@did-btcr2/cli 0.10.2 → 0.11.0

package/dist/esm/src/cli.js

@@ -1,7 +1,7 @@
+import { DidMethodError } from '@did-btcr2/common';
 import { Command, CommanderError } from 'commander';
-import { registerCreateCommand, registerDeactivateCommand, registerResolveCommand, registerUpdateCommand, } from './commands/index.js';
-import { defaultApiFactory } from './config.js';
-import { CLIError } from './error.js';
+import { registerCompletionCommand, registerConfigCommand, registerCreateCommand, registerDeactivateCommand, registerKeyCommand, registerProfileCommand, registerResolveCommand, registerUpdateCommand, } from './commands/index.js';
+import { defaultApiFactory, keystoreApiFactory } from './config.js';
 import { VERSION } from './version.js';
 /**
  * CLI tool for the did:btcr2 method.
@@ -16,9 +16,13 @@ export class DidBtcr2Cli {
      * {@link defaultApiFactory} which uses public endpoints (mempool.space)
      * for known networks and localhost Polar for regtest.
      *
-     * @param factory - Optional API factory. Defaults to {@link defaultApiFactory}.
+     * @param factory - Optional API factory for keystore-free commands (create,
+     *   resolve). Defaults to {@link defaultApiFactory}.
+     * @param keystoreFactory - Optional keystore-aware API factory for commands
+     *   that need a signing identity (key, update, deactivate). Defaults to
+     *   {@link keystoreApiFactory}.
      */
-    constructor(factory = defaultApiFactory) {
+    constructor(factory = defaultApiFactory, keystoreFactory = keystoreApiFactory) {
         this.program = new Command('btcr2')
             .version(`btcr2 ${VERSION}`, '-v, --version', 'Output the current version')
             .description('CLI tool for the did:btcr2 method')
@@ -31,12 +35,19 @@ export class DidBtcr2Cli {
             .option('--btc-rpc-url <url>', 'Override Bitcoin Core RPC endpoint')
             .option('--btc-rpc-user <user>', 'Bitcoin Core RPC username')
             .option('--btc-rpc-pass <pass>', 'Bitcoin Core RPC password')
-            .option('--cas-gateway <url>', 'IPFS HTTP gateway for CAS reads');
+            .option('--cas-gateway <url>', 'IPFS HTTP gateway for CAS reads')
+            .option('--keystore <path>', 'Path to the keystore file (default: $XDG_DATA_HOME/btcr2/keystore.json)')
+            .option('--passphrase-file <path>', 'Read the keystore passphrase from a file (unattended use)')
+            .option('--signing-key <ref>', 'Key for update/deactivate signing: a URN, fingerprint prefix, or name');
         const globals = () => this.program.opts();
         registerCreateCommand(this.program, factory, globals);
         registerResolveCommand(this.program, factory, globals);
-        registerUpdateCommand(this.program, factory, globals);
-        registerDeactivateCommand(this.program, factory, globals);
+        registerUpdateCommand(this.program, keystoreFactory, globals);
+        registerDeactivateCommand(this.program, keystoreFactory, globals);
+        registerKeyCommand(this.program, keystoreFactory, globals);
+        registerConfigCommand(this.program, globals);
+        registerProfileCommand(this.program, globals);
+        registerCompletionCommand(this.program, globals);
     }
     /**
      * Runs the CLI with the provided argv or process.argv.
@@ -51,7 +62,7 @@ export class DidBtcr2Cli {
                 this.program.outputHelp();
         }
         catch (error) {
-            handleError(error);
+            handleError(error, Boolean(this.program.opts().verbose));
         }
     }
 }
@@ -69,16 +80,23 @@ function normalizeArgv(argv) {
 }
 /**
  * Handles errors thrown during CLI execution.
+ *
+ * Known method errors ({@link DidMethodError} and its subclasses, including
+ * {@link CLIError} and the keystore errors) print only their message, never the
+ * stack or the structured `data` payload, so internal shapes are not leaked.
+ * The full error object and stack are shown only under `--verbose`.
+ *
  * @param {unknown} error - The error to handle.
+ * @param {boolean} verbose - Whether to print the full error object and stack.
  * @returns {void}
  */
-function handleError(error) {
+function handleError(error, verbose) {
     if (error instanceof CommanderError &&
         (error.code === 'commander.helpDisplayed' || error.code === 'commander.help')) {
         return;
     }
-    if (error instanceof CLIError) {
-        console.error(error.message);
+    if (error instanceof DidMethodError) {
+        console.error(verbose ? error : error.message);
         process.exitCode ??= 1;
         return;
     }

package/dist/esm/src/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAmB,MAAM,aAAa,CAAC;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,OAAO,CAAU;IAEjC;;;;;;;;;OASG;IACH,YAAY,UAAsB,iBAAiB;QACjD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;aAChC,OAAO,CAAC,SAAS,OAAO,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC;aAC1E,WAAW,CAAC,mCAAmC,CAAC;aAChD,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;aACpE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;aAC5C,MAAM,CAAC,SAAS,EAAE,+BAA+B,EAAE,KAAK,CAAC;aACzD,MAAM,CAAC,qBAAqB,EAAE,mEAAmE,CAAC;aAClG,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;aACvF,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;aAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;aACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;QAEpE,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;QAE1E,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC5D,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,IAAe;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,WAAW,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,KAAc;IACjC,IACE,KAAK,YAAY,cAAc;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAmB,MAAM,aAAa,CAAC;AAErF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,OAAO,CAAU;IAEjC;;;;;;;;;;;;;OAaG;IACH,YACE,UAAsB,iBAAiB,EACvC,kBAA8B,kBAAkB;QAEhD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;aAChC,OAAO,CAAC,SAAS,OAAO,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC;aAC1E,WAAW,CAAC,mCAAmC,CAAC;aAChD,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;aACpE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;aAC5C,MAAM,CAAC,SAAS,EAAE,+BAA+B,EAAE,KAAK,CAAC;aACzD,MAAM,CAAC,qBAAqB,EAAE,mEAAmE,CAAC;aAClG,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;aACvF,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;aAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;aACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;aAChE,MAAM,CAAC,mBAAmB,EAAE,yEAAyE,CAAC;aACtG,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;aAC/F,MAAM,CAAC,qBAAqB,EAAE,uEAAuE,CAAC,CAAC;QAE1G,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;QAE1E,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9D,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAClE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3D,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,IAAe;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,OAAgB;IACnD,IACE,KAAK,YAAY,cAAc;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;AACzB,CAAC"}

package/dist/esm/src/commands/completion.js

@@ -0,0 +1,36 @@
+import { CLIError } from '../error.js';
+const COMMANDS = 'create resolve read update deactivate delete key config profile completion';
+/** Registers the `completion` command, which prints a shell completion script to stdout. */
+export function registerCompletionCommand(program, _globals) {
+    program
+        .command('completion [shell]')
+        .description('Print a shell completion script (bash, zsh, or fish) to stdout.')
+        .action((shell = 'bash') => {
+        console.log(completionScript(shell));
+    });
+}
+/** Returns a completion script for the given shell. */
+function completionScript(shell) {
+    switch (shell) {
+        case 'bash':
+            return [
+                '# btcr2 bash completion. Install with: eval "$(btcr2 completion bash)"',
+                '_btcr2() { COMPREPLY=( $(compgen -W "' + COMMANDS + '" -- "${COMP_WORDS[COMP_CWORD]}") ); }',
+                'complete -F _btcr2 btcr2',
+            ].join('\n');
+        case 'zsh':
+            return [
+                '# btcr2 zsh completion. Install with: eval "$(btcr2 completion zsh)"',
+                '_btcr2() { compadd ' + COMMANDS + ' }',
+                'compdef _btcr2 btcr2',
+            ].join('\n');
+        case 'fish':
+            return [
+                '# btcr2 fish completion. Save to ~/.config/fish/completions/btcr2.fish',
+                'complete -c btcr2 -f -a "' + COMMANDS + '"',
+            ].join('\n');
+        default:
+            throw new CLIError(`Unsupported shell "${shell}". Use bash, zsh, or fish.`, 'INVALID_ARGUMENT_ERROR', { shell });
+    }
+}
+//# sourceMappingURL=completion.js.map

package/dist/esm/src/commands/completion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.js","sourceRoot":"","sources":["../../../../src/commands/completion.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,QAAQ,GAAG,4EAA4E,CAAC;AAE9F,4FAA4F;AAC5F,MAAM,UAAU,yBAAyB,CAAC,OAAgB,EAAE,QAA6B;IACvF,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,CAAC,KAAK,GAAG,MAAM,EAAE,EAAE;QACzB,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC;AAED,uDAAuD;AACvD,SAAS,gBAAgB,CAAC,KAAa;IACrC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM;YACT,OAAO;gBACL,wEAAwE;gBACxE,uCAAuC,GAAG,QAAQ,GAAG,wCAAwC;gBAC7F,0BAA0B;aAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,KAAK;YACR,OAAO;gBACL,sEAAsE;gBACtE,qBAAqB,GAAG,QAAQ,GAAG,IAAI;gBACvC,sBAAsB;aACvB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,MAAM;YACT,OAAO;gBACL,wEAAwE;gBACxE,2BAA2B,GAAG,QAAQ,GAAG,GAAG;aAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACf;YACE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,KAAK,4BAA4B,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC"}

package/dist/esm/src/commands/config.js

@@ -0,0 +1,69 @@
+import { existsSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { CONFIG_SCHEMA_VERSION, defaultConfigPath, getConfigPath, readConfigFile, setConfigPath, unsetConfigPath, writeConfigFile, } from '../config.js';
+import { CLIError } from '../error.js';
+import { ensureDir, writeFileAtomic } from '../keystore/atomic.js';
+import { formatResult } from '../output.js';
+import { SUPPORTED_NETWORKS } from '../types.js';
+/** Registers the `config` command group for reading and writing CLI configuration. */
+export function registerConfigCommand(program, globals) {
+    const config = program.command('config').description('Read and write CLI configuration.');
+    const path = () => globals().config ?? defaultConfigPath();
+    const print = (result) => console.log(formatResult(result, globals()));
+    config
+        .command('init')
+        .description('Create a default config file with one profile per network.')
+        .option('--force', 'Overwrite an existing config file.', false)
+        .action((options) => {
+        const p = path();
+        if (existsSync(p) && !options.force) {
+            throw new CLIError(`Config already exists at ${p}. Use --force to overwrite.`, 'INVALID_ARGUMENT_ERROR', { path: p });
+        }
+        const scaffold = {
+            schemaVersion: CONFIG_SCHEMA_VERSION,
+            defaults: { output: 'text' },
+            profiles: Object.fromEntries(SUPPORTED_NETWORKS.map(n => [n, {}])),
+        };
+        ensureDir(dirname(p), 0o700);
+        writeFileAtomic(p, `${JSON.stringify(scaffold, null, 2)}\n`, 0o600);
+        print({ action: 'config-init', data: { path: p } });
+    });
+    config
+        .command('get [path]')
+        .description('Print a value at a dotted path, or the whole config.')
+        .action((dotted) => {
+        const file = (readConfigFile(path()) ?? {});
+        print({ action: 'config-get', data: (dotted ? getConfigPath(file, dotted) : file) ?? null });
+    });
+    config
+        .command('set <path> <value>')
+        .description('Set a value at a dotted path. The value is parsed as JSON when valid, else stored as a string.')
+        .action((dotted, value) => {
+        writeConfigFile(path(), raw => setConfigPath(raw, dotted, parseValue(value)));
+        print({ action: 'config-set', data: { path: dotted } });
+    });
+    config
+        .command('unset <path>')
+        .description('Delete a value at a dotted path.')
+        .action((dotted) => {
+        writeConfigFile(path(), raw => unsetConfigPath(raw, dotted));
+        print({ action: 'config-unset', data: { path: dotted } });
+    });
+    config
+        .command('list')
+        .alias('ls')
+        .description('Print the entire config file.')
+        .action(() => {
+        print({ action: 'config-list', data: readConfigFile(path()) ?? {} });
+    });
+}
+/** Parses a value as JSON when valid, otherwise treats it as a plain string. */
+function parseValue(value) {
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        return value;
+    }
+}
+//# sourceMappingURL=config.js.map

package/dist/esm/src/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../src/commands/config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CAAC,OAAgB,EAAE,OAA4B;IAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAC;IAC1F,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,SAAS,EAAE,oCAAoC,EAAE,KAAK,CAAC;SAC9D,MAAM,CAAC,CAAC,OAA4B,EAAE,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACjB,IAAI,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACpC,MAAM,IAAI,QAAQ,CAAC,4BAA4B,CAAC,6BAA6B,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,aAAa,EAAG,qBAAqB;YACrC,QAAQ,EAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;YAClC,QAAQ,EAAQ,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAE,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC;SAC3E,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7B,eAAe,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACpE,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,CAAC,MAAe,EAAE,EAAE;QAC1B,MAAM,IAAI,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAA4B,CAAC;QACvE,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,gGAAgG,CAAC;SAC7G,MAAM,CAAC,CAAC,MAAc,EAAE,KAAa,EAAE,EAAE;QACxC,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,CAAC,MAAc,EAAE,EAAE;QACzB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,GAAG,EAAE;QACX,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,gFAAgF;AAChF,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/esm/src/commands/deactivate.js

@@ -1,5 +1,8 @@
+import { KeyManagerSigner } from '@did-btcr2/key-manager';
 import { deriveNetwork } from '../config.js';
 import { CLIError } from '../error.js';
+import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
+import { formatResult } from '../output.js';
 /** The JSON Patch that marks a DID document as permanently deactivated. */
 const DEACTIVATION_PATCH = [{ op: 'add', path: '/deactivated', value: true }];
 export function registerDeactivateCommand(program, factory, globals) {
@@ -12,6 +15,9 @@ export function registerDeactivateCommand(program, factory, globals) {
         .requiredOption('-m, --verification-method-id <id>', 'DID document verification method ID used to sign the deactivation')
         .requiredOption('-b, --beacon-id <json>', 'Beacon ID as a JSON string', parseJsonArg('--beacon-id'))
         .action(async (options) => {
+        if (!/^\d+$/.test(options.sourceVersionId)) {
+            throw new CLIError('--source-version-id must be a non-negative integer.', 'INVALID_ARGUMENT_ERROR', { value: options.sourceVersionId });
+        }
         const parsed = {
             sourceDocument: options.sourceDocument,
             patches: DEACTIVATION_PATCH,
@@ -23,14 +29,21 @@ export function registerDeactivateCommand(program, factory, globals) {
         if (!did) {
             throw new CLIError('Source document must contain an "id" field.', 'INVALID_ARGUMENT_ERROR', options);
         }
-        // CLI signing is not yet wired up; deactivate uses the same update path
-        // and inherits the same gap. Drive the SDK directly with a `Signer` for now.
-        // Variables above are kept so command parsing + validation still works.
-        void deriveNetwork(did);
-        void factory;
-        void globals;
-        void parsed;
-        throw new CLIError('CLI signing is not yet implemented. Use @did-btcr2/api with a Signer directly.', 'NOT_IMPLEMENTED_ERROR', { command: 'deactivate' });
+        // Deactivation is an update that applies the deactivation patch. The core
+        // method has no separate deactivate path, so this routes through update.
+        const network = deriveNetwork(did);
+        const api = factory(network, globals());
+        const keyId = resolveKeyRef(api.kms.kms, globals().signingKey);
+        const signer = new KeyManagerSigner(api.kms.kms, keyId);
+        const data = await api.btcr2.update({
+            sourceDocument: parsed.sourceDocument,
+            patches: parsed.patches,
+            sourceVersionId: parsed.sourceVersionId,
+            verificationMethodId: parsed.verificationMethodId,
+            beaconId: parsed.beaconId,
+            signer,
+        });
+        console.log(formatResult({ action: 'deactivate', data }, globals()));
     });
 }
 /**

package/dist/esm/src/commands/deactivate.js.map

@@ -1 +1 @@
-{"version":3,"file":"deactivate.js","sourceRoot":"","sources":["../../../../src/commands/deactivate.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvF,MAAM,UAAU,yBAAyB,CACvC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,wEAAwE,CAAC;SACrF,cAAc,CACb,8BAA8B,EAC9B,qCAAqC,EACrC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,wCAAwC,CACzC;SACA,cAAc,CACb,mCAAmC,EACnC,mEAAmE,CACpE;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CAAC,KAAK,EAAE,OAKd,EAAE,EAAE;QACH,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,kBAAkB;YACzC,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,wEAAwE;QACxE,6EAA6E;QAC7E,wEAAwE;QACxE,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,MAAM,IAAI,QAAQ,CAChB,gFAAgF,EAChF,uBAAuB,EACvB,EAAE,OAAO,EAAE,YAAY,EAAE,CAC1B,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"deactivate.js","sourceRoot":"","sources":["../../../../src/commands/deactivate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,2EAA2E;AAC3E,MAAM,kBAAkB,GAAG,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEvF,MAAM,UAAU,yBAAyB,CACvC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,KAAK,CAAC,QAAQ,CAAC;SACf,WAAW,CAAC,wEAAwE,CAAC;SACrF,cAAc,CACb,8BAA8B,EAC9B,qCAAqC,EACrC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,wCAAwC,CACzC;SACA,cAAc,CACb,mCAAmC,EACnC,mEAAmE,CACpE;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CAAC,KAAK,EAAE,OAKd,EAAE,EAAE;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,wBAAwB,EACxB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,kBAAkB;YACzC,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,0EAA0E;QAC1E,yEAAyE;QACzE,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,cAAc,EAAS,MAAM,CAAC,cAAc;YAC5C,OAAO,EAAgB,MAAM,CAAC,OAAO;YACrC,eAAe,EAAQ,MAAM,CAAC,eAAe;YAC7C,oBAAoB,EAAG,MAAM,CAAC,oBAAoB;YAClD,QAAQ,EAAe,MAAM,CAAC,QAAQ;YACtC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/src/commands/index.js

@@ -2,4 +2,8 @@ export { registerCreateCommand } from './create.js';
 export { registerResolveCommand } from './resolve.js';
 export { registerUpdateCommand } from './update.js';
 export { registerDeactivateCommand } from './deactivate.js';
+export { registerKeyCommand } from './key.js';
+export { registerConfigCommand } from './config.js';
+export { registerProfileCommand } from './profile.js';
+export { registerCompletionCommand } from './completion.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/src/commands/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/esm/src/commands/key.js

@@ -0,0 +1,175 @@
+import { SchnorrKeyPair } from '@did-btcr2/keypair';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+import { closeSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { CLIError } from '../error.js';
+import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
+import { formatResult } from '../output.js';
+/**
+ * Registers the `key` command group for managing keypairs in the encrypted
+ * keystore. All subcommands operate offline (no Bitcoin connection) through the
+ * keystore-backed KeyManager injected by the factory.
+ */
+export function registerKeyCommand(program, factory, globals) {
+    const key = program.command('key').description('Manage keypairs in the encrypted keystore.');
+    const print = (result) => console.log(formatResult(result, globals()));
+    key
+        .command('generate')
+        .description('Generate a new keypair and store it.')
+        .option('--name <name>', 'A human-friendly name, stored as a tag and usable as a key reference.')
+        .option('--set-active', 'Make this the active key.', false)
+        .action((options) => {
+        const api = factory(undefined, globals());
+        assertNameAvailable(api.kms.kms, options.name);
+        const setActive = options.setActive ?? false;
+        const id = api.kms.generateKey({ ...(options.name && { tags: { name: options.name } }), setActive });
+        print({ action: 'key-generate', data: { keyId: id, publicKey: bytesToHex(api.kms.getPublicKey(id)), active: setActive } });
+    });
+    key
+        .command('list')
+        .alias('ls')
+        .description('List stored keys.')
+        .action(() => {
+        const kms = factory(undefined, globals()).kms.kms;
+        const active = kms.activeKeyId;
+        const data = kms.listKeys().map(id => {
+            const entry = kms.getEntry(id);
+            return {
+                keyId: id,
+                fingerprint: id.split(':').pop() ?? id,
+                ...(entry.tags?.name && { name: entry.tags.name }),
+                active: id === active,
+            };
+        });
+        print({ action: 'key-list', data });
+    });
+    key
+        .command('show <ref>')
+        .description('Show a key\'s public material and tags. Never prints the secret.')
+        .action((ref) => {
+        const kms = factory(undefined, globals()).kms.kms;
+        const id = resolveKeyRef(kms, ref);
+        const entry = kms.getEntry(id);
+        print({ action: 'key-show', data: { keyId: id, publicKey: bytesToHex(entry.publicKey), ...(entry.tags && { tags: entry.tags }) } });
+    });
+    key
+        .command('import')
+        .description('Import a key: a secret from a hex file, or a public key as watch-only.')
+        .option('--secret-file <path>', 'Path to a file containing a 32-byte secret key as hex.')
+        .option('--public <hex>', 'A 33-byte compressed public key as hex (imported watch-only).')
+        .option('--name <name>', 'A human-friendly name, stored as a tag.')
+        .option('--set-active', 'Make this the active key.', false)
+        .action((options) => {
+        if (Boolean(options.secretFile) === Boolean(options.public)) {
+            throw new CLIError('Provide exactly one of --secret-file or --public.', 'INVALID_ARGUMENT_ERROR');
+        }
+        const api = factory(undefined, globals());
+        assertNameAvailable(api.kms.kms, options.name);
+        const keyPair = options.secretFile
+            ? new SchnorrKeyPair({ secretKey: readHexFile(options.secretFile, 32, '--secret-file') })
+            : new SchnorrKeyPair({ publicKey: parseHex(options.public ?? '', 33, '--public') });
+        const setActive = options.setActive ?? false;
+        const id = api.kms.import(keyPair, { ...(options.name && { tags: { name: options.name } }), setActive });
+        print({ action: 'key-import', data: { keyId: id, publicKey: bytesToHex(api.kms.getPublicKey(id)), watchOnly: !options.secretFile, active: setActive } });
+    });
+    key
+        .command('export <ref>')
+        .description('Export a key. Public material by default; --secret writes the secret to a file.')
+        .option('--secret', 'Export the secret key. Requires --out.', false)
+        .option('--out <path>', 'Write the exported secret to this file (created 0600).')
+        .action((ref, options) => {
+        const api = factory(undefined, globals());
+        const id = resolveKeyRef(api.kms.kms, ref);
+        if (!options.secret) {
+            print({ action: 'key-export', data: { keyId: id, publicKey: bytesToHex(api.kms.getPublicKey(id)) } });
+            return;
+        }
+        if (!options.out) {
+            throw new CLIError('Exporting a secret requires --out <file> so it is not written to the terminal.', 'INVALID_ARGUMENT_ERROR');
+        }
+        const keyPair = api.kms.export(id);
+        if (!keyPair.hasSecretKey) {
+            throw new CLIError(`Key ${id} is watch-only and has no secret to export.`, 'INVALID_ARGUMENT_ERROR', { keyId: id });
+        }
+        process.stderr.write('warning: writing an unencrypted secret key to disk. Protect this file and delete it when done.\n');
+        writeSecretFile(options.out, bytesToHex(keyPair.secretKey.bytes));
+        print({ action: 'key-export', data: { keyId: id, secretWrittenTo: options.out } });
+    });
+    key
+        .command('delete <ref>')
+        .alias('rm')
+        .description('Delete a key from the keystore.')
+        .option('--force', 'Delete even if it is the active key.', false)
+        .action((ref, options) => {
+        const api = factory(undefined, globals());
+        const id = resolveKeyRef(api.kms.kms, ref);
+        api.kms.removeKey(id, { force: options.force ?? false });
+        print({ action: 'key-delete', data: { keyId: id, deleted: true } });
+    });
+    key
+        .command('use <ref>')
+        .description('Set the active key, persisted across invocations.')
+        .action((ref) => {
+        const api = factory(undefined, globals());
+        const id = resolveKeyRef(api.kms.kms, ref);
+        api.kms.setActive(id);
+        print({ action: 'key-use', data: { keyId: id, active: true } });
+    });
+}
+/** Throws if a name tag is already used by another key. */
+function assertNameAvailable(kms, name) {
+    if (!name)
+        return;
+    if (kms.listKeys().some(id => kms.getEntry(id).tags?.name === name)) {
+        throw new CLIError(`A key named "${name}" already exists.`, 'INVALID_ARGUMENT_ERROR', { name });
+    }
+}
+/** Parses and length-checks a hex string into bytes. */
+function parseHex(hex, expectedBytes, label) {
+    let bytes;
+    try {
+        bytes = hexToBytes(hex.trim());
+    }
+    catch {
+        throw new CLIError(`Invalid hex for ${label}.`, 'INVALID_ARGUMENT_ERROR', { label });
+    }
+    if (bytes.length !== expectedBytes) {
+        throw new CLIError(`${label} must be ${expectedBytes} bytes (${expectedBytes * 2} hex chars), got ${bytes.length}.`, 'INVALID_ARGUMENT_ERROR', { label });
+    }
+    return bytes;
+}
+/** Reads a file and parses its contents as length-checked hex bytes. */
+function readHexFile(path, expectedBytes, label) {
+    let content;
+    try {
+        content = readFileSync(path, 'utf-8');
+    }
+    catch {
+        throw new CLIError(`Cannot read ${label} at ${path}.`, 'INVALID_ARGUMENT_ERROR', { label, path });
+    }
+    return parseHex(content, expectedBytes, label);
+}
+/**
+ * Writes an exported secret to a new file, created exclusively (O_CREAT|O_EXCL,
+ * mode 0600). The exclusive flag refuses to clobber an existing file or follow
+ * a pre-placed symlink, so the secret never lands in a loose-permissions or
+ * redirected target.
+ */
+function writeSecretFile(path, contents) {
+    let fd;
+    try {
+        fd = openSync(path, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            throw new CLIError(`Refusing to overwrite existing file ${path}. Choose a new --out path.`, 'INVALID_ARGUMENT_ERROR', { path });
+        }
+        throw error;
+    }
+    try {
+        writeFileSync(fd, contents);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=key.js.map

package/dist/esm/src/commands/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../../../src/commands/key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE3E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,GAAG;SACA,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC;SAChG,MAAM,CAAC,cAAc,EAAE,2BAA2B,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,CAAC,OAA+C,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACnC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAS,EAAE;gBAChB,WAAW,EAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE;gBACvC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClD,MAAM,EAAQ,EAAE,KAAK,MAAM;aAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClD,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,sBAAsB,EAAE,wDAAwD,CAAC;SACxF,MAAM,CAAC,gBAAgB,EAAE,+DAA+D,CAAC;SACzF,MAAM,CAAC,eAAe,EAAE,yCAAyC,CAAC;SAClE,MAAM,CAAC,cAAc,EAAE,2BAA2B,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,CAAC,OAAqF,EAAE,EAAE;QAChG,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAAC,mDAAmD,EAAE,wBAAwB,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU;YAChC,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;YACzF,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACzG,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3J,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,iFAAiF,CAAC;SAC9F,MAAM,CAAC,UAAU,EAAE,wCAAwC,EAAE,KAAK,CAAC;SACnE,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;SAChF,MAAM,CAAC,CAAC,GAAW,EAAE,OAA2C,EAAE,EAAE;QACnE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,gFAAgF,EAAE,wBAAwB,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,6CAA6C,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kGAAkG,CAAC,CAAC;QACzH,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;SAChE,MAAM,CAAC,CAAC,GAAW,EAAE,OAA4B,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,2DAA2D;AAC3D,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAa;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,IAAI,mBAAmB,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,GAAW,EAAE,aAAqB,EAAE,KAAa;IACjE,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,mBAAmB,KAAK,GAAG,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAChB,GAAG,KAAK,YAAY,aAAa,WAAW,aAAa,GAAG,CAAC,oBAAoB,KAAK,CAAC,MAAM,GAAG,EAChG,wBAAwB,EACxB,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,IAAY,EAAE,aAAqB,EAAE,KAAa;IACrE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO,IAAI,GAAG,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,QAAQ,CAAC,uCAAuC,IAAI,4BAA4B,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/esm/src/commands/profile.js

@@ -0,0 +1,63 @@
+import { defaultConfigPath, readConfigFile, writeConfigFile } from '../config.js';
+import { CLIError } from '../error.js';
+import { formatResult } from '../output.js';
+/** Registers the `profile` command group for managing configuration profiles. */
+export function registerProfileCommand(program, globals) {
+    const profile = program.command('profile').description('Manage configuration profiles.');
+    const path = () => globals().config ?? defaultConfigPath();
+    const print = (result) => console.log(formatResult(result, globals()));
+    profile
+        .command('add <name>')
+        .description('Add an empty profile.')
+        .action((name) => {
+        writeConfigFile(path(), raw => {
+            if (raw.profiles === undefined || raw.profiles === null)
+                raw.profiles = {};
+            const profiles = raw.profiles;
+            if (profiles[name])
+                throw new CLIError(`Profile "${name}" already exists.`, 'INVALID_ARGUMENT_ERROR', { name });
+            profiles[name] = {};
+        });
+        print({ action: 'profile-add', data: { profile: name } });
+    });
+    profile
+        .command('use <name>')
+        .description('Set the active profile (writes defaults.profile).')
+        .action((name) => {
+        writeConfigFile(path(), raw => {
+            if (raw.defaults === undefined || raw.defaults === null)
+                raw.defaults = {};
+            raw.defaults.profile = name;
+        });
+        print({ action: 'profile-use', data: { profile: name } });
+    });
+    profile
+        .command('show [name]')
+        .description('Show a profile (defaults to the active profile).')
+        .action((name) => {
+        const file = readConfigFile(path()) ?? {};
+        const target = name ?? file.defaults?.profile;
+        if (!target) {
+            throw new CLIError('No profile specified and no active profile is set.', 'INVALID_ARGUMENT_ERROR');
+        }
+        const data = file.profiles?.[target];
+        if (!data) {
+            throw new CLIError(`Profile "${target}" not found.`, 'INVALID_ARGUMENT_ERROR', { profile: target });
+        }
+        print({ action: 'profile-show', data: { profile: target, ...data } });
+    });
+    profile
+        .command('remove <name>')
+        .alias('rm')
+        .description('Remove a profile.')
+        .action((name) => {
+        writeConfigFile(path(), raw => {
+            const profiles = raw.profiles;
+            if (!profiles?.[name])
+                throw new CLIError(`Profile "${name}" not found.`, 'INVALID_ARGUMENT_ERROR', { name });
+            delete profiles[name];
+        });
+        print({ action: 'profile-remove', data: { profile: name } });
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/esm/src/commands/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../src/commands/profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,OAA4B;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;YAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAmC,CAAC;YACzD,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChH,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAoC,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,CAAC,IAAa,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE,wBAAwB,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC,YAAY,MAAM,cAAc,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA+C,CAAC;YACrE,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,cAAc,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9G,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/esm/src/commands/update.js

@@ -1,5 +1,8 @@
+import { KeyManagerSigner } from '@did-btcr2/key-manager';
 import { deriveNetwork } from '../config.js';
 import { CLIError } from '../error.js';
+import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
+import { formatResult } from '../output.js';
 export function registerUpdateCommand(program, factory, globals) {
     program
         .command('update')
@@ -10,6 +13,9 @@ export function registerUpdateCommand(program, factory, globals) {
         .requiredOption('-m, --verification-method-id <id>', 'DID document verification method ID')
         .requiredOption('-b, --beacon-id <json>', 'Beacon ID as a JSON string', parseJsonArg('--beacon-id'))
         .action(async (options) => {
+        if (!/^\d+$/.test(options.sourceVersionId)) {
+            throw new CLIError('--source-version-id must be a non-negative integer.', 'INVALID_ARGUMENT_ERROR', { value: options.sourceVersionId });
+        }
         const parsed = {
             sourceDocument: options.sourceDocument,
             patches: options.patches,
@@ -21,15 +27,19 @@ export function registerUpdateCommand(program, factory, globals) {
         if (!did) {
             throw new CLIError('Source document must contain an "id" field.', 'INVALID_ARGUMENT_ERROR', options);
         }
-        // The CLI does not yet have a way to load signing material (keystore,
-        // KMS config, hardware wallet, etc.), so signed updates from the CLI are
-        // not yet wired up. Drive the SDK directly with a `Signer` for now.
-        // Variables above are kept so command parsing + validation still works.
-        void deriveNetwork(did);
-        void factory;
-        void globals;
-        void parsed;
-        throw new CLIError('CLI signing is not yet implemented. Use @did-btcr2/api with a Signer directly.', 'NOT_IMPLEMENTED_ERROR', { command: 'update' });
+        const network = deriveNetwork(did);
+        const api = factory(network, globals());
+        const keyId = resolveKeyRef(api.kms.kms, globals().signingKey);
+        const signer = new KeyManagerSigner(api.kms.kms, keyId);
+        const data = await api.btcr2.update({
+            sourceDocument: parsed.sourceDocument,
+            patches: parsed.patches,
+            sourceVersionId: parsed.sourceVersionId,
+            verificationMethodId: parsed.verificationMethodId,
+            beaconId: parsed.beaconId,
+            signer,
+        });
+        console.log(formatResult({ action: 'update', data }, globals()));
     });
 }
 /**

package/dist/esm/src/commands/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/commands/update.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,UAAU,qBAAqB,CACnC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,cAAc,CACb,8BAA8B,EAC9B,oCAAoC,EACpC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,+BAA+B,CAChC;SACA,cAAc,CACb,sBAAsB,EACtB,8CAA8C,EAC9C,YAAY,CAAC,WAAW,CAAC,CAC1B;SACA,cAAc,CACb,mCAAmC,EACnC,qCAAqC,CACtC;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,OAAO,CAAC,OAA0C;YACzE,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,MAAM,IAAI,QAAQ,CAChB,gFAAgF,EAChF,uBAAuB,EACvB,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,MAAM,UAAU,qBAAqB,CACnC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,cAAc,CACb,8BAA8B,EAC9B,oCAAoC,EACpC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,+BAA+B,CAChC;SACA,cAAc,CACb,sBAAsB,EACtB,8CAA8C,EAC9C,YAAY,CAAC,WAAW,CAAC,CAC1B;SACA,cAAc,CACb,mCAAmC,EACnC,qCAAqC,CACtC;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,wBAAwB,EACxB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,OAAO,CAAC,OAA0C;YACzE,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,cAAc,EAAS,MAAM,CAAC,cAAc;YAC5C,OAAO,EAAgB,MAAM,CAAC,OAAO;YACrC,eAAe,EAAQ,MAAM,CAAC,eAAe;YAC7C,oBAAoB,EAAG,MAAM,CAAC,oBAAoB;YAClD,QAAQ,EAAe,MAAM,CAAC,QAAQ;YACtC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}