@bitspark/archon-cli 0.12.0 → 0.14.0

package/dist/src/cmd/enroll.d.ts

@@ -0,0 +1,34 @@
+import { type EnrollChallenge, type EnrollIntent } from "@bitspark/archon-sdk";
+import * as keystore from "../keystore.js";
+export declare const USAGE: string;
+/** Where the command meets the world, so a test can stand in for the terminal and the clock. */
+export interface EnrollIo {
+    /** The controlling terminal: where the statement is shown and the question asked. */
+    openTerminal(): {
+        readLine(): string;
+        write(text: string): void;
+        close(): void;
+    };
+    /** Whether stdin is a terminal: then the token is asked for, and its line limit can cut it. */
+    stdinIsTerminal(): boolean;
+    /** One line of stdin, at most MAX_INPUT bytes. */
+    readStdinLine(): Promise<string>;
+    stdout(text: string): void;
+    /** Unix seconds. */
+    now(): number;
+}
+export declare function run(args: string[], io?: EnrollIo): Promise<void>;
+/** Steps 4 to 6 of docs/enroll.md §4: the token's audience is the selected one, its key is the
+ *  entry's, and its deadline is still ahead. The token's audience is display-safe already (the
+ *  codec refuses otherwise), and is JSON-quoted to show where it ends. */
+export declare function checkChallenge(ch: EnrollChallenge, audience: string, key: Uint8Array, now: number): void;
+/** The statement of docs/enroll.md §4, byte-identical in every lane
+ *  (cli/testdata/enroll-statement.json). */
+export declare function renderStatement(audience: string, intent: EnrollIntent, key: Uint8Array, deadline: number, keySource: string): string;
+/** The question, naming the account the person is agreeing to, in plain quotes. */
+export declare function prompt(intent: EnrollIntent): string;
+/** Why the entry may not enroll, and how to change that. `key policy` replaces a list rather
+ *  than adding to it, so the command printed names every context the entry keeps, then
+ *  archon-enroll/1; it is printed only when every context needs no quoting in any shell, and
+ *  otherwise the contexts are listed JSON-quoted. */
+export declare function policyRefusal(name: string, policy: keystore.Policy | null): string;

package/dist/src/cmd/enroll.js

@@ -0,0 +1,245 @@
+// `archon enroll` (docs/enroll.md §4, ADR 0013): make the enrollment proof for a key in the
+// store, but only after showing the person which account the key joins, decoded from the very
+// intent bytes whose digest the proof binds. The challenge arrives as a token the person carries
+// from the signed-in page; the proof leaves as a token they carry back. The command contacts no
+// server, so its success means a proof was produced, never that the key is enrolled.
+import { closeSync, openSync, readSync } from "node:fs";
+import { encodeKey, getPublicKey } from "@bitspark/archon";
+import { decodeEnrollChallenge, ENROLL_DOMAIN, ENROLL_MAX_TOKEN_SIZE, encodeEnrollProof, enrollChallengeRequest, proveEnroll, verifyEnroll, } from "@bitspark/archon-sdk";
+import { jsonString, wantsHelp } from "../io.js";
+import * as keystore from "../keystore.js";
+import { openControllingTerminal, openEntered, readDefaultKeyName, readPasswordEntry, readTerminalLine, takePasswordFd, usableKey, } from "./key_store.js";
+import { formatRfc3339Utc, selectedAudience } from "./login.js";
+export const USAGE = "usage: archon enroll [--challenge-file <file>] [--audience <base>] [--key <name>] [--password-fd <n>]\n" +
+    "  makes the enrollment proof for a key in the store, after showing which account it joins\n" +
+    "  (docs/enroll.md). The challenge token is read from --challenge-file, or one line of stdin;\n" +
+    "  the audience is --audience or ARCHON_AUDIENCE; the key is --key or the default key. The\n" +
+    "  question is asked on the terminal, always, and the proof token is printed on stdout.";
+/** Asks for the token when stdin is a terminal. */
+const PASTE_PROMPT = "paste the challenge token, then press Enter: ";
+/** The one purpose version 1 renders (docs/enroll.md §2). */
+const PURPOSE = "add-key";
+/** What is read before decoding: a token and its surrounding whitespace. */
+const MAX_INPUT = 1 << 20;
+const NO_TERMINAL = "enroll: there is no terminal to ask on; archon enroll asks every time, and a password from " +
+    "ARCHON_KEY_PASSWORD or --password-fd does not answer it";
+const realIo = {
+    openTerminal() {
+        const terminal = openControllingTerminal();
+        return {
+            readLine: () => readTerminalLine(terminal),
+            write: (text) => terminal.io.write(text),
+            close: () => terminal.close(),
+        };
+    },
+    stdinIsTerminal: () => process.stdin.isTTY === true,
+    async readStdinLine() {
+        // Bounded like the Go and Rust lanes, and the stream is stopped once the line is in: when
+        // stdin is the terminal, a reader left running would take the person's "y" from the
+        // controlling terminal's reader, which shares the device.
+        const chunks = [];
+        let size = 0;
+        for await (const chunk of process.stdin) {
+            const b = chunk;
+            const nl = b.indexOf(0x0a);
+            chunks.push(nl >= 0 ? b.subarray(0, nl) : b);
+            size += nl >= 0 ? nl : b.length;
+            if (nl >= 0 || size > MAX_INPUT)
+                break; // breaking out destroys the stream
+        }
+        if (size > MAX_INPUT) {
+            throw new Error(`enroll: the line on stdin is over ${MAX_INPUT} bytes; a challenge token is at most ${ENROLL_MAX_TOKEN_SIZE}`);
+        }
+        return Buffer.concat(chunks).toString("utf8");
+    },
+    stdout: (text) => process.stdout.write(text),
+    now: () => Math.floor(Date.now() / 1000),
+};
+export async function run(args, io = realIo) {
+    if (wantsHelp(args)) {
+        io.stdout(`${USAGE}\n`);
+        return;
+    }
+    const { rest, fd } = takePasswordFd(args);
+    let challengeFile;
+    let audienceFlag;
+    let keyName;
+    for (let i = 0; i < rest.length; i += 2) {
+        const flag = rest[i];
+        const value = rest[i + 1];
+        if (value === undefined || value === "")
+            throw new Error(`flag ${JSON.stringify(flag)} needs a value\n${USAGE}`);
+        if (flag === "--challenge-file")
+            challengeFile = value;
+        else if (flag === "--audience")
+            audienceFlag = value;
+        else if (flag === "--key")
+            keyName = value;
+        else
+            throw new Error(`unknown flag ${JSON.stringify(flag)}\n${USAGE}`);
+    }
+    if (challengeFile === undefined && fd === 0) {
+        throw new Error("enroll: --password-fd 0 and a challenge token on stdin would read the same stream; pass the token with --challenge-file");
+    }
+    // 1. The entry: one read, whose header the seal authenticates at unlock (ADR 0012 §4).
+    const name = keyName ?? readDefaultKeyName();
+    if (name === undefined || name === "") {
+        throw new Error("enroll: no default key is set; pass --key <name>, or choose one with: archon key default <name>");
+    }
+    const { file, header } = usableKey(name);
+    if (header.policy === null || !keystore.permits(header.policy, ENROLL_DOMAIN)) {
+        throw new Error(policyRefusal(name, header.policy));
+    }
+    // 2. The audience the person selected, and a terminal to ask on.
+    const audience = selectedAudience("enroll", "the audience is your configuration, never a token's word (docs/enroll.md §4)", audienceFlag);
+    let terminal;
+    try {
+        terminal = io.openTerminal();
+    }
+    catch {
+        throw new Error(NO_TERMINAL);
+    }
+    try {
+        // 3. The token, read and decoded once. From here on only these values are used.
+        const fromTerminal = challengeFile === undefined && io.stdinIsTerminal();
+        if (fromTerminal)
+            terminal.write(PASTE_PROMPT);
+        const text = challengeFile !== undefined ? readChallengeFile(challengeFile) : await io.readStdinLine();
+        let ch;
+        try {
+            ch = decodeEnrollChallenge(text);
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            throw new Error(fromTerminal ? `${message} (a terminal cuts a long pasted line; save the token to a file and pass --challenge-file)` : message);
+        }
+        // 4.–7. Everything decidable before the person is asked.
+        checkChallenge(ch, audience, header.publicKey, io.now());
+        const { request, intent } = enrollChallengeRequest(ch);
+        if (intent.purpose !== PURPOSE) {
+            throw new Error(`enroll: the intent's purpose is ${jsonString(intent.purpose)}; this archon renders only "${PURPOSE}", so it signs nothing else`);
+        }
+        // 8. Show, and ask on the terminal.
+        terminal.write(renderStatement(audience, intent, header.publicKey, ch.deadline, `the store key ${name}`) + prompt(intent));
+        const answer = terminal.readLine().trim().toLowerCase();
+        if (answer !== "y" && answer !== "yes") {
+            // Non-zero, so a script never mistakes a refusal for a proof: stdout stays empty.
+            terminal.write("refused. nothing was signed.\n");
+            throw new Error("enroll: refused. nothing was signed.");
+        }
+        // 9. Only now is the key unlocked: the same snapshot, its header now authenticated.
+        const seed = openEntered(name, file, readPasswordEntry(fd, false));
+        try {
+            if (!keystore.permits(header.policy, ENROLL_DOMAIN))
+                throw new Error(policyRefusal(name, header.policy));
+            const opened = getPublicKey(seed);
+            if (!equal(opened, header.publicKey) || !equal(header.publicKey, ch.newKey)) {
+                throw new Error(`enroll: key ${name} did not open to the key that was shown; nothing was signed`);
+            }
+            // 10. The proof, over what was shown, checked before it is printed.
+            const proof = proveEnroll(seed, audience, request);
+            if (!verifyEnroll(audience, request, proof))
+                throw new Error("enroll: the proof did not verify; nothing was printed");
+            const token = encodeEnrollProof({ transaction: request.transaction, newKey: request.newKey, proof });
+            // 11. The proof token on stdout, alone; the person is told what it is not.
+            io.stdout(`${token}\n`);
+            terminal.write("proof produced. paste it into the service's page: the key is enrolled only when the page completes.\n");
+        }
+        finally {
+            seed.fill(0);
+        }
+    }
+    finally {
+        terminal.close();
+    }
+}
+/** Steps 4 to 6 of docs/enroll.md §4: the token's audience is the selected one, its key is the
+ *  entry's, and its deadline is still ahead. The token's audience is display-safe already (the
+ *  codec refuses otherwise), and is JSON-quoted to show where it ends. */
+export function checkChallenge(ch, audience, key, now) {
+    if (ch.audience !== audience) {
+        throw new Error(`enroll: the token is for ${jsonString(ch.audience)}, not the audience you selected, ${jsonString(audience)}; nothing was shown or signed`);
+    }
+    if (!equal(ch.newKey, key)) {
+        throw new Error(`enroll: the token enrolls ${encodeKey(ch.newKey)}, not this key, ${encodeKey(key)}; nothing was shown or signed`);
+    }
+    if (now >= ch.deadline) {
+        throw new Error(`enroll: the request's deadline, about ${formatRfc3339Utc(ch.deadline)}, has passed; begin again on the service's page`);
+    }
+}
+/** The statement of docs/enroll.md §4, byte-identical in every lane
+ *  (cli/testdata/enroll-statement.json). */
+export function renderStatement(audience, intent, key, deadline, keySource) {
+    let out = `${audience} asks you to add a key to an account:\n`;
+    out += `  account:      ${intent.accountName}\n`;
+    out += `  account id:   ${intent.accountId}\n`;
+    out += `  key:          ${encodeKey(key)}\n`;
+    if (intent.restrictions.length === 0) {
+        out += "  restrictions: none\n";
+    }
+    else {
+        out += "  restrictions:\n";
+        for (const r of intent.restrictions)
+            out += `    ${r}\n`;
+    }
+    out += "the service may give this key the account's authority.\n";
+    out += `the request's deadline is about ${formatRfc3339Utc(deadline)}, the service's word; it is not the key's expiry.\n`;
+    out += `signing with ${keySource}\n`;
+    return out;
+}
+/** The question, naming the account the person is agreeing to, in plain quotes. */
+export function prompt(intent) {
+    return `add this key to the account "${intent.accountName}"? [y/N] `;
+}
+/** A context every shell receives as itself, unquoted: sh, cmd.exe and PowerShell alike. A
+ *  leading `@` or `-` is left out, since PowerShell and flag parsers read those as something
+ *  else (docs/enroll.md §4 step 1). */
+const BARE_CONTEXT = /^[A-Za-z0-9][A-Za-z0-9._/:+=-]*$/;
+/** Why the entry may not enroll, and how to change that. `key policy` replaces a list rather
+ *  than adding to it, so the command printed names every context the entry keeps, then
+ *  archon-enroll/1; it is printed only when every context needs no quoting in any shell, and
+ *  otherwise the contexts are listed JSON-quoted. */
+export function policyRefusal(name, policy) {
+    // A version-2 entry always has one; said the same way in every lane regardless.
+    if (policy === null)
+        return `enroll: key ${name} may not sign in ${ENROLL_DOMAIN}: it has no policy`;
+    const head = `enroll: key ${name} may not sign in ${ENROLL_DOMAIN}: its policy is ${keystore.describePolicy(policy)}`;
+    if (policy.contexts.length >= keystore.MAX_CONTEXTS) {
+        return `${head}.\n  it already lists ${keystore.MAX_CONTEXTS} contexts, the most a policy holds: drop one with archon key policy, or keep a separate key for enrollment`;
+    }
+    if (!policy.contexts.every((c) => BARE_CONTEXT.test(c))) {
+        return `${head}.\n  key policy replaces the list: run archon key policy ${name} with --allow for each of ${policy.contexts.map(jsonString).join(", ")}, and for ${ENROLL_DOMAIN}`;
+    }
+    const command = [`archon key policy ${name}`, ...policy.contexts.map((c) => `--allow ${c}`), `--allow ${ENROLL_DOMAIN}`].join(" ");
+    return `${head}.\n  to let it enroll, keeping what it has (key policy replaces the list):\n    ${command}`;
+}
+function readChallengeFile(path) {
+    let fd;
+    try {
+        fd = openSync(path, "r");
+    }
+    catch (err) {
+        throw new Error(`enroll: could not read ${JSON.stringify(path)}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    try {
+        const buf = Buffer.alloc(MAX_INPUT + 1);
+        let n = 0;
+        for (;;) {
+            const got = readSync(fd, buf, n, buf.length - n, null);
+            if (got === 0)
+                break;
+            n += got;
+            if (n > MAX_INPUT) {
+                throw new Error(`enroll: ${JSON.stringify(path)} is over ${MAX_INPUT} bytes; a challenge token is at most ${ENROLL_MAX_TOKEN_SIZE}`);
+            }
+        }
+        return buf.subarray(0, n).toString("utf8");
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+function equal(a, b) {
+    return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+//# sourceMappingURL=enroll.js.map

package/dist/src/cmd/enroll.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enroll.js","sourceRoot":"","sources":["../../../src/cmd/enroll.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,8FAA8F;AAC9F,iGAAiG;AACjG,gGAAgG;AAChG,qFAAqF;AACrF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,qBAAqB,EACrB,iBAAiB,EACjB,sBAAsB,EACtB,WAAW,EACX,YAAY,GAGb,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EACL,uBAAuB,EACvB,WAAW,EACX,kBAAkB,EAClB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,SAAS,GACV,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,CAAC,MAAM,KAAK,GAChB,yGAAyG;IACzG,6FAA6F;IAC7F,gGAAgG;IAChG,6FAA6F;IAC7F,wFAAwF,CAAC;AAE3F,mDAAmD;AACnD,MAAM,YAAY,GAAG,+CAA+C,CAAC;AAErE,6DAA6D;AAC7D,MAAM,OAAO,GAAG,SAAS,CAAC;AAE1B,4EAA4E;AAC5E,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC;AAE1B,MAAM,WAAW,GACf,6FAA6F;IAC7F,yDAAyD,CAAC;AAe5D,MAAM,MAAM,GAAa;IACvB,YAAY;QACV,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAC;QAC3C,OAAO;YACL,QAAQ,EAAE,GAAG,EAAE,CAAC,gBAAgB,CAAC,QAAQ,CAAC;YAC1C,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;YACxC,KAAK,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE;SAC9B,CAAC;IACJ,CAAC;IACD,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI;IACnD,KAAK,CAAC,aAAa;QACjB,0FAA0F;QAC1F,oFAAoF;QACpF,0DAA0D;QAC1D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACxC,MAAM,CAAC,GAAG,KAAe,CAAC;YAC1B,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7C,IAAI,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAChC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,GAAG,SAAS;gBAAE,MAAM,CAAC,mCAAmC;QAC7E,CAAC;QACD,IAAI,IAAI,GAAG,SAAS,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,qCAAqC,SAAS,wCAAwC,qBAAqB,EAAE,CAAC,CAAC;QACjI,CAAC;QACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5C,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;CACzC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,GAAG,CAAC,IAAc,EAAE,EAAE,GAAa,MAAM;IAC7D,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACxB,OAAO;IACT,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,aAAiC,CAAC;IACtC,IAAI,YAAgC,CAAC;IACrC,IAAI,OAA2B,CAAC;IAChC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QACjH,IAAI,IAAI,KAAK,kBAAkB;YAAE,aAAa,GAAG,KAAK,CAAC;aAClD,IAAI,IAAI,KAAK,YAAY;YAAE,YAAY,GAAG,KAAK,CAAC;aAChD,IAAI,IAAI,KAAK,OAAO;YAAE,OAAO,GAAG,KAAK,CAAC;;YACtC,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,aAAa,KAAK,SAAS,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yHAAyH,CAAC,CAAC;IAC7I,CAAC;IAED,uFAAuF;IACvF,MAAM,IAAI,GAAG,OAAO,IAAI,kBAAkB,EAAE,CAAC;IAC7C,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACrH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,CAAC;IAED,iEAAiE;IACjE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,EAAE,8EAA8E,EAAE,YAAY,CAAC,CAAC;IAC1I,IAAI,QAA8C,CAAC;IACnD,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,WAAW,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC;QACH,gFAAgF;QAChF,MAAM,YAAY,GAAG,aAAa,KAAK,SAAS,IAAI,EAAE,CAAC,eAAe,EAAE,CAAC;QACzE,IAAI,YAAY;YAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,aAAa,EAAE,CAAC;QACvG,IAAI,EAAmB,CAAC;QACxB,IAAI,CAAC;YACH,EAAE,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,2FAA2F,CAAC,CAAC,CAAC,OAAO,CAC/H,CAAC;QACJ,CAAC;QAED,yDAAyD;QACzD,cAAc,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,CAAC,EAAE,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,+BAA+B,OAAO,6BAA6B,CAAC,CAAC;QACpJ,CAAC;QAED,oCAAoC;QACpC,QAAQ,CAAC,KAAK,CAAC,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,EAAE,iBAAiB,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3H,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACvC,kFAAkF;YAClF,QAAQ,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC1D,CAAC;QAED,oFAAoF;QACpF,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,iBAAiB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACzG,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC5E,MAAM,IAAI,KAAK,CAAC,eAAe,IAAI,6DAA6D,CAAC,CAAC;YACpG,CAAC;YAED,oEAAoE;YACpE,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnD,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACtH,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAErG,2EAA2E;YAC3E,EAAE,CAAC,MAAM,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;YACxB,QAAQ,CAAC,KAAK,CAAC,uGAAuG,CAAC,CAAC;QAC1H,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;IACH,CAAC;YAAS,CAAC;QACT,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;0EAE0E;AAC1E,MAAM,UAAU,cAAc,CAAC,EAAmB,EAAE,QAAgB,EAAE,GAAe,EAAE,GAAW;IAChG,IAAI,EAAE,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,CAAC,EAAE,CAAC,QAAQ,CAAC,oCAAoC,UAAU,CAAC,QAAQ,CAAC,+BAA+B,CAC3I,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,6BAA6B,SAAS,CAAC,EAAE,CAAC,MAAM,CAAC,mBAAmB,SAAS,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACrI,CAAC;IACD,IAAI,GAAG,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,yCAAyC,gBAAgB,CAAC,EAAE,CAAC,QAAQ,CAAC,iDAAiD,CAAC,CAAC;IAC3I,CAAC;AACH,CAAC;AAED;4CAC4C;AAC5C,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,MAAoB,EAAE,GAAe,EAAE,QAAgB,EAAE,SAAiB;IAC1H,IAAI,GAAG,GAAG,GAAG,QAAQ,yCAAyC,CAAC;IAC/D,GAAG,IAAI,mBAAmB,MAAM,CAAC,WAAW,IAAI,CAAC;IACjD,GAAG,IAAI,mBAAmB,MAAM,CAAC,SAAS,IAAI,CAAC;IAC/C,GAAG,IAAI,mBAAmB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;IAC7C,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,GAAG,IAAI,wBAAwB,CAAC;IAClC,CAAC;SAAM,CAAC;QACN,GAAG,IAAI,mBAAmB,CAAC;QAC3B,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,YAAY;YAAE,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAC3D,CAAC;IACD,GAAG,IAAI,0DAA0D,CAAC;IAClE,GAAG,IAAI,mCAAmC,gBAAgB,CAAC,QAAQ,CAAC,qDAAqD,CAAC;IAC1H,GAAG,IAAI,gBAAgB,SAAS,IAAI,CAAC;IACrC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,MAAM,CAAC,MAAoB;IACzC,OAAO,gCAAgC,MAAM,CAAC,WAAW,WAAW,CAAC;AACvE,CAAC;AAED;;uCAEuC;AACvC,MAAM,YAAY,GAAG,kCAAkC,CAAC;AAExD;;;qDAGqD;AACrD,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAA8B;IACxE,gFAAgF;IAChF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,eAAe,IAAI,oBAAoB,aAAa,oBAAoB,CAAC;IACrG,MAAM,IAAI,GAAG,eAAe,IAAI,oBAAoB,aAAa,mBAAmB,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;IACtH,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QACpD,OAAO,GAAG,IAAI,yBAAyB,QAAQ,CAAC,YAAY,4GAA4G,CAAC;IAC3K,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,GAAG,IAAI,4DAA4D,IAAI,6BAA6B,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,aAAa,EAAE,CAAC;IACpL,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,qBAAqB,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,WAAW,aAAa,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnI,OAAO,GAAG,IAAI,mFAAmF,OAAO,EAAE,CAAC;AAC7G,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;QACxC,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,GAAG,KAAK,CAAC;gBAAE,MAAM;YACrB,CAAC,IAAI,GAAG,CAAC;YACT,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,SAAS,wCAAwC,qBAAqB,EAAE,CAAC,CAAC;YACvI,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,CAAa,EAAE,CAAa;IACzC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC"}

package/dist/src/cmd/key.js

@@ -49,6 +49,9 @@ export function run(args) {
         case "export":
             store.runExport(rest);
             return;
+        case "policy":
+            store.runPolicy(rest);
+            return;
         case "encode":
             if (rest.length !== 1)
                 throw new Error(USAGE);

package/dist/src/cmd/key.js.map

@@ -1 +1 @@
-{"version":3,"file":"key.js","sourceRoot":"","sources":["../../../src/cmd/key.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,uFAAuF;AACvF,gFAAgF;AAChF,uFAAuF;AACvF,2EAA2E;AAC3E,yFAAyF;AACzF,6EAA6E;AAC7E,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,eAAe,EACf,KAAK,GACN,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAkB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAExC,MAAM,KAAK,GACT,8DAA8D;IAC9D,qEAAqE;IACrE,0DAA0D;IAC1D,4EAA4E;IAC5E,+EAA+E;IAC/E,gEAAgE;IAChE,2EAA2E;IAC3E,kFAAkF;IAClF,oDAAoD,CAAC;AAEvD,MAAM,UAAU,GAAG,CAAC,IAAc;IAChC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,EAAE,CAAC;QACX,2EAA2E;QAC3E,gFAAgF;QAChF,KAAK,KAAK;YACR,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,KAAK,MAAM;YACT,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,KAAK,IAAI;YACP,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO;QACT,KAAK,SAAS;YACZ,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,KAAK,QAAQ;YACX,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO;QACT,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO;QACT,KAAK,OAAO;YACV,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnB,OAAO;QACT,KAAK,MAAM;YACT,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClB,OAAO;QACT,KAAK,KAAK;YACR,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO;QACT;YACE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,GAAG,CAAC,IAAc,EAAE,SAA2B;IACtD,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,+EAA+E;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CACzG,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,sFAAsF;AACtF,iBAAiB;AACjB,SAAS,GAAG,CAAC,IAAc;IACzB,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,IAAI,GAAG,GAAc,MAAM,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC3B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,MAAM;gBACT,IAAI,KAAK,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;gBAC1F,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,KAAK,UAAU;gBACb,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAgB,CAAC;IACrB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,WAAY,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../../src/cmd/key.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,uFAAuF;AACvF,gFAAgF;AAChF,uFAAuF;AACvF,2EAA2E;AAC3E,yFAAyF;AACzF,6EAA6E;AAC7E,EAAE;AACF,mFAAmF;AACnF,yFAAyF;AACzF,wFAAwF;AACxF,OAAO,EACL,SAAS,EACT,SAAS,EACT,YAAY,EACZ,cAAc,EACd,aAAa,EACb,eAAe,EACf,WAAW,EACX,cAAc,EACd,eAAe,EACf,KAAK,GACN,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAkB,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,KAAK,KAAK,MAAM,gBAAgB,CAAC;AAExC,MAAM,KAAK,GACT,8DAA8D;IAC9D,qEAAqE;IACrE,0DAA0D;IAC1D,4EAA4E;IAC5E,+EAA+E;IAC/E,gEAAgE;IAChE,2EAA2E;IAC3E,kFAAkF;IAClF,oDAAoD,CAAC;AAEvD,MAAM,UAAU,GAAG,CAAC,IAAc;IAChC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO;IACT,CAAC;IACD,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,EAAE,CAAC;QACX,2EAA2E;QAC3E,gFAAgF;QAChF,KAAK,KAAK;YACR,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnB,OAAO;QACT,KAAK,MAAM;YACT,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACT,KAAK,IAAI;YACP,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO;QACT,KAAK,SAAS;YACZ,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YACvB,OAAO;QACT,KAAK,QAAQ;YACX,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,KAAK,QAAQ;YACX,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACtB,OAAO;QACT,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO;QACT,KAAK,QAAQ;YACX,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO;QACT,KAAK,OAAO;YACV,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACnB,OAAO;QACT,KAAK,MAAM;YACT,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClB,OAAO;QACT,KAAK,KAAK;YACR,GAAG,CAAC,IAAI,CAAC,CAAC;YACV,OAAO;QACT;YACE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,SAAS,GAAG,CAAC,IAAc,EAAE,SAA2B;IACtD,MAAM,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC3B,IAAI,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzC,+EAA+E;QAC/E,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAE,CAAC,CAAC,CACzG,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;QAC3G,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,0FAA0F;AAC1F,sFAAsF;AACtF,iBAAiB;AACjB,SAAS,GAAG,CAAC,IAAc;IACzB,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAA2B,CAAC;IAChC,IAAI,GAAG,GAAc,MAAM,CAAC;IAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;QACtB,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAE,CAAC;QAC3B,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,MAAM;gBACT,IAAI,KAAK,KAAK,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,mBAAmB,KAAK,EAAE,CAAC,CAAC;gBAC1F,MAAM,GAAG,KAAK,CAAC;gBACf,MAAM;YACR,KAAK,QAAQ;gBACX,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM;YACR,KAAK,UAAU;gBACb,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAgB,CAAC;IACrB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,WAAY,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/cmd/key_store.d.ts

@@ -1,3 +1,4 @@
+import * as keystore from "../keystore.js";
 export declare const USAGE: string;
 /**
  * Scans for `--password-fd <n>` and removes it. The password never travels in argv, so
@@ -47,6 +48,8 @@ export declare function openControllingTerminal(): ControllingTerminal;
  *  prompt turned each byte into its own character, so a non-ASCII password derived a key no
  *  other lane derives; `openEntered` still opens keys sealed that way, and re-seals them. */
 export declare function promptHidden(label: string, io: HiddenPromptIo): string;
+/** One visible line from the controlling terminal, in cooked mode: `key policy`'s and `enroll`'s y/N. */
+export declare function readTerminalLine(terminal: ControllingTerminal): string;
 /** What the prompt before 0.11.0 made of the same keystrokes: each UTF-8 byte of `password`
  *  as a character of its own. undefined for an ASCII password, where both readings agree. */
 export declare function legacyPromptDecoding(password: string): string | undefined;
@@ -73,11 +76,17 @@ export declare function readPasswordEntry(fd: number | undefined, confirm: boole
  */
 export declare function openEntered(name: string, file: Uint8Array, entry: PasswordEntry): Uint8Array;
 /**
- * The store's own "is there a key called that": a validated name, then a stat — opening
- * nothing, asking for no password. Shared by `key default <name>` and by `login`'s
- * pre-network check, so both refuse a missing key with one wording.
+ * The store's own "is there a key called that, and can it be used": a validated name and a
+ * header read — opening nothing, asking for no password. Shared by `key default <name>` and by
+ * `login`'s pre-network check, so both refuse a missing, unreadable or version-1 key with one
+ * wording (docs/keystore.md §8.2).
  */
-export declare function requireNamedKey(name: string): void;
+export declare function requireNamedKey(name: string): keystore.KeyHeader;
+/** A refusal of a named entry with its machine-mode category (§8.2). */
+export declare class StoreRefusal extends Error {
+    readonly category: string;
+    constructor(category: string, message: string);
+}
 /**
  * The ONE reader of the default pointer ($ARCHON_HOME/default), shared by `key default`
  * and by `login`'s fallback so the two can never disagree about what "the default" is.
@@ -93,28 +102,60 @@ export declare function readDefaultKeyName(): string | undefined;
  */
 export declare function unlockNamedKey(name: string, fd: number | undefined): Uint8Array;
 /**
- * A stored key's file and the public key its header CLAIMS, opening nothing and asking for
- * no password. The claim is what `sign --key --expect` checks before the prompt; it is proven
- * only when the seal opens, because `keystore.open` refuses a seed that does not derive it.
+ * A stored key's file and its header as the header CLAIMS it — public key, version, policy —
+ * opening nothing and asking for no password. The claim is what `sign --key --expect` checks
+ * before the prompt; it is proven only when the seal opens, because `keystore.open` verifies the
+ * tag over the header and refuses a seed that does not derive the public key.
+ *
+ * Every refusal is a StoreRefusal: no-key when no file has that name, else the header's kind.
  */
 export declare function readNamedKey(name: string): {
     file: Uint8Array;
-    publicKey: Uint8Array;
+    header: keystore.KeyHeader;
+};
+/**
+ * readNamedKey for a command that will sign, log in, export or make a key the default: only a
+ * version-2 entry may (§8.2). A version-1 entry is refused with the command that converts it,
+ * named in full, so a person can act on the line they read.
+ */
+export declare function usableKey(name: string): {
+    file: Uint8Array;
+    header: keystore.KeyHeader;
 };
+/**
+ * Removes --allow <context> (repeatable) and --unrestricted from args and returns the policy
+ * they name (docs/keystore.md §8.3). There is no default: undefined when neither appears, and
+ * the caller decides whether that is allowed.
+ */
+export declare function takePolicyFlags(args: string[]): {
+    rest: string[];
+    policy: keystore.Policy | undefined;
+};
+/** The refusal for a new key that names no policy: there is no default. */
+export declare const policyNeeded: (name: string) => Error;
 /**
  * The one place a key is written, shared by `key add` and `keygen --store` so the two
  * cannot drift apart. Salt and nonce are drawn HERE, in the command: the format takes them
  * as arguments and never sources randomness, which is what makes it pinnable.
  */
-export declare function sealAndWrite(path: string, seed: Uint8Array, password: string): string;
+export declare function sealAndWrite(path: string, seed: Uint8Array, password: string, policy: keystore.Policy): string;
 /** `keygen --store <name>`: the same seal path as `key add`. */
-export declare function storeGenerated(name: string, seed: Uint8Array, fd: number | undefined): void;
+export declare function storeGenerated(name: string, seed: Uint8Array, fd: number | undefined, policy: keystore.Policy): void;
 export declare function runAdd(args: string[]): void;
 /**
  * Prints what each header CLAIMS. The claim is only proven at unlock, which is why this
  * never opens a key and never asks for a password.
  */
 export declare function runList(args: string[]): void;
+/**
+ * Shows an entry's policy, or converts a version-1 entry or changes a version-2 one
+ * (docs/keystore.md §8.3). The change form is ALWAYS interactive: it shows the old and the new
+ * policy before asking for anything, asks y/N at the controlling terminal, and takes the
+ * password from that terminal only — no --yes, no ARCHON_KEY_PASSWORD, no --password-fd. That
+ * is a safeguard against a password a program inherited, not an authorization claim (ADR 0012
+ * §6): whoever can type the password can also decrypt the file.
+ */
+export declare function runPolicy(args: string[]): void;
 /**
  * Removes a key and says exactly what it removed, from where, and what it does NOT speak
  * for. An unparsable file is refused unless --force: deleting an unrecognised file inside