@catena/cli 0.8.0 → 0.9.0

package/README.md

@@ -24,8 +24,31 @@ tools such as `jq`; pass `--json` to print compact single-line JSON instead.
 `unlink` revokes only the selected profile's server link and removes that
 profile's local credential.
 
-By default the CLI talks to `https://api.catena.com`. Set `CATENA_API_URL` when
-you need to target another Catena environment.
+## Hosts without a keychain
+
+A container, a CI job, or a serverless runtime has no OS keychain and no
+browser, so `link` cannot store a credential there. Set `CATENA_SECRET_KEY` to
+the agent's P-256 secret key instead:
+
+```bash
+CATENA_SECRET_KEY="<64 hex characters>" pnpm dlx @catena/cli whoami
+```
+
+Create the key in the Catena console: open the agent, select the **Secret keys**
+tab, then **Create secret key**. The console shows it one time. `@catena/sdk`
+reads the same variable, so one key serves either client. Set the value with no
+surrounding whitespace: the CLI trims it, and the SDK does not.
+
+While the key is set, `profiles current` reports `source: "secret-key"` with no
+`.profile` field, and `profiles list` adds `shadowedBy` and marks every profile
+`current: false`.
+
+On a machine that also holds a linked profile or sets `CATENA_PROFILE`, every
+command prints one stderr line that names the key as the signing credential.
+Stdout keeps only the command result.
+
+The key outranks every profile tier, but an explicit `--profile` still wins.
+`unlink` does not apply to it; revoke the key in the console instead.
 
 ## First-time setup
 
@@ -49,11 +72,10 @@ denied or times out, run the command again.
 
 Useful flags:
 
-| Flag         | Description                                             | Default                         |
-| ------------ | ------------------------------------------------------- | ------------------------------- |
-| `--bank-url` | Bank API URL.                                           | `$CATENA_API_URL` or prod       |
-| `--name`     | Suggested name when creating an agent from the console. | none                            |
-| `--profile`  | Credential profile name.                                | configured default or `default` |
+| Flag        | Description                                             | Default                         |
+| ----------- | ------------------------------------------------------- | ------------------------------- |
+| `--name`    | Suggested name when creating an agent from the console. | none                            |
+| `--profile` | Credential profile name.                                | configured default or `default` |
 
 ## Commands
 
@@ -387,9 +409,10 @@ later completes, requires approval, or fails.
 
 ## Configuration
 
-| Variable         | Purpose       | Default                  |
-| ---------------- | ------------- | ------------------------ |
-| `CATENA_API_URL` | Bank API URL. | `https://api.catena.com` |
+| Variable            | Purpose                                              | Default |
+| ------------------- | ---------------------------------------------------- | ------- |
+| `CATENA_SECRET_KEY` | Agent P-256 secret key (64 hex). Selects no profile. | none    |
+| `CATENA_PROFILE`    | Credential profile name.                             | none    |
 
 ## Discovering options