@feralfile/cli 2.8.0 → 2.10.0

package/dist/src/commands/status.js

@@ -12,6 +12,7 @@ const ed25519_key_derive_1 = require("../utilities/ed25519-key-derive");
 const playlist_signing_role_1 = require("../utilities/playlist-signing-role");
 const signing_identity_1 = require("../utilities/signing-identity");
 const config_placeholders_1 = require("../utilities/config-placeholders");
+const signing_key_source_1 = require("../utilities/signing-key-source");
 exports.statusCommand = new commander_1.Command('status')
     .description('Show configuration status')
     // Identity discovery must cover every key `sign` accepts, not just the configured one. `sign --key`
@@ -19,9 +20,34 @@ exports.statusCommand = new commander_1.Command('status')
     // user the wrong did:key to declare in curators[] — and a wrong declaration fails exactly like a
     // missing one.
     .option('-k, --key <privateKey>', 'Report the signing identity for this key instead of the configured one')
+    .option('--key-file <path>', 'Read the key to report on from this file instead of the command line')
     .action(async (options) => {
     try {
-        const overrideKey = options.key?.trim();
+        // An unusable key file is reported here rather than allowed to fall through. This command's whole
+        // job is to answer "which identity is this?", so silently answering about the configured key
+        // instead — which an empty file would do, since the check below is truthiness — would hand back a
+        // did:key that belongs to something else and looks exactly like the right answer.
+        let explicitKey;
+        try {
+            explicitKey = (0, signing_key_source_1.resolveExplicitSigningKey)(options);
+        }
+        catch (error) {
+            console.log(chalk_1.default.red(error.message));
+            process.exit(1);
+        }
+        const overrideKey = explicitKey?.material.trim();
+        // Presence, not truthiness — the same rule `sign` and the feed mutations enforce, and the reason
+        // it is enforced here too. `--key ""` is what `--key "$SIGNING_KEY"` becomes when the variable is
+        // unset, and falling through to the configured identity answers "whose key is this?" with a
+        // different key's did:key. Nothing about that answer looks wrong, so it would be copied into
+        // curators[], and a wrong declaration fails exactly like a missing one.
+        if (explicitKey !== undefined && !overrideKey) {
+            console.log(chalk_1.default.red(`The ${explicitKey.flag} value is empty. This usually means a shell variable did not ` +
+                `expand (for example ${explicitKey.flag} "$SIGNING_KEY" with SIGNING_KEY unset).`));
+            console.log(chalk_1.default.yellow('  Refusing rather than reporting the configured identity, which belongs to a different\n' +
+                '  key. Run "ff-cli status" with no key flag if that is the identity you wanted.'));
+            process.exit(1);
+        }
         if (overrideKey) {
             try {
                 console.log(chalk_1.default.green(`Signing identity (did:key) ${(0, signing_identity_1.playlistSigningDidKey)(overrideKey)}`));
@@ -29,7 +55,7 @@ exports.statusCommand = new commander_1.Command('status')
                 return;
             }
             catch (error) {
-                console.log(chalk_1.default.red(`--key unusable: ${error.message}`));
+                console.log(chalk_1.default.red(`${explicitKey?.flag ?? '--key'} unusable: ${error.message}`));
                 process.exit(1);
             }
         }

package/dist/src/commands/unpublish.js

@@ -8,24 +8,57 @@ const commander_1 = require("commander");
 const chalk_1 = __importDefault(require("chalk"));
 const feed_server_1 = require("./helpers/feed-server");
 const prompt_1 = require("./helpers/prompt");
-/**
- * `ff-cli unpublish <id-or-url>` — delete a playlist this key owns from a feed.
- *
- * The delete is irreversible in a way most deletes are not: the feed tombstones the id, so the playlist
- * cannot be restored and the id can never be reused. Hence the confirmation, which shows the title and
- * server first, and defaults to no. `-y` skips it for scripts; without a terminal and without `-y` the
- * command refuses rather than assuming consent.
- */
 exports.unpublishCommand = new commander_1.Command('unpublish')
     .description('Delete a playlist from a feed server (signed delete; owner key required)')
     .argument('<id-or-url>', 'Playlist id, slug, or feed URL')
     .option('-s, --server <index>', 'Feed server index (use this if multiple servers configured)')
     .option('-y, --yes', 'Skip the confirmation prompt')
+    .option('-k, --key <privateKey>', 'Ed25519 private key that signs the delete authorization (overrides config)')
+    .option('--key-file <path>', 'Read the key that signs the delete authorization from this file, not the command line')
     .action(async (idOrUrl, options) => {
     try {
         console.log(chalk_1.default.blue('\nUnpublish playlist\n'));
         const { getFeedConfig } = await import('../config.js');
         const { unpublishPlaylist, fetchPlaylistForUnpublish } = await import('../utilities/playlist-unpublisher.js');
+        // Resolve the signing credential ONCE, before anything else touches the network or the operator,
+        // and carry the material itself forward.
+        //
+        // This runs before the server is chosen, not after. With several feeds configured, selecting one
+        // is a question put to the operator, and asking it only to reject the key afterwards spends their
+        // attention on a run that could never have completed. A credential the command already holds is
+        // checkable without asking anybody anything, so it is checked first.
+        //
+        // Deriving it here means a malformed or empty --key fails before the lookup and before the
+        // confirmation prompt — otherwise someone was shown a playlist, asked to approve destroying it,
+        // and only then told their key was unusable.
+        //
+        // Passing the resolved material on, rather than letting unpublishPlaylist resolve again, closes a
+        // narrower gap: the prompt can stay open indefinitely, and a second resolution would re-read
+        // config.json at send time. A config edited in that window would sign the delete under an
+        // identity other than the one the operator saw and approved — and a delete tombstones the id.
+        // The DID displayed below and the key that signs are now the same value.
+        //
+        // Only the did:key is ever printed; the material never reaches the output from this path.
+        //
+        // `--key-file` is read here too, in the same step and before the same milestones: a key file that
+        // is missing, unreadable, or empty is a credential failure like any other, and it must not be
+        // discovered after the operator has approved a delete.
+        const { mutationSignerIdentity } = await import('../utilities/feed-mutation.js');
+        const { resolveExplicitSigningKey } = await import('../utilities/signing-key-source.js');
+        let signerDidKey;
+        let signingKey;
+        let keySource = 'configured';
+        try {
+            const explicitKey = resolveExplicitSigningKey(options);
+            keySource = explicitKey?.flag ?? 'configured';
+            ({ privateKey: signingKey, didKey: signerDidKey } = mutationSignerIdentity(explicitKey?.material, 'delete'));
+        }
+        catch (error) {
+            console.error(chalk_1.default.red('\nCannot sign the delete'));
+            console.error(chalk_1.default.red(`  ${error.message}`));
+            console.log();
+            process.exit(1);
+        }
         const feedConfig = getFeedConfig();
         const selection = await (0, feed_server_1.selectFeedServer)(feedConfig.baseURLs, {
             serverArg: options.server,
@@ -59,6 +92,7 @@ exports.unpublishCommand = new commander_1.Command('unpublish')
             }
             console.log(chalk_1.default.yellow(`  ${label}`));
             console.log(chalk_1.default.dim(`  Server: ${selection.url}`));
+            console.log(chalk_1.default.dim(`  Signing as: ${signerDidKey}`));
             console.log(chalk_1.default.dim('  This cannot be undone; the id is tombstoned and cannot be reused.'));
             console.log();
             const prompt = (0, prompt_1.createPrompt)();
@@ -70,7 +104,16 @@ exports.unpublishCommand = new commander_1.Command('unpublish')
                 return;
             }
         }
-        const result = await unpublishPlaylist(idOrUrl, selection.url);
+        // `Signing as` is printed on both paths, not only before the prompt: under -y it is the only
+        // record of which identity performed an irreversible delete, and it is what the assertion in the
+        // tests ties to the signature on the wire.
+        if (options.yes) {
+            console.log(chalk_1.default.dim(`  Signing as: ${signerDidKey}`));
+        }
+        const result = await unpublishPlaylist(idOrUrl, selection.url, {
+            privateKey: signingKey,
+            keySource,
+        });
         if (result.success) {
             console.log(chalk_1.default.green('Unpublished'));
             if (result.playlistId) {

package/dist/src/utilities/feed-mutation.js

@@ -25,12 +25,16 @@ exports.documentPayloadHash = documentPayloadHash;
 exports.signIntent = signIntent;
 exports.resolvePlaylistIdentifier = resolvePlaylistIdentifier;
 exports.fetchStoredPlaylist = fetchStoredPlaylist;
+exports.resolveMutationSigningKey = resolveMutationSigningKey;
+exports.mutationSignerIdentity = mutationSignerIdentity;
 exports.storedOwnerKeys = storedOwnerKeys;
 exports.storedOwnership = storedOwnership;
 exports.ownershipPreflight = ownershipPreflight;
 exports.describeFeedMutationError = describeFeedMutationError;
 exports.asPlaylist = asPlaylist;
 const axios_1 = __importDefault(require("axios"));
+const config_1 = require("../config");
+const signing_identity_1 = require("./signing-identity");
 // playlist-signer is still CommonJS; require keeps the interop simple.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const { normalizeSigningKeyToBase64Pkcs8 } = require('./playlist-signer');
@@ -136,6 +140,58 @@ async function fetchStoredPlaylist(feedServerUrl, identifier) {
     }
     return stored;
 }
+/**
+ * Resolve the key that signs an owner-bound intent, honouring an explicit key from the command line.
+ *
+ * `--key-file` material arrives here already read and trimmed by `signing-key-source`, which rejects an
+ * empty file there rather than here: the message below is about shell expansion, which is the right
+ * diagnosis for a value typed at the prompt and the wrong one for a file that turned out to be empty.
+ *
+ * **Presence, never truthiness.** `--key ""` — the shape an unset shell variable takes,
+ * `--key "$SIGNING_KEY"` with nothing in it — is an override that FAILED, not an absent one. Treating it
+ * as absent silently fell back to the configured key, so a delete meant to be authorized by one identity
+ * was authorized by another and tombstoned the playlist under it. There is no recovering from that: the
+ * id is retired. So anything the caller actually passed goes through validation and is rejected there;
+ * only `undefined` means "use the configured key".
+ *
+ * @param override - Value of `--key` exactly as the command received it
+ * @param action - Which mutation is being authorized, for the no-key-configured message
+ * @returns Key material for signing
+ * @throws Error when the override is empty, or when nothing is configured and none was given
+ */
+function resolveMutationSigningKey(override, action) {
+    if (override !== undefined) {
+        if (override.trim().length === 0) {
+            throw new Error('The --key value is empty. This usually means a shell variable did not expand ' +
+                '(for example --key "$SIGNING_KEY" with SIGNING_KEY unset). Refusing rather than falling ' +
+                'back to the configured key: a signature made by the wrong identity is not something a ' +
+                `${action} can be taken back from.`);
+        }
+        return override;
+    }
+    const configured = (0, config_1.getPlaylistConfig)().privateKey;
+    if (!configured) {
+        throw new Error(`No playlist signing key is configured. A ${action} is authorized by a signature, so one is ` +
+            'required: run "ff-cli setup", set playlist.privateKey in config.json, or pass --key / ' +
+            '--key-file for this run.');
+    }
+    return configured;
+}
+/**
+ * Identity a mutation will sign under, resolved and validated together.
+ *
+ * Commands call this before doing anything else so a bad credential fails before any request — and, for
+ * `unpublish`, before the operator is asked to confirm a delete they could not have completed. The key
+ * material never appears in what comes back: only the `did:key` it derives to.
+ *
+ * @param override - Value of `--key` exactly as the command received it
+ * @param action - Which mutation is being authorized
+ * @returns The key material and the `did:key` it asserts
+ */
+function mutationSignerIdentity(override, action) {
+    const privateKey = resolveMutationSigningKey(override, action);
+    return { privateKey, didKey: (0, signing_identity_1.playlistSigningDidKey)(privateKey) };
+}
 /** Owner `did:key`s the stored playlist declares, in declaration order. */
 function storedOwnerKeys(stored) {
     const curators = Array.isArray(stored.curators) ? stored.curators : [];
@@ -179,13 +235,34 @@ async function storedOwnership(stored) {
         catch {
             // An entry that does not verify is not proof. It is also not this command's business to report:
             // a stale or tampered signature on someone else's key changes nothing about whether the
-            // configured key can act, and the answer below is derived from the set that survived.
+            // signing key can act, and the answer below is derived from the set that survived.
         }
     }
     return { declared, proven };
 }
+/** How a private key is named as the argument to the flag it arrived on. */
+function flagArgument(keySource) {
+    return keySource === '--key-file' ? 'file holding the private key' : 'private key';
+}
+/** How to describe the identity in a refusal, given where it came from. */
+function identityLabel(keySource) {
+    return keySource === 'configured'
+        ? 'Your configured identity:'
+        : `The identity you passed with ${keySource}:`;
+}
+/** What to do about it, given where it came from. */
+function retryAdvice(keySource, plural) {
+    const which = plural ? 'one of the keys listed above' : 'the key listed above';
+    if (keySource === 'configured') {
+        return (`  Point playlist.privateKey at ${which}, or pass one for this run with --key (confirm any\n` +
+            `  key's identity with "ff-cli status --key <private key>").`);
+    }
+    const argument = flagArgument(keySource);
+    return (`  Run it again with an owner key: ${keySource} <${argument} for ${which}>.\n` +
+        `  (Confirm which identity a key carries with "ff-cli status ${keySource} <${argument}>".)`);
+}
 /**
- * Refuse locally when the configured key cannot authorize a mutation on the stored playlist.
+ * Refuse locally when the signing key cannot authorize a mutation on the stored playlist.
  *
  * The feed's own answer to every case here is a bare `403 forbidden`, which says nothing about which
  * identity was offered, which ones would have worked, or whether the problem is the declaration or the
@@ -194,11 +271,11 @@ async function storedOwnership(stored) {
  * declaration is right and the signature that would back it was never made.
  *
  * @param stored - The playlist as the feed serves it
- * @param signerDidKey - `did:key` the configured signing key will assert
+ * @param signerDidKey - `did:key` the signing key will assert
  * @param action - Which mutation is being authorized, for the wording
- * @returns A failure to report, or `null` when the configured key is a proven owner.
+ * @returns A failure to report, or `null` when the signing key is a proven owner.
  */
-async function ownershipPreflight(stored, signerDidKey, action) {
+async function ownershipPreflight(stored, signerDidKey, action, keySource = 'configured') {
     const { declared, proven } = await storedOwnership(stored);
     if (proven.includes(signerDidKey)) {
         return null;
@@ -213,7 +290,7 @@ async function ownershipPreflight(stored, signerDidKey, action) {
             error: `This playlist declares no owners, so no key can ${verb} it.`,
             message: `The feed derives ownership from the stored document's curators[], and this one is empty — the\n` +
                 `  shape a playlist published without an owner-role signature is frozen in. No signature can\n` +
-                `  authorize a ${verb}, including yours (${signerDidKey}).\n` +
+                `  authorize a ${verb}, including this one (${signerDidKey}).\n` +
                 `  Nothing can repair it: the owner set is immutable, and only an owner could change it. Publish\n` +
                 `  a corrected playlist under a new id instead.`,
         };
@@ -240,30 +317,33 @@ async function ownershipPreflight(stored, signerDidKey, action) {
     // it is simply not the one configured here.
     if (declared.includes(signerDidKey)) {
         return {
-            error: `Your key is declared on this playlist but never signed it as ${exports.OWNER_ROLE}, so it cannot ${verb} it.`,
+            error: `This key is declared on this playlist but never signed it as ${exports.OWNER_ROLE}, so it cannot ${verb} it.`,
             message: `The feed treats a declared key as an owner only once it has also signed the stored document\n` +
-                `  as "${exports.OWNER_ROLE}". Yours is named in curators[] but carries no such signature, so an intent\n` +
-                `  signed with it would be refused.\n` +
-                `  Your configured identity:\n` +
+                `  as "${exports.OWNER_ROLE}". This one is named in curators[] but carries no such signature, so an\n` +
+                `  intent signed with it would be refused.\n` +
+                `  ${identityLabel(keySource)}\n` +
                 `    ${signerDidKey}\n` +
                 `  Keys that have proved ownership:\n` +
                 `${proven.map((key) => `    ${key}`).join('\n')}\n` +
-                `  Point playlist.privateKey at one of those (confirm any key's identity with\n` +
-                `  "ff-cli status --key <private key>"). Your own declaration cannot be upgraded after the fact:\n` +
-                `  the proof would have to be a signature over the document as published.`,
+                `${retryAdvice(keySource, proven.length > 1)}\n` +
+                `  The declaration cannot be upgraded after the fact: the proof would have to be a signature\n` +
+                `  over the document as published.`,
         };
     }
+    const source = keySource === 'configured'
+        ? 'The configured signing key is'
+        : `The key you passed with ${keySource} is`;
     return {
-        error: `The configured signing key is not an owner of this playlist, so it cannot ${verb} it.`,
+        error: `${source} not an owner of this playlist, so it cannot ${verb} it.`,
         message: `Only a key the stored playlist names in curators[] AND that signed it as "${exports.OWNER_ROLE}" can\n` +
             `  authorize a ${verb}; the feed derives ownership from the stored document, not from a local copy.\n` +
-            `  Your configured identity:\n` +
+            `  ${identityLabel(keySource)}\n` +
             `    ${signerDidKey}\n` +
             `  Keys that have proved ownership:\n` +
             `${proven.map((key) => `    ${key}`).join('\n')}\n` +
-            `  Point playlist.privateKey at a key listed above (confirm any key's identity with\n` +
-            `  "ff-cli status --key <private key>"). Ownership cannot be granted after the fact: the owner set\n` +
-            `  is immutable, so a playlist signed by the wrong key stays that way.`,
+            `${retryAdvice(keySource, proven.length > 1)}\n` +
+            `  Ownership cannot be granted after the fact: the owner set is immutable, so a playlist signed\n` +
+            `  by the wrong key stays that way.`,
     };
 }
 /** Feed error code carried in an error response body, when there is one. */
@@ -290,8 +370,17 @@ function feedErrorDetail(error) {
  *
  * The codes handled are exactly those dp1-feed-v2 documents for these routes; anything else falls
  * through with the server's own words rather than being guessed at.
+ *
+ * `keySource` matters here for the same reason it does locally: two of these messages talk about the
+ * signing identity, and calling it "configured" when the operator passed `--key` describes a file this
+ * run never read. Worse, after a 403 it reads as though the override had been dropped — which is
+ * precisely the doubt an operator should not be left with when their key was used and refused.
+ *
+ * @param error - The failure thrown by the request
+ * @param action - Which mutation was attempted
+ * @param keySource - Where the signing identity came from
  */
-function describeFeedMutationError(error, action) {
+function describeFeedMutationError(error, action, keySource = 'configured') {
     const axiosError = error;
     const status = axiosError.response?.status;
     const code = feedErrorCode(axiosError);
@@ -305,19 +394,26 @@ function describeFeedMutationError(error, action) {
         return {
             error: `${verb} refused: the feed saw no signatures on the request.`,
             message: `Every mutating request is authorized by the signatures in its body — there is no API key.\n` +
-                `  This usually means no signing key is configured: run "ff-cli status" to check, and\n` +
-                `  "ff-cli setup" to generate one.${suffix}`,
+                (keySource !== 'configured'
+                    ? `  The key passed with ${keySource} produced no signature the feed could read, which should not\n` +
+                        `  happen once it has been accepted locally — please report this.\n`
+                    : `  This usually means no signing key is configured: run "ff-cli status" to check, and\n` +
+                        `  "ff-cli setup" to generate one.\n`) +
+                `  ${suffix.trim() || 'The feed gave no further detail.'}`,
         };
     }
-    // A 403 that reaches here has already passed the local ownership proof: the configured key was found
+    // A 403 that reaches here has already passed the local ownership proof: the key that signed was found
     // in the stored curators[] with a valid curator-role signature over the stored bytes. Repeating "your
     // key is not declared" would therefore be a lie, and it is the wrong place to send someone — the
     // remaining causes are the feed disagreeing about the stored document, or a replace touching the
     // owner set. Say that the feed refused, and that the local check disagreed.
     if (status === 403) {
+        const which = keySource === 'configured'
+            ? 'the configured signing key is'
+            : `the key you passed with ${keySource} is`;
         return {
             error: `${verb} refused by the feed: it did not accept the signing key as an owner.`,
-            message: `The local check disagreed — the configured key is named in the stored playlist's curators[]\n` +
+            message: `The local check disagreed — ${which} named in the stored playlist's curators[]\n` +
                 `  and carries a valid "${exports.OWNER_ROLE}" signature over the stored document — so this is the feed's\n` +
                 `  own judgement, not a missing declaration.\n` +
                 (action === 'replace'

package/dist/src/utilities/playlist-publisher.js

@@ -8,9 +8,7 @@ exports.replacePlaylist = replacePlaylist;
 const axios_1 = __importDefault(require("axios"));
 const fs_1 = __importDefault(require("fs"));
 const playlist_verifier_1 = require("./playlist-verifier");
-const config_1 = require("../config");
 const feed_mutation_1 = require("./feed-mutation");
-const signing_identity_1 = require("./signing-identity");
 /**
  * Publish a verified playlist to a DP-1 feed server
  *
@@ -126,11 +124,16 @@ async function replacePlaylist(filePath, feedServerUrl, options = {}) {
             message: 'A replace targets an existing resource by its id. Publish it without --replace to create it.',
         };
     }
+    // Where the identity came from, resolved before the first request so every refusal — local or from
+    // the feed — names the key the operator actually used rather than a config file this run may not
+    // have read.
+    const keySource = options.keySource ?? (options.privateKey !== undefined ? '--key' : 'configured');
+    // Presence, not truthiness: `--key ""` is an override that failed to expand, and falling back to the
+    // configured key would sign someone else's replacement into place.
     let privateKey;
     let signerDidKey;
     try {
-        privateKey = resolveIntentSigningKey(options.privateKey);
-        signerDidKey = (0, signing_identity_1.playlistSigningDidKey)(privateKey);
+        ({ privateKey, didKey: signerDidKey } = (0, feed_mutation_1.mutationSignerIdentity)(options.privateKey, 'replace'));
     }
     catch (error) {
         return { success: false, error: error.message };
@@ -140,7 +143,7 @@ async function replacePlaylist(filePath, feedServerUrl, options = {}) {
         stored = await (0, feed_mutation_1.fetchStoredPlaylist)(feedServerUrl, documentId);
     }
     catch (error) {
-        const described = (0, feed_mutation_1.describeFeedMutationError)(error, 'replace');
+        const described = (0, feed_mutation_1.describeFeedMutationError)(error, 'replace', keySource);
         const missing = error.response?.status === 404;
         return {
             success: false,
@@ -161,7 +164,7 @@ async function replacePlaylist(filePath, feedServerUrl, options = {}) {
     if (mismatch) {
         return { success: false, ...mismatch, feedServer: feedServerUrl };
     }
-    const ownership = await (0, feed_mutation_1.ownershipPreflight)(stored, signerDidKey, 'replace');
+    const ownership = await (0, feed_mutation_1.ownershipPreflight)(stored, signerDidKey, 'replace', keySource);
     if (ownership) {
         return { success: false, ...ownership, feedServer: feedServerUrl };
     }
@@ -189,7 +192,7 @@ async function replacePlaylist(filePath, feedServerUrl, options = {}) {
     catch (error) {
         return {
             success: false,
-            ...(0, feed_mutation_1.describeFeedMutationError)(error, 'replace'),
+            ...(0, feed_mutation_1.describeFeedMutationError)(error, 'replace', keySource),
             feedServer: feedServerUrl,
         };
     }
@@ -220,7 +223,11 @@ function replaceIdentityMismatch(playlist, stored) {
     }
     const documentOwners = (0, feed_mutation_1.storedOwnerKeys)(playlist);
     const owners = (0, feed_mutation_1.storedOwnerKeys)(stored);
-    if (documentOwners.join('') !== owners.join('')) {
+    // Compared element-wise rather than by joining on a separator: the owner set is an ordered list
+    // of opaque strings, and any separator is a guess about what cannot appear inside one.
+    const sameOwners = documentOwners.length === owners.length &&
+        documentOwners.every((key, index) => key === owners[index]);
+    if (!sameOwners) {
         differences.push(`    curators: stored [${owners.join(', ')}], document [${documentOwners.join(', ')}]`);
     }
     if (differences.length === 0) {
@@ -254,24 +261,6 @@ function sameInstant(left, right) {
     const b = Date.parse(right);
     return Number.isFinite(a) && Number.isFinite(b) && a === b;
 }
-/**
- * resolveIntentSigningKey resolves the key that signs the authorization intent.
- *
- * The intent is signed separately from the document, and by whoever is running the command: the document
- * may legitimately carry several curators' signatures, while the intent proves that *this* operator holds
- * one of those keys right now.
- */
-function resolveIntentSigningKey(override) {
-    if (override && override.trim().length > 0) {
-        return override;
-    }
-    const configured = (0, config_1.getPlaylistConfig)().privateKey;
-    if (!configured) {
-        throw new Error('No playlist signing key is configured. A replace is authorized by a signed intent, so one is ' +
-            'required: run "ff-cli setup" or set playlist.privateKey in config.json.');
-    }
-    return configured;
-}
 /**
  * readPlaylistFile reads and parses a playlist document from disk.
  *