@did-btcr2/cli 0.15.0 → 0.17.0

package/dist/types/src/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AACrG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,eAAO,MAAM,kBAAkB,EAAE,aAAa,EAE7C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG1E;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAG,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAS,gBAAgB,CAAC;IACxC,OAAO,EAAgB,cAAc,EAAE,CAAC;IACxC,eAAe,EAAQ,MAAM,CAAC;IAC9B,oBAAoB,EAAG,MAAM,CAAC;IAC9B,QAAQ,EAAe,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACvF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACjG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACzG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/F;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACrE;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAW,YAAY,CAAC;IAC9B,OAAO,EAAU,OAAO,CAAC;IACzB,KAAK,EAAY,OAAO,CAAC;IACzB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,aAAa,CAAC,EAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAI,MAAM,CAAC;IACxB,YAAY,CAAC,EAAI,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAQ,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AACrG,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C;;;;GAIG;AACH,MAAM,MAAM,uBAAuB,GAAG,WAAW,GAAG,KAAK,GAAG,QAAQ,CAAC;AAErE,eAAO,MAAM,kBAAkB,EAAE,aAAa,EAE7C,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAG1E;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAG,MAAM,CAAC;IACpB,OAAO,CAAC,EAAK,iBAAiB,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,cAAc,EAAS,gBAAgB,CAAC;IACxC,OAAO,EAAgB,cAAc,EAAE,CAAC;IACxC,eAAe,EAAQ,MAAM,CAAC;IAC9B,oBAAoB,EAAG,MAAM,CAAC;IAC9B,QAAQ,EAAe,MAAM,CAAC;CAC/B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC3C;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACvF;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,GAC3G;IAAE,MAAM,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAA;CAAE,GACjG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACzG;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAC/F;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAChE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,IAAI,CAAA;KAAE,CAAA;CAAE,GAC5D;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAA;KAAE,CAAA;CAAE,GACpI;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjD;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACvC;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAClD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,WAAW,EAAE,CAAA;KAAE,CAAA;CAAE,GAC3E;IAAE,MAAM,EAAE,kBAAkB,CAAC;IAAC,IAAI,EAAE,eAAe,CAAA;CAAE,GACrD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACnF;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE,YAAY,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,WAAW,GAAG,KAAK,CAAA;KAAE,CAAA;CAAE,GACpF;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,uBAAuB,CAAC;QAAC,WAAW,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,aAAa,CAAA;KAAE,CAAA;CAAE,GACtL;IAAE,MAAM,EAAE,4BAA4B,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACjF;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,IAAI,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GAChG;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GACrE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzC;IAAE,MAAM,EAAE,gBAAgB,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAE5D,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAW,YAAY,CAAC;IAC9B,OAAO,EAAU,OAAO,CAAC;IACzB,KAAK,EAAY,OAAO,CAAC;IACzB,IAAI,CAAC,EAAY,MAAM,CAAC;IACxB,MAAM,CAAC,EAAU,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,OAAO,CAAC,EAAS,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,SAAS,CAAC,EAAO,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;IACxB,aAAa,CAAC,EAAG,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAI,MAAM,CAAC;IACxB,YAAY,CAAC,EAAI,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAQ,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAM,MAAM,CAAC;CACzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@did-btcr2/cli",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "type": "module",
   "description": "CLI for interacting with did-btcr2-js, the JavaScript/TypeScript reference implementation of the did:btcr2 method. Exposes various parts of multiple packages in the did-btcr2-js monorepo.",
   "main": "./dist/cjs/index.js",
@@ -61,11 +61,11 @@
     "@scure/base": "^1.2.6",
     "@web5/dids": "^1.2.0",
     "commander": "^13.1.0",
-    "@did-btcr2/keypair": "^0.13.1",
     "@did-btcr2/api": "^0.16.1",
     "@did-btcr2/key-manager": "^0.7.0",
     "@did-btcr2/common": "^9.1.0",
-    "@did-btcr2/method": "^0.54.1"
+    "@did-btcr2/method": "^0.54.1",
+    "@did-btcr2/keypair": "^0.13.1"
   },
   "devDependencies": {
     "@eslint/js": "^9.21.0",

package/src/cli.ts

@@ -5,7 +5,9 @@ import {
   registerConfigCommand,
   registerCreateCommand,
   registerDeactivateCommand,
+  registerInitCommand,
   registerKeyCommand,
+  registerKeystoreCommand,
   registerProfileCommand,
   registerResolveCommand,
   registerUpdateCommand,
@@ -44,7 +46,8 @@ export class DidBtcr2Cli {
       .option('-o, --output <format>', 'Output format <json|text> (default: config defaults.output, else text)')
       .option('--verbose', 'Verbose output', false)
       .option('--quiet', 'Suppress non-essential output', false)
-      .option('-c, --config <path>', 'Path to config file (default: $XDG_CONFIG_HOME/btcr2/config.json)')
+      .option('--home <dir>', 'btcr2 home directory holding config.json + keystore.json (default: ~/.btcr2, %LOCALAPPDATA%\\btcr2 on Windows; overrides $BTCR2_HOME)')
+      .option('-c, --config <path>', 'Path to config file (default: <home>/config.json)')
       .option('--profile <name>', 'Config profile name (default: auto-detected from network)')
       .option('--btc-rest <url>', 'Override Bitcoin REST endpoint (Esplora API)')
       .option('--btc-rpc-url <url>', 'Override Bitcoin Core RPC endpoint')
@@ -57,7 +60,7 @@ export class DidBtcr2Cli {
       .option('--btc-rest-header <header>', 'Extra Bitcoin REST header "Key: Value" (repeatable)', collectHeader, [])
       .option('--btc-rpc-wallet <name>', 'Bitcoin Core wallet name for wallet-scoped RPCs')
       .option('--btc-rpc-header <header>', 'Extra Bitcoin Core RPC header "Key: Value" (repeatable)', collectHeader, [])
-      .option('--keystore <path>', 'Path to the keystore file (default: $XDG_DATA_HOME/btcr2/keystore.json)')
+      .option('--keystore <path>', 'Path to the keystore file (default: <home>/keystore.json)')
       .option('--passphrase-file <path>', 'Read the keystore passphrase from a file (unattended use)')
       .option('--signing-key <ref>', 'Key for create/update/deactivate signing: a URN, fingerprint prefix, or name');
 
@@ -70,14 +73,16 @@ export class DidBtcr2Cli {
     // value is written back so every command reads it through globals().output.
     this.program.hook('preAction', () => {
       const opts = this.program.opts() as GlobalOptions;
-      opts.output = resolveOutputFormat({ output: opts.output, config: opts.config });
+      opts.output = resolveOutputFormat({ output: opts.output, config: opts.config, home: opts.home });
     });
 
+    registerInitCommand(this.program, globals);
     registerCreateCommand(this.program, factory, keystoreFactory, globals);
     registerResolveCommand(this.program, factory, globals);
     registerUpdateCommand(this.program, keystoreFactory, globals);
     registerDeactivateCommand(this.program, keystoreFactory, globals);
     registerKeyCommand(this.program, keystoreFactory, globals);
+    registerKeystoreCommand(this.program, globals);
     registerConfigCommand(this.program, globals);
     registerProfileCommand(this.program, globals);
     registerCompletionCommand(this.program, globals);

package/src/commands/config.ts

@@ -1,6 +1,5 @@
 import type { Command } from 'commander';
 import { existsSync } from 'node:fs';
-import { dirname } from 'node:path';
 import {
   CONFIG_SCHEMA_VERSION,
   defaultConfigPath,
@@ -9,23 +8,24 @@ import {
   readConfigFile,
   resolveDefaultNetwork,
   resolveEffectiveConfig,
+  resolveKeystorePath,
   runDoctor,
   setConfigPath,
   unsetConfigPath,
   writeConfigFile,
+  writeDefaultConfigFile,
 } from '../config.js';
 import { findConfigIssues, validateConfigSet } from '../config-schema.js';
 import { CLIError } from '../error.js';
-import { ensureDir, writeFileAtomic } from '../keystore/atomic.js';
-import { defaultKeystorePath } from '../keystore/paths.js';
 import { formatResult, REDACTED, redactSecrets, scrubUrlUserinfo } from '../output.js';
+import { resolveHome } from '../paths.js';
 import type { CommandResult, GlobalOptions, NetworkOption } from '../types.js';
 import { SUPPORTED_NETWORKS } from '../types.js';
 
 /** Registers the `config` command group for reading and writing CLI configuration. */
 export function registerConfigCommand(program: Command, globals: () => GlobalOptions): void {
   const config = program.command('config').description('Read and write CLI configuration.');
-  const path = (): string => globals().config ?? defaultConfigPath();
+  const path = (): string => globals().config ?? defaultConfigPath(globals());
   const print = (result: CommandResult): void => console.log(formatResult(result, globals()));
 
   config
@@ -37,13 +37,7 @@ export function registerConfigCommand(program: Command, globals: () => GlobalOpt
       if (existsSync(p) && !options.force) {
         throw new CLIError(`Config already exists at ${p}. Use --force to overwrite.`, 'INVALID_ARGUMENT_ERROR', { path: p });
       }
-      const scaffold = {
-        schemaVersion : CONFIG_SCHEMA_VERSION,
-        defaults      : { output: 'text' },
-        profiles      : Object.fromEntries(SUPPORTED_NETWORKS.map(n => [ n, {} ])),
-      };
-      ensureDir(dirname(p), 0o700);
-      writeFileAtomic(p, `${JSON.stringify(scaffold, null, 2)}\n`, 0o600);
+      writeDefaultConfigFile(p);
       print({ action: 'config-init', data: { path: p } });
     });
 
@@ -128,11 +122,15 @@ export function registerConfigCommand(program: Command, globals: () => GlobalOpt
 
   config
     .command('path')
-    .description('Print the resolved config-file and keystore paths.')
+    .description('Print the resolved home directory, config-file, and keystore paths.')
     .action(() => {
+      const g = globals();
       const data = {
-        config   : globals().config ?? defaultConfigPath(),
-        keystore : globals().keystore ?? defaultKeystorePath(),
+        home     : resolveHome(g),
+        config   : g.config ?? defaultConfigPath(g),
+        // Diagnostic command: report the path even when the config is malformed
+        // (this is a command you run to find and fix a broken config).
+        keystore : resolveKeystorePath(g, { lenient: true }),
       };
       print({ action: 'config-path', data });
     });

package/src/commands/create.ts

@@ -1,7 +1,7 @@
 import { bytesToHex, hexToBytes } from '@noble/hashes/utils.js';
 import type { Command } from 'commander';
 import type { ApiFactory, ConnectionOverrides } from '../config.js';
-import { profileNetworkMismatch, resolveDefaultNetwork } from '../config.js';
+import { assertKeystoreAllowedForNetwork, profileNetworkMismatch, resolveDefaultNetwork } from '../config.js';
 import { CLIError } from '../error.js';
 import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
 import { formatResult } from '../output.js';
@@ -132,6 +132,8 @@ export function registerCreateCommand(
       }
 
       // Generate: mint a fresh key, persist it, and set it active (passphrase prompt).
+      // Refuse to seal a fresh mainnet key into an unencrypted dev keystore (ADR 080).
+      assertKeystoreAllowedForNetwork(network, overrides);
       const api = keystoreFactory(undefined, overrides);
       const { did, keyId } = api.generateDid({ network, setActive: true });
       const publicKey = bytesToHex(api.kms.getPublicKey(keyId));
@@ -145,6 +147,7 @@ export function registerCreateCommand(
 /** Builds the keystore- and config-resolution overrides from the global flags. */
 function overridesFromGlobals(g: GlobalOptions): ConnectionOverrides {
   return {
+    home           : g.home,
     config         : g.config,
     profile        : g.profile,
     keystore       : g.keystore,

package/src/commands/deactivate.ts

@@ -1,7 +1,7 @@
 import type { PublishToCasMode } from '@did-btcr2/api';
 import { KeyManagerSigner } from '@did-btcr2/key-manager';
 import type { Command } from 'commander';
-import { deriveNetwork, resolveBroadcastOptions, resolveSigningKeyRef, type ApiFactory } from '../config.js';
+import { assertKeystoreAllowedForNetwork, deriveNetwork, resolveBroadcastOptions, resolveSigningKeyRef, type ApiFactory } from '../config.js';
 import { CLIError } from '../error.js';
 import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
 import { formatResult } from '../output.js';
@@ -88,6 +88,8 @@ export function registerDeactivateCommand(
       // Deactivation is an update that applies the deactivation patch. The core
       // method has no separate deactivate path, so this routes through update.
       const network = deriveNetwork(did);
+      // Refuse to sign a mainnet deactivation with an unencrypted dev keystore (ADR 080).
+      assertKeystoreAllowedForNetwork(network, globals());
       const api = factory(network, globals());
       const keyId = resolveKeyRef(api.kms.kms, resolveSigningKeyRef(globals()));
       const signer = new KeyManagerSigner(api.kms.kms, keyId);

package/src/commands/index.ts

@@ -1,8 +1,10 @@
+export { registerInitCommand } from './init.js';
 export { registerCreateCommand } from './create.js';
 export { registerResolveCommand } from './resolve.js';
 export { registerUpdateCommand } from './update.js';
 export { registerDeactivateCommand } from './deactivate.js';
 export { registerKeyCommand } from './key.js';
+export { registerKeystoreCommand } from './keystore.js';
 export { registerConfigCommand } from './config.js';
 export { registerProfileCommand } from './profile.js';
 export { registerCompletionCommand } from './completion.js';

package/src/commands/init.ts

@@ -0,0 +1,80 @@
+import type { Command } from 'commander';
+import { existsSync } from 'node:fs';
+import { defaultConfigPath, resolveKeystorePath, writeDefaultConfigFile } from '../config.js';
+import { ensureDir } from '../keystore/atomic.js';
+import { initKeystore, keystoreSummary } from '../keystore/file-key-store.js';
+import { acquirePassphrase } from '../keystore/passphrase.js';
+import { clearSession } from '../keystore/session.js';
+import { formatResult } from '../output.js';
+import { defaultSessionPath, resolveHome } from '../paths.js';
+import type { CommandResult, GlobalOptions } from '../types.js';
+
+/**
+ * Registers the top-level `btcr2 init`: the one-command entry point that creates
+ * the btcr2 home (ADR 079), writes a default config if none exists, and
+ * establishes the keystore if none exists (encrypted with a confirmed passphrase
+ * by default, or `--dev` for an unencrypted testnet keystore). Idempotent:
+ * existing files are left untouched unless `--force` is given. Establishing the
+ * passphrase here, up front and confirmed, is what keeps the first `key generate`
+ * off the accidental-first-seal path (ADR 080).
+ */
+export function registerInitCommand(program: Command, globals: () => GlobalOptions): void {
+  const print = (result: CommandResult): void => console.log(formatResult(result, globals()));
+
+  program
+    .command('init')
+    .description('Set up the btcr2 home: create the directory, a default config, and establish the keystore.')
+    .option('--dev', 'Establish an UNENCRYPTED dev keystore: plaintext keys, no passphrase. Testnet only.', false)
+    .option('--force', 'Re-create the config and keystore even if they already exist.', false)
+    .action((options: { dev?: boolean; force?: boolean }) => {
+      const g = globals();
+      const home = resolveHome(g);
+      const configPath = g.config ?? defaultConfigPath(g);
+      const keystorePath = resolveKeystorePath(g);
+      ensureDir(home, 0o700);
+
+      const created: string[] = [];
+
+      // The config is regenerable, so --force may re-scaffold it.
+      if (!existsSync(configPath) || options.force) {
+        writeDefaultConfigFile(configPath);
+        created.push('config');
+      }
+
+      // The keystore holds unrecoverable secret keys, so `init` never overwrites
+      // an existing one, even with --force: re-establishing a keystore is the
+      // explicit, deliberate `keystore init --force`. `init` only establishes a
+      // keystore when none exists.
+      const keystoreExists = existsSync(keystorePath);
+      if (keystoreExists && options.force && !g.quiet) {
+        process.stderr.write(
+          `note: a keystore already exists at ${keystorePath} and was left intact. `
+          + 'To re-establish it (discarding its keys), run "btcr2 keystore init --force".\n',
+        );
+      }
+      if (!keystoreExists) {
+        if (options.dev && !g.quiet) {
+          process.stderr.write(
+            'warning: establishing an UNENCRYPTED dev keystore. Keys are stored in plaintext. '
+            + 'Use it only for disposable testnet material; mainnet operations will be refused.\n',
+          );
+        }
+        initKeystore(keystorePath, {
+          protection    : options.dev ? 'none' : 'passphrase',
+          getPassphrase : (opts) => acquirePassphrase({ passphraseFile: g.passphraseFile, confirm: opts?.confirm, prompt: 'New keystore passphrase: ' }),
+        });
+        // A freshly established keystore mints a new verifier (or none, for --dev),
+        // so any cached session holds a passphrase for a keystore that no longer
+        // exists. Drop it, matching `keystore init` / `change-passphrase`, rather
+        // than leave a stale plaintext passphrase behind (ADR 081).
+        clearSession(defaultSessionPath(g));
+        created.push('keystore');
+      }
+
+      const protection = keystoreSummary(keystorePath).protection;
+      print({ action: 'init', data: { home, config: configPath, keystore: keystorePath, created, protection } });
+      if (!g.quiet && g.output !== 'json') {
+        process.stderr.write(`btcr2 home ready at ${home}. Next: btcr2 key generate --set-active\n`);
+      }
+    });
+}

package/src/commands/keystore.ts

@@ -0,0 +1,232 @@
+import type { Command } from 'commander';
+import { existsSync } from 'node:fs';
+import { resolveDefaultNetwork, resolveKeystorePath } from '../config.js';
+import { CLIError } from '../error.js';
+import {
+  changeKeystorePassphrase,
+  initKeystore,
+  keystoreSummary,
+  keystoreVerifierId,
+  verifyKeystorePassphrase,
+} from '../keystore/file-key-store.js';
+import { acquirePassphrase } from '../keystore/passphrase.js';
+import {
+  clearSession,
+  DEFAULT_SESSION_TTL_MS,
+  ENV_KEYSTORE_TTL,
+  MAX_SESSION_TTL_MS,
+  parseTtlToMs,
+  readSessionStatus,
+  writeSession,
+} from '../keystore/session.js';
+import { formatResult } from '../output.js';
+import { defaultSessionPath } from '../paths.js';
+import { blankToUndef, type CommandResult, type GlobalOptions } from '../types.js';
+
+/**
+ * Registers the `keystore` command group: establish, inspect, and re-key the
+ * encrypted keystore (ADR 080), plus the session unlock agent (ADR 081). These
+ * operate on the keystore and session files directly (no Bitcoin connection or
+ * KeyManager) and never decrypt a key except when re-sealing during
+ * `change-passphrase`.
+ */
+export function registerKeystoreCommand(program: Command, globals: () => GlobalOptions): void {
+  const keystore = program.command('keystore').description('Establish, inspect, re-key, and unlock the keystore.');
+  const print = (result: CommandResult): void => console.log(formatResult(result, globals()));
+
+  keystore
+    .command('init')
+    .description('Establish the keystore (encrypted by default). Prompts for a passphrase and confirms it.')
+    .option('--dev', 'Create an UNENCRYPTED dev keystore: plaintext keys, no passphrase. Testnet only; mainnet operations are refused.', false)
+    .option('--force', 'Re-establish even if a keystore already exists (discards its keys).', false)
+    .action((options: { dev?: boolean; force?: boolean }) => {
+      const g = globals();
+      const path = resolveKeystorePath(g);
+      if (existsSync(path) && !options.force) {
+        throw new CLIError(
+          `A keystore already exists at ${path}. Use --force to re-establish it (this discards its keys).`,
+          'INVALID_ARGUMENT_ERROR',
+          { path },
+        );
+      }
+      // --force re-establishes over an existing keystore; make the key loss loud.
+      if (existsSync(path) && options.force && !g.quiet) {
+        const { keyCount } = keystoreSummary(path);
+        if (keyCount > 0) {
+          process.stderr.write(
+            `warning: re-establishing the keystore at ${path} permanently discards its ${keyCount} existing key(s).\n`,
+          );
+        }
+      }
+      if (options.dev && !g.quiet) {
+        process.stderr.write(
+          'warning: creating an UNENCRYPTED dev keystore. Keys are stored in plaintext. '
+          + 'Use it only for disposable testnet material; mainnet operations will be refused.\n',
+        );
+      }
+      initKeystore(path, {
+        protection    : options.dev ? 'none' : 'passphrase',
+        getPassphrase : (opts) => acquirePassphrase({ passphraseFile: g.passphraseFile, confirm: opts?.confirm, prompt: 'New keystore passphrase: ' }),
+      });
+      // A re-established keystore mints a new verifier (or none, for --dev), so any
+      // cached session now holds a passphrase for a keystore that no longer exists.
+      // Drop it rather than leave a stale plaintext passphrase behind (ADR 081).
+      clearSession(defaultSessionPath(g));
+      print({ action: 'keystore-init', data: { path, protection: options.dev ? 'dev' : 'encrypted' } });
+    });
+
+  keystore
+    .command('status')
+    .description('Show the keystore path, protection mode, key count, and session state. Never decrypts or prompts.')
+    .action(() => {
+      const g = globals();
+      // Diagnostic command: report status even when the config is malformed,
+      // rather than crashing on the config you ran this to inspect.
+      const path = resolveKeystorePath(g, { lenient: true });
+      const summary = keystoreSummary(path);
+      const session = readSessionStatus(defaultSessionPath(g), path, keystoreVerifierId(path));
+      if (summary.protection === 'dev' && !g.quiet && g.output !== 'json') {
+        process.stderr.write('warning: this is an UNENCRYPTED dev keystore; keys are stored in plaintext.\n');
+      }
+      print({ action: 'keystore-status', data: { path, ...summary, session } });
+    });
+
+  keystore
+    .command('change-passphrase')
+    .alias('passwd')
+    .description('Change the keystore passphrase, re-sealing every key under the new one. Encrypted keystores only.')
+    .action(() => {
+      const g = globals();
+      const path = resolveKeystorePath(g);
+      const summary = keystoreSummary(path);
+      if (summary.protection === 'absent') {
+        throw new CLIError(`No keystore at ${path}. Run "btcr2 keystore init" first.`, 'INVALID_ARGUMENT_ERROR', { path });
+      }
+      if (summary.protection === 'dev') {
+        throw new CLIError(
+          `The keystore at ${path} is an unencrypted dev keystore; there is no passphrase to change.`,
+          'INVALID_ARGUMENT_ERROR',
+          { path },
+        );
+      }
+      // Current passphrase may come from the env var / file (unattended); the new
+      // one must be entered fresh (forcePrompt) so it cannot be silently satisfied
+      // by the same source and make the change a no-op.
+      const oldPassphrase = acquirePassphrase({ passphraseFile: g.passphraseFile, prompt: 'Current keystore passphrase: ' });
+      const newPassphrase = acquirePassphrase({ forcePrompt: true, confirm: true, prompt: 'New keystore passphrase: ' });
+      const rekeyed = changeKeystorePassphrase(path, oldPassphrase, newPassphrase);
+      // The rotated verifier already invalidates a cached session by fingerprint,
+      // but the session file still holds the OLD passphrase in plaintext; delete it.
+      clearSession(defaultSessionPath(g));
+      print({ action: 'keystore-change-passphrase', data: { path, rekeyed } });
+    });
+
+  keystore
+    .command('unlock')
+    .description('Cache the keystore passphrase for a session so later commands do not re-prompt (ADR 081).')
+    .option('--ttl <duration>', `Session lifetime: bare seconds or an s/m/h suffix (default 1h, max 24h). Also $${ENV_KEYSTORE_TTL}.`)
+    .option('--allow-mainnet', 'Permit unlocking when the active network is mainnet (bitcoin); this suspends per-use passphrase auth for the session.', false)
+    .action((options: { ttl?: string; allowMainnet?: boolean }) => {
+      const g = globals();
+      const path = resolveKeystorePath(g);
+      const summary = keystoreSummary(path);
+      if (summary.protection === 'absent') {
+        throw new CLIError(`No keystore at ${path}. Run "btcr2 init" or "btcr2 keystore init" first.`, 'INVALID_ARGUMENT_ERROR', { path });
+      }
+      if (summary.protection === 'dev') {
+        throw new CLIError(
+          `The keystore at ${path} is an unencrypted dev keystore; it has no passphrase to cache, so no unlock is needed.`,
+          'INVALID_ARGUMENT_ERROR',
+          { path },
+        );
+      }
+      if (!summary.established) {
+        throw new CLIError(
+          `The keystore at ${path} has no passphrase established yet. `
+          + 'Establish one with "btcr2 keystore init" or the first "btcr2 key generate".',
+          'INVALID_ARGUMENT_ERROR',
+          { path },
+        );
+      }
+      // An unlocked encrypted keystore signs prompt-free for the whole TTL,
+      // silently removing per-use passphrase auth. Two guards, both keyed to
+      // --allow-mainnet (ADR 081): this early refusal when the *configured* default
+      // network is mainnet (a clear signal before caching anything), plus the
+      // authoritative one at consumption, where the session records `allowMainnet`
+      // (below) and a `bitcoin` operation, whose network is derived from the DID
+      // rather than the config, is withheld from a session that lacks it. The
+      // active network defaults to a testnet, so this early refusal never fires
+      // for the demo.
+      if (!options.allowMainnet && resolveDefaultNetwork(g) === 'bitcoin') {
+        throw new CLIError(
+          `Refusing to unlock for a mainnet (bitcoin) context: caching the passphrase suspends per-use `
+          + 'authentication for the session. Pass --allow-mainnet to override, or keep signing mainnet '
+          + 'updates with a per-use passphrase prompt.',
+          'MAINNET_UNLOCK_REFUSED_ERROR',
+          { path },
+        );
+      }
+      const ttlMs = resolveSessionTtl(options.ttl);
+      // Acquire the passphrase directly (env / file / prompt) with NO session
+      // consultation and NO confirm, verify it against the keystore verifier, and
+      // only then cache it. A wrong passphrase writes no session file.
+      const passphrase = acquirePassphrase({ passphraseFile: g.passphraseFile, prompt: 'Keystore passphrase: ' });
+      if (!verifyKeystorePassphrase(path, passphrase)) {
+        throw new CLIError(`Incorrect passphrase for the keystore at ${path}; no session was created.`, 'DECRYPT_ERROR', { path });
+      }
+      const verifierId = keystoreVerifierId(path);
+      if (!verifierId) {
+        // An established keystore always carries a verifier; defensive guard.
+        throw new CLIError(`The keystore at ${path} has no verifier to bind a session to.`, 'INVALID_ARGUMENT_ERROR', { path });
+      }
+      const session = writeSession(defaultSessionPath(g), {
+        keystorePath : path,
+        verifierId,
+        passphrase,
+        ttlMs,
+        allowMainnet : !!options.allowMainnet,
+      });
+      print({ action: 'keystore-unlock', data: { keystore: path, expiresAt: session.expiresAt, ttlSeconds: session.ttlSeconds } });
+    });
+
+  keystore
+    .command('lock')
+    .description('Revoke the cached session so later commands prompt for the passphrase again (ADR 081).')
+    .action(() => {
+      const g = globals();
+      // Resolve the session from the home only (defaultSessionPath never reads the
+      // config), so lock revokes even under a malformed config.
+      const sessionPath = defaultSessionPath(g);
+      const cleared = clearSession(sessionPath);
+      print({ action: 'keystore-lock', data: { path: sessionPath, cleared } });
+    });
+}
+
+/**
+ * Resolves the session TTL in milliseconds from the `--ttl` flag, then
+ * `$BTCR2_KEYSTORE_TTL`, then the one-hour default. Rejects a non-positive,
+ * malformed, or over-24h value with a {@link CLIError} that names the actual
+ * source (the flag or the env var) so the operator fixes the right input.
+ */
+function resolveSessionTtl(flag?: string): number {
+  const fromFlag = blankToUndef(flag);
+  const raw = fromFlag ?? blankToUndef(process.env[ENV_KEYSTORE_TTL]);
+  if (raw === undefined) return DEFAULT_SESSION_TTL_MS;
+  const source = fromFlag !== undefined ? '--ttl' : `$${ENV_KEYSTORE_TTL}`;
+  const ms = parseTtlToMs(raw);
+  if (ms === undefined || ms <= 0) {
+    throw new CLIError(
+      `Invalid ${source} "${raw}": expected seconds or a value with an s/m/h suffix, e.g. 3600, 45m, or 2h.`,
+      'INVALID_ARGUMENT_ERROR',
+      { value: raw, source },
+    );
+  }
+  if (ms > MAX_SESSION_TTL_MS) {
+    throw new CLIError(
+      `${source} "${raw}" exceeds the 24h maximum for a cached passphrase.`,
+      'INVALID_ARGUMENT_ERROR',
+      { value: raw, source },
+    );
+  }
+  return ms;
+}

package/src/commands/profile.ts

@@ -7,7 +7,7 @@ import type { CommandResult, GlobalOptions } from '../types.js';
 /** Registers the `profile` command group for managing configuration profiles. */
 export function registerProfileCommand(program: Command, globals: () => GlobalOptions): void {
   const profile = program.command('profile').description('Manage configuration profiles.');
-  const path = (): string => globals().config ?? defaultConfigPath();
+  const path = (): string => globals().config ?? defaultConfigPath(globals());
   const print = (result: CommandResult): void => console.log(formatResult(result, globals()));
 
   profile

package/src/commands/update.ts

@@ -1,7 +1,7 @@
 import type { PublishToCasMode } from '@did-btcr2/api';
 import { KeyManagerSigner } from '@did-btcr2/key-manager';
 import type { Command } from 'commander';
-import { deriveNetwork, resolveBroadcastOptions, resolveSigningKeyRef, type ApiFactory } from '../config.js';
+import { assertKeystoreAllowedForNetwork, deriveNetwork, resolveBroadcastOptions, resolveSigningKeyRef, type ApiFactory } from '../config.js';
 import { CLIError } from '../error.js';
 import { resolveKeyRef } from '../keystore/resolve-key-ref.js';
 import { formatResult } from '../output.js';
@@ -88,6 +88,8 @@ export function registerUpdateCommand(
         );
       }
       const network = deriveNetwork(did);
+      // Refuse to sign a mainnet update with an unencrypted dev keystore (ADR 080).
+      assertKeystoreAllowedForNetwork(network, globals());
       const api = factory(network, globals());
       const keyId = resolveKeyRef(api.kms.kms, resolveSigningKeyRef(globals()));
       const signer = new KeyManagerSigner(api.kms.kms, keyId);