waschmittel

#!/usr/bin/env zx
//
// resolveIdentity() falls back from exact-label match to "the sole identity
// with this touch policy" so a key created by hand before this script existed
// gets adopted rather than duplicated; ambiguous cases die rather than guess.
// --cleanup deletes by resolved identity one at a time, never via
// `sc_auth delete-all-ctk-identities`, so unrelated FileVault/PIV/login
// smartcard identities are never touched.

import os from 'node:os';