@aauth/bootstrap - npm Package Compare versions

Comparing version 1.0.0 to 1.1.0

dist/teardown.d.ts

+import type { AgentConfig, AgentHosting } from '@aauth/local-keys';
+/** Directory under the config dir where uninstall snapshots are written. */
+export declare function backupsDir(): string;
+export interface BackupSummary {
+    file: string;
+    uninstalledAt?: string;
+    agentUrls: string[];
+}
+/**
+ * Available uninstall backups (newest last), so `list` can surface them and the
+ * setup skill can offer to reuse a prior identity's settings.
+ */
+export declare function listBackups(): BackupSummary[];
+export type HardwareRetained = {
+    kid: string;
+    keystore: string;
+    keyId: string;
+    hint: string;
+};
+export interface AgentPlan {
+    agentUrl: string;
+    keysToDelete: Array<{
+        kid: string;
+        backend: string;
+        keyId: string;
+    }>;
+    remoteFilesToRemove: string[];
+    hosting: AgentHosting | null;
+}
+/** Remote `.well-known` files an agent published, derived from config. */
+export declare function remoteFilesFor(cfg: AgentConfig): string[];
+/** What a teardown *would* touch for one agent — pure, deletes nothing. */
+export declare function planAgent(agentUrl: string, cfg: AgentConfig): AgentPlan;
+/**
+ * Delete one agent's keys across every backend (and optionally its config entry).
+ * Software keys live under the agent URL in the OS keychain (wiped in one shot);
+ * hardware keys go through each backend's `deleteKey`. A backend that can't wipe a
+ * key (e.g. YubiKey PIV) throws `KeyDeletionUnsupportedError` — recorded, not fatal.
+ * Never touches remote hosting — that's the skill's job.
+ */
+export declare function executeTeardown(agentUrl: string, cfg: AgentConfig, opts: {
+    removeConfig: boolean;
+}): Promise<{
+    keysDeleted: number;
+    hardwareKeysRetained: HardwareRetained[];
+}>;
+/**
+ * `delete <url>` — per-agent, immediate. Deletes the agent's keys and removes it
+ * from config, and reports the remote files still to remove. Returns null if the
+ * agent provider isn't configured.
+ */
+export declare function deleteAgent(agentUrl: string): Promise<Record<string, unknown> | null>;
+/**
+ * `uninstall` — return the machine to a clean, pre-bootstrap state. Dry-run by
+ * default: computes and returns the plan, deleting nothing. With `force`, it
+ * backs up the config first (so a later setup can reuse the agent URL, person
+ * server, and hosting), deletes every configured agent's keys, sweeps orphaned
+ * keychain entries, and removes the active `config.json` — keeping the config dir
+ * and its `backups/`. Reports the remote `.well-known` files still to remove — it
+ * never touches remote hosting.
+ */
+export declare function uninstall(opts: {
+    force: boolean;
+}): Promise<Record<string, unknown>>;
+//# sourceMappingURL=teardown.d.ts.map

dist/teardown.d.ts.map

+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../src/teardown.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAElE,4EAA4E;AAC5E,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAgBD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,SAAS,EAAE,MAAM,EAAE,CAAA;CACpB;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,aAAa,EAAE,CAiB7C;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAE7F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACpE,mBAAmB,EAAE,MAAM,EAAE,CAAA;IAC7B,OAAO,EAAE,YAAY,GAAG,IAAI,CAAA;CAC7B;AAED,0EAA0E;AAC1E,wBAAgB,cAAc,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,EAAE,CAKzD;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,SAAS,CAOvE;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,WAAW,EAChB,IAAI,EAAE;IAAE,YAAY,EAAE,OAAO,CAAA;CAAE,GAC9B,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,oBAAoB,EAAE,gBAAgB,EAAE,CAAA;CAAE,CAAC,CA2B5E;AAUD;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAW3F;AAED;;;;;;;;GAQG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsD1F"}

dist/teardown.js

+// Teardown logic shared by the `delete` (per-agent) and `uninstall` (full wipe)
+// commands. Kept separate from cli.ts so it can be unit-tested without the CLI's
+// import-time `run()`. Functions return the printable result object — they never
+// write to stdout — so tests can assert the exact JSON shape.
+import { mkdirSync, writeFileSync, readdirSync, readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { getAgentConfig, listAgentProviders, listAgentUrls, readKeychain, deleteKeychain, deleteAgentProvider, deleteConfigFile, getConfigDir, getBackend, KeyDeletionUnsupportedError, } from '@aauth/local-keys';
+/** Directory under the config dir where uninstall snapshots are written. */
+export function backupsDir() {
+    return join(getConfigDir(), 'backups');
+}
+/**
+ * Snapshot the agents being removed so a later setup can reuse their settings
+ * (agent URL, person server, hosting). Contains config only — NEVER private key
+ * material, which never lives in config. Returns the backup file path.
+ */
+function writeBackup(agents) {
+    const dir = backupsDir();
+    mkdirSync(dir, { recursive: true });
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const path = join(dir, `uninstall-${stamp}.json`);
+    writeFileSync(path, JSON.stringify({ uninstalledAt: new Date().toISOString(), agents }, null, 2) + '\n');
+    return path;
+}
+/**
+ * Available uninstall backups (newest last), so `list` can surface them and the
+ * setup skill can offer to reuse a prior identity's settings.
+ */
+export function listBackups() {
+    const dir = backupsDir();
+    if (!existsSync(dir))
+        return [];
+    let files;
+    try {
+        files = readdirSync(dir).filter((f) => f.endsWith('.json')).sort();
+    }
+    catch {
+        return [];
+    }
+    return files.map((file) => {
+        try {
+            const data = JSON.parse(readFileSync(join(dir, file), 'utf-8'));
+            return { file, uninstalledAt: data.uninstalledAt, agentUrls: Object.keys(data.agents ?? {}) };
+        }
+        catch {
+            return { file, agentUrls: [] };
+        }
+    });
+}
+/** Remote `.well-known` files an agent published, derived from config. */
+export function remoteFilesFor(cfg) {
+    const files = [];
+    if (cfg.jwksUri)
+        files.push(cfg.jwksUri);
+    if (cfg.agentServerUrl)
+        files.push(cfg.agentServerUrl);
+    return files;
+}
+/** What a teardown *would* touch for one agent — pure, deletes nothing. */
+export function planAgent(agentUrl, cfg) {
+    return {
+        agentUrl,
+        keysToDelete: Object.entries(cfg.keys).map(([kid, meta]) => ({ kid, backend: meta.backend, keyId: meta.keyId })),
+        remoteFilesToRemove: remoteFilesFor(cfg),
+        hosting: cfg.hosting ?? null,
+    };
+}
+/**
+ * Delete one agent's keys across every backend (and optionally its config entry).
+ * Software keys live under the agent URL in the OS keychain (wiped in one shot);
+ * hardware keys go through each backend's `deleteKey`. A backend that can't wipe a
+ * key (e.g. YubiKey PIV) throws `KeyDeletionUnsupportedError` — recorded, not fatal.
+ * Never touches remote hosting — that's the skill's job.
+ */
+export async function executeTeardown(agentUrl, cfg, opts) {
+    let keysDeleted = 0;
+    const hardwareKeysRetained = [];
+    if (readKeychain(agentUrl))
+        deleteKeychain(agentUrl);
+    for (const [kid, meta] of Object.entries(cfg.keys)) {
+        if (meta.backend === 'software') {
+            keysDeleted++;
+            continue;
+        }
+        const driver = getBackend(meta.backend);
+        try {
+            await driver.deleteKey?.(meta.keyId);
+            keysDeleted++;
+        }
+        catch (e) {
+            if (e instanceof KeyDeletionUnsupportedError) {
+                hardwareKeysRetained.push({ kid, keystore: meta.backend, keyId: meta.keyId, hint: e.hint });
+            }
+            else {
+                throw e;
+            }
+        }
+    }
+    if (opts.removeConfig)
+        deleteAgentProvider(agentUrl);
+    return { keysDeleted, hardwareKeysRetained };
+}
+/** Attach the remote-files footer (and hosting) to a result when there is one. */
+function withRemoteFooter(target, plan) {
+    if (plan.remoteFilesToRemove.length > 0) {
+        target.remoteFilesToRemove = plan.remoteFilesToRemove;
+        if (plan.hosting)
+            target.hosting = plan.hosting;
+    }
+}
+/**
+ * `delete <url>` — per-agent, immediate. Deletes the agent's keys and removes it
+ * from config, and reports the remote files still to remove. Returns null if the
+ * agent provider isn't configured.
+ */
+export async function deleteAgent(agentUrl) {
+    const cfg = getAgentConfig(agentUrl);
+    if (!cfg)
+        return null;
+    const plan = planAgent(agentUrl, cfg);
+    const { keysDeleted, hardwareKeysRetained } = await executeTeardown(agentUrl, cfg, { removeConfig: true });
+    const result = { deleted: agentUrl, keysDeleted };
+    if (hardwareKeysRetained.length > 0)
+        result.hardwareKeysRetained = hardwareKeysRetained;
+    withRemoteFooter(result, plan);
+    return result;
+}
+/**
+ * `uninstall` — return the machine to a clean, pre-bootstrap state. Dry-run by
+ * default: computes and returns the plan, deleting nothing. With `force`, it
+ * backs up the config first (so a later setup can reuse the agent URL, person
+ * server, and hosting), deletes every configured agent's keys, sweeps orphaned
+ * keychain entries, and removes the active `config.json` — keeping the config dir
+ * and its `backups/`. Reports the remote `.well-known` files still to remove — it
+ * never touches remote hosting.
+ */
+export async function uninstall(opts) {
+    const agentUrls = listAgentProviders();
+    const plans = [];
+    const configs = {};
+    for (const url of agentUrls) {
+        const cfg = getAgentConfig(url);
+        if (cfg) {
+            plans.push(planAgent(url, cfg));
+            configs[url] = cfg;
+        }
+    }
+    // Software keys in the keychain whose agent URL isn't in config — orphans to sweep.
+    const orphanedKeychainUrls = listAgentUrls().filter((u) => !agentUrls.includes(u));
+    if (plans.length === 0 && orphanedKeychainUrls.length === 0) {
+        return { alreadyClean: true, configDir: getConfigDir() };
+    }
+    if (!opts.force) {
+        return {
+            dryRun: true,
+            scope: 'all',
+            agents: plans,
+            orphanedKeychainUrls,
+            willBackUpConfig: Object.keys(configs).length > 0,
+            hint: 'Nothing was deleted. Re-run with --force to delete the keys — the config is backed up first so setup can reuse it later.',
+        };
+    }
+    const agents = [];
+    for (const url of agentUrls) {
+        const cfg = configs[url];
+        if (!cfg)
+            continue;
+        const plan = planAgent(url, cfg);
+        // removeConfig:false — config.json is removed in one shot below (deleteConfigFile).
+        const { keysDeleted, hardwareKeysRetained } = await executeTeardown(url, cfg, { removeConfig: false });
+        const entry = { agentUrl: url, keysDeleted };
+        if (hardwareKeysRetained.length > 0)
+            entry.hardwareKeysRetained = hardwareKeysRetained;
+        withRemoteFooter(entry, plan);
+        agents.push(entry);
+    }
+    for (const url of orphanedKeychainUrls)
+        deleteKeychain(url);
+    const result = {
+        uninstalled: true,
+        agents,
+        orphanedKeychainUrlsSwept: orphanedKeychainUrls,
+    };
+    // Back up before removing config so a later setup can reuse it; keep the dir.
+    if (Object.keys(configs).length > 0)
+        result.backupPath = writeBackup(configs);
+    deleteConfigFile();
+    result.configDir = getConfigDir();
+    result.note = 'Config backed up. The setup skill can reuse it (agent URL, person server, hosting) next time — you generate fresh keys.';
+    return result;
+}
+//# sourceMappingURL=teardown.js.map

dist/teardown.js.map

+{"version":3,"file":"teardown.js","sourceRoot":"","sources":["../src/teardown.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,iFAAiF;AACjF,iFAAiF;AACjF,8DAA8D;AAE9D,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,aAAa,EACb,YAAY,EACZ,cAAc,EACd,mBAAmB,EACnB,gBAAgB,EAChB,YAAY,EACZ,UAAU,EACV,2BAA2B,GAC5B,MAAM,mBAAmB,CAAA;AAG1B,4EAA4E;AAC5E,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,YAAY,EAAE,EAAE,SAAS,CAAC,CAAA;AACxC,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,MAAmC;IACtD,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;IACxB,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACnC,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,KAAK,OAAO,CAAC,CAAA;IACjD,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;IACxG,OAAO,IAAI,CAAA;AACb,CAAC;AAQD;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;IACxB,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAC/B,IAAI,KAAe,CAAA;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACxB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAiE,CAAA;YAC/H,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAA;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAA;QAChC,CAAC;IACH,CAAC,CAAC,CAAA;AACJ,CAAC;AAWD,0EAA0E;AAC1E,MAAM,UAAU,cAAc,CAAC,GAAgB;IAC7C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,GAAG,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxC,IAAI,GAAG,CAAC,cAAc;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IACtD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,QAAgB,EAAE,GAAgB;IAC1D,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAChH,mBAAmB,EAAE,cAAc,CAAC,GAAG,CAAC;QACxC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;KAC7B,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,GAAgB,EAChB,IAA+B;IAE/B,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,MAAM,oBAAoB,GAAuB,EAAE,CAAA;IAEnD,IAAI,YAAY,CAAC,QAAQ,CAAC;QAAE,cAAc,CAAC,QAAQ,CAAC,CAAA;IAEpD,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAChC,WAAW,EAAE,CAAA;YACb,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpC,WAAW,EAAE,CAAA;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,2BAA2B,EAAE,CAAC;gBAC7C,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7F,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,YAAY;QAAE,mBAAmB,CAAC,QAAQ,CAAC,CAAA;IAEpD,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAA;AAC9C,CAAC;AAED,kFAAkF;AAClF,SAAS,gBAAgB,CAAC,MAA+B,EAAE,IAAe;IACxE,IAAI,IAAI,CAAC,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,CAAA;QACrD,IAAI,IAAI,CAAC,OAAO;YAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;IACjD,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,QAAgB;IAChD,MAAM,GAAG,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IAErB,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;IACrC,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IAE1G,MAAM,MAAM,GAA4B,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAA;IAC1E,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;IACvF,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAwB;IACtD,MAAM,SAAS,GAAG,kBAAkB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAgB,EAAE,CAAA;IAC7B,MAAM,OAAO,GAAgC,EAAE,CAAA;IAC/C,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,GAAG,EAAE,CAAC;YACR,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAA;YAC/B,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QACpB,CAAC;IACH,CAAC;IACD,oFAAoF;IACpF,MAAM,oBAAoB,GAAG,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IAElF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,EAAE,CAAA;IAC1D,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,KAAK;YACb,oBAAoB;YACpB,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;YACjD,IAAI,EAAE,0HAA0H;SACjI,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAmC,EAAE,CAAA;IACjD,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;QACxB,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;QAChC,oFAAoF;QACpF,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;QACtG,MAAM,KAAK,GAA4B,EAAE,QAAQ,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;QACrE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;QACtF,gBAAgB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAA;QAC7B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACpB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,oBAAoB;QAAE,cAAc,CAAC,GAAG,CAAC,CAAA;IAE3D,MAAM,MAAM,GAA4B;QACtC,WAAW,EAAE,IAAI;QACjB,MAAM;QACN,yBAAyB,EAAE,oBAAoB;KAChD,CAAA;IACD,8EAA8E;IAC9E,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,UAAU,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;IAC7E,gBAAgB,EAAE,CAAA;IAClB,MAAM,CAAC,SAAS,GAAG,YAAY,EAAE,CAAA;IACjC,MAAM,CAAC,IAAI,GAAG,yHAAyH,CAAA;IACvI,OAAO,MAAM,CAAA;AACf,CAAC"}

dist/teardown.test.d.ts

+export {};
+//# sourceMappingURL=teardown.test.d.ts.map

dist/teardown.test.d.ts.map

+{"version":3,"file":"teardown.test.d.ts","sourceRoot":"","sources":["../src/teardown.test.ts"],"names":[],"mappings":""}

dist/teardown.test.js

+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { mkdtempSync, rmSync, existsSync, readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+// Fully mock local-keys so teardown logic is exercised without touching the real
+// OS keychain or ~/.aauth. getConfigDir is pointed at a per-test temp dir, so the
+// real backup file I/O in teardown.ts (writeBackup / listBackups) runs in
+// isolation. The mocked KeyDeletionUnsupportedError is the same class reference
+// teardown.ts imports, so its `instanceof` check still works.
+vi.mock('@aauth/local-keys', () => {
+    class KeyDeletionUnsupportedError extends Error {
+        hint;
+        constructor(hint) {
+            super(hint);
+            this.hint = hint;
+            this.name = 'KeyDeletionUnsupportedError';
+        }
+    }
+    return {
+        getAgentConfig: vi.fn(),
+        listAgentProviders: vi.fn(() => []),
+        listAgentUrls: vi.fn(() => []),
+        readKeychain: vi.fn(() => null),
+        deleteKeychain: vi.fn(),
+        deleteAgentProvider: vi.fn(),
+        deleteConfigFile: vi.fn(),
+        getConfigDir: vi.fn(() => '/tmp/test-aauth'),
+        getBackend: vi.fn(),
+        KeyDeletionUnsupportedError,
+    };
+});
+import * as lk from '@aauth/local-keys';
+import { planAgent, executeTeardown, deleteAgent, uninstall, listBackups } from './teardown.js';
+const mocked = vi.mocked(lk);
+const softwareAgent = (url) => ({
+    agentId: `aauth:local@${url.replace('https://', '')}`,
+    personServerUrl: 'https://person.hello.coop',
+    agentServerUrl: `${url}/.well-known/aauth-agent.json`,
+    jwksUri: `${url}/.well-known/jwks.json`,
+    hosting: { platform: 'github-pages', repo: 'me/me.github.io' },
+    keys: { '2026-05-22_ab': { backend: 'software', algorithm: 'EdDSA', keyId: url, deviceLabel: 'mac' } },
+});
+let dir;
+beforeEach(() => {
+    vi.clearAllMocks();
+    dir = mkdtempSync(join(tmpdir(), 'aauth-teardown-'));
+    mocked.getConfigDir.mockReturnValue(dir);
+    mocked.listAgentProviders.mockReturnValue([]);
+    mocked.listAgentUrls.mockReturnValue([]);
+    mocked.readKeychain.mockReturnValue(null);
+});
+afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+});
+describe('planAgent', () => {
+    it('lists keys + remote files derived from config, deleting nothing', () => {
+        const plan = planAgent('https://me.github.io', softwareAgent('https://me.github.io'));
+        expect(plan.keysToDelete).toEqual([{ kid: '2026-05-22_ab', backend: 'software', keyId: 'https://me.github.io' }]);
+        expect(plan.remoteFilesToRemove).toEqual([
+            'https://me.github.io/.well-known/jwks.json',
+            'https://me.github.io/.well-known/aauth-agent.json',
+        ]);
+        expect(plan.hosting).toEqual({ platform: 'github-pages', repo: 'me/me.github.io' });
+        expect(mocked.deleteKeychain).not.toHaveBeenCalled();
+    });
+});
+describe('executeTeardown', () => {
+    it('wipes a software key via the keychain and removes config when asked', async () => {
+        mocked.readKeychain.mockReturnValue({ keys: {} });
+        const res = await executeTeardown('https://me.github.io', softwareAgent('https://me.github.io'), { removeConfig: true });
+        expect(res.keysDeleted).toBe(1);
+        expect(res.hardwareKeysRetained).toEqual([]);
+        expect(mocked.deleteKeychain).toHaveBeenCalledWith('https://me.github.io');
+        expect(mocked.deleteAgentProvider).toHaveBeenCalledWith('https://me.github.io');
+    });
+    it('records a YubiKey key as retained instead of failing', async () => {
+        const cfg = {
+            keys: { k1: { backend: 'yubikey-piv', algorithm: 'ES256', keyId: '9e', deviceLabel: 'yk' } },
+        };
+        mocked.getBackend.mockReturnValue({
+            deleteKey: vi.fn().mockRejectedValue(new lk.KeyDeletionUnsupportedError('run: ykman piv keys delete 9e')),
+        });
+        const res = await executeTeardown('https://me.github.io', cfg, { removeConfig: false });
+        expect(res.keysDeleted).toBe(0);
+        expect(res.hardwareKeysRetained).toEqual([
+            { kid: 'k1', keystore: 'yubikey-piv', keyId: '9e', hint: 'run: ykman piv keys delete 9e' },
+        ]);
+        expect(mocked.deleteAgentProvider).not.toHaveBeenCalled();
+    });
+    it('propagates an unexpected backend error', async () => {
+        const cfg = { keys: { k1: { backend: 'secure-enclave', algorithm: 'ES256', keyId: 'lbl', deviceLabel: 'se' } } };
+        mocked.getBackend.mockReturnValue({ deleteKey: vi.fn().mockRejectedValue(new Error('boom')) });
+        await expect(executeTeardown('https://me.github.io', cfg, { removeConfig: false })).rejects.toThrow('boom');
+    });
+});
+describe('deleteAgent', () => {
+    it('returns null for an unknown agent', async () => {
+        mocked.getAgentConfig.mockReturnValue(null);
+        expect(await deleteAgent('https://nope.example')).toBeNull();
+    });
+    it('deletes the agent and reports remote files to remove', async () => {
+        mocked.getAgentConfig.mockReturnValue(softwareAgent('https://me.github.io'));
+        const r = await deleteAgent('https://me.github.io');
+        expect(r).toMatchObject({
+            deleted: 'https://me.github.io',
+            keysDeleted: 1,
+            remoteFilesToRemove: [
+                'https://me.github.io/.well-known/jwks.json',
+                'https://me.github.io/.well-known/aauth-agent.json',
+            ],
+            hosting: { platform: 'github-pages', repo: 'me/me.github.io' },
+        });
+        expect(mocked.deleteAgentProvider).toHaveBeenCalledWith('https://me.github.io');
+    });
+});
+describe('uninstall', () => {
+    it('reports alreadyClean when there is nothing configured or orphaned', async () => {
+        const r = await uninstall({ force: false });
+        expect(r).toMatchObject({ alreadyClean: true });
+        expect(mocked.deleteConfigFile).not.toHaveBeenCalled();
+    });
+    it('dry-run lists the plan and deletes nothing', async () => {
+        mocked.listAgentProviders.mockReturnValue(['https://me.github.io']);
+        mocked.getAgentConfig.mockReturnValue(softwareAgent('https://me.github.io'));
+        mocked.listAgentUrls.mockReturnValue(['https://me.github.io', 'https://orphan.example']);
+        const r = await uninstall({ force: false });
+        expect(r.dryRun).toBe(true);
+        expect(r.willBackUpConfig).toBe(true);
+        expect(r.orphanedKeychainUrls).toEqual(['https://orphan.example']);
+        expect(r.agents.length).toBe(1);
+        expect(mocked.deleteConfigFile).not.toHaveBeenCalled();
+        expect(mocked.deleteKeychain).not.toHaveBeenCalled();
+        expect(mocked.deleteAgentProvider).not.toHaveBeenCalled();
+        expect(existsSync(join(dir, 'backups'))).toBe(false);
+    });
+    it('--force backs up config, deletes keys, sweeps orphans, and removes config.json', async () => {
+        mocked.listAgentProviders.mockReturnValue(['https://me.github.io']);
+        mocked.getAgentConfig.mockReturnValue(softwareAgent('https://me.github.io'));
+        mocked.readKeychain.mockReturnValue({ keys: {} });
+        mocked.listAgentUrls.mockReturnValue(['https://me.github.io', 'https://orphan.example']);
+        const r = await uninstall({ force: true });
+        expect(r.uninstalled).toBe(true);
+        expect(r.orphanedKeychainUrlsSwept).toEqual(['https://orphan.example']);
+        // configured agent's software key wiped + orphan swept
+        expect(mocked.deleteKeychain).toHaveBeenCalledWith('https://me.github.io');
+        expect(mocked.deleteKeychain).toHaveBeenCalledWith('https://orphan.example');
+        // active config.json removed (dir kept), no full clear
+        expect(mocked.deleteConfigFile).toHaveBeenCalledOnce();
+        // a backup file was written, containing the agent's config (no private keys)
+        const backupPath = r.backupPath;
+        expect(existsSync(backupPath)).toBe(true);
+        const backup = JSON.parse(readFileSync(backupPath, 'utf-8'));
+        expect(Object.keys(backup.agents)).toEqual(['https://me.github.io']);
+        expect(backup.agents['https://me.github.io'].hosting).toEqual({ platform: 'github-pages', repo: 'me/me.github.io' });
+        expect(JSON.stringify(backup)).not.toContain('"d"'); // no EC/OKP private scalar
+    });
+    it('listBackups surfaces written backups (newest last)', async () => {
+        expect(listBackups()).toEqual([]);
+        mocked.listAgentProviders.mockReturnValue(['https://me.github.io']);
+        mocked.getAgentConfig.mockReturnValue(softwareAgent('https://me.github.io'));
+        await uninstall({ force: true });
+        const backups = listBackups();
+        expect(backups).toHaveLength(1);
+        expect(backups[0].agentUrls).toEqual(['https://me.github.io']);
+        expect(backups[0].file).toMatch(/^uninstall-.*\.json$/);
+        // the file listBackups names actually exists under backups/
+        expect(readdirSync(join(dir, 'backups'))).toContain(backups[0].file);
+    });
+});
+//# sourceMappingURL=teardown.test.js.map

dist/teardown.test.js.map

+{"version":3,"file":"teardown.test.js","sourceRoot":"","sources":["../src/teardown.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAA;AACpF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAGhC,iFAAiF;AACjF,kFAAkF;AAClF,0EAA0E;AAC1E,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,GAAG,EAAE;IAChC,MAAM,2BAA4B,SAAQ,KAAK;QACjB;QAA5B,YAA4B,IAAY;YACtC,KAAK,CAAC,IAAI,CAAC,CAAA;YADe,SAAI,GAAJ,IAAI,CAAQ;YAEtC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAA;QAC3C,CAAC;KACF;IACD,OAAO;QACL,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;QACvB,kBAAkB,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QACnC,aAAa,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;QAC9B,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;QAC/B,cAAc,EAAE,EAAE,CAAC,EAAE,EAAE;QACvB,mBAAmB,EAAE,EAAE,CAAC,EAAE,EAAE;QAC5B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;QACzB,YAAY,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC;QAC5C,UAAU,EAAE,EAAE,CAAC,EAAE,EAAE;QACnB,2BAA2B;KAC5B,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,OAAO,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAE/F,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;AAE5B,MAAM,aAAa,GAAG,CAAC,GAAW,EAAe,EAAE,CAAC,CAAC;IACnD,OAAO,EAAE,eAAe,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE;IACrD,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,GAAG,GAAG,+BAA+B;IACrD,OAAO,EAAE,GAAG,GAAG,wBAAwB;IACvC,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE;IAC9D,IAAI,EAAE,EAAE,eAAe,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE;CACvG,CAAC,CAAA;AAEF,IAAI,GAAW,CAAA;AAEf,UAAU,CAAC,GAAG,EAAE;IACd,EAAE,CAAC,aAAa,EAAE,CAAA;IAClB,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAA;IACpD,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;IACxC,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IAC7C,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC,CAAA;IACxC,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;AAC/C,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,IAAI,GAAG,SAAS,CAAC,sBAAsB,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAA;QACrF,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC,CAAA;QACjH,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,CAAC;YACvC,4CAA4C;YAC5C,mDAAmD;SACpD,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACnF,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,EAAW,CAAC,CAAA;QAC1D,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,sBAAsB,EAAE,aAAa,CAAC,sBAAsB,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;QACxH,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QAC5C,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;QAC1E,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,GAAG,GAAgB;YACvB,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;SAC7F,CAAA;QACD,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;YAChC,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAC,2BAA2B,CAAC,+BAA+B,CAAC,CAAC;SACjG,CAAC,CAAA;QACX,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,sBAAsB,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;QACvF,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC;YACvC,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,aAAa,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,+BAA+B,EAAE;SAC3F,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;QACtD,MAAM,GAAG,GAAgB,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAA;QAC7H,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,SAAS,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,EAAW,CAAC,CAAA;QACvG,MAAM,MAAM,CAAC,eAAe,CAAC,sBAAsB,EAAE,GAAG,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7G,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,CAAC,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAC5E,MAAM,CAAC,GAAG,MAAM,WAAW,CAAC,sBAAsB,CAAC,CAAA;QACnD,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC;YACtB,OAAO,EAAE,sBAAsB;YAC/B,WAAW,EAAE,CAAC;YACd,mBAAmB,EAAE;gBACnB,4CAA4C;gBAC5C,mDAAmD;aACpD;YACD,OAAO,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE;SAC/D,CAAC,CAAA;QACF,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;IACjF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,WAAW,EAAE,GAAG,EAAE;IACzB,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;QAC/C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,KAAK,IAAI,EAAE;QAC1D,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAC5E,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,CAAA;QAExF,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAA;QAC3C,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3B,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAA;QAClE,MAAM,CAAE,CAAC,CAAC,MAAoB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC9C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QACtD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;QACzD,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAC5E,MAAM,CAAC,YAAY,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,EAAE,EAAW,CAAC,CAAA;QAC1D,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC,sBAAsB,EAAE,wBAAwB,CAAC,CAAC,CAAA;QAExF,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAC1C,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChC,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,OAAO,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAA;QACvE,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,sBAAsB,CAAC,CAAA;QAC1E,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,oBAAoB,CAAC,wBAAwB,CAAC,CAAA;QAC5E,uDAAuD;QACvD,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,EAAE,CAAA;QAEtD,6EAA6E;QAC7E,MAAM,UAAU,GAAG,CAAC,CAAC,UAAoB,CAAA;QACzC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAA;QACpE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAA;QACpH,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA,CAAC,2BAA2B;IACjF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;QACjC,MAAM,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAA;QACnE,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,aAAa,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAE5E,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAA;QAC7B,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC/B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAA;QAC9D,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;QACvD,4DAA4D;QAC5D,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

dist/uninstall.e2e.test.d.ts

+export {};
+//# sourceMappingURL=uninstall.e2e.test.d.ts.map

dist/uninstall.e2e.test.d.ts.map

+{"version":3,"file":"uninstall.e2e.test.d.ts","sourceRoot":"","sources":["../src/uninstall.e2e.test.ts"],"names":[],"mappings":""}

dist/uninstall.e2e.test.js

+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { fileURLToPath } from 'node:url';
+// Opt-in end-to-end test of the real CLI: setup (`create`) → `list` → `uninstall`
+// dry-run → scoped `delete`. Skipped in CI and by default — run with:
+//
+//   npm run build && AAUTH_E2E=1 npx vitest run src/uninstall.e2e.test.ts
+//
+// Notes on why it's shaped this way:
+//  - Needs the built dist (it spawns dist/cli.js) — skips with a message if absent.
+//  - Touches the REAL OS keychain (software keys aren't isolated by AAUTH_DIR), so
+//    it uses a unique throwaway agent URL and tears it down with the SCOPED `delete`
+//    command — never `uninstall --force`, whose orphan-sweep would delete unrelated
+//    software keys that might exist on the machine. The destructive full-wipe path
+//    is covered by the mocked unit tests in teardown.test.ts.
+//  - `create` binds a person server, so it needs network access.
+const CLI = join(fileURLToPath(new URL('.', import.meta.url)), '..', 'dist', 'cli.js');
+const ENABLED = !!process.env.AAUTH_E2E && existsSync(CLI);
+function run(env, ...args) {
+    const out = execFileSync('node', [CLI, ...args], {
+        env: { ...process.env, ...env, NO_COLOR: '1' },
+        encoding: 'utf-8',
+    });
+    return JSON.parse(out);
+}
+describe.skipIf(!ENABLED)('uninstall e2e (setup ↔ teardown)', () => {
+    let dir;
+    let url;
+    let env;
+    beforeAll(() => {
+        dir = mkdtempSync(join(tmpdir(), 'aauth-e2e-'));
+        url = `https://aauth-e2e-${process.pid}.example`;
+        env = { AAUTH_DIR: dir };
+    });
+    afterAll(() => {
+        // Best-effort cleanup of the throwaway key + temp dir.
+        try {
+            run(env, 'delete', url);
+        }
+        catch { /* already gone */ }
+        rmSync(dir, { recursive: true, force: true });
+    });
+    it('creates, lists, previews teardown, then deletes the identity', () => {
+        // 1. setup
+        const created = run(env, 'create', url, '--keystore', 'software');
+        expect(created.agentProvider).toBe(url);
+        expect(created.keys).toHaveLength(1);
+        // 2. list shows it
+        const listed = run(env, 'list');
+        expect(listed.agentProviders.map((a) => a.url)).toContain(url);
+        // 3. uninstall dry-run previews the plan and deletes nothing
+        const preview = run(env, 'uninstall');
+        expect(preview.dryRun).toBe(true);
+        expect(preview.willBackUpConfig).toBe(true);
+        expect(preview.agents.map((a) => a.agentUrl)).toContain(url);
+        // still present after a dry-run
+        expect(run(env, 'list').agentProviders).toHaveLength(1);
+        // 4. scoped teardown (safe: no orphan sweep) reports the remote files to remove
+        const deleted = run(env, 'delete', url);
+        expect(deleted.deleted).toBe(url);
+        expect(deleted.keysDeleted).toBe(1);
+        expect(deleted.remoteFilesToRemove).toContain(`${url}/.well-known/jwks.json`);
+        // 5. clean
+        expect(run(env, 'list').agentProviders).toHaveLength(0);
+    });
+});
+//# sourceMappingURL=uninstall.e2e.test.js.map

dist/uninstall.e2e.test.js.map

+{"version":3,"file":"uninstall.e2e.test.js","sourceRoot":"","sources":["../src/uninstall.e2e.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAClE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AACzD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAExC,kFAAkF;AAClF,sEAAsE;AACtE,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,qCAAqC;AACrC,oFAAoF;AACpF,mFAAmF;AACnF,qFAAqF;AACrF,oFAAoF;AACpF,mFAAmF;AACnF,8DAA8D;AAC9D,iEAAiE;AAEjE,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;AACtF,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AAE1D,SAAS,GAAG,CAAC,GAA2B,EAAE,GAAG,IAAc;IACzD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE;QAC/C,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;QAC9C,QAAQ,EAAE,OAAO;KAClB,CAAC,CAAA;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;AACxB,CAAC;AAED,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,kCAAkC,EAAE,GAAG,EAAE;IACjE,IAAI,GAAW,CAAA;IACf,IAAI,GAAW,CAAA;IACf,IAAI,GAA2B,CAAA;IAE/B,SAAS,CAAC,GAAG,EAAE;QACb,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAA;QAC/C,GAAG,GAAG,qBAAqB,OAAO,CAAC,GAAG,UAAU,CAAA;QAChD,GAAG,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,QAAQ,CAAC,GAAG,EAAE;QACZ,uDAAuD;QACvD,IAAI,CAAC;YAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC5D,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,WAAW;QACX,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,YAAY,EAAE,UAAU,CAA+C,CAAA;QAC/G,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAEpC,mBAAmB;QACnB,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,EAAE,MAAM,CAA+C,CAAA;QAC7E,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAE9D,6DAA6D;QAC7D,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,WAAW,CAInC,CAAA;QACD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;QAC5D,gCAAgC;QAChC,MAAM,CAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAmC,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAE1F,gFAAgF;QAChF,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAA4E,CAAA;QAClH,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,SAAS,CAAC,GAAG,GAAG,wBAAwB,CAAC,CAAA;QAE7E,WAAW;QACX,MAAM,CAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAmC,CAAC,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IAC5F,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

skills/uninstall.md

+---
+name: uninstall
+description: Tear down an AAuth agent provider identity — remove the published .well-known files, delete local keys, and wipe config so the machine can be bootstrapped fresh
+when: User wants to uninstall AAuth, remove an agent provider, delete their keys, or return the machine to a clean pre-bootstrap state
+---
+
+# Skill: Uninstall an AAuth agent provider identity
+
+This returns the machine to a clean, pre-bootstrap state. There are three kinds
+of artifact, in two places:
+
+- **Remote** — the `.well-known/jwks.json` and `aauth-agent.json` files published
+  to a hosting platform (GitHub Pages, Cloudflare Pages, …). Only the hosting
+  platform's tooling can remove these.
+- **Local** — signing keys (in the OS keychain / Secure Enclave / YubiKey) and
+  the `~/.aauth` config dir. The `uninstall` command removes these.
+
+## ⚠️ Before you start: this breaks running agents
+
+Tearing down an identity will break **any running agent or MCP server that uses
+it**, on two independent layers:
+
+1. Once the local keys/config are gone, the agent can no longer **sign** requests
+   — the next call fails.
+2. Once the published JWKS is removed, resources can no longer **verify** the
+   agent's existing signatures — even a server that cached its key in memory
+   starts getting rejected.
+
+**Confirm with the user** that no production service depends on this identity,
+and that any running agents/MCP servers using it have been stopped, before doing
+anything destructive. Confirm again before each destructive step.
+
+## 1. See what's there
+
+```
+npx @aauth/bootstrap list
+```
+
+If there are no agent providers, the machine is already clean — stop. Otherwise
+the output is the map for everything below: each agent's `hosting`, `jwksUri`,
+and `keys`.
+
+## 2. Remove the remote `.well-known` files FIRST
+
+Do this **before** wiping config — the config holds the `hosting` pointers you
+need to find the files. For each agent provider in `list`:
+
+- Read its `hosting.platform` and `hosting.repo`.
+- Load the matching platform skill (`npx @aauth/bootstrap skill <platform>`,
+  e.g. `github-pages`) and use that platform's tooling (`gh`, `wrangler`, …) to
+  delete `.well-known/jwks.json` and `.well-known/aauth-agent.json` (or remove
+  the whole `.well-known/` directory) and push.
+
+Confirm the files are gone (e.g. `curl -I <jwksUri>` returns 404) before
+continuing.
+
+## 3. Preview the local teardown (dry-run)
+
+`uninstall` is dry-run by default — it prints exactly what it WOULD delete and
+removes nothing:
+
+```
+npx @aauth/bootstrap uninstall
+```
+
+Review `agents[].keysToDelete`, `orphanedKeychainUrls`, and `willRemoveConfigDir`
+with the user.
+
+## 4. Perform the teardown
+
+After the user confirms, run it for real with `--force`:
+
+```
+npx @aauth/bootstrap uninstall --force
+```
+
+This **backs up the config first** (agent URL, person server, hosting, key
+metadata — never private keys) to `~/.aauth/backups/`, then deletes every agent's
+keys across all keystores, sweeps orphaned keychain entries, and removes the
+active `config.json`. The output's `backupPath` points at the snapshot.
+
+- A YubiKey PIV key (slot 9e) can't be wiped programmatically yet — it appears
+  under `hardwareKeysRetained` with a manual command (`ykman piv keys delete 9e`).
+  Relay that to the user.
+
+## 5. Verify
+
+```
+npx @aauth/bootstrap list
+```
+
+No agent providers means the machine is clean and ready to bootstrap fresh. The
+backup remains under `backups` in the `list` output — next time the user sets up,
+the `setup` skill can reuse the same agent URL, person server, and hosting (with
+fresh keys).

dist/cli.js

 #!/usr/bin/env node
 import { createRequire } from 'node:module';
-import { generateKey, generateKid, toPublicJwk, discoverBackends, getBackend, getAgentConfig, addKeyToAgent, deleteAgentProvider, listAgentProviders, readKeychain, writeKeychain, deleteKeychain, signAgentToken, validateUrl, ensureAgentUrls, KeyDeletionUnsupportedError, } from '@aauth/local-keys';
+import { generateKey, generateKid, toPublicJwk, discoverBackends, getBackend, getAgentConfig, addKeyToAgent, listAgentProviders, readKeychain, writeKeychain, signAgentToken, validateUrl, ensureAgentUrls, } from '@aauth/local-keys';
+import { deleteAgent, uninstall, listBackups } from './teardown.js';
 import { bootstrapWithPS } from './bootstrap-ps.js';
@@ -70,6 +71,10 @@ import { listSkills, getSkill } from './skills.js';
             personServer: cfg.personServerUrl ?? null,
+            hosting: cfg.hosting ?? null,
+            jwksUri: cfg.jwksUri ?? null,
             keys,
         });
     }
-    printResult({ keystores, agentProviders });
+    // Surface uninstall backups so setup can offer to reuse a prior identity's
+    // settings (agent URL, person server, hosting) — fresh keys, same config.
+    printResult({ keystores, agentProviders, backups: listBackups() });
 }
@@ -126,35 +131,10 @@ async function cmdCreate(positional, flags) {
         return fail('Usage: delete <agent-provider-url>');
-    const cfg = getAgentConfig(url);
-    if (!cfg)
+    const result = await deleteAgent(url);
+    if (!result)
         return fail(`Agent provider not found: ${url}`);
-    let keysDeleted = 0;
-    const hardwareKeysRetained = [];
-    // Software keys are grouped under the agent URL in the OS keychain — wipe in one shot.
-    if (readKeychain(url))
-        deleteKeychain(url);
-    for (const [kid, meta] of Object.entries(cfg.keys)) {
-        if (meta.backend === 'software') {
-            keysDeleted++;
-            continue;
-        }
-        const driver = getBackend(meta.backend);
-        try {
-            await driver.deleteKey?.(meta.keyId);
-            keysDeleted++;
-        }
-        catch (e) {
-            if (e instanceof KeyDeletionUnsupportedError) {
-                hardwareKeysRetained.push({ kid, keystore: meta.backend, keyId: meta.keyId, hint: e.hint });
-            }
-            else {
-                throw e;
-            }
-        }
-    }
-    deleteAgentProvider(url);
-    const result = { deleted: url, keysDeleted };
-    if (hardwareKeysRetained.length > 0)
-        result.hardwareKeysRetained = hardwareKeysRetained;
     printResult(result);
 }
+async function cmdUninstall(flags) {
+    printResult(await uninstall({ force: flags.force === true }));
+}
 async function cmdToken(flags) {
@@ -221,2 +201,5 @@ const { url, error } = resolveProvider(flagStr(flags, 'agent-provider'), listAgentProviders());
             break;
+        case 'uninstall':
+            await cmdUninstall(flags);
+            break;
         case 'token':
@@ -223,0 +206,0 @@ await cmdToken(flags);

dist/cli.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,aAAa,EACb,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,cAAc,EACd,WAAW,EACX,eAAe,EACf,2BAA2B,GAC5B,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAA;AAKrB,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAwB,CAAA;AAEpF,MAAM,qBAAqB,GAAG,2BAA2B,CAAA;AAEzD,4DAA4D;AAE5D,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACjD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC;AAED,yBAAyB;AAEzB,uEAAuE;AACvE,SAAS,OAAO,CAAC,KAAuC,EAAE,GAAW;IACnE,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAkB;IAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAe,EAAE,IAAkB,EAAE,GAAW;IACrE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO,EAAE,GAAI,GAA+B,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAA;AAC9F,CAAC;AAED,mBAAmB;AAEnB,KAAK,UAAU,OAAO;IACpB,MAAM,SAAS,GAAG,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEpD,MAAM,cAAc,GAAG,EAAE,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,MAAM,IAAI,GAAG,EAAE,CAAA;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;YAClF,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QACvD,CAAC;QACD,cAAc,CAAC,IAAI,CAAC;YAClB,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC5B,YAAY,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;YACzC,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,WAAW,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAA;AAC5C,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAoB,EAAE,KAAuC;IACpF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAE3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAA;IAEjD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,kCAAkC,GAAG,iCAAiC,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;IACjH,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,qBAAqB,CAAA;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAErD,eAAe,CAAC,GAAG,CAAC,CAAA;IAEpB,IAAI,GAAW,CAAA;IACf,IAAI,SAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACnG,GAAG,GAAG,GAAG,CAAC,GAAa,CAAA;QACvB,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAS,CAAA;QACtE,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACjE,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAC/C,GAAG,GAAG,WAAW,EAAE,CAAA;QACnB,SAAS,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAS,CAAA;QACrF,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,kFAAkF;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACzC,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,kBAAkB,YAAY,MAAM,OAAO,EAAE,CAAC,CAAA;IACvE,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;IAE9E,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAC/B,WAAW,CAAC;QACV,aAAa,EAAE,GAAG;QAClB,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;QAC7B,YAAY,EAAE,GAAG,EAAE,eAAe,IAAI,IAAI;QAC1C,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;KACrC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAoB;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAE3D,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAC/B,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAA;IAEzD,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,MAAM,oBAAoB,GAA0E,EAAE,CAAA;IAEtG,uFAAuF;IACvF,IAAI,YAAY,CAAC,GAAG,CAAC;QAAE,cAAc,CAAC,GAAG,CAAC,CAAA;IAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QACnD,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YAChC,WAAW,EAAE,CAAA;YACb,SAAQ;QACV,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACpC,WAAW,EAAE,CAAA;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,2BAA2B,EAAE,CAAC;gBAC7C,oBAAoB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YAC7F,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,CAAA;YACT,CAAC;QACH,CAAC;IACH,CAAC;IAED,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAExB,MAAM,MAAM,GAA4B,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;IACrE,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,CAAC,oBAAoB,GAAG,oBAAoB,CAAA;IACvF,WAAW,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAuC;IAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9F,IAAI,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAA;IAExE,MAAM,OAAO,GAAG,cAAc,CAAC;QAC7B,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC9B,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QAC3B,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO;KAC5C,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,2BAA2B,GAAG,wDAAwD,CAAC,CAAA;IACrG,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9E,WAAW,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,OAAM;IACR,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,4CAA4C,CAAC,CAAA;IAC5F,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC/B,IAAI,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;QAClC,OAAM;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,qBAAqB;AAErB,KAAK,UAAU,GAAG;IAChB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAEtF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxB,OAAM;IACR,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,OAAO,CAAC,CAAA;QAChB,OAAM;IACR,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YAAE,MAAM,OAAO,EAAE,CAAC;YAAC,MAAK;QACnC,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAAC,MAAK;QACxD,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YAAC,MAAK;QACjD,KAAK,OAAO;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAC,MAAK;QAC1C,KAAK,OAAO;YAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAK;QAC5C;YACE,IAAI,CAAC,oBAAoB,OAAO,sCAAsC,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACzB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AACnB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAC3C,OAAO,EACL,WAAW,EACX,WAAW,EACX,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,cAAc,EACd,WAAW,EACX,eAAe,GAChB,MAAM,mBAAmB,CAAA;AAE1B,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AACnE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAClD,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AACrC,OAAO,EACL,YAAY,EACZ,YAAY,EACZ,cAAc,EACd,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,eAAe,GAChB,MAAM,cAAc,CAAA;AAKrB,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAwB,CAAA;AAEpF,MAAM,qBAAqB,GAAG,2BAA2B,CAAA;AAEzD,4DAA4D;AAE5D,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3C,8EAA8E;IAC9E,iDAAiD;IACjD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IACvE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAA;IACjD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAA;AACtB,CAAC;AAED,yBAAyB;AAEzB,uEAAuE;AACvE,SAAS,OAAO,CAAC,KAAuC,EAAE,GAAW;IACnE,OAAO,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC,CAAC,CAAC,SAAS,CAAA;AAC1E,CAAC;AAED,sGAAsG;AACtG,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,GAAW,EAAE,IAAkB;IAC/E,IAAI,IAAI,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAA;QACnC,MAAM,GAAG,GAAG,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;QAC3B,OAAO,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACtC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,GAAe,EAAE,IAAkB,EAAE,GAAW;IACrE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAA;IAC/C,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACjE,OAAO,EAAE,GAAI,GAA+B,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,EAAE,CAAA;AAC9F,CAAC;AAED,mBAAmB;AAEnB,KAAK,UAAU,OAAO;IACpB,MAAM,SAAS,GAAG,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAA;IAEpD,MAAM,cAAc,GAAG,EAAE,CAAA;IACzB,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,CAAC,GAAG;YAAE,SAAQ;QAClB,MAAM,IAAI,GAAG,EAAE,CAAA;QACf,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACnD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAA;YAClF,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;QACvD,CAAC;QACD,cAAc,CAAC,IAAI,CAAC;YAClB,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC5B,YAAY,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;YACzC,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,IAAI;YAC5B,IAAI;SACL,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,WAAW,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;AACpE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAoB,EAAE,KAAuC;IACpF,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAE3D,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IACjC,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAA;IAEjD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,kCAAkC,GAAG,iCAAiC,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,wBAAwB,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAA;IACjH,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,IAAI,qBAAqB,CAAA;IAC7E,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAErC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,CAAA;IAC3C,MAAM,OAAO,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAErD,eAAe,CAAC,GAAG,CAAC,CAAA;IAEpB,IAAI,GAAW,CAAA;IACf,IAAI,SAAc,CAAA;IAElB,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;QACnG,GAAG,GAAG,GAAG,CAAC,GAAa,CAAA;QACvB,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAS,CAAA;QACtE,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,CAAC,CAAA;QACjE,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAA;QAC/C,GAAG,GAAG,WAAW,EAAE,CAAA;QACnB,SAAS,GAAG,EAAE,GAAG,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAS,CAAA;QACrF,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAA;IAC1F,CAAC;IAED,kFAAkF;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAA;IACzC,IAAI,OAAO;QAAE,OAAO,IAAI,CAAC,kBAAkB,YAAY,MAAM,OAAO,EAAE,CAAC,CAAA;IACvE,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,eAAe,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;IAE9E,MAAM,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAA;IAC/B,WAAW,CAAC;QACV,aAAa,EAAE,GAAG;QAClB,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;QAC7B,YAAY,EAAE,GAAG,EAAE,eAAe,IAAI,IAAI;QAC1C,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;KACrC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,UAAoB;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,oCAAoC,CAAC,CAAA;IAE3D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAA;IAC5D,WAAW,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAuC;IACjE,WAAW,CAAC,MAAM,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAC,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAuC;IAC7D,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAA;IAC9F,IAAI,KAAK,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC,KAAK,IAAI,+BAA+B,CAAC,CAAA;IAExE,MAAM,OAAO,GAAG,cAAc,CAAC;QAC7B,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC;QACpC,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;QAC9B,IAAI,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ;QAC3B,aAAa,EAAE,cAAc,CAAC,GAAG,CAAC,EAAE,OAAO;KAC5C,CAAC,CAAA;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC,2BAA2B,GAAG,wDAAwD,CAAC,CAAA;IACrG,CAAC;IAED,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC9E,WAAW,CAAC,MAAM,CAAC,CAAA;AACrB,CAAC;AAED,SAAS,QAAQ,CAAC,IAAa;IAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,UAAU,EAAE,CAAC,CAAC,CAAA;QAClD,OAAM;IACR,CAAC;IACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,mBAAmB,IAAI,4CAA4C,CAAC,CAAA;IAC5F,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,SAAS,OAAO,CAAC,OAAgB;IAC/B,IAAI,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;QAClC,OAAM;IACR,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAA;AACxC,CAAC;AAED,qBAAqB;AAErB,KAAK,UAAU,GAAG;IAChB,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IAEtF,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACxB,OAAM;IACR,CAAC;IAED,6DAA6D;IAC7D,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACnC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,OAAM;IACR,CAAC;IAED,mDAAmD;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,OAAO,CAAC,CAAA;QAChB,OAAM;IACR,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,MAAM;YAAE,MAAM,OAAO,EAAE,CAAC;YAAC,MAAK;QACnC,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAAC,MAAK;QACxD,KAAK,QAAQ;YAAE,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;YAAC,MAAK;QACjD,KAAK,WAAW;YAAE,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;YAAC,MAAK;QAClD,KAAK,OAAO;YAAE,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YAAC,MAAK;QAC1C,KAAK,OAAO;YAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,MAAK;QAC5C;YACE,IAAI,CAAC,oBAAoB,OAAO,sCAAsC,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC;AAED,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,GAAU,EAAE,EAAE;IACzB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AACnB,CAAC,CAAC,CAAA"}

dist/render.d.ts.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,YAAY,EAAE,CAMtE;AAED,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,0GAC2E,CAAA;AAEzG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAStE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAwCpD;AAED,oDAAoD;AACpD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAkI/C,CAAA"}
+{"version":3,"file":"render.d.ts","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE/C,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,UAAU,EAAE,MAAM,EAAE,CAAA;CACrB;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAcjD;AAED,6EAA6E;AAC7E,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,YAAY,EAAE,CAMtE;AAED,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,0GAC2E,CAAA;AAEzG;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAErD;AAED,8FAA8F;AAC9F,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,CAStE;AAED,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA4CpD;AAED,oDAAoD;AACpD,eAAO,MAAM,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAiL/C,CAAA"}

dist/render.js

@@ -86,2 +86,6 @@ /**
 
+  uninstall [--force]
+    Remove ALL agent providers and keys (clean slate). Backs up the config
+    first so setup can reuse it later. Dry-run by default — pass --force.
+
   token [--agent-provider <url>] [--agent-id <id>] [--local <name>] [--lifetime <s>]
@@ -154,3 +158,5 @@ Generate an agent token
   Delete an agent provider and its keys, including from hardware keystores.
-  Fails if the agent provider doesn't exist.
+  Fails if the agent provider doesn't exist. Deletes immediately (no dry-run).
+  Reports the remote .well-known files that still need removing from hosting —
+  it never touches remote hosting itself.
 
@@ -164,4 +170,48 @@ USAGE
     "deleted": "https://descartes.github.io",
-    "keysDeleted": 1
+    "keysDeleted": 1,
+    "remoteFilesToRemove": [
+      "https://descartes.github.io/.well-known/jwks.json",
+      "https://descartes.github.io/.well-known/aauth-agent.json"
+    ],
+    "hosting": { "platform": "github-pages", "repo": "descartes/descartes.github.io" }
   }`,
+    uninstall: `DESCRIPTION
+  Return the machine to a clean, pre-bootstrap state: delete every configured
+  agent provider's keys (across all keystores) and sweep orphaned keychain
+  entries. Backs up the config first (agent URL, person server, hosting, key
+  metadata — never private keys) to ~/.aauth/backups/, then removes the active
+  config.json while keeping the dir. \`list\` surfaces the backup so a later setup
+  can reuse the same settings with fresh keys.
+
+  Dry-run by default — it prints exactly what WOULD be removed and deletes
+  nothing. Pass --force to actually perform the teardown.
+
+  WARNING: this breaks any running agent or MCP server using these identities —
+  signing fails once the keys/config are gone, and resources can no longer verify
+  signatures once the published JWKS is removed. Stop dependent services first,
+  and remove the remote .well-known files (reported below) before re-bootstrapping.
+
+USAGE
+  npx @aauth/bootstrap uninstall [--force]
+
+EXAMPLE
+  $ npx @aauth/bootstrap uninstall
+  {
+    "dryRun": true,
+    "scope": "all",
+    "agents": [
+      {
+        "agentUrl": "https://descartes.github.io",
+        "keysToDelete": [ { "kid": "bd3f9c…", "backend": "software", "keyId": "…" } ],
+        "remoteFilesToRemove": [
+          "https://descartes.github.io/.well-known/jwks.json",
+          "https://descartes.github.io/.well-known/aauth-agent.json"
+        ],
+        "hosting": { "platform": "github-pages", "repo": "descartes/descartes.github.io" }
+      }
+    ],
+    "orphanedKeychainUrls": [],
+    "willBackUpConfig": true,
+    "hint": "Nothing was deleted. Re-run with --force to delete the keys — the config is backed up first so setup can reuse it later."
+  }`,
     token: `DESCRIPTION
@@ -168,0 +218,0 @@ Generate an agent token — the credential an agent presents to make authenticated calls.

dist/render.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,SAAS,CAAA;IACvB,OAAO,IAAI,CAAC,OAAO,CACjB,sFAAsF,EACtF,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,WAAW,GAAG,GAAG,KAAK,GAAG,KAAK,EAAE,CAAA,CAAC,MAAM;YACvE,OAAO,WAAW,GAAG,GAAG,KAAK,EAAE,CAAA,CAAC,eAAe;QACjD,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,WAAW,OAAO,GAAG,KAAK,EAAE,CAAA,CAAC,cAAc;QAC7E,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,WAAW,GAAG,GAAG,KAAK,EAAE,CAAA,CAAC,SAAS;QAChE,OAAO,KAAK,CAAA;IACd,CAAC,CACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO;QACnB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAA;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,uGAAuG,CAAA;AAEzG;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qEAAqE,iBAAiB,EAAE,CAAA;AAC5H,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,MAAM,KAAK,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IACvE,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO;qBACY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAqCA,CAAA;AAC5B,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;IAwBJ;IAEF,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+BN;IAEF,MAAM,EAAE;;;;;;;;;;;;IAYN;IAEF,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4BL;IAEF,KAAK,EAAE;;;;;;;;;;;;;;;;;;;IAmBL;IAEF,IAAI,EAAE;;;;sCAI8B;CACrC,CAAA"}
+{"version":3,"file":"render.js","sourceRoot":"","sources":["../src/render.ts"],"names":[],"mappings":"AAUA;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,SAAS,CAAA;IACvB,OAAO,IAAI,CAAC,OAAO,CACjB,sFAAsF,EACtF,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE;QAClC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO,WAAW,GAAG,GAAG,KAAK,GAAG,KAAK,EAAE,CAAA,CAAC,MAAM;YACvE,OAAO,WAAW,GAAG,GAAG,KAAK,EAAE,CAAA,CAAC,eAAe;QACjD,CAAC;QACD,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,WAAW,OAAO,GAAG,KAAK,EAAE,CAAA,CAAC,cAAc;QAC7E,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,WAAW,GAAG,GAAG,KAAK,EAAE,CAAA,CAAC,SAAS;QAChE,OAAO,KAAK,CAAA;IACd,CAAC,CACF,CAAA;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,QAAuB;IACpD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1B,QAAQ,EAAE,CAAC,CAAC,OAAO;QACnB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;KACzB,CAAC,CAAC,CAAA;AACL,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,iBAAiB,GAC5B,uGAAuG,CAAA;AAEzG;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,qEAAqE,iBAAiB,EAAE,CAAA;AAC5H,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,uBAAuB,CAAC,MAAsB;IAC5D,MAAM,KAAK,GAAG,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAA;IAC9C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC1B,IAAI,CAAC,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;QAC5C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAChB,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAA;IACvE,OAAO,gBAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,OAAO;qBACY,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAyCA,CAAA;AAC5B,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,MAAM,YAAY,GAA2B;IAClD,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;IAwBJ;IAEF,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA+BN;IAEF,MAAM,EAAE;;;;;;;;;;;;;;;;;;;IAmBN;IAEF,SAAS,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAsCT;IAEF,KAAK,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;IA4BL;IAEF,KAAK,EAAE;;;;;;;;;;;;;;;;;;;IAmBL;IAEF,IAAI,EAAE;;;;sCAI8B;CACrC,CAAA"}

package.json

 {
   "name": "@aauth/bootstrap",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "CLI for bootstrapping AAuth agent keys and configuration",
@@ -33,4 +33,4 @@ "type": "module",
   "dependencies": {
-    "@aauth/local-keys": "^1.0.0"
+    "@aauth/local-keys": "^1.1.0"
   }
 }

skills/setup.md

@@ -22,2 +22,19 @@ ---
 
+## Check for a prior setup to reuse (`backups`)
+
+The `list` output includes a `backups` array — snapshots written when a previous
+identity was uninstalled. If it's non-empty, this machine was set up before. For
+the most recent entry (last in the array):
+
+- Read its `agentUrls`. Offer to set up again with the **same agent URL, person
+  server, and hosting** as before — the user almost always wants the same
+  identity back. (You'll generate fresh keys; the old private keys are gone.)
+- The full prior settings are in `~/.aauth/backups/<file>` (the `file` field) —
+  read it to recover `personServerUrl` and `hosting.platform` / `hosting.repo`,
+  and pass them to `create` (`--person-server`) and the matching platform skill
+  so you republish to the same place.
+
+Confirm with the user before reusing — they may want a different URL. If
+`backups` is empty, this is a first-time setup.
+
 ## What `create` does
@@ -24,0 +41,0 @@

New alerts

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 2 instances

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

157428

44.04%

Number of package files

60

27.66%

Lines of code

1600

48.42%

Worsened metrics

Number of low supply chain risk alerts

12

140%

Dependency changes

• Updated

  @aauth/local-keys@^1.1.0