@did-btcr2/cli 0.10.3 → 0.12.0

package/dist/types/src/commands/create.d.ts

@@ -1,5 +1,23 @@
 import type { Command } from 'commander';
 import type { ApiFactory } from '../config.js';
 import type { GlobalOptions } from '../types.js';
-export declare function registerCreateCommand(program: Command, factory: ApiFactory, globals: () => GlobalOptions): void;
+/**
+ * Registers the `create` command.
+ *
+ * A deterministic (`-t k`) identifier has three mutually-exclusive input modes,
+ * selected by which is present:
+ * - generate (neither `--bytes` nor `--signing-key`): mint a fresh key, persist
+ *   it to the keystore, set it active, and print the identifier. Sealing the
+ *   secret prompts for the keystore passphrase.
+ * - existing (`--signing-key <ref>`): use a stored key's public key as the
+ *   genesis bytes. Reading a public key never decrypts, so this never prompts.
+ * - raw (`--bytes <hex>`): a 33-byte public key as hex. Offline, keystore-free.
+ *
+ * An external (`-t x`) identifier is raw-bytes-only: a 32-byte genesis-document
+ * hash via `--bytes`. Generation and `--signing-key` apply only to `-t k`.
+ *
+ * The keystore-free `factory` serves the raw-bytes path; the keystore-aware
+ * `keystoreFactory` serves the generate and existing-key paths.
+ */
+export declare function registerCreateCommand(program: Command, factory: ApiFactory, keystoreFactory: ApiFactory, globals: () => GlobalOptions): void;
 //# sourceMappingURL=create.d.ts.map

package/dist/types/src/commands/create.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/commands/create.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,KAAK,EAEV,aAAa,EACC,MAAM,aAAa,CAAC;AAWpC,wBAAgB,qBAAqB,CACnC,OAAO,EAAG,OAAO,EACjB,OAAO,EAAG,UAAU,EACpB,OAAO,EAAG,MAAM,aAAa,GAC5B,IAAI,CAwBN"}
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../../src/commands/create.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAuB,MAAM,cAAc,CAAC;AAKpE,OAAO,KAAK,EAAiB,aAAa,EAAiB,MAAM,aAAa,CAAC;AAS/E;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAW,OAAO,EACzB,OAAO,EAAW,UAAU,EAC5B,eAAe,EAAG,UAAU,EAC5B,OAAO,EAAW,MAAM,aAAa,GACpC,IAAI,CA2FN"}

package/dist/types/src/commands/deactivate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deactivate.d.ts","sourceRoot":"","sources":["../../../../src/commands/deactivate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAKvE,wBAAgB,yBAAyB,CACvC,OAAO,EAAG,OAAO,EACjB,OAAO,EAAG,UAAU,EACpB,OAAO,EAAG,MAAM,aAAa,GAC5B,IAAI,CAyDN"}
+{"version":3,"file":"deactivate.d.ts","sourceRoot":"","sources":["../../../../src/commands/deactivate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAKvE,wBAAgB,yBAAyB,CACvC,OAAO,EAAG,OAAO,EACjB,OAAO,EAAG,UAAU,EACpB,OAAO,EAAG,MAAM,aAAa,GAC5B,IAAI,CAmEN"}

package/dist/types/src/commands/index.d.ts

@@ -2,4 +2,8 @@ export { registerCreateCommand } from './create.js';
 export { registerResolveCommand } from './resolve.js';
 export { registerUpdateCommand } from './update.js';
 export { registerDeactivateCommand } from './deactivate.js';
+export { registerKeyCommand } from './key.js';
+export { registerConfigCommand } from './config.js';
+export { registerProfileCommand } from './profile.js';
+export { registerCompletionCommand } from './completion.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/src/commands/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/types/src/commands/key.d.ts

@@ -0,0 +1,10 @@
+import type { Command } from 'commander';
+import type { ApiFactory } from '../config.js';
+import type { GlobalOptions } from '../types.js';
+/**
+ * Registers the `key` command group for managing keypairs in the encrypted
+ * keystore. All subcommands operate offline (no Bitcoin connection) through the
+ * keystore-backed KeyManager injected by the factory.
+ */
+export declare function registerKeyCommand(program: Command, factory: ApiFactory, globals: () => GlobalOptions): void;
+//# sourceMappingURL=key.d.ts.map

package/dist/types/src/commands/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../../../src/commands/key.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAI/C,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAG,OAAO,EACjB,OAAO,EAAG,UAAU,EACpB,OAAO,EAAG,MAAM,aAAa,GAC5B,IAAI,CAgHN"}

package/dist/types/src/commands/profile.d.ts

@@ -0,0 +1,5 @@
+import type { Command } from 'commander';
+import type { GlobalOptions } from '../types.js';
+/** Registers the `profile` command group for managing configuration profiles. */
+export declare function registerProfileCommand(program: Command, globals: () => GlobalOptions): void;
+//# sourceMappingURL=profile.d.ts.map

package/dist/types/src/commands/profile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"profile.d.ts","sourceRoot":"","sources":["../../../../src/commands/profile.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,aAAa,CAAC;AAEhE,iFAAiF;AACjF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,GAAG,IAAI,CAyD3F"}

package/dist/types/src/commands/update.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/commands/update.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAEvE,wBAAgB,qBAAqB,CACnC,OAAO,EAAG,OAAO,EACjB,OAAO,EAAG,UAAU,EACpB,OAAO,EAAG,MAAM,aAAa,GAC5B,IAAI,CA+DN"}
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../../../../src/commands/update.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAI9D,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,aAAa,CAAC;AAEvE,wBAAgB,qBAAqB,CACnC,OAAO,EAAG,OAAO,EACjB,OAAO,EAAG,UAAU,EACpB,OAAO,EAAG,MAAM,aAAa,GAC5B,IAAI,CAsEN"}

package/dist/types/src/config.d.ts

@@ -1,5 +1,5 @@
 import { type DidBtcr2Api } from '@did-btcr2/api';
-import { type NetworkOption } from './types.js';
+import { type NetworkOption, type OutputFormat } from './types.js';
 /**
  * Endpoint overrides provided via CLI flags, env vars, or config file.
  * These override the per-network defaults from
@@ -16,6 +16,10 @@ export type ConnectionOverrides = {
     casGateway?: string;
     config?: string;
     profile?: string;
+    /** Keystore file path. Overrides the default `$XDG_DATA_HOME/btcr2/keystore.json`. */
+    keystore?: string;
+    /** Path to a file holding the keystore passphrase (for unattended use). */
+    passphraseFile?: string;
 };
 /**
  * On-disk config file schema.
@@ -41,6 +45,14 @@ export type ConnectionOverrides = {
  * ```
  */
 export type ConfigFile = {
+    /** Schema version, stamped on every write for forward compatibility. */
+    schemaVersion?: number;
+    /** Tool-wide defaults applied when not overridden by a flag or environment variable. */
+    defaults?: {
+        profile?: string;
+        network?: NetworkOption;
+        output?: OutputFormat;
+    };
     profiles?: Record<string, {
         btc?: {
             rest?: string;
@@ -51,8 +63,34 @@ export type ConfigFile = {
         cas?: {
             gateway?: string;
         };
+        /** Signing identity references. Never embeds key material; the secret lives in the keystore. */
+        identity?: {
+            keystore?: string;
+            default?: string;
+        };
+        /** Aggregation transport and cohort defaults, mirroring the aggregation runner inputs. */
+        aggregation?: {
+            transport?: 'nostr' | 'http' | 'didcomm';
+            relays?: string[];
+            httpBaseUrl?: string;
+            cohort?: Record<string, unknown>;
+        };
     }>;
 };
+/** Current config-file schema version, stamped on every write. */
+export declare const CONFIG_SCHEMA_VERSION = 1;
+/**
+ * Read-modify-write a config file, preserving unknown keys. Reads the raw JSON
+ * (so keys outside {@link ConfigFile} survive a rewrite), applies `mutate`,
+ * stamps the schema version, and writes atomically (file 0600, dir 0700).
+ */
+export declare function writeConfigFile(path: string, mutate: (raw: Record<string, unknown>) => void): void;
+/** Reads the value at a dotted path (e.g. `profiles.regtest.btc.rest`). */
+export declare function getConfigPath(config: Record<string, unknown>, path: string): unknown;
+/** Sets the value at a dotted path, creating intermediate objects. */
+export declare function setConfigPath(config: Record<string, unknown>, path: string, value: unknown): void;
+/** Deletes the value at a dotted path. No-op if the path does not exist. */
+export declare function unsetConfigPath(config: Record<string, unknown>, path: string): void;
 /**
  * Factory function that creates a configured {@link DidBtcr2Api} instance.
  *
@@ -105,18 +143,32 @@ export declare function readConfigFile(path: string): ConfigFile | undefined;
  * {@link ConfigFile}. Returns an empty object if the profile does not exist.
  */
 export declare function profileToOverrides(config: ConfigFile, profileName: string): ConnectionOverrides;
+/**
+ * Resolves the default Bitcoin network for offline identifier creation when no
+ * `--network` flag is given. Resolution order: the config file's
+ * `defaults.network`, then an active profile named for a network (an explicit
+ * `--profile` flag or `defaults.profile`), then `regtest` as the development
+ * fallback. Generation itself is offline; this only fixes which network the
+ * identifier encodes.
+ */
+export declare function resolveDefaultNetwork(overrides?: ConnectionOverrides): NetworkOption;
 /**
  * Default {@link ApiFactory} backed by network defaults from
  * `@did-btcr2/bitcoin` (mempool.space for public networks, localhost for
- * regtest).
+ * regtest). Keystore-free: suitable for offline `create` and read-only
+ * `resolve`, which never need a signing identity.
  *
  * Override precedence (highest wins):
  * CLI flags -> env vars -> config file profile -> network defaults.
- *
- * When no `--profile` is given, the network name is used as the profile
- * key (e.g. a regtest DID auto-selects the `"regtest"` profile).
  */
 export declare function defaultApiFactory(network?: NetworkOption, overrides?: ConnectionOverrides): DidBtcr2Api;
+/**
+ * Keystore-aware {@link ApiFactory} for commands that need a signing identity
+ * (key management, update, deactivate). Identical to {@link defaultApiFactory}
+ * for Bitcoin and CAS, plus an injected keystore-backed KeyManager. Offline key
+ * commands (no network) still get the keystore.
+ */
+export declare function keystoreApiFactory(network?: NetworkOption, overrides?: ConnectionOverrides): DidBtcr2Api;
 /**
  * Extracts and validates the Bitcoin network from a DID string.
  *

package/dist/types/src/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAKhG,OAAO,EAAsB,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEpE;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAK,MAAM,CAAC;IACpB,SAAS,CAAC,EAAG,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAM,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,MAAM,CAAC;CACrB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB,GAAG,CAAC,EAAE;YACJ,IAAI,CAAC,EAAM,MAAM,CAAC;YAClB,MAAM,CAAC,EAAI,MAAM,CAAC;YAClB,OAAO,CAAC,EAAG,MAAM,CAAC;YAClB,OAAO,CAAC,EAAG,MAAM,CAAC;SACnB,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,KAAK,WAAW,CAAC;AAEnG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ;;;;;;CAMX,CAAC;AAEX;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,mBAAmB,CAStD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAOnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAQ,UAAU,EACxB,WAAW,EAAG,MAAM,GACnB,mBAAmB,CAUrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAsCvG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAUxD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgD,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAUhG,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,MAAM,CAAC,EAAW,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,EAAS,MAAM,CAAC;IACzB,2EAA2E;IAC3E,cAAc,CAAC,EAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB,GAAG,CAAC,EAAE;YACJ,IAAI,CAAC,EAAM,MAAM,CAAC;YAClB,MAAM,CAAC,EAAI,MAAM,CAAC;YAClB,OAAO,CAAC,EAAG,MAAM,CAAC;YAClB,OAAO,CAAC,EAAG,MAAM,CAAC;SACnB,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;QACF,gGAAgG;QAChG,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;QACF,0FAA0F;QAC1F,WAAW,CAAC,EAAE;YACZ,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;YACzC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;YAClB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAMlG;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAUjG;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAUnF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,KAAK,WAAW,CAAC;AAEnG;;;;;;;;;;GAUG;AACH,eAAO,MAAM,QAAQ;;;;;;CAMX,CAAC;AAEX;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,mBAAmB,CAStD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAOnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAQ,UAAU,EACxB,WAAW,EAAG,MAAM,GACnB,mBAAmB,CAUrB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAapF;AAwDD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAEvG;AAgBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAKxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAUxD"}

package/dist/types/src/keystore/atomic.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Creates a directory (recursively) and, on POSIX systems, tightens it to the
+ * requested mode. `mkdir`'s mode is subject to the umask, so it is reapplied
+ * with an explicit `chmod`.
+ */
+export declare function ensureDir(dir: string, mode: number): void;
+/**
+ * Writes a file atomically: serialize to a sibling temporary file, tighten its
+ * permissions, then rename over the target so a crash mid-write cannot leave a
+ * truncated or partially-written file. The temporary file is removed on failure.
+ */
+export declare function writeFileAtomic(path: string, data: string, mode: number): void;
+/**
+ * Fails closed if a keystore file is readable or writable by group or other.
+ * On Windows, where POSIX mode bits are not enforced, this is a no-op that
+ * warns once on standard error.
+ */
+export declare function assertSecurePerms(path: string): void;
+//# sourceMappingURL=atomic.d.ts.map

package/dist/types/src/keystore/atomic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic.d.ts","sourceRoot":"","sources":["../../../../src/keystore/atomic.ts"],"names":[],"mappings":"AAQA;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CASzD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAkB9E;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAkBpD"}

package/dist/types/src/keystore/envelope.d.ts

@@ -0,0 +1,64 @@
+/** Current keystore secret-envelope format version. */
+export declare const ENVELOPE_VERSION: 1;
+/**
+ * argon2id cost parameters. Field names follow RFC 9106: `t` time cost
+ * (passes), `m` memory cost in KiB, `p` parallelism (lanes), `dkLen` derived
+ * key length in bytes.
+ */
+export type ArgonParams = {
+    t: number;
+    m: number;
+    p: number;
+    dkLen: number;
+};
+/**
+ * Production argon2id parameters: 3 passes over 64 MiB across 4 lanes, deriving
+ * a 32-byte key. Recorded in every envelope so the cost can be raised later
+ * without making previously sealed envelopes undecryptable.
+ */
+export declare const DEFAULT_ARGON_PARAMS: ArgonParams;
+/**
+ * A self-describing, versioned envelope sealing one secret at rest. The header
+ * (version, key-derivation parameters, cipher) is bound as the AEAD additional
+ * data, so a tampered header fails authentication. All byte fields are
+ * base64url with no padding.
+ */
+export type SecretEnvelope = {
+    v: typeof ENVELOPE_VERSION;
+    kdf: {
+        alg: 'argon2id';
+        salt: string;
+        t: number;
+        m: number;
+        p: number;
+        dkLen: number;
+    };
+    cipher: 'xchacha20poly1305';
+    nonce: string;
+    ciphertext: string;
+};
+/**
+ * Seals a secret under a passphrase into a {@link SecretEnvelope}. A fresh
+ * random salt and nonce are generated per call, so encrypting the same secret
+ * twice yields different envelopes.
+ *
+ * @param secret - The secret bytes to encrypt. Must be non-empty.
+ * @param passphrase - The passphrase the encryption key is derived from.
+ * @param params - argon2id cost parameters. Defaults to {@link DEFAULT_ARGON_PARAMS}.
+ * @returns The versioned, authenticated envelope.
+ * @throws {KeyStoreError} `ENVELOPE_ENCRYPT_ERROR` when `secret` is empty.
+ */
+export declare function encryptSecret(secret: Uint8Array, passphrase: string, params?: ArgonParams): SecretEnvelope;
+/**
+ * Opens a {@link SecretEnvelope} sealed by {@link encryptSecret} and returns the
+ * plaintext secret. A wrong passphrase, corrupted ciphertext, or a tampered
+ * header all fail authentication and raise `DECRYPT_ERROR`.
+ *
+ * @param env - The envelope to open.
+ * @param passphrase - The passphrase the envelope was sealed with.
+ * @returns The decrypted secret bytes.
+ * @throws {KeyStoreError} `ENVELOPE_VERSION_ERROR` for an unknown version or
+ *   algorithm; `DECRYPT_ERROR` for failed authentication.
+ */
+export declare function decryptSecret(env: SecretEnvelope, passphrase: string): Uint8Array;
+//# sourceMappingURL=envelope.d.ts.map

package/dist/types/src/keystore/envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envelope.d.ts","sourceRoot":"","sources":["../../../../src/keystore/envelope.ts"],"names":[],"mappings":"AAMA,uDAAuD;AACvD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAS3C;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,CAAC,EAAO,MAAM,CAAC;IACf,CAAC,EAAO,MAAM,CAAC;IACf,CAAC,EAAO,MAAM,CAAC;IACf,KAAK,EAAG,MAAM,CAAC;CAChB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,WAAwD,CAAC;AAE5F;;;;;GAKG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,CAAC,EAAK,OAAO,gBAAgB,CAAC;IAC9B,GAAG,EAAG;QACJ,GAAG,EAAK,UAAU,CAAC;QACnB,IAAI,EAAI,MAAM,CAAC;QACf,CAAC,EAAO,MAAM,CAAC;QACf,CAAC,EAAO,MAAM,CAAC;QACf,CAAC,EAAO,MAAM,CAAC;QACf,KAAK,EAAG,MAAM,CAAC;KAChB,CAAC;IACF,MAAM,EAAO,mBAAmB,CAAC;IACjC,KAAK,EAAQ,MAAM,CAAC;IACpB,UAAU,EAAG,MAAM,CAAC;CACrB,CAAC;AA2CF;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAO,UAAU,EACvB,UAAU,EAAG,MAAM,EACnB,MAAM,GAAO,WAAkC,GAC9C,cAAc,CAkBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,GAAG,UAAU,CA4BjF"}

package/dist/types/src/keystore/error.d.ts

@@ -0,0 +1,14 @@
+import { DidMethodError } from '@did-btcr2/common';
+/**
+ * Error raised by the CLI keystore layer: secret-envelope encryption and
+ * decryption, on-disk file permission enforcement, and passphrase acquisition.
+ *
+ * Unlike {@link CLIError} (whose `name` is fixed to `'CLIError'`), this follows
+ * the {@link DidMethodError} sibling convention where `name` mirrors the `type`
+ * code, so a thrown error's `name` reflects the specific failure category
+ * (for example `DECRYPT_ERROR` or `KEYSTORE_PERMISSION_ERROR`).
+ */
+export declare class KeyStoreError extends DidMethodError {
+    constructor(message: string, type?: string, data?: Record<string, any>);
+}
+//# sourceMappingURL=error.d.ts.map

package/dist/types/src/keystore/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../../../src/keystore/error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;;;;GAQG;AACH,qBAAa,aAAc,SAAQ,cAAc;gBACnC,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE,MAAwB,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC;CAGxF"}

package/dist/types/src/keystore/file-backed-key-manager.d.ts

@@ -0,0 +1,41 @@
+import type { Bytes, HashBytes, KeyBytes, SignatureBytes } from '@did-btcr2/common';
+import { type GenerateKeyOptions, type ImportKeyOptions, type KeyIdentifier, type KeyManager, type SignOptions, type VerifyOptions } from '@did-btcr2/key-manager';
+import type { SchnorrKeyPair } from '@did-btcr2/keypair';
+import { type FileKeyStoreOptions } from './file-key-store.js';
+/**
+ * A {@link KeyManager} backed by the encrypted on-disk {@link FileKeyStore}.
+ *
+ * It composes a {@link LocalKeyManager} over a {@link FileKeyStore} and adds the
+ * one thing the store interface cannot express: persisting the active-key
+ * pointer. `LocalKeyManager` tracks the active key only in process memory, so
+ * this wrapper mirrors every active-key change to the keystore file and
+ * re-applies the persisted pointer at construction. Read and signing
+ * operations delegate straight through.
+ *
+ * Injected as the api's KeyManager so every command reaches it uniformly via
+ * `api.kms`, and "the active key" survives across CLI invocations.
+ */
+export declare class FileBackedKeyManager implements KeyManager {
+    #private;
+    /** Capability probe: the local store supports exporting secret material. */
+    readonly canExport = true;
+    constructor(options: FileKeyStoreOptions);
+    get activeKeyId(): KeyIdentifier | undefined;
+    setActiveKey(id: KeyIdentifier): void;
+    importKey(keyPair: SchnorrKeyPair, options?: ImportKeyOptions): KeyIdentifier;
+    generateKey(options?: GenerateKeyOptions): KeyIdentifier;
+    removeKey(id: KeyIdentifier, options?: {
+        force?: boolean;
+    }): void;
+    listKeys(): KeyIdentifier[];
+    getPublicKey(id?: KeyIdentifier): KeyBytes;
+    getEntry(id?: KeyIdentifier): {
+        publicKey: KeyBytes;
+        tags?: Record<string, string>;
+    };
+    sign(data: Bytes, id?: KeyIdentifier, options?: SignOptions): SignatureBytes;
+    verify(signature: SignatureBytes, data: Bytes, id?: KeyIdentifier, options?: VerifyOptions): boolean;
+    digest(data: Uint8Array): HashBytes;
+    exportKey(id: KeyIdentifier): SchnorrKeyPair;
+}
+//# sourceMappingURL=file-backed-key-manager.d.ts.map

package/dist/types/src/keystore/file-backed-key-manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-backed-key-manager.d.ts","sourceRoot":"","sources":["../../../../src/keystore/file-backed-key-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACpF,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAgB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE7E;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAqB,YAAW,UAAU;;IACrD,4EAA4E;IAC5E,QAAQ,CAAC,SAAS,QAAQ;gBAKd,OAAO,EAAE,mBAAmB;IAWxC,IAAI,WAAW,IAAI,aAAa,GAAG,SAAS,CAE3C;IAED,YAAY,CAAC,EAAE,EAAE,aAAa,GAAG,IAAI;IAKrC,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,aAAa;IAM7E,WAAW,CAAC,OAAO,CAAC,EAAE,kBAAkB,GAAG,aAAa;IAMxD,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAMjE,QAAQ,IAAI,aAAa,EAAE;IAI3B,YAAY,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG,QAAQ;IAI1C,QAAQ,CAAC,EAAE,CAAC,EAAE,aAAa,GAAG;QAAE,SAAS,EAAE,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;IAIpF,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,cAAc;IAI5E,MAAM,CAAC,SAAS,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO;IAIpG,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS;IAInC,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,cAAc;CAG7C"}

package/dist/types/src/keystore/file-key-store.d.ts

@@ -0,0 +1,52 @@
+import type { KeyEntry, KeyIdentifier, KeyValueStore } from '@did-btcr2/key-manager';
+import type { ArgonParams } from './envelope.js';
+/** Current on-disk keystore file format version. */
+export declare const KEYSTORE_VERSION: 1;
+/** Options for constructing a {@link FileKeyStore}. */
+export type FileKeyStoreOptions = {
+    /** Keystore file path. Defaults to {@link defaultKeystorePath}. */
+    path?: string;
+    /** Supplies the passphrase lazily, called only when a secret must be sealed or opened. */
+    getPassphrase: () => string;
+    /** argon2id cost parameters used when sealing new secrets. Defaults to {@link DEFAULT_ARGON_PARAMS}. */
+    argonParams?: ArgonParams;
+};
+/**
+ * A Node-only, file-backed {@link KeyValueStore} that encrypts secret keys at
+ * rest. It satisfies the synchronous store contract by caching the parsed file
+ * in memory at construction and flushing the whole file atomically on every
+ * mutation.
+ *
+ * Secrets are materialized only through {@link FileKeyStore.get}. The
+ * {@link FileKeyStore.list} and {@link FileKeyStore.entries} projections omit
+ * secret keys and never decrypt, so enumerating the store never triggers a
+ * passphrase prompt.
+ */
+export declare class FileKeyStore implements KeyValueStore<KeyIdentifier, KeyEntry> {
+    #private;
+    constructor(options: FileKeyStoreOptions);
+    get(id: KeyIdentifier): KeyEntry | undefined;
+    has(id: KeyIdentifier): boolean;
+    set(id: KeyIdentifier, value: KeyEntry): void;
+    delete(id: KeyIdentifier): boolean;
+    clear(): void;
+    /** All stored values with secret keys omitted. Never decrypts, never prompts. */
+    list(): Array<KeyEntry>;
+    /**
+     * All entries as id-value tuples with secret keys omitted. Never decrypts,
+     * never prompts: {@link FileKeyStore.get} is the only secret-materializing
+     * path, so callers that only need identifiers (such as `listKeys`) do not
+     * force a passphrase prompt. This deviates intentionally from the in-memory
+     * store, which returns stored values verbatim.
+     */
+    entries(): Array<[KeyIdentifier, KeyEntry]>;
+    close(): void;
+    /** The persisted active-key identifier, or undefined if none is set. */
+    getActive(): string | undefined;
+    /**
+     * Persists the active-key pointer in the keystore file. Passing undefined
+     * clears it. Throws if the identifier is not a known key.
+     */
+    setActive(id: KeyIdentifier | undefined): void;
+}
+//# sourceMappingURL=file-key-store.d.ts.map

package/dist/types/src/keystore/file-key-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-key-store.d.ts","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIrF,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAIjE,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAwB3C,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,wGAAwG;IACxG,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B,CAAC;AAEF;;;;;;;;;;GAUG;AACH,qBAAa,YAAa,YAAW,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;;gBAO7D,OAAO,EAAE,mBAAmB;IAyExC,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS;IA0B5C,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAI/B,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI;IAa7C,MAAM,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IASlC,KAAK,IAAI,IAAI;IAMb,iFAAiF;IACjF,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;IAIvB;;;;;;OAMG;IACH,OAAO,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAW3C,KAAK,IAAI,IAAI;IAQb,wEAAwE;IACxE,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAO/C"}

package/dist/types/src/keystore/passphrase.d.ts

@@ -0,0 +1,20 @@
+/** Environment variable that supplies the keystore passphrase for unattended use. */
+export declare const ENV_KEYSTORE_PASSPHRASE = "BTCR2_KEYSTORE_PASSPHRASE";
+/** Options controlling how a passphrase is acquired. */
+export type PassphraseOptions = {
+    /** Path to a file whose contents (a trailing newline is trimmed) are the passphrase. */
+    passphraseFile?: string;
+    /** Prompt label shown on a terminal. */
+    prompt?: string;
+    /** When true, prompt twice and require the entries to match (for a new keystore). */
+    confirm?: boolean;
+};
+/**
+ * Acquires a passphrase without ever reading it from a command-line flag value
+ * (which would leak into process listings and shell history). Resolution order:
+ * the {@link ENV_KEYSTORE_PASSPHRASE} environment variable, a passphrase file,
+ * then a non-echoing terminal prompt. Throws if none is available and standard
+ * input is not a terminal.
+ */
+export declare function acquirePassphrase(options?: PassphraseOptions): string;
+//# sourceMappingURL=passphrase.d.ts.map

package/dist/types/src/keystore/passphrase.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passphrase.d.ts","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAyBzE"}

package/dist/types/src/keystore/paths.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Default keystore file path, following the XDG Base Directory Specification's
+ * data directory. Secret key material is data a user accumulates, so it lives
+ * under the data directory, kept separate from the configuration directory used
+ * for portable settings.
+ *
+ * Resolution order:
+ * 1. `$XDG_DATA_HOME/btcr2/keystore.json`
+ * 2. `%LOCALAPPDATA%/btcr2/keystore.json` (Windows)
+ * 3. `~/.local/share/btcr2/keystore.json` (fallback)
+ */
+export declare function defaultKeystorePath(): string;
+//# sourceMappingURL=paths.d.ts.map

package/dist/types/src/keystore/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../../src/keystore/paths.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C"}

package/dist/types/src/keystore/resolve-key-ref.d.ts

@@ -0,0 +1,19 @@
+import type { KeyIdentifier, KeyManager } from '@did-btcr2/key-manager';
+/**
+ * Resolves a user-supplied key reference to a key identifier. Resolution order:
+ * 1. No reference: the active key (errors if none is set).
+ * 2. Exact URN identifier match.
+ * 3. Unique fingerprint-prefix match (against the hex tail of the URN).
+ * 4. Unique `name` tag match.
+ *
+ * Reads only public material (listKeys + getEntry), so resolving a reference
+ * never decrypts a secret or prompts for a passphrase.
+ *
+ * @param kms The key manager to resolve against.
+ * @param ref The reference to resolve. When omitted, the active key is used.
+ * @returns The resolved key identifier.
+ * @throws {CLIError} If no key matches, the reference is ambiguous, or no
+ *   reference is given and no active key is set.
+ */
+export declare function resolveKeyRef(kms: KeyManager, ref?: string): KeyIdentifier;
+//# sourceMappingURL=resolve-key-ref.d.ts.map

package/dist/types/src/keystore/resolve-key-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-key-ref.d.ts","sourceRoot":"","sources":["../../../../src/keystore/resolve-key-ref.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAQxE;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,aAAa,CAqC1E"}

package/dist/types/src/types.d.ts

@@ -5,11 +5,6 @@ import type { DidResolutionResult } from '@web5/dids';
 export type NetworkOption = 'bitcoin' | 'testnet3' | 'testnet4' | 'signet' | 'mutinynet' | 'regtest';
 export type OutputFormat = 'json' | 'text';
 export declare const SUPPORTED_NETWORKS: NetworkOption[];
-export interface CreateCommandOptions {
-    type: 'k' | 'x';
-    bytes: string;
-    network: NetworkOption;
-}
 export interface ResolveCommandOptions {
     identifier: string;
     options?: ResolutionOptions;
@@ -24,6 +19,8 @@ export interface UpdateCommandOptions {
 export type CommandResult = {
     action: 'create';
     data: string;
+    keyId?: string;
+    publicKey?: string;
 } | {
     action: 'resolve';
     data: DidResolutionResult;
@@ -33,6 +30,94 @@ export type CommandResult = {
 } | {
     action: 'deactivate';
     data: SignedBTCR2Update;
+} | {
+    action: 'key-generate';
+    data: {
+        keyId: string;
+        publicKey: string;
+        active: boolean;
+    };
+} | {
+    action: 'key-list';
+    data: Array<{
+        keyId: string;
+        fingerprint: string;
+        name?: string;
+        active: boolean;
+    }>;
+} | {
+    action: 'key-show';
+    data: {
+        keyId: string;
+        publicKey: string;
+        tags?: Record<string, string>;
+    };
+} | {
+    action: 'key-import';
+    data: {
+        keyId: string;
+        publicKey: string;
+        watchOnly: boolean;
+        active: boolean;
+    };
+} | {
+    action: 'key-export';
+    data: {
+        keyId: string;
+        publicKey?: string;
+        secretWrittenTo?: string;
+    };
+} | {
+    action: 'key-delete';
+    data: {
+        keyId: string;
+        deleted: true;
+    };
+} | {
+    action: 'key-use';
+    data: {
+        keyId: string;
+        active: true;
+    };
+} | {
+    action: 'config-init';
+    data: {
+        path: string;
+    };
+} | {
+    action: 'config-get';
+    data: unknown;
+} | {
+    action: 'config-set';
+    data: {
+        path: string;
+    };
+} | {
+    action: 'config-unset';
+    data: {
+        path: string;
+    };
+} | {
+    action: 'config-list';
+    data: unknown;
+} | {
+    action: 'profile-add';
+    data: {
+        profile: string;
+    };
+} | {
+    action: 'profile-use';
+    data: {
+        profile: string;
+    };
+} | {
+    action: 'profile-show';
+    data: unknown;
+} | {
+    action: 'profile-remove';
+    data: {
+        profile: string;
+    };
 };
 export interface GlobalOptions {
     output: OutputFormat;
@@ -45,5 +130,8 @@ export interface GlobalOptions {
     btcRpcUser?: string;
     btcRpcPass?: string;
     casGateway?: string;
+    keystore?: string;
+    passphraseFile?: string;
+    signingKey?: string;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AACrG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,eAAO,MAAM,kBAAkB,EAAE,aAAa,EAE7C,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAM,GAAG,GAAG,GAAG,CAAC;IACpB,KAAK,EAAK,MAAM,CAAC;IACjB,OAAO,EAAG,aAAa,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAG,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAS,gBAAgB,CAAC;IACxC,OAAO,EAAgB,cAAc,EAAE,CAAC;IACxC,eAAe,EAAQ,MAAM,CAAC;IAC9B,oBAAoB,EAAG,MAAM,CAAC;IAC9B,QAAQ,EAAe,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,CAAC;AAEtD,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAO,YAAY,CAAC;IAC1B,OAAO,EAAM,OAAO,CAAC;IACrB,KAAK,EAAQ,OAAO,CAAC;IACrB,MAAM,CAAC,EAAM,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,MAAM,CAAC;IACpB,SAAS,CAAC,EAAG,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AACrG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,eAAO,MAAM,kBAAkB,EAAE,aAAa,EAE7C,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAG,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAS,gBAAgB,CAAC;IACxC,OAAO,EAAgB,cAAc,EAAE,CAAC;IACxC,eAAe,EAAQ,MAAM,CAAC;IAC9B,oBAAoB,EAAG,MAAM,CAAC;IAC9B,QAAQ,EAAe,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,iBAAiB,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACvF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACjG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACzG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/F;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAW,YAAY,CAAC;IAC9B,OAAO,EAAU,OAAO,CAAC;IACzB,KAAK,EAAY,OAAO,CAAC;IACzB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAQ,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;CACzB"}