@did-btcr2/cli 0.11.0 → 0.12.0

package/dist/cjs/index.js

@@ -43,6 +43,7 @@ __export(index_exports, {
   registerProfileCommand: () => registerProfileCommand,
   registerResolveCommand: () => registerResolveCommand,
   registerUpdateCommand: () => registerUpdateCommand,
+  resolveDefaultNetwork: () => resolveDefaultNetwork,
   setConfigPath: () => setConfigPath,
   unsetConfigPath: () => unsetConfigPath,
   writeConfigFile: () => writeConfigFile
@@ -57,96 +58,8 @@ var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 var import_common3 = require("@did-btcr2/common");
 var import_commander = require("commander");
 
-// src/error.ts
-var import_common = require("@did-btcr2/common");
-var CLIError = class extends import_common.DidMethodError {
-  constructor(message, type = "CLIError", data) {
-    super(message, { type, name: "CLIError", data });
-  }
-};
-
-// src/output.ts
-function formatResult(result, options) {
-  if (options.output === "json") {
-    return JSON.stringify(result, null, 2);
-  }
-  const { data } = result;
-  return typeof data === "string" ? data : JSON.stringify(data, null, 2);
-}
-
-// src/types.ts
-var SUPPORTED_NETWORKS = [
-  "bitcoin",
-  "testnet3",
-  "testnet4",
-  "signet",
-  "mutinynet",
-  "regtest"
-];
-
 // src/commands/create.ts
-var EXPECTED_BYTES = {
-  k: { length: 33, label: "secp256k1 compressed public key (33 bytes)" },
-  x: { length: 32, label: "SHA-256 hash (32 bytes)" }
-};
-function registerCreateCommand(program, factory, globals) {
-  program.command("create").description("Create an identifier and initial DID document").requiredOption("-t, --type <type>", "Identifier type <k|x>", "k").requiredOption(
-    "-n, --network <network>",
-    "Identifier bitcoin network <bitcoin|testnet3|testnet4|signet|mutinynet|regtest>"
-  ).requiredOption(
-    "-b, --bytes <bytes>",
-    "Genesis bytes as a hex string. If type=k, MUST be secp256k1 public key. If type=x, MUST be SHA-256 hash of a genesis document"
-  ).action(async (options) => {
-    const parsed = validateCreateOptions(options);
-    const api = factory();
-    const type = parsed.type === "k" ? "deterministic" : "external";
-    const genesisBytes = Buffer.from(parsed.bytes, "hex");
-    const data = api.createDid(type, genesisBytes, { network: parsed.network });
-    const result = { action: "create", data };
-    console.log(formatResult(result, globals()));
-  });
-}
-function validateCreateOptions(options) {
-  if (!["k", "x"].includes(options.type)) {
-    throw new CLIError(
-      'Invalid type. Must be "k" or "x".',
-      "INVALID_ARGUMENT_ERROR",
-      options
-    );
-  }
-  if (!SUPPORTED_NETWORKS.includes(options.network)) {
-    throw new CLIError(
-      'Invalid network. Must be one of "bitcoin", "testnet3", "testnet4", "signet", "mutinynet", or "regtest".',
-      "INVALID_ARGUMENT_ERROR",
-      options
-    );
-  }
-  const buf = Buffer.from(options.bytes, "hex");
-  if (buf.length === 0) {
-    throw new CLIError(
-      "Invalid bytes. Must be a non-empty hex string.",
-      "INVALID_ARGUMENT_ERROR",
-      options
-    );
-  }
-  const expected = EXPECTED_BYTES[options.type];
-  if (buf.length !== expected.length) {
-    throw new CLIError(
-      `Invalid bytes length for type="${options.type}": expected ${expected.label}, got ${buf.length} bytes.`,
-      "INVALID_ARGUMENT_ERROR",
-      options
-    );
-  }
-  return {
-    type: options.type,
-    network: options.network,
-    bytes: options.bytes
-  };
-}
-
-// src/commands/resolve.ts
-var import_api2 = require("@did-btcr2/api");
-var import_promises = require("fs/promises");
+var import_utils2 = require("@noble/hashes/utils.js");
 
 // src/config.ts
 var import_api = require("@did-btcr2/api");
@@ -154,6 +67,14 @@ var import_node_fs4 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path4 = require("path");
 
+// src/error.ts
+var import_common = require("@did-btcr2/common");
+var CLIError = class extends import_common.DidMethodError {
+  constructor(message, type = "CLIError", data) {
+    super(message, { type, name: "CLIError", data });
+  }
+};
+
 // src/keystore/atomic.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
@@ -609,6 +530,16 @@ function promptHidden(label) {
   return Buffer.from(bytes).toString("utf-8");
 }
 
+// src/types.ts
+var SUPPORTED_NETWORKS = [
+  "bitcoin",
+  "testnet3",
+  "testnet4",
+  "signet",
+  "mutinynet",
+  "regtest"
+];
+
 // src/config.ts
 var CONFIG_SCHEMA_VERSION = 1;
 function writeConfigFile(path, mutate) {
@@ -687,6 +618,17 @@ function profileToOverrides(config, profileName) {
     casGateway: profile.cas?.gateway
   };
 }
+function resolveDefaultNetwork(overrides) {
+  const configPath = overrides?.config ?? defaultConfigPath();
+  const file = readConfigFile(configPath);
+  const explicit = file?.defaults?.network;
+  if (explicit && SUPPORTED_NETWORKS.includes(explicit)) return explicit;
+  const profile = overrides?.profile ?? file?.defaults?.profile;
+  if (profile && SUPPORTED_NETWORKS.includes(profile)) {
+    return profile;
+  }
+  return "regtest";
+}
 function resolveConnectionConfig(network, overrides) {
   if (!network) return {};
   const configPath = overrides?.config ?? defaultConfigPath();
@@ -742,7 +684,172 @@ function deriveNetwork(did) {
   return network;
 }
 
+// src/keystore/resolve-key-ref.ts
+function fingerprintOf(id) {
+  return /^urn:kms:secp256k1:([0-9a-f]{32})$/.exec(id)?.[1];
+}
+function resolveKeyRef(kms, ref) {
+  if (!ref) {
+    if (!kms.activeKeyId) {
+      throw new CLIError(
+        "No key specified and no active key is set. Use --key <ref> or set one with `btcr2 key use <ref>`.",
+        "INVALID_ARGUMENT_ERROR"
+      );
+    }
+    return kms.activeKeyId;
+  }
+  const ids = kms.listKeys();
+  if (ids.includes(ref)) return ref;
+  const prefix = ref.toLowerCase();
+  const byPrefix = ids.filter((id) => fingerprintOf(id)?.startsWith(prefix));
+  if (byPrefix.length === 1) return byPrefix[0];
+  if (byPrefix.length > 1) {
+    throw new CLIError(
+      `Ambiguous key reference "${ref}" matches ${byPrefix.length} keys by fingerprint.`,
+      "KEY_REF_AMBIGUOUS_ERROR",
+      { ref }
+    );
+  }
+  const byName = ids.filter((id) => kms.getEntry(id).tags?.name === ref);
+  if (byName.length === 1) return byName[0];
+  if (byName.length > 1) {
+    throw new CLIError(
+      `Ambiguous key name "${ref}" matches ${byName.length} keys.`,
+      "KEY_REF_AMBIGUOUS_ERROR",
+      { ref }
+    );
+  }
+  throw new CLIError(`No key matches reference "${ref}".`, "KEY_NOT_FOUND_ERROR", { ref });
+}
+
+// src/output.ts
+function formatResult(result, options) {
+  if (options.output === "json") {
+    return JSON.stringify(result, null, 2);
+  }
+  const { data } = result;
+  return typeof data === "string" ? data : JSON.stringify(data, null, 2);
+}
+
+// src/commands/create.ts
+var EXPECTED_BYTES = {
+  k: { length: 33, label: "secp256k1 compressed public key (33 bytes)" },
+  x: { length: 32, label: "SHA-256 hash (32 bytes)" }
+};
+function registerCreateCommand(program, factory, keystoreFactory, globals) {
+  program.command("create").description("Create an identifier and initial DID document").option("-t, --type <type>", "Identifier type <k|x>", "k").option(
+    "-n, --network <network>",
+    "Identifier bitcoin network <bitcoin|testnet3|testnet4|signet|mutinynet|regtest> (default: config defaults.network, else regtest)"
+  ).option(
+    "-b, --bytes <bytes>",
+    "Genesis bytes as a hex string. For type=k, a 33-byte secp256k1 public key (omit to generate a key). For type=x, the 32-byte SHA-256 hash of a genesis document."
+  ).action(async (options) => {
+    const g = globals();
+    if (options.type !== "k" && options.type !== "x") {
+      throw new CLIError('Invalid type. Must be "k" or "x".', "INVALID_ARGUMENT_ERROR", options);
+    }
+    const overrides = overridesFromGlobals(g);
+    const network = resolveNetwork(options.network, overrides);
+    const signingKey = g.signingKey;
+    const print = (result, note) => {
+      console.log(formatResult(result, g));
+      if (note && g.output !== "json") process.stderr.write(`${note}
+`);
+    };
+    if (options.type === "x") {
+      if (signingKey) {
+        throw new CLIError(
+          "--signing-key applies only to deterministic identifiers (-t k).",
+          "INVALID_ARGUMENT_ERROR"
+        );
+      }
+      if (options.bytes === void 0) {
+        throw new CLIError(
+          "External identifiers (-t x) require --bytes <hex>, the 32-byte genesis document hash. Key generation is only available for -t k.",
+          "INVALID_ARGUMENT_ERROR"
+        );
+      }
+      const genesisBytes = parseGenesisBytes(options.bytes, "x");
+      const did2 = factory().createDid("external", genesisBytes, { network });
+      print({ action: "create", data: did2 });
+      return;
+    }
+    if (options.bytes !== void 0 && signingKey) {
+      throw new CLIError(
+        "Provide at most one of --bytes or --signing-key.",
+        "INVALID_ARGUMENT_ERROR"
+      );
+    }
+    if (options.bytes !== void 0) {
+      const genesisBytes = parseGenesisBytes(options.bytes, "k");
+      const did2 = factory().createDid("deterministic", genesisBytes, { network });
+      print({ action: "create", data: did2 });
+      return;
+    }
+    if (signingKey) {
+      const api2 = keystoreFactory(void 0, overrides);
+      const keyId2 = resolveKeyRef(api2.kms.kms, signingKey);
+      const publicKey2 = api2.kms.getPublicKey(keyId2);
+      const did2 = api2.createDid("deterministic", publicKey2, { network });
+      print(
+        { action: "create", data: did2, keyId: keyId2, publicKey: (0, import_utils2.bytesToHex)(publicKey2) },
+        `Using stored key ${keyId2}.`
+      );
+      return;
+    }
+    const api = keystoreFactory(void 0, overrides);
+    const { did, keyId } = api.generateDid({ network, setActive: true });
+    const publicKey = (0, import_utils2.bytesToHex)(api.kms.getPublicKey(keyId));
+    print(
+      { action: "create", data: did, keyId, publicKey },
+      `Generated and stored key ${keyId} (now the active key).`
+    );
+  });
+}
+function overridesFromGlobals(g) {
+  return {
+    config: g.config,
+    profile: g.profile,
+    keystore: g.keystore,
+    passphraseFile: g.passphraseFile
+  };
+}
+function resolveNetwork(explicit, overrides) {
+  if (!explicit) return resolveDefaultNetwork(overrides);
+  if (!SUPPORTED_NETWORKS.includes(explicit)) {
+    throw new CLIError(
+      'Invalid network. Must be one of "bitcoin", "testnet3", "testnet4", "signet", "mutinynet", or "regtest".',
+      "INVALID_ARGUMENT_ERROR",
+      { network: explicit }
+    );
+  }
+  return explicit;
+}
+function parseGenesisBytes(hex, type) {
+  const expected = EXPECTED_BYTES[type];
+  let bytes;
+  try {
+    bytes = (0, import_utils2.hexToBytes)(hex.trim());
+  } catch {
+    throw new CLIError(
+      `Invalid bytes: not valid hex. Expected ${expected.label}.`,
+      "INVALID_ARGUMENT_ERROR",
+      { bytes: hex }
+    );
+  }
+  if (bytes.length !== expected.length) {
+    throw new CLIError(
+      `Invalid bytes length for type="${type}": expected ${expected.label}, got ${bytes.length} bytes.`,
+      "INVALID_ARGUMENT_ERROR",
+      { bytes: hex }
+    );
+  }
+  return bytes;
+}
+
 // src/commands/resolve.ts
+var import_api2 = require("@did-btcr2/api");
+var import_promises = require("fs/promises");
 function registerResolveCommand(program, factory, globals) {
   program.command("resolve").alias("read").description("Resolve the DID document of the identifier.").requiredOption("-i, --identifier <identifier>", "did:btcr2 identifier").option("-r, --resolution-options <json>", "JSON string containing resolution options").option("-p, --resolution-options-path <path>", "Path to a JSON file containing resolution options").action(async (options) => {
     const parsed = await validateResolveOptions(options);
@@ -783,46 +890,6 @@ async function validateResolveOptions(options) {
 
 // src/commands/update.ts
 var import_key_manager2 = require("@did-btcr2/key-manager");
-
-// src/keystore/resolve-key-ref.ts
-function fingerprintOf(id) {
-  return /^urn:kms:secp256k1:([0-9a-f]{32})$/.exec(id)?.[1];
-}
-function resolveKeyRef(kms, ref) {
-  if (!ref) {
-    if (!kms.activeKeyId) {
-      throw new CLIError(
-        "No key specified and no active key is set. Use --key <ref> or set one with `btcr2 key use <ref>`.",
-        "INVALID_ARGUMENT_ERROR"
-      );
-    }
-    return kms.activeKeyId;
-  }
-  const ids = kms.listKeys();
-  if (ids.includes(ref)) return ref;
-  const prefix = ref.toLowerCase();
-  const byPrefix = ids.filter((id) => fingerprintOf(id)?.startsWith(prefix));
-  if (byPrefix.length === 1) return byPrefix[0];
-  if (byPrefix.length > 1) {
-    throw new CLIError(
-      `Ambiguous key reference "${ref}" matches ${byPrefix.length} keys by fingerprint.`,
-      "KEY_REF_AMBIGUOUS_ERROR",
-      { ref }
-    );
-  }
-  const byName = ids.filter((id) => kms.getEntry(id).tags?.name === ref);
-  if (byName.length === 1) return byName[0];
-  if (byName.length > 1) {
-    throw new CLIError(
-      `Ambiguous key name "${ref}" matches ${byName.length} keys.`,
-      "KEY_REF_AMBIGUOUS_ERROR",
-      { ref }
-    );
-  }
-  throw new CLIError(`No key matches reference "${ref}".`, "KEY_NOT_FOUND_ERROR", { ref });
-}
-
-// src/commands/update.ts
 function registerUpdateCommand(program, factory, globals) {
   program.command("update").description("Update a did:btcr2 document.").requiredOption(
     "-s, --source-document <json>",
@@ -966,7 +1033,7 @@ function parseJsonArg2(flagName) {
 
 // src/commands/key.ts
 var import_keypair = require("@did-btcr2/keypair");
-var import_utils2 = require("@noble/hashes/utils.js");
+var import_utils3 = require("@noble/hashes/utils.js");
 var import_node_fs5 = require("fs");
 function registerKeyCommand(program, factory, globals) {
   const key = program.command("key").description("Manage keypairs in the encrypted keystore.");
@@ -976,7 +1043,7 @@ function registerKeyCommand(program, factory, globals) {
     assertNameAvailable(api.kms.kms, options.name);
     const setActive = options.setActive ?? false;
     const id = api.kms.generateKey({ ...options.name && { tags: { name: options.name } }, setActive });
-    print({ action: "key-generate", data: { keyId: id, publicKey: (0, import_utils2.bytesToHex)(api.kms.getPublicKey(id)), active: setActive } });
+    print({ action: "key-generate", data: { keyId: id, publicKey: (0, import_utils3.bytesToHex)(api.kms.getPublicKey(id)), active: setActive } });
   });
   key.command("list").alias("ls").description("List stored keys.").action(() => {
     const kms = factory(void 0, globals()).kms.kms;
@@ -996,7 +1063,7 @@ function registerKeyCommand(program, factory, globals) {
     const kms = factory(void 0, globals()).kms.kms;
     const id = resolveKeyRef(kms, ref);
     const entry = kms.getEntry(id);
-    print({ action: "key-show", data: { keyId: id, publicKey: (0, import_utils2.bytesToHex)(entry.publicKey), ...entry.tags && { tags: entry.tags } } });
+    print({ action: "key-show", data: { keyId: id, publicKey: (0, import_utils3.bytesToHex)(entry.publicKey), ...entry.tags && { tags: entry.tags } } });
   });
   key.command("import").description("Import a key: a secret from a hex file, or a public key as watch-only.").option("--secret-file <path>", "Path to a file containing a 32-byte secret key as hex.").option("--public <hex>", "A 33-byte compressed public key as hex (imported watch-only).").option("--name <name>", "A human-friendly name, stored as a tag.").option("--set-active", "Make this the active key.", false).action((options) => {
     if (Boolean(options.secretFile) === Boolean(options.public)) {
@@ -1007,13 +1074,13 @@ function registerKeyCommand(program, factory, globals) {
     const keyPair = options.secretFile ? new import_keypair.SchnorrKeyPair({ secretKey: readHexFile(options.secretFile, 32, "--secret-file") }) : new import_keypair.SchnorrKeyPair({ publicKey: parseHex(options.public ?? "", 33, "--public") });
     const setActive = options.setActive ?? false;
     const id = api.kms.import(keyPair, { ...options.name && { tags: { name: options.name } }, setActive });
-    print({ action: "key-import", data: { keyId: id, publicKey: (0, import_utils2.bytesToHex)(api.kms.getPublicKey(id)), watchOnly: !options.secretFile, active: setActive } });
+    print({ action: "key-import", data: { keyId: id, publicKey: (0, import_utils3.bytesToHex)(api.kms.getPublicKey(id)), watchOnly: !options.secretFile, active: setActive } });
   });
   key.command("export <ref>").description("Export a key. Public material by default; --secret writes the secret to a file.").option("--secret", "Export the secret key. Requires --out.", false).option("--out <path>", "Write the exported secret to this file (created 0600).").action((ref, options) => {
     const api = factory(void 0, globals());
     const id = resolveKeyRef(api.kms.kms, ref);
     if (!options.secret) {
-      print({ action: "key-export", data: { keyId: id, publicKey: (0, import_utils2.bytesToHex)(api.kms.getPublicKey(id)) } });
+      print({ action: "key-export", data: { keyId: id, publicKey: (0, import_utils3.bytesToHex)(api.kms.getPublicKey(id)) } });
       return;
     }
     if (!options.out) {
@@ -1024,7 +1091,7 @@ function registerKeyCommand(program, factory, globals) {
       throw new CLIError(`Key ${id} is watch-only and has no secret to export.`, "INVALID_ARGUMENT_ERROR", { keyId: id });
     }
     process.stderr.write("warning: writing an unencrypted secret key to disk. Protect this file and delete it when done.\n");
-    writeSecretFile(options.out, (0, import_utils2.bytesToHex)(keyPair.secretKey.bytes));
+    writeSecretFile(options.out, (0, import_utils3.bytesToHex)(keyPair.secretKey.bytes));
     print({ action: "key-export", data: { keyId: id, secretWrittenTo: options.out } });
   });
   key.command("delete <ref>").alias("rm").description("Delete a key from the keystore.").option("--force", "Delete even if it is the active key.", false).action((ref, options) => {
@@ -1049,7 +1116,7 @@ function assertNameAvailable(kms, name) {
 function parseHex(hex, expectedBytes, label) {
   let bytes;
   try {
-    bytes = (0, import_utils2.hexToBytes)(hex.trim());
+    bytes = (0, import_utils3.hexToBytes)(hex.trim());
   } catch {
     throw new CLIError(`Invalid hex for ${label}.`, "INVALID_ARGUMENT_ERROR", { label });
   }
@@ -1246,7 +1313,7 @@ var DidBtcr2Cli = class {
   constructor(factory = defaultApiFactory, keystoreFactory = keystoreApiFactory) {
     this.program = new import_commander.Command("btcr2").version(`btcr2 ${VERSION}`, "-v, --version", "Output the current version").description("CLI tool for the did:btcr2 method").option("-o, --output <format>", "Output format <json|text>", "text").option("--verbose", "Verbose output", false).option("--quiet", "Suppress non-essential output", false).option("-c, --config <path>", "Path to config file (default: $XDG_CONFIG_HOME/btcr2/config.json)").option("--profile <name>", "Config profile name (default: auto-detected from network)").option("--btc-rest <url>", "Override Bitcoin REST endpoint (Esplora API)").option("--btc-rpc-url <url>", "Override Bitcoin Core RPC endpoint").option("--btc-rpc-user <user>", "Bitcoin Core RPC username").option("--btc-rpc-pass <pass>", "Bitcoin Core RPC password").option("--cas-gateway <url>", "IPFS HTTP gateway for CAS reads").option("--keystore <path>", "Path to the keystore file (default: $XDG_DATA_HOME/btcr2/keystore.json)").option("--passphrase-file <path>", "Read the keystore passphrase from a file (unattended use)").option("--signing-key <ref>", "Key for update/deactivate signing: a URN, fingerprint prefix, or name");
     const globals = () => this.program.opts();
-    registerCreateCommand(this.program, factory, globals);
+    registerCreateCommand(this.program, factory, keystoreFactory, globals);
     registerResolveCommand(this.program, factory, globals);
     registerUpdateCommand(this.program, keystoreFactory, globals);
     registerDeactivateCommand(this.program, keystoreFactory, globals);
@@ -1312,6 +1379,7 @@ function handleError(error, verbose) {
   registerProfileCommand,
   registerResolveCommand,
   registerUpdateCommand,
+  resolveDefaultNetwork,
   setConfigPath,
   unsetConfigPath,
   writeConfigFile

package/dist/esm/src/cli.js

@@ -40,7 +40,7 @@ export class DidBtcr2Cli {
             .option('--passphrase-file <path>', 'Read the keystore passphrase from a file (unattended use)')
             .option('--signing-key <ref>', 'Key for update/deactivate signing: a URN, fingerprint prefix, or name');
         const globals = () => this.program.opts();
-        registerCreateCommand(this.program, factory, globals);
+        registerCreateCommand(this.program, factory, keystoreFactory, globals);
         registerResolveCommand(this.program, factory, globals);
         registerUpdateCommand(this.program, keystoreFactory, globals);
         registerDeactivateCommand(this.program, keystoreFactory, globals);

package/dist/esm/src/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAmB,MAAM,aAAa,CAAC;AAErF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,OAAO,CAAU;IAEjC;;;;;;;;;;;;;OAaG;IACH,YACE,UAAsB,iBAAiB,EACvC,kBAA8B,kBAAkB;QAEhD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;aAChC,OAAO,CAAC,SAAS,OAAO,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC;aAC1E,WAAW,CAAC,mCAAmC,CAAC;aAChD,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;aACpE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;aAC5C,MAAM,CAAC,SAAS,EAAE,+BAA+B,EAAE,KAAK,CAAC;aACzD,MAAM,CAAC,qBAAqB,EAAE,mEAAmE,CAAC;aAClG,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;aACvF,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;aAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;aACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;aAChE,MAAM,CAAC,mBAAmB,EAAE,yEAAyE,CAAC;aACtG,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;aAC/F,MAAM,CAAC,qBAAqB,EAAE,uEAAuE,CAAC,CAAC;QAE1G,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;QAE1E,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACtD,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9D,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAClE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3D,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,IAAe;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,OAAgB;IACnD,IACE,KAAK,YAAY,cAAc;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,EACzB,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAmB,MAAM,aAAa,CAAC;AAErF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,OAAO,CAAU;IAEjC;;;;;;;;;;;;;OAaG;IACH,YACE,UAAsB,iBAAiB,EACvC,kBAA8B,kBAAkB;QAEhD,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;aAChC,OAAO,CAAC,SAAS,OAAO,EAAE,EAAE,eAAe,EAAE,4BAA4B,CAAC;aAC1E,WAAW,CAAC,mCAAmC,CAAC;aAChD,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,EAAE,MAAM,CAAC;aACpE,MAAM,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC;aAC5C,MAAM,CAAC,SAAS,EAAE,+BAA+B,EAAE,KAAK,CAAC;aACzD,MAAM,CAAC,qBAAqB,EAAE,mEAAmE,CAAC;aAClG,MAAM,CAAC,kBAAkB,EAAE,2DAA2D,CAAC;aACvF,MAAM,CAAC,kBAAkB,EAAE,8CAA8C,CAAC;aAC1E,MAAM,CAAC,qBAAqB,EAAE,oCAAoC,CAAC;aACnE,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,uBAAuB,EAAE,2BAA2B,CAAC;aAC5D,MAAM,CAAC,qBAAqB,EAAE,iCAAiC,CAAC;aAChE,MAAM,CAAC,mBAAmB,EAAE,yEAAyE,CAAC;aACtG,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;aAC/F,MAAM,CAAC,qBAAqB,EAAE,uEAAuE,CAAC,CAAC;QAE1G,MAAM,OAAO,GAAG,GAAkB,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAmB,CAAC;QAE1E,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QACvE,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC9D,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAClE,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;QAC3D,qBAAqB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC7C,sBAAsB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC9C,yBAAyB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACI,KAAK,CAAC,GAAG,CAAC,IAAe;QAC9B,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAC5D,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAc;IACnC,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,KAAc,EAAE,OAAgB;IACnD,IACE,KAAK,YAAY,cAAc;QAC/B,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,CAAC,EAC7E,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,YAAY,cAAc,EAAE,CAAC;QACpC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/C,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;QACvB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrB,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;AACzB,CAAC"}

package/dist/esm/src/commands/create.js

@@ -1,49 +1,128 @@
+import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
+import { resolveDefaultNetwork } from '../config.js';
 import { CLIError } from '../error.js';
+import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
 import { formatResult } from '../output.js';
-import { SUPPORTED_NETWORKS, } from '../types.js';
+import { SUPPORTED_NETWORKS } from '../types.js';
 /** Expected byte length per identifier type: compressed secp256k1 = 33, SHA-256 hash = 32. */
 const EXPECTED_BYTES = {
     k: { length: 33, label: 'secp256k1 compressed public key (33 bytes)' },
     x: { length: 32, label: 'SHA-256 hash (32 bytes)' },
 };
-export function registerCreateCommand(program, factory, globals) {
+/**
+ * Registers the `create` command.
+ *
+ * A deterministic (`-t k`) identifier has three mutually-exclusive input modes,
+ * selected by which is present:
+ * - generate (neither `--bytes` nor `--signing-key`): mint a fresh key, persist
+ *   it to the keystore, set it active, and print the identifier. Sealing the
+ *   secret prompts for the keystore passphrase.
+ * - existing (`--signing-key <ref>`): use a stored key's public key as the
+ *   genesis bytes. Reading a public key never decrypts, so this never prompts.
+ * - raw (`--bytes <hex>`): a 33-byte public key as hex. Offline, keystore-free.
+ *
+ * An external (`-t x`) identifier is raw-bytes-only: a 32-byte genesis-document
+ * hash via `--bytes`. Generation and `--signing-key` apply only to `-t k`.
+ *
+ * The keystore-free `factory` serves the raw-bytes path; the keystore-aware
+ * `keystoreFactory` serves the generate and existing-key paths.
+ */
+export function registerCreateCommand(program, factory, keystoreFactory, globals) {
     program
         .command('create')
         .description('Create an identifier and initial DID document')
-        .requiredOption('-t, --type <type>', 'Identifier type <k|x>', 'k')
-        .requiredOption('-n, --network <network>', 'Identifier bitcoin network <bitcoin|testnet3|testnet4|signet|mutinynet|regtest>')
-        .requiredOption('-b, --bytes <bytes>', 'Genesis bytes as a hex string. ' +
-        'If type=k, MUST be secp256k1 public key. ' +
-        'If type=x, MUST be SHA-256 hash of a genesis document')
+        .option('-t, --type <type>', 'Identifier type <k|x>', 'k')
+        .option('-n, --network <network>', 'Identifier bitcoin network <bitcoin|testnet3|testnet4|signet|mutinynet|regtest> '
+        + '(default: config defaults.network, else regtest)')
+        .option('-b, --bytes <bytes>', 'Genesis bytes as a hex string. '
+        + 'For type=k, a 33-byte secp256k1 public key (omit to generate a key). '
+        + 'For type=x, the 32-byte SHA-256 hash of a genesis document.')
         .action(async (options) => {
-        const parsed = validateCreateOptions(options);
-        const api = factory();
-        const type = parsed.type === 'k' ? 'deterministic' : 'external';
-        const genesisBytes = Buffer.from(parsed.bytes, 'hex');
-        const data = api.createDid(type, genesisBytes, { network: parsed.network });
-        const result = { action: 'create', data };
-        console.log(formatResult(result, globals()));
+        const g = globals();
+        if (options.type !== 'k' && options.type !== 'x') {
+            throw new CLIError('Invalid type. Must be "k" or "x".', 'INVALID_ARGUMENT_ERROR', options);
+        }
+        const overrides = overridesFromGlobals(g);
+        const network = resolveNetwork(options.network, overrides);
+        const signingKey = g.signingKey;
+        /** Prints the result, plus a stderr provenance line in text mode. */
+        const print = (result, note) => {
+            console.log(formatResult(result, g));
+            if (note && g.output !== 'json')
+                process.stderr.write(`${note}\n`);
+        };
+        // External: raw-bytes only.
+        if (options.type === 'x') {
+            if (signingKey) {
+                throw new CLIError('--signing-key applies only to deterministic identifiers (-t k).', 'INVALID_ARGUMENT_ERROR');
+            }
+            if (options.bytes === undefined) {
+                throw new CLIError('External identifiers (-t x) require --bytes <hex>, the 32-byte genesis document hash. '
+                    + 'Key generation is only available for -t k.', 'INVALID_ARGUMENT_ERROR');
+            }
+            const genesisBytes = parseGenesisBytes(options.bytes, 'x');
+            const did = factory().createDid('external', genesisBytes, { network });
+            print({ action: 'create', data: did });
+            return;
+        }
+        // Deterministic (KEY): three mutually-exclusive modes.
+        if (options.bytes !== undefined && signingKey) {
+            throw new CLIError('Provide at most one of --bytes or --signing-key.', 'INVALID_ARGUMENT_ERROR');
+        }
+        // Raw bytes: keystore-free, offline.
+        if (options.bytes !== undefined) {
+            const genesisBytes = parseGenesisBytes(options.bytes, 'k');
+            const did = factory().createDid('deterministic', genesisBytes, { network });
+            print({ action: 'create', data: did });
+            return;
+        }
+        // Existing key: read its public key from the keystore (no passphrase prompt).
+        if (signingKey) {
+            const api = keystoreFactory(undefined, overrides);
+            const keyId = resolveKeyRef(api.kms.kms, signingKey);
+            const publicKey = api.kms.getPublicKey(keyId);
+            const did = api.createDid('deterministic', publicKey, { network });
+            print({ action: 'create', data: did, keyId, publicKey: bytesToHex(publicKey) }, `Using stored key ${keyId}.`);
+            return;
+        }
+        // Generate: mint a fresh key, persist it, and set it active (passphrase prompt).
+        const api = keystoreFactory(undefined, overrides);
+        const { did, keyId } = api.generateDid({ network, setActive: true });
+        const publicKey = bytesToHex(api.kms.getPublicKey(keyId));
+        print({ action: 'create', data: did, keyId, publicKey }, `Generated and stored key ${keyId} (now the active key).`);
     });
 }
-function validateCreateOptions(options) {
-    if (!['k', 'x'].includes(options.type)) {
-        throw new CLIError('Invalid type. Must be "k" or "x".', 'INVALID_ARGUMENT_ERROR', options);
+/** Builds the keystore- and config-resolution overrides from the global flags. */
+function overridesFromGlobals(g) {
+    return {
+        config: g.config,
+        profile: g.profile,
+        keystore: g.keystore,
+        passphraseFile: g.passphraseFile,
+    };
+}
+/** Validates an explicit `--network`, or resolves the default from configuration. */
+function resolveNetwork(explicit, overrides) {
+    if (!explicit)
+        return resolveDefaultNetwork(overrides);
+    if (!SUPPORTED_NETWORKS.includes(explicit)) {
+        throw new CLIError('Invalid network. Must be one of "bitcoin", "testnet3", "testnet4", "signet", "mutinynet", or "regtest".', 'INVALID_ARGUMENT_ERROR', { network: explicit });
     }
-    if (!SUPPORTED_NETWORKS.includes(options.network)) {
-        throw new CLIError('Invalid network. Must be one of "bitcoin", "testnet3", "testnet4", "signet", "mutinynet", or "regtest".', 'INVALID_ARGUMENT_ERROR', options);
+    return explicit;
+}
+/** Parses and length-checks hex genesis bytes for the given identifier type. */
+function parseGenesisBytes(hex, type) {
+    const expected = EXPECTED_BYTES[type];
+    let bytes;
+    try {
+        bytes = hexToBytes(hex.trim());
     }
-    const buf = Buffer.from(options.bytes, 'hex');
-    if (buf.length === 0) {
-        throw new CLIError('Invalid bytes. Must be a non-empty hex string.', 'INVALID_ARGUMENT_ERROR', options);
+    catch {
+        throw new CLIError(`Invalid bytes: not valid hex. Expected ${expected.label}.`, 'INVALID_ARGUMENT_ERROR', { bytes: hex });
     }
-    const expected = EXPECTED_BYTES[options.type];
-    if (buf.length !== expected.length) {
-        throw new CLIError(`Invalid bytes length for type="${options.type}": expected ${expected.label}, got ${buf.length} bytes.`, 'INVALID_ARGUMENT_ERROR', options);
+    if (bytes.length !== expected.length) {
+        throw new CLIError(`Invalid bytes length for type="${type}": expected ${expected.label}, got ${bytes.length} bytes.`, 'INVALID_ARGUMENT_ERROR', { bytes: hex });
     }
-    return {
-        type: options.type,
-        network: options.network,
-        bytes: options.bytes,
-    };
+    return bytes;
 }
 //# sourceMappingURL=create.js.map