archon-cli.js

import { program } from 'commander';
import fs from 'fs';
import path from 'path';
import { fileURLToPath } from 'url';
import dotenv from 'dotenv';

import KeymasterClient from '@didcid/clients/keymaster';

dotenv.config();

const __filename = fileURLToPath(import.meta.url);
const __dirname = path.dirname(__filename);
const pkg = JSON.parse(fs.readFileSync(path.resolve(__dirname, '..', 'package.json'), 'utf-8'));

let keymaster;

const UPDATE_OK = "OK";
const UPDATE_FAILED = "Update failed";
const LIGHTNING_ZAP_STATUS_CHECKS = 3;
const LIGHTNING_ZAP_STATUS_DELAY_MS = 1000;

function sleep(ms) {
    return new Promise(resolve => setTimeout(resolve, ms));
}

// A handler that reports a failure has to fail the process too: without this
// `archon create-id alice && next` runs `next` after alice failed, and no
// script or CI step can tell. exitCode rather than exit(1), so stdout a
// partially-completed command already wrote still flushes.
function fail(detail) {
    console.error(detail);
    process.exitCode = 1;
}


program
    .version(pkg.version)
    .description('Archon CLI tool')
    .configureHelp({ sortSubcommands: true });

program
    .command('create-wallet')
    .description('Create a new wallet (or show existing wallet)')
    .action(async () => {
        try {
            const wallet = await keymaster.loadWallet();
            console.log(JSON.stringify(wallet, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('new-wallet')
    .description('Create a new wallet')
    .action(async () => {
        try {
            await keymaster.newWallet("", true);
            const wallet = await keymaster.loadWallet();
            console.log(JSON.stringify(wallet, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('check-wallet')
    .description('Validate DIDs in wallet')
    .action(async () => {
        try {
            const { checked, invalid, deleted } = await keymaster.checkWallet();

            if (invalid === 0 && deleted === 0) {
                console.log(`${checked} DIDs checked, no problems found`);
            }
            else {
                console.log(`${checked} DIDs checked, ${invalid} invalid DIDs found, ${deleted} deleted DIDs found`);
            }
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('fix-wallet')
    .description('Remove invalid DIDs from the wallet')
    .action(async () => {
        try {
            const { idsRemoved, ownedRemoved, heldRemoved, aliasesRemoved } = await keymaster.fixWallet();

            console.log(`${idsRemoved} IDs and ${ownedRemoved} owned DIDs and ${heldRemoved} held DIDs and ${aliasesRemoved} aliases were removed`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('import-wallet <recovery-phrase>')
    .description('Create new wallet from a recovery phrase')
    .action(async (recoveryPhrase) => {
        try {
            const wallet = await keymaster.newWallet(recoveryPhrase);
            console.log(JSON.stringify(wallet, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('show-wallet')
    .description('Show wallet')
    .action(async () => {
        try {
            const wallet = await keymaster.loadWallet();
            console.log(JSON.stringify(wallet, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('backup-wallet-file <file>')
    .description('Backup wallet to file')
    .action(async (file) => {
        try {
            const wallet = await keymaster.exportEncryptedWallet();
            fs.writeFileSync(file, JSON.stringify(wallet, null, 4));
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('restore-wallet-file <file>')
    .description('Restore wallet from backup file')
    .action(async (file) => {
        try {
            const contents = fs.readFileSync(file).toString();
            const wallet = JSON.parse(contents);
            const ok = await keymaster.saveWallet(wallet, true);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('show-mnemonic')
    .description('Show recovery phrase for wallet')
    .action(async () => {
        try {
            const mnenomic = await keymaster.decryptMnemonic();
            console.log(mnenomic);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('change-passphrase <new-passphrase>')
    .description('Re-encrypt wallet with a new passphrase')
    .action(async (newPassphrase) => {
        try {
            const ok = await keymaster.changePassphrase(newPassphrase);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('backup-wallet-did')
    .description('Backup wallet to encrypted DID and seed bank')
    .action(async () => {
        try {
            const did = await keymaster.backupWallet();
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('recover-wallet-did [did]')
    .description('Recover wallet from seed bank or encrypted DID')
    .action(async (did) => {
        try {
            const wallet = await keymaster.recoverWallet(did);
            console.log(JSON.stringify(wallet, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-id <name>')
    .description('Create a new decentralized ID')
    // eslint-disable-next-line
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (name, options) => {
        try {
            const { registry } = options;
            const did = await keymaster.createId(name, { registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('resolve-id')
    .description('Resolves the current ID')
    .action(async () => {
        try {
            const current = await keymaster.getCurrentId();
            const doc = await keymaster.resolveDID(current);
            console.log(JSON.stringify(doc, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('backup-id')
    .description('Backup the current ID to its registry')
    .action(async () => {
        try {
            const ok = await keymaster.backupId();
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('recover-id <did>')
    .description('Recovers the ID from the DID')
    .action(async (did) => {
        try {
            const response = await keymaster.recoverId(did);
            console.log(response);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('remove-id <name>')
    .description('Deletes named ID')
    .action(async (name) => {
        try {
            await keymaster.removeId(name);
            console.log(`ID ${name} removed`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('rename-id <oldName> <newName>')
    .description('Renames the ID')
    .action(async (oldName, newName) => {
        try {
            const ok = await keymaster.renameId(oldName, newName);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-ids')
    .description('List IDs and show current ID')
    .action(async () => {
        try {
            const current = await keymaster.getCurrentId();
            const ids = await keymaster.listIds();

            for (let id of ids) {
                if (id === current) {
                    console.log(id, ' <<< current');
                }
                else {
                    console.log(id);
                }
            }
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-registries')
    .description('List supported registries')
    .action(async () => {
        try {
            const registries = await keymaster.listRegistries();

            for (const registry of registries) {
                console.log(registry);
            }
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('use-id <name>')
    .description('Set the current ID')
    .action(async (name) => {
        try {
            await keymaster.setCurrentId(name);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('rotate-keys')
    .description('Generates new set of keys for current ID')
    .action(async () => {
        try {
            const ok = await keymaster.rotateKeys();
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('publish-assertion-key')
    .description('Publish an Ed25519 assertion key (Multikey) so credentials this identity issues carry a proof other DID methods can verify')
    .option('-n, --name <name>', 'identity name (defaults to current)')
    .action(async (options) => {
        try {
            const ok = await keymaster.publishAssertionKey(options.name);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('unpublish-assertion-key')
    .description('Remove the Ed25519 assertion key from the current identity')
    .option('-n, --name <name>', 'identity name (defaults to current)')
    .action(async (options) => {
        try {
            const ok = await keymaster.unpublishAssertionKey(options.name);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('check-did <did>')
    .description('Inspect known DID document problems without changing it')
    .action(async (did) => {
        try {
            console.log(JSON.stringify(await keymaster.checkDID(did), null, 4));
        } catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('repair-did <did>')
    .description('Apply supported repairs to a DID document')
    .action(async (did) => {
        try {
            console.log(JSON.stringify(await keymaster.repairDID(did), null, 4));
        } catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('resolve-did <did> [confirm]')
    .description('Return document associated with DID')
    .action(async (did, confirm) => {
        try {
            const doc = await keymaster.resolveDID(did, { confirm: !!confirm });
            console.log(JSON.stringify(doc, null, 4));
        }
        catch (error) {
            fail(`cannot resolve ${did}`);
        }
    });

program
    .command('resolve-did-version <did> <version>')
    .description('Return specified version of document associated with DID')
    .action(async (did, version) => {
        try {
            const doc = await keymaster.resolveDID(did, { versionSequence: version });
            console.log(JSON.stringify(doc, null, 4));
        }
        catch (error) {
            fail(`cannot resolve ${did}`);
        }
    });

program
    .command('change-registry <did> <registry>')
    .description('Changes the registry for an existing DID')
    .action(async (did, registry) => {
        try {
            const ok = await keymaster.changeRegistry(did, registry);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('revoke-did <did>')
    .description('Permanently revoke a DID')
    .action(async (did, confirm) => {
        try {
            const ok = await keymaster.revokeDID(did);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(`cannot revoke ${did}`);
        }
    });

program
    .command('encrypt-message <message> <did>')
    .description('Encrypt a message for a DID')
    .action(async (msg, did) => {
        try {
            const cipherDid = await keymaster.encryptMessage(msg, did);
            console.log(cipherDid);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('encrypt-file <file> <did>')
    .description('Encrypt a file for a DID')
    .action(async (file, did) => {
        try {
            const contents = fs.readFileSync(file).toString();
            const cipherDid = await keymaster.encryptMessage(contents, did);
            console.log(cipherDid);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('decrypt-did <did>')
    .description('Decrypt an encrypted message DID')
    .action(async (did) => {
        try {
            const plaintext = await keymaster.decryptMessage(did);
            console.log(plaintext);
        }
        catch (error) {
            fail(`cannot decrypt ${did}`);
        }
    });

program
    .command('decrypt-json <did>')
    .description('Decrypt an encrypted JSON DID')
    .action(async (did) => {
        try {
            const json = await keymaster.decryptJSON(did);
            console.log(JSON.stringify(json, null, 4));
        }
        catch (error) {
            fail(`cannot decrypt ${did}`);
        }
    });

program
    .command('sign-file <file>')
    .description('Sign a JSON file')
    .action(async (file) => {
        try {
            const contents = fs.readFileSync(file).toString();
            const json = await keymaster.addProof(JSON.parse(contents));
            console.log(JSON.stringify(json, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('verify-file <file>')
    .description('Verify the proof in a JSON file')
    .action(async (file) => {
        try {
            const json = JSON.parse(fs.readFileSync(file).toString());
            const isValid = await keymaster.verifyProof(json);
            console.log(`proof in ${file}`, isValid ? 'is valid' : 'is NOT valid');
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-challenge [file]')
    .description('Create a challenge (optionally from a file)')
    // eslint-disable-next-line
    .option('-a, --alias <alias>', 'DID alias')
    .action(async (file, options) => {
        try {
            const { alias } = options;
            const challenge = file ? JSON.parse(fs.readFileSync(file).toString()) : undefined;
            const did = await keymaster.createChallenge(challenge, { alias });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-challenge-cc <did>')
    .description('Create a challenge from a credential DID')
    .option('-a, --alias <alias>', 'DID alias')
    .action(async (credentialDID, options) => {
        try {
            const { alias } = options;
            const challenge = { credentials: [{ schema: credentialDID }] };
            const did = await keymaster.createChallenge(challenge, { alias });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('bind-credential <schema> <subject>')
    .description('Create bound credential for a user')
    .action(async (schema, subject) => {
        try {
            const vc = await keymaster.bindCredential(subject, { schema });
            console.log(JSON.stringify(vc, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('issue-credential <file>')
    .description('Sign and encrypt a bound credential file')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const vc = JSON.parse(fs.readFileSync(file).toString());
            const did = await keymaster.issueCredential(vc, { registry, alias });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-issued')
    .description('List issued credentials')
    .action(async () => {
        try {
            const response = await keymaster.listIssued();
            console.log(JSON.stringify(response, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('revoke-credential <did>')
    .description('Revokes a verifiable credential')
    .action(async (did) => {
        try {
            const ok = await keymaster.revokeCredential(did);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('accept-credential <did>')
    .description('Save verifiable credential for current ID')
    .option('-a, --alias <alias>', 'DID alias')
    .action(async (did, options) => {
        const { alias } = options;
        try {
            const ok = await keymaster.acceptCredential(did);

            if (ok) {
                console.log(UPDATE_OK);

                if (alias) {
                    await keymaster.addAlias(alias, did);
                }
            }
            else {
                console.log(UPDATE_FAILED);
            }
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-credentials')
    .description('List credentials by current ID')
    .action(async () => {
        try {
            const held = await keymaster.listCredentials();
            console.log(JSON.stringify(held, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-credential <did>')
    .description('Get credential by DID')
    .action(async (did) => {
        try {
            const credential = await keymaster.getCredential(did);
            console.log(JSON.stringify(credential, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('view-credential <did>')
    .description('Decrypt and display a credential in human-readable format')
    .action(async (did) => {
        try {
            const credential = await keymaster.getCredential(did);

            if (!credential) {
                fail('Credential not found');
                return;
            }

            console.log(`Credential: ${did}`);
            console.log(`Type:       ${credential.type.join(', ')}`);
            console.log(`Issuer:     ${credential.issuer}`);
            console.log(`Subject:    ${credential.credentialSubject?.id}`);
            console.log(`Valid from: ${credential.validFrom}`);

            if (credential.validUntil) {
                console.log(`Valid until: ${credential.validUntil}`);
            }

            if (credential.credentialSchema) {
                console.log(`Schema:     ${credential.credentialSchema.id}`);
            }

            const { id, ...claims } = credential.credentialSubject || {};
            if (Object.keys(claims).length) {
                console.log(`Claims:     ${JSON.stringify(claims, null, 4)}`);
            }

            const isValid = await keymaster.verifyProof(credential);
            console.log(`Proof:      ${isValid ? 'valid' : 'INVALID'}`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('publish-credential <did>')
    .description('Publish the existence of a credential to the current user manifest')
    .action(async (did) => {
        try {
            const response = await keymaster.publishCredential(did, { reveal: false });
            console.log(JSON.stringify(response, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('reveal-credential <did>')
    .description('Reveal a credential to the current user manifest')
    .action(async (did) => {
        try {
            const response = await keymaster.publishCredential(did, { reveal: true });
            console.log(JSON.stringify(response, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('unpublish-credential <did>')
    .description('Remove a credential from the current user manifest')
    .action(async (did) => {
        try {
            const response = await keymaster.unpublishCredential(did);
            console.log(response);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-response <challenge>')
    .description('Create a response to a challenge')
    .action(async (challenge) => {
        try {
            const did = await keymaster.createResponse(challenge);
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('verify-response <response>')
    .description('Decrypt and validate a response to a challenge')
    .action(async (response) => {
        try {
            const vp = await keymaster.verifyResponse(response);
            console.log(JSON.stringify(vp, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('add-alias <alias> <did>')
    .description('Add an alias for a DID')
    .action(async (alias, did) => {
        try {
            await keymaster.addAlias(alias, did);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-alias <alias>')
    .description('Get DID assigned to alias')
    .action(async (alias) => {
        try {
            const did = await keymaster.getAlias(alias);
            console.log(did || `${alias} not found`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('remove-alias <alias>')
    .description('Removes an alias for a DID')
    .action(async (alias) => {
        try {
            await keymaster.removeAlias(alias);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('add-nostr [id]')
    .description('Derive and add nostr keys to an agent DID')
    .action(async (id) => {
        try {
            const nostr = await keymaster.addNostr(id);
            console.log(JSON.stringify(nostr, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('remove-nostr [id]')
    .description('Remove nostr keys from an agent DID')
    .action(async (id) => {
        try {
            await keymaster.removeNostr(id);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-aliases')
    .description('List DID aliases')
    .action(async () => {
        try {
            const aliases = await keymaster.listAliases();

            if (aliases) {
                console.log(JSON.stringify(aliases, null, 4));
            }
            else {
                console.log("No aliases defined");
            }
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-group <groupName>')
    .description('Create a new group')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (groupName, options) => {
        try {
            const { alias, registry } = options;
            const did = await keymaster.createGroup(groupName, { alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-groups')
    .description('List groups owned by current ID')
    .action(async () => {
        try {
            const groups = await keymaster.listGroups();
            console.log(JSON.stringify(groups, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-group <did>')
    .description('Get group by DID')
    .action(async (did) => {
        try {
            const group = await keymaster.getGroup(did);
            console.log(JSON.stringify(group, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('add-group-member <group> <member>')
    .description('Add a member to a group')
    .action(async (group, member) => {
        try {
            const response = await keymaster.addGroupMember(group, member);
            console.log(response);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('remove-group-member <group> <member>')
    .description('Remove a member from a group')
    .action(async (group, member) => {
        try {
            const response = await keymaster.removeGroupMember(group, member);
            console.log(response);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('test-group <group> [member]')
    .description('Determine if a member is in a group')
    .action(async (group, member) => {
        try {
            const response = await keymaster.testGroup(group, member);
            console.log(response);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-schema <file>')
    .description('Create a schema from a file')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const schema = JSON.parse(fs.readFileSync(file).toString());
            const did = await keymaster.createSchema(schema, { alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-schemas')
    .description('List schemas owned by current ID')
    .action(async () => {
        try {
            const schemas = await keymaster.listSchemas();
            console.log(JSON.stringify(schemas, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });


program
    .command('get-schema <did>')
    .description('Get schema by DID')
    .action(async (did) => {
        try {
            const schema = await keymaster.getSchema(did);
            console.log(JSON.stringify(schema, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-schema-template <schema>')
    .description('Create a template from a schema')
    .action(async (schema) => {
        try {
            const template = await keymaster.createTemplate(schema);
            console.log(JSON.stringify(template, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-asset')
    .description('Create an empty asset')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (options) => {
        try {
            const { alias, registry } = options;
            const did = await keymaster.createAsset({}, { alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-asset-json <file>')
    .description('Create an asset from a JSON file')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const data = JSON.parse(fs.readFileSync(file).toString());
            const did = await keymaster.createAsset(data, { alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-asset-image <file>')
    .description('Create an asset from an image file')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const data = fs.readFileSync(file);
            const filename = path.basename(file);
            const did = await keymaster.createImage(data, { filename, alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-asset-file <file>')
    .description('Create an asset from a file')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const data = fs.readFileSync(file);
            const filename = file.split('/').pop();
            const did = await keymaster.createFile(data, { filename, alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-asset <id>')
    .description('Get asset by name or DID')
    .action(async (id) => {
        try {
            const asset = await keymaster.resolveAsset(id);
            console.log(JSON.stringify(asset, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-asset-json <id> <file>')
    .description('Save a JSON asset to a file')
    .action(async (id, file) => {
        try {
            const asset = await keymaster.resolveAsset(id);
            fs.writeFileSync(file, JSON.stringify(asset, null, 4));
            console.log(`Data written to ${file}`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-asset-image <id> [file]')
    .description('Save an image asset to a file')
    .action(async (id, file) => {
        try {
            const imageAsset = await keymaster.getImage(id);
            if (!imageAsset || !imageAsset.file.data) {
                fail('Image not found');
                return;
            }
            const outputFile = file || imageAsset.file.filename;
            fs.writeFileSync(outputFile, imageAsset.file.data);
            console.log(`Data written to ${outputFile}`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-asset-file <id> [file]')
    .description('Save a file asset to a file')
    .action(async (id, file) => {
        try {
            const fileAsset = await keymaster.getFile(id);
            if (!fileAsset || !fileAsset.data) {
                fail('File not found');
                return;
            }
            const outputFile = file || fileAsset.filename;
            fs.writeFileSync(outputFile, fileAsset.data);
            console.log(`Data written to ${outputFile}`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('update-asset-json <id> <file>')
    .description('Update an asset from a JSON file')
    .action(async (id, file) => {
        try {
            const data = JSON.parse(fs.readFileSync(file).toString());
            const ok = await keymaster.mergeData(id, data);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('update-asset-image <id> <file>')
    .description('Update an asset from an image file')
    .action(async (id, file) => {
        try {
            const data = fs.readFileSync(file);
            const filename = path.basename(file);
            const ok = await keymaster.updateImage(id, data, { filename });
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('update-asset-file <id> <file>')
    .description('Update an asset from a file')
    .action(async (id, file) => {
        try {
            const data = fs.readFileSync(file);
            const filename = file.split('/').pop();
            const ok = await keymaster.updateFile(id, data, { filename });
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('transfer-asset <id> <controller>')
    .description('Transfer asset to a new controller')
    .action(async (id, controller) => {
        try {
            const ok = await keymaster.transferAsset(id, controller);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        } catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('clone-asset <id>')
    .description('Clone an asset')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (id, options) => {
        try {
            const { alias, registry } = options;
            const did = await keymaster.cloneAsset(id, { alias, registry });
            console.log(did);
        } catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-property <id> <key>')
    .description('Get a property value from a DID')
    .action(async (id, key) => {
        try {
            const doc = await keymaster.resolveDID(id);
            const data = doc.didDocumentData || {};
            const value = data[key];

            if (value !== undefined) {
                console.log(JSON.stringify(value, null, 4));
            }
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('set-property <id> <key> [value]')
    .description('Assign a key-value pair to a DID')
    .action(async (id, key, value) => {
        try {
            let parsed = null;

            if (value) {
                try {
                    parsed = JSON.parse(value);
                }
                catch {
                    parsed = value;
                }
            }

            const ok = await keymaster.mergeData(id, { [key]: parsed });
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-assets')
    .description('List assets owned by current ID')
    .action(async () => {
        try {
            const assets = await keymaster.listAssets();
            console.log(JSON.stringify(assets, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-poll-template')
    .description('Create a poll template')
    .action(async () => {
        try {
            const template = await keymaster.pollTemplate();
            console.log(JSON.stringify(template, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-poll <file>')
    .description('Create a poll')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const poll = JSON.parse(fs.readFileSync(file).toString());
            const did = await keymaster.createPoll(poll, { alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('view-poll <poll>')
    .description('View poll details')
    .action(async (poll) => {
        try {
            const response = await keymaster.viewPoll(poll);
            console.log(JSON.stringify(response, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('vote-poll <poll> <vote>')
    .description('Vote in a poll (0 to spoil)')
    .action(async (poll, vote) => {
        try {
            const did = await keymaster.votePoll(poll, parseInt(vote));
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('update-poll <ballot>')
    .description('Add a ballot to the poll')
    .action(async (ballot) => {
        try {
            const ok = await keymaster.updatePoll(ballot);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('publish-poll <poll>')
    .description('Publish results to poll, hiding ballots')
    .action(async (poll) => {
        try {
            const ok = await keymaster.publishPoll(poll);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('reveal-poll <poll>')
    .description('Publish results to poll, revealing ballots')
    .action(async (poll) => {
        try {
            const ok = await keymaster.publishPoll(poll, { reveal: true });
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('unpublish-poll <poll>')
    .description('Remove results from poll')
    .action(async (poll) => {
        try {
            const ok = await keymaster.unpublishPoll(poll);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('perf-test [N]')
    .description('Performance test to create N credentials')
    .action(async (N = 100) => {
        try {
            const currentID = await keymaster.getCurrentId();
            const expires = new Date();
            expires.setMinutes(expires.getMinutes() + 1);
            const testOptions = { registry: 'local', validUntil: expires.toISOString() };

            console.time('createSchema');
            const schemaDID = await keymaster.createSchema(undefined, testOptions);
            console.timeEnd('createSchema');
            console.log(`schemaDID: ${schemaDID}`);

            console.time('total');
            for (let i = 0; i < N; i++) {
                console.log(`credential ${i + 1}/${N}`);

                console.time('bindCredential');
                const credential = await keymaster.bindCredential(currentID, { schema: schemaDID });
                console.timeEnd('bindCredential');

                console.time('issueCredential');
                const credentialDID = await keymaster.issueCredential(credential, testOptions);
                console.timeEnd('issueCredential');

                console.time('decryptJSON');
                await keymaster.decryptJSON(credentialDID);
                console.timeEnd('decryptJSON');
            }
            console.timeEnd('total');
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('create-vault')
    .description('Create a vault')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .option('-s, --secretMembers', 'keep member list secret from each other')
    .action(async (options) => {
        try {
            const did = await keymaster.createVault(options);
            console.log(did);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-vault-items <id>')
    .description('List items in the vault')
    .action(async (id) => {
        try {
            const items = await keymaster.listVaultItems(id);
            console.log(JSON.stringify(items, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('add-vault-member <id> <member>')
    .description('Add a member to a vault')
    .action(async (id, member) => {
        try {
            const ok = await keymaster.addVaultMember(id, member);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('remove-vault-member <id> <member>')
    .description('Remove a member from a vault')
    .action(async (id, member) => {
        try {
            const ok = await keymaster.removeVaultMember(id, member);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('list-vault-members <id>')
    .description('List members of a vault')
    .action(async (id) => {
        try {
            const members = await keymaster.listVaultMembers(id);
            console.log(JSON.stringify(members, null, 4));
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('add-vault-item <id> <file>')
    .description('Add an item (file) to a vault')
    .action(async (id, file) => {
        try {
            const data = fs.readFileSync(file);
            const name = file.split('/').pop();
            const ok = await keymaster.addVaultItem(id, name, data);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('remove-vault-item <id> <item>')
    .description('Remove an item from a vault')
    .action(async (id, item) => {
        try {
            const ok = await keymaster.removeVaultItem(id, item);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

program
    .command('get-vault-item <id> <item> <file>')
    .description('Save an item from a vault to a file')
    .action(async (id, item, file) => {
        try {
            const data = await keymaster.getVaultItem(id, item);
            fs.writeFileSync(file, data);
            console.log(`Data written to ${file}`);
        }
        catch (error) {
            fail(error.error || error);
        }
    });

// DIDComm v2 commands
program
    .command('publish-didcomm [endpoint]')
    .description('Publish an X25519 key-agreement key (+ DIDCommMessaging service; endpoint auto-discovered from the gateway when omitted) to the current identity')
    .option('-n, --name <name>', 'identity name (defaults to current)')
    .option('--routing-keys <keys>', 'comma-separated mediator routing keys/DIDs')
    .action(async (endpoint, options) => {
        try {
            const routingKeys = options.routingKeys ? options.routingKeys.split(',').map(s => s.trim()) : undefined;
            const ok = await keymaster.publishDidComm(endpoint, options.name, routingKeys);
            console.log(ok ? 'published' : 'failed');
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('unpublish-didcomm')
    .description('Remove the DIDComm key-agreement key and service from the current identity')
    .option('-n, --name <name>', 'identity name (defaults to current)')
    .action(async (options) => {
        try {
            const ok = await keymaster.unpublishDidComm(options.name);
            console.log(ok ? 'unpublished' : 'failed');
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('pack-didcomm <file> <to>')
    .description('Pack a DIDComm v2 message (JSON file) for one or more recipients (comma-separated DIDs)')
    .option('--sign', 'add an ES256K signature (non-repudiation)')
    .option('--anoncrypt', 'anonymous sender (anoncrypt instead of authcrypt)')
    .option('-e, --encryption <alg>', 'content encryption: A256CBC-HS512 | XC20P | A256GCM')
    .option('-n, --name <name>', 'sender identity name (defaults to current)')
    .action(async (file, to, options) => {
        try {
            const message = JSON.parse(fs.readFileSync(file).toString());
            const recipients = to.includes(',') ? to.split(',').map(s => s.trim()) : to;
            const packed = await keymaster.packDidComm(message, recipients, {
                sign: options.sign,
                anoncrypt: options.anoncrypt,
                encryption: options.encryption,
                name: options.name,
            });
            console.log(packed);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('unpack-didcomm <file>')
    .description('Unpack (decrypt and verify) a DIDComm v2 message read from a file')
    .option('-n, --name <name>', 'recipient identity name (defaults to current)')
    .action(async (file, options) => {
        try {
            const packed = fs.readFileSync(file).toString();
            const result = await keymaster.unpackDidComm(packed, { name: options.name });
            console.log(JSON.stringify(result, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('send-didcomm <file> <to>')
    .description('Pack a DIDComm message (JSON file) and deliver it to each recipient mailbox (comma-separated DIDs)')
    .option('--sign', 'add an ES256K signature (non-repudiation)')
    .option('--anoncrypt', 'anonymous sender (anoncrypt instead of authcrypt)')
    .option('-e, --encryption <alg>', 'content encryption: A256CBC-HS512 | XC20P | A256GCM')
    .option('-n, --name <name>', 'sender identity name (defaults to current)')
    .action(async (file, to, options) => {
        try {
            const message = JSON.parse(fs.readFileSync(file).toString());
            const recipients = to.includes(',') ? to.split(',').map(s => s.trim()) : to;
            const ids = await keymaster.sendDidComm(message, recipients, {
                sign: options.sign,
                anoncrypt: options.anoncrypt,
                encryption: options.encryption,
                name: options.name,
            });
            console.log(JSON.stringify(ids, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('send-credential-didcomm <did> <to>')
    .description('Deliver an issued credential over DIDComm (reaches subjects whose DID is not did:cid)')
    .option('--anoncrypt', 'anonymous sender (anoncrypt instead of authcrypt)')
    .option('-c, --comment <text>', 'comment to include with the credential')
    .option('-n, --name <name>', 'sender identity name (defaults to current)')
    .action(async (did, to, options) => {
        try {
            const recipients = to.includes(',') ? to.split(',').map(s => s.trim()) : to;
            const ids = await keymaster.sendCredentialDidComm(did, recipients, {
                anoncrypt: options.anoncrypt,
                comment: options.comment,
                name: options.name,
            });
            console.log(JSON.stringify(ids, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('accept-credential-didcomm <file>')
    .description('Accept a credential received over DIDComm (JSON file containing the unpacked message)')
    .action(async (file) => {
        try {
            const message = JSON.parse(fs.readFileSync(file).toString());
            const ok = await keymaster.acceptCredentialDidComm(message);
            console.log(JSON.stringify({ ok }, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('receive-didcomm')
    .description('Fetch and unpack queued DIDComm messages from the current identity mailbox')
    .option('-n, --name <name>', 'identity name (defaults to current)')
    .option('--endpoint <url>', 'override the mailbox endpoint')
    .option('--no-ack', 'leave messages in the mailbox (acknowledge later with ack-didcomm)')
    .action(async (options) => {
        try {
            const results = await keymaster.receiveDidComm({ name: options.name, endpoint: options.endpoint, ack: options.ack });
            console.log(JSON.stringify(results, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('ack-didcomm <ids...>')
    .description('Acknowledge (remove) DIDComm messages from the current identity mailbox by id')
    .option('-n, --name <name>', 'identity name (defaults to current)')
    .option('--endpoint <url>', 'override the mailbox endpoint')
    .action(async (ids, options) => {
        try {
            const acknowledged = await keymaster.ackDidComm(ids, { name: options.name, endpoint: options.endpoint });
            console.log(JSON.stringify({ acknowledged }, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

program
    .command('mediate-didcomm')
    .description('Relay queued Forward envelopes from this identity mailbox to their recipients (mediator role)')
    .option('-n, --name <name>', 'mediator identity name (defaults to current)')
    .option('--endpoint <url>', 'override the mailbox endpoint')
    .action(async (options) => {
        try {
            const result = await keymaster.mediateDidComm({ name: options.name, endpoint: options.endpoint });
            console.log(JSON.stringify(result, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('update-credential <did> <file>')
    .description('Update an issued credential')
    .action(async (did, file) => {
        try {
            const vc = JSON.parse(fs.readFileSync(file).toString());
            const ok = await keymaster.updateCredential(did, vc);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('list-addresses')
    .description('List wallet addresses')
    .action(async () => {
        try {
            const addresses = await keymaster.listAddresses();

            if (Object.keys(addresses).length) {
                console.log(JSON.stringify(addresses, null, 4));
            }
            else {
                console.log('No addresses defined');
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('get-address <domain>')
    .description('Get the current address for a domain')
    .action(async (domain) => {
        try {
            const address = await keymaster.getAddress(domain);

            if (address) {
                console.log(JSON.stringify(address, null, 4));
            }
            else {
                console.log(`${domain} not found`);
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('import-address <domain>')
    .description('Import any existing address for the current ID from a domain')
    .action(async (domain) => {
        try {
            const addresses = await keymaster.importAddress(domain);

            if (Object.keys(addresses).length) {
                console.log(JSON.stringify(addresses, null, 4));
            }
            else {
                console.log('No addresses imported');
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('check-address <address>')
    .description('Check whether an address is available')
    .action(async (address) => {
        try {
            const result = await keymaster.checkAddress(address);

            if (result.status === 'available') {
                console.log(`${result.address} is available`);
            }
            else if (result.status === 'claimed') {
                console.log(`${result.address} is claimed by ${result.did}`);
            }
            else if (result.status === 'unsupported') {
                console.log(`${result.address} domain does not appear to support names`);
            }
            else {
                console.log(`${result.address} domain is unreachable`);
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('add-address <address>')
    .description('Claim an address for the current ID')
    .action(async (address) => {
        try {
            await keymaster.addAddress(address);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('remove-address <address>')
    .description('Remove an address for the current ID')
    .action(async (address) => {
        try {
            await keymaster.removeAddress(address);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('publish-address [address] [id]')
    .description('Publish a stored address for a DID')
    .action(async (address, id) => {
        try {
            await keymaster.publishAddress(address, id);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('unpublish-address [id]')
    .description('Remove the published address from a DID')
    .action(async (id) => {
        try {
            await keymaster.unpublishAddress(id);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

// Nostr commands


program
    .command('import-nostr <nsec> [id]')
    .description('Import nostr keys for an agent DID from an nsec private key')
    .action(async (nsec, id) => {
        try {
            const nostr = await keymaster.importNostr(nsec, id);
            console.log(JSON.stringify(nostr, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('add-lightning [id]')
    .description('Create a Lightning wallet for a DID')
    .action(async (id) => {
        try {
            const config = await keymaster.addLightning(id);
            // adminKey spends: lightning-pay, lightning-zap and
            // lightning-payments pass it. invoiceKey cannot -- it creates
            // invoices and reads balance and payment status. addLightning has
            // already persisted both to the wallet, so the summary reports the
            // wallet id and leaves the credentials out of stdout.
            console.log(`Lightning wallet created (id ${config.walletId}).`);
            console.log('Keys are stored in your wallet. The admin key can spend from it.');
            console.log('Show them with: show-wallet');
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('remove-lightning [id]')
    .description('Remove Lightning wallet from a DID')
    .action(async (id) => {
        try {
            await keymaster.removeLightning(id);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-balance [id]')
    .description('Check Lightning wallet balance')
    .action(async (id) => {
        try {
            const balance = await keymaster.getLightningBalance(id);
            console.log(`${balance.balance} sats`);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-decode <bolt11>')
    .description('Decode a Lightning BOLT11 invoice')
    .action(async (bolt11) => {
        try {
            const info = await keymaster.decodeLightningInvoice(bolt11);
            console.log(JSON.stringify(info, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-invoice <amount> <memo> [id]')
    .description('Create a Lightning invoice to receive sats')
    .action(async (amount, memo, id) => {
        try {
            const invoice = await keymaster.createLightningInvoice(parseInt(amount), memo, id);
            console.log(JSON.stringify(invoice, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-pay <bolt11> [id]')
    .description('Pay a Lightning invoice')
    .action(async (bolt11, id) => {
        try {
            const payment = await keymaster.payLightningInvoice(bolt11, id);
            console.log(JSON.stringify(payment, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-check <paymentHash> [id]')
    .description('Check status of a Lightning payment')
    .action(async (paymentHash, id) => {
        try {
            const status = await keymaster.checkLightningPayment(paymentHash, id);
            console.log(JSON.stringify(status, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('publish-lightning [id]')
    .description('Publish Lightning service endpoint for a DID')
    .action(async (id) => {
        try {
            await keymaster.publishLightning(id);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('unpublish-lightning [id]')
    .description('Remove Lightning service endpoint from a DID')
    .action(async (id) => {
        try {
            await keymaster.unpublishLightning(id);
            console.log(UPDATE_OK);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-zap <recipient> <amount> [memo]')
    .description('Send sats via Lightning (DID, alias, or Lightning Address)')
    .action(async (recipient, amount, memo) => {
        try {
            const result = await keymaster.zapLightning(recipient, parseInt(amount), memo);
            let status = await keymaster.checkLightningPayment(result.paymentHash);

            for (let attempt = 1; attempt < LIGHTNING_ZAP_STATUS_CHECKS && !status.paid; attempt++) {
                await sleep(LIGHTNING_ZAP_STATUS_DELAY_MS);
                status = await keymaster.checkLightningPayment(result.paymentHash);
            }

            console.log(JSON.stringify({
                ...result,
                paid: status.paid,
                status: status.status,
                preimage: status.preimage,
            }, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('lightning-payments [id]')
    .description('Show Lightning payment history')
    .action(async (id) => {
        try {
            const payments = await keymaster.getLightningPayments(id);
            if (payments.length === 0) {
                console.log('No payments found.');
                return;
            }
            for (const p of payments) {
                const d = p.time ? new Date(p.time) : null;
                const date = d ? `${d.getFullYear()}/${String(d.getMonth() + 1).padStart(2, '0')}/${String(d.getDate()).padStart(2, '0')} ${String(d.getHours()).padStart(2, '0')}:${String(d.getMinutes()).padStart(2, '0')}:${String(d.getSeconds()).padStart(2, '0')}` : '—';
                const fee = p.fee > 0 ? ` (fee: ${p.fee})` : '';
                const memo = p.memo ? ` "${p.memo}"` : '';
                const status = p.pending ? ' [pending]' : '';
                console.log(`${date}  ${p.amount} sats${fee}${memo}${status}`);
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

// Group commands


program
    .command('add-poll-voter <poll> <member>')
    .description('Add a voter to the poll')
    .action(async (poll, member) => {
        try {
            const ok = await keymaster.addPollVoter(poll, member);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('remove-poll-voter <poll> <member>')
    .description('Remove a voter from the poll')
    .action(async (poll, member) => {
        try {
            const ok = await keymaster.removePollVoter(poll, member);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('list-poll-voters <poll>')
    .description('List eligible voters in the poll')
    .action(async (poll) => {
        try {
            const members = await keymaster.listPollVoters(poll);
            console.log(JSON.stringify(members, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('send-poll <poll>')
    .description('Send a poll notice to all voters')
    .action(async (poll) => {
        try {
            const did = await keymaster.sendPoll(poll);
            console.log(did);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('send-ballot <ballot> <poll>')
    .description('Send a ballot to the poll owner')
    .action(async (ballot, poll) => {
        try {
            const did = await keymaster.sendBallot(ballot, poll);
            console.log(did);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('view-ballot <ballot>')
    .description('View ballot details')
    .action(async (ballot) => {
        try {
            const result = await keymaster.viewBallot(ballot);
            console.log(JSON.stringify(result, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('create-dmail <file>')
    .description('Create a new dmail from a JSON file')
    .option('-a, --alias <alias>', 'DID alias')
    .option('-r, --registry <registry>', 'registry to use')
    .action(async (file, options) => {
        try {
            const { alias, registry } = options;
            const message = JSON.parse(fs.readFileSync(file).toString());
            const did = await keymaster.createDmail(message, { alias, registry });
            console.log(did);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('update-dmail <did> <file>')
    .description('Update an existing dmail from a JSON file')
    .action(async (did, file) => {
        try {
            const message = JSON.parse(fs.readFileSync(file).toString());
            const ok = await keymaster.updateDmail(did, message);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('send-dmail <did>')
    .description('Send a dmail and return the notice DID')
    .action(async (did) => {
        try {
            const notice = await keymaster.sendDmail(did);
            if (notice) {
                console.log(notice);
            } else {
                fail('Send failed');
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('get-dmail <did>')
    .description('Get a dmail message by DID')
    .action(async (did) => {
        try {
            const message = await keymaster.getDmailMessage(did);
            if (message) {
                console.log(JSON.stringify(message, null, 4));
            } else {
                fail('Dmail not found');
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('list-dmail')
    .description('List dmails for current ID')
    .action(async () => {
        try {
            const dmails = await keymaster.listDmail();
            console.log(JSON.stringify(dmails, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('file-dmail <did> <tags>')
    .description('Assign tags to a dmail (comma-separated, e.g. inbox,unread)')
    .action(async (did, tags) => {
        try {
            const tagList = tags.split(',').map((t) => t.trim());
            const ok = await keymaster.fileDmail(did, tagList);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('refresh-dmail')
    .description('Check for new dmails and clean up expired notices')
    .action(async () => {
        try {
            const ok = await keymaster.refreshNotices();
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('import-dmail <did>')
    .description('Import a dmail into inbox with unread tag')
    .action(async (did) => {
        try {
            const ok = await keymaster.importDmail(did);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('remove-dmail <did>')
    .description('Delete a dmail')
    .action(async (did) => {
        try {
            const ok = await keymaster.removeDmail(did);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('add-dmail-attachment <did> <file>')
    .description('Add a file attachment to a dmail')
    .action(async (did, file) => {
        try {
            const data = fs.readFileSync(file);
            const name = path.basename(file);
            const ok = await keymaster.addDmailAttachment(did, name, data);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('remove-dmail-attachment <did> <name>')
    .description('Remove an attachment from a dmail')
    .action(async (did, name) => {
        try {
            const ok = await keymaster.removeDmailAttachment(did, name);
            console.log(ok ? UPDATE_OK : UPDATE_FAILED);
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('get-dmail-attachment <did> <name> <file>')
    .description('Save a dmail attachment to a file')
    .action(async (did, name, file) => {
        try {
            const data = await keymaster.getDmailAttachment(did, name);
            if (data) {
                fs.writeFileSync(file, data);
                console.log(`Data written to ${file}`);
            } else {
                fail(`Attachment ${name} not found`);
            }
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });


program
    .command('list-dmail-attachments <did>')
    .description('List attachments of a dmail')
    .action(async (did) => {
        try {
            const attachments = await keymaster.listDmailAttachments(did);
            console.log(JSON.stringify(attachments, null, 4));
        }
        catch (error) {
            fail(error.error || error.message || error);
        }
    });

// DIDComm v2 commands

async function run() {
    const keymasterURL = process.env.ARCHON_KEYMASTER_URL || 'http://localhost:4226';
    const adminApiKey = process.env.ARCHON_ADMIN_API_KEY;

    keymaster = new KeymasterClient();
    await keymaster.connect({
        url: keymasterURL,
        apiKey: adminApiKey,
        waitUntilReady: true,
        intervalSeconds: 1,
        chatty: false,
        becomeChattyAfter: 2
    });
    program.parse(process.argv);
}

run();