@did-btcr2/cli 0.10.3 → 0.11.0

package/src/keystore/resolve-key-ref.ts

@@ -0,0 +1,62 @@
+import type { KeyIdentifier, KeyManager } from '@did-btcr2/key-manager';
+import { CLIError } from '../error.js';
+
+/** Extracts the 32-hex fingerprint from a `urn:kms:secp256k1:<hex>` identifier. */
+function fingerprintOf(id: KeyIdentifier): string | undefined {
+  return /^urn:kms:secp256k1:([0-9a-f]{32})$/.exec(id)?.[1];
+}
+
+/**
+ * Resolves a user-supplied key reference to a key identifier. Resolution order:
+ * 1. No reference: the active key (errors if none is set).
+ * 2. Exact URN identifier match.
+ * 3. Unique fingerprint-prefix match (against the hex tail of the URN).
+ * 4. Unique `name` tag match.
+ *
+ * Reads only public material (listKeys + getEntry), so resolving a reference
+ * never decrypts a secret or prompts for a passphrase.
+ *
+ * @param kms The key manager to resolve against.
+ * @param ref The reference to resolve. When omitted, the active key is used.
+ * @returns The resolved key identifier.
+ * @throws {CLIError} If no key matches, the reference is ambiguous, or no
+ *   reference is given and no active key is set.
+ */
+export function resolveKeyRef(kms: KeyManager, ref?: string): KeyIdentifier {
+  if (!ref) {
+    if (!kms.activeKeyId) {
+      throw new CLIError(
+        'No key specified and no active key is set. Use --key <ref> or set one with `btcr2 key use <ref>`.',
+        'INVALID_ARGUMENT_ERROR',
+      );
+    }
+    return kms.activeKeyId;
+  }
+
+  const ids = kms.listKeys();
+
+  if (ids.includes(ref)) return ref;
+
+  const prefix = ref.toLowerCase();
+  const byPrefix = ids.filter(id => fingerprintOf(id)?.startsWith(prefix));
+  if (byPrefix.length === 1) return byPrefix[0];
+  if (byPrefix.length > 1) {
+    throw new CLIError(
+      `Ambiguous key reference "${ref}" matches ${byPrefix.length} keys by fingerprint.`,
+      'KEY_REF_AMBIGUOUS_ERROR',
+      { ref },
+    );
+  }
+
+  const byName = ids.filter(id => kms.getEntry(id).tags?.name === ref);
+  if (byName.length === 1) return byName[0];
+  if (byName.length > 1) {
+    throw new CLIError(
+      `Ambiguous key name "${ref}" matches ${byName.length} keys.`,
+      'KEY_REF_AMBIGUOUS_ERROR',
+      { ref },
+    );
+  }
+
+  throw new CLIError(`No key matches reference "${ref}".`, 'KEY_NOT_FOUND_ERROR', { ref });
+}

package/src/types.ts

@@ -33,17 +33,36 @@ export type CommandResult =
   | { action: 'create'; data: string }
   | { action: 'resolve'; data: DidResolutionResult }
   | { action: 'update'; data: SignedBTCR2Update }
-  | { action: 'deactivate'; data: SignedBTCR2Update };
+  | { action: 'deactivate'; data: SignedBTCR2Update }
+  | { action: 'key-generate'; data: { keyId: string; publicKey: string; active: boolean } }
+  | { action: 'key-list'; data: Array<{ keyId: string; fingerprint: string; name?: string; active: boolean }> }
+  | { action: 'key-show'; data: { keyId: string; publicKey: string; tags?: Record<string, string> } }
+  | { action: 'key-import'; data: { keyId: string; publicKey: string; watchOnly: boolean; active: boolean } }
+  | { action: 'key-export'; data: { keyId: string; publicKey?: string; secretWrittenTo?: string } }
+  | { action: 'key-delete'; data: { keyId: string; deleted: true } }
+  | { action: 'key-use'; data: { keyId: string; active: true } }
+  | { action: 'config-init'; data: { path: string } }
+  | { action: 'config-get'; data: unknown }
+  | { action: 'config-set'; data: { path: string } }
+  | { action: 'config-unset'; data: { path: string } }
+  | { action: 'config-list'; data: unknown }
+  | { action: 'profile-add'; data: { profile: string } }
+  | { action: 'profile-use'; data: { profile: string } }
+  | { action: 'profile-show'; data: unknown }
+  | { action: 'profile-remove'; data: { profile: string } };
 
 export interface GlobalOptions {
-  output     : OutputFormat;
-  verbose    : boolean;
-  quiet      : boolean;
-  config?    : string;
-  profile?   : string;
-  btcRest?   : string;
-  btcRpcUrl? : string;
-  btcRpcUser?: string;
-  btcRpcPass?: string;
-  casGateway?: string;
+  output         : OutputFormat;
+  verbose        : boolean;
+  quiet          : boolean;
+  config?        : string;
+  profile?       : string;
+  btcRest?       : string;
+  btcRpcUrl?     : string;
+  btcRpcUser?    : string;
+  btcRpcPass?    : string;
+  casGateway?    : string;
+  keystore?      : string;
+  passphraseFile?: string;
+  signingKey?    : string;
 }