Module keychain 

Structs

AnvilNodeInfo 🔒

AuthScopesJson

Newtype wrapper for parsed key-authorization --scopes JSON.

DoctorCandidate 🔒

Candidate subject collected before the RPC chain is known.

DoctorContext 🔒

DoctorStep 🔒

DoctorSubject 🔒

Result of resolving a local registry entry for the doctor.

InspectedLimit 🔒

JsonCallScope 🔒

Represents a single scope entry in JSON format for --scopes.

JsonSelectorWithRecipients 🔒

KeyAuthorizationArgs

Common fields for cast key-authorization encode and cast key-authorization sign.

KeyMetadata 🔒

LocalCandidateResolution 🔒

LocalLimitMetadata 🔒

ScopesJson

Newtype wrapper for parsed --scopes JSON so clap can treat it as a single value.

SponsorshipDiagnosis 🔒

ValidKeyAuthorization 🔒

Enums

AllowedCallMatch 🔒

Outcome of TIP-1011 allowed-call matching.

AllowedCallsView 🔒

ChainTimestamp 🔒

DoctorStatus 🔒

JsonSelectorEntry 🔒

A selector entry can be either a plain string or an object with recipients.

KeyAuthorizationSubcommand

Tempo key-authorization artifact helpers.

KeyRegistrationState 🔒

KeychainPolicySubcommand

Higher-level access-key policy editing commands.

KeychainRootSigner 🔒

KeychainSubcommand

Tempo keychain management commands.

KeychainTxOutcome 🔒

Functions

abi_scope_to_auth_scope 🔒

active_from_anvil_node_info 🔒

add_selector_rule_to_scope 🔒

address_label 🔒

address_label_with_address 🔒

allowed_calls_to_json 🔒

anvil_tempo_hardfork_active 🔒

auth_signature_type_label 🔒

auth_signature_type_name 🔒

call_scope_to_json 🔒

check_allowed_calls 🔒

Step 8 helper: allowed calls (TIP-1011).

check_authorization_allowed_calls 🔒

check_authorization_expiry 🔒

check_authorization_spending_limits 🔒

check_expiring_nonce 🔒

Step 12 helper: validate TIP-1009 expiring-nonce options, if supplied.

check_expiring_nonce_window 🔒

check_fee_token_balance 🔒

Step 9 helper: fee-token balance on the root account.

check_hardfork 🔒

check_key_expiry 🔒

check_local_signing_readiness 🔒

Step 4 helper: verify whether the local side can actually sign as the key.

check_spending_limits 🔒

Step 7 helper: spending limits.

check_sponsorship 🔒

Step 13 helper: validate sponsorship configuration, if supplied.

collect_local_candidates 🔒

Step 1 helper: collect local registry candidates.

decode_and_validate_key_authorization 🔒

Decode a hex RLP key authorization (signed or unsigned) and validate its account binding.

decoded_entry_key_authorization 🔒

diagnose_allowed_scopes 🔒

encode_key_authorization 🔒

ensure_key_authorization_root_sender 🔒

Ensures key authorization artifacts are signed by the expected root account.

ensure_root_sender 🔒

Ensures AccountKeychain calls with a known root account use that root as the signer.

ensure_tempo_precompile_active 🔒

Fails early with requirement when a Tempo precompile is not active yet: a pre-fork call would succeed as a silent no-op instead of reverting. Prefers the hardfork query and falls back to checking the precompile’s code when the RPC lacks the method.

fetch_chain_timestamp 🔒

finalize_doctor 🔒

Render the doctor result and return.

format_authorization_limits 🔒

format_duration_words 🔒

format_expiry 🔒

format_expiry_for_inspect 🔒

format_period_end 🔒

format_recipients 🔒

format_relative_timestamp 🔒

format_relative_timestamp_from 🔒

format_selector 🔒

format_timestamp_iso 🔒

inspected_limit_to_json 🔒

is_rpc_method_not_found 🔒

is_tempo_hardfork_active 🔒

key_entry_effective_key 🔒

key_entry_to_json 🔒

key_metadata_from_entry 🔒

key_type_label 🔒

key_type_matches_authorization 🔒

key_type_name 🔒

load_keys_file 🔒

local_key_role 🔒

Classify a local key entry’s role for display.

match_allowed_call 🔒

Pure TIP-1011 matching logic. Extracted so it can be unit-tested.

parse_auth_limit 🔒

Parse a key-authorization --limit TOKEN:AMOUNT[:PERIOD] flag value.

parse_auth_scope 🔒

parse_auth_scopes_json_wrapped 🔒

parse_auth_signature_type 🔒

parse_limit 🔒

Parse a --limit TOKEN:AMOUNT flag value.

parse_scopes_json 🔒

Parse --scopes JSON flag value.

parse_scopes_json_wrapped 🔒

Parse --scopes JSON flag value into the newtype wrapper.

parse_signature_type 🔒

print_allowed_calls 🔒

print_doctor_step 🔒

print_inspected_limits 🔒

print_key_entry 🔒

print_signed_key_authorization 🔒

redact_private_key_uri_tokens 🔒

resolve_key_metadata 🔒

resolve_keychain_root_signer 🔒

Resolve the root-authorized signer used for AccountKeychain policy changes.

run_authorize 🔒

cast keychain authorize / cast keychain auth — authorize a key on-chain.

run_burn_witness 🔒

cast keychain burn-witness — burn a TIP-1053 key authorization witness.

run_check 🔒

cast keychain check / cast keychain info — query on-chain key status.

run_doctor 🔒

cast keychain doctor — diagnose access-key signing failures.

run_inspect 🔒

cast keychain inspect <key_address> — inspect on-chain key policy.

run_is_admin 🔒

cast keychain is-admin — check whether a key is the root or an active admin key (T6).

run_is_witness_burned 🔒

cast keychain is-witness-burned — check TIP-1053 witness burn state.

run_key_auth_encode 🔒

run_key_auth_inspect 🔒

cast key-authorization inspect — decode a signed or unsigned key authorization and print its fields, including the T6 is_admin / account fields.

run_key_auth_sign 🔒

run_list 🔒

cast keychain list — display all entries from keys.toml.

run_policy_add_call 🔒

cast keychain policy add-call — merge a selector rule into a target scope.

run_policy_set_limit 🔒

cast keychain policy set-limit — update a spending limit amount.

run_remaining_limit 🔒

cast keychain rl — query remaining spending limit.

run_remove_scope 🔒

cast keychain rs — remove call scope for a target.

run_revoke 🔒

cast keychain revoke / cast keychain rev — revoke a key on-chain.

run_set_scope 🔒

cast keychain ss — set allowed call scopes.

run_show 🔒

cast keychain show <wallet_address> — show keys for a specific wallet.

run_update_limit 🔒

cast keychain ul — update spending limit.

run_verify_keychain 🔒

cast keychain verify / verify-admin — verify a Tempo keychain signature (T6).

sanitize_sponsor_config_error 🔒

select_subject_for_chain 🔒

Step 3 helper: filter candidates to the RPC chain id and pick a single entry.

selector_hex 🔒

selector_rule_to_json 🔒

selector_signature 🔒

send_keychain_tx 🔒

Send calldata to the Tempo AccountKeychain precompile as a root-authorized transaction.

send_keychain_tx_with_root_signer 🔒

Send AccountKeychain calldata with an already-resolved root signer.

signature_type_label 🔒

signature_type_name 🔒

tempo_keys_path_display 🔒

unix_timestamp_now 🔒

validate_admin_key_authorization 🔒

Enforce the T6 admin access-key invariants when constructing a key authorization.

validate_pending_key_authorization 🔒

wallet_type_name 🔒