@did-btcr2/cli 0.14.0 → 0.15.0

package/src/keystore/paths.ts

@@ -1,5 +1,6 @@
 import { homedir } from 'node:os';
 import { join } from 'node:path';
+import { blankToUndef } from '../types.js';
 
 /**
  * Default keystore file path, following the XDG Base Directory Specification's
@@ -13,8 +14,8 @@ import { join } from 'node:path';
  * 3. `~/.local/share/btcr2/keystore.json` (fallback)
  */
 export function defaultKeystorePath(): string {
-  const base = process.env.XDG_DATA_HOME
-    ?? process.env.LOCALAPPDATA
+  const base = blankToUndef(process.env.XDG_DATA_HOME)
+    ?? blankToUndef(process.env.LOCALAPPDATA)
     ?? join(homedir(), '.local', 'share');
   return join(base, 'btcr2', 'keystore.json');
 }

package/src/output.ts

@@ -1,5 +1,58 @@
 import type { CommandResult, GlobalOptions } from './types.js';
 
+/** Placeholder printed in place of a redacted secret value. */
+export const REDACTED = '********';
+
+/**
+ * Key names whose (scalar) values are treated as secrets and redacted in printed
+ * output. Covers RPC passwords plus header credentials (`Authorization`, API
+ * keys, bearer tokens) that a profile can now carry in `btc.headers`/`rpcHeaders`.
+ */
+const SECRET_KEY = /(pass|secret|token|auth|api[-_]?key|credential|bearer)/i;
+
+/** Whether a config key name looks like a secret (so its scalar value should be redacted). */
+export function isSecretKey(key: string): boolean {
+  return SECRET_KEY.test(key);
+}
+
+/**
+ * Masks the password in a `scheme://user:pass@host` URL, leaving the rest of the
+ * value verbatim. A credential embedded in an endpoint URL (e.g. `rpcUrl`) is not
+ * caught by key-name matching, so it is scrubbed here regardless of the key.
+ */
+export function scrubUrlUserinfo(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  return value.replace(/^([a-z][a-z0-9+.-]*:\/\/[^/@:]+):[^/@]*@/i, `$1:${REDACTED}@`);
+}
+
+/**
+ * Returns a deep copy of `value` with secret scalar values replaced by
+ * {@link REDACTED}, so routine introspection (`config get`/`list`/`effective`)
+ * does not print RPC passwords or other secrets into terminal scrollback and CI
+ * logs. A secret-named key redacts only a scalar value (an object under such a
+ * key, e.g. a profile named `access-token`, is still traversed, not wholesale
+ * masked). Passwords embedded in URL values are scrubbed regardless of key name.
+ * When `keyName` is a secret name, a directly-passed scalar value is redacted
+ * (used when a single leaf value is printed). Display-only: the stored config and
+ * the value used to connect are untouched.
+ */
+export function redactSecrets(value: unknown, keyName?: string): unknown {
+  if (Array.isArray(value)) {
+    return value.map(item => redactSecrets(item));
+  }
+  if (value !== null && typeof value === 'object') {
+    const out: Record<string, unknown> = {};
+    for (const [ key, val ] of Object.entries(value as Record<string, unknown>)) {
+      out[key] = redactSecrets(val, key);
+    }
+    return out;
+  }
+  if (keyName !== undefined && isSecretKey(keyName)) {
+    return value === undefined ? undefined : REDACTED;
+  }
+  return typeof value === 'string' ? scrubUrlUserinfo(value) : value;
+}
+
 /**
  * Formats a CommandResult for console output.
  * In 'json' mode, the full result is serialized.

package/src/types.ts

@@ -2,6 +2,8 @@ import type { DidUpdateResult } from '@did-btcr2/api';
 import type { PatchOperation } from '@did-btcr2/common';
 import type { Btcr2DidDocument, ResolutionOptions } from '@did-btcr2/method';
 import type { DidResolutionResult } from '@web5/dids';
+import type { DoctorReport, EffectiveConfig } from './config.js';
+import type { ConfigIssue } from './config-schema.js';
 
 export type NetworkOption = 'bitcoin' | 'testnet3' | 'testnet4' | 'signet' | 'mutinynet' | 'regtest';
 export type OutputFormat = 'json' | 'text';
@@ -10,6 +12,17 @@ export const SUPPORTED_NETWORKS: NetworkOption[] = [
   'bitcoin', 'testnet3', 'testnet4', 'signet', 'mutinynet', 'regtest'
 ];
 
+/**
+ * Normalizes a blank value (empty or whitespace-only) to `undefined`, so a
+ * blank at any precedence layer defers to the next layer instead of masking it.
+ * A non-blank value is returned unchanged. This mirrors the `|| undefined`
+ * treatment the environment layer already applies in `readEnvOverrides`.
+ */
+export function blankToUndef(value: string | undefined): string | undefined {
+  if (value === undefined) return undefined;
+  return value.trim() === '' ? undefined : value;
+}
+
 export interface ResolveCommandOptions {
   identifier : string;
   options?   : ResolutionOptions;
@@ -40,6 +53,10 @@ export type CommandResult =
   | { action: 'config-set'; data: { path: string } }
   | { action: 'config-unset'; data: { path: string } }
   | { action: 'config-list'; data: unknown }
+  | { action: 'config-validate'; data: { ok: boolean; issues: ConfigIssue[] } }
+  | { action: 'config-effective'; data: EffectiveConfig }
+  | { action: 'config-path'; data: { config: string; keystore: string } }
+  | { action: 'config-doctor'; data: DoctorReport }
   | { action: 'profile-add'; data: { profile: string } }
   | { action: 'profile-use'; data: { profile: string } }
   | { action: 'profile-show'; data: unknown }
@@ -57,6 +74,11 @@ export interface GlobalOptions {
   btcRpcPass?    : string;
   casGateway?    : string;
   casRpcUrl?     : string;
+  btcTimeout?    : string;
+  casTimeout?    : string;
+  btcRestHeader? : string[];
+  btcRpcWallet?  : string;
+  btcRpcHeader?  : string[];
   keystore?      : string;
   passphraseFile?: string;
   signingKey?    : string;