@gbuerk/gcrypt 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gavin Buerk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,167 @@
+# @gbuerk/gcrypt
+
+Store encrypted, signed `.env` and JSON configuration in Git. `gcrypt` uses
+[age](https://age-encryption.org/) encryption and Node.js cryptography, so it
+does not require an installed `age` binary.
+
+Each team member has a decryption key and a signing key. A listed maintainer
+must sign every version before `gcrypt` will decrypt or change it.
+
+## Requirements
+
+- Node.js 22.13 or later (Node 23 requires 23.5 or later)
+- A Git repository for the encrypted configuration file
+
+## Install
+
+Install `gcrypt` in the project that owns the configuration:
+
+```bash
+npm install --save-dev @gbuerk/gcrypt
+npx gcrypt init
+```
+
+`init` creates `.env.dev.enc`, adds helper scripts to `package.json`, and
+wraps the existing `dev` script. It asks before replacing any existing scripts.
+It also creates an empty `.env.example` when one does not exist.
+
+The private keys are stored locally at:
+
+```text
+~/.config/gcrypt/keys/default.txt
+~/.config/gcrypt/signing/default.txt
+```
+
+Never commit, share, or copy these private keys. Add the generated
+`.env.dev.enc` to Git; it contains encrypted values and public team metadata.
+
+## Team workflow
+
+### 1. Set up a new member
+
+Each developer runs this once from the project:
+
+```bash
+npm run dev:setup
+```
+
+The command prints a versioned member setup code. Send that code and a stable,
+human-readable member ID, such as `alice-smith`, to a maintainer. The setup
+code contains only public keys.
+
+### 2. Grant access
+
+A maintainer grants the new member access, then commits the changed encrypted
+file:
+
+```bash
+npm run secrets:grant -- .env.dev.enc
+```
+
+### 3. Edit configuration
+
+Listed maintainers edit a file using the editor named by `VISUAL` or `EDITOR`:
+
+```bash
+export EDITOR=vim
+npm run secrets -- .env.dev.enc
+```
+
+`gcrypt` verifies maintainer approval before it writes a temporary plaintext
+file. It re-encrypts all values and signs the updated document after editing.
+
+### 4. Run the application
+
+After `gcrypt init`, use the normal development command:
+
+```bash
+npm run dev
+```
+
+The decrypted dotenv values exist only in the environment of the application
+child process.
+
+## Access management
+
+Remove a member's full access and re-encrypt every value for the remaining
+members:
+
+```bash
+npm run secrets:revoke -- .env.dev.enc
+```
+
+To retain decryption access but remove approval rights, demote the member:
+
+```bash
+npm run secrets:maintainer:revoke -- .env.dev.enc
+```
+
+Promote an existing member to maintainer:
+
+```bash
+npm run secrets:maintainer:grant -- .env.dev.enc
+```
+
+Verify signatures and metadata without decrypting:
+
+```bash
+npm run secrets:verify -- .env.dev.enc
+```
+
+Removing a recipient protects future versions only. Rotate any credentials the
+former member may already know.
+
+## JSON files
+
+Create a JSON configuration file by using a `.json.enc` name:
+
+```bash
+npx gcrypt secrets init config.json.enc
+```
+
+JSON documents support top-level scalar values: strings, numbers, booleans,
+and `null`. Nested objects and arrays are not supported.
+
+## Commands
+
+```text
+gcrypt init [file]                 Initialize a project and encrypted dotenv file
+gcrypt setup                       Create or show the local member setup code
+gcrypt grant [file]                Add a member from their setup code
+gcrypt revoke [file]               Remove a member's access
+gcrypt maintainer grant [file]     Give an existing member approval rights
+gcrypt maintainer revoke [file]    Remove an existing member's approval rights
+gcrypt verify [file]               Verify without decrypting
+gcrypt decrypt [file]              Print plaintext to standard output
+gcrypt edit [file]                 Edit and re-encrypt a file
+gcrypt exec <file> -- <command>    Run a command with decrypted dotenv values
+gcrypt secrets init [file]         Create an encrypted dotenv or JSON file
+```
+
+When the file argument is omitted in an interactive terminal, `gcrypt` offers
+encrypted files found below the current directory.
+
+## Security model
+
+- Values are encrypted independently for all current recipients using age
+  X25519 recipients.
+- Document metadata and encrypted values are signed with Ed25519 keys.
+- Any listed maintainer may approve a version; at least one valid maintainer
+  signature is required.
+- Public member IDs, recipients, signing keys, and roles are stored in the
+  encrypted file's metadata so the team can review access changes in Git.
+
+`gcrypt` does not protect secrets that have already been decrypted, copied, or
+committed in prior Git history. Use normal credential rotation and access
+controls alongside this tool.
+
+## Publishing
+
+This repository does not commit `dist/`. `npm pack` and `npm publish` run the
+TypeScript build through the `prepack` lifecycle script, and the package ships
+only the generated `dist/` directory plus standard npm files such as this
+README and the license.
+
+## License
+
+[MIT](LICENSE)

package/dist/commands.d.ts

@@ -0,0 +1,49 @@
+import { type DocumentMember } from './document.js';
+export declare const managedFileWarning = "Do not manually edit this file. Use gcrypt instead.";
+export interface ChangePrompt {
+    memberId?: () => Promise<string>;
+    memberSetupCode?: () => Promise<string>;
+}
+export interface CommandOptions {
+    homeDirectory?: string;
+    prompt: ChangePrompt;
+}
+export interface SetupOptions {
+    homeDirectory?: string;
+    /** @deprecated Identities are now created automatically. */
+    prompt?: {
+        confirm(): Promise<boolean>;
+    };
+}
+export interface SetupResult {
+    age: AgeSetupResult;
+    signing: SigningSetupResult;
+    memberSetupCode: string;
+}
+export interface AgeSetupResult {
+    created: boolean;
+    path: string;
+    recipient: string;
+}
+export interface SigningSetupResult {
+    created: boolean;
+    path: string;
+    publicKey: string;
+}
+export interface InitialDocumentOptions {
+    homeDirectory?: string;
+    members?: DocumentMember[];
+    memberId?: string;
+}
+export declare function maintainerSetup({ homeDirectory }?: SetupOptions): Promise<SigningSetupResult>;
+export declare function setup(options?: SetupOptions): Promise<SetupResult>;
+export declare function grantRecipient(filePath: string, options: CommandOptions): Promise<void>;
+export declare function revokeRecipient(filePath: string, options: CommandOptions): Promise<void>;
+export declare function grantMaintainer(filePath: string, options: CommandOptions): Promise<void>;
+export declare function revokeMaintainer(filePath: string, options: CommandOptions): Promise<void>;
+/** Create a new signed encrypted dotenv or JSON document from plaintext input. */
+export declare function createEncryptedDocument(filePath: string, plaintext: string, options?: InitialDocumentOptions): Promise<void>;
+export declare function verifyEncryptedDocument(filePath: string): Promise<void>;
+export declare function decryptEncryptedDocument(filePath: string, homeDirectory?: string): Promise<string>;
+export declare function editEncryptedDocument(filePath: string, editor: string, homeDirectory?: string): Promise<void>;
+export declare function executeDotenv(filePath: string, command: string[], homeDirectory?: string): Promise<number>;

package/dist/commands.js

@@ -0,0 +1,333 @@
+import { mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { basename, dirname, join } from 'node:path';
+import { spawn } from 'node:child_process';
+import { parse as parseDotenv } from 'dotenv';
+import { ageRecipientForIdentity, decryptValue, encryptValue, generateAgeIdentity, generateSigningIdentity, signDocument, signingPublicKeyForIdentity, validateSigningPublicKey, verifyDocument, } from './crypto.js';
+import { canonicalSigningData, parseEncryptedDocument, renderEncryptedDocument, } from './document.js';
+import { defaultAgeIdentityPath, defaultSigningIdentityPath, readDefaultAgeIdentity, readDefaultSigningIdentity, writeDefaultAgeIdentity, writeDefaultSigningIdentity, } from './key-storage.js';
+import { decodeMemberSetupCode, encodeMemberSetupCode } from './member-setup-code.js';
+export const managedFileWarning = 'Do not manually edit this file. Use gcrypt instead.';
+async function ageSetup({ homeDirectory } = {}) {
+    try {
+        const identity = await readDefaultAgeIdentity(homeDirectory);
+        return { created: false, path: defaultAgeIdentityPath(homeDirectory), recipient: await ageRecipientForIdentity(identity) };
+    }
+    catch (error) {
+        if (!isMissingFile(error))
+            throw error;
+    }
+    const identity = await generateAgeIdentity();
+    return { created: true, path: await writeDefaultAgeIdentity(identity.identity, homeDirectory), recipient: identity.recipient };
+}
+export async function maintainerSetup({ homeDirectory } = {}) {
+    try {
+        const privateKey = await readDefaultSigningIdentity(homeDirectory);
+        return { created: false, path: defaultSigningIdentityPath(homeDirectory), publicKey: signingPublicKeyForIdentity(privateKey) };
+    }
+    catch (error) {
+        if (!isMissingFile(error))
+            throw error;
+    }
+    const identity = generateSigningIdentity();
+    return { created: true, path: await writeDefaultSigningIdentity(identity.privateKey, homeDirectory), publicKey: identity.publicKey };
+}
+export async function setup(options = {}) {
+    const [age, signing] = await Promise.all([ageSetup(options), maintainerSetup(options)]);
+    return { age, signing, memberSetupCode: encodeMemberSetupCode({ recipient: age.recipient, signingKey: signing.publicKey }) };
+}
+export async function grantRecipient(filePath, options) {
+    const memberId = await requested(options.prompt.memberId, 'member ID');
+    validateMemberId(memberId);
+    const { recipient, signingKey } = decodeMemberSetupCode(await requested(options.prompt.memberSetupCode, 'member setup code'));
+    await changeMembers(filePath, options, (members) => {
+        if (members.some((member) => member.id === memberId))
+            throw new Error('Member ID is already listed');
+        if (members.some((member) => member.recipient === recipient))
+            throw new Error('This access key is already assigned to a member');
+        if (members.some((member) => member.signingKey === signingKey))
+            throw new Error('Signing key is already listed');
+        return [...members, { id: memberId, recipient, signingKey, isMaintainer: false }];
+    });
+}
+export async function revokeRecipient(filePath, options) {
+    const memberId = await requested(options.prompt.memberId, 'member ID');
+    await changeMembers(filePath, options, (members) => {
+        const member = members.find((candidate) => candidate.id === memberId);
+        if (!member)
+            throw new Error('Member ID is not listed');
+        if (members.length === 1)
+            throw new Error('Cannot remove the final recipient');
+        if (member.isMaintainer && members.filter((candidate) => candidate.isMaintainer).length === 1)
+            throw new Error('Cannot remove the final maintainer');
+        return members.filter((candidate) => candidate.id !== memberId);
+    });
+}
+export async function grantMaintainer(filePath, options) {
+    const memberId = await requested(options.prompt.memberId, 'member ID');
+    await changeMembers(filePath, options, (members) => {
+        const member = members.find((candidate) => candidate.id === memberId);
+        if (!member)
+            throw new Error('Member ID is not listed');
+        if (member.isMaintainer)
+            throw new Error('Member is already a maintainer');
+        return members.map((candidate) => candidate.id === memberId ? { ...candidate, isMaintainer: true } : candidate);
+    });
+}
+export async function revokeMaintainer(filePath, options) {
+    const memberId = await requested(options.prompt.memberId, 'member ID');
+    await changeMembers(filePath, options, (members) => {
+        const member = members.find((candidate) => candidate.id === memberId);
+        if (!member)
+            throw new Error('Member ID is not listed');
+        if (!member.isMaintainer)
+            throw new Error('Member is not a maintainer');
+        if (members.filter((member) => member.isMaintainer).length === 1)
+            throw new Error('Cannot remove the final maintainer');
+        return members.map((candidate) => candidate.id === memberId ? { ...candidate, isMaintainer: false } : candidate);
+    });
+}
+/** Create a new signed encrypted dotenv or JSON document from plaintext input. */
+export async function createEncryptedDocument(filePath, plaintext, options = {}) {
+    const identity = await readDefaultAgeIdentity(options.homeDirectory);
+    const privateKey = await readDefaultSigningIdentity(options.homeDirectory);
+    const publicKey = signingPublicKeyForIdentity(privateKey);
+    const members = options.members ?? [{ id: options.memberId ?? 'local', recipient: await ageRecipientForIdentity(identity), signingKey: publicKey, isMaintainer: true }];
+    const metadata = metadataForMembers(members);
+    const format = filePath.endsWith('.json.enc') || filePath.endsWith('.json') ? 'json' : 'dotenv';
+    const source = format === 'json'
+        ? await encryptJson(plaintext, metadata)
+        : await encryptDotenv(plaintext, metadata);
+    const document = parseEncryptedDocument(source, format);
+    const signature = signDocument(canonicalSigningData(document), privateKey);
+    await atomicWrite(filePath, renderMetadata(source, format, { ...document.metadata, signatures: [`${publicKey}:${signature}`] }));
+}
+export async function verifyEncryptedDocument(filePath) {
+    await loadVerifiedDocument(filePath);
+}
+export async function decryptEncryptedDocument(filePath, homeDirectory) {
+    const { document } = await loadVerifiedDocument(filePath);
+    const identity = await readDefaultAgeIdentity(homeDirectory);
+    return decryptParsedDocument(document, identity);
+}
+async function decryptParsedDocument(document, identity) {
+    const values = await Promise.all(document.values.map(({ marker }) => decryptValue(marker, identity)));
+    if (document.format === 'dotenv')
+        return document.values.map(({ key }, index) => `${key}=${values[index]}`).join('\n') + (values.length ? '\n' : '');
+    const decrypted = Object.fromEntries(document.values.map(({ key }, index) => [key, parseJsonScalar(values[index])]));
+    return `${JSON.stringify(decrypted, undefined, 2)}\n`;
+}
+export async function editEncryptedDocument(filePath, editor, homeDirectory) {
+    // Editing must be authorized before a plaintext temporary file is created.
+    const authorized = await loadAuthorizedDocument(filePath, homeDirectory);
+    const plaintext = await decryptParsedDocument(authorized.document, authorized.identity);
+    const directory = await mkdtemp(join(tmpdir(), 'gcrypt-edit-'));
+    const temporaryFile = join(directory, basename(filePath).replace(/\.enc$/u, ''));
+    try {
+        await writeFile(temporaryFile, plaintext, { encoding: 'utf8', mode: 0o600 });
+        const [command, ...arguments_] = editor.trim().split(/\s+/u);
+        if (!command)
+            throw new Error('An editor is required');
+        const result = await new Promise((resolve, reject) => {
+            const child = spawn(command, [...arguments_, temporaryFile], { stdio: 'inherit' });
+            child.once('error', reject);
+            child.once('exit', resolve);
+        });
+        if (result !== 0)
+            throw new Error(`Editor exited with status ${result ?? 'unknown'}`);
+        const updated = await readFile(temporaryFile, 'utf8');
+        await createEncryptedDocument(filePath, updated, {
+            homeDirectory,
+            members: authorized.document.metadata.members,
+        });
+    }
+    finally {
+        await rm(directory, { force: true, recursive: true });
+    }
+}
+export async function executeDotenv(filePath, command, homeDirectory) {
+    if (command.length === 0)
+        throw new Error('A command after -- is required');
+    const { document } = await loadVerifiedDocument(filePath);
+    if (document.format !== 'dotenv')
+        throw new Error('exec supports dotenv files only');
+    const identity = await readDefaultAgeIdentity(homeDirectory);
+    const environment = parseDotenv(await decryptParsedDocument(document, identity));
+    return new Promise((resolve, reject) => {
+        const child = spawn(command[0], command.slice(1), { stdio: 'inherit', env: { ...process.env, ...environment } });
+        child.once('error', reject);
+        child.once('exit', (code) => resolve(code ?? 1));
+    });
+}
+async function changeMembers(filePath, options, update) {
+    const { source, document, format, identity, privateKey, publicKey } = await loadAuthorizedDocument(filePath, options.homeDirectory);
+    const metadata = metadataForMembers(update(document.metadata.members));
+    const plaintextValues = await Promise.all(document.values.map(({ marker }) => decryptValue(marker, identity)));
+    const markers = await Promise.all(plaintextValues.map((value) => encryptValue(value, metadata.recipients)));
+    await writeSignedDocument(filePath, source, document, format, { ...metadata, signatures: document.metadata.signatures }, markers, privateKey, publicKey);
+}
+async function loadAuthorizedDocument(filePath, homeDirectory) {
+    const { source, format, document } = await loadVerifiedDocument(filePath);
+    const identity = await readDefaultAgeIdentity(homeDirectory);
+    const privateKey = await readDefaultSigningIdentity(homeDirectory);
+    const publicKey = signingPublicKeyForIdentity(privateKey);
+    if (!document.metadata.maintainers.includes(publicKey))
+        throw new Error('Local signing identity is not a listed maintainer');
+    return { source, document, format, identity, privateKey, publicKey };
+}
+async function writeSignedDocument(filePath, source, document, format, metadata, markers, privateKey, publicKey) {
+    const updated = { ...document, metadata, values: document.values.map((value, index) => ({ ...value, marker: markers[index] })) };
+    const signature = signDocument(canonicalSigningData(updated), privateKey);
+    const signedMetadata = { ...metadata, signatures: [`${publicKey}:${signature}`] };
+    const renderedValues = renderEncryptedDocument(document, markers);
+    await atomicWrite(filePath, renderMetadata(renderedValues, format, signedMetadata));
+}
+async function loadDocument(filePath) {
+    const source = await readFile(filePath, 'utf8');
+    const format = source.trimStart().startsWith('{') ? 'json' : 'dotenv';
+    return { source, format, document: parseEncryptedDocument(source, format) };
+}
+async function loadVerifiedDocument(filePath) {
+    const loaded = await loadDocument(filePath);
+    validateMaintainers(loaded.document);
+    if (!hasValidSignature(loaded.document))
+        throw new Error('Document does not have a valid maintainer signature');
+    return loaded;
+}
+async function encryptDotenv(plaintext, metadata) {
+    const values = parseDotenv(plaintext);
+    const lines = await Promise.all(Object.entries(values).map(async ([key, value]) => `${key}=${await encryptValue(value, metadata.recipients)}`));
+    return `# WARNING: ${managedFileWarning}\n# gcrypt: 2\n# gcrypt-recipients: ${metadata.recipients.join(',')}\n# gcrypt-maintainers: ${metadata.maintainers.join(',')}\n${metadata.members.map(renderDotenvMember).join('\n')}\n# gcrypt-signature: pending\n\n${lines.join('\n')}\n`;
+}
+async function encryptJson(plaintext, metadata) {
+    let values;
+    try {
+        values = JSON.parse(plaintext);
+    }
+    catch {
+        throw new Error('Invalid JSON document');
+    }
+    if (typeof values !== 'object' || values === null || Array.isArray(values) || Object.hasOwn(values, '$gcrypt'))
+        throw new Error('JSON document must be a top-level object without $gcrypt');
+    const encrypted = { $gcrypt: { warning: managedFileWarning, ...metadata, signatures: ['pending'] } };
+    for (const [key, value] of Object.entries(values)) {
+        if (value !== null && typeof value === 'object')
+            throw new Error(`JSON value ${key} must be a scalar`);
+        encrypted[key] = await encryptValue(JSON.stringify(value), metadata.recipients);
+    }
+    return `${JSON.stringify(encrypted, undefined, 2)}\n`;
+}
+function parseJsonScalar(value) {
+    try {
+        const parsed = JSON.parse(value);
+        if (parsed === null || ['string', 'number', 'boolean'].includes(typeof parsed))
+            return parsed;
+    }
+    catch { /* Older documents encrypted string values directly. */ }
+    return value;
+}
+async function atomicWrite(filePath, value) {
+    const temporary = join(dirname(filePath), `.${basename(filePath)}.${process.pid}.tmp`);
+    await writeFile(temporary, value, { encoding: 'utf8', mode: 0o600 });
+    await rename(temporary, filePath);
+}
+function hasValidSignature(document) {
+    const data = canonicalSigningData(document);
+    const seenSigners = new Set();
+    for (const maintainer of document.metadata.maintainers)
+        validateSigningPublicKey(maintainer);
+    for (const signature of document.metadata.signatures) {
+        const match = /^(ed25519:[A-Za-z0-9_-]+):([A-Za-z0-9_-]+)$/u.exec(signature);
+        if (!match || !document.metadata.maintainers.includes(match[1]) || seenSigners.has(match[1])) {
+            throw new Error('Document has malformed or duplicate maintainer signatures');
+        }
+        seenSigners.add(match[1]);
+        try {
+            if (verifyDocument(data, match[2], match[1]))
+                return true;
+        }
+        catch {
+            throw new Error('Document does not have a valid maintainer signature');
+        }
+    }
+    return false;
+}
+function validateMaintainers(document) {
+    for (const maintainer of document.metadata.maintainers)
+        validateSigningPublicKey(maintainer);
+}
+function renderMetadata(source, format, metadata) {
+    if (format === 'json') {
+        const parsed = JSON.parse(source);
+        parsed.$gcrypt = { warning: managedFileWarning, ...metadata };
+        return `${JSON.stringify(parsed, undefined, 2)}\n`;
+    }
+    const lines = source.split(/(\r\n|\n|\r)/u);
+    const replacement = new Map([
+        ['version', '# gcrypt: 2'],
+        ['recipients', `# gcrypt-recipients: ${metadata.recipients.join(',')}`],
+        ['maintainers', `# gcrypt-maintainers: ${metadata.maintainers.join(',')}`],
+    ]);
+    let wroteSignature = false;
+    let memberIndex = 0;
+    for (let index = 0; index < lines.length; index += 2) {
+        const match = /^\s*#\s*gcrypt(?:-(member|recipients|maintainers|signature))?\s*:/u.exec(lines[index]);
+        if (!match)
+            continue;
+        const name = match[1] ?? 'version';
+        if (name === 'member') {
+            const member = metadata.members[memberIndex];
+            lines[index] = member ? renderDotenvMember(member) : '';
+            memberIndex += 1;
+        }
+        else if (name === 'signature') {
+            if (wroteSignature)
+                lines[index] = '';
+            else {
+                lines[index] = `# gcrypt-signature: ${metadata.signatures[0]}`;
+                wroteSignature = true;
+            }
+        }
+        else
+            lines[index] = replacement.get(name);
+    }
+    if (!wroteSignature) {
+        const maintainerIndex = lines.findIndex((line) => line.startsWith('# gcrypt-maintainers:'));
+        lines.splice(maintainerIndex + 2, 0, `# gcrypt-signature: ${metadata.signatures[0]}`, '\n');
+    }
+    const missingMembers = metadata.members.slice(memberIndex).map(renderDotenvMember);
+    if (missingMembers.length > 0) {
+        const signatureIndex = lines.findIndex((line) => line.startsWith('# gcrypt-signature:'));
+        lines.splice(signatureIndex === -1 ? lines.length : signatureIndex, 0, ...missingMembers.flatMap((line) => [line, '\n']));
+    }
+    const rendered = lines.join('');
+    return rendered.startsWith(`# WARNING: ${managedFileWarning}`) ? rendered : `# WARNING: ${managedFileWarning}\n${rendered}`;
+}
+function metadataForMembers(members) {
+    return {
+        version: 2,
+        members,
+        recipients: members.map(({ recipient }) => recipient),
+        maintainers: members.flatMap(({ signingKey, isMaintainer }) => isMaintainer ? [signingKey] : []),
+        signatures: [],
+    };
+}
+function renderDotenvMember({ id, recipient, signingKey, isMaintainer }) {
+    return `# gcrypt-member: ${id},${recipient},${signingKey},${isMaintainer}`;
+}
+function validateMemberId(memberId) {
+    if (/\s|,/u.test(memberId))
+        throw new Error('Member ID must not contain spaces or commas');
+}
+async function requested(request, name) {
+    if (!request)
+        throw new Error(`A ${name} prompt is required`);
+    const value = (await request()).trim();
+    if (!value)
+        throw new Error(`A ${name} is required`);
+    return value;
+}
+function isMissingFile(error) {
+    return typeof error === 'object' && error !== null && 'code' in error && error.code === 'ENOENT';
+}
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC3E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,KAAK,IAAI,WAAW,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EACH,uBAAuB,EACvB,YAAY,EACZ,YAAY,EACZ,mBAAmB,EACnB,uBAAuB,EACvB,YAAY,EACZ,2BAA2B,EAC3B,wBAAwB,EACxB,cAAc,GACjB,MAAM,aAAa,CAAA;AACpB,OAAO,EACH,oBAAoB,EAKpB,sBAAsB,EACtB,uBAAuB,GAC1B,MAAM,eAAe,CAAA;AACtB,OAAO,EACH,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,GAC9B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAErF,MAAM,CAAC,MAAM,kBAAkB,GAAG,qDAAqD,CAAA;AA0CvF,KAAK,UAAU,QAAQ,CAAC,EAAE,aAAa,KAAmB,EAAE;IACxD,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAA;QAC5D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC,QAAQ,CAAC,EAAE,CAAA;IAC9H,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;IAC1C,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,mBAAmB,EAAE,CAAA;IAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAA;AAClI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAE,aAAa,KAAmB,EAAE;IACtE,IAAI,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,aAAa,CAAC,CAAA;QAClE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,2BAA2B,CAAC,UAAU,CAAC,EAAE,CAAA;IAClI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAA;IAC1C,CAAC;IACD,MAAM,QAAQ,GAAG,uBAAuB,EAAE,CAAA;IAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,2BAA2B,CAAC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,SAAS,EAAE,CAAA;AACxI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,UAAwB,EAAE;IAClD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACvF,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,qBAAqB,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,CAAA;AAChI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,OAAuB;IAC1E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACtE,gBAAgB,CAAC,QAAQ,CAAC,CAAA;IAC1B,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,qBAAqB,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAC7H,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/C,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,KAAK,QAAQ,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAA;QACpG,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QAChI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,KAAK,UAAU,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAA;QAChH,OAAO,CAAC,GAAG,OAAO,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAuB;IAC3E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACtE,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;QACrE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAA;QAC9E,IAAI,MAAM,CAAC,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACpJ,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAgB,EAAE,OAAuB;IAC3E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACtE,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;QACrE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QACvD,IAAI,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;QAC1E,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACnH,CAAC,CAAC,CAAA;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,QAAgB,EAAE,OAAuB;IAC5E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAA;IACtE,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAA;QACrE,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAA;QACvD,IAAI,CAAC,MAAM,CAAC,YAAY;YAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAA;QACvE,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAA;QACvH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACpH,CAAC,CAAC,CAAA;AACN,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB,EAAE,SAAiB,EAAE,UAAkC,EAAE;IACnH,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IACpE,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;IAC1E,MAAM,SAAS,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAA;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAA;IACvK,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC5C,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC/F,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM;QAC5B,CAAC,CAAC,MAAM,WAAW,CAAC,SAAS,EAAE,QAAQ,CAAC;QACxC,CAAC,CAAC,MAAM,aAAa,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;IAC9C,MAAM,QAAQ,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAA;IAC1E,MAAM,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;AACpI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAAgB;IAC1D,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;AACxC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,QAAgB,EAAE,aAAsB;IACnF,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACzD,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAA;IAC5D,OAAO,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;AACpD,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,QAAwB,EAAE,QAAgB;IAC3E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IACrG,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;IACpJ,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACpH,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,QAAgB,EAAE,MAAc,EAAE,aAAsB;IAChG,2EAA2E;IAC3E,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAA;IACxE,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAAC,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAA;IACvF,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,CAAC,CAAC,CAAA;IAC/D,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAA;IAChF,IAAI,CAAC;QACD,MAAM,SAAS,CAAC,aAAa,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC5E,MAAM,CAAC,OAAO,EAAE,GAAG,UAAU,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;QAC5D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAChE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,UAAU,EAAE,aAAa,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAClF,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;QAC/B,CAAC,CAAC,CAAA;QACF,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,IAAI,SAAS,EAAE,CAAC,CAAA;QACrF,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC,CAAA;QACrD,MAAM,uBAAuB,CAAC,QAAQ,EAAE,OAAO,EAAE;YAC7C,aAAa;YACb,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO;SAChD,CAAC,CAAA;IACN,CAAC;YAAS,CAAC;QACP,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAiB,EAAE,aAAsB;IAC3F,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;IAC3E,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACzD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IACpF,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,qBAAqB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IAChF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,WAAW,EAAE,EAAE,CAAC,CAAA;QAChH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,QAAgB,EAAE,OAAuB,EAAE,MAAuD;IAC3H,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,aAAa,CAAC,CAAA;IACnI,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;IACtE,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IAC9G,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAC3G,MAAM,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,CAAC,CAAA;AAC5J,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,QAAgB,EAAE,aAAsB;IAC1E,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IACzE,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,CAAA;IAC5D,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,aAAa,CAAC,CAAA;IAClE,MAAM,SAAS,GAAG,2BAA2B,CAAC,UAAU,CAAC,CAAA;IACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAA;IAC5H,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AACxE,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAwB,EAAE,MAAsB,EAAE,QAA0B,EAAE,OAAiB,EAAE,UAAkB,EAAE,SAAiB;IACvM,MAAM,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAA;IAChI,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAA;IACzE,MAAM,cAAc,GAAG,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC,GAAG,SAAS,IAAI,SAAS,EAAE,CAAC,EAAE,CAAA;IACjF,MAAM,cAAc,GAAG,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACjE,MAAM,WAAW,CAAC,QAAQ,EAAE,cAAc,CAAC,cAAc,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IACxC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAA;IACrE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAA;AAC/E,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IAChD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAA;IAC3C,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACpC,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;IAC/G,OAAO,MAAM,CAAA;AACjB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,QAA0B;IACtE,MAAM,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IACrC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,MAAM,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/I,OAAO,cAAc,kBAAkB,uCAAuC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,2BAA2B,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oCAAoC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAA;AACxR,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,SAAiB,EAAE,QAA0B;IACpE,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;IAAC,CAAC;IACzF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAA;IAC3L,MAAM,SAAS,GAA4B,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,CAAA;IAC7H,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,mBAAmB,CAAC,CAAA;QACtG,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,UAAU,CAAC,CAAA;IACnF,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAA;AACzD,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IAClC,IAAI,CAAC;QACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,MAAM,CAAC;YAAE,OAAO,MAA0C,CAAA;IACrI,CAAC;IAAC,MAAM,CAAC,CAAC,uDAAuD,CAAC,CAAC;IACnE,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,KAAa;IACtD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;IACtF,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;AACrC,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAwB;IAC/C,MAAM,IAAI,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW;QAAE,wBAAwB,CAAC,UAAU,CAAC,CAAA;IAC5F,KAAK,MAAM,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,8CAA8C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC5E,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;QAChF,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,CAAC;YACD,IAAI,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAA;QAC7D,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;QAC1E,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAwB;IACjD,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW;QAAE,wBAAwB,CAAC,UAAU,CAAC,CAAA;AAChG,CAAC;AAED,SAAS,cAAc,CAAC,MAAc,EAAE,MAAsB,EAAE,QAA0B;IACtF,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA4B,CAAA;QAC5D,MAAM,CAAC,OAAO,GAAG,EAAE,OAAO,EAAE,kBAAkB,EAAE,GAAG,QAAQ,EAAE,CAAA;QAC7D,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAA;IACtD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAA;IAC3C,MAAM,WAAW,GAAG,IAAI,GAAG,CAAiB;QACxC,CAAC,SAAS,EAAE,aAAa,CAAC;QAC1B,CAAC,YAAY,EAAE,wBAAwB,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,CAAC,aAAa,EAAE,yBAAyB,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;KAC7E,CAAC,CAAA;IACF,IAAI,cAAc,GAAG,KAAK,CAAA;IAC1B,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,oEAAoE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;QACrG,IAAI,CAAC,KAAK;YAAE,SAAQ;QACpB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,SAAS,CAAA;QAClC,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;YAC5C,KAAK,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;YACvD,WAAW,IAAI,CAAC,CAAA;QACpB,CAAC;aAAM,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YAC9B,IAAI,cAAc;gBAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAA;iBAChC,CAAC;gBACF,KAAK,CAAC,KAAK,CAAC,GAAG,uBAAuB,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;gBAC9D,cAAc,GAAG,IAAI,CAAA;YACzB,CAAC;QACL,CAAC;;YAAM,KAAK,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;IAChD,CAAC;IACD,IAAI,CAAC,cAAc,EAAE,CAAC;QAClB,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAC,CAAA;QAC3F,KAAK,CAAC,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC,EAAE,uBAAuB,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,CAAA;IAC/F,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;IAClF,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,cAAc,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,CAAA;QACxF,KAAK,CAAC,MAAM,CAAC,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;IAC7H,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAC/B,OAAO,QAAQ,CAAC,UAAU,CAAC,cAAc,kBAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc,kBAAkB,KAAK,QAAQ,EAAE,CAAA;AAC/H,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAyB;IACjD,OAAO;QACH,OAAO,EAAE,CAAC;QACV,OAAO;QACP,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC;QACrD,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChG,UAAU,EAAE,EAAE;KACjB,CAAA;AACL,CAAC;AAED,SAAS,kBAAkB,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAkB;IACnF,OAAO,oBAAoB,EAAE,IAAI,SAAS,IAAI,UAAU,IAAI,YAAY,EAAE,CAAA;AAC9E,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB;IACtC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAA;AAC9F,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAA4C,EAAE,IAAY;IAC/E,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,qBAAqB,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;IACtC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC,CAAA;IACpD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACjC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAA;AACpG,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,18 @@
+export interface AgeIdentity {
+    identity: string;
+    recipient: string;
+}
+export interface SigningIdentity {
+    privateKey: string;
+    publicKey: string;
+}
+export declare function generateAgeIdentity(): Promise<AgeIdentity>;
+export declare function ageRecipientForIdentity(identity: string): Promise<string>;
+export declare function encryptValue(value: string, recipients: string[]): Promise<string>;
+export declare function decryptValue(encryptedValue: string, identity: string): Promise<string>;
+export declare function generateSigningIdentity(): SigningIdentity;
+export declare function signDocument(document: string, privateKey: string): string;
+export declare function verifyDocument(document: string, signature: string, publicKey: string): boolean;
+export declare function signingPublicKeyForIdentity(privateKey: string): string;
+export declare function validateAgeRecipient(recipient: string): void;
+export declare function validateSigningPublicKey(publicKey: string): void;