Apply various fixes and refactoring.

Signed-off-by: Dmitri Zagidulin <dzagidulin@gmail.com>

Author: dmitrizagidulin

CHANGELOG.md

@@ -19,7 +19,33 @@
 - Update to latest d-i-core, verifier-core, was-client and didwebvh deps.
 - `did webvh rotate-keys` and `did service add|remove` now pass the
   already-resolved log state to `updateDID` as `priorMeta`, so each update
-  verifies the history log once instead of twice.
+  verifies the history log once instead of twice. The pairing between the log
+  and its resolved metadata is now asserted (O(1)) before signing.
+- `did webvh rotate-keys` edits the authorized `updateKeys` set instead of
+  rebuilding it from the single local key: a stage-only `--enable-prerotation`
+  leaves the set unchanged, and an ordinary rotation replaces only the retired
+  key, so co-authorized update keys are no longer silently revoked.
+- `rotate-keys --update-key` now authorizes every supplied key instead of
+  silently dropping all but the first.
+- did:webvh updates persist crash-safely: the update-keys sidecar (including
+  the superseded secret) is written before the log that authorizes the new
+  key, and the signer loaders can recover from a rotation interrupted between
+  the two writes.
+- Stored artifacts (DID documents, history logs, sidecars, wallet items) are
+  written atomically (temp file + rename), so an interrupted write can no
+  longer leave a truncated file.
+- Confirmation prompts no longer auto-confirm when stdin is not interactive;
+  non-interactive runs must pass `--yes`, and a declined confirmation now
+  exits 1.
+- An empty `SECRET_KEY_SEED` env var is treated as unset, and an invalid one
+  is reported as a one-line error; seed derivation is shared across
+  `key create`, `did create`, and `rotate-keys`.
+- Command errors that escape a runner are reported as one-line messages with
+  exit 1 instead of surfacing as unhandled rejections; a corrupt update-keys
+  sidecar reports its file path.
+- `did add-service` validates `--endpoint`/`--endpoint-json` arguments before
+  resolving (and re-verifying) a did:webvh history log; `rotate-keys` likewise
+  checks flag conflicts before resolution.
 
 ## 0.13.0 - 2026-07-12
 

README.md

@@ -693,6 +693,8 @@ Flags:
   new key (a bare `--stop-prerotation` reveal, or rotating to an external
   `--update-key`).
 - `-y`, `--yes` -- skip the confirmation prompt (rotation is hard to undo).
+  Required when stdin is not interactive (scripts, cron), where the prompt
+  cannot be asked.
 
 #### Add or remove a service entry
 

src/commands/did.test.ts

@@ -4,6 +4,7 @@ import { mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { tmpdir } from 'node:os'
 import { resolveDIDFromLog } from '@interop/did-method-webvh'
+import { Ed25519VerificationKey } from '@interop/ed25519-verification-key'
 import { makeDidCommand, parseDidLog } from './did.js'
 import { makeKeyCommand } from './key.js'
 
@@ -984,6 +985,183 @@ describe('di did', () => {
       }
     })
 
+    it('--update-key authorizes every supplied key', async () => {
+      const { didsDir, did, updateKeysPath } = await createSavedWebvh([
+        '--no-prerotation'
+      ])
+      try {
+        const before = await readJson<{
+          active: { publicKeyMultibase: string }
+        }>(updateKeysPath)
+        const activePub = before.active.publicKeyMultibase
+        const external = await Ed25519VerificationKey.generate()
+        const { publicKeyMultibase: externalPub } = (await external.export({
+          publicKey: true
+        })) as { publicKeyMultibase: string }
+
+        await makeDidCommand().parseAsync(
+          [
+            'webvh',
+            'rotate-keys',
+            did,
+            '--update-key',
+            activePub,
+            externalPub,
+            '--keep-old-key',
+            '--yes'
+          ],
+          { from: 'user' }
+        )
+
+        const meta = await resolveStoredWebvhMeta(didsDir, did)
+        // Both supplied keys are authorized -- no silent drop of the extras.
+        assert.deepEqual(meta.updateKeys, [activePub, externalPub])
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
+    it('stage-only --enable-prerotation leaves a multi-key authorized set unchanged', async () => {
+      const { didsDir, did, updateKeysPath } = await createSavedWebvh([
+        '--no-prerotation'
+      ])
+      try {
+        const before = await readJson<{
+          active: { publicKeyMultibase: string }
+        }>(updateKeysPath)
+        const activePub = before.active.publicKeyMultibase
+        const external = await Ed25519VerificationKey.generate()
+        const { publicKeyMultibase: externalPub } = (await external.export({
+          publicKey: true
+        })) as { publicKeyMultibase: string }
+        // Authorize a second (externally-held) key alongside the local one,
+        // keeping the local secret in `retired` so it can still sign.
+        await makeDidCommand().parseAsync(
+          [
+            'webvh',
+            'rotate-keys',
+            did,
+            '--update-key',
+            activePub,
+            externalPub,
+            '--keep-old-key',
+            '--yes'
+          ],
+          { from: 'user' }
+        )
+        logs.length = 0
+
+        await makeDidCommand().parseAsync(
+          ['webvh', 'rotate-keys', did, '--enable-prerotation', '--yes'],
+          { from: 'user' }
+        )
+
+        const meta = await resolveStoredWebvhMeta(didsDir, did)
+        // Stage only: pre-rotation is armed without revoking the co-authorized
+        // key.
+        assert.equal(meta.prerotation, true)
+        assert.deepEqual(meta.updateKeys, [activePub, externalPub])
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
+    it('refuses without --yes when stdin is not interactive', async () => {
+      const { didsDir, did } = await createSavedWebvh()
+      try {
+        await makeDidCommand().parseAsync(['webvh', 'rotate-keys', did], {
+          from: 'user'
+        })
+        assert.equal(exitCode, 1)
+        assert.ok(errors.some(line => line.includes('pass --yes')))
+        // Nothing was appended.
+        const meta = await resolveStoredWebvhMeta(didsDir, did)
+        assert.equal(meta.versionId.split('-')[0], '1')
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
+    it('reports a corrupt update-keys sidecar instead of crashing', async () => {
+      const { didsDir, did, updateKeysPath } = await createSavedWebvh()
+      try {
+        // Simulate a truncated (interrupted) sidecar write.
+        await writeFile(updateKeysPath, '{ "active": { "publicKeyM', 'utf8')
+        await makeDidCommand().parseAsync(
+          ['webvh', 'rotate-keys', did, '--yes'],
+          { from: 'user' }
+        )
+        assert.equal(exitCode, 1)
+        assert.ok(
+          errors.some(line =>
+            line.includes('Could not parse the update-keys sidecar')
+          )
+        )
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
+    it('recovers when an interrupted rotation left the sidecar ahead of the log', async () => {
+      const { didsDir, did } = await createSavedWebvh()
+      try {
+        const logPath = join(didsDir, 'webvh', `${did}.jsonl`)
+        const beforeLog = await readFile(logPath, 'utf8')
+        await makeDidCommand().parseAsync(
+          ['webvh', 'rotate-keys', did, '--yes'],
+          { from: 'user' }
+        )
+        // Simulate the interruption: the sidecar advanced, the log write was
+        // lost.
+        await writeFile(logPath, beforeLog, 'utf8')
+        logs.length = 0
+
+        await makeDidCommand().parseAsync(
+          ['webvh', 'rotate-keys', did, '--yes'],
+          { from: 'user' }
+        )
+
+        assert.equal(exitCode, undefined)
+        const meta = await resolveStoredWebvhMeta(didsDir, did)
+        assert.equal(meta.versionId.split('-')[0], '2')
+        assert.equal(meta.prerotation, true)
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
+    it('--with-seed treats an empty SECRET_KEY_SEED as unset', async () => {
+      const { didsDir, did } = await createSavedWebvh()
+      try {
+        process.env.SECRET_KEY_SEED = ''
+        await makeDidCommand().parseAsync(
+          ['webvh', 'rotate-keys', did, '--with-seed', '--yes'],
+          { from: 'user' }
+        )
+        assert.equal(exitCode, undefined)
+        const parsed = JSON.parse(logs.join('\n'))
+        // A seed was generated rather than the empty env value being used.
+        assert.match(parsed.secretKeySeed, /^z/)
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
+    it('reports an invalid SECRET_KEY_SEED instead of crashing', async () => {
+      const { didsDir, did } = await createSavedWebvh()
+      try {
+        process.env.SECRET_KEY_SEED = 'not-a-multibase-seed'
+        await makeDidCommand().parseAsync(
+          ['webvh', 'rotate-keys', did, '--with-seed', '--yes'],
+          { from: 'user' }
+        )
+        assert.equal(exitCode, 1)
+        assert.ok(errors.some(line => line.includes('Invalid SECRET_KEY_SEED')))
+      } finally {
+        await rm(didsDir, { recursive: true })
+      }
+    })
+
     it('--with-seed emits the staged next key seed', async () => {
       const { didsDir, did } = await createSavedWebvh()
       try {

src/commands/did.ts

@@ -17,6 +17,7 @@ import {
 } from './did/create.js'
 import {
   addServiceEntry,
+  buildServiceEndpoint,
   buildServiceEntry,
   dispatchServiceUpdate,
   normalizeServiceId,
@@ -194,6 +195,14 @@ export function makeDidCommand(): Command {
           yes?: boolean
         }
       ) => {
+        try {
+          // Argument-only validation, before the did:webvh path pays for a
+          // full (signature-verifying) log resolution.
+          buildServiceEndpoint(options)
+        } catch (err) {
+          console.error((err as Error).message)
+          return runAndExit(Promise.resolve(1))
+        }
         const transform = (
           current: ServiceEndpoint[],
           resolvedDid: string

src/commands/did/create.ts

@@ -1,14 +1,10 @@
 /**
  * DID creation and key addition: `runCreate` (key, web, webvh) and `runAddKey`
- * (add a verification key to a stored did:web). Both share the seed-derivation,
- * ECDSA-curve, non-deterministic-seed-guard, and output helpers at the top of
- * this module; the webvh signer/sidecar plumbing is reused from
- * `./webvh-update.js`.
+ * (add a verification key to a stored did:web). Both share the ECDSA-curve,
+ * non-deterministic-seed-guard, and output helpers at the top of this module;
+ * seed derivation comes from `../../keys/seed.js` and the webvh signer/sidecar
+ * plumbing is reused from `./webvh-update.js`.
  */
-import {
-  decodeSecretKeySeed,
-  generateSecretKeySeed
-} from '@digitalcredentials/bnid'
 import { driver } from '@interop/did-method-key'
 import * as didWeb from '@interop/did-web-resolver'
 import { createDID } from '@interop/did-method-webvh'
@@ -29,6 +25,7 @@ import {
   SUPPORTED_ECDSA_CURVES,
   warnIfNotVcIssuanceCapable
 } from '../../keys/ecdsa.js'
+import { deriveSeed } from '../../keys/seed.js'
 import { exportUpdateKey, generateStagedKey } from '../../keys/webvh-update.js'
 import { requireSaveForMetaFlags } from '../collection-command.js'
 import {
@@ -96,31 +93,6 @@ async function saveDidArtifacts({
   console.error(`DID saved to ${docPath}`)
 }
 
-/**
- * Resolve the secret key seed for a deterministic (Ed25519) key. With
- * `--with-seed`, an existing `SECRET_KEY_SEED` env var is honored or a fresh
- * seed generated; without it, only an explicitly set env seed is used. Returns
- * the encoded seed (echoed back to the user) and its decoded bytes (for key
- * generation).
- *
- * @param options {object}
- * @param [options.withSeed] {boolean}
- * @returns {Promise<{ secretKeySeed?: string, seedBytes?: Uint8Array }>}
- */
-async function deriveSeed({ withSeed }: { withSeed?: boolean }): Promise<{
-  secretKeySeed?: string
-  seedBytes?: Uint8Array
-}> {
-  const envSeed = process.env.SECRET_KEY_SEED
-  const secretKeySeed = withSeed
-    ? (envSeed ?? (await generateSecretKeySeed()))
-    : envSeed
-  const seedBytes = secretKeySeed
-    ? decodeSecretKeySeed({ secretKeySeed })
-    : undefined
-  return { secretKeySeed, seedBytes }
-}
-
 /**
  * Guard a non-deterministic key type against `--with-seed`: ECDSA and X25519
  * keys are generated non-deterministically and cannot be derived from a seed.