@did-btcr2/cli 0.10.3 → 0.12.0

package/dist/esm/src/commands/key.js

@@ -0,0 +1,175 @@
+import { SchnorrKeyPair } from '@did-btcr2/keypair';
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+import { closeSync, openSync, readFileSync, writeFileSync } from 'node:fs';
+import { CLIError } from '../error.js';
+import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
+import { formatResult } from '../output.js';
+/**
+ * Registers the `key` command group for managing keypairs in the encrypted
+ * keystore. All subcommands operate offline (no Bitcoin connection) through the
+ * keystore-backed KeyManager injected by the factory.
+ */
+export function registerKeyCommand(program, factory, globals) {
+    const key = program.command('key').description('Manage keypairs in the encrypted keystore.');
+    const print = (result) => console.log(formatResult(result, globals()));
+    key
+        .command('generate')
+        .description('Generate a new keypair and store it.')
+        .option('--name <name>', 'A human-friendly name, stored as a tag and usable as a key reference.')
+        .option('--set-active', 'Make this the active key.', false)
+        .action((options) => {
+        const api = factory(undefined, globals());
+        assertNameAvailable(api.kms.kms, options.name);
+        const setActive = options.setActive ?? false;
+        const id = api.kms.generateKey({ ...(options.name && { tags: { name: options.name } }), setActive });
+        print({ action: 'key-generate', data: { keyId: id, publicKey: bytesToHex(api.kms.getPublicKey(id)), active: setActive } });
+    });
+    key
+        .command('list')
+        .alias('ls')
+        .description('List stored keys.')
+        .action(() => {
+        const kms = factory(undefined, globals()).kms.kms;
+        const active = kms.activeKeyId;
+        const data = kms.listKeys().map(id => {
+            const entry = kms.getEntry(id);
+            return {
+                keyId: id,
+                fingerprint: id.split(':').pop() ?? id,
+                ...(entry.tags?.name && { name: entry.tags.name }),
+                active: id === active,
+            };
+        });
+        print({ action: 'key-list', data });
+    });
+    key
+        .command('show <ref>')
+        .description('Show a key\'s public material and tags. Never prints the secret.')
+        .action((ref) => {
+        const kms = factory(undefined, globals()).kms.kms;
+        const id = resolveKeyRef(kms, ref);
+        const entry = kms.getEntry(id);
+        print({ action: 'key-show', data: { keyId: id, publicKey: bytesToHex(entry.publicKey), ...(entry.tags && { tags: entry.tags }) } });
+    });
+    key
+        .command('import')
+        .description('Import a key: a secret from a hex file, or a public key as watch-only.')
+        .option('--secret-file <path>', 'Path to a file containing a 32-byte secret key as hex.')
+        .option('--public <hex>', 'A 33-byte compressed public key as hex (imported watch-only).')
+        .option('--name <name>', 'A human-friendly name, stored as a tag.')
+        .option('--set-active', 'Make this the active key.', false)
+        .action((options) => {
+        if (Boolean(options.secretFile) === Boolean(options.public)) {
+            throw new CLIError('Provide exactly one of --secret-file or --public.', 'INVALID_ARGUMENT_ERROR');
+        }
+        const api = factory(undefined, globals());
+        assertNameAvailable(api.kms.kms, options.name);
+        const keyPair = options.secretFile
+            ? new SchnorrKeyPair({ secretKey: readHexFile(options.secretFile, 32, '--secret-file') })
+            : new SchnorrKeyPair({ publicKey: parseHex(options.public ?? '', 33, '--public') });
+        const setActive = options.setActive ?? false;
+        const id = api.kms.import(keyPair, { ...(options.name && { tags: { name: options.name } }), setActive });
+        print({ action: 'key-import', data: { keyId: id, publicKey: bytesToHex(api.kms.getPublicKey(id)), watchOnly: !options.secretFile, active: setActive } });
+    });
+    key
+        .command('export <ref>')
+        .description('Export a key. Public material by default; --secret writes the secret to a file.')
+        .option('--secret', 'Export the secret key. Requires --out.', false)
+        .option('--out <path>', 'Write the exported secret to this file (created 0600).')
+        .action((ref, options) => {
+        const api = factory(undefined, globals());
+        const id = resolveKeyRef(api.kms.kms, ref);
+        if (!options.secret) {
+            print({ action: 'key-export', data: { keyId: id, publicKey: bytesToHex(api.kms.getPublicKey(id)) } });
+            return;
+        }
+        if (!options.out) {
+            throw new CLIError('Exporting a secret requires --out <file> so it is not written to the terminal.', 'INVALID_ARGUMENT_ERROR');
+        }
+        const keyPair = api.kms.export(id);
+        if (!keyPair.hasSecretKey) {
+            throw new CLIError(`Key ${id} is watch-only and has no secret to export.`, 'INVALID_ARGUMENT_ERROR', { keyId: id });
+        }
+        process.stderr.write('warning: writing an unencrypted secret key to disk. Protect this file and delete it when done.\n');
+        writeSecretFile(options.out, bytesToHex(keyPair.secretKey.bytes));
+        print({ action: 'key-export', data: { keyId: id, secretWrittenTo: options.out } });
+    });
+    key
+        .command('delete <ref>')
+        .alias('rm')
+        .description('Delete a key from the keystore.')
+        .option('--force', 'Delete even if it is the active key.', false)
+        .action((ref, options) => {
+        const api = factory(undefined, globals());
+        const id = resolveKeyRef(api.kms.kms, ref);
+        api.kms.removeKey(id, { force: options.force ?? false });
+        print({ action: 'key-delete', data: { keyId: id, deleted: true } });
+    });
+    key
+        .command('use <ref>')
+        .description('Set the active key, persisted across invocations.')
+        .action((ref) => {
+        const api = factory(undefined, globals());
+        const id = resolveKeyRef(api.kms.kms, ref);
+        api.kms.setActive(id);
+        print({ action: 'key-use', data: { keyId: id, active: true } });
+    });
+}
+/** Throws if a name tag is already used by another key. */
+function assertNameAvailable(kms, name) {
+    if (!name)
+        return;
+    if (kms.listKeys().some(id => kms.getEntry(id).tags?.name === name)) {
+        throw new CLIError(`A key named "${name}" already exists.`, 'INVALID_ARGUMENT_ERROR', { name });
+    }
+}
+/** Parses and length-checks a hex string into bytes. */
+function parseHex(hex, expectedBytes, label) {
+    let bytes;
+    try {
+        bytes = hexToBytes(hex.trim());
+    }
+    catch {
+        throw new CLIError(`Invalid hex for ${label}.`, 'INVALID_ARGUMENT_ERROR', { label });
+    }
+    if (bytes.length !== expectedBytes) {
+        throw new CLIError(`${label} must be ${expectedBytes} bytes (${expectedBytes * 2} hex chars), got ${bytes.length}.`, 'INVALID_ARGUMENT_ERROR', { label });
+    }
+    return bytes;
+}
+/** Reads a file and parses its contents as length-checked hex bytes. */
+function readHexFile(path, expectedBytes, label) {
+    let content;
+    try {
+        content = readFileSync(path, 'utf-8');
+    }
+    catch {
+        throw new CLIError(`Cannot read ${label} at ${path}.`, 'INVALID_ARGUMENT_ERROR', { label, path });
+    }
+    return parseHex(content, expectedBytes, label);
+}
+/**
+ * Writes an exported secret to a new file, created exclusively (O_CREAT|O_EXCL,
+ * mode 0600). The exclusive flag refuses to clobber an existing file or follow
+ * a pre-placed symlink, so the secret never lands in a loose-permissions or
+ * redirected target.
+ */
+function writeSecretFile(path, contents) {
+    let fd;
+    try {
+        fd = openSync(path, 'wx', 0o600);
+    }
+    catch (error) {
+        if (error.code === 'EEXIST') {
+            throw new CLIError(`Refusing to overwrite existing file ${path}. Choose a new --out path.`, 'INVALID_ARGUMENT_ERROR', { path });
+        }
+        throw error;
+    }
+    try {
+        writeFileSync(fd, contents);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=key.js.map

package/dist/esm/src/commands/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../../../src/commands/key.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEhE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE3E,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAC7F,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,GAAG;SACA,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,eAAe,EAAE,uEAAuE,CAAC;SAChG,MAAM,CAAC,cAAc,EAAE,2BAA2B,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,CAAC,OAA+C,EAAE,EAAE;QAC1D,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACrG,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7H,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClD,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC;QAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YACnC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC/B,OAAO;gBACL,KAAK,EAAS,EAAE;gBAChB,WAAW,EAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE;gBACvC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClD,MAAM,EAAQ,EAAE,KAAK,MAAM;aAC5B,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,kEAAkE,CAAC;SAC/E,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAClD,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IACtI,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,sBAAsB,EAAE,wDAAwD,CAAC;SACxF,MAAM,CAAC,gBAAgB,EAAE,+DAA+D,CAAC;SACzF,MAAM,CAAC,eAAe,EAAE,yCAAyC,CAAC;SAClE,MAAM,CAAC,cAAc,EAAE,2BAA2B,EAAE,KAAK,CAAC;SAC1D,MAAM,CAAC,CAAC,OAAqF,EAAE,EAAE;QAChG,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAAC,mDAAmD,EAAE,wBAAwB,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU;YAChC,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC;YACzF,CAAC,CAAC,IAAI,cAAc,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;QAC7C,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;QACzG,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3J,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,iFAAiF,CAAC;SAC9F,MAAM,CAAC,UAAU,EAAE,wCAAwC,EAAE,KAAK,CAAC;SACnE,MAAM,CAAC,cAAc,EAAE,wDAAwD,CAAC;SAChF,MAAM,CAAC,CAAC,GAAW,EAAE,OAA2C,EAAE,EAAE;QACnE,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACtG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YACjB,MAAM,IAAI,QAAQ,CAAC,gFAAgF,EAAE,wBAAwB,CAAC,CAAC;QACjI,CAAC;QACD,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,6CAA6C,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kGAAkG,CAAC,CAAC;QACzH,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAClE,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrF,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,cAAc,CAAC;SACvB,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,SAAS,EAAE,sCAAsC,EAAE,KAAK,CAAC;SAChE,MAAM,CAAC,CAAC,GAAW,EAAE,OAA4B,EAAE,EAAE;QACpD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,KAAK,EAAE,CAAC,CAAC;QACzD,KAAK,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEL,GAAG;SACA,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,CAAC,GAAW,EAAE,EAAE;QACtB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3C,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;AACP,CAAC;AAED,2DAA2D;AAC3D,SAAS,mBAAmB,CAAC,GAAe,EAAE,IAAa;IACzD,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,QAAQ,CAAC,gBAAgB,IAAI,mBAAmB,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED,wDAAwD;AACxD,SAAS,QAAQ,CAAC,GAAW,EAAE,aAAqB,EAAE,KAAa;IACjE,IAAI,KAAiB,CAAC;IACtB,IAAI,CAAC;QACH,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,mBAAmB,KAAK,GAAG,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAChB,GAAG,KAAK,YAAY,aAAa,WAAW,aAAa,GAAG,CAAC,oBAAoB,KAAK,CAAC,MAAM,GAAG,EAChG,wBAAwB,EACxB,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,SAAS,WAAW,CAAC,IAAY,EAAE,aAAqB,EAAE,KAAa;IACrE,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,eAAe,KAAK,OAAO,IAAI,GAAG,EAAE,wBAAwB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,QAAQ,CAAC,OAAO,EAAE,aAAa,EAAE,KAAK,CAAC,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACrD,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA2B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,QAAQ,CAAC,uCAAuC,IAAI,4BAA4B,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClI,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,aAAa,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,EAAE,CAAC,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/esm/src/commands/profile.js

@@ -0,0 +1,63 @@
+import { defaultConfigPath, readConfigFile, writeConfigFile } from '../config.js';
+import { CLIError } from '../error.js';
+import { formatResult } from '../output.js';
+/** Registers the `profile` command group for managing configuration profiles. */
+export function registerProfileCommand(program, globals) {
+    const profile = program.command('profile').description('Manage configuration profiles.');
+    const path = () => globals().config ?? defaultConfigPath();
+    const print = (result) => console.log(formatResult(result, globals()));
+    profile
+        .command('add <name>')
+        .description('Add an empty profile.')
+        .action((name) => {
+        writeConfigFile(path(), raw => {
+            if (raw.profiles === undefined || raw.profiles === null)
+                raw.profiles = {};
+            const profiles = raw.profiles;
+            if (profiles[name])
+                throw new CLIError(`Profile "${name}" already exists.`, 'INVALID_ARGUMENT_ERROR', { name });
+            profiles[name] = {};
+        });
+        print({ action: 'profile-add', data: { profile: name } });
+    });
+    profile
+        .command('use <name>')
+        .description('Set the active profile (writes defaults.profile).')
+        .action((name) => {
+        writeConfigFile(path(), raw => {
+            if (raw.defaults === undefined || raw.defaults === null)
+                raw.defaults = {};
+            raw.defaults.profile = name;
+        });
+        print({ action: 'profile-use', data: { profile: name } });
+    });
+    profile
+        .command('show [name]')
+        .description('Show a profile (defaults to the active profile).')
+        .action((name) => {
+        const file = readConfigFile(path()) ?? {};
+        const target = name ?? file.defaults?.profile;
+        if (!target) {
+            throw new CLIError('No profile specified and no active profile is set.', 'INVALID_ARGUMENT_ERROR');
+        }
+        const data = file.profiles?.[target];
+        if (!data) {
+            throw new CLIError(`Profile "${target}" not found.`, 'INVALID_ARGUMENT_ERROR', { profile: target });
+        }
+        print({ action: 'profile-show', data: { profile: target, ...data } });
+    });
+    profile
+        .command('remove <name>')
+        .alias('rm')
+        .description('Remove a profile.')
+        .action((name) => {
+        writeConfigFile(path(), raw => {
+            const profiles = raw.profiles;
+            if (!profiles?.[name])
+                throw new CLIError(`Profile "${name}" not found.`, 'INVALID_ARGUMENT_ERROR', { name });
+            delete profiles[name];
+        });
+        print({ action: 'profile-remove', data: { profile: name } });
+    });
+}
+//# sourceMappingURL=profile.js.map

package/dist/esm/src/commands/profile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.js","sourceRoot":"","sources":["../../../../src/commands/profile.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,iFAAiF;AACjF,MAAM,UAAU,sBAAsB,CAAC,OAAgB,EAAE,OAA4B;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAC;IACzF,MAAM,IAAI,GAAG,GAAW,EAAE,CAAC,OAAO,EAAE,CAAC,MAAM,IAAI,iBAAiB,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,CAAC,MAAqB,EAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IAE5F,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,uBAAuB,CAAC;SACpC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;YAC3E,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAmC,CAAC;YACzD,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChH,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,mDAAmD,CAAC;SAChE,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,IAAI;gBAAE,GAAG,CAAC,QAAQ,GAAG,EAAE,CAAC;YAC1E,GAAG,CAAC,QAAoC,CAAC,OAAO,GAAG,IAAI,CAAC;QAC3D,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,CAAC,IAAa,EAAE,EAAE;QACxB,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,QAAQ,CAAC,oDAAoD,EAAE,wBAAwB,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,QAAQ,CAAC,YAAY,MAAM,cAAc,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,eAAe,CAAC;SACxB,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,eAAe,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,EAAE;YAC5B,MAAM,QAAQ,GAAG,GAAG,CAAC,QAA+C,CAAC;YACrE,IAAI,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,cAAc,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9G,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/esm/src/commands/update.js

@@ -1,5 +1,8 @@
+import { KeyManagerSigner } from '@did-btcr2/key-manager';
 import { deriveNetwork } from '../config.js';
 import { CLIError } from '../error.js';
+import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
+import { formatResult } from '../output.js';
 export function registerUpdateCommand(program, factory, globals) {
     program
         .command('update')
@@ -10,6 +13,9 @@ export function registerUpdateCommand(program, factory, globals) {
         .requiredOption('-m, --verification-method-id <id>', 'DID document verification method ID')
         .requiredOption('-b, --beacon-id <json>', 'Beacon ID as a JSON string', parseJsonArg('--beacon-id'))
         .action(async (options) => {
+        if (!/^\d+$/.test(options.sourceVersionId)) {
+            throw new CLIError('--source-version-id must be a non-negative integer.', 'INVALID_ARGUMENT_ERROR', { value: options.sourceVersionId });
+        }
         const parsed = {
             sourceDocument: options.sourceDocument,
             patches: options.patches,
@@ -21,15 +27,19 @@ export function registerUpdateCommand(program, factory, globals) {
         if (!did) {
             throw new CLIError('Source document must contain an "id" field.', 'INVALID_ARGUMENT_ERROR', options);
         }
-        // The CLI does not yet have a way to load signing material (keystore,
-        // KMS config, hardware wallet, etc.), so signed updates from the CLI are
-        // not yet wired up. Drive the SDK directly with a `Signer` for now.
-        // Variables above are kept so command parsing + validation still works.
-        void deriveNetwork(did);
-        void factory;
-        void globals;
-        void parsed;
-        throw new CLIError('CLI signing is not yet implemented. Use @did-btcr2/api with a Signer directly.', 'NOT_IMPLEMENTED_ERROR', { command: 'update' });
+        const network = deriveNetwork(did);
+        const api = factory(network, globals());
+        const keyId = resolveKeyRef(api.kms.kms, globals().signingKey);
+        const signer = new KeyManagerSigner(api.kms.kms, keyId);
+        const data = await api.btcr2.update({
+            sourceDocument: parsed.sourceDocument,
+            patches: parsed.patches,
+            sourceVersionId: parsed.sourceVersionId,
+            verificationMethodId: parsed.verificationMethodId,
+            beaconId: parsed.beaconId,
+            signer,
+        });
+        console.log(formatResult({ action: 'update', data }, globals()));
     });
 }
 /**

package/dist/esm/src/commands/update.js.map

@@ -1 +1 @@
-{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/commands/update.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAGvC,MAAM,UAAU,qBAAqB,CACnC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,cAAc,CACb,8BAA8B,EAC9B,oCAAoC,EACpC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,+BAA+B,CAChC;SACA,cAAc,CACb,sBAAsB,EACtB,8CAA8C,EAC9C,YAAY,CAAC,WAAW,CAAC,CAC1B;SACA,cAAc,CACb,mCAAmC,EACnC,qCAAqC,CACtC;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,OAAO,CAAC,OAA0C;YACzE,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,sEAAsE;QACtE,yEAAyE;QACzE,oEAAoE;QACpE,wEAAwE;QACxE,KAAK,aAAa,CAAC,GAAG,CAAC,CAAC;QACxB,KAAK,OAAO,CAAC;QACb,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,MAAM,IAAI,QAAQ,CAChB,gFAAgF,EAChF,uBAAuB,EACvB,EAAE,OAAO,EAAE,QAAQ,EAAE,CACtB,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,aAAa,EAAmB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAC;AAC/D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAG5C,MAAM,UAAU,qBAAqB,CACnC,OAAiB,EACjB,OAAoB,EACpB,OAA6B;IAE7B,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8BAA8B,CAAC;SAC3C,cAAc,CACb,8BAA8B,EAC9B,oCAAoC,EACpC,YAAY,CAAC,mBAAmB,CAAC,CAClC;SACA,cAAc,CACb,8BAA8B,EAC9B,+BAA+B,CAChC;SACA,cAAc,CACb,sBAAsB,EACtB,8CAA8C,EAC9C,YAAY,CAAC,WAAW,CAAC,CAC1B;SACA,cAAc,CACb,mCAAmC,EACnC,qCAAqC,CACtC;SACA,cAAc,CACb,wBAAwB,EACxB,4BAA4B,EAC5B,YAAY,CAAC,aAAa,CAAC,CAC5B;SACA,MAAM,CAAC,KAAK,EAAE,OAMd,EAAE,EAAE;QACH,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,QAAQ,CAChB,qDAAqD,EACrD,wBAAwB,EACxB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE,CACnC,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAyB;YACnC,cAAc,EAAS,OAAO,CAAC,cAAwD;YACvF,OAAO,EAAgB,OAAO,CAAC,OAA0C;YACzE,eAAe,EAAQ,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC;YACtD,oBAAoB,EAAG,OAAO,CAAC,oBAAoB;YACnD,QAAQ,EAAe,OAAO,CAAC,QAA4C;SAC5E,CAAC;QACF,MAAM,GAAG,GAAG,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,QAAQ,CAChB,6CAA6C,EAC7C,wBAAwB,EACxB,OAAO,CACR,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,UAAU,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC;YAClC,cAAc,EAAS,MAAM,CAAC,cAAc;YAC5C,OAAO,EAAgB,MAAM,CAAC,OAAO;YACrC,eAAe,EAAQ,MAAM,CAAC,eAAe;YAC7C,oBAAoB,EAAG,MAAM,CAAC,oBAAoB;YAClD,QAAQ,EAAe,MAAM,CAAC,QAAQ;YACtC,MAAM;SACP,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,QAAgB;IACpC,OAAO,CAAC,KAAa,EAAW,EAAE;QAChC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,QAAQ,CAChB,oBAAoB,QAAQ,gCAAgC,EAC5D,wBAAwB,EACxB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACpB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/esm/src/config.js

@@ -1,9 +1,59 @@
 import { createApi, Identifier } from '@did-btcr2/api';
 import { readFileSync } from 'node:fs';
 import { homedir } from 'node:os';
-import { join } from 'node:path';
+import { dirname, join } from 'node:path';
 import { CLIError } from './error.js';
+import { ensureDir, writeFileAtomic } from './keystore/atomic.js';
+import { FileBackedKeyManager } from './keystore/file-backed-key-manager.js';
+import { defaultKeystorePath } from './keystore/paths.js';
+import { acquirePassphrase } from './keystore/passphrase.js';
 import { SUPPORTED_NETWORKS } from './types.js';
+/** Current config-file schema version, stamped on every write. */
+export const CONFIG_SCHEMA_VERSION = 1;
+/**
+ * Read-modify-write a config file, preserving unknown keys. Reads the raw JSON
+ * (so keys outside {@link ConfigFile} survive a rewrite), applies `mutate`,
+ * stamps the schema version, and writes atomically (file 0600, dir 0700).
+ */
+export function writeConfigFile(path, mutate) {
+    const raw = readConfigFile(path) ?? {};
+    mutate(raw);
+    raw.schemaVersion = CONFIG_SCHEMA_VERSION;
+    ensureDir(dirname(path), 0o700);
+    writeFileAtomic(path, `${JSON.stringify(raw, null, 2)}\n`, 0o600);
+}
+/** Reads the value at a dotted path (e.g. `profiles.regtest.btc.rest`). */
+export function getConfigPath(config, path) {
+    return path.split('.').reduce((node, key) => node?.[key], config);
+}
+/** Sets the value at a dotted path, creating intermediate objects. */
+export function setConfigPath(config, path, value) {
+    const keys = path.split('.');
+    const last = keys.pop();
+    if (!last)
+        throw new CLIError('Config path must be non-empty.', 'INVALID_ARGUMENT_ERROR');
+    let node = config;
+    for (const key of keys) {
+        if (typeof node[key] !== 'object' || node[key] === null)
+            node[key] = {};
+        node = node[key];
+    }
+    node[last] = value;
+}
+/** Deletes the value at a dotted path. No-op if the path does not exist. */
+export function unsetConfigPath(config, path) {
+    const keys = path.split('.');
+    const last = keys.pop();
+    if (!last)
+        return;
+    let node = config;
+    for (const key of keys) {
+        node = node?.[key];
+        if (!node)
+            return;
+    }
+    delete node[last];
+}
 /**
  * Environment variable names consulted by {@link defaultApiFactory}.
  *
@@ -80,23 +130,43 @@ export function profileToOverrides(config, profileName) {
     };
 }
 /**
- * Default {@link ApiFactory} backed by network defaults from
- * `@did-btcr2/bitcoin` (mempool.space for public networks, localhost for
- * regtest).
+ * Resolves the default Bitcoin network for offline identifier creation when no
+ * `--network` flag is given. Resolution order: the config file's
+ * `defaults.network`, then an active profile named for a network (an explicit
+ * `--profile` flag or `defaults.profile`), then `regtest` as the development
+ * fallback. Generation itself is offline; this only fixes which network the
+ * identifier encodes.
+ */
+export function resolveDefaultNetwork(overrides) {
+    const configPath = overrides?.config ?? defaultConfigPath();
+    const file = readConfigFile(configPath);
+    const explicit = file?.defaults?.network;
+    if (explicit && SUPPORTED_NETWORKS.includes(explicit))
+        return explicit;
+    const profile = overrides?.profile ?? file?.defaults?.profile;
+    if (profile && SUPPORTED_NETWORKS.includes(profile)) {
+        return profile;
+    }
+    return 'regtest';
+}
+/**
+ * Resolves the Bitcoin and CAS connection config for a network by merging,
+ * in precedence order, CLI flags, environment variables, and the config-file
+ * profile on top of the per-network defaults (handled by `BitcoinConnection`).
  *
- * Override precedence (highest wins):
- * CLI flags -> env vars -> config file profile -> network defaults.
+ * Returns an empty config when no network is given, since offline operations
+ * (create, key management) need no connection.
  *
- * When no `--profile` is given, the network name is used as the profile
- * key (e.g. a regtest DID auto-selects the `"regtest"` profile).
+ * When no `--profile` is given, the network name is used as the profile key
+ * (e.g. a regtest DID auto-selects the `"regtest"` profile).
  */
-export function defaultApiFactory(network, overrides) {
+function resolveConnectionConfig(network, overrides) {
     if (!network)
-        return createApi();
+        return {};
     // Layer 1: Config file profile (lowest precedence of the three override layers)
     const configPath = overrides?.config ?? defaultConfigPath();
-    const profileName = overrides?.profile ?? network;
     const file = readConfigFile(configPath);
+    const profileName = overrides?.profile ?? file?.defaults?.profile ?? network;
     const fileOverrides = file ? profileToOverrides(file, profileName) : {};
     // Layer 2: Environment variables
     const env = readEnvOverrides();
@@ -120,7 +190,44 @@ export function defaultApiFactory(network, overrides) {
         };
     }
     const cas = merged.casGateway ? { gateway: merged.casGateway } : undefined;
-    return createApi({ btc, ...(cas && { cas }) });
+    return { btc, ...(cas && { cas }) };
+}
+/**
+ * Default {@link ApiFactory} backed by network defaults from
+ * `@did-btcr2/bitcoin` (mempool.space for public networks, localhost for
+ * regtest). Keystore-free: suitable for offline `create` and read-only
+ * `resolve`, which never need a signing identity.
+ *
+ * Override precedence (highest wins):
+ * CLI flags -> env vars -> config file profile -> network defaults.
+ */
+export function defaultApiFactory(network, overrides) {
+    return createApi(resolveConnectionConfig(network, overrides));
+}
+/**
+ * Builds a keystore-backed {@link KeyManager} reading secret keys from the
+ * encrypted on-disk keystore. The passphrase is acquired lazily, so building
+ * this never prompts; a prompt happens only when a secret is actually sealed
+ * or opened. The persisted active-key pointer is re-applied (a non-decrypting
+ * existence check) so "the active key" survives across invocations.
+ */
+function buildKeystoreKms(overrides) {
+    return new FileBackedKeyManager({
+        path: overrides?.keystore ?? defaultKeystorePath(),
+        getPassphrase: () => acquirePassphrase({ passphraseFile: overrides?.passphraseFile }),
+    });
+}
+/**
+ * Keystore-aware {@link ApiFactory} for commands that need a signing identity
+ * (key management, update, deactivate). Identical to {@link defaultApiFactory}
+ * for Bitcoin and CAS, plus an injected keystore-backed KeyManager. Offline key
+ * commands (no network) still get the keystore.
+ */
+export function keystoreApiFactory(network, overrides) {
+    return createApi({
+        ...resolveConnectionConfig(network, overrides),
+        kms: buildKeystoreKms(overrides),
+    });
 }
 /**
  * Extracts and validates the Bitcoin network from a DID string.

package/dist/esm/src/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAA2C,MAAM,gBAAgB,CAAC;AAChG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,kBAAkB,EAAsB,MAAM,YAAY,CAAC;AAoEpE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,QAAQ,EAAO,gBAAgB;IAC/B,WAAW,EAAI,mBAAmB;IAClC,YAAY,EAAG,oBAAoB;IACnC,YAAY,EAAG,oBAAoB;IACnC,WAAW,EAAI,mBAAmB;CAC1B,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IAC/E,OAAO;QACL,OAAO,EAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,SAAS,EAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtC,UAAU,EAAG,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QACvC,UAAU,EAAG,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QACvC,UAAU,EAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;WACnC,OAAO,CAAC,GAAG,CAAC,OAAO;WACnB,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAwB,EACxB,WAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO;QACL,OAAO,EAAM,OAAO,CAAC,GAAG,EAAE,IAAI;QAC9B,SAAS,EAAI,OAAO,CAAC,GAAG,EAAE,MAAM;QAChC,UAAU,EAAG,OAAO,CAAC,GAAG,EAAE,OAAO;QACjC,UAAU,EAAG,OAAO,CAAC,GAAG,EAAE,OAAO;QACjC,UAAU,EAAG,OAAO,CAAC,GAAG,EAAE,OAAO;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB,EAAE,SAA+B;IACxF,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,EAAE,CAAC;IAEjC,gFAAgF;IAChF,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC5D,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,IAAI,OAAO,CAAC;IAClD,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,iCAAiC;IACjC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAE/B,iGAAiG;IACjG,MAAM,MAAM,GAAwB;QAClC,OAAO,EAAM,SAAS,EAAE,OAAO,IAAO,GAAG,CAAC,OAAO,IAAO,aAAa,CAAC,OAAO;QAC7E,SAAS,EAAI,SAAS,EAAE,SAAS,IAAK,GAAG,CAAC,SAAS,IAAK,aAAa,CAAC,SAAS;QAC/E,UAAU,EAAG,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;QAChF,UAAU,EAAG,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;QAChF,UAAU,EAAG,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;KACjF,CAAC;IAEF,MAAM,GAAG,GAAqB,EAAE,OAAO,EAAE,CAAC;IAE1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,GAAG;YACR,IAAI,EAAO,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAG,MAAM,CAAC,UAAU;YAC5B,QAAQ,EAAG,MAAM,CAAC,UAAU;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,OAAO,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;AACjD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAwB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAChB,wBAAwB,OAAO,WAAW,EAC1C,wBAAwB,EACxB,EAAE,GAAG,EAAE,OAAO,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,OAAwB,CAAC;AAClC,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAA2C,MAAM,gBAAgB,CAAC;AAEhG,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAyC,MAAM,YAAY,CAAC;AAiFvF,kEAAkE;AAClE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEvC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAA8C;IAC1F,MAAM,GAAG,GAA6B,cAAc,CAAC,IAAI,CAAyC,IAAI,EAAE,CAAC;IACzG,MAAM,CAAC,GAAG,CAAC,CAAC;IACZ,GAAG,CAAC,aAAa,GAAG,qBAAqB,CAAC;IAC1C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,eAAe,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACpE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,aAAa,CAAC,MAA+B,EAAE,IAAY;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAC3B,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAE,IAA4C,EAAE,CAAC,GAAG,CAAC,EACnE,MAAM,CACP,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa,CAAC,MAA+B,EAAE,IAAY,EAAE,KAAc;IACzF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,QAAQ,CAAC,gCAAgC,EAAE,wBAAwB,CAAC,CAAC;IAC1F,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QACxE,IAAI,GAAG,IAAI,CAAC,GAAG,CAA4B,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACrB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,MAA+B,EAAE,IAAY;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,IAAI,GAAwC,MAAM,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,IAAI,EAAE,CAAC,GAAG,CAAwC,CAAC;QAC1D,IAAI,CAAC,IAAI;YAAE,OAAO;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;AACpB,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,QAAQ,EAAO,gBAAgB;IAC/B,WAAW,EAAI,mBAAmB;IAClC,YAAY,EAAG,oBAAoB;IACnC,YAAY,EAAG,oBAAoB;IACnC,WAAW,EAAI,mBAAmB;CAC1B,CAAC;AAEX;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,GAAG,CAAC,GAAW,EAAsB,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;IAC/E,OAAO;QACL,OAAO,EAAM,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,SAAS,EAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;QACtC,UAAU,EAAG,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QACvC,UAAU,EAAG,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;QACvC,UAAU,EAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC;KACvC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB;IAC/B,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe;WACnC,OAAO,CAAC,GAAG,CAAC,OAAO;WACnB,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAe,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAwB,EACxB,WAAoB;IAEpB,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IACxB,OAAO;QACL,OAAO,EAAM,OAAO,CAAC,GAAG,EAAE,IAAI;QAC9B,SAAS,EAAI,OAAO,CAAC,GAAG,EAAE,MAAM;QAChC,UAAU,EAAG,OAAO,CAAC,GAAG,EAAE,OAAO;QACjC,UAAU,EAAG,OAAO,CAAC,GAAG,EAAE,OAAO;QACjC,UAAU,EAAG,OAAO,CAAC,GAAG,EAAE,OAAO;KAClC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,SAA+B;IACnE,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IAExC,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;IACzC,IAAI,QAAQ,IAAI,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvE,MAAM,OAAO,GAAG,SAAS,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC;IAC9D,IAAI,OAAO,IAAI,kBAAkB,CAAC,QAAQ,CAAC,OAAwB,CAAC,EAAE,CAAC;QACrE,OAAO,OAAwB,CAAC;IAClC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,uBAAuB,CAC9B,OAAyB,EACzB,SAA+B;IAE/B,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAExB,gFAAgF;IAChF,MAAM,UAAU,GAAG,SAAS,EAAE,MAAM,IAAI,iBAAiB,EAAE,CAAC;IAC5D,MAAM,IAAI,GAAG,cAAc,CAAC,UAAU,CAAC,CAAC;IACxC,MAAM,WAAW,GAAG,SAAS,EAAE,OAAO,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,IAAI,OAAO,CAAC;IAC7E,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,iCAAiC;IACjC,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAE/B,iGAAiG;IACjG,MAAM,MAAM,GAAwB;QAClC,OAAO,EAAM,SAAS,EAAE,OAAO,IAAO,GAAG,CAAC,OAAO,IAAO,aAAa,CAAC,OAAO;QAC7E,SAAS,EAAI,SAAS,EAAE,SAAS,IAAK,GAAG,CAAC,SAAS,IAAK,aAAa,CAAC,SAAS;QAC/E,UAAU,EAAG,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;QAChF,UAAU,EAAG,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;QAChF,UAAU,EAAG,SAAS,EAAE,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,aAAa,CAAC,UAAU;KACjF,CAAC;IAEF,MAAM,GAAG,GAAqB,EAAE,OAAO,EAAE,CAAC;IAE1C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IACtC,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,GAAG,GAAG;YACR,IAAI,EAAO,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAG,MAAM,CAAC,UAAU;YAC5B,QAAQ,EAAG,MAAM,CAAC,UAAU;SAC7B,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAE3E,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB,EAAE,SAA+B;IACxF,OAAO,SAAS,CAAC,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,gBAAgB,CAAC,SAA+B;IACvD,OAAO,IAAI,oBAAoB,CAAC;QAC9B,IAAI,EAAY,SAAS,EAAE,QAAQ,IAAI,mBAAmB,EAAE;QAC5D,aAAa,EAAG,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;KACvF,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAuB,EAAE,SAA+B;IACzF,OAAO,SAAS,CAAC;QACf,GAAG,uBAAuB,CAAC,OAAO,EAAE,SAAS,CAAC;QAC9C,GAAG,EAAG,gBAAgB,CAAC,SAAS,CAAC;KAClC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,OAAwB,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAChB,wBAAwB,OAAO,WAAW,EAC1C,wBAAwB,EACxB,EAAE,GAAG,EAAE,OAAO,EAAE,CACjB,CAAC;IACJ,CAAC;IACD,OAAO,OAAwB,CAAC;AAClC,CAAC"}

package/dist/esm/src/keystore/atomic.js

@@ -0,0 +1,64 @@
+import { chmodSync, mkdirSync, renameSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { KeyStoreError } from './error.js';
+const isWindows = process.platform === 'win32';
+let permsWarned = false;
+let tmpCounter = 0;
+/**
+ * Creates a directory (recursively) and, on POSIX systems, tightens it to the
+ * requested mode. `mkdir`'s mode is subject to the umask, so it is reapplied
+ * with an explicit `chmod`.
+ */
+export function ensureDir(dir, mode) {
+    mkdirSync(dir, { recursive: true, mode });
+    if (!isWindows) {
+        try {
+            chmodSync(dir, mode);
+        }
+        catch {
+            // A pre-existing directory we do not own cannot be re-moded; best effort.
+        }
+    }
+}
+/**
+ * Writes a file atomically: serialize to a sibling temporary file, tighten its
+ * permissions, then rename over the target so a crash mid-write cannot leave a
+ * truncated or partially-written file. The temporary file is removed on failure.
+ */
+export function writeFileAtomic(path, data, mode) {
+    const tmp = join(dirname(path), `.${basename(path)}.${process.pid}.${tmpCounter++}.tmp`);
+    try {
+        writeFileSync(tmp, data, { mode });
+        if (!isWindows)
+            chmodSync(tmp, mode);
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        try {
+            rmSync(tmp, { force: true });
+        }
+        catch {
+            // Ignore cleanup failure; surface the original write error.
+        }
+        throw new KeyStoreError(`Failed to write keystore at ${path}.`, 'ATOMIC_WRITE_ERROR', { path, cause: error instanceof Error ? error.message : String(error) });
+    }
+}
+/**
+ * Fails closed if a keystore file is readable or writable by group or other.
+ * On Windows, where POSIX mode bits are not enforced, this is a no-op that
+ * warns once on standard error.
+ */
+export function assertSecurePerms(path) {
+    if (isWindows) {
+        if (!permsWarned) {
+            process.stderr.write('warning: file permissions are not enforced on Windows; protect the keystore directory manually.\n');
+            permsWarned = true;
+        }
+        return;
+    }
+    const mode = statSync(path).mode & 0o777;
+    if ((mode & 0o077) !== 0) {
+        throw new KeyStoreError(`Keystore at ${path} has insecure permissions 0${mode.toString(8)}; expected 0600.`, 'KEYSTORE_PERMISSION_ERROR', { path, mode: `0${mode.toString(8)}` });
+    }
+}
+//# sourceMappingURL=atomic.js.map

package/dist/esm/src/keystore/atomic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic.js","sourceRoot":"","sources":["../../../../src/keystore/atomic.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC5F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3C,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;AAC/C,IAAI,WAAW,GAAG,KAAK,CAAC;AACxB,IAAI,UAAU,GAAG,CAAC,CAAC;AAEnB;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY;IACjD,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,IAAI,CAAC;YACH,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACvB,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;QAC5E,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnC,IAAI,CAAC,SAAS;YAAE,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACrC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,4DAA4D;QAC9D,CAAC;QACD,MAAM,IAAI,aAAa,CACrB,+BAA+B,IAAI,GAAG,EACtC,oBAAoB,EACpB,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,mGAAmG,CACpG,CAAC;YACF,WAAW,GAAG,IAAI,CAAC;QACrB,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;IACzC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,aAAa,CACrB,eAAe,IAAI,8BAA8B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,EACnF,2BAA2B,EAC3B,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC;IACJ,CAAC;AACH,CAAC"}