@interop/did-cli 0.10.0 → 0.10.1

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # History
 
+## 0.10.1 - 2026-06-26
+
+### Fixed
+
+- `vc verify` now verifies credentials issued by `did:webvh` (and `did:web`)
+  issuers. Verification ran through `@interop/verifier-core`'s default document
+  loader, which resolves only `did:key` and `did:web`, so a `did:webvh` proof's
+  verification method could never be fetched and the signature was reported as
+  invalid. Verification now uses the CLI's shared loader (which registers the
+  `did:webvh` driver), passed through to `verifyCredential`.
+- `vc issue --did` now accepts a metadata handle (not just a full DID id),
+  resolving it via the same lookup used by the other DID-referencing commands.
+  Previously passing a handle failed with a confusing `The "path" argument must
+  be of type string. Received undefined` error.
+
+### Changed
+
+- The `list` / `show` / `meta` / `remove` subcommands and metadata handling of
+  the `vc`, `key`, and `zcap` command families now share a single
+  `src/commands/collection-command.ts` module (`runListCollection`,
+  `runMetaCollection`, `runRemoveCollection`, `resolveRefOrReport`,
+  `applyMetaEdits`, `requireSaveForMetaFlags`, and a unified `writeCreateMeta`),
+  replacing the near-identical clones previously copy-pasted across the three
+  files. `did`'s metadata edit and save-flag guard reuse the same helpers. No
+  behavior change.
+- The `did` command file was split, mirroring `was/`: `src/commands/did.ts` now
+  holds only the `makeDidCommand()` wiring and delegates to `run*` functions in
+  `src/commands/did/` -- `create` (create / add-key), `service`
+  (add / remove-service), `manage` (get / show / list / meta / remove), and
+  `webvh-update` (the did:webvh log / update-key plumbing plus rotate-keys). The
+  in-`create` duplication was folded into shared `deriveSeed`,
+  `rejectSeedForNonDeterministic`, `resolveEcdsaCurveOrReport`, and
+  `printDidOutput` helpers (and a `DEFAULT_VERIFICATION_PURPOSES` constant), and
+  the `did.split(':')[1]` method-index idiom became `methodOf` in `storage.ts`.
+  No behavior change.
+- All commands now share a single JSON-LD document loader (`src/documentLoader.ts`)
+  for DID resolution, DID-URL dereferencing, and context loading -- replacing the
+  per-module loaders previously built in `vc/issue`, `vc/verify` (none was passed
+  before), `edv/recipients`, `zcap/delegate`, and `commands/did`. The shared
+  loader resolves `did:key`, `did:web`, and `did:webvh`.
+- `vc verify` prints a friendly `Cannot verify: ...` hint on stderr (stdout stays
+  machine-parseable JSON) when a proof's verification method uses a DID method the
+  loader has no driver for, distinguishing a loader misconfiguration from a
+  genuine invalid signature.
+- Internal typing and consistency cleanups (no behavior change): the exported
+  key-pair shape is named once as `StoredKeyPair` in `storage.ts` (replacing the
+  three verbatim copies in `vc/issue`, `zcap/signer`, `was/client` and the inline
+  shapes in `storage`/`meta`); `loadMetaFromCollection` is generic over the
+  metadata type (so only the `keys` collection carries the key-specific `dids`
+  field); `loadFromCollection` / `saveToCollection` take an options object like
+  the rest of the storage helpers; `vc/issue` and `vc/verify` replace their
+  `as never` casts with typed ones; `edv/recipients` replaces `Record<string,
+  any>` with a named `VerificationMethodNode` type; `edv`'s encrypt functions
+  share an `EnvelopeOptions` type and a `resolveEncryptContextOrReport` wrapper;
+  and the `z6Mk` / `z6LS` multibase prefixes are named constants. Added the
+  file-level JSDoc header to `key.ts` and moved the `zcap revoke` stub message to
+  stderr.
+
 ## 0.10.0 - 2026-06-25
 
 ### Added

package/dist/commands/collection-command.d.ts

@@ -0,0 +1,169 @@
+/**
+ * Shared helpers for the wallet "collection" command families (`vc`, `key`,
+ * and `zcap`), whose `list` / `show` / `meta` / `remove` subcommands and
+ * metadata handling are otherwise near-identical clones. Each command file
+ * declares its collection name and supplies the per-collection projection
+ * (how to load an item, turn it into a table row / JSON object, and resolve a
+ * reference); the control flow -- plain/json/empty/table listing, the
+ * set-or-clear metadata edits, and the resolve-then-validate preamble -- lives
+ * here once.
+ */
+import { type ItemMetadata, type KeyMetadata } from '../storage.js';
+import { type Column } from '../table.js';
+/**
+ * Guards the `--handle` / `--description` metadata flags against being given
+ * without `--save`. Prints the standard message to stderr and returns false
+ * when the combination is invalid; the caller chooses the exit code.
+ *
+ * @param options {object}
+ * @param [options.save] {boolean}
+ * @param [options.handle] {string}
+ * @param [options.description] {string}
+ * @returns {boolean}   true when the flags are valid.
+ */
+export declare function requireSaveForMetaFlags({ save, handle, description }: {
+    save?: boolean;
+    handle?: string;
+    description?: string;
+}): boolean;
+/**
+ * Apply the `--handle` / `--description` set-or-clear edits to a metadata
+ * object in place: a defined non-empty value sets the field, an empty string
+ * clears it, and an undefined value leaves it untouched.
+ *
+ * @param meta {ItemMetadata}   The metadata object to mutate.
+ * @param edits {object}
+ * @param [edits.handle] {string}
+ * @param [edits.description] {string}
+ * @returns {void}
+ */
+export declare function applyMetaEdits(meta: ItemMetadata, { handle, description }: {
+    handle?: string;
+    description?: string;
+}): void;
+/**
+ * Write the `.meta.json` metadata sidecar of a freshly saved wallet item: the
+ * creation timestamp plus the handle and description when given. When
+ * `mergeExisting` is set, any existing sidecar is loaded first and its fields
+ * take precedence over `created` (so re-saving an already-stored item keeps
+ * its original timestamp) -- used by `vc import` / `vc issue --save`, which may
+ * re-store a credential that is already in the wallet.
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param options.storageId {string}
+ * @param options.created {string}
+ * @param [options.handle] {string}
+ * @param [options.description] {string}
+ * @param [options.mergeExisting] {boolean}
+ * @returns {Promise<void>}
+ */
+export declare function writeCreateMeta({ collection, storageId, created, handle, description, mergeExisting }: {
+    collection: string;
+    storageId: string;
+    created: string;
+    handle?: string;
+    description?: string;
+    mergeExisting?: boolean;
+}): Promise<void>;
+/**
+ * Resolve a wallet item reference, reporting failures to stderr and returning
+ * undefined: prints the thrown error message on an ambiguous handle, or the
+ * standard "No locally stored <noun> found for <ref>" message when nothing
+ * matches. Collapses the resolve-then-validate preamble shared by the
+ * `show` / `meta` / `remove` subcommands; callers do `if (!resolved) return 1`.
+ *
+ * @param options {object}
+ * @param options.resolve {(ref: string) => Promise<T | undefined>}
+ * @param options.ref {string}
+ * @param options.noun {string}   The item noun for the not-found message.
+ * @returns {Promise<T | undefined>}
+ */
+export declare function resolveRefOrReport<T>({ resolve, ref, noun }: {
+    resolve: (ref: string) => Promise<T | undefined>;
+    ref: string;
+    noun: string;
+}): Promise<T | undefined>;
+/**
+ * Render a wallet collection listing: one id per line with `plain`, a JSON
+ * array with `json`, an empty result as no output, otherwise a column-aligned
+ * table. Shared by `vc list`, `key list`, and `zcap list`; each caller
+ * supplies how to load an item, project it to a row / JSON object, and the
+ * table columns. A `toEntry` returning undefined drops the item from the
+ * non-plain output (e.g. an id-less zcap).
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param [options.plain] {boolean}
+ * @param [options.json] {boolean}
+ * @param options.plainId {(item: Item, storageId: string) => string | undefined}
+ *   The id to print in `--plain` mode; undefined skips the item.
+ * @param options.toEntry {(args: {storageId: string, item: Item, meta?: KeyMetadata}) => Entry | undefined | Promise<Entry | undefined>}
+ * @param options.toJson {(entry: Entry) => object}
+ * @param options.columns {Column[]}
+ * @param options.toRow {(entry: Entry) => string[]}
+ * @returns {Promise<number>}   The process exit code.
+ */
+export declare function runListCollection<Item, Entry>({ collection, plain, json, plainId, toEntry, toJson, columns, toRow }: {
+    collection: string;
+    plain?: boolean;
+    json?: boolean;
+    plainId: (item: Item, storageId: string) => string | undefined;
+    toEntry: (args: {
+        storageId: string;
+        item: Item;
+        meta?: KeyMetadata;
+    }) => Entry | undefined | Promise<Entry | undefined>;
+    toJson: (entry: Entry) => object;
+    columns: Column[];
+    toRow: (entry: Entry) => string[];
+}): Promise<number>;
+/**
+ * Show or edit the metadata of a wallet item (by id or handle): with no
+ * `--handle` / `--description` edits, prints the current metadata; otherwise
+ * applies the set-or-clear edits, saves the sidecar, and prints the result.
+ * Shared by `vc meta` and `zcap meta`. (`key meta` keeps its own runner: it
+ * additionally backfills the created date and refreshes the cached DID
+ * associations.)
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param options.noun {string}
+ * @param options.resolve {(ref: string) => Promise<{storageId: string, meta?: ItemMetadata} | undefined>}
+ * @param options.ref {string}
+ * @param [options.handle] {string}
+ * @param [options.description] {string}
+ * @returns {Promise<number>}   The process exit code.
+ */
+export declare function runMetaCollection({ collection, noun, resolve, ref, handle, description }: {
+    collection: string;
+    noun: string;
+    resolve: (ref: string) => Promise<{
+        storageId: string;
+        meta?: ItemMetadata;
+    } | undefined>;
+    ref: string;
+    handle?: string;
+    description?: string;
+}): Promise<number>;
+/**
+ * Resolve a wallet item by reference and remove it (and its metadata sidecar),
+ * printing each removed file path to stderr. Shared by `vc remove`,
+ * `key remove`, and `zcap remove`.
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param options.noun {string}
+ * @param options.resolve {(ref: string) => Promise<{storageId: string} | undefined>}
+ * @param options.ref {string}
+ * @returns {Promise<number>}   The process exit code.
+ */
+export declare function runRemoveCollection({ collection, noun, resolve, ref }: {
+    collection: string;
+    noun: string;
+    resolve: (ref: string) => Promise<{
+        storageId: string;
+    } | undefined>;
+    ref: string;
+}): Promise<number>;
+//# sourceMappingURL=collection-command.d.ts.map

package/dist/commands/collection-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-command.d.ts","sourceRoot":"","sources":["../../src/commands/collection-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAML,KAAK,YAAY,EACjB,KAAK,WAAW,EACjB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAe,KAAK,MAAM,EAAE,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,CAAC,EACtC,IAAI,EACJ,MAAM,EACN,WAAW,EACZ,EAAE;IACD,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAMV;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE,YAAY,EAClB,EAAE,MAAM,EAAE,WAAW,EAAE,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjE,IAAI,CAeN;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,eAAe,CAAC,EACpC,UAAU,EACV,SAAS,EACT,OAAO,EACP,MAAM,EACN,WAAW,EACX,aAAa,EACd,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,EAC1C,OAAO,EACP,GAAG,EACH,IAAI,EACL,EAAE;IACD,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAA;IAChD,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAazB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,EACnD,UAAU,EACV,KAAK,EACL,IAAI,EACJ,OAAO,EACP,OAAO,EACP,MAAM,EACN,OAAO,EACP,KAAK,EACN,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;IAC9D,OAAO,EAAE,CAAC,IAAI,EAAE;QACd,SAAS,EAAE,MAAM,CAAA;QACjB,IAAI,EAAE,IAAI,CAAA;QACV,IAAI,CAAC,EAAE,WAAW,CAAA;KACnB,KAAK,KAAK,GAAG,SAAS,GAAG,OAAO,CAAC,KAAK,GAAG,SAAS,CAAC,CAAA;IACpD,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAA;IAChC,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,EAAE,CAAA;CAClC,GAAG,OAAO,CAAC,MAAM,CAAC,CAyClB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,iBAAiB,CAAC,EACtC,UAAU,EACV,IAAI,EACJ,OAAO,EACP,GAAG,EACH,MAAM,EACN,WAAW,EACZ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,CACP,GAAG,EAAE,MAAM,KACR,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,YAAY,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsBlB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CAAC,EACxC,UAAU,EACV,IAAI,EACJ,OAAO,EACP,GAAG,EACJ,EAAE;IACD,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACpE,GAAG,EAAE,MAAM,CAAA;CACZ,GAAG,OAAO,CAAC,MAAM,CAAC,CAalB"}

package/dist/commands/collection-command.js

@@ -0,0 +1,241 @@
+/**
+ * Shared helpers for the wallet "collection" command families (`vc`, `key`,
+ * and `zcap`), whose `list` / `show` / `meta` / `remove` subcommands and
+ * metadata handling are otherwise near-identical clones. Each command file
+ * declares its collection name and supplies the per-collection projection
+ * (how to load an item, turn it into a table row / JSON object, and resolve a
+ * reference); the control flow -- plain/json/empty/table listing, the
+ * set-or-clear metadata edits, and the resolve-then-validate preamble -- lives
+ * here once.
+ */
+import { listCollection, loadFromCollection, loadMetaFromCollection, removeFromCollection, saveMetaToCollection } from '../storage.js';
+import { renderTable } from '../table.js';
+/**
+ * Guards the `--handle` / `--description` metadata flags against being given
+ * without `--save`. Prints the standard message to stderr and returns false
+ * when the combination is invalid; the caller chooses the exit code.
+ *
+ * @param options {object}
+ * @param [options.save] {boolean}
+ * @param [options.handle] {string}
+ * @param [options.description] {string}
+ * @returns {boolean}   true when the flags are valid.
+ */
+export function requireSaveForMetaFlags({ save, handle, description }) {
+    if ((handle !== undefined || description !== undefined) && !save) {
+        console.error('--handle and --description require --save');
+        return false;
+    }
+    return true;
+}
+/**
+ * Apply the `--handle` / `--description` set-or-clear edits to a metadata
+ * object in place: a defined non-empty value sets the field, an empty string
+ * clears it, and an undefined value leaves it untouched.
+ *
+ * @param meta {ItemMetadata}   The metadata object to mutate.
+ * @param edits {object}
+ * @param [edits.handle] {string}
+ * @param [edits.description] {string}
+ * @returns {void}
+ */
+export function applyMetaEdits(meta, { handle, description }) {
+    if (handle !== undefined) {
+        if (handle === '') {
+            delete meta.handle;
+        }
+        else {
+            meta.handle = handle;
+        }
+    }
+    if (description !== undefined) {
+        if (description === '') {
+            delete meta.description;
+        }
+        else {
+            meta.description = description;
+        }
+    }
+}
+/**
+ * Write the `.meta.json` metadata sidecar of a freshly saved wallet item: the
+ * creation timestamp plus the handle and description when given. When
+ * `mergeExisting` is set, any existing sidecar is loaded first and its fields
+ * take precedence over `created` (so re-saving an already-stored item keeps
+ * its original timestamp) -- used by `vc import` / `vc issue --save`, which may
+ * re-store a credential that is already in the wallet.
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param options.storageId {string}
+ * @param options.created {string}
+ * @param [options.handle] {string}
+ * @param [options.description] {string}
+ * @param [options.mergeExisting] {boolean}
+ * @returns {Promise<void>}
+ */
+export async function writeCreateMeta({ collection, storageId, created, handle, description, mergeExisting }) {
+    const existing = mergeExisting
+        ? await loadMetaFromCollection({ collection, storageId })
+        : undefined;
+    const meta = { created, ...existing };
+    if (handle) {
+        meta.handle = handle;
+    }
+    if (description) {
+        meta.description = description;
+    }
+    await saveMetaToCollection({ collection, storageId, meta });
+}
+/**
+ * Resolve a wallet item reference, reporting failures to stderr and returning
+ * undefined: prints the thrown error message on an ambiguous handle, or the
+ * standard "No locally stored <noun> found for <ref>" message when nothing
+ * matches. Collapses the resolve-then-validate preamble shared by the
+ * `show` / `meta` / `remove` subcommands; callers do `if (!resolved) return 1`.
+ *
+ * @param options {object}
+ * @param options.resolve {(ref: string) => Promise<T | undefined>}
+ * @param options.ref {string}
+ * @param options.noun {string}   The item noun for the not-found message.
+ * @returns {Promise<T | undefined>}
+ */
+export async function resolveRefOrReport({ resolve, ref, noun }) {
+    let resolved;
+    try {
+        resolved = await resolve(ref);
+    }
+    catch (err) {
+        console.error(err.message);
+        return undefined;
+    }
+    if (!resolved) {
+        console.error(`No locally stored ${noun} found for ${ref}`);
+        return undefined;
+    }
+    return resolved;
+}
+/**
+ * Render a wallet collection listing: one id per line with `plain`, a JSON
+ * array with `json`, an empty result as no output, otherwise a column-aligned
+ * table. Shared by `vc list`, `key list`, and `zcap list`; each caller
+ * supplies how to load an item, project it to a row / JSON object, and the
+ * table columns. A `toEntry` returning undefined drops the item from the
+ * non-plain output (e.g. an id-less zcap).
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param [options.plain] {boolean}
+ * @param [options.json] {boolean}
+ * @param options.plainId {(item: Item, storageId: string) => string | undefined}
+ *   The id to print in `--plain` mode; undefined skips the item.
+ * @param options.toEntry {(args: {storageId: string, item: Item, meta?: KeyMetadata}) => Entry | undefined | Promise<Entry | undefined>}
+ * @param options.toJson {(entry: Entry) => object}
+ * @param options.columns {Column[]}
+ * @param options.toRow {(entry: Entry) => string[]}
+ * @returns {Promise<number>}   The process exit code.
+ */
+export async function runListCollection({ collection, plain, json, plainId, toEntry, toJson, columns, toRow }) {
+    const storageIds = await listCollection(collection);
+    if (plain) {
+        const ids = [];
+        for (const storageId of storageIds) {
+            const item = await loadFromCollection({ collection, storageId });
+            const id = plainId(item, storageId);
+            if (id !== undefined) {
+                ids.push(id);
+            }
+        }
+        ids.sort();
+        for (const id of ids) {
+            console.log(id);
+        }
+        return 0;
+    }
+    const entries = [];
+    for (const storageId of storageIds) {
+        const item = await loadFromCollection({ collection, storageId });
+        const meta = await loadMetaFromCollection({
+            collection,
+            storageId
+        });
+        const entry = await toEntry({ storageId, item, meta });
+        if (entry !== undefined) {
+            entries.push(entry);
+        }
+    }
+    if (json) {
+        console.log(JSON.stringify(entries.map(toJson), null, 2));
+        return 0;
+    }
+    if (entries.length === 0) {
+        return 0;
+    }
+    console.log(renderTable({ columns, rows: entries.map(toRow) }));
+    return 0;
+}
+/**
+ * Show or edit the metadata of a wallet item (by id or handle): with no
+ * `--handle` / `--description` edits, prints the current metadata; otherwise
+ * applies the set-or-clear edits, saves the sidecar, and prints the result.
+ * Shared by `vc meta` and `zcap meta`. (`key meta` keeps its own runner: it
+ * additionally backfills the created date and refreshes the cached DID
+ * associations.)
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param options.noun {string}
+ * @param options.resolve {(ref: string) => Promise<{storageId: string, meta?: ItemMetadata} | undefined>}
+ * @param options.ref {string}
+ * @param [options.handle] {string}
+ * @param [options.description] {string}
+ * @returns {Promise<number>}   The process exit code.
+ */
+export async function runMetaCollection({ collection, noun, resolve, ref, handle, description }) {
+    const resolved = await resolveRefOrReport({ resolve, ref, noun });
+    if (!resolved) {
+        return 1;
+    }
+    const hasEdits = handle !== undefined || description !== undefined;
+    if (!hasEdits) {
+        console.log(JSON.stringify(resolved.meta ?? {}, null, 2));
+        return 0;
+    }
+    const meta = { ...(resolved.meta ?? {}) };
+    applyMetaEdits(meta, { handle, description });
+    const filePath = await saveMetaToCollection({
+        collection,
+        storageId: resolved.storageId,
+        meta
+    });
+    console.error(`Metadata saved to ${filePath}`);
+    console.log(JSON.stringify(meta, null, 2));
+    return 0;
+}
+/**
+ * Resolve a wallet item by reference and remove it (and its metadata sidecar),
+ * printing each removed file path to stderr. Shared by `vc remove`,
+ * `key remove`, and `zcap remove`.
+ *
+ * @param options {object}
+ * @param options.collection {string}
+ * @param options.noun {string}
+ * @param options.resolve {(ref: string) => Promise<{storageId: string} | undefined>}
+ * @param options.ref {string}
+ * @returns {Promise<number>}   The process exit code.
+ */
+export async function runRemoveCollection({ collection, noun, resolve, ref }) {
+    const resolved = await resolveRefOrReport({ resolve, ref, noun });
+    if (!resolved) {
+        return 1;
+    }
+    const removed = await removeFromCollection({
+        collection,
+        storageId: resolved.storageId
+    });
+    for (const filePath of removed) {
+        console.error(`Removed ${filePath}`);
+    }
+    return 0;
+}
+//# sourceMappingURL=collection-command.js.map

package/dist/commands/collection-command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collection-command.js","sourceRoot":"","sources":["../../src/commands/collection-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,EACpB,oBAAoB,EAGrB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAe,MAAM,aAAa,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB,CAAC,EACtC,IAAI,EACJ,MAAM,EACN,WAAW,EAKZ;IACC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACjE,OAAO,CAAC,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC1D,OAAO,KAAK,CAAA;IACd,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAkB,EAClB,EAAE,MAAM,EAAE,WAAW,EAA6C;IAElE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,MAAM,CAAA;QACpB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACtB,CAAC;IACH,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,WAAW,CAAA;QACzB,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;QAChC,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EACpC,UAAU,EACV,SAAS,EACT,OAAO,EACP,MAAM,EACN,WAAW,EACX,aAAa,EAQd;IACC,MAAM,QAAQ,GAAG,aAAa;QAC5B,CAAC,CAAC,MAAM,sBAAsB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QACzD,CAAC,CAAC,SAAS,CAAA;IACb,MAAM,IAAI,GAAiB,EAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAA;IACnD,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;IACtB,CAAC;IACD,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAA;IAChC,CAAC;IACD,MAAM,oBAAoB,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;AAC7D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAI,EAC1C,OAAO,EACP,GAAG,EACH,IAAI,EAKL;IACC,IAAI,QAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAA;QACrC,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,qBAAqB,IAAI,cAAc,GAAG,EAAE,CAAC,CAAA;QAC3D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAc,EACnD,UAAU,EACV,KAAK,EACL,IAAI,EACJ,OAAO,EACP,OAAO,EACP,MAAM,EACN,OAAO,EACP,KAAK,EAcN;IACC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,UAAU,CAAC,CAAA;IACnD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,GAAG,GAAa,EAAE,CAAA;QACxB,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;YACtE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;YACnC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACrB,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;YACd,CAAC;QACH,CAAC;QACD,GAAG,CAAC,IAAI,EAAE,CAAA;QACV,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACjB,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,OAAO,GAAY,EAAE,CAAA;IAC3B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAA;QACtE,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAc;YACrD,UAAU;YACV,SAAS;SACV,CAAC,CAAA;QACF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;QACtD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;IAED,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACzD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,CAAA;IACV,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/D,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EACtC,UAAU,EACV,IAAI,EACJ,OAAO,EACP,GAAG,EACH,MAAM,EACN,WAAW,EAUZ;IACC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,CAAA;IAClE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QACzD,OAAO,CAAC,CAAA;IACV,CAAC;IAED,MAAM,IAAI,GAAiB,EAAE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAA;IACvD,cAAc,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAA;IAC7C,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC;QAC1C,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,IAAI;KACL,CAAC,CAAA;IACF,OAAO,CAAC,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAA;IAC9C,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1C,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EACxC,UAAU,EACV,IAAI,EACJ,OAAO,EACP,GAAG,EAMJ;IACC,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,CAAC,CAAA;IACV,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;QACzC,UAAU;QACV,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC9B,CAAC,CAAA;IACF,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,WAAW,QAAQ,EAAE,CAAC,CAAA;IACtC,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC"}

package/dist/commands/did/create.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Verification relationships a newly created did:webvh document key is wired
+ * into -- everything but keyAgreement, which needs an X25519 key. Also the
+ * `add-key` default purpose set (described in its help text).
+ */
+export declare const DEFAULT_VERIFICATION_PURPOSES: readonly ["authentication", "assertionMethod", "capabilityDelegation", "capabilityInvocation"];
+/**
+ * Create a new DID of the given method (key, web, or webvh), optionally saving
+ * its document, keys, and metadata to local storage, and print it to stdout.
+ *
+ * @param options {object}
+ * @param [options.method] {string}   DID method: key (default), web, or webvh.
+ * @param options.type {string}   Key type (ed25519 or ecdsa).
+ * @param options.curve {string}   ECDSA curve, for --type ecdsa.
+ * @param [options.url] {string}   HTTPS url (required for did:web/did:webvh).
+ * @param [options.prerotation] {boolean}   Arm did:webvh key pre-rotation.
+ * @param [options.portable] {boolean}   Create a portable did:webvh.
+ * @param [options.witness] {string[]}   did:webvh witness did:key DIDs.
+ * @param [options.witnessThreshold] {string}   Required witness approvals.
+ * @param [options.watcher] {string[]}   did:webvh watcher URLs.
+ * @param [options.withSeed] {boolean}   Include/derive the secret key seed.
+ * @param [options.save] {boolean}   Save the DID to local storage.
+ * @param [options.handle] {string}   Short tag stored in the metadata sidecar.
+ * @param [options.description] {string}   Longer description for the sidecar.
+ * @returns {Promise<number>}   The process exit code.
+ */
+export declare function runCreate(options: {
+    method?: string;
+    type: string;
+    curve: string;
+    url?: string;
+    prerotation?: boolean;
+    portable?: boolean;
+    witness?: string[];
+    witnessThreshold?: string;
+    watcher?: string[];
+    withSeed?: boolean;
+    save?: boolean;
+    handle?: string;
+    description?: string;
+}): Promise<number>;
+/**
+ * Add a verification key to an existing (locally stored) did:web document,
+ * re-save the document and keys file, and print the updated document.
+ *
+ * @param options {object}
+ * @param options.did {string}   The did:web DID to add a key to.
+ * @param options.type {string}   Key type: ed25519, ecdsa, or x25519.
+ * @param options.curve {string}   ECDSA curve, for --type ecdsa.
+ * @param [options.purpose] {string[]}   Verification relationship(s) to wire
+ *   the key into.
+ * @param [options.withSeed] {boolean}   Include/derive the secret key seed
+ *   (ed25519 only).
+ * @returns {Promise<number>}   The process exit code.
+ */
+export declare function runAddKey(options: {
+    did: string;
+    type: string;
+    curve: string;
+    purpose?: string[];
+    withSeed?: boolean;
+}): Promise<number>;
+//# sourceMappingURL=create.d.ts.map

package/dist/commands/did/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/did/create.ts"],"names":[],"mappings":"AAsCA;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,gGAKhC,CAAA;AAuJV;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE;IACvC,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6XlB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAAC,OAAO,EAAE;IACvC,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAA;CACnB,GAAG,OAAO,CAAC,MAAM,CAAC,CAsIlB"}