@sebastienrousseau/crypto-cli 0.0.7 → 0.0.9

package/dist/program/io.d.ts

@@ -0,0 +1,35 @@
+export declare const EXIT: {
+    readonly OK: 0;
+    readonly FAILURE: 1;
+    readonly USAGE: 2;
+};
+export type InputSource = AsyncIterable<Buffer | string> | Iterable<Buffer | string>;
+export interface CliIO {
+    stdin: InputSource;
+    stdout: (data: string | Uint8Array) => void;
+    stderr: (text: string) => void;
+    isTTY: boolean;
+    promptSecret?: ((message: string) => Promise<string | undefined>) | undefined;
+}
+export declare class UsageError extends Error {
+}
+export interface RunContext {
+    io: CliIO;
+    exitCode: number;
+}
+export declare const isInteractive: (input: {
+    isTTY?: boolean;
+}, output: {
+    isTTY?: boolean;
+}) => boolean;
+export declare const exitOnClosedPipe: (stream: NodeJS.EventEmitter, exit: (code: number) => void) => NodeJS.EventEmitter<any>;
+export declare const promptHidden: (message: string) => Promise<string | undefined>;
+export declare const secretPrompt: (stdin: {
+    isTTY?: boolean;
+}) => ((message: string) => Promise<string | undefined>) | undefined;
+export declare const processIO: () => CliIO;
+export declare const isStdin: (file: string | undefined) => file is undefined | "-";
+export declare const readInput: (file: string | undefined, io: CliIO) => Promise<Buffer<ArrayBuffer>>;
+export declare const valueOrJsonField: (input: Buffer, field: string) => string;
+export declare const emit: (io: CliIO, json: boolean, data: unknown, text: string) => void;
+//# sourceMappingURL=io.d.ts.map

package/dist/program/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/program/io.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,IAAI;;;;CAA2C,CAAC;AAG7D,MAAM,MAAM,WAAW,GACrB,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;AAG7D,MAAM,WAAW,KAAK;IAEpB,KAAK,EAAE,WAAW,CAAC;IAEnB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;IAE5C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/B,KAAK,EAAE,OAAO,CAAC;IAKf,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;CAC/E;AAMD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAGxC,MAAM,WAAW,UAAU;IAEzB,EAAE,EAAE,KAAK,CAAC;IAEV,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD,eAAO,MAAM,aAAa,GACxB,OAAO;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC1B,QAAQ;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,YACY,CAAC;AAO1C,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,CAAC,YAAY,EAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,6BAK1B,CAAC;AASL,eAAO,MAAM,YAAY,GAAU,SAAS,MAAM,gCAQjD,CAAC;AAQF,eAAO,MAAM,YAAY,GAAI,OAAO;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,gBAhBX,MAAM,6CAiBV,CAAC;AAGzC,eAAO,MAAM,SAAS,QAAO,KAM3B,CAAC;AAgBH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,IAAI,IAAI,SAAS,GAAG,GACnC,CAAC;AASrC,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,KAAK,iCACT,CAAC;AAUrD,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAQ/D,CAAC;AAWF,eAAO,MAAM,IAAI,GAAI,IAAI,KAAK,EAAE,MAAM,OAAO,EAAE,MAAM,OAAO,EAAE,MAAM,MAAM,SACpB,CAAC"}

package/dist/program/io.js

@@ -0,0 +1,65 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emit = exports.valueOrJsonField = exports.readInput = exports.isStdin = exports.processIO = exports.secretPrompt = exports.promptHidden = exports.exitOnClosedPipe = exports.isInteractive = exports.UsageError = exports.EXIT = void 0;
+const promises_1 = require("node:fs/promises");
+const prompts_1 = __importDefault(require("prompts"));
+exports.EXIT = { OK: 0, FAILURE: 1, USAGE: 2 };
+class UsageError extends Error {
+}
+exports.UsageError = UsageError;
+const isInteractive = (input, output) => Boolean(input.isTTY && output.isTTY);
+exports.isInteractive = isInteractive;
+const exitOnClosedPipe = (stream, exit) => stream.on("error", (err) => {
+    if (err.code !== "EPIPE")
+        throw err;
+    exit(exports.EXIT.OK);
+});
+exports.exitOnClosedPipe = exitOnClosedPipe;
+const promptHidden = async (message) => {
+    const answer = await (0, prompts_1.default)({
+        type: "password",
+        name: "secret",
+        message,
+        stdout: process.stderr,
+    });
+    return answer.secret;
+};
+exports.promptHidden = promptHidden;
+const secretPrompt = (stdin) => stdin.isTTY ? exports.promptHidden : undefined;
+exports.secretPrompt = secretPrompt;
+const processIO = () => ({
+    stdin: process.stdin,
+    stdout: (data) => process.stdout.write(data),
+    stderr: (text) => process.stderr.write(text),
+    isTTY: (0, exports.isInteractive)(process.stdin, process.stdout),
+    promptSecret: (0, exports.secretPrompt)(process.stdin),
+});
+exports.processIO = processIO;
+const readAll = async (stream) => {
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+};
+const isStdin = (file) => file === undefined || file === "-";
+exports.isStdin = isStdin;
+const readInput = (file, io) => (0, exports.isStdin)(file) ? readAll(io.stdin) : (0, promises_1.readFile)(file);
+exports.readInput = readInput;
+const valueOrJsonField = (input, field) => {
+    const text = input.toString("utf8").trim();
+    if (!text.startsWith("{"))
+        return text;
+    const value = JSON.parse(text)[field];
+    if (typeof value !== "string") {
+        throw new Error(`the JSON input has no "${field}" string`);
+    }
+    return value;
+};
+exports.valueOrJsonField = valueOrJsonField;
+const emit = (io, json, data, text) => io.stdout(`${json ? JSON.stringify(data) : text}\n`);
+exports.emit = emit;
+//# sourceMappingURL=io.js.map

package/dist/program/keygen.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerKeygen: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/program/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/program/keygen.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAQ5C,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AA0B7C,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAoB1D,CAAC"}

package/dist/program/keygen.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerKeygen = void 0;
+const commander_1 = require("commander");
+const keys_1 = require("@sebastienrousseau/crypto-lib/keys");
+const io_1 = require("./io");
+const describe = (key) => [
+    `Algorithm: ${key.algorithm}`,
+    `Key ID:    ${key.kid}`,
+    `Public:    ${key.publicKey}`,
+    `Private:   ${key.privateKey}`,
+].join("\n");
+const registerKeygen = (program, ctx) => program
+    .command("keygen")
+    .description("Generate a key pair (the private key is printed to stdout)")
+    .addOption(new commander_1.Option("-a, --algorithm <name>", "key algorithm")
+    .choices(keys_1.KEY_ALGORITHMS)
+    .makeOptionMandatory())
+    .option("--kid <id>", "key ID (default: thumbprint of the public key)")
+    .addOption(new commander_1.Option("--use <use>", "intended key usage").choices(["sig", "enc"]))
+    .option("--json", "print the key pair as one line of JSON")
+    .action((opts) => {
+    const metadata = {};
+    if (opts.kid !== undefined)
+        metadata.kid = opts.kid;
+    if (opts.use !== undefined)
+        metadata.use = opts.use;
+    const key = (0, keys_1.generateKeyPair)(opts.algorithm, metadata);
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), key, describe(key));
+});
+exports.registerKeygen = registerKeygen;
+//# sourceMappingURL=keygen.js.map

package/dist/program/password.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerPassword: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=password.d.ts.map

package/dist/program/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/program/password.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAOL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AA2Hd,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAQjE,CAAC"}

package/dist/program/password.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPassword = void 0;
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const promptPassword = async (ctx, dataOnStdin, confirm) => {
+    const ask = ctx.io.promptSecret;
+    if (ask === undefined || dataOnStdin) {
+        throw new io_1.UsageError("missing password: pass --password-file <path> or " +
+            "--password-stdin (a prompt needs a terminal on stdin)");
+    }
+    const password = (await ask("Password")) ?? "";
+    if (confirm && (await ask("Repeat the password")) !== password) {
+        throw new Error("the passwords do not match");
+    }
+    return password;
+};
+const readPassword = async (ctx, opts, dataOnStdin, confirm) => {
+    const source = {
+        file: opts.passwordFile,
+        stdin: opts.passwordStdin,
+    };
+    const raw = await (0, secrets_1.readSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.PASSWORD_FLAGS,
+        dataOnStdin,
+        checkMode: true,
+    });
+    const password = raw === undefined
+        ? await promptPassword(ctx, dataOnStdin, confirm)
+        : raw.toString("utf8").replace(/\r?\n$/, "");
+    if (password === "")
+        throw new Error("the password is empty");
+    return password;
+};
+const passwordCommand = (command, takesData) => (0, secrets_1.withSecretOptions)(command, secrets_1.PASSWORD_FLAGS, {
+    what: "password",
+    format: "one trailing line break is ignored",
+    takesData,
+}).option("--json", "print the result as one line of JSON");
+const registerHash = (password, ctx) => passwordCommand(password
+    .command("hash")
+    .description("Hash a password with Argon2id (crypto-lib defaults: t=3, " +
+    "m=64 MiB, p=4) and print its PHC string"), false).action(async (opts) => {
+    const secret = await readPassword(ctx, opts, false, true);
+    const { phc, algorithm, params } = (0, modern_1.hashPassword)({ password: secret });
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), { phc, algorithm, params }, phc);
+});
+const registerVerify = (password, ctx) => passwordCommand(password
+    .command("verify")
+    .description("Check a password against a PHC string; exits 1 when it does not match")
+    .argument("[file]", "PHC string (password hash output or its --json line); '-' or " +
+    "omitted reads standard input"), true).action(async (file, opts) => {
+    const secret = await readPassword(ctx, opts, (0, io_1.isStdin)(file), false);
+    const phc = (0, io_1.valueOrJsonField)(await (0, io_1.readInput)(file, ctx.io), "phc");
+    const { valid } = (0, modern_1.verifyPasswordPhc)({ password: secret, phc });
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), { valid }, valid ? "valid" : "invalid");
+    if (!valid)
+        ctx.exitCode = io_1.EXIT.FAILURE;
+});
+const registerPassword = (program, ctx) => {
+    const password = program
+        .command("password")
+        .description("Hash or verify a password (Argon2id)")
+        .helpCommand(false);
+    registerHash(password, ctx);
+    registerVerify(password, ctx);
+    return password;
+};
+exports.registerPassword = registerPassword;
+//# sourceMappingURL=password.js.map

package/dist/program/secrets.d.ts

@@ -0,0 +1,30 @@
+import { Command } from "commander";
+import { type CliIO } from "./io";
+export interface SecretFlags {
+    file: string;
+    stdin: string;
+}
+export interface SecretSource {
+    file?: string | undefined;
+    stdin?: boolean | undefined;
+}
+export declare const KEY_FLAGS: SecretFlags;
+export declare const PASSWORD_FLAGS: SecretFlags;
+export declare const sharedModeWarning: (file: string, mode: number, platform: NodeJS.Platform) => string | undefined;
+export declare const readSecretFile: (file: string, io: CliIO, platform: NodeJS.Platform) => Promise<NonSharedBuffer>;
+export interface SecretHelp {
+    what: string;
+    format: string;
+    takesData: boolean;
+}
+export declare const withSecretOptions: (command: Command, flags: SecretFlags, help: SecretHelp) => Command;
+export interface SecretRequest {
+    io: CliIO;
+    source: SecretSource;
+    flags: SecretFlags;
+    dataOnStdin: boolean;
+    checkMode: boolean;
+}
+export declare const readSecret: (req: SecretRequest) => Promise<Buffer | undefined>;
+export declare const requireSecret: (req: SecretRequest, what: string) => Promise<Buffer<ArrayBufferLike>>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/program/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/program/secrets.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC;AAGzD,MAAM,WAAW,WAAW;IAE1B,IAAI,EAAE,MAAM,CAAC;IAEb,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,YAAY;IAE3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAGD,eAAO,MAAM,SAAS,EAAE,WAGvB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,WAG5B,CAAC;AAeF,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,MAAM,MAAM,EACZ,UAAU,MAAM,CAAC,QAAQ,uBAU1B,CAAC;AAWF,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,IAAI,KAAK,EACT,UAAU,MAAM,CAAC,QAAQ,6BAc1B,CAAC;AAGF,MAAM,WAAW,UAAU;IAEzB,IAAI,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,OAAO,CAAC;CACpB;AAUD,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,OAAO,WAAW,EAClB,MAAM,UAAU,YAejB,CAAC;AAGF,MAAM,WAAW,aAAa;IAE5B,EAAE,EAAE,KAAK,CAAC;IAEV,MAAM,EAAE,YAAY,CAAC;IAErB,KAAK,EAAE,WAAW,CAAC;IAEnB,WAAW,EAAE,OAAO,CAAC;IAErB,SAAS,EAAE,OAAO,CAAC;CACpB;AASD,eAAO,MAAM,UAAU,GACrB,KAAK,aAAa,KACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAe5B,CAAC;AAQF,eAAO,MAAM,aAAa,GAAU,KAAK,aAAa,EAAE,MAAM,MAAM,qCAQnE,CAAC"}

package/dist/program/secrets.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireSecret = exports.readSecret = exports.withSecretOptions = exports.readSecretFile = exports.sharedModeWarning = exports.PASSWORD_FLAGS = exports.KEY_FLAGS = void 0;
+const promises_1 = require("node:fs/promises");
+const commander_1 = require("commander");
+const io_1 = require("./io");
+exports.KEY_FLAGS = {
+    file: "--key-file",
+    stdin: "--key-stdin",
+};
+exports.PASSWORD_FLAGS = {
+    file: "--password-file",
+    stdin: "--password-stdin",
+};
+const SHARED_MODE_BITS = 0o077;
+const sharedModeWarning = (file, mode, platform) => {
+    if (platform === "win32" || (mode & SHARED_MODE_BITS) === 0) {
+        return undefined;
+    }
+    const octal = (mode & 0o777).toString(8).padStart(3, "0");
+    return (`crypto-cli: warning: ${file} can be read by other users ` +
+        `(mode ${octal}); restrict it with: chmod 600 ${file}\n`);
+};
+exports.sharedModeWarning = sharedModeWarning;
+const readSecretFile = async (file, io, platform) => {
+    const handle = await (0, promises_1.open)(file, "r");
+    try {
+        const warning = (0, exports.sharedModeWarning)(file, (await handle.stat()).mode, platform);
+        if (warning !== undefined)
+            io.stderr(warning);
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+};
+exports.readSecretFile = readSecretFile;
+const withSecretOptions = (command, flags, help) => {
+    const note = help.takesData ? " (the data must then be a file argument)" : "";
+    const stdinOption = new commander_1.Option(flags.stdin, `read the ${help.what} from standard input${note}`);
+    return command
+        .addOption(new commander_1.Option(`${flags.file} <path>`, `read the ${help.what} from a file: ${help.format}`).conflicts(stdinOption.attributeName()))
+        .addOption(stdinOption);
+};
+exports.withSecretOptions = withSecretOptions;
+const readSecret = async (req) => {
+    const { io, source, flags } = req;
+    if (source.stdin) {
+        if (req.dataOnStdin) {
+            throw new io_1.UsageError(`${flags.stdin} needs the data as a file argument: standard ` +
+                `input cannot carry both`);
+        }
+        return (0, io_1.readInput)(undefined, io);
+    }
+    if (source.file === undefined)
+        return undefined;
+    return req.checkMode
+        ? (0, exports.readSecretFile)(source.file, io, process.platform)
+        : (0, promises_1.readFile)(source.file);
+};
+exports.readSecret = readSecret;
+const requireSecret = async (req, what) => {
+    const secret = await (0, exports.readSecret)(req);
+    if (secret === undefined) {
+        throw new io_1.UsageError(`missing ${what}: pass ${req.flags.file} <path> or ${req.flags.stdin}`);
+    }
+    return secret;
+};
+exports.requireSecret = requireSecret;
+//# sourceMappingURL=secrets.js.map

package/dist/program/sign.d.ts

@@ -0,0 +1,18 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+interface Signer {
+    sign: (privateKey: string, message: Uint8Array) => string;
+    verify: (publicKey: string, message: Uint8Array, signature: string) => boolean;
+}
+export declare const SIGNING_ALGORITHMS: string[];
+interface LoadedKey {
+    algorithm: string;
+    kid?: string | undefined;
+    material: string;
+    signer: Signer;
+}
+export declare const parseKeyFile: (raw: Buffer, field: "privateKey" | "publicKey") => LoadedKey;
+export declare const registerSign: (program: Command, ctx: RunContext) => Command;
+export declare const registerVerify: (program: Command, ctx: RunContext) => Command;
+export {};
+//# sourceMappingURL=sign.d.ts.map

package/dist/program/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/program/sign.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAc5C,OAAO,EAOL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AASd,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC;IAC1D,MAAM,EAAE,CACN,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;CACd;AAmCD,eAAO,MAAM,kBAAkB,UAAuB,CAAC;AAMvD,UAAU,SAAS;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AA0BD,eAAO,MAAM,YAAY,GACvB,KAAK,MAAM,EACX,OAAO,YAAY,GAAG,WAAW,KAChC,SAmBF,CAAC;AAkEF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAoBxD,CAAC;AAiCP,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YA+B1D,CAAC"}

package/dist/program/sign.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerVerify = exports.registerSign = exports.parseKeyFile = exports.SIGNING_ALGORITHMS = void 0;
+const promises_1 = require("node:fs/promises");
+const commander_1 = require("commander");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const mlDsa = (level) => ({
+    sign: (key, msg) => (0, modern_1.mlDsaSign)(level, key, msg).signature,
+    verify: (key, msg, sig) => (0, modern_1.mlDsaVerify)(level, key, msg, sig).valid,
+});
+const SIGNERS = {
+    ed25519: {
+        sign: (key, msg) => (0, modern_1.ed25519Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.ed25519Verify)(key, msg, sig).valid,
+    },
+    ed448: {
+        sign: (key, msg) => (0, modern_1.ed448Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.ed448Verify)(key, msg, sig).valid,
+    },
+    p256: {
+        sign: (key, msg) => (0, modern_1.p256Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.p256Verify)(key, msg, sig).valid,
+    },
+    p384: {
+        sign: (key, msg) => (0, modern_1.p384Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.p384Verify)(key, msg, sig).valid,
+    },
+    "ml-dsa-44": mlDsa(44),
+    "ml-dsa-65": mlDsa(65),
+    "ml-dsa-87": mlDsa(87),
+};
+exports.SIGNING_ALGORITHMS = Object.keys(SIGNERS);
+const HEX = /^(?:[0-9a-fA-F]{2})+$/;
+const asRecord = (value) => typeof value === "object" && value !== null
+    ? value
+    : {};
+const parseJson = (raw) => {
+    try {
+        return JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        throw new Error("the key file is not JSON from crypto-cli keygen --json");
+    }
+};
+const parseKeyFile = (raw, field) => {
+    const key = asRecord(parseJson(raw));
+    const { algorithm, kid } = key;
+    if (typeof algorithm !== "string" || !Object.hasOwn(SIGNERS, algorithm)) {
+        throw new Error(`the key must be a signing key from crypto-cli keygen --json ` +
+            `(${exports.SIGNING_ALGORITHMS.join(", ")})`);
+    }
+    const material = key[field];
+    if (typeof material !== "string") {
+        throw new Error(`the key file has no ${field}`);
+    }
+    return {
+        algorithm,
+        kid: typeof kid === "string" ? kid : undefined,
+        material,
+        signer: SIGNERS[algorithm],
+    };
+};
+exports.parseKeyFile = parseKeyFile;
+const readKey = async (ctx, opts, file, field) => {
+    const source = { file: opts.keyFile, stdin: opts.keyStdin };
+    const raw = await (0, secrets_1.requireSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.KEY_FLAGS,
+        dataOnStdin: (0, io_1.isStdin)(file),
+        checkMode: field === "privateKey",
+    }, "key");
+    return (0, exports.parseKeyFile)(raw, field);
+};
+const JSON_OPTION = ["--json", "print the result as one line of JSON"];
+const signatureCommand = (program, name, description, key) => (0, secrets_1.withSecretOptions)(program
+    .command(name)
+    .description(description)
+    .argument("[file]", `file to ${name}; '-' or omitted reads standard input`), secrets_1.KEY_FLAGS, { ...key, takesData: true });
+const registerSign = (program, ctx) => signatureCommand(program, "sign", "Sign a file with a key pair from keygen --json and print the " +
+    "signature in hex", {
+    what: "key pair",
+    format: `keygen --json output (${exports.SIGNING_ALGORITHMS.join(", ")})`,
+})
+    .option(...JSON_OPTION)
+    .action(async (file, opts) => {
+    const key = await readKey(ctx, opts, file, "privateKey");
+    const signature = key.signer.sign(key.material, await (0, io_1.readInput)(file, ctx.io));
+    const result = { signature, algorithm: key.algorithm, kid: key.kid };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, signature);
+});
+exports.registerSign = registerSign;
+const readSignature = async (opts) => {
+    if (opts.signature !== undefined)
+        return opts.signature.trim();
+    if (opts.signatureFile === undefined) {
+        throw new io_1.UsageError("missing signature: pass --signature <hex> or --signature-file <path>");
+    }
+    return (0, io_1.valueOrJsonField)(await (0, promises_1.readFile)(opts.signatureFile), "signature");
+};
+const checkSignature = (key, data, signature) => {
+    if (!HEX.test(signature))
+        return false;
+    try {
+        return key.signer.verify(key.material, data, signature);
+    }
+    catch {
+        return false;
+    }
+};
+const registerVerify = (program, ctx) => signatureCommand(program, "verify", "Verify a signature from sign; exits 1 when it is not valid", {
+    what: "public key",
+    format: "keygen --json output, or JSON with algorithm and publicKey",
+})
+    .addOption(new commander_1.Option("--signature <hex>", "the signature, in hex").conflicts("signatureFile"))
+    .option("--signature-file <path>", "read the signature from a file (sign output or its --json line)")
+    .option(...JSON_OPTION)
+    .action(async (file, opts) => {
+    const signature = await readSignature(opts);
+    const key = await readKey(ctx, opts, file, "publicKey");
+    const valid = checkSignature(key, await (0, io_1.readInput)(file, ctx.io), signature);
+    const result = { valid, algorithm: key.algorithm, kid: key.kid };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, valid ? "valid" : "invalid");
+    if (!valid)
+        ctx.exitCode = io_1.EXIT.FAILURE;
+});
+exports.registerVerify = registerVerify;
+//# sourceMappingURL=sign.js.map

package/dist/program/usage.d.ts

@@ -0,0 +1,7 @@
+export declare const USAGE_MARKERS: {
+    readonly start: "<!-- cli-usage:start (generated: pnpm run readme:usage) -->";
+    readonly end: "<!-- cli-usage:end -->";
+};
+export declare const renderUsage: () => string;
+export declare const replaceUsage: (readme: string) => string;
+//# sourceMappingURL=usage.d.ts.map

package/dist/program/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../../src/program/usage.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAgBX,eAAO,MAAM,WAAW,QAAO,MAQ9B,CAAC;AAQF,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAW7C,CAAC"}

package/dist/program/usage.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.replaceUsage = exports.renderUsage = exports.USAGE_MARKERS = void 0;
+const index_1 = require("./index");
+exports.USAGE_MARKERS = {
+    start: "<!-- cli-usage:start (generated: pnpm run readme:usage) -->",
+    end: "<!-- cli-usage:end -->",
+};
+const walk = (command, prefix) => {
+    const name = prefix ? `${prefix} ${command.name()}` : command.name();
+    return [
+        [name, command],
+        ...command.commands.flatMap((sub) => walk(sub, name)),
+    ];
+};
+const renderUsage = () => {
+    const program = (0, index_1.buildProgram)({ io: (0, index_1.processIO)(), exitCode: index_1.EXIT.OK }, "");
+    const sections = walk(program, "").map(([name, command]) => {
+        command.configureHelp({ helpWidth: 80 });
+        return `#### \`${name}\`\n\n\`\`\`text\n${command.helpInformation()}\`\`\`\n`;
+    });
+    return [exports.USAGE_MARKERS.start, "", ...sections, exports.USAGE_MARKERS.end].join("\n");
+};
+exports.renderUsage = renderUsage;
+const replaceUsage = (readme) => {
+    const start = readme.indexOf(exports.USAGE_MARKERS.start);
+    const end = readme.indexOf(exports.USAGE_MARKERS.end);
+    if (start < 0 || end < start) {
+        throw new Error("README.md has no cli-usage block");
+    }
+    return (readme.slice(0, start) +
+        (0, exports.renderUsage)() +
+        readme.slice(end + exports.USAGE_MARKERS.end.length));
+};
+exports.replaceUsage = replaceUsage;
+//# sourceMappingURL=usage.js.map

package/package.json

@@ -12,46 +12,46 @@
     "source": "git",
     "target": "git://github.com/sebastienrousseau/crypto-service.git"
   },
+  "type": "commonjs",
   "bin": {
     "crypto-cli": "dist/cli.js",
     "cryptocli": "dist/cli.js"
   },
+  "exports": {
+    "./package.json": "./package.json"
+  },
   "bugs": {
     "url": "https://github.com/sebastienrousseau/crypto-service/issues"
   },
   "dependencies": {
+    "commander": "^14.0.3",
     "figlet": "^1.6.0",
     "kleur": "^4.1.5",
     "prompts": "^2.4.2",
-    "@sebastienrousseau/crypto-lib": "0.0.7",
-    "@sebastienrousseau/crypto-cbom": "0.0.7"
+    "@sebastienrousseau/crypto-cbom": "0.0.9",
+    "@sebastienrousseau/crypto-lib": "0.0.9"
   },
   "description": "The Crypto Lib Command Line Interface (CLI) is a unified tool to perform common cryptographic operations such as key generation, data encryption, digital signing, and signature verification which are invoked from the command prompt or terminal.",
   "devDependencies": {
-    "@sebastienrousseau/c8-config": "^0.0.3",
-    "@sebastienrousseau/eslint-config": "^0.0.2",
-    "@sebastienrousseau/jsdoc-config": "^0.0.5",
+    "@sebastienrousseau/c8-config": "^0.0.7",
+    "@sebastienrousseau/eslint-config": "^0.0.7",
+    "@sebastienrousseau/jsdoc-config": "^0.0.7",
     "@sebastienrousseau/markdownlint-config": "^0.0.1",
     "@sebastienrousseau/mocha-config": "^0.0.5",
-    "@sebastienrousseau/prettier-config": "^0.0.4",
-    "@sebastienrousseau/remark-config": "^0.0.3",
-    "@types/chai": "^4.3.7",
+    "@sebastienrousseau/prettier-config": "^0.0.7",
+    "@sebastienrousseau/remark-config": "^0.0.7",
+    "@types/chai": "^5.2.3",
     "@types/chai-as-promised": "^8.0.2",
     "@types/figlet": "^1.5.6",
-    "@types/mocha": "^10.0.2",
-    "@types/node": "^26.4.1",
+    "@types/mocha": "^10.0.10",
+    "@types/node": "^26.6.3",
     "@types/prompts": "^2.4.5",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
-    "@typescript-eslint/parser": "^6.21.0",
     "c8": "^12.0.0",
-    "chai": "^4.5.0",
-    "chai-as-promised": "^7.1.2",
-    "eslint": "^8.57.1",
-    "eslint-import-resolver-typescript": "^3.10.1",
-    "eslint-plugin-import": "^2.28.1",
+    "chai": "^6.3.0",
+    "chai-as-promised": "^8.0.2",
     "filesizes": "^0.1.2",
-    "mocha": "^10.8.2",
-    "prettier": "^3.9.8",
+    "mocha": "^12.0.3",
+    "prettier": "^3.9.9",
     "remark-cli": "^12.0.0",
     "remark-footnotes": "^5.0.0",
     "remark-preset-lint-consistent": "^6.0.1",
@@ -86,39 +86,31 @@
     }
   ],
   "homepage": "https://crypto-cli.io",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sebastienrousseau/crypto-service.git",
+    "directory": "packages/crypto-cli"
+  },
   "keywords": [
     "crypto-cli"
   ],
   "license": "MIT OR Apache-2.0",
   "license_URI": "http://www.opensource.org/licenses/mit-license.php",
-  "main": "./dist/cli.js",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "require": "./dist/cli.js",
-      "import": "./dist/cli.js"
-    }
-  },
   "name": "@sebastienrousseau/crypto-cli",
   "private": false,
   "publishConfig": {
     "access": "public"
   },
-  "repository": {
-    "directory": "packages/crypto-cli",
-    "type": "git",
-    "url": "git@github.com:sebastienrousseau/crypto-service.git"
-  },
-  "types": "./dist/index.d.ts",
   "sideEffects": false,
-  "version": "0.0.7",
+  "version": "0.0.9",
   "scripts": {
     "build": "tsc --build tsconfig.json",
     "clean": "rimraf ./coverage ./dist ./docs",
-    "lint": "eslint --ext .ts src __tests__",
-    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "lint": "eslint src __tests__",
+    "lint:fix": "eslint --cache --fix src __tests__",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check \"src/**/*.ts\"",
+    "readme:usage": "node scripts/readme-usage.mjs",
     "start": "node dist/cli.js",
     "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
     "docs": "typedoc"