if (reason !== 'rotation' && reason !== 'retirement' && reason !== 'compromise') {
+        throw new Error('--reason must be one of: rotation, retirement, compromise');
+    }
+    if (reason === 'rotation' && !flags.successor) {
+        throw new Error('--reason rotation requires --successor PUBKEY (43-char base64url)');
+    }
+    if (flags.successor && !/^[A-Za-z0-9_-]{43}$/.test(flags.successor)) {
+        throw new Error('--successor must be a 43-char base64url Ed25519 pubkey');
+    }
+    const seedBytes = await loadSigningSeed(flags);
+    const pub = await getPublicKey(seedBytes);
+    const creatorKey = base64urlEncode(pub);
+    // Per §1.9.2: standard revocation is signed by the key being retired.
+    // creator_key === revoked_key in that case. Compromise + emergency-key
+    // path is V2 — not exposed here.
+    const revokedKey = creatorKey;
+    // Use the supplied --context-id or generate a fresh one. Revocation
+    // records form their own session for traceability per §1.9.
+    const contextId = flags.contextId ?? randomBytes(16).toString('hex');
+    if (!/^[0-9a-f]{32}$/.test(contextId)) {
+        throw new Error('--context-id must be 32 hex chars');
+    }
+    const unsigned = {
+        spec_version: 'atrib/1.0',
+        content_id: 'sha256:' + hexEncode(sha256(Buffer.from(`revoke:${revokedKey}:${reason}:${Date.now()}`))),
+        creator_key: creatorKey,
+        chain_root: genesisChainRoot(contextId),
+        event_type: 'https://atrib.dev/v1/types/key_revocation',
+        context_id: contextId,
+        timestamp: Date.now(),
+        revoked_key: revokedKey,
+        revocation_reason: reason,
+        ...(flags.successor ? { successor_key: flags.successor } : {}),
+        signature: '',
+    };
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const signed = await signRecord(unsigned, seedBytes);
+    seedBytes.fill(0);
+    const recordHash = 'sha256:' + hexEncode(sha256(canonicalRecord(signed)));
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    if (flags.dryRun) {
+        console.log(JSON.stringify(signed, null, 2));
+        return;
+    }
+    const logEndpoint = flags.log ?? 'https://log.atrib.dev/v1';
+    const submitUrl = `${logEndpoint.replace(/\/$/, '')}/entries`;
+    const res = await fetch(submitUrl, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(signed),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new Error(`log submit failed (${res.status}): ${JSON.stringify(body)}`);
+    }
+    console.log(`# Revoked key ${revokedKey}`);
+    console.log(`# reason: ${reason}${flags.successor ? `, successor: ${flags.successor}` : ''}`);
+    console.log(`# log_index: ${String(body.log_index)}`);
+    console.log(`# record_hash: ${recordHash}`);
+    console.log(`# context_id: ${contextId}`);
+    console.log(`# Records signed by ${revokedKey} with log_index >= ${String(body.log_index)} are now`);
+    console.log(`# flagged 'revoked_after_revocation' by §1.9.3-aware verifiers.`);
+}
+async function runPublishClaim(flags) {
+    const seedBytes = await loadSigningSeed(flags);
+    const pub = await getPublicKey(seedBytes);
+    const creatorKey = base64urlEncode(pub);
+    const subject = buildClaimSubject(flags);
+    const capabilities = buildCapabilities(flags);
+    const unsigned = {
+        creator_key: creatorKey,
+        claim_type: 'self_attested',
+        claim_method: 'self',
+        claim_subject: subject,
+        ...(capabilities ? { capabilities } : {}),
+    };
+    const claim = await signClaim(unsigned, seedBytes);
+    // Zero seed bytes after signing
+    seedBytes.fill(0);
+    if (flags.dryRun) {
+        console.log(JSON.stringify(claim, null, 2));
+        return;
+    }
+    const directory = flags.directory ?? 'https://directory.atrib.dev/v6';
+    const endpoint = `${directory.replace(/\/$/, '')}/publish`;
+    const res = await fetch(endpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify(claim),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new Error(`directory publish failed (${res.status}): ${JSON.stringify(body)}`);
+    }
+    console.log(`# Published identity claim for ${creatorKey}`);
+    console.log(`# directory: ${directory}`);
+    console.log(`# epoch: ${String(body.epoch)}`);
+    console.log(`# root_hash: ${String(body.root_hash)}`);
+    if (body.anchor && typeof body.anchor === 'object') {
+        const a = body.anchor;
+        if (a.submitted)
+            console.log(`# anchored: record_hash=${String(a.record_hash)}`);
+        else if (a.error)
+            console.log(`# anchor error: ${String(a.error)}`);
+    }
+}
+function runDeleteKey(flags) {
+    if (!flags.keychain) {
+        throw new Error('delete-key currently requires --keychain.');
+    }
+    const removed = deleteSeed(flags.service ? { service: flags.service } : {});
+    const { service, account } = resolveServiceAccount(flags.service ? { service: flags.service } : {});
+    if (removed) {
+        console.log(`# Removed Keychain entry service=${service} account=${account}`);
+    }
+    else {
+        console.log(`# No Keychain entry found for service=${service} account=${account}`);
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const command = args[0];
+    if (!command || command === 'help' || command === '--help' || command === '-h') {
+        console.log(HELP);
+        return;
+    }
+    if (command === '--version' || command === '-v') {
+        console.log(VERSION);
+        return;
+    }
+    const tail = args.slice(1);
+    let flags;
+    try {
+        flags = parseFlags(tail);
+    }
+    catch (err) {
+        console.error(`atrib: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        if (command === 'keygen') {
+            await runKeygen(flags);
+            return;
+        }
+        if (command === 'export-pubkey') {
+            await runExportPubkey(flags);
+            return;
+        }
+        if (command === 'delete-key') {
+            runDeleteKey(flags);
+            return;
+        }
+        if (command === 'publish-claim') {
+            await runPublishClaim(flags);
+            return;
+        }
+        if (command === 'revoke') {
+            await runRevoke(flags);
+            return;
+        }
+    }
+    catch (err) {
+        if (err instanceof KeychainNotSupportedError) {
+            console.error(`atrib: ${err.message}`);
+            process.exitCode = 2;
+            return;
+        }
+        if (err instanceof KeychainError) {
+            console.error(`atrib: keychain error (status ${err.status}): ${err.message}`);
+            if (err.stderr)
+                console.error(err.stderr);
+            process.exitCode = 3;
+            return;
+        }
+        console.error(`atrib: ${err instanceof Error ? err.message : String(err)}`);
+        process.exitCode = 1;
+        return;
+    }
+    console.error(`Unknown command: ${command}`);
+    console.error('Run "atrib help" for usage.');
+    process.exitCode = 1;
+}
+main().catch((err) => {
+    console.error('atrib: fatal error', err);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,sCAAsC;AAEtC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,yBAAyB,EACzB,QAAQ,EACR,qBAAqB,EACrB,SAAS,EACT,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAE5C,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAC7F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,OAAO,GAAG,OAAO,CAAA;AAEvB,MAAM,IAAI,GAAG,cAAc,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqDjC,CAAA;AA6BD,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,KAAK,GAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAA;IACxC,MAAM,WAAW,GAA8C;QAC7D,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE,SAAS,EAAE;QACrC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,SAAS,EAAE;QACtC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE;QACzC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7B,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,EAAE;QAC1C,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,aAAa,EAAE;QAC9C,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE;QAC/C,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE;QACjC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7B,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE;QACnC,EAAE,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE,WAAW,EAAE;QACzC,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,kBAAkB,EAAE;QACxD,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,EAAE;QAC1C,EAAE,IAAI,EAAE,eAAe,EAAE,GAAG,EAAE,YAAY,EAAE;QAC5C,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,EAAE,gBAAgB,EAAE;QACnD,EAAE,IAAI,EAAE,uBAAuB,EAAE,GAAG,EAAE,mBAAmB,EAAE;QAC3D,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,gBAAgB,EAAE;QACrD,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,EAAE,WAAW,EAAE;KAC3C,CAAA;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YACzB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAA;YACrB,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,KAAK,CAAC,MAAM,GAAG,IAAI,CAAA;YACnB,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAA;QAClD,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;YACzB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,mBAAmB,CAAC,CAErD;YAAC,KAAa,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;YAC/B,CAAC,EAAE,CAAA;YACH,SAAQ;QACV,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAY;IACnC,MAAM,IAAI,GAAG,MAAM,MAAM,EAAE,CAAA;IAC3B,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,YAAY,CAAC,IAAI,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IACD,IAAI,CAAC,mBAAmB,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,yBAAyB,CACjC,uEAAuE,CACxE,CAAA;IACH,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAChD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAChD,CAAA;IACD,mEAAmE;IACnE,yBAAyB;IACzB,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;IACjD,OAAO,CAAC,GAAG,CAAC,4CAA4C,OAAO,aAAa,OAAO,GAAG,CAAC,CAAA;IACvF,OAAO,CAAC,GAAG,CAAC,kDAAkD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC/G,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAY;IACzC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACtE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAChD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAChD,CAAA;QACD,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,YAAY,OAAO,GAAG,CAAC,CAAA;IACvF,CAAC;IACD,MAAM,SAAS,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACvC,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,oCAAoC,SAAS,CAAC,MAAM,mBAAmB,CAAC,CAAA;IAC1F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;IACzC,OAAO,CAAC,GAAG,CAAC,oBAAoB,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACvD,iCAAiC;IACjC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACnB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAY;IACrC,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAA;IAC/D,IAAI,KAAK,CAAC,YAAY;QAAE,OAAO,CAAC,YAAY,GAAG,KAAK,CAAC,YAAY,CAAA;IACjE,IAAI,KAAK,CAAC,KAAK;QAAE,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IAC5C,IAAI,KAAK,CAAC,GAAG;QAAE,OAAO,CAAC,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACtC,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC/C,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,+FAA+F,CAAC,CAAA;IAClH,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAY;IACrC,iEAAiE;IACjE,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAA;QACzD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAA;IAC9C,CAAC;IACD,MAAM,GAAG,GAAuB,EAAE,CAAA;IAClC,IAAI,KAAK,CAAC,SAAS;QAAE,GAAG,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACrG,IAAI,KAAK,CAAC,UAAU;QAAE,GAAG,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxG,IAAI,KAAK,CAAC,cAAc;QAAE,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACnH,IAAI,KAAK,CAAC,iBAAiB,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,iBAAiB,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;QACtF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAA;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAA;QACxG,GAAG,CAAC,UAAU,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;QACtC,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;QACvG,GAAG,CAAC,UAAU,GAAG,EAAE,CAAA;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAY;IACzC,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACtE,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACnG,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,YAAY,OAAO,GAAG,CAAC,CAAA;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;QACnC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;QAC9F,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;QACvD,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,KAAK,CAAC,OAAO,oCAAoC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAA;QACvH,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAA;AACtG,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,KAAY;IACnC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAA;IAC3B,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IAC9E,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACtF,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC3E,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAEvC,sEAAsE;IACtE,uEAAuE;IACvE,iCAAiC;IACjC,MAAM,UAAU,GAAG,UAAU,CAAA;IAE7B,oEAAoE;IACpE,4DAA4D;IAC5D,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;IACtD,CAAC;IAED,MAAM,QAAQ,GAAG;QACf,YAAY,EAAE,WAAoB;QAClC,UAAU,EAAE,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,UAAU,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACtG,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACvC,UAAU,EAAE,2CAA2C;QACvD,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;QACrB,WAAW,EAAE,UAAU;QACvB,iBAAiB,EAAE,MAAM;QACzB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,SAAS,EAAE,EAAE;KACd,CAAA;IACD,8DAA8D;IAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,QAAe,EAAE,SAAS,CAAC,CAAA;IAC3D,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEjB,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAEzE,8DAA8D;IAC9D,IAAK,KAAa,CAAC,MAAM,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5C,OAAM;IACR,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,IAAI,0BAA0B,CAAA;IAC3D,MAAM,SAAS,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAA;IAC7D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACjC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;KAC7B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAA;IAC5E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/E,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;IAC1C,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC7F,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACrD,OAAO,CAAC,GAAG,CAAC,kBAAkB,UAAU,EAAE,CAAC,CAAA;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,SAAS,EAAE,CAAC,CAAA;IACzC,OAAO,CAAC,GAAG,CAAC,uBAAuB,UAAU,sBAAsB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAA;IACpG,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAA;AAChF,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,KAAY;IACzC,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;IAC9C,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;IAEvC,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IACxC,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAA;IAE7C,MAAM,QAAQ,GAAqC;QACjD,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,eAAe;QAC3B,YAAY,EAAE,MAAM;QACpB,aAAa,EAAE,OAAO;QACtB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1C,CAAA;IAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IAClD,gCAAgC;IAChC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEjB,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC3C,OAAM;IACR,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,gCAAgC,CAAA;IACrE,MAAM,QAAQ,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAA;IAC1D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAA;IAC5E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,kCAAkC,UAAU,EAAE,CAAC,CAAA;IAC3D,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,EAAE,CAAC,CAAA;IACxC,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC7C,OAAO,CAAC,GAAG,CAAC,gBAAgB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAA;IACrD,IAAI,IAAI,CAAC,MAAM,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnD,MAAM,CAAC,GAAG,IAAI,CAAC,MAAiC,CAAA;QAChD,IAAI,CAAC,CAAC,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAA;aAC3E,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IACrE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAY;IAChC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;IAC9D,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IAC3E,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAChD,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAChD,CAAA;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,YAAY,OAAO,EAAE,CAAC,CAAA;IAC/E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,yCAAyC,OAAO,YAAY,OAAO,EAAE,CAAC,CAAA;IACpF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IAEvB,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,OAAM;IACR,CAAC;IAED,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC1B,IAAI,KAAY,CAAA;IAChB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,YAAY,CAAC,KAAK,CAAC,CAAA;YACnB,OAAM;QACR,CAAC;QACD,IAAI,OAAO,KAAK,eAAe,EAAE,CAAC;YAChC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAC5B,OAAM;QACR,CAAC;QACD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;YACzB,MAAM,SAAS,CAAC,KAAK,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YACtC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QACD,IAAI,GAAG,YAAY,aAAa,EAAE,CAAC;YACjC,OAAO,CAAC,KAAK,CAAC,iCAAiC,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAA;YAC7E,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACzC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;YACpB,OAAM;QACR,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QAC3E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;QACpB,OAAM;IACR,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAA;IAC5C,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAA;IAC5C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAA;IACxC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export { keygen, printKeypair } from './keygen.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1,4 @@
+// SPDX-License-Identifier: Apache-2.0
+// @atrib/cli. Public API (library exports for programmatic use).
+export { keygen, printKeypair } from './keygen.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC,iEAAiE;AAEjE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA"}

package/dist/keychain.d.ts

@@ -0,0 +1,45 @@
+export interface KeychainOptions {
+    service?: string;
+    account?: string;
+}
+export declare class KeychainNotSupportedError extends Error {
+    constructor(message: string);
+}
+export declare class KeychainError extends Error {
+    readonly status: number | null;
+    readonly stderr: string;
+    constructor(message: string, status: number | null, stderr: string);
+}
+/**
+ * Resolve service + account names with sensible defaults. Pure: no side
+ * effects, easy to test.
+ */
+export declare function resolveServiceAccount(options?: KeychainOptions): {
+    service: string;
+    account: string;
+};
+/**
+ * Store a base64url-encoded seed in the macOS Keychain. If an entry for the
+ * same service+account already exists, it is overwritten (`-U`). The seed
+ * is passed via the `-w` flag, which goes through argv and is therefore
+ * visible to other processes on the machine for the brief lifetime of the
+ * `security` invocation. This is acceptable on a single-user laptop; for
+ * stricter environments use `storeSeedFromStdin` for argv-free entry.
+ */
+export declare function storeSeed(seedB64: string, options?: KeychainOptions): void;
+/**
+ * Read a base64url-encoded seed from the macOS Keychain. Returns null if no
+ * entry exists for the given service+account. Throws on other errors.
+ */
+export declare function loadSeed(options?: KeychainOptions): string | null;
+/**
+ * Remove a key from the macOS Keychain. Returns true if the entry was
+ * removed, false if it didn't exist.
+ */
+export declare function deleteSeed(options?: KeychainOptions): boolean;
+/**
+ * Check whether Keychain integration is supported on the current platform.
+ * Useful for callers that want to fall back to env vars without throwing.
+ */
+export declare function isKeychainSupported(): boolean;
+//# sourceMappingURL=keychain.d.ts.map

package/dist/keychain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAiCA,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,aAAc,SAAQ,KAAK;aAGpB,MAAM,EAAE,MAAM,GAAG,IAAI;aACrB,MAAM,EAAE,MAAM;gBAF9B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM;CAKjC;AAYD;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,eAAoB,GAAG;IACpE,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;CAChB,CAKA;AAED;;;;;;;GAOG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,IAAI,CAqB9E;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,OAAO,GAAE,eAAoB,GAAG,MAAM,GAAG,IAAI,CAyBrE;AAED;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,eAAoB,GAAG,OAAO,CAmBjE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C"}

package/dist/keychain.js

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * macOS Keychain integration for atrib creator keys.
+ *
+ * Why a keystore: env vars and `~/.claude.json` are 644-by-default and end
+ * up in shell history, process listings, and command transcripts. The macOS
+ * Keychain is encrypted at rest, ACL'd to a specific app or user, and
+ * survives reboots without any plaintext leaving the keychain DB.
+ *
+ * Why shell out to `security` rather than a native bridge: zero install
+ * dependencies. `security` ships with macOS. The cost is two `spawnSync`
+ * calls per key operation — fine at MCP wrapper boot.
+ *
+ * Linux/Windows are NOT supported in this initial cut. Linux users can
+ * shell out to `secret-tool` (libsecret) via a similar wrapper; see
+ * `loadFromSecretTool` for the planned shape. Windows is out of scope.
+ *
+ * Service name convention:
+ *   atrib-creator              default for the agent's primary creator key
+ *   atrib-creator-<agent-id>   per-agent variants when an operator runs
+ *                                multiple agents on one machine
+ *   atrib-merchant             merchant key for settlement signing
+ *
+ * Account name: always the current user (`$USER`) — the keychain ACL is
+ * implicit "this user only" via the account binding.
+ */
+import { spawnSync } from 'node:child_process';
+import { platform, userInfo } from 'node:os';
+const DEFAULT_SERVICE = 'atrib-creator';
+export class KeychainNotSupportedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'KeychainNotSupportedError';
+    }
+}
+export class KeychainError extends Error {
+    status;
+    stderr;
+    constructor(message, status, stderr) {
+        super(message);
+        this.status = status;
+        this.stderr = stderr;
+        this.name = 'KeychainError';
+    }
+}
+function assertMacos() {
+    if (platform() !== 'darwin') {
+        throw new KeychainNotSupportedError('Keychain integration is currently macOS-only. ' +
+            'On Linux, use libsecret/secret-tool or a callback-mode keystore. ' +
+            'On Windows, use a callback-mode keystore that reads from DPAPI or a Vault.');
+    }
+}
+/**
+ * Resolve service + account names with sensible defaults. Pure: no side
+ * effects, easy to test.
+ */
+export function resolveServiceAccount(options = {}) {
+    return {
+        service: options.service ?? DEFAULT_SERVICE,
+        account: options.account ?? userInfo().username,
+    };
+}
+/**
+ * Store a base64url-encoded seed in the macOS Keychain. If an entry for the
+ * same service+account already exists, it is overwritten (`-U`). The seed
+ * is passed via the `-w` flag, which goes through argv and is therefore
+ * visible to other processes on the machine for the brief lifetime of the
+ * `security` invocation. This is acceptable on a single-user laptop; for
+ * stricter environments use `storeSeedFromStdin` for argv-free entry.
+ */
+export function storeSeed(seedB64, options = {}) {
+    assertMacos();
+    const { service, account } = resolveServiceAccount(options);
+    const result = spawnSync('security', [
+        'add-generic-password',
+        '-U', // update if exists
+        '-a', account,
+        '-s', service,
+        '-w', seedB64,
+    ], { encoding: 'utf8' });
+    if (result.status !== 0) {
+        throw new KeychainError(`security add-generic-password failed for service=${service} account=${account}`, result.status, result.stderr ?? '');
+    }
+}
+/**
+ * Read a base64url-encoded seed from the macOS Keychain. Returns null if no
+ * entry exists for the given service+account. Throws on other errors.
+ */
+export function loadSeed(options = {}) {
+    assertMacos();
+    const { service, account } = resolveServiceAccount(options);
+    const result = spawnSync('security', [
+        'find-generic-password',
+        '-a', account,
+        '-s', service,
+        '-w', // print password only
+    ], { encoding: 'utf8' });
+    if (result.status === 0) {
+        return (result.stdout ?? '').trim();
+    }
+    // status 44 = not found
+    if (result.status === 44) {
+        return null;
+    }
+    throw new KeychainError(`security find-generic-password failed for service=${service} account=${account}`, result.status, result.stderr ?? '');
+}
+/**
+ * Remove a key from the macOS Keychain. Returns true if the entry was
+ * removed, false if it didn't exist.
+ */
+export function deleteSeed(options = {}) {
+    assertMacos();
+    const { service, account } = resolveServiceAccount(options);
+    const result = spawnSync('security', [
+        'delete-generic-password',
+        '-a', account,
+        '-s', service,
+    ], { encoding: 'utf8' });
+    if (result.status === 0)
+        return true;
+    if (result.status === 44)
+        return false;
+    throw new KeychainError(`security delete-generic-password failed for service=${service} account=${account}`, result.status, result.stderr ?? '');
+}
+/**
+ * Check whether Keychain integration is supported on the current platform.
+ * Useful for callers that want to fall back to env vars without throwing.
+ */
+export function isKeychainSupported() {
+    return platform() === 'darwin';
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAE5C,MAAM,eAAe,GAAG,eAAe,CAAA;AAOvC,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,MAAM,OAAO,aAAc,SAAQ,KAAK;IAGpB;IACA;IAHlB,YACE,OAAe,EACC,MAAqB,EACrB,MAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,WAAM,GAAN,MAAM,CAAe;QACrB,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAA;IAC7B,CAAC;CACF;AAED,SAAS,WAAW;IAClB,IAAI,QAAQ,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,yBAAyB,CACjC,gDAAgD;YAC9C,mEAAmE;YACnE,4EAA4E,CAC/E,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAA2B,EAAE;IAIjE,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,eAAe;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ,EAAE,CAAC,QAAQ;KAChD,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,UAA2B,EAAE;IACtE,WAAW,EAAE,CAAA;IACb,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,SAAS,CACtB,UAAU,EACV;QACE,sBAAsB;QACtB,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;KACd,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,aAAa,CACrB,oDAAoD,OAAO,YAAY,OAAO,EAAE,EAChF,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,IAAI,EAAE,CACpB,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,QAAQ,CAAC,UAA2B,EAAE;IACpD,WAAW,EAAE,CAAA;IACb,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,SAAS,CACtB,UAAU,EACV;QACE,uBAAuB;QACvB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,sBAAsB;KAC7B,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACrC,CAAC;IACD,wBAAwB;IACxB,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACzB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,IAAI,aAAa,CACrB,qDAAqD,OAAO,YAAY,OAAO,EAAE,EACjF,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,IAAI,EAAE,CACpB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,UAA2B,EAAE;IACtD,WAAW,EAAE,CAAA;IACb,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,MAAM,GAAG,SAAS,CACtB,UAAU,EACV;QACE,yBAAyB;QACzB,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,OAAO;KACd,EACD,EAAE,QAAQ,EAAE,MAAM,EAAE,CACrB,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACpC,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IACtC,MAAM,IAAI,aAAa,CACrB,uDAAuD,OAAO,YAAY,OAAO,EAAE,EACnF,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,MAAM,IAAI,EAAE,CACpB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,QAAQ,EAAE,KAAK,QAAQ,CAAA;AAChC,CAAC"}

package/dist/keygen.d.ts

@@ -0,0 +1,9 @@
+export declare function keygen(): Promise<{
+    privateKey: string;
+    publicKey: string;
+}>;
+export declare function printKeypair(keys: {
+    privateKey: string;
+    publicKey: string;
+}): void;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AAWA,wBAAsB,MAAM,IAAI,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CAajF;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAGlF"}

package/dist/keygen.js

@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Ed25519 key generation for atrib (§5.6.1).
+ *
+ * Generates a 32-byte random seed, derives the Ed25519 public key,
+ * and outputs both in the ATRIB_PRIVATE_KEY / ATRIB_PUBLIC_KEY format.
+ */
+import { getPublicKey, base64urlEncode } from '@atrib/mcp';
+export async function keygen() {
+    const seed = new Uint8Array(32);
+    crypto.getRandomValues(seed);
+    const publicKeyBytes = await getPublicKey(seed);
+    const privateKey = base64urlEncode(seed);
+    const publicKey = base64urlEncode(publicKeyBytes);
+    // Zero the seed from memory after encoding (§5.6.3)
+    seed.fill(0);
+    return { privateKey, publicKey };
+}
+export function printKeypair(keys) {
+    console.log(`ATRIB_PRIVATE_KEY=${keys.privateKey}`);
+    console.log(`ATRIB_PUBLIC_KEY=${keys.publicKey}`);
+}
+//# sourceMappingURL=keygen.js.map

package/dist/keygen.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.js","sourceRoot":"","sources":["../src/keygen.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAEtC;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAE1D,MAAM,CAAC,KAAK,UAAU,MAAM;IAC1B,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAA;IAC/B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;IAE5B,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,CAAA;IAE/C,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,eAAe,CAAC,cAAc,CAAC,CAAA;IAEjD,oDAAoD;IACpD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAEZ,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAA+C;IAC1E,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,UAAU,EAAE,CAAC,CAAA;IACnD,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAA;AACnD,CAAC"}

package/package.json

@@ -0,0 +1,36 @@
+{
+  "name": "@atrib/cli",
+  "version": "0.1.0",
+  "type": "module",
+  "bin": {
+    "atrib": "./dist/cli.js"
+  },
+  "main": "./dist/cli.js",
+  "files": [
+    "dist"
+  ],
+  "description": "CLI tools for atrib. Key generation and utilities.",
+  "author": "atrib <hello@atrib.dev>",
+  "license": "Apache-2.0",
+  "homepage": "https://atrib.dev",
+  "keywords": [
+    "atrib",
+    "cli",
+    "ed25519",
+    "keygen"
+  ],
+  "dependencies": {
+    "@atrib/directory": "0.1.0",
+    "@atrib/mcp": "0.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.19.17",
+    "typescript": "^5.9.3",
+    "vitest": "^3.2.4"
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}