@certen.io/cli 0.4.0 → 0.7.0

package/dist/commands/errors-catalogue.js

@@ -0,0 +1,83 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiUrl, getOutputFormat } from '../config.js';
+import { printOutput, human, hint, isJsonMode } from '../output.js';
+import { CliError, EXIT } from '../errors.js';
+/**
+ * The error vocabulary, read from the gateway you are actually talking to.
+ *
+ * The catalogue was published in the gateway and then had no client surface for a release — so the
+ * codes stayed exactly as discoverable as before, which is to say you found them by provoking them
+ * in production. Worse, the SDK ships a vendored copy that is only as current as its release, so a
+ * gateway ahead of the SDK raises codes nothing local has heard of.
+ *
+ * `certen errors <CODE>` is the command that earns this: it is the thing to run when a code shows
+ * up in a log and the question is whether to retry, pay, or wake someone.
+ */
+/** No API key: understanding an error should never require holding a credential. */
+function publicClient() {
+    return new CertenClient({ apiKey: process.env.CERTEN_API_KEY ?? 'public', baseUrl: getApiUrl() });
+}
+const machineOutput = () => isJsonMode() || getOutputFormat() === 'json';
+function describe(e) {
+    human('');
+    human(`  ${e.code}   HTTP ${e.status}`);
+    human('');
+    human(`  ${e.meaning}`);
+    human('');
+    // These two are the whole decision. `retryable` says whether the same request can ever work;
+    // `audience` says whether there is anything on your side to change at all — and being told
+    // "nothing you can do" is genuinely useful, because it stops the debugging.
+    human(`  Retrying this exact request: ${e.retryable ? 'can succeed' : 'will not help'}`);
+    if (e.audience === 'platform') {
+        human('  Cause: on CERTEN\'s side. Nothing in your request changes this.');
+    }
+    if (e.action) {
+        human('');
+        human(`  ${e.action}`);
+    }
+    human('');
+}
+export function registerErrorsCommands(program) {
+    program
+        .command('errors [code]')
+        .description('Every error code this API can return, and what to do about each')
+        .option('--retryable', 'Only codes where repeating the request can succeed')
+        .action(async (code, opts) => {
+        const { errors } = await publicClient().admin.errors();
+        if (code) {
+            const wanted = code.toUpperCase();
+            const found = errors.find((e) => e.code.toUpperCase() === wanted);
+            if (!found) {
+                // Near-misses beat a bare "not found": the usual reason to be here is a code copied out
+                // of a log with a typo, or one this gateway does not raise.
+                const near = errors
+                    .filter((e) => e.code.includes(wanted) || wanted.includes(e.code))
+                    .map((e) => e.code);
+                throw new CliError(`This gateway does not raise "${code}".`
+                    + (near.length ? ` Did you mean: ${near.join(', ')}?` : ' See them all: certen errors'), 'UNKNOWN_ERROR_CODE', EXIT.USAGE);
+            }
+            if (machineOutput()) {
+                printOutput({ ...found });
+                return;
+            }
+            describe(found);
+            return;
+        }
+        const shown = opts.retryable ? errors.filter((e) => e.retryable) : errors;
+        if (machineOutput()) {
+            printOutput({ errors: shown });
+            return;
+        }
+        const w = Math.max(...shown.map((e) => e.code.length), 4);
+        human('');
+        for (const e of shown) {
+            // `retry` is the one column worth carrying in a list — it is what someone scanning for a
+            // code in a log actually wants to know before reading the description.
+            human(`  ${e.code.padEnd(w)}  ${String(e.status).padEnd(3)}  ${e.retryable ? 'retry' : '     '}  ${e.meaning}`);
+        }
+        human('');
+        human(`  ${shown.length} code(s)${opts.retryable ? ' where retrying can succeed' : ''}.`);
+        hint('certen errors PLAN_QUOTA_EXCEEDED   # what one code means and what to do');
+    });
+}
+//# sourceMappingURL=errors-catalogue.js.map

package/dist/commands/errors-catalogue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-catalogue.js","sourceRoot":"","sources":["../../src/commands/errors-catalogue.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAsB,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAE9C;;;;;;;;;;GAUG;AAEH,oFAAoF;AACpF,SAAS,YAAY;IACnB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,MAAM,aAAa,GAAG,GAAY,EAAE,CAAC,UAAU,EAAE,IAAI,eAAe,EAAE,KAAK,MAAM,CAAC;AAElF,SAAS,QAAQ,CAAC,CAAgB;IAChC,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,6FAA6F;IAC7F,2FAA2F;IAC3F,4EAA4E;IAC5E,KAAK,CAAC,kCAAkC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC9B,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,CAAC,EAAE,CAAC,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,aAAa,EAAE,oDAAoD,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,IAA6B,EAAE,EAAE;QACxE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,YAAY,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAEvD,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,CAAC;YAClE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,wFAAwF;gBACxF,4DAA4D;gBAC5D,MAAM,IAAI,GAAG,MAAM;qBAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;qBACjE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,MAAM,IAAI,QAAQ,CAChB,gCAAgC,IAAI,IAAI;sBACtC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,8BAA8B,CAAC,EACvF,oBAAoB,EAAE,IAAI,CAAC,KAAK,CACjC,CAAC;YACJ,CAAC;YACD,IAAI,aAAa,EAAE,EAAE,CAAC;gBACpB,WAAW,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,QAAQ,CAAC,KAAK,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAE1E,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1D,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,yFAAyF;YACzF,uEAAuE;YACvE,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,KAAK,KAAK,CAAC,MAAM,WAAW,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1F,IAAI,CAAC,0EAA0E,CAAC,CAAC;IACnF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/identity.js

@@ -1,10 +1,49 @@
-import { CertenClient } from '@certen.io/sdk';
-import { getApiKey, getApiUrl } from '../config.js';
-import { printOutput } from '../output.js';
+import { writeFileSync, chmodSync } from 'node:fs';
+import { CertenClient, parseMnemonicTarget } from '@certen.io/sdk';
+import { getApiKey, getApiUrl, getOutputFormat, rememberIdentity, forgetIdentity } from '../config.js';
+import { printOutput, hint, human, isJsonMode } from '../output.js';
 import { resolveSigner } from '../signer.js';
+import { publicKeyHashOf } from '../keystore.js';
+import { assertChain, assertChains } from '../chains.js';
+import { UsageError } from '../errors.js';
+import { resolveWait, parseWaitBudget, waitForIdentity, IDENTITY_WAIT } from '../wait.js';
+import { faucetFor } from '../funding-guard.js';
 async function getClient() {
     return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
 }
+/**
+ * Render an identity for whoever is reading.
+ *
+ * Machine consumers get the response verbatim — same keys whether or not the command waited, so
+ * nothing has to branch on which flags were passed. Humans get the six fields that decide what to
+ * do next, because the table renderer serialises any nested object to a single JSON line: the raw
+ * response arrived as one unreadable blob with `can_sign` — the field that determines whether the
+ * identity works at all — buried in the middle of it.
+ *
+ * Table output is explicitly not a contract (docs/CLI-CONTRACT.md), which is what makes this
+ * divergence safe.
+ */
+function printIdentity(response) {
+    // One parameter, not two. It took a `response` and an `identity` back when the gateway nested the
+    // identity inside the response; now that the response carries those fields itself, passing both
+    // would be passing the same object twice — and the JSON branch below re-attached the inner object
+    // under an `identity` key, reintroducing the shape on the machine interface after the API had
+    // dropped it.
+    if (isJsonMode() || getOutputFormat() === 'json') {
+        printOutput({ ...response });
+        return;
+    }
+    printOutput({
+        id: response.id,
+        adi_url: response.adi_url,
+        status: response.status,
+        // `?? 'unknown'` is load-bearing: `can_sign` is three-valued and null means the key page could
+        // not be read. Printing an empty cell would read as "no".
+        can_sign: response.can_sign ?? 'unknown',
+        key_page_url: response.key_page_url ?? '-',
+        credit_balance: response.credit_balance,
+    });
+}
 export function registerIdentityCommands(program) {
     const identity = program.command('identity').description('Identity management');
     identity
@@ -14,8 +53,15 @@ export function registerIdentityCommands(program) {
         .option('--sign-with <key>', 'Local key to own this identity (see `certen keys generate`)')
         .option('--public-key-hash <hash>', 'Public key hash (omit when using --sign-with)')
         .option('--public-key <key>', 'Public key (hex)')
-        .option('--chains <chains>', 'Comma-separated chain IDs')
+        .option('--chains <chains>', 'Comma-separated chains, e.g. base-sepolia,arbitrum-sepolia')
         .option('--credits <credits>', 'Initial credits', parseInt)
+        // Creation is asynchronous and the response says nothing about whether the identity works.
+        // Human mode waits; --json keeps the old fire-and-forget default so existing scripts do not
+        // silently start blocking. See resolveWait().
+        .option('--wait', 'Wait until the identity is provisioned AND can sign (default off --json)')
+        .option('--no-wait', 'Return as soon as the gateway accepts the request')
+        .option('--timeout <minutes>', `How long to wait (default ${IDENTITY_WAIT.timeoutMin})`)
+        .option('--poll-interval <seconds>', `How often to check (default ${IDENTITY_WAIT.intervalSec})`)
         .action(async (opts) => {
         // --public-key-hash was required, which is why the CLI could not create an identity on its
         // own: the hash is sha256 of the RAW 32-byte public key, and working that out was left to
@@ -23,39 +69,151 @@ export function registerIdentityCommands(program) {
         // neither. The explicit flags still work for a key this machine does not hold.
         let publicKeyHash = opts.publicKeyHash;
         let publicKey = opts.publicKey;
+        // Chains are validated BEFORE the signer is unlocked and before the request goes out. A
+        // typo'd chain used to reach the gateway and come back as a rejection with no visible link
+        // to the flag that caused it — after the passphrase prompt, which made the round trip worse.
+        const chains = opts.chains ? assertChains(opts.chains) : undefined;
+        // Same reasoning for the wait options: a typo'd --timeout must not be discovered after an
+        // identity has already been created and has already consumed a slot against the org quota.
+        const wait = resolveWait();
+        const budget = parseWaitBudget(opts.timeout, opts.pollInterval, IDENTITY_WAIT);
         if (opts.signWith) {
             if (publicKeyHash || publicKey) {
-                throw new Error('Pass either --sign-with or --public-key-hash/--public-key, not both.');
+                throw new UsageError('Pass either --sign-with or --public-key-hash/--public-key, not both.', 'CONFLICTING_KEY_FLAGS');
             }
             const signer = await resolveSigner(opts.signWith);
             publicKeyHash = signer.publicKeyHash;
             publicKey = signer.publicKey;
         }
+        // Derive the hash from the public key rather than demanding both.
+        //
+        // The hash is sha256 of the RAW 32-byte key — a fact this file already documented while still
+        // making the caller compute it. Requiring it alongside the key was pure friction: the CLI has
+        // the bytes and the function, and every caller who supplied only `--public-key` was refused
+        // and sent to work out a digest by hand.
+        //
+        // Worse, the refusal steered them wrong. It said `--public-key-hash <hash>` was sufficient,
+        // and the gateway rejects a hash-only identity for external signing mode — correctly, since a
+        // hash cannot sign. So following the CLI's own advice produced an identity that consumes org
+        // quota and can never be used. Found by the end-to-end check on its first real run.
+        if (!publicKeyHash && publicKey) {
+            const clean = publicKey.trim().toLowerCase().replace(/^0x/, '');
+            if (!/^[0-9a-f]{64}$/.test(clean)) {
+                throw new UsageError(`"${publicKey}" is not a public key. Expected 64 hex characters (32 bytes).`, 'INVALID_PUBLIC_KEY');
+            }
+            publicKey = clean;
+            publicKeyHash = publicKeyHashOf(Buffer.from(clean, 'hex'));
+        }
         if (!publicKeyHash) {
-            throw new Error('Provide --sign-with <key>, or --public-key-hash <hash>. '
-                + 'To make a key: certen keys generate --name dev');
+            throw new UsageError('Provide --sign-with <key>, or --public-key <hex>. '
+                + 'To make a key: certen keys generate --name dev', 'MISSING_SIGNING_KEY');
+        }
+        // A hash with no key is accepted here and refused by the gateway, because a hash cannot sign.
+        // Saying so now costs nothing; discovering it after creation costs an identity slot.
+        if (!publicKey) {
+            hint('No --public-key given, only its hash. The gateway refuses this for external signing:');
+            hint('a hash cannot sign, so the identity would consume quota and never be usable.');
         }
         const client = await getClient();
         const result = await client.identity.create({
             name: opts.name,
             publicKeyHash,
             publicKey,
-            chains: opts.chains ? opts.chains.split(',') : undefined,
+            chains,
             credits: opts.credits,
         });
-        printOutput(result);
+        const id = result.id;
+        // Recorded the moment it exists. The gateway has no identity list route and the portfolio
+        // view returns no UUIDs, so an id that is only printed is an id that can be lost.
+        if (id)
+            rememberIdentity({ id, adi_url: result.adi_url, chains: chains ?? [] });
+        if (!wait || !id) {
+            if (result.id)
+                printIdentity(result);
+            else
+                printOutput(result);
+            hint('');
+            hint('Provisioning continues in the background. It is not usable until status is terminal');
+            hint('AND can_sign is true:');
+            hint(`  certen identity get ${id ?? '<id>'}`);
+            return;
+        }
+        // Waiting means the printed result is the one the user can act on, not the 202. Emitting
+        // both would put two payloads in the --json envelope for no benefit.
+        //
+        // The SHAPE stays identical to the no-wait response, because a consumer must not have to
+        // parse two different layouts depending on which flags were passed.
+        const identity = await waitForIdentity(client, id, budget);
+        // Merged, not replaced. `result` carries fields that only the create returns —
+        // `mnemonic_retrieval`, `status_url`, `warning` — and `identity` carries the refreshed state.
+        // Printing `identity` alone would drop the one-shot mnemonic URL for provider-mode
+        // identities, which cannot be recovered afterwards.
+        printIdentity({ ...result, ...identity });
+        if (isJsonMode())
+            return;
+        human('');
+        human(`  Identity ${identity.adi_url} is active and can sign.`);
+        human(`  ID  ${identity.id}`);
+        // The abstract account is msg.sender for everything this identity executes, and it starts
+        // empty. It was previously buried in a JSON blob under a name that does not say so, which
+        // is how the "parks at anchoring forever" failure finds people.
+        const accounts = identity.chain_accounts ?? [];
+        if (accounts.length > 0) {
+            human('');
+            human('  Abstract accounts (msg.sender on chain — these need gas before they can execute):');
+            for (const account of accounts) {
+                human(`    ${account.chain_id.padEnd(18)} ${account.address || '(not deployed)'}`);
+            }
+            const faucets = accounts.map((a) => faucetFor(a.chain_id)).filter(Boolean);
+            if (faucets.length > 0) {
+                human('');
+                human(`  Fund them: ${[...new Set(faucets)].join('  ')}`);
+            }
+        }
+        hint('');
+        hint(`Next: certen tx create --identity ${identity.id} --to-chain <chain> --to <addr> --amount <n> --sign-with <key>`);
     });
     identity
         .command('list')
-        .description('(unavailable — the gateway has no identity list endpoint)')
-        .action(() => {
+        .description('List the identities in your organization (via the portfolio view)')
+        .action(async () => {
         // This called GET /v1/identities, which 404s: the gateway serves /v1/identity (POST) and
-        // /v1/identity/{id} (GET/PATCH/DELETE) and has no collection route. Failing with an explanation
-        // beats failing with a 404 the user has to go decode. Kept as a command so it explains itself
-        // rather than printing "unknown command".
-        throw new Error('The gateway has no identity list endpoint — GET /v1/identities does not exist. '
-            + 'Use `certen identity get <id>` for an identity you know, or `certen portfolio` for a '
-            + 'cross-identity view of the org.');
+        // /v1/identity/{id} (GET/PATCH/DELETE) and has no collection route. It then spent a release
+        // as a command whose only behaviour was to explain that it did not work — honest, but the
+        // user's actual question ("what identities do I have") was answerable the whole time from
+        // /v1/portfolio.
+        //
+        // It then spent a release answering that question WITHOUT the ids, because the portfolio view
+        // withheld them — so anyone who had lost the UUID printed at create time could see their
+        // identity listed and still not act on it. The gateway now returns `id` there (it had it in
+        // hand all along), and this command is finally a complete answer rather than a partial one
+        // with a footnote.
+        const client = await getClient();
+        const portfolio = await client.portfolio.get();
+        const identities = portfolio.identities ?? [];
+        if (identities.length === 0) {
+            printOutput([]);
+            hint('No identities yet. Create one: certen identity create --name <name> --sign-with <key>');
+            return;
+        }
+        // `id` first: it is the field every other command takes as an argument, so it is the one a
+        // reader is scanning for.
+        printOutput(identities.map((i) => ({
+            id: i.id ?? '—',
+            adi_url: i.adi_url,
+            status: i.status,
+            credit_balance: i.credit_balance,
+            chains: i.chains?.length ?? 0,
+            pending_actions: i.pending_actions,
+        })));
+        // A gateway older than 2026-08 does not return `id` here, and the CLI ships independently of
+        // it. Say so only when it is actually true — a permanent caveat about a fixed problem trains
+        // people to skip the notes that matter.
+        if (identities.some((i) => !i.id)) {
+            hint('');
+            hint('This gateway does not return identity ids in the portfolio view, so `id` reads "—".');
+            hint('Upgrade the gateway, or use the id printed when the identity was created.');
+        }
     });
     identity
         .command('get <id>')
@@ -64,18 +222,110 @@ export function registerIdentityCommands(program) {
         const client = await getClient();
         // No `--include`: the route takes no query parameters. It used to be sent and silently ignored.
         const result = await client.identity.get(id);
+        printIdentity(result);
+        if (isJsonMode())
+            return;
+        const identity = result;
+        // `can_sign` is the field that decides whether this identity is usable, and reading it out
+        // of a printed blob is exactly the step people skip. State the conclusion.
+        if (identity.can_sign === true) {
+            hint('');
+            hint(`Ready. Next: certen tx create --identity ${identity.id} --to-chain <chain> --to <addr> --amount <n> --sign-with <key>`);
+        }
+        else if (identity.can_sign === false) {
+            hint('');
+            hint('This identity CANNOT sign — its key page is not held by your key. It will fail at the');
+            hint('signing step of every flow.');
+        }
+        else if (['provisioning', 'pending', 'creating'].includes(identity.status)) {
+            hint('');
+            hint(`Still provisioning. Wait for it: certen identity get ${identity.id}`);
+        }
+        else {
+            // null on a terminal status: unknown, not a soft yes. Never round it up.
+            hint('');
+            hint('Whether this identity can sign is UNKNOWN — its on-chain key page could not be read.');
+            hint('Treat it as unusable until that resolves.');
+        }
+    });
+    identity
+        .command('retire <id>')
+        .description('Retire an identity, freeing the org quota slot it occupies')
+        .requiredOption('--yes', 'Confirm. There is no prompt — see below')
+        .action(async (id) => {
+        // No y/N prompt: the required --yes IS the confirmation, matching `keys delete`. An identity
+        // that a live integration depends on should not be retirable by an accidental Enter.
+        const client = await getClient();
+        // Resolved first so the confirmation message names what is being retired. An id pasted from
+        // the wrong terminal is the mistake worth catching, and it is invisible until something says
+        // the ADI out loud.
+        // No enrichments: this read exists to name the ADI in the confirmation prompt. Fetching
+        // governance, per-chain balances and pending counts to print one URL is work nobody sees.
+        const before = await client.identity.get(id, { include: [] }).catch(() => null);
+        const result = await client.identity.retire(id);
+        // Dropped from the local record too, so `certen init` does not offer to reuse it.
+        forgetIdentity(id);
         printOutput(result);
+        if (isJsonMode())
+            return;
+        human('');
+        human(`  Retired ${before?.adi_url ?? id}. The org quota slot is free.`);
+        human('');
+        // The distinction people get wrong, and the one that matters if they were retiring for
+        // security reasons rather than housekeeping.
+        human('  This is a soft delete INSIDE CERTEN. The on-chain ADI, its key book and its key page');
+        human('  still exist on Accumulate and are untouched. Retiring is not a way to revoke a key.');
     });
     identity
         .command('link-chain <id>')
         .description('Link a chain to an identity')
-        .requiredOption('--chain <chain>', 'Chain ID to link')
+        .requiredOption('--chain <chain>', 'Chain to link, e.g. base-sepolia')
         .action(async (id, opts) => {
+        const chain = assertChain(opts.chain);
         const client = await getClient();
         const result = await client.identity.update(id, {
-            linkChains: [opts.chain],
+            linkChains: [chain],
         });
         printOutput(result);
     });
+    identity
+        .command('mnemonic <id-or-url> [token]')
+        .description('Collect a provider-mode mnemonic — works exactly once')
+        .option('--out <file>', 'Where to write it. Defaults to ./<id>-mnemonic.txt, mode 0600.')
+        .option('--print', 'Print it to the terminal instead of writing a file')
+        .action(async (idOrUrl, token, opts) => {
+        const client = await getClient();
+        const { mnemonic } = await client.identity.retrieveMnemonic(idOrUrl, token);
+        // A machine consumer asked for the value in its output, so give it the value. Anything else
+        // would mean a script has to go read a file the CLI chose the name of.
+        if (isJsonMode() || getOutputFormat() === 'json') {
+            printOutput({ mnemonic });
+            return;
+        }
+        if (opts.print) {
+            human('');
+            human(`  ${mnemonic}`);
+            human('');
+            human('  That was the only read. The URL is dead now, and this phrase is in your');
+            human('  terminal scrollback — move it somewhere you trust and clear the buffer.');
+            return;
+        }
+        // Writing beats printing by default. A seed phrase on stdout lands in scrollback, in CI
+        // logs, and in whatever is recording the session — all places it outlives its usefulness by
+        // years. `--print` is there for anyone who genuinely wants that.
+        const { id } = parseMnemonicTarget(idOrUrl, token);
+        const path = opts.out ?? `${id}-mnemonic.txt`;
+        writeFileSync(path, `${mnemonic}\n`, { encoding: 'utf-8', mode: 0o600 });
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+            // Windows has no POSIX mode. The file is still written; permissions are the OS's business.
+        }
+        human('');
+        human(`  Written to ${path}`);
+        human('  Read once and gone — the retrieval URL no longer works, and CERTEN cannot');
+        human('  produce this phrase again. Move it into your secret store and delete the file.');
+    });
 }
 //# sourceMappingURL=identity.js.map

package/dist/commands/identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAEhF,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uBAAuB,CAAC;SACpC,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CAAC,mBAAmB,EAAE,6DAA6D,CAAC;SAC1F,MAAM,CAAC,0BAA0B,EAAE,+CAA+C,CAAC;SACnF,MAAM,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;SAChD,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SACxD,MAAM,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,QAAQ,CAAC;SAC1D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,2FAA2F;QAC3F,0FAA0F;QAC1F,uFAAuF;QACvF,+EAA+E;QAC/E,IAAI,aAAa,GAAuB,IAAI,CAAC,aAAa,CAAC;QAC3D,IAAI,SAAS,GAAuB,IAAI,CAAC,SAAS,CAAC;QAEnD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,aAAa,IAAI,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;YACrC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,0DAA0D;kBACxD,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa;YACb,SAAS;YACT,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;YACxD,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,GAAG,EAAE;QACX,yFAAyF;QACzF,gGAAgG;QAChG,8FAA8F;QAC9F,0CAA0C;QAC1C,MAAM,IAAI,KAAK,CACb,iFAAiF;cAC/E,uFAAuF;cACvF,iCAAiC,CACpC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,gGAAgG;QAChG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,cAAc,CAAC,iBAAiB,EAAE,kBAAkB,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE;YAC9C,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC;SACzB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/commands/identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEnE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACvG,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAEhD,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,QAA0B;IAC/C,kGAAkG;IAClG,gGAAgG;IAChG,kGAAkG;IAClG,8FAA8F;IAC9F,cAAc;IACd,IAAI,UAAU,EAAE,IAAI,eAAe,EAAE,KAAK,MAAM,EAAE,CAAC;QACjD,WAAW,CAAC,EAAE,GAAG,QAAQ,EAAwC,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,WAAW,CAAC;QACV,EAAE,EAAE,QAAQ,CAAC,EAAE;QACf,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,+FAA+F;QAC/F,0DAA0D;QAC1D,QAAQ,EAAE,QAAQ,CAAC,QAAQ,IAAI,SAAS;QACxC,YAAY,EAAE,QAAQ,CAAC,YAAY,IAAI,GAAG;QAC1C,cAAc,EAAE,QAAQ,CAAC,cAAc;KACxC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,CAAC;IAEhF,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,uBAAuB,CAAC;SACpC,cAAc,CAAC,eAAe,EAAE,eAAe,CAAC;SAChD,MAAM,CAAC,mBAAmB,EAAE,6DAA6D,CAAC;SAC1F,MAAM,CAAC,0BAA0B,EAAE,+CAA+C,CAAC;SACnF,MAAM,CAAC,oBAAoB,EAAE,kBAAkB,CAAC;SAChD,MAAM,CAAC,mBAAmB,EAAE,4DAA4D,CAAC;SACzF,MAAM,CAAC,qBAAqB,EAAE,iBAAiB,EAAE,QAAQ,CAAC;QAC3D,2FAA2F;QAC3F,4FAA4F;QAC5F,8CAA8C;SAC7C,MAAM,CAAC,QAAQ,EAAE,0EAA0E,CAAC;SAC5F,MAAM,CAAC,WAAW,EAAE,mDAAmD,CAAC;SACxE,MAAM,CAAC,qBAAqB,EAAE,6BAA6B,aAAa,CAAC,UAAU,GAAG,CAAC;SACvF,MAAM,CAAC,2BAA2B,EAAE,+BAA+B,aAAa,CAAC,WAAW,GAAG,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,2FAA2F;QAC3F,0FAA0F;QAC1F,uFAAuF;QACvF,+EAA+E;QAC/E,IAAI,aAAa,GAAuB,IAAI,CAAC,aAAa,CAAC;QAC3D,IAAI,SAAS,GAAuB,IAAI,CAAC,SAAS,CAAC;QAEnD,wFAAwF;QACxF,2FAA2F;QAC3F,6FAA6F;QAC7F,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACnE,0FAA0F;QAC1F,2FAA2F;QAC3F,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAE/E,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,aAAa,IAAI,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,UAAU,CAClB,sEAAsE,EACtE,uBAAuB,CACxB,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAClD,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;YACrC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAC/B,CAAC;QAED,kEAAkE;QAClE,EAAE;QACF,8FAA8F;QAC9F,8FAA8F;QAC9F,4FAA4F;QAC5F,yCAAyC;QACzC,EAAE;QACF,4FAA4F;QAC5F,8FAA8F;QAC9F,6FAA6F;QAC7F,oFAAoF;QACpF,IAAI,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAChE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,UAAU,CAClB,IAAI,SAAS,+DAA+D,EAC5E,oBAAoB,CACrB,CAAC;YACJ,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,aAAa,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAClB,oDAAoD;kBAClD,gDAAgD,EAClD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QAED,8FAA8F;QAC9F,qFAAqF;QACrF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,CAAC,sFAAsF,CAAC,CAAC;YAC7F,IAAI,CAAC,8EAA8E,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,aAAa;YACb,SAAS;YACT,MAAM;YACN,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC;QACrB,0FAA0F;QAC1F,kFAAkF;QAClF,IAAI,EAAE;YAAE,gBAAgB,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;QAEhF,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,MAAM,CAAC,EAAE;gBAAE,aAAa,CAAC,MAAM,CAAC,CAAC;;gBAChC,WAAW,CAAC,MAA4C,CAAC,CAAC;YAC/D,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,qFAAqF,CAAC,CAAC;YAC5F,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC9B,IAAI,CAAC,yBAAyB,EAAE,IAAI,MAAM,EAAE,CAAC,CAAC;YAC9C,OAAO;QACT,CAAC;QAED,yFAAyF;QACzF,qEAAqE;QACrE,EAAE;QACF,yFAAyF;QACzF,oEAAoE;QACpE,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC3D,+EAA+E;QAC/E,8FAA8F;QAC9F,mFAAmF;QACnF,oDAAoD;QACpD,aAAa,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAE1C,IAAI,UAAU,EAAE;YAAE,OAAO;QAEzB,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,cAAc,QAAQ,CAAC,OAAO,0BAA0B,CAAC,CAAC;QAChE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAE9B,0FAA0F;QAC1F,0FAA0F;QAC1F,gEAAgE;QAChE,MAAM,QAAQ,GAAG,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;QAC/C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,EAAE,CAAC,CAAC;YACV,KAAK,CAAC,qFAAqF,CAAC,CAAC;YAC7F,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,KAAK,CAAC,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,IAAI,gBAAgB,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC3E,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,KAAK,CAAC,EAAE,CAAC,CAAC;gBACV,KAAK,CAAC,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QAED,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,CAAC,qCAAqC,QAAQ,CAAC,EAAE,gEAAgE,CAAC,CAAC;IACzH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,mEAAmE,CAAC;SAChF,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,yFAAyF;QACzF,4FAA4F;QAC5F,0FAA0F;QAC1F,0FAA0F;QAC1F,iBAAiB;QACjB,EAAE;QACF,8FAA8F;QAC9F,yFAAyF;QACzF,4FAA4F;QAC5F,2FAA2F;QAC3F,mBAAmB;QACnB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,IAAI,EAAE,CAAC;QAE9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,WAAW,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,uFAAuF,CAAC,CAAC;YAC9F,OAAO;QACT,CAAC;QAED,2FAA2F;QAC3F,0BAA0B;QAC1B,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,GAAG;YACf,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC;YAC7B,eAAe,EAAE,CAAC,CAAC,eAAe;SACnC,CAAC,CAAC,CAAC,CAAC;QAEL,6FAA6F;QAC7F,6FAA6F;QAC7F,wCAAwC;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,qFAAqF,CAAC,CAAC;YAC5F,IAAI,CAAC,2EAA2E,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,gGAAgG;QAChG,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,aAAa,CAAC,MAAM,CAAC,CAAC;QAEtB,IAAI,UAAU,EAAE;YAAE,OAAO;QACzB,MAAM,QAAQ,GAAG,MAAM,CAAC;QAExB,2FAA2F;QAC3F,2EAA2E;QAC3E,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,4CAA4C,QAAQ,CAAC,EAAE,gEAAgE,CAAC,CAAC;QAChI,CAAC;aAAM,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvC,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,uFAAuF,CAAC,CAAC;YAC9F,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC7E,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,wDAAwD,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,yEAAyE;YACzE,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,sFAAsF,CAAC,CAAC;YAC7F,IAAI,CAAC,2CAA2C,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,4DAA4D,CAAC;SACzE,cAAc,CAAC,OAAO,EAAE,yCAAyC,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,6FAA6F;QAC7F,qFAAqF;QACrF,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QAEjC,4FAA4F;QAC5F,6FAA6F;QAC7F,oBAAoB;QACpB,wFAAwF;QACxF,0FAA0F;QAC1F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEhF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAChD,kFAAkF;QAClF,cAAc,CAAC,EAAE,CAAC,CAAC;QACnB,WAAW,CAAC,MAA4C,CAAC,CAAC;QAE1D,IAAI,UAAU,EAAE;YAAE,OAAO;QACzB,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,aAAa,MAAM,EAAE,OAAO,IAAI,EAAE,+BAA+B,CAAC,CAAC;QACzE,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,uFAAuF;QACvF,6CAA6C;QAC7C,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAChG,KAAK,CAAC,uFAAuF,CAAC,CAAC;IACjG,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,6BAA6B,CAAC;SAC1C,cAAc,CAAC,iBAAiB,EAAE,kCAAkC,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,EAAE;YAC9C,UAAU,EAAE,CAAC,KAAK,CAAC;SACpB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,QAAQ;SACL,OAAO,CAAC,8BAA8B,CAAC;SACvC,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,cAAc,EAAE,gEAAgE,CAAC;SACxF,MAAM,CAAC,SAAS,EAAE,oDAAoD,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,KAAyB,EAAE,IAAuC,EAAE,EAAE;QACpG,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAE5E,4FAA4F;QAC5F,uEAAuE;QACvE,IAAI,UAAU,EAAE,IAAI,eAAe,EAAE,KAAK,MAAM,EAAE,CAAC;YACjD,WAAW,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,KAAK,CAAC,EAAE,CAAC,CAAC;YACV,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;YACvB,KAAK,CAAC,EAAE,CAAC,CAAC;YACV,KAAK,CAAC,2EAA2E,CAAC,CAAC;YACnF,KAAK,CAAC,2EAA2E,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,wFAAwF;QACxF,4FAA4F;QAC5F,iEAAiE;QACjE,MAAM,EAAE,EAAE,EAAE,GAAG,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACnD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,EAAE,eAAe,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,QAAQ,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,2FAA2F;QAC7F,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QAC9B,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACrF,KAAK,CAAC,kFAAkF,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/init.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerInitCommands(program: Command): void;