@getcofund/cli 0.0.0-stage → 0.1.0

package/dist/commands/reads.js

@@ -0,0 +1,88 @@
+import { cofundClientId, readActiveAdmins, readClientVault, readOnboardingComplete, readPolicy, readRequiredAdminInviteSignatures, readUser, } from "@getcofund/protocol/evm";
+import { evmWallet } from "@getcofund/protocol/keys";
+import { amountText, memberIds, policyIds, seatOf, seatText, signerNames, tokenInfo, } from "../chain.js";
+import { evmChain, keystoreIfAny, line, } from "../context.js";
+import { pickCompany } from "../keystore.js";
+import { cofundLine } from "./lines.js";
+/** `show`, `members`, `policies show`: the cofund as State holds it, read through the RPC. */
+async function cofundOf(io, flags) {
+    const keys = keystoreIfAny(io, flags);
+    const company = pickCompany(keys, flags.company);
+    const evm = await evmChain(io, flags);
+    const clientId = cofundClientId(company);
+    const vault = await readClientVault(evm.reader, evm.deployment, clientId);
+    if (!vault) {
+        throw new Error(`No cofund "${company}" on chain ${evm.deployment.chainId}`);
+    }
+    return { keys, company, evm, clientId, vault };
+}
+/** `show`: the cofund, its vault, its phase, its admins, its policies, and this key's seat. */
+export async function show(io, flags) {
+    const { keys, company, evm, clientId, vault } = await cofundOf(io, flags);
+    const { reader, deployment } = evm;
+    const [onboarded, admins, required, policies] = await Promise.all([
+        readOnboardingComplete(reader, deployment, clientId),
+        readActiveAdmins(reader, deployment, clientId),
+        readRequiredAdminInviteSignatures(reader, deployment, clientId),
+        policyIds(evm, clientId),
+    ]);
+    io.out(cofundLine(company));
+    io.out(line("vault", `${vault.vault}, tier ${vault.tier}`));
+    io.out(line("phase", onboarded
+        ? "onboarding complete"
+        : "onboarding open: one admin signature seats an admin or activates a policy"));
+    io.out(line("admins", `${admins} active; an admin seat takes ${required} admin signature${required === 1 ? "" : "s"}`));
+    const states = await Promise.all(policies.map(async (id) => {
+        const policy = await readPolicy(reader, deployment, clientId, id);
+        return `${id} (${policy?.active ? "active" : "inactive"})`;
+    }));
+    io.out(line("policies", states.length === 0 ? "none" : states.join(", ")));
+    if (keys) {
+        const seat = await seatOf(evm, clientId, evmWallet(keys).address);
+        io.out(line("you", seat ? seatText(seat) : `${keys.evm.address} (no seat)`));
+    }
+    return 0;
+}
+/** `members`: everyone ever seated, as State holds them now. */
+export async function members(io, flags) {
+    const { evm, clientId } = await cofundOf(io, flags);
+    for (const userId of await memberIds(evm, clientId)) {
+        const user = await readUser(evm.reader, evm.deployment, clientId, userId);
+        if (user) {
+            io.out(seatText({ userId, user }));
+        }
+    }
+    return 0;
+}
+/** A policy's bounds as every preview prints them. */
+export async function boundsLines(evm, bounds) {
+    if ("wrapper" in bounds) {
+        return [
+            line("calls", `wrapper ${bounds.wrapper}, function ${bounds.func}`),
+        ];
+    }
+    const token = await tokenInfo(evm, bounds.token);
+    const { recipients } = bounds;
+    return [
+        line("cap", `${amountText(bounds.maxAmount, token)} per transfer`),
+        line("to", recipients.length === 0 ? "any address" : `only ${recipients.join(", ")}`),
+    ];
+}
+/** `policies show <id>`: a policy as State holds it, its signers by user id. */
+export async function policiesShow(io, flags, policyId) {
+    if (!policyId) {
+        throw new Error("policies show takes a policy id (`show` lists them)");
+    }
+    const { evm, clientId } = await cofundOf(io, flags);
+    const policy = await readPolicy(evm.reader, evm.deployment, clientId, policyId);
+    if (!policy) {
+        throw new Error(`No policy ${policyId} in this cofund`);
+    }
+    const signers = signerNames(policy.signerIds, await memberIds(evm, clientId));
+    io.out(line("policy", `${policyId}: "${policy.title}" (${policy.policyType}), ${policy.active ? "active" : "inactive"}`));
+    io.out(line("signers", `${signers.join(", ")}; ${policy.threshold} of ${signers.length} must sign`));
+    for (const bound of await boundsLines(evm, policy.isTransaction ? policy.transaction : policy.transfer)) {
+        io.out(bound);
+    }
+    return 0;
+}

package/dist/commands/sign-or-send.js

@@ -0,0 +1,87 @@
+import { evmWallet } from "@getcofund/protocol/keys";
+import { approved, evmChain, keystoreIfAny, line, send, sender, } from "../context.js";
+import { keystorePath, pinCompany, requirePinned } from "../keystore.js";
+import { loadSignatures, signMessage, writeSignatureFile, } from "../signature-file.js";
+import { cofundLine, signedByLines } from "./lines.js";
+/** The message the files carry (checked against the arguments), or a new one. */
+async function messageOf(spec, flags, { evm, signed, keys, }) {
+    if (signed.length === 0) {
+        if (!keys) {
+            throw new Error("No keystore to sign with: pass --keystore, or files");
+        }
+        return await spec.fresh(keys, evm);
+    }
+    const message = signed[0].message;
+    spec.matches(message);
+    if (flags.company !== undefined && flags.company !== message.company) {
+        throw new Error(`The files are for company "${message.company}", not "${flags.company}"`);
+    }
+    return message;
+}
+/**
+ * This key, when its signature counts for the call; null when it does not
+ * and the files are sent as they are. Refused when it does not count and
+ * there is nothing else to send (`--out`, or no files).
+ */
+async function signerOf(spec, flags, { evm, message, signed, keys, }) {
+    const role = keys
+        ? await spec.role(evm, message, evmWallet(keys).address, signed)
+        : { not: "there is no keystore to sign with" };
+    if ("as" in role && keys) {
+        if (signed.length > 0) {
+            requirePinned(keys, message.company, flags.company);
+        }
+        return { account: evmWallet(keys), as: role.as };
+    }
+    if (flags.out || signed.length === 0) {
+        throw new Error(`Your signature does not count here: ${"not" in role ? role.not : ""}`);
+    }
+    return null;
+}
+export async function signOrSend(io, flags, spec) {
+    const evm = await evmChain(io, flags);
+    const signed = await loadSignatures(spec.files, evm.deployment, [spec.type]);
+    const keys = keystoreIfAny(io, flags);
+    const message = await messageOf(spec, flags, { evm, signed, keys });
+    const signer = await signerOf(spec, flags, { evm, message, signed, keys });
+    for (const text of [
+        cofundLine(message.company),
+        ...(await spec.lines(evm, message)),
+        ...(await signedByLines(evm, message.company, signed)),
+        ...(signer
+            ? [line("you", `sign as the ${signer.as}, ${signer.account.address}`)]
+            : []),
+    ]) {
+        io.out(text);
+    }
+    const mine = signer
+        ? await signMessage(signer.account, evm.deployment, {
+            type: spec.type,
+            message,
+        })
+        : null;
+    if (flags.out && mine) {
+        if (!(await approved(io, flags, { question: "Sign it?", action: "sign it" }))) {
+            return 1;
+        }
+        writeSignatureFile(flags.out, mine);
+        io.out(line("wrote", flags.out));
+        return 0;
+    }
+    const all = [
+        ...signed,
+        ...(mine
+            ? [{ signer: mine.signer, signature: mine.signature }]
+            : []),
+    ];
+    const via = sender(io, flags, evm);
+    const call = await spec.build(evm, message, all);
+    io.out(line("call", `${spec.entry} ${call.to}`));
+    const sent = await send(io, flags, { evm, via, call }, { question: spec.question, action: "send it" });
+    if (sent === 0 && mine && spec.pinOnSend) {
+        const path = keystorePath(io.env, flags.keystore);
+        pinCompany(path, message.company);
+        io.out(line("pinned", `company "${message.company}" in ${path}`));
+    }
+    return sent;
+}

package/dist/commands/transfers.js

@@ -0,0 +1,168 @@
+import { randomUUID } from "node:crypto";
+import { cofundClientId, executeTransferCall, readClientVault, readContract, readPolicy, sameAddress, stateAbi, } from "@getcofund/protocol/evm";
+import { evmWallet } from "@getcofund/protocol/keys";
+import { getAddress } from "viem";
+import { amountText, baseUnits, memberIds, signerNames, tokenInfo, } from "../chain.js";
+import { approved, evmChain, keystore, line, send, sender, } from "../context.js";
+import { pickCompany, requirePinned } from "../keystore.js";
+import { loadSignatures, signMessage, writeSignatureFile, } from "../signature-file.js";
+import { USAGE } from "../usage.js";
+import { cofundLine, signedByLines } from "./lines.js";
+/**
+ * `transfers sign`: a signer of a transfer policy signs a transfer, new from
+ * the flags or the one in a file. `transfers send`: sent from the vault once
+ * signed often enough.
+ */
+/** The policy a vault message spends under: State's, active, of the kind the message needs. */
+export async function spendingPolicy(evm, company, policyId, kind) {
+    const policy = await readPolicy(evm.reader, evm.deployment, cofundClientId(company), policyId);
+    if (!policy?.active) {
+        throw new Error(`Policy ${policyId} is not an active policy of this cofund`);
+    }
+    if (policy.isTransaction !== (kind === "call")) {
+        throw new Error(`Policy ${policyId} is a ${policy.isTransaction ? "call" : "transfer"} policy: use \`${policy.isTransaction ? "calls" : "transfers"} sign\``);
+    }
+    return policy;
+}
+/** `me` must be an active signer of the policy, as the vault resolves its signers. */
+export async function requirePolicySigner(evm, company, policyId, me) {
+    const [ok] = await readContract(evm.reader, {
+        address: evm.deployment.state,
+        abi: stateAbi,
+        functionName: "resolvePolicySigner",
+        args: [cofundClientId(company), policyId, me],
+    });
+    if (!ok) {
+        throw new Error(`${me} is not an active signer of policy ${policyId}`);
+    }
+}
+/** The policy line every vault message shows: its title, its signers, its threshold. */
+export async function policyLine(evm, company, policyId) {
+    const clientId = cofundClientId(company);
+    const policy = await readPolicy(evm.reader, evm.deployment, clientId, policyId);
+    if (!policy) {
+        return line("policy", `${policyId} (no such policy)`);
+    }
+    const signers = signerNames(policy.signerIds, await memberIds(evm, clientId));
+    const inactive = policy.active ? "" : " (inactive)";
+    return line("policy", `${policyId}: "${policy.title}"${inactive}, ${policy.threshold} of ${signers.join(", ")} must sign`);
+}
+/** The vault a message spends from. */
+export async function vaultLine(evm, company) {
+    const vault = await readClientVault(evm.reader, evm.deployment, cofundClientId(company));
+    return line("from", vault ? `the vault ${vault.vault}` : "no vault");
+}
+/**
+ * A message signed by this key, new or from files, after the checks its
+ * command makes: the signer's own file, which `send` takes with the others.
+ */
+export async function signVaultMessage(io, flags, { evm, keys, type, message, signed, lines, instructions, }) {
+    const { out } = flags;
+    if (!out) {
+        throw new Error("Pass --out <file> for the signature");
+    }
+    const signer = evmWallet(keys);
+    await requirePolicySigner(evm, message.company, message.policyId, signer.address);
+    if (signed.some((each) => sameAddress(each.signer, signer.address))) {
+        throw new Error("The files hold your signature already");
+    }
+    for (const text of [
+        ...lines,
+        ...(await signedByLines(evm, message.company, signed)),
+        line("you", `sign as ${signer.address}`),
+    ]) {
+        io.out(text);
+    }
+    if (!(await approved(io, flags, { question: "Sign it?", action: "sign it" }))) {
+        return 1;
+    }
+    writeSignatureFile(out, await signMessage(signer, evm.deployment, { type, message, instructions }));
+    io.out(line("wrote", `${out}: send it with the others' once signed often enough`));
+    return 0;
+}
+async function transferLines(evm, message) {
+    const token = await tokenInfo(evm, getAddress(message.token));
+    return [
+        cofundLine(message.company),
+        await policyLine(evm, message.company, message.policyId),
+        line("transfer", amountText(BigInt(message.amount), token)),
+        line("to", message.recipient),
+        await vaultLine(evm, message.company),
+    ];
+}
+/** What a signer refuses to sign: a transfer its policy can never send (over the cap, off the allowlist). */
+async function checkTransfer(evm, message) {
+    const policy = await spendingPolicy(evm, message.company, message.policyId, "transfer");
+    const { maxAmount, recipients } = policy.transfer;
+    if (BigInt(message.amount) > maxAmount) {
+        throw new Error(`${message.amount} base units are over the policy's cap of ${maxAmount}`);
+    }
+    if (recipients.length > 0 &&
+        !recipients.some((r) => sameAddress(r, message.recipient))) {
+        throw new Error(`${message.recipient} is not on the policy's allowlist`);
+    }
+}
+export async function transfersSign(io, flags, files) {
+    const keys = keystore(io, flags);
+    const evm = await evmChain(io, flags);
+    let message;
+    let signed = [];
+    if (files.length > 0) {
+        signed = await loadSignatures(files, evm.deployment, ["Transfer"]);
+        message = signed[0].message;
+        requirePinned(keys, message.company, flags.company);
+    }
+    else {
+        const { policy: policyId, to, amount } = flags;
+        if (!(policyId && to && amount)) {
+            io.err(USAGE);
+            return 1;
+        }
+        const company = pickCompany(keys, flags.company);
+        const policy = await spendingPolicy(evm, company, policyId, "transfer");
+        const token = await tokenInfo(evm, policy.transfer.token);
+        message = {
+            company,
+            policyId,
+            messageType: policy.policyType,
+            amount: baseUnits(amount, token, "--amount").toString(),
+            token: policy.transfer.token,
+            recipient: getAddress(to),
+            authId: randomUUID(),
+        };
+    }
+    await checkTransfer(evm, message);
+    return await signVaultMessage(io, flags, {
+        evm,
+        keys,
+        type: "Transfer",
+        message,
+        signed,
+        lines: await transferLines(evm, message),
+    });
+}
+export async function transfersSend(io, flags, files) {
+    if (files.length === 0) {
+        io.err(USAGE);
+        return 1;
+    }
+    const evm = await evmChain(io, flags);
+    const signed = await loadSignatures(files, evm.deployment, ["Transfer"]);
+    const message = signed[0].message;
+    const via = sender(io, flags, evm);
+    for (const text of [
+        ...(await transferLines(evm, message)),
+        ...(await signedByLines(evm, message.company, signed)),
+    ]) {
+        io.out(text);
+    }
+    const call = await executeTransferCall(evm, {
+        message,
+        signatures: signed.map(({ signature }) => signature),
+    });
+    io.out(line("call", `executeTransfer on the vault ${call.to}`));
+    return await send(io, flags, { evm, via, call }, {
+        question: "Send this transfer?",
+        action: "send it",
+    });
+}

package/dist/context.js

@@ -0,0 +1,231 @@
+import { readFileSync } from "node:fs";
+import { CallRefusedError, CallRevertedError, directSubmitter, guardSubmitter, loadEvmDeployment, policiesAbi, revertDataOf, revertReason, sponsorGuardAbi, stateAbi, usersAbi, vaultAbi, } from "@getcofund/protocol/evm";
+import { evmWallet } from "@getcofund/protocol/keys";
+import { createPublicClient, createWalletClient, custom, defineChain, encodeFunctionData, http, } from "viem";
+import { privateKeyToAccount } from "viem/accounts";
+import { keystorePath, readKeystore } from "./keystore.js";
+/** A line of a preview: the label padded to one column, as every command prints them. */
+export const line = (label, value) => `${label.padEnd(9)} ${value}`;
+const SETTINGS = {
+    deployment: { flag: "--deployment <file>", env: "COFUND_DEPLOYMENT" },
+    rpc: { flag: "--rpc <url>", env: "COFUND_RPC_URL" },
+    esplora: { flag: "--esplora <url>", env: "COFUND_ESPLORA_URL" },
+};
+/** A setting from its flag, else its environment variable, else an error saying what is missing. */
+export function setting(io, flags, name) {
+    const value = flags[name] ?? io.env[SETTINGS[name].env];
+    if (!value) {
+        const { flag, env } = SETTINGS[name];
+        throw new Error(`No ${name}: pass ${flag} or set ${env}`);
+    }
+    return value;
+}
+/** The keystore at --keystore, COFUND_KEYSTORE or the default path. */
+export function keystore(io, flags) {
+    return readKeystore(keystorePath(io.env, flags.keystore));
+}
+/** The keystore when there is one; null when there is none to read. */
+export function keystoreIfAny(io, flags) {
+    try {
+        return keystore(io, flags);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The deployment file read and checked against its chain (its domain, the
+ * helpers State registers, the chain id), with a reader at the RPC URL.
+ */
+export async function evmChain(io, flags) {
+    const path = setting(io, flags, "deployment");
+    const url = setting(io, flags, "rpc");
+    let config;
+    try {
+        config = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (error) {
+        throw new Error(`Could not read the deployment ${path}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    const chain = defineChain({
+        id: Number(config.chainId),
+        name: `chain ${config.chainId}`,
+        nativeCurrency: { name: "Ether", symbol: "ETH", decimals: 18 },
+        rpcUrls: { default: { http: [url] } },
+    });
+    const transport = io.provider ? custom(io.provider(url)) : http(url);
+    const reader = createPublicClient({ chain, transport });
+    const deployment = await loadEvmDeployment(config, reader);
+    return { deployment, reader, chain, transport };
+}
+const PRIVATE_KEY = /^0x[0-9a-fA-F]{64}$/;
+/** A private key from a file: a bare hex key, or a keystore's EVM key. */
+function sponsorKey(path) {
+    const text = readFileSync(path, "utf8").trim();
+    const key = text.startsWith("{")
+        ? JSON.parse(text).evm?.privateKey
+        : text;
+    const hex = key?.startsWith("0x") ? key : `0x${key}`;
+    if (!PRIVATE_KEY.test(hex)) {
+        throw new Error(`${path} holds no private key: a 32-byte hex key, or a keystore`);
+    }
+    return hex;
+}
+/**
+ * `--via direct` (the default): the keystore's EVM key sends the call and
+ * pays gas. `--via guard`: the call wrapped in the deployment's guard's
+ * `relay`, sent by the key in --sponsor-key-file, which the guard must accept
+ * as a sponsor.
+ */
+export function sender(io, flags, evm) {
+    const via = flags.via ?? "direct";
+    const sponsorFile = flags["sponsor-key-file"];
+    if (via === "direct") {
+        if (sponsorFile) {
+            throw new Error("--sponsor-key-file is for --via guard");
+        }
+        const account = evmWallet(keystore(io, flags));
+        return {
+            address: account.address,
+            submitter: directSubmitter(createWalletClient({
+                account,
+                chain: evm.chain,
+                transport: evm.transport,
+            })),
+            transaction: (call) => call,
+            line: line("via", `direct: ${account.address} sends it and pays gas`),
+        };
+    }
+    if (via !== "guard") {
+        throw new Error("--via is direct or guard");
+    }
+    if (!sponsorFile) {
+        throw new Error("--via guard sends from a sponsor's key: pass --sponsor-key-file <file>");
+    }
+    const account = privateKeyToAccount(sponsorKey(sponsorFile));
+    const guard = evm.deployment.sponsorGuard;
+    return {
+        address: account.address,
+        submitter: guardSubmitter(createWalletClient({
+            account,
+            chain: evm.chain,
+            transport: evm.transport,
+        }), evm.deployment),
+        transaction: (call) => ({
+            ...call,
+            to: guard,
+            data: encodeFunctionData({
+                abi: sponsorGuardAbi,
+                functionName: "relay",
+                args: [call.to, call.data],
+            }),
+        }),
+        line: line("via", `guard ${guard}: sponsor ${account.address} relays it and pays gas`),
+    };
+}
+/** Yes from --yes or the person at the terminal; a refusal is said before it returns false. */
+export async function approved(io, flags, { question, action }) {
+    if (flags.yes) {
+        return true;
+    }
+    if (!io.confirm) {
+        io.err(`Nothing was done: no terminal to confirm in. Pass --yes to ${action} without a prompt.`);
+        return false;
+    }
+    if (!(await io.confirm(question))) {
+        io.err("Nothing was done.");
+        return false;
+    }
+    return true;
+}
+const PROTOCOL_ERRORS = [
+    usersAbi,
+    policiesAbi,
+    vaultAbi,
+    sponsorGuardAbi,
+    stateAbi,
+];
+/**
+ * The transaction run as an `eth_call` from its sender, before anyone is
+ * asked: the checks that turn on the sender (the platform gate, the guard's
+ * sponsors, the vault's broadcasters) are the chain's. Its revert reason, or
+ * null when it would go through.
+ */
+async function preflight(reader, from, transaction) {
+    try {
+        await reader.request({
+            method: "eth_call",
+            params: [
+                {
+                    from,
+                    to: transaction.to,
+                    data: transaction.data,
+                    ...(transaction.value !== undefined && {
+                        value: `0x${transaction.value.toString(16)}`,
+                    }),
+                },
+                "latest",
+            ],
+        });
+        return null;
+    }
+    catch (error) {
+        const data = revertDataOf(error);
+        if (data === null) {
+            throw error;
+        }
+        return revertReason(data, { errors: PROTOCOL_ERRORS });
+    }
+}
+/**
+ * Send a checked call: its sender said, the transaction run from that sender
+ * first (a revert is shown and nothing is sent), approved, sent, and waited
+ * for. 0 once it lands.
+ */
+export async function send(io, flags, { evm, via, call }, prompt) {
+    io.out(via.line);
+    const reason = await preflight(evm.reader, via.address, via.transaction(call));
+    if (reason !== null) {
+        io.err(line("refused", `the chain reverts it from ${via.address}: ${reason}`));
+        io.err("Nothing was sent.");
+        return 1;
+    }
+    if (!(await approved(io, flags, prompt))) {
+        return 1;
+    }
+    const hash = await via.submitter.send(call);
+    io.out(line("sent", hash));
+    const receipt = await evm.reader.waitForTransactionReceipt({ hash });
+    if (receipt.status !== "success") {
+        io.err(line("reverted", `in block ${receipt.blockNumber}`));
+        return 1;
+    }
+    io.out(line("landed", `block ${receipt.blockNumber}`));
+    return 0;
+}
+/** URLs, which can carry an RPC's or an Esplora's key. */
+const URLS = /\b(?:https?|wss?):\/\/\S+/gi;
+/**
+ * How a failure prints: a refusal as the contract's error and why, and that
+ * nothing went out; anything else as its message (viem's short one and its
+ * details), with every URL in it hidden.
+ */
+export function errorLines(error) {
+    if (error instanceof CallRefusedError) {
+        return [line("refused", error.message), "Nothing was sent."];
+    }
+    if (error instanceof CallRevertedError) {
+        return [
+            line("refused", `the chain reverts it: ${error.reason}`),
+            "Nothing was sent.",
+        ];
+    }
+    if (!(error instanceof Error)) {
+        return [String(error).replace(URLS, "<url>")];
+    }
+    const { shortMessage, details } = error;
+    const text = shortMessage
+        ? `${shortMessage}${details ? ` (${details})` : ""}`
+        : error.message;
+    return [text.replace(URLS, "<url>")];
+}

package/dist/keystore.js

@@ -0,0 +1,74 @@
+import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { cofundClientId } from "@getcofund/protocol/evm";
+/**
+ * The keystore file the API CLI `cofund` keeps too: the same format
+ * (`Keystore`), the same `COFUND_KEYSTORE` and default path, written with mode
+ * 0600, so one key serves both. Its `cofunds` pins the `company` this key
+ * signs as; this CLI pins a cofund under its client id.
+ */
+export function keystorePath(env, flag) {
+    return (flag ?? env.COFUND_KEYSTORE ?? join(homedir(), ".cofund", "keystore.json"));
+}
+export function readKeystore(path) {
+    let text;
+    try {
+        text = readFileSync(path, "utf8");
+    }
+    catch {
+        throw new Error(`No keystore at ${path}: make one with \`cofund-chain keys init\``);
+    }
+    const keystore = JSON.parse(text);
+    if (keystore.version !== 1) {
+        throw new Error(`${path}: unsupported keystore version`);
+    }
+    return keystore;
+}
+export function writeKeystore(path, keystore) {
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(keystore, null, 2)}\n`, {
+        mode: 0o600,
+    });
+    chmodSync(path, 0o600);
+}
+/** Pin `company` in the keystore at `path`: what this key signs as in that cofund. */
+export function pinCompany(path, company) {
+    const keystore = readKeystore(path);
+    writeKeystore(path, {
+        ...keystore,
+        cofunds: { ...keystore.cofunds, [cofundClientId(company)]: { company } },
+    });
+}
+/** Every company the keystore pins, once each, whichever CLI pinned it. */
+export function pinnedCompanies(keystore) {
+    return [
+        ...new Set(Object.values(keystore?.cofunds ?? {}).map(({ company }) => company)),
+    ];
+}
+/** The cofund a command acts in: --company, or the keystore's only pinned company. */
+export function pickCompany(keystore, flag) {
+    if (flag) {
+        return flag;
+    }
+    const pinned = pinnedCompanies(keystore);
+    if (pinned.length === 1) {
+        return pinned[0];
+    }
+    if (pinned.length === 0) {
+        throw new Error("No cofund is pinned in the keystore: pass --company, or found or join one");
+    }
+    throw new Error(`Pass --company, one of:\n${pinned.map((c) => `  ${c}`).join("\n")}`);
+}
+/**
+ * Whether this key may sign for `company`: pinned in the keystore, or named
+ * with --company. A file for a cofund the key never pinned is refused.
+ */
+export function requirePinned(keystore, company, flag) {
+    if (flag !== undefined && flag !== company) {
+        throw new Error(`The file is for company "${company}", not "${flag}"`);
+    }
+    if (flag === undefined && !pinnedCompanies(keystore).includes(company)) {
+        throw new Error(`This key has not pinned company "${company}": pass --company "${company}" to sign for it`);
+    }
+}