saphan person
Performs a person's own act from the command line with a FIDO2 security key: checking what the host offers, enrolling a key, and signing orders.
Performs a person's own act from the command line with a FIDO2 security key: checking what the host offers, enrolling a key, and signing orders. The key's PIN is asked only at the terminal with echo off; no flag, environment variable or file carries it. Security keys are supported on macOS and Linux.
saphan person enrol
Enrols a FIDO2 security key as a person's credential: it explains what the touch does, asks the key to create a credential (PIN at the terminal), and prints the registration object for the server's enrolment step. It does not check the key's attestation; the server's enrolment step does. You supply the deployment record, its relying-party configuration and a server-issued challenge; the command fetches nothing itself.
| flag | type | default | what it does |
|---|---|---|---|
--challenge | string | The server-issued enrolment challenge, base64url-encoded. Required. | |
--deployment | string | A JSON file holding the deployment record. Required. | |
--rp-config | string | A JSON file holding the deployment's relying-party (WebAuthn) configuration. Required. | |
--user-id | string | The person's handle, stored on the key as the user ID. Required. | |
--user-name | string | The label the key shows for this credential. |
saphan person probe
Reports, without touching anything, whether this host offers a FIDO2 security key and a phone reachable for cross-device (hybrid) sign-in. Each line reads present, absent or unmeasured with its reason.
| flag | type | default | what it does |
|---|---|---|---|
--getinfo | bool | false | Also open the key and ask what it supports; no touch, no PIN, nothing is signed. |
saphan person sign
Signs a batch of orders with one touch of a FIDO2 security key. It reads a request file, shows what the touch will sign (the same screen the console shows), asks the key for a signature, checks it with the same verifier the browser path uses, and prints the resulting record as JSON on standard output. It writes nothing to the record; delivering the signed record is up to you. The checkpoint in the request file is used as given; whether it is current is checked when the signature is verified (checkpoint-stale).
| flag | type | default | what it does |
|---|---|---|---|
--deployment | string | A JSON file holding the deployment record. Required. | |
--request | string | A JSON file holding the signing request: the person, the enrolled credential, the checkpoint and the orders. Required. | |
--rp-config | string | A JSON file holding the deployment's relying-party (WebAuthn) configuration. Required. |
Global options apply to every command — see Every command.
saphan owner-block-settle
Settles a stream's owner-block debt by recording a well-formed owner block from a file, without starting a run, so the stream can be dispatched again.
saphan policy
Validates, inspects and merges drafts of the two policy document types: egress rule-sets (policy egress) and permission classes (policy grant).