@did-btcr2/cli 0.14.0 → 0.16.0

package/dist/types/src/config.d.ts

@@ -1,5 +1,8 @@
-import { type DidBtcr2Api } from '@did-btcr2/api';
-import { type NetworkOption, type OutputFormat } from './types.js';
+import { type BitcoinApiConfig, type CasConfig, type DidBtcr2Api } from '@did-btcr2/api';
+import type { BroadcastOptions } from '@did-btcr2/method';
+import { defaultConfigPath } from './paths.js';
+import { type KeystoreProtectionLabel, type NetworkOption, type OutputFormat } from './types.js';
+export { defaultConfigPath };
 /**
  * Endpoint overrides provided via CLI flags, env vars, or config file.
  * These override the per-network defaults the SDK applies
@@ -17,12 +20,26 @@ export type ConnectionOverrides = {
     casGateway?: string;
     /** IPFS HTTP RPC endpoint for a writable CAS (reads + writes). */
     casRpcUrl?: string;
+    /** Bitcoin REST/RPC request timeout in milliseconds (raw flag/env string). */
+    btcTimeout?: string;
+    /** CAS request timeout in milliseconds (raw flag/env string; `0` disables). */
+    casTimeout?: string;
+    /** Extra Bitcoin REST headers as raw `Key: Value` flag values (repeatable). */
+    btcRestHeader?: string[];
+    /** Bitcoin Core RPC wallet name for wallet-scoped RPCs. */
+    btcRpcWallet?: string;
+    /** Extra Bitcoin Core RPC headers as raw `Key: Value` flag values (repeatable). */
+    btcRpcHeader?: string[];
+    /** CLI home root from `--home`. Colocates config.json + keystore.json (ADR 079). */
+    home?: string;
     config?: string;
     profile?: string;
-    /** Keystore file path. Overrides the default `$XDG_DATA_HOME/btcr2/keystore.json`. */
+    /** Keystore file path. Overrides the home default `<home>/keystore.json`. */
     keystore?: string;
     /** Path to a file holding the keystore passphrase (for unattended use). */
     passphraseFile?: string;
+    /** Signing key reference (URN, fingerprint prefix, or name) from `--signing-key`. */
+    signingKey?: string;
 };
 /**
  * On-disk config file schema.
@@ -57,17 +74,38 @@ export type ConfigFile = {
         output?: OutputFormat;
     };
     profiles?: Record<string, {
+        /**
+         * The Bitcoin network this profile's endpoints target. Declaring it lets a
+         * profile that is not named after a network (e.g. `production`) still fix
+         * the network its `create` runs encode, and lets the CLI warn when the
+         * network being encoded disagrees with the profile's endpoints.
+         */
+        network?: NetworkOption;
         btc?: {
             rest?: string;
             rpcUrl?: string;
             rpcUser?: string;
             rpcPass?: string;
+            /** Fee rate in sats/vByte for beacon transactions (update/deactivate). */
+            feeRate?: number;
+            /** Change address for beacon transactions (ADR 044 unlinkability opt-out). */
+            changeAddress?: string;
+            /** Request timeout in milliseconds for REST/RPC calls. No default (unbounded). */
+            timeoutMs?: number;
+            /** Extra headers sent on REST (Esplora) requests, e.g. an API key. */
+            headers?: Record<string, string>;
+            /** Bitcoin Core wallet name for wallet-scoped RPCs. */
+            wallet?: string;
+            /** Extra headers sent on Bitcoin Core RPC requests. */
+            rpcHeaders?: Record<string, string>;
         };
         cas?: {
             /** IPFS HTTP gateway for CAS reads (read-only). */
             gateway?: string;
             /** IPFS HTTP RPC endpoint for a writable CAS (reads + writes). */
             rpcUrl?: string;
+            /** Request timeout in milliseconds for CAS operations. Default 30000; `0` disables. */
+            timeoutMs?: number;
         };
         /** Signing identity references. Never embeds key material; the secret lives in the keystore. */
         identity?: {
@@ -82,8 +120,20 @@ export declare const CONFIG_SCHEMA_VERSION = 1;
  * Read-modify-write a config file, preserving unknown keys. Reads the raw JSON
  * (so keys outside {@link ConfigFile} survive a rewrite), applies `mutate`,
  * stamps the schema version, and writes atomically (file 0600, dir 0700).
+ *
+ * A file that exists but cannot be parsed makes {@link readConfigFile} throw, so
+ * a write never starts from `{}` over a malformed-but-recoverable file and can
+ * never clobber the other profiles and defaults it still holds. A genuinely
+ * absent file (ENOENT) still starts from `{}`.
  */
 export declare function writeConfigFile(path: string, mutate: (raw: Record<string, unknown>) => void): void;
+/**
+ * Writes a default config scaffold to `path`: schema version, a `text` output
+ * default, and one empty profile per supported network. Shared by `config init`
+ * and `btcr2 init` so the seeded config is identical. Writes atomically (file
+ * 0600, dir 0700); the caller decides whether to overwrite an existing file.
+ */
+export declare function writeDefaultConfigFile(path: string): void;
 /** Reads the value at a dotted path (e.g. `profiles.regtest.btc.rest`). */
 export declare function getConfigPath(config: Record<string, unknown>, path: string): unknown;
 /** Sets the value at a dotted path, creating intermediate objects. */
@@ -111,6 +161,9 @@ export type ApiFactory = (network?: NetworkOption, overrides?: ConnectionOverrid
  * | `BTCR2_BTC_RPC_PASS`  | `--btc-rpc-pass`   |
  * | `BTCR2_CAS_GATEWAY`   | `--cas-gateway`    |
  * | `BTCR2_CAS_RPC_URL`   | `--cas-rpc-url`    |
+ * | `BTCR2_BTC_TIMEOUT`   | `--btc-timeout`    |
+ * | `BTCR2_CAS_TIMEOUT`   | `--cas-timeout`    |
+ * | `BTCR2_FEE_RATE`      | `--fee-rate`       |
  */
 export declare const ENV_VARS: {
     readonly BTC_REST: "BTCR2_BTC_REST";
@@ -119,6 +172,9 @@ export declare const ENV_VARS: {
     readonly BTC_RPC_PASS: "BTCR2_BTC_RPC_PASS";
     readonly CAS_GATEWAY: "BTCR2_CAS_GATEWAY";
     readonly CAS_RPC_URL: "BTCR2_CAS_RPC_URL";
+    readonly BTC_TIMEOUT: "BTCR2_BTC_TIMEOUT";
+    readonly CAS_TIMEOUT: "BTCR2_CAS_TIMEOUT";
+    readonly FEE_RATE: "BTCR2_FEE_RATE";
 };
 /**
  * Reads {@link ConnectionOverrides} from environment variables.
@@ -126,17 +182,20 @@ export declare const ENV_VARS: {
  */
 export declare function readEnvOverrides(): ConnectionOverrides;
 /**
- * Default config file path following the XDG Base Directory Specification.
- *
- * Resolution order:
- * 1. `$XDG_CONFIG_HOME/btcr2/config.json`
- * 2. `%APPDATA%/btcr2/config.json` (Windows)
- * 3. `~/.config/btcr2/config.json` (fallback)
+ * Reads and JSON-parses a config file without applying the schema-version
+ * ceiling check. Returns `undefined` only for a genuinely absent file (ENOENT).
+ * Any other read failure, and any JSON parse failure, throws a {@link CLIError}
+ * that names the file. Used by `config validate`, which reports a newer-than-
+ * supported `schemaVersion` as a finding rather than aborting on it.
  */
-export declare function defaultConfigPath(): string;
+export declare function parseConfigFileRaw(path: string): Record<string, unknown> | undefined;
 /**
- * Reads and parses a config file. Returns `undefined` if the file does
- * not exist or cannot be parsed.
+ * Reads and parses a config file. Returns `undefined` only when the file is
+ * genuinely absent (ENOENT), so callers can safely treat "no file" as "use
+ * defaults". Any other read failure, and any JSON parse failure, throws a
+ * {@link CLIError} that names the file, rather than silently degrading to the
+ * public network defaults. A file written by a newer CLI (higher `schemaVersion`)
+ * is also refused.
  */
 export declare function readConfigFile(path: string): ConfigFile | undefined;
 /**
@@ -144,15 +203,160 @@ export declare function readConfigFile(path: string): ConfigFile | undefined;
  * {@link ConfigFile}. Returns an empty object if the profile does not exist.
  */
 export declare function profileToOverrides(config: ConfigFile, profileName: string): ConnectionOverrides;
+/**
+ * Resolves the active profile name and the network it targets, shared by
+ * {@link resolveDefaultNetwork} and {@link resolveConnectionConfig} so the two
+ * can never disagree about which profile is active or which network it means.
+ *
+ * The active profile name is the explicit `--profile` flag, else the config
+ * file's `defaults.profile`. The network is the profile's own `network` field
+ * when set to a supported value, else the profile name itself when it is a
+ * network name (the historical convention). A profile that declares no network
+ * and is not named after one yields `network: undefined`.
+ */
+export declare function resolveActiveProfile(file: ConfigFile | undefined, overrides?: ConnectionOverrides): {
+    name: string | undefined;
+    network: NetworkOption | undefined;
+};
 /**
  * Resolves the default Bitcoin network for offline identifier creation when no
  * `--network` flag is given. Resolution order: the config file's
- * `defaults.network`, then an active profile named for a network (an explicit
- * `--profile` flag or `defaults.profile`), then `regtest` as the development
+ * `defaults.network`, then the active profile's network (its explicit `network`
+ * field, else its network-derived name), then `regtest` as the development
  * fallback. Generation itself is offline; this only fixes which network the
  * identifier encodes.
  */
 export declare function resolveDefaultNetwork(overrides?: ConnectionOverrides): NetworkOption;
+/**
+ * Reports a coherence conflict between the network a `create` run is about to
+ * encode and the network the active profile declares, so the CLI can warn
+ * instead of silently minting an identifier on one network while wiring
+ * endpoints for another. Returns `undefined` when the active profile declares
+ * no network or agrees with the one being encoded.
+ */
+export declare function profileNetworkMismatch(network: NetworkOption, overrides?: ConnectionOverrides): {
+    profile: string;
+    declared: NetworkOption;
+} | undefined;
+/**
+ * Resolves the effective output format: the `-o/--output` flag, then the
+ * `BTCR2_OUTPUT` environment variable, then the config file's `defaults.output`,
+ * then `'text'`. A malformed config never blocks output resolution (the command's
+ * own read path surfaces it); output format falls back to `'text'` instead.
+ */
+export declare function resolveOutputFormat(options: {
+    output?: string;
+    config?: string;
+    home?: string;
+}): OutputFormat;
+/**
+ * Resolves the Bitcoin and CAS connection config for a network by merging,
+ * in precedence order, CLI flags, environment variables, and the config-file
+ * profile on top of the per-network defaults (handled by `BitcoinConnection`).
+ *
+ * Returns an empty config when no network is given, since offline operations
+ * (create, key management) need no connection.
+ *
+ * When no `--profile` is given, the network name is used as the profile key
+ * (e.g. a regtest DID auto-selects the `"regtest"` profile).
+ */
+export declare function resolveConnectionConfig(network?: NetworkOption, overrides?: ConnectionOverrides): {
+    btc?: BitcoinApiConfig;
+    cas?: CasConfig;
+};
+/**
+ * Parses repeatable `Key: Value` header flag values into a header map. Returns
+ * `undefined` for an empty list. Throws a {@link CLIError} for an entry missing a
+ * colon or with an empty key.
+ */
+export declare function parseHeaderList(list?: string[], flagName?: string): Record<string, string> | undefined;
+/** Environment variable naming a file whose contents are the Bitcoin Core RPC password. */
+export declare const ENV_RPC_PASS_FILE = "BTCR2_BTC_RPC_PASS_FILE";
+/**
+ * Resolves an RPC-password secret reference to its literal value: `env:<VAR>`
+ * reads the named environment variable, `file:<path>` reads the file, and any
+ * other value is returned as-is. A trailing newline is trimmed from file/env
+ * sources so a secret written by `echo` matches an inline value (ADR 077).
+ */
+export declare function resolveSecretRef(value?: string): string | undefined;
+/**
+ * Resolves the beacon {@link BroadcastOptions} for an update/deactivate from the
+ * fee-rate and change-address knobs, following the CLI precedence chain.
+ *
+ * - Fee rate: `--fee-rate` flag, then `BTCR2_FEE_RATE`, then profile
+ *   `btc.feeRate`. A positive sats/vByte value wrapped in a `StaticFeeEstimator`.
+ * - Change address: `--change-address` flag, then profile `btc.changeAddress`
+ *   (no env, since a change address is DID/network-specific). Validated against
+ *   the DID network by the beacon at broadcast time.
+ *
+ * Returns `undefined` when neither is set, so the SDK defaults (5 sat/vB, change
+ * back to the beacon address) still apply.
+ */
+export declare function resolveBroadcastOptions(network: NetworkOption, overrides: ConnectionOverrides | undefined, flags: {
+    feeRate?: string;
+    changeAddress?: string;
+}): BroadcastOptions | undefined;
+/** Which precedence layer a resolved value came from. */
+export type Provenance = 'flag' | 'env' | 'file' | 'default';
+/** A resolved value paired with the layer it came from. */
+export interface EffectiveEntry {
+    value: string | number | undefined;
+    source: Provenance;
+}
+/**
+ * The resolved connection config with per-value provenance, the shape behind
+ * `config effective`. Values are read through the real resolver (the constructed
+ * api and {@link resolveConnectionConfig}) so they cannot drift from what a live
+ * command would use; the `source` tag names the layer the merge selected.
+ */
+export interface EffectiveConfig {
+    network: NetworkOption;
+    profile: string | undefined;
+    btc: {
+        rest: EffectiveEntry;
+        rpcUrl: EffectiveEntry;
+        rpcUser: EffectiveEntry;
+        rpcPass: EffectiveEntry;
+        rpcWallet: EffectiveEntry;
+        timeoutMs: EffectiveEntry;
+    };
+    cas: {
+        gateway: EffectiveEntry;
+        rpcUrl: EffectiveEntry;
+        timeoutMs: EffectiveEntry;
+    };
+}
+/**
+ * Resolves the effective connection config with provenance for `config effective`.
+ * The btc values are read back from the constructed api (so SDK network defaults
+ * are reflected), the cas and timeout values from {@link resolveConnectionConfig},
+ * and each `source` is derived by the same precedence order the merge uses.
+ */
+export declare function resolveEffectiveConfig(network: NetworkOption, overrides?: ConnectionOverrides): EffectiveConfig;
+/** One endpoint reachability check produced by `config doctor`. */
+export interface DoctorCheck {
+    endpoint: 'btc-rest' | 'btc-rpc' | 'cas';
+    target: string;
+    ok: boolean;
+    detail?: string;
+}
+/** Result of `config doctor`: per-endpoint reachability and any coherence warning. */
+export interface DoctorReport {
+    checks: DoctorCheck[];
+    coherence?: {
+        profile: string;
+        declared: NetworkOption;
+        encoding: NetworkOption;
+    };
+}
+/**
+ * Probes reachability of the resolved endpoints for `config doctor`: a
+ * lightweight REST call against btc-rest, a `getblockchaininfo` against btc-rpc
+ * when configured, and a reachability check against the resolved CAS. Also
+ * surfaces the profile/network coherence warning. Reads and touches the network;
+ * never writes.
+ */
+export declare function runDoctor(network: NetworkOption, overrides?: ConnectionOverrides): Promise<DoctorReport>;
 /**
  * Default {@link ApiFactory} backed by network defaults from
  * `@did-btcr2/bitcoin` (mempool.space for public networks, localhost for
@@ -163,6 +367,40 @@ export declare function resolveDefaultNetwork(overrides?: ConnectionOverrides):
  * CLI flags -> env vars -> config file profile -> network defaults.
  */
 export declare function defaultApiFactory(network?: NetworkOption, overrides?: ConnectionOverrides): DidBtcr2Api;
+/**
+ * The protection mode of the resolved keystore, read without decrypting or
+ * prompting: `encrypted`, `dev` (plaintext), or `absent`. Used by `keystore
+ * status`, `config path`, and the mainnet guard.
+ */
+export declare function resolveKeystoreProtection(overrides?: ConnectionOverrides): KeystoreProtectionLabel;
+/**
+ * Hard-refuses using an unencrypted dev keystore for a mainnet operation (ADR
+ * 080). A plaintext key must never sign or seal a `bitcoin` did:btcr2; the check
+ * reads only the keystore's protection header, so it never decrypts or prompts.
+ * A no-op for every other network and for encrypted/absent keystores.
+ */
+export declare function assertKeystoreAllowedForNetwork(network: NetworkOption, overrides?: ConnectionOverrides): void;
+/**
+ * Resolves the keystore file path: the `--keystore` flag, else the active
+ * profile's `identity.keystore`, else the default `<home>/keystore.json` (ADR
+ * 079). The flag always wins over the profile default and never reads the config.
+ *
+ * A malformed config aborts loudly by default so a keystore-mutating command
+ * never silently reads or writes the wrong store. Pass `lenient: true` only for
+ * diagnostic/recovery commands (`config path`, `keystore status`) that must still
+ * report a path instead of crashing on the very config you ran them to fix; those
+ * fall back to the home default when the profile identity cannot be read.
+ */
+export declare function resolveKeystorePath(overrides?: ConnectionOverrides, options?: {
+    lenient?: boolean;
+}): string;
+/**
+ * Resolves the signing-key reference for update/deactivate: the `--signing-key`
+ * flag, else the active profile's `identity.default`, else `undefined` (letting
+ * the KMS fall back to its active key). The flag always wins over the profile
+ * default, consistent with the flag -> profile precedence used elsewhere.
+ */
+export declare function resolveSigningKeyRef(overrides?: ConnectionOverrides): string | undefined;
 /**
  * Keystore-aware {@link ApiFactory} for commands that need a signing identity
  * (key management, update, deactivate). Identical to {@link defaultApiFactory}

package/dist/types/src/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAUhH,OAAO,EAAsB,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEvF;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,MAAM,CAAC,EAAW,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,sFAAsF;IACtF,QAAQ,CAAC,EAAS,MAAM,CAAC;IACzB,2EAA2E;IAC3E,cAAc,CAAC,EAAG,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB,GAAG,CAAC,EAAE;YACJ,IAAI,CAAC,EAAM,MAAM,CAAC;YAClB,MAAM,CAAC,EAAI,MAAM,CAAC;YAClB,OAAO,CAAC,EAAG,MAAM,CAAC;YAClB,OAAO,CAAC,EAAG,MAAM,CAAC;SACnB,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,mDAAmD;YACnD,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,kEAAkE;YAClE,MAAM,CAAC,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,gGAAgG;QAChG,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAMlG;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF;AAED,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAUjG;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAUnF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,KAAK,WAAW,CAAC;AAEnG;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,QAAQ;;;;;;;CAOX,CAAC;AAEX;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,mBAAmB,CAUtD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAK1C;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAOnE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAQ,UAAU,EACxB,WAAW,EAAG,MAAM,GACnB,mBAAmB,CAWrB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAapF;AA+DD;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAEvG;AAgBD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAKxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAUxD"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAA8E,KAAK,gBAAgB,EAAE,KAAK,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGrK,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAS1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,EAAoC,KAAK,uBAAuB,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAEnI,OAAO,EAAE,iBAAiB,EAAE,CAAC;AAE7B;;;;;;;GAOG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,mDAAmD;IACnD,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,kEAAkE;IAClE,SAAS,CAAC,EAAQ,MAAM,CAAC;IACzB,8EAA8E;IAC9E,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,+EAA+E;IAC/E,UAAU,CAAC,EAAO,MAAM,CAAC;IACzB,+EAA+E;IAC/E,aAAa,CAAC,EAAI,MAAM,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,YAAY,CAAC,EAAK,MAAM,CAAC;IACzB,mFAAmF;IACnF,YAAY,CAAC,EAAK,MAAM,EAAE,CAAC;IAC3B,oFAAoF;IACpF,IAAI,CAAC,EAAa,MAAM,CAAC;IACzB,MAAM,CAAC,EAAW,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC;IACzB,6EAA6E;IAC7E,QAAQ,CAAC,EAAS,MAAM,CAAC;IACzB,2EAA2E;IAC3E,cAAc,CAAC,EAAG,MAAM,CAAC;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAO,MAAM,CAAC;CAC1B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,MAAM,UAAU,GAAG;IACvB,wEAAwE;IACxE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,OAAO,CAAC,EAAE,aAAa,CAAC;QACxB,MAAM,CAAC,EAAE,YAAY,CAAC;KACvB,CAAC;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QACxB;;;;;WAKG;QACH,OAAO,CAAC,EAAG,aAAa,CAAC;QACzB,GAAG,CAAC,EAAE;YACJ,IAAI,CAAC,EAAY,MAAM,CAAC;YACxB,MAAM,CAAC,EAAU,MAAM,CAAC;YACxB,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,0EAA0E;YAC1E,OAAO,CAAC,EAAS,MAAM,CAAC;YACxB,8EAA8E;YAC9E,aAAa,CAAC,EAAG,MAAM,CAAC;YACxB,kFAAkF;YAClF,SAAS,CAAC,EAAO,MAAM,CAAC;YACxB,sEAAsE;YACtE,OAAO,CAAC,EAAS,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACxC,uDAAuD;YACvD,MAAM,CAAC,EAAU,MAAM,CAAC;YACxB,uDAAuD;YACvD,UAAU,CAAC,EAAM,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,CAAC;QACF,GAAG,CAAC,EAAE;YACJ,mDAAmD;YACnD,OAAO,CAAC,EAAE,MAAM,CAAC;YACjB,kEAAkE;YAClE,MAAM,CAAC,EAAE,MAAM,CAAC;YAChB,uFAAuF;YACvF,SAAS,CAAC,EAAE,MAAM,CAAC;SACpB,CAAC;QACF,gGAAgG;QAChG,QAAQ,CAAC,EAAE;YACT,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC,CAAC;CACJ,CAAC;AAEF,kEAAkE;AAClE,eAAO,MAAM,qBAAqB,IAAI,CAAC;AAEvC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG,IAAI,CAMlG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAQzD;AAED,2EAA2E;AAC3E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAKpF;AAYD,sEAAsE;AACtE,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAWjG;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAWnF;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,KAAK,WAAW,CAAC;AAEnG;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,QAAQ;;;;;;;;;;CAUX,CAAC;AAEX;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,mBAAmB,CAUtD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAsBpF;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAKnE;AAsBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAQ,UAAU,EACxB,WAAW,EAAG,MAAM,GACnB,mBAAmB,CAWrB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAQ,UAAU,GAAG,SAAS,EAClC,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,aAAa,GAAG,SAAS,CAAA;CAAE,CASlE;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAWpF;AAED;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAK,aAAa,EACzB,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG,SAAS,CAa1D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,CAe9G;AA4CD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,CAAC,EAAI,aAAa,EACzB,SAAS,CAAC,EAAE,mBAAmB,GAC9B;IAAE,GAAG,CAAC,EAAE,gBAAgB,CAAC;IAAC,GAAG,CAAC,EAAE,SAAS,CAAA;CAAE,CAyF7C;AAwBD;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,SAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAgB1G;AAeD,2FAA2F;AAC3F,eAAO,MAAM,iBAAiB,4BAA4B,CAAC;AAoB3D;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAUnE;AASD;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAI,aAAa,EACxB,SAAS,EAAE,mBAAmB,GAAG,SAAS,EAC1C,KAAK,EAAM;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,GACtD,gBAAgB,GAAG,SAAS,CAgB9B;AAeD,yDAAyD;AACzD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,SAAS,CAAC;AAE7D,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAI,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,MAAM,EAAG,UAAU,CAAC;CACrB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAG,aAAa,CAAC;IACxB,OAAO,EAAG,MAAM,GAAG,SAAS,CAAC;IAC7B,GAAG,EAAG;QACJ,IAAI,EAAQ,cAAc,CAAC;QAC3B,MAAM,EAAM,cAAc,CAAC;QAC3B,OAAO,EAAK,cAAc,CAAC;QAC3B,OAAO,EAAK,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;KAC5B,CAAC;IACF,GAAG,EAAG;QACJ,OAAO,EAAK,cAAc,CAAC;QAC3B,MAAM,EAAM,cAAc,CAAC;QAC3B,SAAS,EAAG,cAAc,CAAC;KAC5B,CAAC;CACH;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,eAAe,CAmD/G;AAED,mEAAmE;AACnE,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAC;IAC1C,MAAM,EAAK,MAAM,CAAC;IAClB,EAAE,EAAS,OAAO,CAAC;IACnB,MAAM,CAAC,EAAI,MAAM,CAAC;CACnB;AAED,sFAAsF;AACtF,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAO,WAAW,EAAE,CAAC;IAC3B,SAAS,CAAC,EAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAC;QAAC,QAAQ,EAAE,aAAa,CAAA;KAAE,CAAC;CACpF;AAmCD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmC9G;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAEvG;AAmBD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,uBAAuB,CAElG;AAED;;;;;GAKG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,IAAI,CAW7G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,mBAAmB,EAAE,OAAO,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,MAAM,CAa5G;AAoBD;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,SAAS,CAExF;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,CAAC,EAAE,aAAa,EAAE,SAAS,CAAC,EAAE,mBAAmB,GAAG,WAAW,CAKxG;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAUxD"}

package/dist/types/src/keystore/file-key-store.d.ts

@@ -1,33 +1,61 @@
 import type { KeyEntry, KeyIdentifier, KeyValueStore } from '@did-btcr2/key-manager';
+import type { KeystoreProtectionLabel } from '../types.js';
 import type { ArgonParams } from './envelope.js';
 import { type LockOptions } from './lock.js';
 /** Current on-disk keystore file format version. */
 export declare const KEYSTORE_VERSION: 1;
+/**
+ * How a keystore protects its secrets on disk:
+ * - `passphrase`: each secret is sealed in its own argon2id + XChaCha20-Poly1305
+ *   envelope, all opened by one shared, verifier-checked passphrase.
+ * - `none`: a dev keystore; secrets are stored as plaintext bytes. Never prompts;
+ *   refused for mainnet (ADR 080). For disposable testnet material only.
+ */
+export type KeystoreProtection = 'passphrase' | 'none';
 /** Options for constructing a {@link FileKeyStore}. */
 export type FileKeyStoreOptions = {
     /** Keystore file path. Defaults to {@link defaultKeystorePath}. */
     path?: string;
-    /** Supplies the passphrase lazily, called only when a secret must be sealed or opened. */
-    getPassphrase: () => string;
+    /**
+     * Supplies the passphrase lazily, called only when a secret must be sealed or
+     * opened. `confirm` is passed as `true` only while establishing a fresh
+     * encrypted keystore's passphrase, so the provider prompts twice and requires
+     * a match; it is a no-op for non-interactive sources.
+     */
+    getPassphrase: (opts?: {
+        confirm?: boolean;
+    }) => string;
     /** argon2id cost parameters used when sealing new secrets. Defaults to {@link DEFAULT_ARGON_PARAMS}. */
     argonParams?: ArgonParams;
     /** Tuning for the cross-process write lock. Defaults documented on {@link LockOptions}. */
     lock?: LockOptions;
+    /**
+     * Protection mode to use when *establishing* a fresh keystore. Defaults to
+     * `passphrase` (encrypted). Ignored for an existing keystore, whose on-disk
+     * `protection` always wins.
+     */
+    protection?: KeystoreProtection;
 };
 /**
- * A Node-only, file-backed {@link KeyValueStore} that encrypts secret keys at
+ * A Node-only, file-backed {@link KeyValueStore} that protects secret keys at
  * rest. It satisfies the synchronous store contract by caching the parsed file
  * in memory at construction and flushing the whole file atomically on every
  * mutation.
  *
+ * Encrypted keystores seal each secret in its own argon2id + XChaCha20-Poly1305
+ * envelope under one shared passphrase, and store a `verifier` sentinel so a
+ * candidate passphrase is checked before it is used (ADR 080): the first
+ * passphrase is established with a confirm prompt, and every later use is
+ * verified, so a typo is a loud failure rather than a key sealed under an
+ * unknown or divergent passphrase. Dev keystores (`protection: 'none'`) store
+ * secrets as plaintext and never prompt; they are refused for mainnet by the
+ * command layer.
+ *
  * Every mutation runs under an exclusive cross-process lock and, inside that
- * lock, reloads the file from disk before applying its change and flushing.
- * Caching at construction and flushing the whole file is otherwise a lost-update
- * race: two `btcr2` processes that each load, then each write, would have the
- * second overwrite the first. The lock serializes the writers and the reload
- * merges any change the other made, so concurrent invocations compose instead of
- * clobbering. Reads stay lock-free: an atomic rename means a concurrent reader
- * always sees a complete file, old or new.
+ * lock, reloads the file from disk before applying its change and flushing, so
+ * concurrent `btcr2` invocations compose instead of clobbering. Reads stay
+ * lock-free: an atomic rename means a concurrent reader always sees a complete
+ * file, old or new.
  *
  * Secrets are materialized only through {@link FileKeyStore.get}. The
  * {@link FileKeyStore.list} and {@link FileKeyStore.entries} projections omit
@@ -60,5 +88,53 @@ export declare class FileKeyStore implements KeyValueStore<KeyIdentifier, KeyEnt
      * clears it. Throws if the identifier is not a known key.
      */
     setActive(id: KeyIdentifier | undefined): void;
+    /** The keystore's protection mode. */
+    get protection(): KeystoreProtection;
+    /**
+     * Re-seals every sealed secret and the verifier under a new passphrase (ADR
+     * 080), returning the number of secrets re-sealed. Verifies the current
+     * passphrase against the verifier first. Refused on a dev keystore, which has
+     * no passphrase.
+     */
+    changePassphrase(oldPassphrase: string, newPassphrase: string): number;
 }
+/** A no-decrypt, no-prompt summary of a keystore file for `keystore status`. */
+export interface KeystoreSummary {
+    protection: KeystoreProtectionLabel;
+    established: boolean;
+    keyCount: number;
+    active: string | undefined;
+}
+/**
+ * Summarizes a keystore file by structure alone: protection mode, whether a
+ * passphrase is established, key count, and active key. Never decrypts, never
+ * prompts, and never throws (a missing or unreadable file reports `absent`), so
+ * it is safe for `keystore status`, `config path`, and the mainnet dev-keystore
+ * guard.
+ */
+export declare function keystoreSummary(path: string): KeystoreSummary;
+/** The protection label of a keystore file, without decrypting or prompting. */
+export declare function keystoreProtection(path: string): KeystoreProtectionLabel;
+/** Options for {@link initKeystore}. */
+export interface InitKeystoreOptions {
+    protection: KeystoreProtection;
+    getPassphrase: (opts?: {
+        confirm?: boolean;
+    }) => string;
+    argonParams?: ArgonParams;
+}
+/**
+ * Establishes a fresh keystore file (ADR 080). An encrypted keystore prompts
+ * (with confirm) for the passphrase and writes the verifier; a dev keystore
+ * writes a plaintext-mode header with no passphrase. The caller is responsible
+ * for refusing to overwrite an existing keystore; this always writes the file.
+ */
+export declare function initKeystore(path: string, options: InitKeystoreOptions): void;
+/**
+ * Re-seals every secret in an encrypted keystore under a new passphrase (ADR
+ * 080), returning the count re-sealed. The old and new passphrases are supplied
+ * explicitly, so the store's own passphrase provider is never invoked (a wrong
+ * current passphrase is caught by the verifier). Refused on a dev keystore.
+ */
+export declare function changeKeystorePassphrase(path: string, oldPassphrase: string, newPassphrase: string, argonParams?: ArgonParams): number;
 //# sourceMappingURL=file-key-store.d.ts.map

package/dist/types/src/keystore/file-key-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-key-store.d.ts","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAIrF,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG3D,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAwB3C,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0FAA0F;IAC1F,aAAa,EAAE,MAAM,MAAM,CAAC;IAC5B,wGAAwG;IACxG,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2FAA2F;IAC3F,IAAI,CAAC,EAAE,WAAW,CAAC;CACpB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,YAAa,YAAW,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;;gBAS7D,OAAO,EAAE,mBAAmB;IAiHxC,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS;IA0B5C,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAI/B,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI;IAgB7C,MAAM,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAWlC,KAAK,IAAI,IAAI;IAOb,iFAAiF;IACjF,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;IAIvB;;;;;;OAMG;IACH,OAAO,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAW3C,KAAK,IAAI,IAAI;IAQb,wEAAwE;IACxE,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;CAU/C"}
+{"version":3,"file":"file-key-store.d.ts","sourceRoot":"","sources":["../../../../src/keystore/file-key-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAGrF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAG3D,OAAO,KAAK,EAAE,WAAW,EAAkB,MAAM,eAAe,CAAC;AAEjE,OAAO,EAAgB,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAG3D,oDAAoD;AACpD,eAAO,MAAM,gBAAgB,EAAG,CAAU,CAAC;AAE3C;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,YAAY,GAAG,MAAM,CAAC;AAuDvD,uDAAuD;AACvD,MAAM,MAAM,mBAAmB,GAAG;IAChC,mEAAmE;IACnE,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;OAKG;IACH,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC;IACxD,wGAAwG;IACxG,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,2FAA2F;IAC3F,IAAI,CAAC,EAAE,WAAW,CAAC;IACnB;;;;OAIG;IACH,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,YAAa,YAAW,aAAa,CAAC,aAAa,EAAE,QAAQ,CAAC;;gBAW7D,OAAO,EAAE,mBAAmB;IAoPxC,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,QAAQ,GAAG,SAAS;IAiC5C,GAAG,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAI/B,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,QAAQ,GAAG,IAAI;IA2D7C,MAAM,CAAC,EAAE,EAAE,aAAa,GAAG,OAAO;IAWlC,KAAK,IAAI,IAAI;IAOb,iFAAiF;IACjF,IAAI,IAAI,KAAK,CAAC,QAAQ,CAAC;IAIvB;;;;;;OAMG;IACH,OAAO,IAAI,KAAK,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAW3C,KAAK,IAAI,IAAI;IAQb,wEAAwE;IACxE,SAAS,IAAI,MAAM,GAAG,SAAS;IAI/B;;;OAGG;IACH,SAAS,CAAC,EAAE,EAAE,aAAa,GAAG,SAAS,GAAG,IAAI;IAW9C,sCAAsC;IACtC,IAAI,UAAU,IAAI,kBAAkB,CAEnC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM;CA0DvE;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAI,uBAAuB,CAAC;IACtC,WAAW,EAAG,OAAO,CAAC;IACtB,QAAQ,EAAM,MAAM,CAAC;IACrB,MAAM,EAAQ,MAAM,GAAG,SAAS,CAAC;CAClC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,CA0B7D;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,uBAAuB,CAExE;AAED,wCAAwC;AACxC,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAM,kBAAkB,CAAC;IACnC,aAAa,EAAG,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,MAAM,CAAC;IACzD,WAAW,CAAC,EAAI,WAAW,CAAC;CAC7B;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,IAAI,CAW7E;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,IAAI,EAAY,MAAM,EACtB,aAAa,EAAG,MAAM,EACtB,aAAa,EAAG,MAAM,EACtB,WAAW,CAAC,EAAI,WAAW,GAC1B,MAAM,CAaR"}

package/dist/types/src/keystore/passphrase.d.ts

@@ -8,13 +8,28 @@ export type PassphraseOptions = {
     prompt?: string;
     /** When true, prompt twice and require the entries to match (for a new keystore). */
     confirm?: boolean;
+    /**
+     * When true, skip the environment variable and passphrase file and require a
+     * fresh terminal entry. Used for the *new* passphrase in `change-passphrase`,
+     * where the env var / file holds the *current* passphrase and must not silently
+     * satisfy the new one (which would make the change a no-op).
+     */
+    forcePrompt?: boolean;
 };
 /**
  * Acquires a passphrase without ever reading it from a command-line flag value
  * (which would leak into process listings and shell history). Resolution order:
  * the {@link ENV_KEYSTORE_PASSPHRASE} environment variable, a passphrase file,
  * then a non-echoing terminal prompt. Throws if none is available and standard
- * input is not a terminal.
+ * input is not a terminal. When `forcePrompt` is set, the env var and file are
+ * skipped and a terminal entry is required.
  */
 export declare function acquirePassphrase(options?: PassphraseOptions): string;
+/**
+ * Removes the last whole UTF-8 character from an accumulating byte array in
+ * place: pops any trailing continuation bytes (0b10xxxxxx) then the leading
+ * byte. Exported for testing; a backspace mid-entry must not strand a fragment
+ * that later decodes to U+FFFD.
+ */
+export declare function dropLastUtf8Char(bytes: number[]): void;
 //# sourceMappingURL=passphrase.d.ts.map

package/dist/types/src/keystore/passphrase.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passphrase.d.ts","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CAyBzE"}
+{"version":3,"file":"passphrase.d.ts","sourceRoot":"","sources":["../../../../src/keystore/passphrase.ts"],"names":[],"mappings":"AAGA,qFAAqF;AACrF,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,wDAAwD;AACxD,MAAM,MAAM,iBAAiB,GAAG;IAC9B,wFAAwF;IACxF,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qFAAqF;IACrF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,CAAC;AAEF;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,CA2BzE;AAuBD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAGtD"}

package/dist/types/src/keystore/paths.d.ts

@@ -1,13 +1,9 @@
 /**
- * Default keystore file path, following the XDG Base Directory Specification's
- * data directory. Secret key material is data a user accumulates, so it lives
- * under the data directory, kept separate from the configuration directory used
- * for portable settings.
- *
- * Resolution order:
- * 1. `$XDG_DATA_HOME/btcr2/keystore.json`
- * 2. `%LOCALAPPDATA%/btcr2/keystore.json` (Windows)
- * 3. `~/.local/share/btcr2/keystore.json` (fallback)
+ * The default keystore path now lives alongside the config file under a single
+ * CLI home root (`<home>/keystore.json`, ADR 079). The implementation lives in
+ * `../paths.ts` (the single source of truth for on-disk state locations); it is
+ * re-exported here so existing `./paths.js` importers in the keystore layer keep
+ * their import surface.
  */
-export declare function defaultKeystorePath(): string;
+export { defaultKeystorePath } from '../paths.js';
 //# sourceMappingURL=paths.d.ts.map

package/dist/types/src/keystore/paths.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../../src/keystore/paths.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAK5C"}
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../../../src/keystore/paths.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}

package/dist/types/src/output.d.ts

@@ -1,4 +1,26 @@
 import type { CommandResult, GlobalOptions } from './types.js';
+/** Placeholder printed in place of a redacted secret value. */
+export declare const REDACTED = "********";
+/** Whether a config key name looks like a secret (so its scalar value should be redacted). */
+export declare function isSecretKey(key: string): boolean;
+/**
+ * Masks the password in a `scheme://user:pass@host` URL, leaving the rest of the
+ * value verbatim. A credential embedded in an endpoint URL (e.g. `rpcUrl`) is not
+ * caught by key-name matching, so it is scrubbed here regardless of the key.
+ */
+export declare function scrubUrlUserinfo(value: string | undefined): string | undefined;
+/**
+ * Returns a deep copy of `value` with secret scalar values replaced by
+ * {@link REDACTED}, so routine introspection (`config get`/`list`/`effective`)
+ * does not print RPC passwords or other secrets into terminal scrollback and CI
+ * logs. A secret-named key redacts only a scalar value (an object under such a
+ * key, e.g. a profile named `access-token`, is still traversed, not wholesale
+ * masked). Passwords embedded in URL values are scrubbed regardless of key name.
+ * When `keyName` is a secret name, a directly-passed scalar value is redacted
+ * (used when a single leaf value is printed). Display-only: the stored config and
+ * the value used to connect are untouched.
+ */
+export declare function redactSecrets(value: unknown, keyName?: string): unknown;
 /**
  * Formats a CommandResult for console output.
  * In 'json' mode, the full result is serialized.

package/dist/types/src/output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAMlF"}
+{"version":3,"file":"output.d.ts","sourceRoot":"","sources":["../../../src/output.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D,+DAA+D;AAC/D,eAAO,MAAM,QAAQ,aAAa,CAAC;AASnC,8FAA8F;AAC9F,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG9E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAevE;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,aAAa,GAAG,MAAM,CAMlF"}