@certen.io/cli 0.5.0 → 0.7.0

package/dist/commands/pending.js

@@ -1,6 +1,6 @@
 import { CertenClient } from '@certen.io/sdk';
 import { getApiKey, getApiUrl } from '../config.js';
-import { printOutput } from '../output.js';
+import { printOutput, hint, isJsonMode } from '../output.js';
 import { resolveSignature } from '../signer.js';
 async function getClient() {
     return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
@@ -44,6 +44,18 @@ export function registerPendingCommands(program) {
             vote: opts.vote,
         });
         printOutput(result);
+        if (isJsonMode())
+            return;
+        // This command creates a sign REQUEST; it does not cast the vote. The two-step shape is not
+        // obvious from the name, and stopping here leaves the approval uncast.
+        const r = result;
+        const requestId = r.sign_request_id;
+        const hash = r.signing_data?.data_for_signature ?? r.signing_data?.hash_to_sign;
+        if (requestId && hash) {
+            hint('');
+            hint('This opened a sign request — the vote is not cast until the signature is submitted:');
+            hint(`  certen pending submit ${requestId} --sign-with <key> --hash ${hash}`);
+        }
     });
     pending
         .command('submit <id>')

package/dist/commands/pending.js.map

@@ -1 +1 @@
-{"version":3,"file":"pending.js","sourceRoot":"","sources":["../../src/commands/pending.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAEhF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;SAChD,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC9C,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAChD,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC;QAC3C,sFAAsF;QACtF,2FAA2F;SAC1F,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACtC,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACpE,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;SAChF,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"pending.js","sourceRoot":"","sources":["../../src/commands/pending.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,OAAgB;IACtD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAEhF,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,mBAAmB,EAAE,kBAAkB,CAAC;SAC/C,MAAM,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;SAChD,MAAM,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ,CAAC;SAC9C,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;YACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,4CAA4C,CAAC;SACzD,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAChD,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC;QAC3C,sFAAsF;QACtF,2FAA2F;SAC1F,MAAM,CAAC,eAAe,EAAE,kCAAkC,CAAC;SAC3D,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC;YACtC,IAAI,EAAE,gBAAgB;YACtB,QAAQ,EAAE,EAAE;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;QAE1D,IAAI,UAAU,EAAE;YAAE,OAAO;QACzB,4FAA4F;QAC5F,uEAAuE;QACvE,MAAM,CAAC,GAAG,MAGT,CAAC;QACF,MAAM,SAAS,GAAG,CAAC,CAAC,eAAe,CAAC;QACpC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,kBAAkB,IAAI,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC;QAChF,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,qFAAqF,CAAC,CAAC;YAC5F,IAAI,CAAC,2BAA2B,SAAS,6BAA6B,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACpE,MAAM,CAAC,cAAc,EAAE,qDAAqD,CAAC;SAC7E,MAAM,CAAC,mBAAmB,EAAE,mDAAmD,CAAC;SAChF,MAAM,CAAC,oBAAoB,EAAE,6CAA6C,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAI,EAAE,EAAE;QACjC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC;YACtD,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QAC/E,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/portfolio.js

@@ -1,6 +1,8 @@
 import { CertenClient } from '@certen.io/sdk';
 import { getApiKey, getApiUrl } from '../config.js';
-import { printOutput } from '../output.js';
+import { printOutput, hint, isJsonMode } from '../output.js';
+import { faucetFor } from '../funding-guard.js';
+import { normalizeChain } from '../chains.js';
 async function getClient() {
     return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
 }
@@ -13,6 +15,37 @@ export function registerPortfolioCommands(program) {
         const client = await getClient();
         const result = await client.portfolio.get(opts.identity);
         printOutput(result);
+        if (isJsonMode())
+            return;
+        if ((result.identities ?? []).length === 0) {
+            hint('');
+            hint('No identities yet. Next: certen identity create --name <name> --sign-with <key>');
+            return;
+        }
+        // An abstract account with no gas is the difference between an intent that executes and one
+        // that parks at `anchoring` forever. This is the view where that is visible, so say it here
+        // rather than leaving it to be discovered at submit time.
+        const empty = [];
+        for (const identity of result.identities) {
+            for (const chain of identity.chains ?? []) {
+                const native = (chain.balances ?? []).find((b) => !b.token || b.token === 'ETH' || b.token === 'native');
+                // Normalized: the same chain arrives as a slug on one account and a numeric EVM id on
+                // another, so the raw values would list one chain twice.
+                if (native && Number(native.balance) === 0)
+                    empty.push(normalizeChain(chain.chain_id));
+            }
+        }
+        if (empty.length > 0) {
+            const chains = [...new Set(empty)];
+            hint('');
+            hint(`Abstract accounts with no gas on: ${chains.join(', ')}.`);
+            hint('An intent that moves value from these is accepted and then never executes.');
+            for (const chain of chains) {
+                const faucet = faucetFor(chain);
+                if (faucet)
+                    hint(`  ${chain}: ${faucet}`);
+            }
+        }
     });
 }
 //# sourceMappingURL=portfolio.js.map

package/dist/commands/portfolio.js.map

@@ -1 +1 @@
-{"version":3,"file":"portfolio.js","sourceRoot":"","sources":["../../src/commands/portfolio.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,oCAAoC,CAAC;SACjD,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"portfolio.js","sourceRoot":"","sources":["../../src/commands/portfolio.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB;IACxD,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,oCAAoC,CAAC;SACjD,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzD,WAAW,CAAC,MAA4C,CAAC,CAAC;QAE1D,IAAI,UAAU,EAAE;YAAE,OAAO;QAEzB,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,iFAAiF,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QAED,4FAA4F;QAC5F,4FAA4F;QAC5F,0DAA0D;QAC1D,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;gBAC1C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;gBACzG,sFAAsF;gBACtF,yDAAyD;gBACzD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnC,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,qCAAqC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChE,IAAI,CAAC,4EAA4E,CAAC,CAAC;YACnF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChC,IAAI,MAAM;oBAAE,IAAI,CAAC,KAAK,KAAK,KAAK,MAAM,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/proof.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerProofCommands(program: Command): void;

package/dist/commands/proof.js

@@ -0,0 +1,400 @@
+import { writeFileSync, readFileSync } from 'node:fs';
+import { CertenClient, CertenError, fetchSharedProof } from '@certen.io/sdk';
+import { getApiKey, getApiUrl } from '../config.js';
+import { printOutput, hint, human, isJsonMode } from '../output.js';
+import { CliError, UsageError, EXIT } from '../errors.js';
+/**
+ * `certen proof` — the evidence the whole product exists to produce.
+ *
+ * Eleven proof endpoints shipped with no CLI surface at all, so retrieving the deliverable meant
+ * curl. That is the gap this closes.
+ *
+ * **The design is shaped by a fact about production: the proof-service and Accumulate fail
+ * independently.** `proof/{id}`, `/bundle` and `/custody` come from the proof-service;
+ * `proof/tx/{hash}/receipt` is read live from Accumulate. When the proof-service is down the
+ * first three return 502 — with a plain-text body — while the receipt keeps working. On the live
+ * gateway today, that is exactly the state: every proof-service read 502s and every receipt
+ * succeeds.
+ *
+ * So a command that reported "no proof" on a 502 would be wrong in the most damaging way
+ * available: telling someone their evidence does not exist when it does. Every read here falls
+ * back to the receipt and says which source answered.
+ */
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const HEX64 = /^(0x)?[0-9a-f]{64}$/i;
+/**
+ * Pull a 64-hex transaction hash out of whatever the gateway called one.
+ *
+ * `accum_tx_hash` arrives as a full ACME URL in practice —
+ * `acc://<64hex>@campaign-714942.acme/data` — not as a bare hash. Passing that string to
+ * `/v1/proof/tx/{hash}/receipt` 404s, and the reason is invisible unless you know the shape.
+ */
+function extractTxHash(value) {
+    if (!value)
+        return undefined;
+    return String(value).match(/([a-f0-9]{64})/i)?.[1];
+}
+/**
+ * The verdict, applied identically in both output modes.
+ *
+ * Shared so that adding an output branch can never again skip it. A verification command that
+ * exits 0 on an unverified proof is worse than no command at all.
+ */
+function failIfNotIncluded(inclusion) {
+    if (inclusion)
+        return;
+    throw new CliError('Inclusion could not be established from this receipt.', 'INCLUSION_NOT_ESTABLISHED', EXIT.FAILED);
+}
+/** A 5xx means the source is unavailable, which is categorically not "the proof does not exist". */
+function isUnavailable(err) {
+    return err instanceof CertenError && err.status >= 500;
+}
+/**
+ * Work out what the user gave us and what it points at.
+ *
+ * Accepts a proof id, an intent id, or a transaction hash, because at the moment someone wants a
+ * proof they have whichever of the three their last command printed — and making them work out
+ * which kind it is, then pick a matching subcommand, is a step that buys nothing.
+ */
+async function resolveTarget(client, id) {
+    if (HEX64.test(id))
+        return { txHash: id.replace(/^0x/, '') };
+    if (!UUID.test(id)) {
+        throw new UsageError(`"${id}" is not a proof id, an intent id, or a transaction hash. `
+            + 'Pass a UUID or a 64-character hex hash.', 'INVALID_PROOF_TARGET');
+    }
+    // A UUID could be either a proof id or an intent id. Try it as an intent first: that read is
+    // served by the gateway's own database rather than the proof-service, so it answers even when
+    // the proof-service is down — and it is the id a user is far more likely to be holding.
+    try {
+        const intent = await client.transaction.get(id);
+        return {
+            intentId: id,
+            // Empty string, not undefined, is what a proof-less intent actually carries. Every
+            // completed intent on the live gateway today has `proof_id: ""`.
+            proofId: intent.proof_id || undefined,
+            txHash: extractTxHash(intent.accum_tx_hash),
+            status: intent.status,
+        };
+    }
+    catch (err) {
+        if (err instanceof CertenError && err.status === 404)
+            return { proofId: id };
+        throw err;
+    }
+}
+/** Render a receipt for a human, leading with the field that decides whether it proves anything. */
+function describeReceipt(receipt) {
+    human('');
+    human(`  Accumulate receipt for ${receipt.tx_hash}`);
+    human(`    status        ${receipt.status}`);
+    human(`    anchored      ${receipt.anchored}`);
+    if (receipt.tx_type)
+        human(`    tx_type       ${receipt.tx_type}`);
+    if (receipt.principal)
+        human(`    principal     ${receipt.principal}`);
+    if (receipt.block_time)
+        human(`    block_time    ${receipt.block_time}`);
+    if (receipt.receipt?.anchor)
+        human(`    anchor        ${receipt.receipt.anchor}`);
+    human('');
+    if (!receipt.anchored) {
+        // Delivered and anchored are different claims. Only the second is checkable against a root a
+        // counterparty obtained independently, which is the only kind of check that means anything.
+        human('  NOT ANCHORED YET — delivered, but there is no inclusion proof to check against a');
+        human('  block root until it anchors. Try again shortly.');
+        human('');
+    }
+}
+export function registerProofCommands(program) {
+    const proof = program.command('proof').description('Proofs — the evidence you hand a counterparty');
+    proof
+        .command('get <id>')
+        .description('Get a proof by proof id, intent id, or transaction hash')
+        .action(async (id) => {
+        const client = await getClient();
+        const target = await resolveTarget(client, id);
+        let serviceDown = 0;
+        if (target.proofId) {
+            try {
+                const artifact = await client.proof.get(target.proofId);
+                printOutput({ source: 'proof-service', proof_id: target.proofId, proof: artifact });
+                if (!isJsonMode()) {
+                    hint('');
+                    hint(`Full bundle: certen proof bundle ${target.proofId}`);
+                }
+                return;
+            }
+            catch (err) {
+                if (!isUnavailable(err))
+                    throw err;
+                serviceDown = err.status;
+                if (!isJsonMode() && target.txHash) {
+                    hint(`The proof-service is unavailable (${serviceDown}). `
+                        + 'Falling back to the Accumulate receipt, which is read from the network directly.');
+                }
+            }
+        }
+        if (!target.txHash) {
+            // Three genuinely different situations, and only one of them is "there is nothing here".
+            // Reporting a 502 as "nothing found" tells someone their evidence does not exist when it
+            // does — the worst available answer, and the one the naive version gave.
+            if (serviceDown) {
+                throw new CliError(`The proof-service is unavailable (${serviceDown}), so proof ${target.proofId} could not `
+                    + 'be read. This does NOT mean the proof is missing — it means the service that serves '
+                    + 'it is down. If you have the intent id, its Accumulate receipt is readable directly: '
+                    + 'certen proof get <intent-id>', 'PROOF_SERVICE_UNAVAILABLE', 
+                // Retryable: the proof is presumably fine and the service will come back.
+                EXIT.FAILED, true);
+            }
+            throw new CliError(target.intentId
+                ? `Intent ${target.intentId} is "${target.status ?? 'unknown'}" and carries neither a proof `
+                    + 'nor an Accumulate transaction hash yet. Wait for it to reach a terminal state: '
+                    + `certen tx status ${target.intentId} --wait`
+                : `Nothing found for ${id}.`, 'NO_PROOF_AVAILABLE', EXIT.FAILED);
+        }
+        // The receipt path. This is the normal case for governance and authorization transactions,
+        // which have no proof_id by design — an empty proof lookup there is not a bug.
+        const receipt = await client.proof.receipt(target.txHash);
+        // The merkle path is the substance of the receipt and is the point of the JSON output — and
+        // it is fourteen sibling hashes, which the table renderer flattens onto one unreadable line.
+        // Machines get all of it; the human summary below carries the anchor, which is the part a
+        // person actually checks.
+        if (isJsonMode()) {
+            printOutput({
+                source: 'accumulate-receipt',
+                tx_hash: receipt.tx_hash,
+                status: receipt.status,
+                anchored: receipt.anchored,
+                tx_type: receipt.tx_type ?? null,
+                principal: receipt.principal ?? null,
+                block_time: receipt.block_time ?? null,
+                receipt: receipt.receipt ?? null,
+            });
+            return;
+        }
+        describeReceipt(receipt);
+        hint(`Full merkle path: certen --json proof get ${id}`);
+        hint(`What this does and does not prove: certen proof verify ${id}`);
+    });
+    proof
+        .command('bundle <proofId>')
+        .description('Download the full proof bundle to a file')
+        .option('--out <path>', 'Where to write it (default ./proof-<id>.<ext>)')
+        .action(async (proofId, opts) => {
+        const client = await getClient();
+        const { data, contentType } = await client.proof.bundle(proofId).catch((err) => {
+            if (isUnavailable(err)) {
+                throw new CliError(`The proof-service is unavailable (${err.status}), so the bundle cannot `
+                    + 'be downloaded right now. The proof is not lost — this is the service that packages '
+                    + `it. The Accumulate receipt is still readable: certen proof get ${proofId}`, 'PROOF_SERVICE_UNAVAILABLE', EXIT.FAILED);
+            }
+            throw err;
+        });
+        // The gateway streams octet-stream for binary downstreams and JSON otherwise, so the
+        // extension follows what actually arrived rather than an assumption.
+        const ext = contentType.includes('json') ? 'json' : 'bin';
+        const path = opts.out ?? `./proof-${proofId}.${ext}`;
+        writeFileSync(path, data);
+        printOutput({ proof_id: proofId, path, bytes: data.length, content_type: contentType });
+        if (!isJsonMode()) {
+            hint('');
+            hint(`Hand this to your counterparty. What they should check: certen proof verify @${path}`);
+        }
+    });
+    proof
+        .command('custody <proofId>')
+        .description('Show the custody chain for a proof')
+        .action(async (proofId) => {
+        const client = await getClient();
+        const custody = await client.proof.custody(proofId).catch((err) => {
+            if (isUnavailable(err)) {
+                throw new CliError(`The proof-service is unavailable (${err.status}). Custody is served by `
+                    + 'that service and has no independent fallback.', 'PROOF_SERVICE_UNAVAILABLE', EXIT.FAILED);
+            }
+            throw err;
+        });
+        printOutput(custody);
+    });
+    // ── sharing ───────────────────────────────────────────────────────────────────────────────────
+    proof
+        .command('share <proofId>')
+        .description('Mint a link a counterparty can open without an API key')
+        .option('--label <label>', 'What this share is for — shown in `proof shares`')
+        .option('--expires-in <seconds>', 'Lifetime in seconds', parseInt)
+        .action(async (proofId, opts) => {
+        const client = await getClient();
+        const share = await client.proof.share(proofId, {
+            label: opts.label,
+            expiresIn: opts.expiresIn,
+        });
+        printOutput(share);
+        if (isJsonMode())
+            return;
+        human('');
+        if (share.url)
+            human(`  ${share.url}`);
+        else if (share.token)
+            human(`  Token: ${share.token}`);
+        human('');
+        // The token is shown once. Saying so after the fact is useless, so say it here.
+        human('  This token is shown ONCE. Later reads show only its prefix.');
+        if (share.expires_at)
+            human(`  Expires ${share.expires_at}.`);
+        hint('');
+        hint(`Revoke it: certen proof shares revoke ${share.id ?? '<share-id>'}`);
+    });
+    proof
+        .command('open <link>')
+        .description('Read a proof someone shared with you (no API key needed)')
+        .option('--out <file>', 'Write the bundle to a file instead of printing it')
+        .action(async (link, opts) => {
+        // NO getApiKey() and no client. This is the one command a counterparty runs, and the endpoint
+        // takes no credential precisely because requiring a CERTEN account to verify a CERTEN proof
+        // would defeat the purpose. Every other operation on a share existed - create, list, revoke,
+        // all for the SENDER - and the person the feature is actually for had nothing.
+        //
+        // The share URL is accepted as handed over, origin included, so nothing needs configuring:
+        // asking someone to strip the token out of a link and then name the gateway it came from is
+        // work invented for no reason.
+        const shared = await fetchSharedProof(link);
+        if (opts.out) {
+            writeFileSync(opts.out, JSON.stringify(shared.bundle, null, 2));
+            printOutput({
+                proof_id: shared.proof_id, expires_at: shared.expires_at,
+                view_count: shared.view_count, written_to: opts.out,
+            });
+            if (!isJsonMode()) {
+                human('');
+                human(`  Proof ${shared.proof_id} written to ${opts.out}.`);
+                human(`  This link expires ${shared.expires_at}.`);
+            }
+            return;
+        }
+        if (isJsonMode()) {
+            printOutput({ ...shared });
+            return;
+        }
+        // The bundle is the payload; printing it through the key/value table would render it as one
+        // unreadable line.
+        human('');
+        human(`  Proof ${shared.proof_id}`);
+        human(`  Link expires ${shared.expires_at} - viewed ${shared.view_count} time(s).`);
+        human('');
+        process.stdout.write(`${JSON.stringify(shared.bundle, null, 2)}\n`);
+        hint('certen proof open <link> --out proof.json   # keep a copy');
+    });
+    const shares = proof.command('shares').description('Share links this organization has created');
+    shares
+        .command('list', { isDefault: true })
+        .description('List every share link, including revoked and expired ones')
+        .action(async () => {
+        const client = await getClient();
+        const result = await client.proof.shares();
+        const all = result.shares ?? [];
+        if (all.length === 0) {
+            printOutput([]);
+            hint('No share links yet. Create one: certen proof share <proof-id>');
+            return;
+        }
+        const now = Date.now();
+        printOutput(all.map((share) => ({
+            id: share.id ?? '-',
+            proof_id: share.proof_id ?? '-',
+            label: share.label ?? '-',
+            // One column for the answer to "can someone use this right now", rather than three
+            // timestamp columns the reader has to combine themselves.
+            state: share.revoked_at
+                ? 'revoked'
+                : share.expires_at && new Date(share.expires_at).getTime() < now ? 'expired' : 'active',
+            views: share.view_count ?? 0,
+            expires_at: share.expires_at ?? '-',
+        })));
+    });
+    shares
+        .command('revoke <shareId>')
+        .description('Revoke a share link (the proof itself is untouched)')
+        .action(async (shareId) => {
+        const client = await getClient();
+        const result = await client.proof.revokeShare(shareId);
+        printOutput(result);
+        if (!isJsonMode()) {
+            human(`Share ${shareId} revoked. The token no longer resolves; the proof is unaffected.`);
+        }
+    });
+    // ── verify ────────────────────────────────────────────────────────────────────────────────────
+    proof
+        .command('verify <target>')
+        .description('Check a proof, and state plainly what was and was not verified')
+        .action(async (target) => {
+        // A saved bundle is checked as a file; anything else is fetched.
+        const fromFile = target.startsWith('@');
+        const client = fromFile ? null : await getClient();
+        let receipt = null;
+        let bundle = null;
+        if (fromFile) {
+            const path = target.slice(1);
+            try {
+                bundle = JSON.parse(readFileSync(path, 'utf8'));
+            }
+            catch (err) {
+                throw new UsageError(`Could not read ${path} as a JSON bundle: ${err instanceof Error ? err.message : String(err)}. `
+                    + 'A binary bundle cannot be checked locally.', 'UNREADABLE_BUNDLE');
+            }
+            const hash = extractTxHash(String(bundle.tx_hash ?? bundle.accum_tx_hash ?? ''));
+            if (hash)
+                receipt = (bundle.receipt ? bundle : null);
+        }
+        else {
+            const resolved = await resolveTarget(client, target);
+            if (!resolved.txHash) {
+                throw new CliError(`Nothing to verify for ${target} — no Accumulate transaction hash.`, 'NOTHING_TO_VERIFY', EXIT.FAILED);
+            }
+            receipt = await client.proof.receipt(resolved.txHash);
+        }
+        const inclusion = Boolean(receipt?.anchored && receipt?.receipt?.anchor);
+        const summary = {
+            checked: {
+                inclusion: inclusion ? 'asserted by the gateway' : 'not established',
+                authorization: 'NOT CHECKED — requires your own record of what was agreed',
+                outcome: 'NOT CHECKED — requires reading the destination chain',
+            },
+            anchored: receipt?.anchored ?? null,
+            anchor: receipt?.receipt?.anchor ?? null,
+            tx_hash: receipt?.tx_hash ?? null,
+            independent: false,
+        };
+        // JSON only for the payload: the `checked` object is three sentences the table renderer
+        // puts on one line, directly above the rendered version of the same thing.
+        //
+        // The mode check gates the OUTPUT, never the verdict. An earlier arrangement returned here
+        // in JSON mode and so skipped the failure check entirely — `--json proof verify` could not
+        // fail, which is the one thing a verification command must be able to do.
+        if (isJsonMode()) {
+            printOutput(summary);
+            failIfNotIncluded(inclusion);
+            return;
+        }
+        human('');
+        human('  A verifier should satisfy themselves of three separate things.');
+        human('');
+        human(`  1. Inclusion      ${inclusion ? 'the gateway returned an anchored merkle receipt' : 'NOT ESTABLISHED — not anchored, or no anchor in the receipt'}`);
+        human('  2. Authorization  NOT CHECKED. Compare the operation against your own record of');
+        human('                    what was agreed — recipient, amount, target, calldata.');
+        human('                    A valid proof of the WRONG call is still a valid proof.');
+        human('  3. Outcome        NOT CHECKED. Read the destination chain for the execution.');
+        human('');
+        // The load-bearing sentence. Everything above came from the gateway, and a verifier who
+        // does not trust the gateway has learned nothing by asking it.
+        human('  This command asked the GATEWAY. That is not independent verification.');
+        human('  To verify without trusting Certen:');
+        human('    - query an Accumulate node directly and check the receipt against roots you fetch;');
+        human('    - read the execution and its events on the destination chain.');
+        human('');
+        failIfNotIncluded(inclusion);
+    });
+}
+//# sourceMappingURL=proof.js.map

package/dist/commands/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","sourceRoot":"","sources":["../../src/commands/proof.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAqB,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAE1D;;;;;;;;;;;;;;;;GAgBG;AAEH,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,KAAK,GAAG,sBAAsB,CAAC;AAErC;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,KAAgC;IACrD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,SAAkB;IAC3C,IAAI,SAAS;QAAE,OAAO;IACtB,MAAM,IAAI,QAAQ,CAChB,uDAAuD,EACvD,2BAA2B,EAC3B,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC;AACzD,CAAC;AASD;;;;;;GAMG;AACH,KAAK,UAAU,aAAa,CAAC,MAAoB,EAAE,EAAU;IAC3D,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;IAE7D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAClB,IAAI,EAAE,4DAA4D;cAChE,yCAAyC,EAC3C,sBAAsB,CACvB,CAAC;IACJ,CAAC;IAED,6FAA6F;IAC7F,8FAA8F;IAC9F,wFAAwF;IACxF,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAE7C,CAAC;QACF,OAAO;YACL,QAAQ,EAAE,EAAE;YACZ,mFAAmF;YACnF,iEAAiE;YACjE,OAAO,EAAE,MAAM,CAAC,QAAQ,IAAI,SAAS;YACrC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,aAAa,CAAC;YAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC7E,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,SAAS,eAAe,CAAC,OAAqB;IAC5C,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,4BAA4B,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACrD,KAAK,CAAC,qBAAqB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7C,KAAK,CAAC,qBAAqB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO;QAAE,KAAK,CAAC,qBAAqB,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,SAAS;QAAE,KAAK,CAAC,qBAAqB,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACvE,IAAI,OAAO,CAAC,UAAU;QAAE,KAAK,CAAC,qBAAqB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,OAAO,EAAE,MAAM;QAAE,KAAK,CAAC,qBAAqB,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClF,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,6FAA6F;QAC7F,4FAA4F;QAC5F,KAAK,CAAC,oFAAoF,CAAC,CAAC;QAC5F,KAAK,CAAC,mDAAmD,CAAC,CAAC;QAC3D,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAEpG,KAAK;SACF,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAE/C,IAAI,WAAW,GAAG,CAAC,CAAC;QAEpB,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxD,WAAW,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpF,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;oBAClB,IAAI,CAAC,EAAE,CAAC,CAAC;oBACT,IAAI,CAAC,oCAAoC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC7D,CAAC;gBACD,OAAO;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;oBAAE,MAAM,GAAG,CAAC;gBACnC,WAAW,GAAI,GAAmB,CAAC,MAAM,CAAC;gBAC1C,IAAI,CAAC,UAAU,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBACnC,IAAI,CAAC,qCAAqC,WAAW,KAAK;0BACtD,kFAAkF,CAAC,CAAC;gBAC1F,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACnB,yFAAyF;YACzF,yFAAyF;YACzF,yEAAyE;YACzE,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,IAAI,QAAQ,CAChB,qCAAqC,WAAW,eAAe,MAAM,CAAC,OAAO,aAAa;sBACxF,sFAAsF;sBACtF,sFAAsF;sBACtF,8BAA8B,EAChC,2BAA2B;gBAC3B,0EAA0E;gBAC1E,IAAI,CAAC,MAAM,EACX,IAAI,CACL,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,QAAQ,CAChB,MAAM,CAAC,QAAQ;gBACb,CAAC,CAAC,UAAU,MAAM,CAAC,QAAQ,QAAQ,MAAM,CAAC,MAAM,IAAI,SAAS,gCAAgC;sBACzF,iFAAiF;sBACjF,oBAAoB,MAAM,CAAC,QAAQ,SAAS;gBAChD,CAAC,CAAC,qBAAqB,EAAE,GAAG,EAC9B,oBAAoB,EACpB,IAAI,CAAC,MAAM,CACZ,CAAC;QACJ,CAAC;QAED,2FAA2F;QAC3F,+EAA+E;QAC/E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAE1D,4FAA4F;QAC5F,6FAA6F;QAC7F,0FAA0F;QAC1F,0BAA0B;QAC1B,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC;gBACV,MAAM,EAAE,oBAAoB;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;gBAChC,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI;gBACpC,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI;gBACtC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,IAAI;aACjC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,eAAe,CAAC,OAAO,CAAC,CAAC;QACzB,IAAI,CAAC,6CAA6C,EAAE,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,0DAA0D,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,cAAc,EAAE,gDAAgD,CAAC;SACxE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAsB,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACtF,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,QAAQ,CAChB,qCAAsC,GAAmB,CAAC,MAAM,0BAA0B;sBACxF,qFAAqF;sBACrF,kEAAkE,OAAO,EAAE,EAC7E,2BAA2B,EAC3B,IAAI,CAAC,MAAM,CACZ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QAEH,qFAAqF;QACrF,qEAAqE;QACrE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,WAAW,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAE1B,WAAW,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC;QACxF,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,gFAAgF,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,oCAAoC,CAAC;SACjD,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;YACzE,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,QAAQ,CAChB,qCAAsC,GAAmB,CAAC,MAAM,0BAA0B;sBACxF,+CAA+C,EACjD,2BAA2B,EAC3B,IAAI,CAAC,MAAM,CACZ,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,WAAW,CAAC,OAAkC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEL,iGAAiG;IAEjG,KAAK;SACF,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,wDAAwD,CAAC;SACrE,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SAC7E,MAAM,CAAC,wBAAwB,EAAE,qBAAqB,EAAE,QAAQ,CAAC;SACjE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAA4C,EAAE,EAAE;QAC9E,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;YAC9C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QAEH,WAAW,CAAC,KAAgC,CAAC,CAAC;QAE9C,IAAI,UAAU,EAAE;YAAE,OAAO;QACzB,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,IAAI,KAAK,CAAC,GAAG;YAAE,KAAK,CAAC,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;aAClC,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,YAAY,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,gFAAgF;QAChF,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACvE,IAAI,KAAK,CAAC,UAAU;YAAE,KAAK,CAAC,aAAa,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,CAAC,yCAAyC,KAAK,CAAC,EAAE,IAAI,YAAY,EAAE,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,cAAc,EAAE,mDAAmD,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE;QACrD,8FAA8F;QAC9F,4FAA4F;QAC5F,6FAA6F;QAC7F,+EAA+E;QAC/E,EAAE;QACF,2FAA2F;QAC3F,4FAA4F;QAC5F,+BAA+B;QAC/B,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,WAAW,CAAC;gBACV,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;gBACxD,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG;aACpD,CAAC,CAAC;YACH,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;gBAClB,KAAK,CAAC,EAAE,CAAC,CAAC;gBACV,KAAK,CAAC,WAAW,MAAM,CAAC,QAAQ,eAAe,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;gBAC5D,KAAK,CAAC,uBAAuB,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;YACrD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,EAAE,GAAG,MAAM,EAAwC,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,4FAA4F;QAC5F,mBAAmB;QACnB,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,WAAW,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpC,KAAK,CAAC,kBAAkB,MAAM,CAAC,UAAU,aAAa,MAAM,CAAC,UAAU,WAAW,CAAC,CAAC;QACpF,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEL,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,2CAA2C,CAAC,CAAC;IAEhG,MAAM;SACH,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACpC,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;QAEhC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,WAAW,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,+DAA+D,CAAC,CAAC;YACtE,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YAC9B,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,GAAG;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,GAAG;YACzB,mFAAmF;YACnF,0DAA0D;YAC1D,KAAK,EAAE,KAAK,CAAC,UAAU;gBACrB,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACzF,KAAK,EAAE,KAAK,CAAC,UAAU,IAAI,CAAC;YAC5B,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,GAAG;SACpC,CAAC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,qDAAqD,CAAC;SAClE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACvD,WAAW,CAAC,MAAiC,CAAC,CAAC;QAC/C,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;YAClB,KAAK,CAAC,SAAS,OAAO,kEAAkE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,iGAAiG;IAEjG,KAAK;SACF,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,KAAK,EAAE,MAAc,EAAE,EAAE;QAC/B,iEAAiE;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC;QAEnD,IAAI,OAAO,GAAwB,IAAI,CAAC;QACxC,IAAI,MAAM,GAAmC,IAAI,CAAC;QAElD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC7B,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;YAC7E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,UAAU,CAClB,kBAAkB,IAAI,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI;sBAC9F,4CAA4C,EAC9C,mBAAmB,CACpB,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;YACjF,IAAI,IAAI;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAwB,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAO,EAAE,MAAM,CAAC,CAAC;YACtD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,IAAI,QAAQ,CAChB,yBAAyB,MAAM,oCAAoC,EACnE,mBAAmB,EACnB,IAAI,CAAC,MAAM,CACZ,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,MAAM,MAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;QAEzE,MAAM,OAAO,GAAG;YACd,OAAO,EAAE;gBACP,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,iBAAiB;gBACpE,aAAa,EAAE,2DAA2D;gBAC1E,OAAO,EAAE,sDAAsD;aAChE;YACD,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,IAAI;YACnC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;YACxC,OAAO,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI;YACjC,WAAW,EAAE,KAAK;SACnB,CAAC;QAEF,wFAAwF;QACxF,2EAA2E;QAC3E,EAAE;QACF,2FAA2F;QAC3F,2FAA2F;QAC3F,0EAA0E;QAC1E,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,iBAAiB,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;QACT,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,kEAAkE,CAAC,CAAC;QAC1E,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,uBAAuB,SAAS,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,6DAA6D,EAAE,CAAC,CAAC;QAC9J,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC3F,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACpF,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACrF,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACxF,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,wFAAwF;QACxF,+DAA+D;QAC/D,KAAK,CAAC,yEAAyE,CAAC,CAAC;QACjF,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC9C,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAChG,KAAK,CAAC,mEAAmE,CAAC,CAAC;QAC3E,KAAK,CAAC,EAAE,CAAC,CAAC;QAEV,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/signup.d.ts

@@ -0,0 +1,14 @@
+import { Command } from 'commander';
+/**
+ * The device flow, exported so `certen init` can run it as its credential step rather than
+ * telling the user to go and run another command first. One flow, two entry points.
+ */
+export declare function runDeviceFlow(opts: {
+    browser: boolean;
+    keyring: boolean;
+    timeoutMs?: number;
+}): Promise<{
+    prefix: string;
+    orgId?: string;
+}>;
+export declare function registerSignupCommands(program: Command): void;