@daski/pay 0.1.0

package/dist/signers/circle.js

@@ -0,0 +1,136 @@
+/**
+ * Circle Developer-Controlled Wallets — implemented for the EOA account type,
+ * wired into the conformance suite, and marked **candidate pending conformance**.
+ *
+ * The adapter is thin on purpose: resolve the wallet, refuse anything that is
+ * not an externally owned account, and forward typed-data signing to Circle's
+ * `signTypedData`. What Circle receives is exactly the `TypedDataRequest` the
+ * policy validator produced — domain, types, primaryType, message — as JSON.
+ * Nothing is added and nothing is rewritten on the way out, which is what the
+ * doctor self-test later checks by recovering the signer from that same data.
+ *
+ * Smart-contract accounts (SCA) are refused outright. They sign through
+ * ERC-1271, where the contract decides what a valid signature is, and the
+ * gateway verifies purchase authorizations by plain low-s ECDSA recovery of an
+ * EOA. No amount of adapter code turns one into the other, so the adapter says
+ * so instead of producing signatures the facilitator cannot verify.
+ *
+ * What is *not* yet established is that Circle's EOA signatures settle on the
+ * live gateway end to end — that is what `npm run conformance -- --signer
+ * circle` exists to answer, and until it passes `describe()` reports the
+ * candidate status so `doctor` can say so out loud.
+ *
+ * Credentials come from the environment only (`CIRCLE_API_KEY`,
+ * `CIRCLE_ENTITY_SECRET`): a flag would put them in the process list and the
+ * shell history. Neither is ever printed, logged, or sent to the gateway.
+ */
+import { getAddress, isAddress } from "viem";
+import { CliError } from "../cli/errors.js";
+const DOC = "https://github.com/daski-io/buyer/blob/main/docs/signers.md#circle";
+const SDK_PACKAGE = "@circle-fin/developer-controlled-wallets";
+export async function createCircleSigner(options = {}) {
+    const apiKey = process.env.CIRCLE_API_KEY;
+    const entitySecret = process.env.CIRCLE_ENTITY_SECRET;
+    if (!apiKey || !entitySecret) {
+        throw new CliError({
+            code: "DASKI_CIRCLE_CREDENTIALS_UNSET",
+            message: "The Circle signer needs CIRCLE_API_KEY and CIRCLE_ENTITY_SECRET in the " +
+                "environment. They are never taken from a flag.",
+            remediation: `Export both from your Circle developer console, then re-run. See ${DOC}`,
+        });
+    }
+    const walletId = options.wallet ?? process.env.DASKI_CIRCLE_WALLET;
+    if (!walletId) {
+        throw new CliError({
+            code: "DASKI_CIRCLE_WALLET_UNSET",
+            message: "The Circle signer needs a wallet id.",
+            remediation: `Set DASKI_CIRCLE_WALLET, or pass --circle-wallet <id>. See ${DOC}`,
+        });
+    }
+    const sdk = await loadSdk(options.sdk);
+    const client = sdk.initiateDeveloperControlledWalletsClient({ apiKey, entitySecret });
+    const wallet = (await client.getWallet({ id: walletId })).data?.wallet;
+    if (!wallet || typeof wallet.address !== "string") {
+        throw new CliError({
+            code: "DASKI_CIRCLE_WALLET_NOT_FOUND",
+            message: `Circle returned no wallet for id ${walletId}.`,
+            remediation: `Check the id in your Circle console, or pass another --circle-wallet <id>. See ${DOC}`,
+        });
+    }
+    if (wallet.accountType !== "EOA") {
+        throw new CliError({
+            code: "DASKI_CIRCLE_SCA_UNSUPPORTED",
+            message: `Circle wallet ${walletId} is a ${wallet.accountType} account. Smart-contract ` +
+                "accounts sign through ERC-1271, where the contract decides what a valid " +
+                "signature is; the gateway verifies purchase authorizations by plain low-s " +
+                "ECDSA recovery of an EOA, which cannot verify them.",
+            remediation: "Use a Circle wallet created with accountType EOA and pass its id with " +
+                `--circle-wallet <id>. See ${DOC}`,
+        });
+    }
+    if (!isAddress(wallet.address, { strict: false })) {
+        throw new CliError({
+            code: "DASKI_CIRCLE_WALLET_NOT_EVM",
+            message: `Circle wallet ${walletId} is on ${wallet.blockchain ?? "an unknown blockchain"} ` +
+                "and has no EVM address.",
+            remediation: "Pass the id of an EVM wallet (for the sandbox: BASE-SEPOLIA or EVM-TESTNET). " +
+                `See ${DOC}`,
+        });
+    }
+    const address = getAddress(wallet.address);
+    return {
+        getAddress: async () => address,
+        signTypedData: async (payload) => {
+            const response = await client.signTypedData({
+                walletId,
+                data: serializeTypedData(payload),
+                memo: `daski: ${payload.primaryType} on eip155:${payload.domain.chainId}`,
+            });
+            const signature = response.data?.signature;
+            if (typeof signature !== "string") {
+                throw new CliError({
+                    code: "DASKI_CIRCLE_SIGNATURE_MISSING",
+                    message: "Circle answered the signing request without a signature.",
+                    remediation: `Check the wallet's state in your Circle console and re-run. See ${DOC}`,
+                });
+            }
+            return signature;
+        },
+        describe: () => ({
+            provider: "circle",
+            accountType: "eoa",
+            conformance: "candidate-pending-conformance",
+        }),
+    };
+}
+/**
+ * Exactly the request the validator produced — domain, types, primaryType,
+ * message — as the JSON string Circle's `signTypedData` takes. `uint256`
+ * values arrive as bigints, which JSON cannot carry, so they go out as decimal
+ * strings: the same wire form the authorization itself uses. `EIP712Domain` is
+ * not added to `types`; it is derived from `domain`, as the validator does.
+ */
+export function serializeTypedData(payload) {
+    const { domain, types, primaryType, message } = payload;
+    return JSON.stringify({ domain, types, primaryType, message }, (_key, value) => (typeof value === "bigint" ? value.toString() : value));
+}
+/**
+ * `@circle-fin/developer-controlled-wallets` is not a dependency of this
+ * package: installing it is the operator's choice, and the local signer must
+ * not carry its weight.
+ */
+async function loadSdk(sdk) {
+    if (sdk && typeof sdk !== "function")
+        return sdk;
+    try {
+        return sdk ? await sdk() : (await import(SDK_PACKAGE));
+    }
+    catch {
+        throw new CliError({
+            code: "DASKI_CIRCLE_SDK_MISSING",
+            message: `The Circle signer requires ${SDK_PACKAGE}, which is not installed.`,
+            remediation: `Run: npm install ${SDK_PACKAGE} — then see ${DOC}`,
+        });
+    }
+}
+//# sourceMappingURL=circle.js.map

package/dist/signers/circle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"circle.js","sourceRoot":"","sources":["../../src/signers/circle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAA0B,MAAM,MAAM,CAAC;AAErE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,GAAG,GAAG,oEAAoE,CAAC;AACjF,MAAM,WAAW,GAAG,0CAA0C,CAAC;AAoC/D,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAA+B,EAAE;IACxE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC1C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;IACtD,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,gCAAgC;YACtC,OAAO,EACL,yEAAyE;gBACzE,gDAAgD;YAClD,WAAW,EAAE,oEAAoE,GAAG,EAAE;SACvF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,sCAAsC;YAC/C,WAAW,EAAE,8DAA8D,GAAG,EAAE;SACjF,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,GAAG,CAAC,wCAAwC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;IACvE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,oCAAoC,QAAQ,GAAG;YACxD,WAAW,EAAE,kFAAkF,GAAG,EAAE;SACrG,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QACjC,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EACL,iBAAiB,QAAQ,SAAS,MAAM,CAAC,WAAW,2BAA2B;gBAC/E,0EAA0E;gBAC1E,4EAA4E;gBAC5E,qDAAqD;YACvD,WAAW,EACT,wEAAwE;gBACxE,6BAA6B,GAAG,EAAE;SACrC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,6BAA6B;YACnC,OAAO,EACL,iBAAiB,QAAQ,UAAU,MAAM,CAAC,UAAU,IAAI,uBAAuB,GAAG;gBAClF,yBAAyB;YAC3B,WAAW,EACT,+EAA+E;gBAC/E,OAAO,GAAG,EAAE;SACf,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC3C,OAAO;QACL,UAAU,EAAE,KAAK,IAAsB,EAAE,CAAC,OAAO;QACjD,aAAa,EAAE,KAAK,EAAE,OAAyB,EAAgB,EAAE;YAC/D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;gBAC1C,QAAQ;gBACR,IAAI,EAAE,kBAAkB,CAAC,OAAO,CAAC;gBACjC,IAAI,EAAE,UAAU,OAAO,CAAC,WAAW,cAAc,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE;aAC1E,CAAC,CAAC;YACH,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;YAC3C,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;gBAClC,MAAM,IAAI,QAAQ,CAAC;oBACjB,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,0DAA0D;oBACnE,WAAW,EAAE,mEAAmE,GAAG,EAAE;iBACtF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,SAAgB,CAAC;QAC1B,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;YACf,QAAQ,EAAE,QAAQ;YAClB,WAAW,EAAE,KAAK;YAClB,WAAW,EAAE,+BAA+B;SAC7C,CAAC;KACH,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACxD,OAAO,IAAI,CAAC,SAAS,CACnB,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EACvC,CAAC,IAAI,EAAE,KAAc,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CACjF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,OAAO,CACpB,GAA6D;IAE7D,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,UAAU;QAAE,OAAO,GAAG,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAqB,CAAC,CAAiB,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC;YACjB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,8BAA8B,WAAW,2BAA2B;YAC7E,WAAW,EAAE,oBAAoB,WAAW,eAAe,GAAG,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/signers/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Signer selection.
+ *
+ * Three adapters behind one interface: `local` (a viem account from the key
+ * store, verified by the conformance suite), and `cdp` and `circle`
+ * (candidates pending conformance). Whatever the backend, the request it
+ * signs has already been through the §4 validator, and `daski doctor` puts
+ * every adapter through the same self-test before calling it usable.
+ */
+import type { SignerAdapter } from "@daski/x402-scheme";
+import type { SignerKind } from "../config.js";
+import { createCdpSigner } from "./cdp.js";
+import { createCircleSigner } from "./circle.js";
+import { createLocalSigner } from "./local.js";
+export interface SignerSelection {
+    kind: SignerKind;
+    profile: string;
+    cdpAccount?: string | undefined;
+    circleWallet?: string | undefined;
+}
+export declare function createSigner(selection: SignerSelection): Promise<SignerAdapter>;
+export { createCdpSigner, createCircleSigner, createLocalSigner };
+//# sourceMappingURL=index.d.ts.map

package/dist/signers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/signers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,wBAAsB,YAAY,CAAC,SAAS,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC,CAerF;AAED,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/signers/index.js

@@ -0,0 +1,22 @@
+import { CliError } from "../cli/errors.js";
+import { createCdpSigner } from "./cdp.js";
+import { createCircleSigner } from "./circle.js";
+import { createLocalSigner } from "./local.js";
+export async function createSigner(selection) {
+    switch (selection.kind) {
+        case "local":
+            return createLocalSigner(selection.profile);
+        case "cdp":
+            return createCdpSigner({ account: selection.cdpAccount });
+        case "circle":
+            return createCircleSigner({ wallet: selection.circleWallet });
+        default:
+            throw new CliError({
+                code: "DASKI_SIGNER_UNKNOWN",
+                message: `Unknown signer "${String(selection.kind)}".`,
+                remediation: "Set profiles.<name>.signer to one of: local, cdp, circle.",
+            });
+    }
+}
+export { createCdpSigner, createCircleSigner, createLocalSigner };
+//# sourceMappingURL=index.js.map

package/dist/signers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/signers/index.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAS/C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,SAA0B;IAC3D,QAAQ,SAAS,CAAC,IAAI,EAAE,CAAC;QACvB,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9C,KAAK,KAAK;YACR,OAAO,eAAe,CAAC,EAAE,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5D,KAAK,QAAQ;YACX,OAAO,kBAAkB,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;QAChE;YACE,MAAM,IAAI,QAAQ,CAAC;gBACjB,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,mBAAmB,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI;gBACtD,WAAW,EAAE,2DAA2D;aACzE,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/signers/local.d.ts

@@ -0,0 +1,3 @@
+import type { SignerAdapter } from "@daski/x402-scheme";
+export declare function createLocalSigner(profile: string): Promise<SignerAdapter>;
+//# sourceMappingURL=local.d.ts.map

package/dist/signers/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/signers/local.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAuC,MAAM,oBAAoB,CAAC;AAG7F,wBAAsB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAc/E"}

package/dist/signers/local.js

@@ -0,0 +1,24 @@
+/**
+ * The local viem-account signer: the one adapter implemented in full.
+ *
+ * The key is held in this closure and never leaves it. `describe()` reports
+ * where it came from so `doctor` can flag the developer environment variable.
+ */
+import { privateKeyToAccount } from "viem/accounts";
+import {} from "viem";
+import { loadKey, locateKey } from "../store/keystore.js";
+export async function createLocalSigner(profile) {
+    const location = await locateKey(profile);
+    const account = privateKeyToAccount(await loadKey(profile));
+    const description = {
+        provider: location?.source === "environment" ? "local (env)" : "local",
+        accountType: "eoa",
+        conformance: "verified",
+    };
+    return {
+        getAddress: async () => account.address,
+        signTypedData: (payload) => account.signTypedData(payload),
+        describe: () => description,
+    };
+}
+//# sourceMappingURL=local.js.map

package/dist/signers/local.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/signers/local.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAA0B,MAAM,MAAM,CAAC;AAE9C,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe;IACrD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5D,MAAM,WAAW,GAAsB;QACrC,QAAQ,EAAE,QAAQ,EAAE,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO;QACtE,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,UAAU;KACxB,CAAC;IACF,OAAO;QACL,UAAU,EAAE,KAAK,IAAsB,EAAE,CAAC,OAAO,CAAC,OAAO;QACzD,aAAa,EAAE,CAAC,OAAyB,EAAgB,EAAE,CACzD,OAAO,CAAC,aAAa,CAAC,OAAgB,CAAC;QACzC,QAAQ,EAAE,GAAG,EAAE,CAAC,WAAW;KAC5B,CAAC;AACJ,CAAC"}

package/dist/signers/selfTest.d.ts

@@ -0,0 +1,46 @@
+/**
+ * The doctor's signer self-test.
+ *
+ * `daski doctor` does not take a signer's word for it. Before reporting one as
+ * usable it has the signer sign one fixed vector and checks the result the way
+ * the gateway will: the address recovered from the typed data must be the
+ * address the adapter claims, `s` must be in the low half of the curve order,
+ * and the whole thing must be 65 bytes. A signer that rewrites a field, wraps
+ * an ERC-1271 blob, emits a malleable twin, or simply throws fails here, on a
+ * machine with nothing at stake, instead of at settlement.
+ *
+ * The vector has the *shape* of a purchase — the closed 6-field
+ * `TransferWithAuthorization` type set, so an adapter that mishandles that
+ * exact structure is caught — but it can never be one: the domain is
+ * `DaskiDoctor` with a zero verifying contract, not any token's; the value
+ * and recipient are zero; the validity window is closed. No contract will
+ * ever accept it.
+ */
+import { type Address, type Hex } from "viem";
+import { type SignerAdapter, type TypedDataRequest } from "@daski/x402-scheme";
+/** The vector's nonce: a commitment to nothing but its own name. */
+export declare const SELF_TEST_NONCE: Hex;
+export declare const LOW_S_MAX: bigint;
+/**
+ * The fixed vector for one signer address and chain. Everything about it is
+ * pinned except the payer, which must be the signer under test so that a
+ * matching recovered address proves the signer signed *this* message,
+ * unchanged.
+ */
+export declare function selfTestVector(signerAddress: Address, chainId: number): TypedDataRequest;
+export interface SignerSelfTestResult {
+    passed: boolean;
+    /** The address the signature recovers to, or null when nothing recovers. */
+    recovered: Address | null;
+    /** True when `s` is at most secp256k1n/2. */
+    lowS: boolean;
+    /** Why the test failed. Absent on a pass. */
+    reason?: string;
+}
+/**
+ * Signs the vector with `signer` and checks the signature the way the gateway
+ * will. Never throws: a signer that throws has failed the test, and the reason
+ * says so.
+ */
+export declare function runSignerSelfTest(signer: SignerAdapter, chainId: number): Promise<SignerSelfTestResult>;
+//# sourceMappingURL=selfTest.d.ts.map

package/dist/signers/selfTest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfTest.d.ts","sourceRoot":"","sources":["../../src/signers/selfTest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAOL,KAAK,OAAO,EACZ,KAAK,GAAG,EACT,MAAM,MAAM,CAAC;AACd,OAAO,EAGL,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACtB,MAAM,oBAAoB,CAAC;AAI5B,oEAAoE;AACpE,eAAO,MAAM,eAAe,EAAE,GAAsD,CAAC;AAIrF,eAAO,MAAM,SAAS,QAAmB,CAAC;AAE1C;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,GAAG,gBAAgB,CAmBxF;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,6CAA6C;IAC7C,IAAI,EAAE,OAAO,CAAC;IACd,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,aAAa,EACrB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,oBAAoB,CAAC,CA+C/B"}

package/dist/signers/selfTest.js

@@ -0,0 +1,113 @@
+/**
+ * The doctor's signer self-test.
+ *
+ * `daski doctor` does not take a signer's word for it. Before reporting one as
+ * usable it has the signer sign one fixed vector and checks the result the way
+ * the gateway will: the address recovered from the typed data must be the
+ * address the adapter claims, `s` must be in the low half of the curve order,
+ * and the whole thing must be 65 bytes. A signer that rewrites a field, wraps
+ * an ERC-1271 blob, emits a malleable twin, or simply throws fails here, on a
+ * machine with nothing at stake, instead of at settlement.
+ *
+ * The vector has the *shape* of a purchase — the closed 6-field
+ * `TransferWithAuthorization` type set, so an adapter that mishandles that
+ * exact structure is caught — but it can never be one: the domain is
+ * `DaskiDoctor` with a zero verifying contract, not any token's; the value
+ * and recipient are zero; the validity window is closed. No contract will
+ * ever accept it.
+ */
+import { getAddress, hexToBigInt, keccak256, parseSignature, recoverTypedDataAddress, stringToHex, } from "viem";
+import { TRANSFER_WITH_AUTHORIZATION_PRIMARY_TYPE, TRANSFER_WITH_AUTHORIZATION_TYPES, } from "@daski/x402-scheme";
+const ZERO_ADDRESS = "0x0000000000000000000000000000000000000000";
+/** The vector's nonce: a commitment to nothing but its own name. */
+export const SELF_TEST_NONCE = keccak256(stringToHex("daski-doctor-self-test"));
+/** The secp256k1 group order, and the largest `s` the gateway's recovery accepts. */
+const SECP256K1_N = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
+export const LOW_S_MAX = SECP256K1_N / 2n;
+/**
+ * The fixed vector for one signer address and chain. Everything about it is
+ * pinned except the payer, which must be the signer under test so that a
+ * matching recovered address proves the signer signed *this* message,
+ * unchanged.
+ */
+export function selfTestVector(signerAddress, chainId) {
+    return {
+        domain: {
+            name: "DaskiDoctor",
+            version: "1",
+            chainId,
+            verifyingContract: ZERO_ADDRESS,
+        },
+        types: TRANSFER_WITH_AUTHORIZATION_TYPES,
+        primaryType: TRANSFER_WITH_AUTHORIZATION_PRIMARY_TYPE,
+        message: {
+            from: signerAddress,
+            to: ZERO_ADDRESS,
+            value: 0n,
+            validAfter: 0n,
+            validBefore: 0n,
+            nonce: SELF_TEST_NONCE,
+        },
+    };
+}
+/**
+ * Signs the vector with `signer` and checks the signature the way the gateway
+ * will. Never throws: a signer that throws has failed the test, and the reason
+ * says so.
+ */
+export async function runSignerSelfTest(signer, chainId) {
+    let claimed;
+    let vector;
+    let signature;
+    try {
+        claimed = getAddress(await signer.getAddress());
+        vector = selfTestVector(claimed, chainId);
+        signature = await signer.signTypedData(vector);
+    }
+    catch (error) {
+        return failed(`the signer threw: ${errorMessage(error)}`);
+    }
+    if (typeof signature !== "string" || !/^0x[0-9a-fA-F]{130}$/.test(signature)) {
+        return failed(`malformed signature: expected 65 bytes of 0x-prefixed hex, got ${describeShape(signature)}`);
+    }
+    let recovered;
+    let s;
+    try {
+        recovered = await recoverTypedDataAddress({ ...vector, signature });
+        s = hexToBigInt(parseSignature(signature).s);
+    }
+    catch (error) {
+        return failed(`the signature does not recover: ${errorMessage(error)}`);
+    }
+    const lowS = s <= LOW_S_MAX;
+    if (recovered !== claimed) {
+        return {
+            passed: false,
+            recovered,
+            lowS,
+            reason: `recovered-address mismatch: the signature recovers to ${recovered} but the ` +
+                `signer reports ${claimed}, so either the key is not the one claimed or a ` +
+                "field was rewritten before signing",
+        };
+    }
+    if (!lowS) {
+        return {
+            passed: false,
+            recovered,
+            lowS,
+            reason: "high-s signature: s is above secp256k1n/2, which the gateway's low-s ECDSA " +
+                "recovery rejects",
+        };
+    }
+    return { passed: true, recovered, lowS };
+}
+function failed(reason) {
+    return { passed: false, recovered: null, lowS: false, reason };
+}
+function errorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function describeShape(value) {
+    return typeof value === "string" ? `a ${value.length}-character string` : typeof value;
+}
+//# sourceMappingURL=selfTest.js.map

package/dist/signers/selfTest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selfTest.js","sourceRoot":"","sources":["../../src/signers/selfTest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EACL,UAAU,EACV,WAAW,EACX,SAAS,EACT,cAAc,EACd,uBAAuB,EACvB,WAAW,GAGZ,MAAM,MAAM,CAAC;AACd,OAAO,EACL,wCAAwC,EACxC,iCAAiC,GAGlC,MAAM,oBAAoB,CAAC;AAE5B,MAAM,YAAY,GAAG,4CAAuD,CAAC;AAE7E,oEAAoE;AACpE,MAAM,CAAC,MAAM,eAAe,GAAQ,SAAS,CAAC,WAAW,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAErF,qFAAqF;AACrF,MAAM,WAAW,GAAG,mEAAmE,CAAC;AACxF,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,GAAG,EAAE,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,aAAsB,EAAE,OAAe;IACpE,OAAO;QACL,MAAM,EAAE;YACN,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,GAAG;YACZ,OAAO;YACP,iBAAiB,EAAE,YAAY;SAChC;QACD,KAAK,EAAE,iCAAiC;QACxC,WAAW,EAAE,wCAAwC;QACrD,OAAO,EAAE;YACP,IAAI,EAAE,aAAa;YACnB,EAAE,EAAE,YAAY;YAChB,KAAK,EAAE,EAAE;YACT,UAAU,EAAE,EAAE;YACd,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,eAAe;SACvB;KACF,CAAC;AACJ,CAAC;AAYD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAqB,EACrB,OAAe;IAEf,IAAI,OAAgB,CAAC;IACrB,IAAI,MAAwB,CAAC;IAC7B,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAC;QACH,OAAO,GAAG,UAAU,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAChD,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC1C,SAAS,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,qBAAqB,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7E,OAAO,MAAM,CACX,kEAAkE,aAAa,CAAC,SAAS,CAAC,EAAE,CAC7F,CAAC;IACJ,CAAC;IACD,IAAI,SAAkB,CAAC;IACvB,IAAI,CAAS,CAAC;IACd,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,uBAAuB,CAAC,EAAE,GAAG,MAAM,EAAE,SAAS,EAAW,CAAC,CAAC;QAC7E,CAAC,GAAG,WAAW,CAAC,cAAc,CAAC,SAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,MAAM,CAAC,mCAAmC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,IAAI,SAAS,CAAC;IAC5B,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAC1B,OAAO;YACL,MAAM,EAAE,KAAK;YACb,SAAS;YACT,IAAI;YACJ,MAAM,EACJ,yDAAyD,SAAS,WAAW;gBAC7E,kBAAkB,OAAO,kDAAkD;gBAC3E,oCAAoC;SACvC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO;YACL,MAAM,EAAE,KAAK;YACb,SAAS;YACT,IAAI;YACJ,MAAM,EACJ,6EAA6E;gBAC7E,kBAAkB;SACrB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,MAAM,CAAC,MAAc;IAC5B,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,MAAM,mBAAmB,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;AACzF,CAAC"}

package/dist/store/keystore.d.ts

@@ -0,0 +1,19 @@
+import type { Hex } from "viem";
+export type KeySource = "keychain" | "encrypted-file" | "environment";
+export interface KeyLocation {
+    source: KeySource;
+    /** Human-readable, never the key. */
+    description: string;
+}
+/** Where a key for this profile lives, without loading it. */
+export declare function locateKey(profile: string): Promise<KeyLocation | undefined>;
+/** Loads the private key for a profile, prompting for a passphrase if needed. */
+export declare function loadKey(profile: string): Promise<Hex>;
+/**
+ * Stores a key for a profile. Returns where it landed so the caller can tell
+ * the operator — the caller prints the location, never the key.
+ */
+export declare function storeKey(profile: string, privateKey: Hex): Promise<KeyLocation>;
+/** True when a key already exists for this profile. */
+export declare function hasKey(profile: string): Promise<boolean>;
+//# sourceMappingURL=keystore.d.ts.map

package/dist/store/keystore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../src/store/keystore.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAehC,MAAM,MAAM,SAAS,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAEtE,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,SAAS,CAAC;IAClB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;CACrB;AAkID,8DAA8D;AAC9D,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAqBjF;AAED,iFAAiF;AACjF,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAiC3D;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAgCrF;AAED,uDAAuD;AACvD,wBAAsB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE9D"}

package/dist/store/keystore.js

@@ -0,0 +1,226 @@
+/**
+ * §5 — key storage.
+ *
+ * Order of preference: the OS keychain, then an scrypt+AES-GCM file guarded by
+ * a passphrase, then — for sandbox development only — an environment variable.
+ * Sandbox and mainnet never share a keychain entry or a file slot, so a
+ * profile mix-up cannot reach a mainnet key.
+ *
+ * Nothing in this file logs, prints, or returns key material except to the
+ * single caller that is about to construct a signer.
+ */
+import { createCipheriv, createDecipheriv, randomBytes, scrypt as scryptCallback } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { promisify } from "node:util";
+import { CliError } from "../cli/errors.js";
+import { readPassphrase } from "../cli/prompt.js";
+import { keystorePath } from "../paths.js";
+const scrypt = promisify(scryptCallback);
+const SERVICE = "io.daski.pay";
+const DOC = "https://github.com/daski-io/buyer/blob/main/docs/keys.md";
+/** Interactive-grade scrypt parameters. */
+const SCRYPT = { N: 1 << 17, r: 8, p: 1 };
+/** Keychain and file entries are namespaced by profile, never shared. */
+function accountFor(profile) {
+    return `payer:${profile}`;
+}
+/** The developer escape hatch, and only for a sandbox profile. */
+function environmentKey(profile) {
+    const raw = process.env.DASKI_PAYER_PRIVATE_KEY;
+    if (!raw)
+        return undefined;
+    if (profile !== "sandbox") {
+        throw new CliError({
+            code: "DASKI_ENV_KEY_REFUSED_OFF_SANDBOX",
+            message: `DASKI_PAYER_PRIVATE_KEY is set, but the active profile is "${profile}". ` +
+                "The environment-variable signer is sandbox-only.",
+            remediation: `Unset DASKI_PAYER_PRIVATE_KEY, and store the ${profile} key in the OS ` +
+                `keychain instead: run \`daski wallet create --profile ${profile}\`. See ${DOC}`,
+        });
+    }
+    if (!/^0x[0-9a-fA-F]{64}$/.test(raw)) {
+        throw new CliError({
+            code: "DASKI_ENV_KEY_MALFORMED",
+            message: "DASKI_PAYER_PRIVATE_KEY is not a 32-byte 0x-prefixed hex key.",
+            remediation: `Unset it, or set a valid key. See ${DOC}`,
+        });
+    }
+    return raw;
+}
+/**
+ * Loads `@napi-rs/keyring` if the platform has it. It is an optional
+ * dependency with prebuilt binaries and no install scripts, so its absence is
+ * normal rather than exceptional — we fall through to the file keystore.
+ */
+async function keyring(profile) {
+    if (process.env.DASKI_DISABLE_KEYCHAIN === "1")
+        return undefined;
+    try {
+        const module = await import("@napi-rs/keyring");
+        const Entry = module.Entry;
+        return new Entry(SERVICE, accountFor(profile));
+    }
+    catch {
+        return undefined;
+    }
+}
+function readKeystoreFile() {
+    try {
+        const parsed = JSON.parse(readFileSync(keystorePath(), "utf8"));
+        if (parsed.version !== 1 || typeof parsed.entries !== "object")
+            throw new Error("shape");
+        return parsed;
+    }
+    catch {
+        return { version: 1, entries: {} };
+    }
+}
+function writeKeystoreFile(file) {
+    const path = keystorePath();
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    chmodSync(path, 0o600);
+}
+async function encrypt(privateKey, passphrase) {
+    const salt = randomBytes(32);
+    const key = await scrypt(passphrase, salt, 32, SCRYPT);
+    const iv = randomBytes(12);
+    const cipher = createCipheriv("aes-256-gcm", key, iv);
+    const ciphertext = Buffer.concat([
+        cipher.update(Buffer.from(privateKey.slice(2), "hex")),
+        cipher.final(),
+    ]);
+    return {
+        kdf: "scrypt",
+        N: SCRYPT.N, r: SCRYPT.r, p: SCRYPT.p,
+        salt: salt.toString("base64"),
+        iv: iv.toString("base64"),
+        tag: cipher.getAuthTag().toString("base64"),
+        ciphertext: ciphertext.toString("base64"),
+    };
+}
+async function decrypt(entry, passphrase) {
+    const key = await scrypt(passphrase, Buffer.from(entry.salt, "base64"), 32, {
+        N: entry.N, r: entry.r, p: entry.p,
+    });
+    const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(entry.iv, "base64"));
+    decipher.setAuthTag(Buffer.from(entry.tag, "base64"));
+    try {
+        const plaintext = Buffer.concat([
+            decipher.update(Buffer.from(entry.ciphertext, "base64")),
+            decipher.final(),
+        ]);
+        return `0x${plaintext.toString("hex")}`;
+    }
+    catch {
+        // GCM authentication failed: a wrong passphrase, or a tampered file.
+        throw new CliError({
+            code: "DASKI_KEYSTORE_DECRYPT_FAILED",
+            message: "The keystore could not be decrypted with that passphrase.",
+            remediation: "Re-run and enter the passphrase used when the key was created. If it " +
+                `is lost, the key cannot be recovered from this file. See ${DOC}`,
+        });
+    }
+}
+/** Where a key for this profile lives, without loading it. */
+export async function locateKey(profile) {
+    if (process.env.DASKI_PAYER_PRIVATE_KEY) {
+        return {
+            source: "environment",
+            description: "DASKI_PAYER_PRIVATE_KEY (developer/sandbox only)",
+        };
+    }
+    const entry = await keyring(profile);
+    if (entry) {
+        try {
+            if (entry.getPassword()) {
+                return { source: "keychain", description: `OS keychain (${SERVICE}/${accountFor(profile)})` };
+            }
+        }
+        catch {
+            // An unavailable keychain is not an error here; fall through to the file.
+        }
+    }
+    if (readKeystoreFile().entries[accountFor(profile)]) {
+        return { source: "encrypted-file", description: `${keystorePath()} (scrypt + AES-256-GCM)` };
+    }
+    return undefined;
+}
+/** Loads the private key for a profile, prompting for a passphrase if needed. */
+export async function loadKey(profile) {
+    const fromEnvironment = environmentKey(profile);
+    if (fromEnvironment)
+        return fromEnvironment;
+    const entry = await keyring(profile);
+    if (entry) {
+        try {
+            const stored = entry.getPassword();
+            if (stored) {
+                if (!/^0x[0-9a-fA-F]{64}$/.test(stored)) {
+                    throw new CliError({
+                        code: "DASKI_KEYCHAIN_ENTRY_MALFORMED",
+                        message: `The keychain entry for "${profile}" is not a valid private key.`,
+                        remediation: `Delete it and re-run \`daski wallet create --profile ${profile}\`. See ${DOC}`,
+                    });
+                }
+                return stored;
+            }
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+        }
+    }
+    const stored = readKeystoreFile().entries[accountFor(profile)];
+    if (!stored) {
+        throw new CliError({
+            code: "DASKI_NO_KEY_FOR_PROFILE",
+            message: `No signing key is configured for the "${profile}" profile.`,
+            remediation: `Run: daski wallet create --profile ${profile}`,
+        });
+    }
+    const passphrase = await readPassphrase(`Passphrase for the ${profile} keystore: `);
+    return decrypt(stored, passphrase);
+}
+/**
+ * Stores a key for a profile. Returns where it landed so the caller can tell
+ * the operator — the caller prints the location, never the key.
+ */
+export async function storeKey(profile, privateKey) {
+    const entry = await keyring(profile);
+    if (entry) {
+        try {
+            entry.setPassword(privateKey);
+            return { source: "keychain", description: `OS keychain (${SERVICE}/${accountFor(profile)})` };
+        }
+        catch {
+            // No usable keychain (headless Linux without libsecret, for example).
+        }
+    }
+    const passphrase = await readPassphrase(`No OS keychain is available. Choose a passphrase for ${keystorePath()}: `);
+    if (passphrase.length < 8) {
+        throw new CliError({
+            code: "DASKI_PASSPHRASE_TOO_SHORT",
+            message: "The keystore passphrase must be at least 8 characters.",
+            remediation: "Re-run and choose a longer passphrase.",
+        });
+    }
+    const again = await readPassphrase("Confirm passphrase: ");
+    if (again !== passphrase) {
+        throw new CliError({
+            code: "DASKI_PASSPHRASE_MISMATCH",
+            message: "The passphrases did not match.",
+            remediation: "Re-run and enter the same passphrase twice.",
+        });
+    }
+    const file = readKeystoreFile();
+    file.entries[accountFor(profile)] = await encrypt(privateKey, passphrase);
+    writeKeystoreFile(file);
+    return { source: "encrypted-file", description: `${keystorePath()} (scrypt + AES-256-GCM)` };
+}
+/** True when a key already exists for this profile. */
+export async function hasKey(profile) {
+    return (await locateKey(profile)) !== undefined;
+}
+//# sourceMappingURL=keystore.js.map