@certen.io/cli 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Certen IO
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/commands/admin.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerAdminCommands(program: Command): void;

package/dist/commands/admin.js

@@ -0,0 +1,93 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput } from '../output.js';
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+export function registerAdminCommands(program) {
+    const admin = program.command('admin').description('Administration');
+    // API Keys management
+    const apiKeys = admin.command('api-keys').description('API key management');
+    apiKeys
+        .command('list')
+        .description('List API keys')
+        .action(async () => {
+        const client = await getClient();
+        const result = await client.admin.listApiKeys();
+        printOutput(result);
+    });
+    apiKeys
+        .command('create')
+        .description('Create a new API key')
+        .requiredOption('--name <name>', 'Key name')
+        .requiredOption('--org-id <id>', 'Organization ID')
+        .option('--permissions <perms>', 'Comma-separated permissions')
+        .option('--rate-limit <rpm>', 'Rate limit RPM', parseInt)
+        .option('--expires-at <date>', 'Expiration date (ISO)')
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.admin.createApiKey({
+            name: opts.name,
+            orgId: opts.orgId,
+            permissions: opts.permissions ? opts.permissions.split(',') : undefined,
+            rateLimitRpm: opts.rateLimit,
+            expiresAt: opts.expiresAt,
+        });
+        printOutput(result);
+    });
+    apiKeys
+        .command('rotate')
+        .description('Rotate an API key (mints a new key + deactivates the old)')
+        .requiredOption('--id <uuid>', 'ID of the API key to rotate')
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.admin.rotateApiKey(opts.id);
+        printOutput(result);
+    });
+    apiKeys
+        .command('revoke')
+        .description('Revoke an API key (DELETE)')
+        .requiredOption('--id <uuid>', 'ID of the API key to revoke')
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.admin.revokeApiKey(opts.id);
+        printOutput(result);
+    });
+    // Audit log
+    admin
+        .command('audit-log')
+        .description('View audit log')
+        .option('--action <action>', 'Filter by action')
+        .option('--resource-type <type>', 'Filter by resource type')
+        .option('--from <date>', 'From date (ISO)')
+        .option('--to <date>', 'To date (ISO)')
+        .option('--limit <n>', 'Max results', parseInt)
+        .option('--offset <n>', 'Offset', parseInt)
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.admin.getAuditLog({
+            action: opts.action,
+            resourceType: opts.resourceType,
+            from: opts.from,
+            to: opts.to,
+            limit: opts.limit,
+            offset: opts.offset,
+        });
+        printOutput(result);
+    });
+    // Usage
+    admin
+        .command('usage')
+        .description('View usage summary')
+        .option('--from <date>', 'From date (ISO)')
+        .option('--to <date>', 'To date (ISO)')
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.admin.getUsage({
+            from: opts.from,
+            to: opts.to,
+        });
+        printOutput(result);
+    });
+}
+//# sourceMappingURL=admin.js.map

package/dist/commands/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/commands/admin.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;IAErE,sBAAsB;IACtB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAE5E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,eAAe,CAAC;SAC5B,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;QAChD,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sBAAsB,CAAC;SACnC,cAAc,CAAC,eAAe,EAAE,UAAU,CAAC;SAC3C,cAAc,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAClD,MAAM,CAAC,uBAAuB,EAAE,6BAA6B,CAAC;SAC9D,MAAM,CAAC,oBAAoB,EAAE,gBAAgB,EAAE,QAAQ,CAAC;SACxD,MAAM,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;YAC7C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACvE,YAAY,EAAE,IAAI,CAAC,SAAS;YAC5B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,2DAA2D,CAAC;SACxE,cAAc,CAAC,aAAa,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,IAAoB,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,4BAA4B,CAAC;SACzC,cAAc,CAAC,aAAa,EAAE,6BAA6B,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,IAAoB,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,YAAY;IACZ,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,gBAAgB,CAAC;SAC7B,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,wBAAwB,EAAE,yBAAyB,CAAC;SAC3D,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAC1C,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC;SACtC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC9C,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;YAC5C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,QAAQ;IACR,KAAK;SACF,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,oBAAoB,CAAC;SACjC,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAC1C,MAAM,CAAC,aAAa,EAAE,eAAe,CAAC;SACtC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC;YACzC,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,EAAE,EAAE,IAAI,CAAC,EAAE;SACZ,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/auth.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerAuthCommands(program: Command): void;

package/dist/commands/auth.js

@@ -0,0 +1,68 @@
+import { readConfig, writeConfig, setApiKey, clearApiKey, DEFAULT_API_URL } from '../config.js';
+import { printOutput } from '../output.js';
+export function registerAuthCommands(program) {
+    const auth = program.command('auth').description('Authentication management');
+    auth
+        .command('login')
+        .description('Save API key (OS keyring by default; --no-keyring stores in ~/.certen/config.json with 0600 perms)')
+        .requiredOption('--api-key <key>', 'API key to save')
+        .option('--api-url <url>', 'API base URL')
+        .option('--no-keyring', 'Store in ~/.certen/config.json instead of the OS keyring')
+        .action(async (opts) => {
+        const useKeyring = opts.keyring !== false;
+        try {
+            await setApiKey(opts.apiKey, useKeyring);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`Failed to save API key: ${msg}`);
+            process.exit(1);
+        }
+        if (opts.apiUrl) {
+            const cfg = readConfig();
+            cfg.api_url = opts.apiUrl;
+            writeConfig(cfg);
+        }
+        console.log(useKeyring ? 'API key saved to OS keyring' : 'API key saved to ~/.certen/config.json (mode 0600)');
+    });
+    auth
+        .command('logout')
+        .description('Remove the saved API key from keyring or config file')
+        .action(async () => {
+        await clearApiKey();
+        console.log('API key cleared');
+    });
+    auth
+        .command('status')
+        .description('Show current authentication config (prefix-only — never reveals the full key)')
+        .action(() => {
+        const cfg = readConfig();
+        // Round-2 #43: when storage=keyring the prefix is persisted at login
+        // time, so we can still display "which key is selected" without
+        // round-tripping through the OS keyring. The prefix has zero
+        // exfiltration risk — it's used as the public lookup field.
+        let apiKey;
+        if (process.env.CERTEN_API_KEY) {
+            apiKey = `${process.env.CERTEN_API_KEY.substring(0, 12)}... (from CERTEN_API_KEY env)`;
+        }
+        else if (cfg.api_key) {
+            apiKey = `${cfg.api_key.substring(0, 12)}...`;
+        }
+        else if (cfg.storage === 'keyring' && cfg.key_prefix) {
+            apiKey = `${cfg.key_prefix}... (in OS keyring)`;
+        }
+        else if (cfg.storage === 'keyring') {
+            apiKey = '(in OS keyring; prefix unknown — re-run `certen auth login` to record it)';
+        }
+        else {
+            apiKey = '(not set)';
+        }
+        printOutput({
+            storage: cfg.storage ?? 'file (default)',
+            api_key: apiKey,
+            api_url: cfg.api_url ?? `${DEFAULT_API_URL} (default)`,
+            output: cfg.output ?? 'table (default)',
+        });
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,2BAA2B,CAAC,CAAC;IAE9E,IAAI;SACD,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,oGAAoG,CAAC;SACjH,cAAc,CAAC,iBAAiB,EAAE,iBAAiB,CAAC;SACpD,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC;SACzC,MAAM,CAAC,cAAc,EAAE,0DAA0D,CAAC;SAClF,MAAM,CAAC,KAAK,EAAE,IAA2D,EAAE,EAAE;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,CAAC,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;YACzB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,WAAW,CAAC,GAAG,CAAC,CAAC;QACnB,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,oDAAoD,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,WAAW,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,+EAA+E,CAAC;SAC5F,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,qEAAqE;QACrE,gEAAgE;QAChE,6DAA6D;QAC7D,4DAA4D;QAC5D,IAAI,MAAc,CAAC;QACnB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,CAAC;QACzF,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;QAChD,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,qBAAqB,CAAC;QAClD,CAAC;aAAM,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,GAAG,2EAA2E,CAAC;QACvF,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;QACD,WAAW,CAAC;YACV,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,gBAAgB;YACxC,OAAO,EAAE,MAAM;YACf,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,GAAG,eAAe,YAAY;YACtD,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,iBAAiB;SACxC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/governance.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerGovernanceCommands(program: Command): void;

package/dist/commands/governance.js

@@ -0,0 +1,37 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput } from '../output.js';
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+export function registerGovernanceCommands(program) {
+    const governance = program.command('governance').description('Governance operations');
+    governance
+        .command('add-delegate')
+        // `--identity` is the ADI (acc://org.acme), not a uuid — the governance endpoint keys on the ADI.
+        .description('Add a delegate to an identity key book')
+        .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
+        .requiredOption('--delegate-url <url>', 'Delegate URL to add')
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.governance.create({
+            identity: opts.identity,
+            operations: [{ type: 'add_delegate', delegate_url: opts.delegateUrl }],
+        });
+        printOutput(result);
+    });
+    governance
+        .command('set-threshold')
+        .description('Set the M-of-N acceptThreshold on an identity key page')
+        .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
+        .requiredOption('--threshold <n>', 'New threshold', parseInt)
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.governance.create({
+            identity: opts.identity,
+            operations: [{ type: 'set_threshold', threshold: opts.threshold }],
+        });
+        printOutput(result);
+    });
+}
+//# sourceMappingURL=governance.js.map

package/dist/commands/governance.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/commands/governance.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAEtF,UAAU;SACP,OAAO,CAAC,cAAc,CAAC;QACxB,kGAAkG;SACjG,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SACvE,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,UAAU;SACP,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,wDAAwD,CAAC;SACrE,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,iBAAiB,EAAE,eAAe,EAAE,QAAQ,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/identity.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerIdentityCommands(program: Command): void;

package/dist/commands/identity.js

@@ -0,0 +1,61 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput } from '../output.js';
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+export function registerIdentityCommands(program) {
+    const identity = program.command('identity').description('Identity management');
+    identity
+        .command('create')
+        .description('Create a new identity')
+        .requiredOption('--name <name>', 'Identity name')
+        .requiredOption('--public-key-hash <hash>', 'Public key hash')
+        .option('--public-key <key>', 'Public key (hex)')
+        .option('--chains <chains>', 'Comma-separated chain IDs')
+        .option('--credits <credits>', 'Initial credits', parseInt)
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.identity.create({
+            name: opts.name,
+            publicKeyHash: opts.publicKeyHash,
+            publicKey: opts.publicKey,
+            chains: opts.chains ? opts.chains.split(',') : undefined,
+            credits: opts.credits,
+        });
+        printOutput(result);
+    });
+    identity
+        .command('list')
+        .description('(unavailable — the gateway has no identity list endpoint)')
+        .action(() => {
+        // This called GET /v1/identities, which 404s: the gateway serves /v1/identity (POST) and
+        // /v1/identity/{id} (GET/PATCH/DELETE) and has no collection route. Failing with an explanation
+        // beats failing with a 404 the user has to go decode. Kept as a command so it explains itself
+        // rather than printing "unknown command".
+        throw new Error('The gateway has no identity list endpoint — GET /v1/identities does not exist. '
+            + 'Use `certen identity get <id>` for an identity you know, or `certen portfolio` for a '
+            + 'cross-identity view of the org.');
+    });
+    identity
+        .command('get <id>')
+        .description('Get identity details')
+        .action(async (id) => {
+        const client = await getClient();
+        // No `--include`: the route takes no query parameters. It used to be sent and silently ignored.
+        const result = await client.identity.get(id);
+        printOutput(result);
+    });
+    identity
+        .command('link-chain <id>')
+        .description('Link a chain to an identity')
+        .requiredOption('--chain <chain>', 'Chain ID to link')
+        .action(async (id, opts) => {
+        const client = await getClient();
+        const result = await client.identity.update(id, {
+            linkChains: [opts.chain],
+        });
+        printOutput(result);
+    });
+}
+//# sourceMappingURL=identity.js.map

package/dist/commands/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAEhF,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uBAAuB,CAAC;SACpC,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,cAAc,CAAC,0BAA0B,EAAE,iBAAiB,CAAC;SAC7D,MAAM,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;SAChD,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SACxD,MAAM,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,QAAQ,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACxD,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,GAAG,EAAE;QACX,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,0CAA0C;QAC1C,MAAM,IAAI,KAAK,CACb,iFAAiF;cAC/E,uFAAuF;cACvF,iCAAiC,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,gGAAgG;QAChG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,cAAc,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE;YAC9C,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/pending.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerPendingCommands(program: Command): void;

package/dist/commands/pending.js

@@ -0,0 +1,59 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput } from '../output.js';
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+export function registerPendingCommands(program) {
+    const pending = program.command('pending').description('Pending actions inbox');
+    pending
+        .command('list')
+        .description('List pending actions')
+        .option('--identity <id>', 'Filter by identity')
+        .option('--status <status>', 'Filter by status')
+        .option('--category <cat>', 'Filter by category')
+        .option('--limit <n>', 'Max results', parseInt)
+        .option('--offset <n>', 'Offset', parseInt)
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.pending.list({
+            identity: opts.identity,
+            status: opts.status,
+            category: opts.category,
+            limit: opts.limit,
+            offset: opts.offset,
+        });
+        printOutput(result);
+    });
+    pending
+        .command('sign <id>')
+        .description('Create a sign request for a pending action')
+        .option('--identity <id>', 'Identity to sign as')
+        .option('--signer-url <url>', 'Signer URL')
+        .option('--vote <vote>', 'Vote (accept/reject)')
+        .action(async (id, opts) => {
+        const client = await getClient();
+        const result = await client.sign.create({
+            type: 'pending_action',
+            targetId: id,
+            identity: opts.identity,
+            signerUrl: opts.signerUrl,
+            vote: opts.vote,
+        });
+        printOutput(result);
+    });
+    pending
+        .command('submit <id>')
+        .description('Submit a signature for a pending sign request')
+        .requiredOption('--signature <sig>', 'Signature (hex)')
+        .requiredOption('--public-key <key>', 'Public key (hex)')
+        .action(async (id, opts) => {
+        const client = await getClient();
+        const result = await client.sign.submitSignature(id, {
+            signature: opts.signature,
+            publicKey: opts.publicKey,
+        });
+        printOutput(result);
+    });
+}
+//# sourceMappingURL=pending.js.map

package/dist/commands/pending.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending.js","sourceRoot":"","sources":["../../src/commands/pending.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAEhF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;SAChD,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC9C,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAChD,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC;SAC1C,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACtC,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;SACtD,cAAc,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE;YACnD,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/portfolio.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerPortfolioCommands(program: Command): void;

package/dist/commands/portfolio.js

@@ -0,0 +1,18 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput } from '../output.js';
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+export function registerPortfolioCommands(program) {
+    program
+        .command('portfolio')
+        .description('Get multi-chain portfolio balances')
+        .option('--identity <id>', 'Filter by identity')
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.portfolio.get(opts.identity);
+        printOutput(result);
+    });
+}
+//# sourceMappingURL=portfolio.js.map

package/dist/commands/portfolio.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"portfolio.js","sourceRoot":"","sources":["../../src/commands/portfolio.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,oCAAoC,CAAC;SACjD,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/transaction.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerTransactionCommands(program: Command): void;

package/dist/commands/transaction.js

@@ -0,0 +1,95 @@
+import { readFileSync } from 'node:fs';
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput } from '../output.js';
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+export function registerTransactionCommands(program) {
+    const tx = program.command('tx').description('Transaction lifecycle');
+    tx
+        .command('create')
+        .description('Open a transaction intent (returns signing_data — you sign it, then `tx sign`)')
+        // The API takes an `intent` object, not flat to/amount/type fields. The flags below build the simple
+        // native-transfer shape; `--intent` takes a JSON file or literal for multi-leg and contract-call
+        // intents, which have no sensible flag representation.
+        .requiredOption('--identity <id>', 'Identity ID (uuid)')
+        .option('--intent <json>', 'Intent as JSON, or @path/to/intent.json. Overrides the flags below.')
+        .option('--from-chain <chain>', 'Source chain', 'accumulate')
+        .option('--to-chain <chain>', 'Destination chain, e.g. ethereum-sepolia')
+        .option('--from <address>', 'Source address (the identity ADI or its abstract account)')
+        .option('--to <address>', 'Destination address')
+        .option('--amount <amount>', 'Amount in base units (wei) — pass as a string')
+        .option('--token <symbol>', 'Token symbol')
+        .option('--contract-address <addr...>', 'Contract addresses this intent touches')
+        .option('--signer-key-page <url>', 'Which key page signs, e.g. acc://org.acme/book/2')
+        .option('--signer-public-key <hex>', 'Which seat on the page signs (64 hex)')
+        .option('--idempotency-key <key>', 'Idempotency key (one is generated if omitted)')
+        .action(async (opts) => {
+        const client = await getClient();
+        let intent;
+        if (opts.intent) {
+            const raw = opts.intent.startsWith('@')
+                ? readFileSync(opts.intent.slice(1), 'utf8')
+                : opts.intent;
+            intent = JSON.parse(raw);
+        }
+        else {
+            if (!opts.to || !opts.amount) {
+                throw new Error('give --intent, or all of --to and --amount (plus --to-chain) for a simple transfer');
+            }
+            intent = {
+                fromChain: opts.fromChain,
+                toChain: opts.toChain,
+                fromAddress: opts.from,
+                toAddress: opts.to,
+                amount: String(opts.amount),
+                tokenSymbol: opts.token,
+            };
+        }
+        const result = await client.transaction.create({
+            identityId: opts.identity,
+            intent,
+            contractAddresses: opts.contractAddress,
+            signerKeyPage: opts.signerKeyPage,
+            signerPublicKey: opts.signerPublicKey,
+            idempotencyKey: opts.idempotencyKey,
+        });
+        printOutput(result);
+    });
+    tx
+        .command('sign <id>')
+        .description('Submit a signature for a transaction')
+        .requiredOption('--signature <sig>', 'Signature (hex)')
+        .requiredOption('--public-key <key>', 'Public key (hex)')
+        .action(async (id, opts) => {
+        const client = await getClient();
+        const result = await client.transaction.submitSignature(id, {
+            signature: opts.signature,
+            publicKey: opts.publicKey,
+        });
+        printOutput(result);
+    });
+    tx
+        .command('status <id>')
+        .description('Get transaction status')
+        .action(async (id) => {
+        const client = await getClient();
+        const result = await client.transaction.get(id);
+        printOutput(result);
+    });
+    tx
+        .command('list')
+        .description('List transactions')
+        .option('--limit <n>', 'Max results', parseInt)
+        .option('--offset <n>', 'Offset', parseInt)
+        .action(async (opts) => {
+        const client = await getClient();
+        const result = await client.transaction.list({
+            limit: opts.limit,
+            offset: opts.offset,
+        });
+        printOutput(result);
+    });
+}
+//# sourceMappingURL=transaction.js.map

package/dist/commands/transaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transaction.js","sourceRoot":"","sources":["../../src/commands/transaction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAEtE,EAAE;SACC,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gFAAgF,CAAC;QAC9F,qGAAqG;QACrG,iGAAiG;QACjG,uDAAuD;SACtD,cAAc,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SACvD,MAAM,CAAC,iBAAiB,EAAE,qEAAqE,CAAC;SAChG,MAAM,CAAC,sBAAsB,EAAE,cAAc,EAAE,YAAY,CAAC;SAC5D,MAAM,CAAC,oBAAoB,EAAE,0CAA0C,CAAC;SACxE,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;SACvF,MAAM,CAAC,gBAAgB,EAAE,qBAAqB,CAAC;SAC/C,MAAM,CAAC,mBAAmB,EAAE,+CAA+C,CAAC;SAC5E,MAAM,CAAC,kBAAkB,EAAE,cAAc,CAAC;SAC1C,MAAM,CAAC,8BAA8B,EAAE,wCAAwC,CAAC;SAChF,MAAM,CAAC,yBAAyB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,2BAA2B,EAAE,uCAAuC,CAAC;SAC5E,MAAM,CAAC,yBAAyB,EAAE,+CAA+C,CAAC;SAClF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QAEjC,IAAI,MAA+B,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;gBACrC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC;gBAC5C,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YAChB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,GAAG;gBACP,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,WAAW,EAAE,IAAI,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,EAAE;gBAClB,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC3B,WAAW,EAAE,IAAI,CAAC,KAAK;aACxB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC;YAC7C,UAAU,EAAE,IAAI,CAAC,QAAQ;YACzB,MAAM;YACN,iBAAiB,EAAE,IAAI,CAAC,eAAe;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;SACpC,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,EAAE;SACC,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,sCAAsC,CAAC;SACnD,cAAc,CAAC,mBAAmB,EAAE,iBAAiB,CAAC;SACtD,cAAc,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;SACxD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,EAAE;YAC1D,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,EAAE;SACC,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChD,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,EAAE;SACC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC9C,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC;YAC3C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,39 @@
+export interface CliConfig {
+    api_key?: string;
+    api_url?: string;
+    output?: 'table' | 'json';
+    /** When 'keyring', api_key in this file is unused; the OS keyring is the source of truth. */
+    storage?: 'file' | 'keyring';
+    /**
+     * Round-2 #43: when storage=keyring, the actual key isn't in this file.
+     * Persist its prefix (first 12 chars) so `auth status` can still show
+     * which key is selected without round-tripping through the keyring.
+     */
+    key_prefix?: string;
+}
+export declare function readConfig(): CliConfig;
+/**
+ * Write the config file with 0600 perms (owner read/write only). On Windows,
+ * filesystem permissions are not enforced the same way; we still call
+ * chmod to flag intent.
+ */
+export declare function writeConfig(config: CliConfig): void;
+/**
+ * Read the API key with the following precedence:
+ *   1. CERTEN_API_KEY env (always wins so CI never touches the keyring/file)
+ *   2. OS keyring when storage='keyring'
+ *   3. config.json (only if perms are 0600 or stricter)
+ */
+export declare function getApiKey(): Promise<string>;
+export declare function setApiKey(apiKey: string, useKeyring: boolean): Promise<void>;
+export declare function clearApiKey(): Promise<void>;
+/**
+ * The gateway this CLI talks to when nothing else says.
+ *
+ * Must be a host that actually serves the API. This was `https://api.certen.io`, which resolves to the
+ * Certen marketing site, so every unconfigured invocation got HTML back and the failure looked like a
+ * broken CLI rather than a wrong address.
+ */
+export declare const DEFAULT_API_URL = "https://gateway.kompendium.co";
+export declare function getApiUrl(): string;
+export declare function getOutputFormat(): 'table' | 'json';

package/dist/config.js

@@ -0,0 +1,147 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, statSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const CONFIG_DIR = join(homedir(), '.certen');
+const CONFIG_FILE = join(CONFIG_DIR, 'config.json');
+export function readConfig() {
+    if (!existsSync(CONFIG_FILE)) {
+        return {};
+    }
+    try {
+        const raw = readFileSync(CONFIG_FILE, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+/**
+ * Write the config file with 0600 perms (owner read/write only). On Windows,
+ * filesystem permissions are not enforced the same way; we still call
+ * chmod to flag intent.
+ */
+export function writeConfig(config) {
+    if (!existsSync(CONFIG_DIR)) {
+        mkdirSync(CONFIG_DIR, { recursive: true });
+    }
+    writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    try {
+        chmodSync(CONFIG_FILE, 0o600);
+    }
+    catch {
+        // Windows or non-permission-aware FS: best effort.
+    }
+}
+/**
+ * If the config file exists with world/group read permissions, warn the
+ * user and refuse to read the api_key. Forces explicit re-login under
+ * 0600 perms, or env-var-only operation.
+ */
+function configFileIsSecure() {
+    try {
+        const stat = statSync(CONFIG_FILE);
+        // Cross-platform: check that group/world have no read bits.
+        const mode = stat.mode & 0o077;
+        return mode === 0;
+    }
+    catch {
+        return true; // missing file is fine; we just have no key
+    }
+}
+async function loadKeyring() {
+    try {
+        const mod = await import('keytar');
+        return mod;
+    }
+    catch {
+        return null;
+    }
+}
+const KEYRING_SERVICE = 'certen';
+const KEYRING_ACCOUNT = 'api_key';
+/**
+ * Read the API key with the following precedence:
+ *   1. CERTEN_API_KEY env (always wins so CI never touches the keyring/file)
+ *   2. OS keyring when storage='keyring'
+ *   3. config.json (only if perms are 0600 or stricter)
+ */
+export async function getApiKey() {
+    const envKey = process.env.CERTEN_API_KEY;
+    if (envKey)
+        return envKey;
+    const cfg = readConfig();
+    if (cfg.storage === 'keyring') {
+        const kr = await loadKeyring();
+        if (kr) {
+            const v = await kr.getPassword(KEYRING_SERVICE, KEYRING_ACCOUNT);
+            if (v)
+                return v;
+        }
+        else {
+            console.error('storage=keyring requested but `keytar` is not installed; install it or set CERTEN_API_KEY.');
+            process.exit(1);
+        }
+    }
+    if (cfg.api_key) {
+        if (!configFileIsSecure()) {
+            console.error('refusing to read ~/.certen/config.json — file permissions are not 0600. Run `certen auth login` again to fix.');
+            process.exit(1);
+        }
+        return cfg.api_key;
+    }
+    console.error('No API key configured. Run "certen auth login --api-key <key>" or set CERTEN_API_KEY.');
+    process.exit(1);
+}
+export async function setApiKey(apiKey, useKeyring) {
+    const prefix = apiKey.substring(0, 12);
+    if (useKeyring) {
+        const kr = await loadKeyring();
+        if (!kr) {
+            throw new Error('keytar is not installed; install it with `npm i keytar -g` or pass --no-keyring');
+        }
+        await kr.setPassword(KEYRING_SERVICE, KEYRING_ACCOUNT, apiKey);
+        const cfg = readConfig();
+        cfg.storage = 'keyring';
+        cfg.key_prefix = prefix;
+        delete cfg.api_key;
+        writeConfig(cfg);
+        return;
+    }
+    const cfg = readConfig();
+    cfg.storage = 'file';
+    cfg.api_key = apiKey;
+    cfg.key_prefix = prefix;
+    writeConfig(cfg);
+}
+export async function clearApiKey() {
+    const cfg = readConfig();
+    if (cfg.storage === 'keyring') {
+        const kr = await loadKeyring();
+        if (kr)
+            await kr.deletePassword(KEYRING_SERVICE, KEYRING_ACCOUNT);
+    }
+    delete cfg.api_key;
+    delete cfg.key_prefix;
+    cfg.storage = 'file';
+    writeConfig(cfg);
+}
+/**
+ * The gateway this CLI talks to when nothing else says.
+ *
+ * Must be a host that actually serves the API. This was `https://api.certen.io`, which resolves to the
+ * Certen marketing site, so every unconfigured invocation got HTML back and the failure looked like a
+ * broken CLI rather than a wrong address.
+ */
+export const DEFAULT_API_URL = 'https://gateway.kompendium.co';
+export function getApiUrl() {
+    const envUrl = process.env.CERTEN_API_URL;
+    if (envUrl)
+        return envUrl;
+    const cfg = readConfig();
+    return cfg.api_url ?? DEFAULT_API_URL;
+}
+export function getOutputFormat() {
+    const cfg = readConfig();
+    return cfg.output ?? 'table';
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AAC7F,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;AAgBpD,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAiB;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,mDAAmD;IACrD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB;IACzB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnC,4DAA4D;QAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4CAA4C;IAC3D,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,GAAyB,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,QAAQ,CAAC;AACjC,MAAM,eAAe,GAAG,SAAS,CAAC;AAElC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,IAAI,EAAE,EAAE,CAAC;YACP,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;YACjE,IAAI,CAAC;gBAAE,OAAO,CAAC,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,4FAA4F,CAAC,CAAC;YAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,OAAO,CAAC,KAAK,CAAC,+GAA+G,CAAC,CAAC;YAC/H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC;IACrB,CAAC;IAED,OAAO,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,UAAmB;IACjE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC,EAAE,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC,CAAC;QAC/D,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;QACzB,GAAG,CAAC,OAAO,GAAG,SAAS,CAAC;QACxB,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;QACxB,OAAO,GAAG,CAAC,OAAO,CAAC;QACnB,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,GAAG,CAAC,UAAU,GAAG,MAAM,CAAC;IACxB,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,EAAE,GAAG,MAAM,WAAW,EAAE,CAAC;QAC/B,IAAI,EAAE;YAAE,MAAM,EAAE,CAAC,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC;IACnB,OAAO,GAAG,CAAC,UAAU,CAAC;IACtB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC;IACrB,WAAW,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,+BAA+B,CAAC;AAE/D,MAAM,UAAU,SAAS;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,OAAO,IAAI,eAAe,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,OAAO,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC;AAC/B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/index.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import { Command } from 'commander';
+import { CertenError } from '@certen.io/sdk';
+import { registerAuthCommands } from './commands/auth.js';
+import { registerIdentityCommands } from './commands/identity.js';
+import { registerTransactionCommands } from './commands/transaction.js';
+import { registerPendingCommands } from './commands/pending.js';
+import { registerGovernanceCommands } from './commands/governance.js';
+import { registerPortfolioCommands } from './commands/portfolio.js';
+import { registerAdminCommands } from './commands/admin.js';
+const program = new Command();
+program
+    .name('certen')
+    .description('CERTEN Gateway CLI')
+    .version('0.1.0');
+registerAuthCommands(program);
+registerIdentityCommands(program);
+registerTransactionCommands(program);
+registerPendingCommands(program);
+registerGovernanceCommands(program);
+registerPortfolioCommands(program);
+registerAdminCommands(program);
+// Global error handler
+program.hook('preAction', () => { });
+program.exitOverride();
+async function main() {
+    try {
+        await program.parseAsync(process.argv);
+    }
+    catch (err) {
+        if (err instanceof CertenError) {
+            console.error(`Error [${err.code}]: ${err.message}`);
+            process.exit(1);
+        }
+        if (err instanceof Error) {
+            // Commander exit override throws for --help etc
+            if (err.exitCode === 0)
+                return;
+            console.error(`Error: ${err.message}`);
+            process.exit(1);
+        }
+        console.error('Unknown error:', err);
+        process.exit(1);
+    }
+}
+main();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,QAAQ,CAAC;KACd,WAAW,CAAC,oBAAoB,CAAC;KACjC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEpB,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,uBAAuB;AACvB,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACpC,OAAO,CAAC,YAAY,EAAE,CAAC;AAEvB,KAAK,UAAU,IAAI;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,IAAI,GAAG,YAAY,WAAW,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;YACzB,gDAAgD;YAChD,IAAK,GAAW,CAAC,QAAQ,KAAK,CAAC;gBAAE,OAAO;YACxC,OAAO,CAAC,KAAK,CAAC,UAAU,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC"}

package/dist/output.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Print data as an aligned table or JSON depending on user preference.
+ */
+export declare function printOutput(data: Record<string, unknown>[] | Record<string, unknown>, opts?: {
+    forceJson?: boolean;
+}): void;

package/dist/output.js

@@ -0,0 +1,54 @@
+import { getOutputFormat } from './config.js';
+/**
+ * Print data as an aligned table or JSON depending on user preference.
+ */
+export function printOutput(data, opts) {
+    const format = opts?.forceJson ? 'json' : getOutputFormat();
+    if (format === 'json') {
+        console.log(JSON.stringify(data, null, 2));
+        return;
+    }
+    // Single object: print key-value pairs
+    if (!Array.isArray(data)) {
+        const entries = Object.entries(data);
+        const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+        for (const [key, value] of entries) {
+            const displayValue = typeof value === 'object' ? JSON.stringify(value) : String(value ?? '');
+            console.log(`${key.padEnd(maxKeyLen + 2)}${displayValue}`);
+        }
+        return;
+    }
+    // Array: print table
+    if (data.length === 0) {
+        console.log('(no results)');
+        return;
+    }
+    const columns = Object.keys(data[0]);
+    const widths = {};
+    for (const col of columns) {
+        widths[col] = col.length;
+    }
+    for (const row of data) {
+        for (const col of columns) {
+            const val = formatCell(row[col]);
+            widths[col] = Math.max(widths[col], val.length);
+        }
+    }
+    // Header
+    const header = columns.map((c) => c.toUpperCase().padEnd(widths[c])).join('  ');
+    console.log(header);
+    console.log(columns.map((c) => '-'.repeat(widths[c])).join('  '));
+    // Rows
+    for (const row of data) {
+        const line = columns.map((c) => formatCell(row[c]).padEnd(widths[c])).join('  ');
+        console.log(line);
+    }
+}
+function formatCell(value) {
+    if (value === null || value === undefined)
+        return '-';
+    if (typeof value === 'object')
+        return JSON.stringify(value);
+    return String(value);
+}
+//# sourceMappingURL=output.js.map

package/dist/output.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output.js","sourceRoot":"","sources":["../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,IAAyD,EAAE,IAA8B;IACnH,MAAM,MAAM,GAAG,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC;IAE5D,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3C,OAAO;IACT,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC7F,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,OAAO;IACT,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAE1C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,SAAS;IACT,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAElE,OAAO;IACP,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@certen.io/cli",
+  "version": "0.2.0",
+  "description": "Command line for the CERTEN Gateway API",
+  "license": "MIT",
+  "type": "module",
+  "keywords": [
+    "certen",
+    "accumulate",
+    "cli",
+    "blockchain"
+  ],
+  "homepage": "https://github.com/certenIO/certen-sdk#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/certenIO/certen-sdk.git",
+    "directory": "packages/cli"
+  },
+  "bugs": {
+    "url": "https://github.com/certenIO/certen-sdk/issues"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "bin": {
+    "certen": "dist/index.js"
+  },
+  "//files": "Build output plus docs. Without this npm ships the whole directory, including src/ and test/.",
+  "files": [
+    "dist/",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit",
+    "//prepack": "Build before packing so the published bin can never point at a missing dist/index.js.",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "//dependencies": "@certen.io/sdk MUST be a version range, not file:../sdk. A published package carrying a file: dependency installs and then fails to resolve on the consumer's machine, because that path does not exist there. Local development uses `npm link` or a workspace instead.",
+  "dependencies": {
+    "@certen.io/sdk": "^0.2.0",
+    "commander": "^12.0.0"
+  },
+  "devDependencies": {
+    "typescript": "^5.5.0",
+    "vitest": "^1.6.1",
+    "@types/node": "^22.0.0"
+  },
+  "//publishConfig": "Provenance is passed as --provenance by .github/workflows/release.yml. Setting it here instead would break every publish outside CI with an error that does not explain itself."
+}