@certen.io/cli 0.3.0 → 0.3.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +136 -132
- package/package.json +2 -2
package/README.md
CHANGED
|
@@ -1,132 +1,136 @@
|
|
|
1
|
-
# `@certen.io/cli`
|
|
2
|
-
|
|
3
|
-
The `certen` command line for the [CERTEN Gateway](https://gateway.kompendium.co/reference) —
|
|
4
|
-
proof-gated cross-chain execution on Accumulate.
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
```
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
certen keys
|
|
40
|
-
certen keys
|
|
41
|
-
certen keys
|
|
42
|
-
certen keys
|
|
43
|
-
certen keys
|
|
44
|
-
certen keys
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
certen tx
|
|
70
|
-
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
certen pending
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
certen
|
|
91
|
-
certen
|
|
92
|
-
certen
|
|
93
|
-
certen
|
|
94
|
-
|
|
95
|
-
|
|
96
|
-
|
|
97
|
-
|
|
98
|
-
|
|
99
|
-
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
|
103
|
-
|
|
104
|
-
| `
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
120
|
-
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
|
|
124
|
-
|
|
125
|
-
|
|
126
|
-
|
|
127
|
-
|
|
128
|
-
proof-gating a contract call, M-of-N
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
|
|
132
|
-
|
|
1
|
+
# `@certen.io/cli`
|
|
2
|
+
|
|
3
|
+
The `certen` command line for the [CERTEN Gateway](https://gateway.kompendium.co/reference) —
|
|
4
|
+
proof-gated cross-chain execution on Accumulate.
|
|
5
|
+
|
|
6
|
+
**Docs: <https://docs.kompendium.co>** · **Get an API key: <https://gateway.kompendium.co/portal>**
|
|
7
|
+
|
|
8
|
+
```bash
|
|
9
|
+
npm install -g @certen.io/cli
|
|
10
|
+
```
|
|
11
|
+
|
|
12
|
+
## Five minutes, start to finish
|
|
13
|
+
|
|
14
|
+
```bash
|
|
15
|
+
# 1. A key. Generated here, encrypted here, and it never leaves this machine.
|
|
16
|
+
certen keys generate --name dev
|
|
17
|
+
|
|
18
|
+
# 2. An API key from the portal at https://gateway.kompendium.co/portal
|
|
19
|
+
certen auth login --api-key ck_live_...
|
|
20
|
+
|
|
21
|
+
# 3. An identity that your key controls.
|
|
22
|
+
certen identity create --name my-org --sign-with dev
|
|
23
|
+
|
|
24
|
+
# 4. Watch it provision (~20s). Wait for status=active AND can_sign=true.
|
|
25
|
+
certen identity get <id>
|
|
26
|
+
```
|
|
27
|
+
|
|
28
|
+
That is the whole onboarding path. Step 3 is the one worth understanding: `--sign-with` derives
|
|
29
|
+
the `public_key` and `public_key_hash` from your local key, so the ADI's key page is bound to a
|
|
30
|
+
key only you hold.
|
|
31
|
+
|
|
32
|
+
## Your key never leaves this machine
|
|
33
|
+
|
|
34
|
+
`certen keys generate` creates an Ed25519 key, encrypts it with a passphrase (scrypt + AES-256-GCM),
|
|
35
|
+
and writes it to `~/.certen/keys/<name>.json` with `0600` permissions. The CLI sends **signatures**
|
|
36
|
+
to the gateway. It never sends a private key, and there is no code path that could.
|
|
37
|
+
|
|
38
|
+
```bash
|
|
39
|
+
certen keys generate --name dev # prompts for a passphrase (confirmed)
|
|
40
|
+
certen keys generate --name ci --no-passphrase # unencrypted; file permissions only
|
|
41
|
+
certen keys list # metadata only — never decrypts
|
|
42
|
+
certen keys show dev
|
|
43
|
+
certen keys verify dev # proves the key decrypts and signs correctly
|
|
44
|
+
certen keys sign --name dev --hash <hex> # print a signature, send nothing
|
|
45
|
+
certen keys delete dev --yes
|
|
46
|
+
certen keys path
|
|
47
|
+
```
|
|
48
|
+
|
|
49
|
+
Set `CERTEN_KEY_PASSPHRASE` to skip the prompt in CI. When it is set and there is no TTY, the CLI
|
|
50
|
+
uses it; when neither is available it fails with an explanation rather than hanging on a prompt
|
|
51
|
+
nobody can see.
|
|
52
|
+
|
|
53
|
+
**`certen keys sign` sends nothing anywhere.** It is the air-gapped path: generate on one machine,
|
|
54
|
+
carry the hash to it, carry the signature back.
|
|
55
|
+
|
|
56
|
+
## Signing a transaction
|
|
57
|
+
|
|
58
|
+
The one-step form opens the intent, signs the returned hash, and submits the signature:
|
|
59
|
+
|
|
60
|
+
```bash
|
|
61
|
+
certen tx create --identity <uuid> --to-chain ethereum-sepolia \
|
|
62
|
+
--to 0xRecipient --amount 1000000000000000 --sign-with dev
|
|
63
|
+
```
|
|
64
|
+
|
|
65
|
+
Or drive the steps yourself — useful when the signer is an HSM, another machine, or your own
|
|
66
|
+
policy engine:
|
|
67
|
+
|
|
68
|
+
```bash
|
|
69
|
+
certen tx create --identity <uuid> ... # returns signing_data.hash_to_sign
|
|
70
|
+
certen keys sign --name dev --hash <hash> # or your HSM
|
|
71
|
+
certen tx sign <intent-id> --signature <sig> --public-key <pub>
|
|
72
|
+
```
|
|
73
|
+
|
|
74
|
+
`--signature`/`--public-key` remain first-class. `--sign-with` is a convenience, not a replacement.
|
|
75
|
+
|
|
76
|
+
## Multi-party approvals
|
|
77
|
+
|
|
78
|
+
```bash
|
|
79
|
+
certen pending list
|
|
80
|
+
certen pending sign <id> --identity <adi> --vote approve
|
|
81
|
+
certen pending submit <request-id> --sign-with dev --hash <hash>
|
|
82
|
+
```
|
|
83
|
+
|
|
84
|
+
`--vote` takes `approve`, `reject`, or `abstain` — lowercase strings. Not `accept`, and not a
|
|
85
|
+
number.
|
|
86
|
+
|
|
87
|
+
## Everything else
|
|
88
|
+
|
|
89
|
+
```bash
|
|
90
|
+
certen identity get <id> | link-chain <id> --chain <chain>
|
|
91
|
+
certen portfolio # balances across every identity and chain
|
|
92
|
+
certen tx status <id> | list
|
|
93
|
+
certen governance add-delegate | set-threshold
|
|
94
|
+
certen admin api-keys list | create | rotate | revoke
|
|
95
|
+
certen admin audit-log | usage
|
|
96
|
+
```
|
|
97
|
+
|
|
98
|
+
Run `certen <group> --help` for the flags on any of them.
|
|
99
|
+
|
|
100
|
+
## Configuration
|
|
101
|
+
|
|
102
|
+
| | |
|
|
103
|
+
|---|---|
|
|
104
|
+
| `CERTEN_API_KEY` | API key. Always wins, so CI never touches the keyring or config file. |
|
|
105
|
+
| `CERTEN_API_URL` | Gateway base URL. Defaults to `https://gateway.kompendium.co`. |
|
|
106
|
+
| `CERTEN_KEY_PASSPHRASE` | Passphrase for local signing keys. |
|
|
107
|
+
|
|
108
|
+
`certen auth login` stores the API key in your OS keyring by default, or in
|
|
109
|
+
`~/.certen/config.json` at `0600` with `--no-keyring`.
|
|
110
|
+
|
|
111
|
+
## Things that will bite you
|
|
112
|
+
|
|
113
|
+
**Identity creation is asynchronous.** `identity create` returns `202` and provisioning continues.
|
|
114
|
+
Poll until the status is terminal, and check `can_sign` — it derives from the on-chain key page, so
|
|
115
|
+
it can read `true` while the status is still `creating`.
|
|
116
|
+
|
|
117
|
+
**A proof cycle takes 60–110 seconds.** Real validator work, not a tunable delay. Do not wrap it in
|
|
118
|
+
a 30-second timeout.
|
|
119
|
+
|
|
120
|
+
**Sign the bytes, not the text.** If you are producing signatures outside this CLI: sign the raw
|
|
121
|
+
bytes of the hash, do not hash it again, and do not sign the ASCII of the hex string. All three
|
|
122
|
+
mistakes produce a well-formed 128-hex signature the gateway rejects. `certen keys sign` handles
|
|
123
|
+
this for you.
|
|
124
|
+
|
|
125
|
+
## Documentation
|
|
126
|
+
|
|
127
|
+
**<https://docs.kompendium.co>** — getting started, authentication, errors, idempotency, and
|
|
128
|
+
task-shaped guides: onboarding an identity, external signing, proof-gating a contract call, M-of-N
|
|
129
|
+
panels, and verifying a proof.
|
|
130
|
+
|
|
131
|
+
The [live API reference](https://gateway.kompendium.co/reference) is generated from the running
|
|
132
|
+
gateway and is authoritative — when a guide and the spec disagree, the spec is right.
|
|
133
|
+
|
|
134
|
+
## License
|
|
135
|
+
|
|
136
|
+
MIT
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@certen.io/cli",
|
|
3
|
-
"version": "0.3.
|
|
3
|
+
"version": "0.3.1",
|
|
4
4
|
"description": "Command line for the CERTEN Gateway API",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -44,7 +44,7 @@
|
|
|
44
44
|
},
|
|
45
45
|
"//dependencies": "@certen.io/sdk MUST be a version range, not file:../sdk. A published package carrying a file: dependency installs and then fails to resolve on the consumer's machine, because that path does not exist there. Local development uses `npm link` or a workspace instead.",
|
|
46
46
|
"dependencies": {
|
|
47
|
-
"@certen.io/sdk": "^0.3.
|
|
47
|
+
"@certen.io/sdk": "^0.3.1",
|
|
48
48
|
"commander": "^12.0.0"
|
|
49
49
|
},
|
|
50
50
|
"devDependencies": {
|