@certen.io/cli 0.7.2 → 0.8.0

package/README.md

@@ -1,232 +1,234 @@
-# `@certen.io/cli`
-
-The `certen` command line for the [CERTEN Gateway](https://gateway.kompendium.co/reference) —
-proof-gated cross-chain execution on Accumulate.
-
-**Docs: <https://docs.kompendium.co>** · **Portal: <https://gateway.kompendium.co/portal>**
-
-```bash
-npm install -g @certen.io/cli
-```
-
-## From nothing to a proof
-
-```bash
-certen login          # approve this machine once in the portal; the key arrives here
-certen init           # signing key, identity, funding — created and checked
-
-certen call --identity <id> --chain base-sepolia --to 0xYourContract \
-    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
-
-certen proof get <intent-id>   # the evidence, to hand to a counterparty
-```
-
-**You never copy an API key.** `certen login` uses the device authorization grant: it prints a
-short code, you approve that code in a portal session you already trust, and the CLI collects the
-key over its own channel. The secret is never displayed here and never passes through your
-clipboard or your shell history.
-
-`certen init` is idempotent. It creates only what is missing, records the identity id so a later
-run reuses it, waits until the identity can actually sign, and tells you if an abstract account
-needs gas before it can execute anything.
-
-Stuck at any point:
-
-```bash
-certen doctor         # names the one thing blocking you, and the command that fixes it
-```
-
-### If your gateway predates device authorization
-
-`certen login` will say so and point at the portal. Mint a key there and hand it over without
-putting it in your shell history:
-
-```bash
-certen auth login --api-key -   # reads the key from stdin
-```
-
-## Your key never leaves this machine
-
-`certen keys generate` creates an Ed25519 key, encrypts it with a passphrase (scrypt + AES-256-GCM),
-and writes it to `~/.certen/keys/<name>.json` with `0600` permissions. The CLI sends **signatures**
-to the gateway. It never sends a private key, and there is no code path that could.
-
-```bash
-certen keys generate --name dev          # prompts for a passphrase (confirmed)
-certen keys generate --name ci --no-passphrase   # unencrypted; file permissions only
-certen keys list                         # metadata only — never decrypts
-certen keys show dev
-certen keys verify dev                   # proves the key decrypts and signs correctly
-certen keys sign --name dev --hash <hex> # print a signature, send nothing
-certen keys delete dev --yes
-certen keys path
-```
-
-Set `CERTEN_KEY_PASSPHRASE` to skip the prompt in CI. When it is set and there is no TTY, the CLI
-uses it; when neither is available it fails with an explanation rather than hanging on a prompt
-nobody can see.
-
-**`certen keys sign` sends nothing anywhere.** It is the air-gapped path: generate on one machine,
-carry the hash to it, carry the signature back.
-
-## Proof-gated contract calls
-
-```bash
-certen call --identity <uuid> --chain base-sepolia --to 0xTarget \
-    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
-```
-
-`--fn` takes a Solidity signature and `--arg` repeats positionally. Arguments are checked against
-the signature **before** anything is sent — on a proof-gated call, a valid proof of the *wrong*
-call is still a valid proof, so a mis-encoded argument is worse than an error.
-
-The ADI URL, the abstract account (`msg.sender` on chain) and the numeric chain id are all derived
-from the identity. You do not supply them, and you should not need to know that omitting them
-produces a bodyless 502.
-
-`--dry-run` prints the intent that would be sent without sending it — also the starting point if
-you need a multi-leg intent, which you then pass to `tx create --intent @file.json`.
-
-## Transfers
-
-```bash
-certen tx create --identity <uuid> --to-chain ethereum-sepolia \
-  --from 0xYourAbstractAccount --to 0xRecipient --amount 0.001 --sign-with dev --wait
-```
-
-**`--amount` is in WHOLE UNITS.** `1` means one ETH, `0.5` means half. This is the field most
-worth reading twice: the gateway documented it as wei until 2026-08-11, and someone sending `1`
-meaning one wei moves a whole ETH — which on a funded account succeeds silently.
-
-`--from` is the identity's abstract account on the source chain; `certen portfolio` shows it.
-
-If that account has no gas, the CLI refuses before submitting. That refusal is worth having: an
-intent from an empty abstract account is accepted, signed and submitted — every step reports
-success — and then parks at `anchoring` forever, because the execution leg cannot run on chain.
-`--force` overrides it.
-
-Or drive the steps yourself — useful when the signer is an HSM, another machine, or your own
-policy engine:
-
-```bash
-certen tx create --identity <uuid> ...          # returns signing_data.hash_to_sign
-certen keys sign --name dev --hash <hash>       # or your HSM
-certen tx sign <intent-id> --signature <sig> --public-key <pub>
-```
-
-`--signature`/`--public-key` remain first-class. `--sign-with` is a convenience, not a replacement.
-
-## Proofs
-
-```bash
-certen proof get <intent-id>        # also accepts a proof id or a transaction hash
-certen proof bundle <proof-id>      # the artifact to hand over
-certen proof share <proof-id>       # a link a counterparty opens without a key of yours
-certen proof verify <intent-id>     # what was, and was NOT, verified
-```
-
-`proof verify` reports three separate judgements — inclusion, authorization, outcome — and it can
-establish only the first, and only as something the gateway asserted. It says so. Asking the
-gateway is not independent verification; to verify without trusting CERTEN, query an Accumulate
-node for the receipt and read the execution on the destination chain.
-
-`proof get` falls back to the Accumulate merkle receipt when the proof-service is unavailable or
-when an intent has no `proof_id` — the normal case for governance and authorization transactions.
-A 5xx from the proof-service means that service is down, **not** that your proof is missing.
-
-## Multi-party approvals
-
-```bash
-certen pending list
-certen pending sign <id> --identity <adi> --vote approve
-certen pending submit <request-id> --sign-with dev --hash <hash>
-```
-
-`--vote` takes `approve`, `reject`, or `abstain` — lowercase strings. Not `accept`, and not a
-number.
-
-## Everything else
-
-```bash
-certen chains                                    # what CERTEN is deployed on (no API key needed)
-certen whoami                                    # which key, which gateway, what standing
-certen identity get <id> | list | link-chain <id> --chain <chain> | retire <id> --yes
-certen portfolio                                 # balances across every identity and chain
-certen tx status <id> --wait | tx list
-certen pricing                                   # everything CERTEN charges for, in one call
-certen balance | quote --chain <chain> [--sku <sku>] | fund <amount> --chain <chain>
-certen governance add-delegate | set-threshold
-certen admin api-keys list | create | rotate | revoke
-certen admin audit-log | usage
-```
-
-Run `certen <group> --help` for the flags on any of them, or `certen --help` for the whole tree
-grouped by where you are in the journey.
-
-## Chains
-
-This CLI targets `ethereum-sepolia`, `base-sepolia` and `arbitrum-sepolia`. A chain outside that
-set is refused with the reason — and if the gateway genuinely serves it, the refusal says so
-rather than claiming it does not exist. `CERTEN_ALLOW_ANY_CHAIN=1` lifts the restriction.
-
-## Scripting and AI agents: `--json`
-
-`--json` turns the CLI into a machine interface. It is a contract, documented in full in
-[docs/CLI-CONTRACT.md](../../docs/CLI-CONTRACT.md) and enforced by a conformance suite.
-
-```bash
-certen --json tx status <id>
-# {"ok":true,"data":{"intent_id":"…","status":"completed"}}
-
-certen --json portfolio
-# {"ok":false,"error":{"code":"NETWORK_ERROR","message":"connect ECONNREFUSED","retryable":true,"status":0}}
-```
-
-- **Exactly one JSON object on stdout**, nothing else. Every human-facing line goes to stderr.
-- **Exit codes:** `0` ok · `1` operation failed · `2` usage error · `3` gateway unreachable. Branch on
-  these instead of parsing text. `3` guarantees nothing was submitted, so a retry cannot
-  double-execute.
-- **`error.retryable`** comes from the SDK's own `CertenError.isRetryable`, so the CLI and the SDK
-  give an identical retry decision.
-- **`certen --help --json`** returns the entire command tree — every command, flag and exit code — in
-  one call.
-
-Without `--json`, output is the human table format as before. Do not parse it.
-
-## Configuration
-
-| | |
-|---|---|
-| `CERTEN_API_KEY` | API key. Always wins, so CI never touches the keyring or config file. |
-| `CERTEN_API_URL` | Gateway base URL. Defaults to `https://gateway.kompendium.co`. |
-| `CERTEN_KEY_PASSPHRASE` | Passphrase for local signing keys. |
-
-`certen auth login` stores the API key in your OS keyring by default, or in
-`~/.certen/config.json` at `0600` with `--no-keyring`.
-
-## Things that will bite you
-
-**Identity creation is asynchronous.** `identity create` returns `202` and provisioning continues.
-Poll until the status is terminal, and check `can_sign` — it derives from the on-chain key page, so
-it can read `true` while the status is still `creating`.
-
-**A proof cycle takes 60–110 seconds.** Real validator work, not a tunable delay. Do not wrap it in
-a 30-second timeout.
-
-**Sign the bytes, not the text.** If you are producing signatures outside this CLI: sign the raw
-bytes of the hash, do not hash it again, and do not sign the ASCII of the hex string. All three
-mistakes produce a well-formed 128-hex signature the gateway rejects. `certen keys sign` handles
-this for you.
-
-## Documentation
-
-**<https://docs.kompendium.co>** — getting started, authentication, errors, idempotency, and
-task-shaped guides: onboarding an identity, external signing, proof-gating a contract call, M-of-N
-panels, and verifying a proof.
-
-The [live API reference](https://gateway.kompendium.co/reference) is generated from the running
-gateway and is authoritative — when a guide and the spec disagree, the spec is right.
-
-## License
-
-MIT
+# `@certen.io/cli`
+
+The `certen` command line for the [CERTEN Gateway](https://gateway.kompendium.co/reference) —
+proof-gated cross-chain execution on Accumulate.
+
+**Docs: <https://docs.kompendium.co>** · **Portal: <https://gateway.kompendium.co/portal>**
+
+```bash
+npm install -g @certen.io/cli
+```
+
+## From nothing to a proof
+
+```bash
+certen login          # approve this machine once in the portal; the key arrives here
+certen init           # signing key, identity, funding — created and checked
+
+certen call --identity <id> --chain base-sepolia --to 0xYourContract \
+    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
+
+certen proof get <intent-id>   # the evidence, to hand to a counterparty
+```
+
+**You never copy an API key.** `certen login` uses the device authorization grant: it prints a
+short code, you approve that code in a portal session you already trust, and the CLI collects the
+key over its own channel. The secret is never displayed here and never passes through your
+clipboard or your shell history.
+
+`certen init` is idempotent. It creates only what is missing, records the identity id so a later
+run reuses it, waits until the identity can actually sign, and tells you if an abstract account
+needs gas before it can execute anything.
+
+Stuck at any point:
+
+```bash
+certen doctor         # names the one thing blocking you, and the command that fixes it
+```
+
+### If your gateway predates device authorization
+
+`certen login` will say so and point at the portal. Mint a key there and hand it over without
+putting it in your shell history:
+
+```bash
+certen auth login --api-key -   # reads the key from stdin
+```
+
+## Your key never leaves this machine
+
+`certen keys generate` creates an Ed25519 key, encrypts it with a passphrase (scrypt + AES-256-GCM),
+and writes it to `~/.certen/keys/<name>.json` with `0600` permissions. The CLI sends **signatures**
+to the gateway. It never sends a private key, and there is no code path that could.
+
+```bash
+certen keys generate --name dev          # prompts for a passphrase (confirmed)
+certen keys generate --name ci --no-passphrase   # unencrypted; file permissions only
+certen keys list                         # metadata only — never decrypts
+certen keys show dev
+certen keys verify dev                   # proves the key decrypts and signs correctly
+certen keys sign --name dev --hash <hex> # print a signature, send nothing
+certen keys delete dev --yes
+certen keys path
+```
+
+Set `CERTEN_KEY_PASSPHRASE` to skip the prompt in CI. When it is set and there is no TTY, the CLI
+uses it; when neither is available it fails with an explanation rather than hanging on a prompt
+nobody can see.
+
+**`certen keys sign` sends nothing anywhere.** It is the air-gapped path: generate on one machine,
+carry the hash to it, carry the signature back.
+
+## Proof-gated contract calls
+
+```bash
+certen call --identity <uuid> --chain base-sepolia --to 0xTarget \
+    --fn 'confirm(bytes32)' --arg 0x… --sign-with dev --wait
+```
+
+`--fn` takes a Solidity signature and `--arg` repeats positionally. Arguments are checked against
+the signature **before** anything is sent — on a proof-gated call, a valid proof of the *wrong*
+call is still a valid proof, so a mis-encoded argument is worse than an error.
+
+The ADI URL, the abstract account (`msg.sender` on chain) and the numeric chain id are all derived
+from the identity. You do not supply them, and you should not need to know that omitting them
+produces a bodyless 502.
+
+`--dry-run` prints the intent that would be sent without sending it — also the starting point if
+you need a multi-leg intent, which you then pass to `tx create --intent @file.json`.
+
+## Transfers
+
+```bash
+certen tx create --identity <uuid> --to-chain ethereum-sepolia \
+  --from 0xYourAbstractAccount --to 0xRecipient --amount 0.001 --sign-with dev --wait
+```
+
+**`--amount` is in WHOLE UNITS.** `1` means one ETH, `0.5` means half. This is the field most
+worth reading twice: the gateway documented it as wei until 2026-08-11, and someone sending `1`
+meaning one wei moves a whole ETH — which on a funded account succeeds silently.
+
+`--from` is the identity's abstract account on the source chain; `certen portfolio` shows it.
+
+If that account has no gas, the CLI refuses before submitting. That refusal is worth having: an
+intent from an empty abstract account is accepted, signed and submitted — every step reports
+success — and then parks at `anchoring` forever, because the execution leg cannot run on chain.
+`--force` overrides it.
+
+Or drive the steps yourself — useful when the signer is an HSM, another machine, or your own
+policy engine:
+
+```bash
+certen tx create --identity <uuid> ...          # returns signing_data.hash_to_sign
+certen keys sign --name dev --hash <hash>       # or your HSM
+certen tx sign <intent-id> --signature <sig> --public-key <pub>
+```
+
+`--signature`/`--public-key` remain first-class. `--sign-with` is a convenience, not a replacement.
+
+## Proofs
+
+```bash
+certen proof get <intent-id>        # also accepts a proof id or a transaction hash
+certen proof bundle <proof-id>      # the artifact to hand over
+certen proof share <proof-id>       # a link a counterparty opens without a key of yours
+certen proof verify <intent-id>     # what was, and was NOT, verified
+```
+
+`proof verify` reports three separate judgements — inclusion, authorization, outcome — and it can
+establish only the first, and only as something the gateway asserted. It says so. Asking the
+gateway is not independent verification; to verify without trusting CERTEN, query an Accumulate
+node for the receipt and read the execution on the destination chain.
+
+`proof get` falls back to the Accumulate merkle receipt when the proof-service is unavailable or
+when an intent has no `proof_id` — the normal case for governance and authorization transactions.
+A 5xx from the proof-service means that service is down, **not** that your proof is missing.
+
+## Multi-party approvals
+
+```bash
+certen pending list
+certen pending sign <id> --identity <adi> --vote approve
+certen pending submit <request-id> --sign-with dev --hash <hash>
+```
+
+`--vote` takes `approve`, `reject`, or `abstain` — lowercase strings. Not `accept`, and not a
+number.
+
+## Everything else
+
+```bash
+certen chains                                    # what CERTEN is deployed on (no API key needed)
+certen whoami                                    # which key, which gateway, what standing
+certen identity get <id> | list | link-chain <id> --chain <chain> | retire <id> --yes
+certen portfolio                                 # balances across every identity and chain
+certen tx status <id> --wait | tx list
+certen pricing                                   # everything CERTEN charges for, in one call
+certen balance | quote --chain <chain> [--sku <sku>] | fund <amount> --chain <chain>
+certen governance add-key | remove-key | set-threshold | add-authority | remove-authority | add-delegate | sign
+                                                 # --sign-with <key> signs and submits in one step; add-authority is how
+                                                 # a policy signer becomes a required co-signer on an agent
+certen admin api-keys list | create | rotate | revoke
+certen admin audit-log | usage
+```
+
+Run `certen <group> --help` for the flags on any of them, or `certen --help` for the whole tree
+grouped by where you are in the journey.
+
+## Chains
+
+This CLI targets `ethereum-sepolia`, `base-sepolia` and `arbitrum-sepolia`. A chain outside that
+set is refused with the reason — and if the gateway genuinely serves it, the refusal says so
+rather than claiming it does not exist. `CERTEN_ALLOW_ANY_CHAIN=1` lifts the restriction.
+
+## Scripting and AI agents: `--json`
+
+`--json` turns the CLI into a machine interface. It is a contract, documented in full in
+[docs/CLI-CONTRACT.md](../../docs/CLI-CONTRACT.md) and enforced by a conformance suite.
+
+```bash
+certen --json tx status <id>
+# {"ok":true,"data":{"intent_id":"…","status":"completed"}}
+
+certen --json portfolio
+# {"ok":false,"error":{"code":"NETWORK_ERROR","message":"connect ECONNREFUSED","retryable":true,"status":0}}
+```
+
+- **Exactly one JSON object on stdout**, nothing else. Every human-facing line goes to stderr.
+- **Exit codes:** `0` ok · `1` operation failed · `2` usage error · `3` gateway unreachable. Branch on
+  these instead of parsing text. `3` guarantees nothing was submitted, so a retry cannot
+  double-execute.
+- **`error.retryable`** comes from the SDK's own `CertenError.isRetryable`, so the CLI and the SDK
+  give an identical retry decision.
+- **`certen --help --json`** returns the entire command tree — every command, flag and exit code — in
+  one call.
+
+Without `--json`, output is the human table format as before. Do not parse it.
+
+## Configuration
+
+| | |
+|---|---|
+| `CERTEN_API_KEY` | API key. Always wins, so CI never touches the keyring or config file. |
+| `CERTEN_API_URL` | Gateway base URL. Defaults to `https://gateway.kompendium.co`. |
+| `CERTEN_KEY_PASSPHRASE` | Passphrase for local signing keys. |
+
+`certen auth login` stores the API key in your OS keyring by default, or in
+`~/.certen/config.json` at `0600` with `--no-keyring`.
+
+## Things that will bite you
+
+**Identity creation is asynchronous.** `identity create` returns `202` and provisioning continues.
+Poll until the status is terminal, and check `can_sign` — it derives from the on-chain key page, so
+it can read `true` while the status is still `creating`.
+
+**A proof cycle takes 60–110 seconds.** Real validator work, not a tunable delay. Do not wrap it in
+a 30-second timeout.
+
+**Sign the bytes, not the text.** If you are producing signatures outside this CLI: sign the raw
+bytes of the hash, do not hash it again, and do not sign the ASCII of the hex string. All three
+mistakes produce a well-formed 128-hex signature the gateway rejects. `certen keys sign` handles
+this for you.
+
+## Documentation
+
+**<https://docs.kompendium.co>** — getting started, authentication, errors, idempotency, and
+task-shaped guides: onboarding an identity, external signing, proof-gating a contract call, M-of-N
+panels, and verifying a proof.
+
+The [live API reference](https://gateway.kompendium.co/reference) is generated from the running
+gateway and is authoritative — when a guide and the spec disagree, the spec is right.
+
+## License
+
+MIT

package/dist/commands/chains.js

@@ -116,8 +116,8 @@ export function registerChainsCommands(program) {
         hint('');
         hint('Detail for one: certen chains base-sepolia');
     });
-    chains.addHelpText('after', `
-Registry version and Accumulate network are included in --json output.
+    chains.addHelpText('after', `
+Registry version and Accumulate network are included in --json output.
 This command needs no API key, so it also answers "is the gateway up".`);
 }
 //# sourceMappingURL=chains.js.map

package/dist/commands/governance.js

@@ -1,36 +1,106 @@
 import { CertenClient } from '@certen.io/sdk';
 import { getApiKey, getApiUrl } from '../config.js';
-import { printOutput } from '../output.js';
+import { printOutput, hint } from '../output.js';
+import { resolveSigner } from '../signer.js';
 async function getClient() {
     return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
 }
+/**
+ * Every governance operation is the same two steps: the gateway builds the Accumulate transaction
+ * and returns `signing_data.hash_to_sign`; a key that is ON THE PAGE signs it and the signature is
+ * submitted. Without `--sign-with` the first step happens and the hash is printed for an external
+ * signer, which is how an HSM or the policy signer participates. With it, both steps happen here.
+ */
+async function submitGovernance(operation, opts) {
+    const client = await getClient();
+    const signer = opts.signWith ? await resolveSigner(opts.signWith) : null;
+    const created = await client.governance.create({
+        identity: opts.identity,
+        operations: [operation],
+        signerKeyPage: opts.signerKeyPage,
+        signerPublicKey: signer?.publicKey,
+    });
+    const hash = created.signing_data?.hash_to_sign;
+    if (!signer || !hash) {
+        printOutput(created);
+        if (hash) {
+            hint('');
+            hint(`Sign signing_data.hash_to_sign with a key on the page, then: certen governance sign ${created.governance_op_id} --signature <hex> --public-key <hex>`);
+        }
+        return;
+    }
+    const submitted = await client.governance.submitSignature(created.governance_op_id, {
+        signature: signer.sign(hash),
+        publicKey: signer.publicKey,
+    });
+    printOutput({ ...created, ...submitted });
+}
 export function registerGovernanceCommands(program) {
-    const governance = program.command('governance').description('Governance operations');
-    governance
-        .command('add-delegate')
-        // `--identity` is the ADI (acc://org.acme), not a uuid — the governance endpoint keys on the ADI.
-        .description('Add a delegate to an identity key book')
+    const governance = program.command('governance').description('Who may sign for an identity, and under what rules');
+    const signing = (cmd) => cmd
+        .option('--sign-with <key>', 'Local key on the page: sign the returned hash and submit it in one step')
+        .option('--signer-key-page <url>', 'Sign with a specific page of the book, e.g. acc://org.acme/book/2');
+    signing(governance
+        .command('add-key')
+        .description('Seat another key on the identity\'s key page — a co-signer, a human, a second agent')
         .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
-        .requiredOption('--delegate-url <url>', 'Delegate URL to add')
+        .requiredOption('--public-key-hash <hex>', 'sha256 of the new key\'s raw public key, 64 hex (certen keys list shows it)'))
         .action(async (opts) => {
-        const client = await getClient();
-        const result = await client.governance.create({
-            identity: opts.identity,
-            operations: [{ type: 'add_delegate', delegate_url: opts.delegateUrl }],
-        });
-        printOutput(result);
+        await submitGovernance({ type: 'add_key', public_key_hash: opts.publicKeyHash }, opts);
     });
-    governance
+    signing(governance
+        .command('remove-key')
+        .description('Remove a seat from the identity\'s key page')
+        .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
+        .requiredOption('--public-key-hash <hex>', 'sha256 of the key to remove, 64 hex'))
+        .action(async (opts) => {
+        await submitGovernance({ type: 'remove_key', public_key_hash: opts.publicKeyHash }, opts);
+    });
+    signing(governance
         .command('set-threshold')
         .description('Set the M-of-N acceptThreshold on an identity key page')
         .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
-        .requiredOption('--threshold <n>', 'New threshold', parseInt)
+        .requiredOption('--threshold <n>', 'New threshold', parseInt))
         .action(async (opts) => {
+        await submitGovernance({ type: 'set_threshold', threshold: opts.threshold }, opts);
+    });
+    signing(governance
+        .command('add-authority')
+        .description('Name a key book as a REQUIRED authority: every transaction then waits for it to sign too — how a policy signer regulates an agent')
+        .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
+        .requiredOption('--authority <book-url>', 'The key book that must co-sign, e.g. acc://owner-policy.acme/book'))
+        .action(async (opts) => {
+        await submitGovernance({ type: 'add_authority', authority_url: opts.authority }, opts);
+    });
+    signing(governance
+        .command('remove-authority')
+        .description('Release a required authority')
+        .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
+        .requiredOption('--authority <book-url>', 'The key book to release'))
+        .action(async (opts) => {
+        await submitGovernance({ type: 'remove_authority', authority_url: opts.authority }, opts);
+    });
+    signing(governance
+        .command('add-delegate')
+        // `--identity` is the ADI (acc://org.acme), not a uuid — the governance endpoint keys on the ADI.
+        .description('Add a delegate to an identity key book')
+        .requiredOption('--identity <adi>', 'Identity ADI, e.g. acc://org.acme')
+        .requiredOption('--delegate-url <url>', 'Delegate URL to add'))
+        .action(async (opts) => {
+        await submitGovernance({ type: 'add_delegate', delegate_url: opts.delegateUrl }, opts);
+    });
+    governance
+        .command('sign <governance-op-id>')
+        .description('Submit a signature for a governance operation created without --sign-with')
+        .option('--sign-with <key>', 'Local key to sign with (needs --hash)')
+        .option('--hash <hex>', 'The operation\'s signing_data.hash_to_sign')
+        .option('--signature <hex>', 'A signature produced elsewhere (with --public-key)')
+        .option('--public-key <hex>', 'The signing key\'s public key, 64 hex')
+        .action(async (id, opts) => {
+        const { resolveSignature } = await import('../signer.js');
+        const { signature, publicKey } = await resolveSignature(opts);
         const client = await getClient();
-        const result = await client.governance.create({
-            identity: opts.identity,
-            operations: [{ type: 'set_threshold', threshold: opts.threshold }],
-        });
+        const result = await client.governance.submitSignature(id, { signature, publicKey });
         printOutput(result);
     });
 }

package/dist/commands/governance.js.map

@@ -1 +1 @@
-{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/commands/governance.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,uBAAuB,CAAC,CAAC;IAEtF,UAAU;SACP,OAAO,CAAC,cAAc,CAAC;QACxB,kGAAkG;SACjG,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,sBAAsB,EAAE,qBAAqB,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;SACvE,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,UAAU;SACP,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,wDAAwD,CAAC;SACrE,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,iBAAiB,EAAE,eAAe,EAAE,QAAQ,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5C,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;SACnE,CAAC,CAAC;QACH,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../../src/commands/governance.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAC7B,SAAkC,EAClC,IAAqE;IAErE,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,eAAe,EAAE,MAAM,EAAE,SAAS;KACnC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC;IAChD,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,WAAW,CAAC,OAA6C,CAAC,CAAC;QAC3D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,EAAE,CAAC,CAAC;YACT,IAAI,CAAC,uFAAuF,OAAO,CAAC,gBAAgB,uCAAuC,CAAC,CAAC;QAC/J,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,OAAO,CAAC,gBAAgB,EAAE;QAClF,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,GAAG,SAAS,EAAwC,CAAC,CAAC;AAClF,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,oDAAoD,CAAC,CAAC;IAEnH,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,GAAG;SAClC,MAAM,CAAC,mBAAmB,EAAE,yEAAyE,CAAC;SACtG,MAAM,CAAC,yBAAyB,EAAE,mEAAmE,CAAC,CAAC;IAE1G,OAAO,CAAC,UAAU;SACf,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qFAAqF,CAAC;SAClG,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,yBAAyB,EAAE,6EAA6E,CAAC,CAAC;SACzH,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,UAAU;SACf,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,6CAA6C,CAAC;SAC1D,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,CAAC;SACjF,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,UAAU;SACf,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,wDAAwD,CAAC;SACrE,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,iBAAiB,EAAE,eAAe,EAAE,QAAQ,CAAC,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,UAAU;SACf,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,mIAAmI,CAAC;SAChJ,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,wBAAwB,EAAE,mEAAmE,CAAC,CAAC;SAC9G,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,UAAU;SACf,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,8BAA8B,CAAC;SAC3C,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,wBAAwB,EAAE,yBAAyB,CAAC,CAAC;SACpE,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;IAC5F,CAAC,CAAC,CAAC;IAEL,OAAO,CAAC,UAAU;SACf,OAAO,CAAC,cAAc,CAAC;QACxB,kGAAkG;SACjG,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,kBAAkB,EAAE,mCAAmC,CAAC;SACvE,cAAc,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,CAAC;SAC9D,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC,CAAC,CAAC;IAEL,UAAU;SACP,OAAO,CAAC,yBAAyB,CAAC;SAClC,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACpE,MAAM,CAAC,cAAc,EAAE,4CAA4C,CAAC;SACpE,MAAM,CAAC,mBAAmB,EAAE,oDAAoD,CAAC;SACjF,MAAM,CAAC,oBAAoB,EAAE,uCAAuC,CAAC;SACrE,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1D,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;QACrF,WAAW,CAAC,MAA4C,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;AACP,CAAC"}