nostr-bray 1.30.0 → 1.32.0

package/README.md

@@ -1,11 +1,12 @@
 # nostr-bray
 
-**Trust-aware Nostr MCP for AI and humans.** 235 tools across 27 groups. Model-agnostic. Works with Claude, ChatGPT, Gemini, Cursor, Windsurf, or any MCP client.
+**Trust-aware Nostr MCP for AI and humans.** 238 tools across 27 groups. Model-agnostic. Works with Claude, ChatGPT, Gemini, Cursor, Windsurf, or any MCP client.
 
 [![npm](https://img.shields.io/npm/v/nostr-bray)](https://www.npmjs.com/package/nostr-bray)
 [![CI](https://github.com/forgesworn/bray/actions/workflows/ci.yml/badge.svg)](https://github.com/forgesworn/bray/actions/workflows/ci.yml)
 [![licence](https://img.shields.io/npm/l/nostr-bray)](./LICENSE)
 [![TypeScript](https://img.shields.io/badge/TypeScript-ESM-blue)](./tsconfig.json)
+[![GitHub Sponsors](https://img.shields.io/github/sponsors/TheCryptoDonkey?logo=githubsponsors&color=ea4aaa&label=Sponsor)](https://github.com/sponsors/TheCryptoDonkey)
 
 ## Quick Start
 

package/dist/admin/handlers.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Admin — NIP-86 relay management API.
+ *
+ * NIP-86 defines an HTTP management API for relay operators. Requests are POST to the
+ * relay's HTTP URL with a NIP-98 `Authorization: Nostr <base64(event)>` header.
+ *
+ * Reference: https://github.com/nostr-protocol/nips/blob/master/86.md
+ */
+import type { SigningContext } from '../signing-context.js';
+export type AdminMethod = 'allowpubkey' | 'banpubkey' | 'listallowedpubkeys' | 'listbannedpubkeys' | 'allowkind' | 'bankind' | 'listallowedkinds' | 'listbannedkinds' | 'blockip' | 'unblockip' | 'listblockedips';
+export interface AdminCallOptions {
+    /** Relay HTTP URL (e.g. https://relay.example.com) */
+    relay: string;
+    /** NIP-86 method name */
+    method: AdminMethod;
+    /** Method parameters (pubkey hex, kind number, IP address, etc.) */
+    params?: Array<string | number>;
+}
+export interface AdminResult {
+    relay: string;
+    method: AdminMethod;
+    result: unknown;
+}
+/**
+ * Call a NIP-86 relay management method.
+ *
+ * @param ctx - Signing context used to produce the NIP-98 auth event
+ * @param opts - Target relay URL, method name, and optional parameters
+ */
+export declare function handleAdminCall(ctx: SigningContext, opts: AdminCallOptions): Promise<AdminResult>;

package/dist/admin/handlers.js

@@ -0,0 +1,71 @@
+/**
+ * Admin — NIP-86 relay management API.
+ *
+ * NIP-86 defines an HTTP management API for relay operators. Requests are POST to the
+ * relay's HTTP URL with a NIP-98 `Authorization: Nostr <base64(event)>` header.
+ *
+ * Reference: https://github.com/nostr-protocol/nips/blob/master/86.md
+ */
+// ─── Internal helpers ─────────────────────────────────────────────────────────
+/**
+ * Build a NIP-98 HTTP Auth header value for the given URL and HTTP method.
+ *
+ * Produces a signed kind 27235 event and returns the
+ * `Nostr <base64url(JSON)>` string ready for the Authorization header.
+ */
+async function buildNip98Header(ctx, url, httpMethod, payloadHash) {
+    const sign = ctx.getSigningFunction();
+    const tags = [
+        ['u', url],
+        ['method', httpMethod.toUpperCase()],
+    ];
+    if (payloadHash)
+        tags.push(['payload', payloadHash]);
+    const event = await sign({
+        kind: 27235,
+        created_at: Math.floor(Date.now() / 1000),
+        tags,
+        content: '',
+    });
+    const encoded = Buffer.from(JSON.stringify(event), 'utf-8').toString('base64');
+    return `Nostr ${encoded}`;
+}
+// ─── Handler ──────────────────────────────────────────────────────────────────
+/**
+ * Call a NIP-86 relay management method.
+ *
+ * @param ctx - Signing context used to produce the NIP-98 auth event
+ * @param opts - Target relay URL, method name, and optional parameters
+ */
+export async function handleAdminCall(ctx, opts) {
+    // NIP-86 always POSTs to the relay root URL
+    const url = opts.relay.replace(/\/$/, '');
+    const body = JSON.stringify({
+        method: opts.method,
+        params: opts.params ?? [],
+    });
+    // Hash the request body for the NIP-98 payload tag (SHA-256 hex)
+    const { createHash } = await import('node:crypto');
+    const payloadHash = createHash('sha256').update(body, 'utf-8').digest('hex');
+    const authHeader = await buildNip98Header(ctx, url, 'POST', payloadHash);
+    const response = await fetch(url, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/nostr+json+rpc',
+            'Authorization': authHeader,
+        },
+        body,
+    });
+    if (!response.ok) {
+        const text = await response.text().catch(() => '');
+        throw new Error(`Admin call failed: HTTP ${response.status} — ${text}`);
+    }
+    const json = await response.json();
+    if (json.error)
+        throw new Error(`Relay error: ${json.error}`);
+    return {
+        relay: opts.relay,
+        method: opts.method,
+        result: json.result,
+    };
+}

package/dist/admin/index.d.ts

@@ -0,0 +1 @@
+export * from './handlers.js';

package/dist/admin/index.js

@@ -0,0 +1 @@
+export * from './handlers.js';

package/dist/bunker-helpers.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Read the BIP-39 mnemonic from an nsec-tree-cli profile
+ * (`~/.nsec-tree/profiles/<name>.json`). Lets `bunker --profile <name>` use the
+ * master directly, so the operator never types or stores the 12 words separately.
+ */
+export declare function readNsecTreeProfileMnemonic(name: string, baseDir?: string): string;
+/**
+ * Get — creating + persisting on first use — a stable bunker connection key for
+ * a label, so the bunker:// URI stays the same across restarts without the
+ * operator managing key files. Stored in bray's state dir.
+ */
+export declare function getOrCreateBunkerKey(label: string, stateDir?: string): string;

package/dist/bunker-helpers.js

@@ -0,0 +1,36 @@
+import { readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { generateSecretKey } from 'nostr-tools/pure';
+import { bytesToHex } from 'nostr-tools/utils';
+import { readStateFile, writeStateFile } from './state.js';
+const NSEC_TREE_PROFILES_DIR = join(homedir(), '.nsec-tree', 'profiles');
+const BUNKER_KEYS_FILE = 'bunker-keys.json';
+/**
+ * Read the BIP-39 mnemonic from an nsec-tree-cli profile
+ * (`~/.nsec-tree/profiles/<name>.json`). Lets `bunker --profile <name>` use the
+ * master directly, so the operator never types or stores the 12 words separately.
+ */
+export function readNsecTreeProfileMnemonic(name, baseDir = NSEC_TREE_PROFILES_DIR) {
+    const raw = readFileSync(join(baseDir, `${name}.json`), 'utf8');
+    const mnemonic = JSON.parse(raw).root?.mnemonic;
+    if (typeof mnemonic !== 'string' || mnemonic.trim() === '') {
+        throw new Error(`nsec-tree profile "${name}" is not mnemonic-backed (no recoverable 12 words)`);
+    }
+    return mnemonic.trim();
+}
+/**
+ * Get — creating + persisting on first use — a stable bunker connection key for
+ * a label, so the bunker:// URI stays the same across restarts without the
+ * operator managing key files. Stored in bray's state dir.
+ */
+export function getOrCreateBunkerKey(label, stateDir) {
+    const keys = readStateFile(BUNKER_KEYS_FILE, stateDir);
+    const existing = keys[label];
+    if (typeof existing === 'string' && /^[0-9a-f]{64}$/i.test(existing))
+        return existing;
+    const hex = bytesToHex(generateSecretKey());
+    keys[label] = hex;
+    writeStateFile(BUNKER_KEYS_FILE, keys, stateDir);
+    return hex;
+}

package/dist/catalog.js

@@ -51,25 +51,36 @@ export class ActionCatalog {
                     }],
             };
         }
-        if (entry.inputSchema && Object.keys(entry.inputSchema).length > 0) {
-            const schema = z.object(entry.inputSchema);
-            const result = schema.safeParse(params);
-            if (!result.success) {
-                return {
-                    content: [{
-                            type: 'text',
-                            text: JSON.stringify({
-                                error: 'Invalid parameters',
-                                action: name,
-                                issues: result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`),
-                                expected: extractParams(entry.inputSchema),
-                            }, null, 2),
-                        }],
-                };
-            }
-            return entry.handler(result.data);
+        // A registered catalog entry must carry an inputSchema, even if empty.
+        // Fail-closed when undefined so that a registration bug cannot silently
+        // forward unvalidated arguments to a handler.
+        if (!entry.inputSchema) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: 'Action has no declared input schema',
+                            action: name,
+                        }, null, 2),
+                    }],
+            };
+        }
+        const schema = z.object(entry.inputSchema);
+        const result = schema.safeParse(params ?? {});
+        if (!result.success) {
+            return {
+                content: [{
+                        type: 'text',
+                        text: JSON.stringify({
+                            error: 'Invalid parameters',
+                            action: name,
+                            issues: result.error.issues.map(i => `${i.path.join('.')}: ${i.message}`),
+                            expected: extractParams(entry.inputSchema),
+                        }, null, 2),
+                    }],
+            };
         }
-        return entry.handler(params);
+        return entry.handler(result.data);
     }
     registerMetaTools(server) {
         const catalog = this;

package/dist/cli/commands/admin.d.ts

@@ -0,0 +1,2 @@
+import type { Helpers } from '../dispatch.js';
+export declare function dispatch(cmd: string, cmdArgs: string[], h: Helpers, ctx: any): Promise<void>;

package/dist/cli/commands/admin.js

@@ -0,0 +1,29 @@
+import { handleAdminCall } from '../../exports.js';
+const ADMIN_METHODS = new Set([
+    'allowpubkey', 'banpubkey', 'listallowedpubkeys', 'listbannedpubkeys',
+    'allowkind', 'bankind', 'listallowedkinds', 'listbannedkinds',
+    'blockip', 'unblockip', 'listblockedips',
+]);
+export async function dispatch(cmd, cmdArgs, h, ctx) {
+    // cmd is always 'admin'; subcommand is cmdArgs[1] (already sliced by normaliser)
+    // After COMPOUND_COMMANDS normalisation: cmd = 'admin-<subcommand>'
+    const { req, out } = h;
+    // Extract the method from the compound command name
+    const method = cmd.replace(/^admin-/, '');
+    if (!ADMIN_METHODS.has(method)) {
+        throw new Error(`Unknown admin subcommand: ${method}. Valid: ${[...ADMIN_METHODS].join(', ')}`);
+    }
+    const relay = req(1, `admin ${method} <relay-url> [param...]`);
+    // Remaining positional args after relay URL are method params
+    const params = cmdArgs.slice(2).filter(a => !a.startsWith('--'));
+    // allowkind / bankind take integer params
+    const coercedParams = params.map(p => {
+        const n = Number(p);
+        return isNaN(n) ? p : n;
+    });
+    out(await handleAdminCall(ctx, {
+        relay,
+        method,
+        params: coercedParams.length ? coercedParams : undefined,
+    }), d => `${d.method} on ${d.relay}: ${JSON.stringify(d.result)}`);
+}

package/dist/cli/commands/bunker.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Bunker command module.
+ * bunker sign, bunker connect, bunker authorize, bunker status, and bunker daemon
+ * are all dispatched BEFORE ctx/pool setup in index.ts, so this module does its
+ * own config/context construction.
+ */
+/**
+ * Apply `--persona <name>` to a bunker context: switch signing to that named
+ * sub-identity (the same key `nsec-tree-cli export nsec <name>` yields). With no
+ * `--persona`, the bunker signs as the configured master identity, unchanged.
+ */
+export declare function applyBunkerPersona(ctx: {
+    use(purpose: string, index?: number): Promise<void>;
+}, args: string[]): Promise<string | undefined>;
+export declare function dispatch(args: string[]): Promise<void>;

package/dist/cli/commands/bunker.js

@@ -0,0 +1,197 @@
+/**
+ * Bunker command module.
+ * bunker sign, bunker connect, bunker authorize, bunker status, and bunker daemon
+ * are all dispatched BEFORE ctx/pool setup in index.ts, so this module does its
+ * own config/context construction.
+ */
+/** Filename used to persist the active bunker URI inside the bray state dir. */
+const BUNKER_URI_FILE = 'bunker-uri';
+/**
+ * Apply `--persona <name>` to a bunker context: switch signing to that named
+ * sub-identity (the same key `nsec-tree-cli export nsec <name>` yields). With no
+ * `--persona`, the bunker signs as the configured master identity, unchanged.
+ */
+export async function applyBunkerPersona(ctx, args) {
+    const i = args.indexOf('--persona');
+    const value = i >= 0 ? args[i + 1] : undefined;
+    if (value && !value.startsWith('--')) {
+        await ctx.use(value);
+        return value;
+    }
+    return undefined;
+}
+export async function dispatch(args) {
+    // Accept `bunker daemon` as alias for `bunker` (start daemon)
+    if (args[1] === 'daemon')
+        args.splice(1, 1);
+    // ── bunker connect <bunker-url> ─────────────────────────────────────────────
+    // Connect to a remote NIP-46 bunker or Heartwood device, verify the
+    // connection, then persist the URI so subsequent bray commands use it
+    // automatically without needing BUNKER_URI in the environment.
+    if (args[1] === 'connect') {
+        const uri = args[2];
+        if (!uri) {
+            console.error('usage: bray bunker connect <bunker://…>');
+            process.exit(1);
+        }
+        const { BunkerContext } = await import('../../bunker-context.js');
+        const { HeartwoodContext } = await import('../../heartwood-context.js');
+        const { writeStateFile } = await import('../../state.js');
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        let client;
+        try {
+            client = await BunkerContext.connect(uri);
+            await client.resolvePublicKey();
+        }
+        catch (err) {
+            console.error(`bunker connect: failed to connect — ${err.message}`);
+            process.exit(1);
+        }
+        const hw = await HeartwoodContext.probe(client);
+        const isHeartwood = hw !== null;
+        // Persist URI in state dir so loadConfig() picks it up on next invocation.
+        // Written with 0600 permissions by writeStateFile.
+        writeStateFile(BUNKER_URI_FILE, { uri });
+        const npub = client.activeNpub;
+        client.destroy();
+        console.log(JSON.stringify({
+            connected: true,
+            npub,
+            heartwood: isHeartwood,
+            saved: true,
+        }, null, 2));
+        process.exit(0);
+    }
+    // ── bunker authorize <app-pubkey> ───────────────────────────────────────────
+    // Pre-authorise an app's hex pubkey so it can use the bunker daemon without
+    // going through the interactive connect flow.  Reads the saved bunker URI for
+    // the bunker transport pubkey (used as the key in approved-clients.json) then
+    // writes the new entry — no network connection required.
+    if (args[1] === 'authorize') {
+        const appPubkey = args[2];
+        if (!appPubkey || !/^[0-9a-f]{64}$/i.test(appPubkey)) {
+            console.error('usage: bray bunker authorize <64-char-hex-pubkey>');
+            process.exit(1);
+        }
+        const { readStateFile, writeStateFile } = await import('../../state.js');
+        const { parseBunkerUri } = await import('../../bunker-context.js');
+        // The bunker transport pubkey keys the approvals file.  It is the pubkey
+        // encoded in the saved bunker URI (bunker://<pubkey>?…), OR falls back to
+        // the BUNKER_URI env var so the command also works without a saved URI.
+        const saved = readStateFile(BUNKER_URI_FILE);
+        const bunkerUriStr = saved.uri ?? process.env.BUNKER_URI;
+        if (!bunkerUriStr) {
+            console.error('bunker authorize: no saved bunker URI — run `bunker connect` first or set BUNKER_URI');
+            process.exit(1);
+        }
+        const { pubkey: bunkerPk } = parseBunkerUri(bunkerUriStr);
+        const APPROVALS_FILE = 'approved-clients.json';
+        const current = readStateFile(APPROVALS_FILE);
+        const entries = current[bunkerPk] ?? [];
+        const normalised = appPubkey.toLowerCase();
+        if (entries.includes(normalised)) {
+            console.error(`bunker authorize: ${normalised} is already authorised`);
+            process.exit(0);
+        }
+        entries.push(normalised);
+        current[bunkerPk] = entries;
+        writeStateFile(APPROVALS_FILE, current);
+        console.log(JSON.stringify({ authorised: normalised, total: entries.length }, null, 2));
+        process.exit(0);
+    }
+    // ── bunker status ───────────────────────────────────────────────────────────
+    // Report the saved bunker URI and its parsed details.  Does NOT attempt a
+    // live connection (use `bunker connect` to verify reachability).
+    if (args[1] === 'status') {
+        const { readStateFile } = await import('../../state.js');
+        const saved = readStateFile(BUNKER_URI_FILE);
+        if (!saved.uri) {
+            console.log(JSON.stringify({ connected: false }));
+            process.exit(0);
+        }
+        const { parseBunkerUri } = await import('../../bunker-context.js');
+        const { npubEncode } = await import('nostr-tools/nip19');
+        const cfg = parseBunkerUri(saved.uri);
+        const npub = npubEncode(cfg.pubkey);
+        console.log(JSON.stringify({
+            connected: true,
+            npub,
+            relays: cfg.relays,
+        }, null, 2));
+        process.exit(0);
+    }
+    // One-shot signing: bray bunker sign <file> [--bunker <url>]
+    if (args[1] === 'sign') {
+        const { readFileSync } = await import('node:fs');
+        const { BunkerContext } = await import('../../bunker-context.js');
+        const bunkerUri = process.env.BUNKER_URI;
+        if (!bunkerUri) {
+            console.error('bunker sign: missing bunker URI — use --bunker <url> or set BUNKER_URI');
+            process.exit(1);
+        }
+        const filePath = args[2] && args[2] !== '-' ? args[2] : undefined;
+        const raw = filePath ? readFileSync(filePath, 'utf-8') : readFileSync(0, 'utf-8');
+        const template = JSON.parse(raw);
+        const client = await BunkerContext.connect(bunkerUri);
+        await client.resolvePublicKey();
+        const sign = client.getSigningFunction();
+        const signed = await sign({
+            kind: template.kind ?? 1,
+            created_at: template.created_at ?? Math.floor(Date.now() / 1000),
+            tags: template.tags ?? [],
+            content: template.content ?? '',
+        });
+        console.log(JSON.stringify(signed, null, 2));
+        client.destroy();
+        process.exit(0);
+    }
+    // Bunker daemon
+    const { startBunker } = await import('../../bunker.js');
+    const { readNsecTreeProfileMnemonic, getOrCreateBunkerKey } = await import('../../bunker-helpers.js');
+    // --profile <name>: load the master straight from an nsec-tree-cli profile
+    // (~/.nsec-tree/profiles/<name>.json). loadConfig scrubs NOSTR_SECRET_KEY after.
+    const profileIdx = args.indexOf('--profile');
+    const profileName = profileIdx >= 0 && args[profileIdx + 1] && !args[profileIdx + 1].startsWith('--')
+        ? args[profileIdx + 1]
+        : undefined;
+    if (profileName)
+        process.env.NOSTR_SECRET_KEY = readNsecTreeProfileMnemonic(profileName);
+    const config = await (await import('../../config.js')).loadConfig();
+    const { IdentityContext: IC } = await import('../../context.js');
+    const bCtx = new IC(config.secretKey, config.secretFormat);
+    config.secretKey = '';
+    const persona = await applyBunkerPersona(bCtx, args);
+    const authorizedKeys = args.includes('--authorized-keys')
+        ? args[args.indexOf('--authorized-keys') + 1].split(',')
+        : undefined;
+    let bunkerKeyHex;
+    if (args.includes('--bunker-key-file')) {
+        const { readFileSync } = await import('node:fs');
+        bunkerKeyHex = readFileSync(args[args.indexOf('--bunker-key-file') + 1], 'utf-8').trim();
+    }
+    else if (args.includes('--bunker-key')) {
+        bunkerKeyHex = args[args.indexOf('--bunker-key') + 1];
+    }
+    else {
+        // No explicit key: persist a STABLE one per identity so the bunker:// URI
+        // survives restarts without the operator managing key files.
+        bunkerKeyHex = getOrCreateBunkerKey(persona ?? profileName ?? 'default');
+    }
+    const relays = config.relays.length > 0
+        ? config.relays
+        : ['wss://relay.damus.io', 'wss://nos.lol'];
+    const bunker = startBunker({
+        ctx: bCtx,
+        relays,
+        authorizedKeys,
+        bunkerKeyHex,
+        quiet: args.includes('--quiet'),
+    });
+    console.error(`nostr-bray bunker running`);
+    console.error(`URI: ${bunker.url}`);
+    console.error(`Signing as: ${bCtx.activeNpub}`);
+    console.error('Press Ctrl+C to stop');
+    process.on('SIGINT', () => { bunker.close(); bCtx.destroy(); process.exit(0); });
+    process.on('SIGTERM', () => { bunker.close(); bCtx.destroy(); process.exit(0); });
+    await new Promise(() => { });
+}

package/dist/cli/commands/event.d.ts

@@ -0,0 +1,2 @@
+import type { Helpers } from '../dispatch.js';
+export declare function dispatch(cmd: string, _cmdArgs: string[], h: Helpers, ctx: any, pool: any): Promise<void>;

package/dist/cli/commands/event.js

@@ -0,0 +1,74 @@
+import { handlePublishEvent, handlePublishRaw } from '../../exports.js';
+export async function dispatch(cmd, _cmdArgs, h, ctx, pool) {
+    const { flag, flags, hasFlag, out } = h;
+    switch (cmd) {
+        case 'event': {
+            const kind = parseInt(flag('kind') ?? '', 10);
+            if (!kind || isNaN(kind))
+                throw new Error('Usage: event --kind <N> [--tag k=v] [--content s] [--relay url] [--no-publish]');
+            const tagValues = flags('tag').map(t => {
+                const eq = t.indexOf('=');
+                if (eq === -1)
+                    return [t];
+                return [t.slice(0, eq), t.slice(eq + 1)];
+            });
+            const content = flag('content') ?? '';
+            const relayOverrides = flags('relay');
+            if (hasFlag('no-publish')) {
+                const sign = ctx.getSigningFunction();
+                const event = await sign({
+                    kind,
+                    created_at: Math.floor(Date.now() / 1000),
+                    tags: tagValues,
+                    content,
+                });
+                console.log(JSON.stringify(event, null, 2));
+                break;
+            }
+            out(await handlePublishEvent(ctx, pool, {
+                kind,
+                content,
+                tags: tagValues,
+                relays: relayOverrides.length ? relayOverrides : undefined,
+            }));
+            break;
+        }
+        case 'publish-raw': {
+            const { readFileSync } = await import('node:fs');
+            const raw = hasFlag('file')
+                ? readFileSync(flag('file'), 'utf-8')
+                : readFileSync(0, 'utf-8');
+            const inputEvent = JSON.parse(raw);
+            const relayOverrides = flags('relay');
+            const timeoutMs = flag('timeout') ? parseInt(flag('timeout'), 10) : undefined;
+            const quorum = flag('quorum') ? parseInt(flag('quorum'), 10) : undefined;
+            const report = hasFlag('report');
+            const result = await handlePublishRaw(ctx, pool, {
+                event: inputEvent,
+                noSign: hasFlag('no-sign'),
+                relays: relayOverrides.length ? relayOverrides : undefined,
+                timeoutMs,
+                quorum,
+            });
+            if (report) {
+                const { accepted, rejected, errors } = result.publish;
+                const rows = [
+                    ...accepted.map(u => `  ✓  ${u}`),
+                    ...rejected.map(u => {
+                        const err = errors.find(e => e.startsWith(u));
+                        return `  ✗  ${u}${err ? `  (${err.slice(u.length + 2)})` : ''}`;
+                    }),
+                ];
+                const status = result.publish.success ? 'OK' : 'FAILED';
+                console.log(`publish-raw ${status}: ${accepted.length}/${accepted.length + rejected.length} relays accepted`);
+                console.log(rows.join('\n'));
+            }
+            else {
+                out(result);
+            }
+            break;
+        }
+        default:
+            throw new Error(`Unknown command: ${cmd}. Run --help for usage.`);
+    }
+}

package/dist/cli/commands/identity.d.ts

@@ -0,0 +1,2 @@
+import type { Helpers } from '../dispatch.js';
+export declare function dispatch(cmd: string, cmdArgs: string[], h: Helpers, ctx: any, pool: any): Promise<void>;

package/dist/cli/commands/identity.js

@@ -0,0 +1,67 @@
+import { handleIdentityList, handleIdentityProve, handleIdentityCreate, handleBackupShamir, handleRestoreShamir, handleIdentityBackup, handleIdentityRestore, handleIdentityMigrate, handleTrustProofPublish, } from '../../exports.js';
+import * as fmt from '../../format.js';
+export async function dispatch(cmd, cmdArgs, h, ctx, pool) {
+    const { req, flag, hasFlag, out } = h;
+    switch (cmd) {
+        case 'whoami':
+            console.log(ctx.activeNpub);
+            break;
+        case 'create':
+            out(handleIdentityCreate());
+            break;
+        case 'list':
+            out(await handleIdentityList(ctx), fmt.formatIdentityList);
+            break;
+        case 'derive':
+            out(await ctx.derive(req(1, 'derive <purpose> [index]'), parseInt(cmdArgs[2] ?? '0', 10)));
+            break;
+        case 'persona':
+            out(await ctx.derivePersona(req(1, 'persona <name> [index]'), parseInt(cmdArgs[2] ?? '0', 10)));
+            break;
+        case 'switch':
+            await ctx.switch(req(1, 'switch <target> [index]'), cmdArgs[2] ? parseInt(cmdArgs[2], 10) : undefined);
+            console.error(`Now signing as ${ctx.activeNpub}`);
+            console.log(ctx.activeNpub);
+            break;
+        case 'prove':
+            out(await handleIdentityProve(ctx, { mode: (cmdArgs[1] === 'full' ? 'full' : 'blind') }));
+            break;
+        case 'proof-publish': {
+            const r = await handleTrustProofPublish(ctx, pool, {
+                mode: (cmdArgs[1] === 'full' ? 'full' : 'blind'),
+                confirm: hasFlag('confirm'),
+            });
+            out(r);
+            break;
+        }
+        case 'backup':
+            out(handleBackupShamir({
+                secret: new Uint8Array(ctx.activePrivateKey),
+                threshold: parseInt(cmdArgs[2] ?? '3', 10),
+                shares: parseInt(cmdArgs[3] ?? '5', 10),
+                outputDir: req(1, 'backup <dir> [threshold] [shares]'),
+            }));
+            break;
+        case 'restore': {
+            const tFlag = flag('t', '3');
+            const files = cmdArgs.slice(1).filter(a => a !== '--t' && a !== `-t` && a !== tFlag);
+            out({ masterNpub: handleRestoreShamir({ files, threshold: parseInt(tFlag, 10) }) });
+            break;
+        }
+        case 'identity-backup':
+            out(await handleIdentityBackup(pool, req(1, 'identity-backup <pubkey-hex>'), ctx.activeNpub));
+            break;
+        case 'identity-restore':
+            out(await handleIdentityRestore(ctx, pool, await handleIdentityBackup(pool, req(1, 'identity-restore <pubkey-hex>'), ctx.activeNpub)));
+            break;
+        case 'migrate':
+            out(await handleIdentityMigrate(ctx, pool, {
+                oldPubkeyHex: req(1, 'migrate <old-hex> <old-npub>'),
+                oldNpub: req(2, 'migrate <old-hex> <old-npub>'),
+                confirm: hasFlag('confirm'),
+            }));
+            break;
+        default:
+            throw new Error(`Unknown command: ${cmd}. Run --help for usage.`);
+    }
+}

package/dist/cli/commands/musig2.d.ts

@@ -0,0 +1,2 @@
+import type { Helpers } from '../dispatch.js';
+export declare function dispatch(cmd: string, _cmdArgs: string[], h: Helpers): Promise<void>;