@sebastienrousseau/crypto-cli 0.0.8 → 0.0.24

package/dist/program/cbom.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCbom = void 0;
+const promises_1 = require("node:fs/promises");
+const commander_1 = require("commander");
+const cbom_core_1 = require("../commands/modern/cbom.core");
+const io_1 = require("./io");
+const deliver = async (ctx, document, opts, label) => {
+    const pretty = JSON.stringify(document, null, 2);
+    if (opts.output === undefined) {
+        (0, io_1.emit)(ctx.io, Boolean(opts.json), document, pretty);
+        return;
+    }
+    await (0, promises_1.writeFile)(opts.output, `${pretty}\n`, "utf8");
+    ctx.io.stderr(`${label} written to ${opts.output}\n`);
+};
+const withOutputOptions = (command, what) => command
+    .option("-o, --output <file>", `write the ${what} to a file, not stdout`)
+    .option("--json", `print the ${what} as one line of JSON`);
+const registerScan = (cbom, ctx) => withOutputOptions(cbom
+    .command("scan")
+    .description("Scan source code and print its CBOM")
+    .argument("[directory]", "directory or file to scan", ".")
+    .addOption(new commander_1.Option("-f, --format <format>", "CBOM standard")
+    .choices(cbom_core_1.CBOM_FORMATS)
+    .default("cyclonedx")), "CBOM").action(async (directory, opts) => {
+    await deliver(ctx, await (0, cbom_core_1.buildCbom)(directory, opts.format), opts, "CBOM");
+});
+const registerAudit = (cbom, ctx) => withOutputOptions(cbom
+    .command("audit")
+    .description("Validate and audit a CBOM; exits 1 when the audit status is FAIL")
+    .argument("[file]", "CBOM JSON file; '-' or omitted reads standard input"), "audit report").action(async (file, opts) => {
+    const raw = (await (0, io_1.readInput)(file, ctx.io)).toString("utf8");
+    const result = await (0, cbom_core_1.auditCbomJson)(raw);
+    await deliver(ctx, result, opts, "Audit report");
+    if (result.status === "FAIL")
+        ctx.exitCode = io_1.EXIT.FAILURE;
+});
+const registerCbom = (program, ctx) => {
+    const cbom = program
+        .command("cbom")
+        .description("Generate or audit a Cryptographic Bill of Materials")
+        .helpCommand(false);
+    registerScan(cbom, ctx);
+    registerAudit(cbom, ctx);
+    return cbom;
+};
+exports.registerCbom = registerCbom;
+//# sourceMappingURL=cbom.js.map

package/dist/program/encrypt.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const parseSymmetricKey: (raw: Buffer) => Uint8Array;
+export declare const registerEncrypt: (program: Command, ctx: RunContext) => Command;
+export declare const registerDecrypt: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=encrypt.d.ts.map

package/dist/program/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../src/program/encrypt.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AA6Bd,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,UAQ/C,CAAC;AAgEF,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAU7D,CAAC;AASL,eAAO,MAAM,eAAe,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YA+B7D,CAAC"}

package/dist/program/encrypt.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDecrypt = exports.registerEncrypt = exports.parseSymmetricKey = void 0;
+const high_level_1 = require("@sebastienrousseau/crypto-lib/high-level");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const KEY_LENGTH = 32;
+const HEX_KEY = /^[0-9a-fA-F]{64}$/;
+const BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+const parseSymmetricKey = (raw) => {
+    const text = raw.toString("latin1").trim();
+    if (HEX_KEY.test(text))
+        return Buffer.from(text, "hex");
+    if (raw.length === KEY_LENGTH)
+        return raw;
+    throw new Error(`the key must be ${KEY_LENGTH} bytes: 64 hexadecimal characters ` +
+        `or ${KEY_LENGTH} raw bytes`);
+};
+exports.parseSymmetricKey = parseSymmetricKey;
+const readKey = async (ctx, opts, file) => {
+    const source = { file: opts.keyFile, stdin: opts.keyStdin };
+    const raw = await (0, secrets_1.requireSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.KEY_FLAGS,
+        dataOnStdin: (0, io_1.isStdin)(file),
+        checkMode: true,
+    }, "key");
+    return (0, exports.parseSymmetricKey)(raw);
+};
+const parseSealed = (input) => {
+    const sealed = (0, io_1.valueOrJsonField)(input, "sealed");
+    if (!BASE64.test(sealed)) {
+        throw new Error("the input is not base64 from crypto-cli encrypt");
+    }
+    return Buffer.from(sealed, "base64");
+};
+const secretboxCommand = (program, name, description, input) => (0, secrets_1.withSecretOptions)(program
+    .command(name)
+    .description(description)
+    .argument("[file]", `${input}; '-' or omitted reads standard input`), secrets_1.KEY_FLAGS, {
+    what: "key",
+    format: "32 bytes, as 64 hex characters or raw",
+    takesData: true,
+}).option("--json", "print the result as one line of JSON");
+const registerEncrypt = (program, ctx) => secretboxCommand(program, "encrypt", "Encrypt with XChaCha20-Poly1305 and print the sealed box as base64", "file to encrypt").action(async (file, opts) => {
+    const key = await readKey(ctx, opts, file);
+    const result = high_level_1.secretbox.seal(key, await (0, io_1.readInput)(file, ctx.io));
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, result.sealed);
+});
+exports.registerEncrypt = registerEncrypt;
+const registerDecrypt = (program, ctx) => secretboxCommand(program, "decrypt", "Decrypt the output of encrypt; exits 1 on a wrong key or modified input", "output of encrypt (base64 or its --json line)").action(async (file, opts) => {
+    const key = await readKey(ctx, opts, file);
+    const sealed = parseSealed(await (0, io_1.readInput)(file, ctx.io));
+    let plaintext;
+    try {
+        plaintext = high_level_1.secretbox.open(key, sealed);
+    }
+    catch {
+        throw new Error("decryption failed: wrong key, or the input was modified or truncated");
+    }
+    if (!opts.json) {
+        ctx.io.stdout(plaintext);
+        return;
+    }
+    (0, io_1.emit)(ctx.io, true, {
+        plaintext: Buffer.from(plaintext).toString("base64"),
+        encoding: "base64",
+        algorithm: "xchacha20-poly1305",
+    }, "");
+});
+exports.registerDecrypt = registerDecrypt;
+//# sourceMappingURL=encrypt.js.map

package/dist/program/hash.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerHash: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=hash.d.ts.map

package/dist/program/hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hash.d.ts","sourceRoot":"","sources":["../../src/program/hash.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAM5C,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAcxD,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAexD,CAAC"}

package/dist/program/hash.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerHash = void 0;
+const commander_1 = require("commander");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const registerHash = (program, ctx) => program
+    .command("hash")
+    .description("Hash a file, or standard input when no file is given")
+    .argument("[file]", "file to hash; '-' or omitted reads standard input")
+    .addOption(new commander_1.Option("-a, --algorithm <name>", "hash algorithm")
+    .choices(modern_1.HASH_ALGORITHMS)
+    .default("sha256"))
+    .option("--json", "print the result as one line of JSON")
+    .action(async (file, opts) => {
+    const data = await (0, io_1.readInput)(file, ctx.io);
+    const result = (0, modern_1.hash)({ algorithm: opts.algorithm, data });
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, result.digest);
+});
+exports.registerHash = registerHash;
+//# sourceMappingURL=hash.js.map

package/dist/program/hpke.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare function registerHpke(program: Command, ctx: RunContext): void;
+//# sourceMappingURL=hpke.d.ts.map

package/dist/program/hpke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hpke.d.ts","sourceRoot":"","sources":["../../src/program/hpke.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAM5C,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAyG1E,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CA0DpE"}

package/dist/program/hpke.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerHpke = registerHpke;
+const commander_1 = require("commander");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const KEM_CHOICES = [
+    "x25519-ml-kem-768",
+    "x25519",
+    "p256",
+];
+const AEAD_CHOICES = [
+    "chacha20-poly1305",
+    "aes-128-gcm",
+];
+function stringToHex(text) {
+    const isHex = /^[0-9a-fA-F]*$/.test(text) && text.length % 2 === 0;
+    return isHex ? text : Buffer.from(text, "utf8").toString("hex");
+}
+function executeKeygen(opts, ctx) {
+    const kp = (0, modern_1.hpkeGenerateKeyPair)(opts.kem);
+    const data = {
+        kem: opts.kem,
+        publicKey: kp.publicKey,
+        privateKey: kp.privateKey,
+    };
+    const desc = [
+        `Algorithm:   ${opts.kem}`,
+        `Public Key:  ${kp.publicKey}`,
+        `Private Key: ${kp.privateKey}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeSeal(file, opts, ctx) {
+    const raw = await (0, io_1.readInput)(file, ctx.io);
+    const plaintextHex = raw.toString("hex");
+    const res = (0, modern_1.hpkeSeal)({
+        recipientPublicKey: opts.publicKey,
+        plaintext: plaintextHex,
+        suite: { kem: opts.kem, aead: opts.aead },
+        ...(opts.info !== undefined ? { info: stringToHex(opts.info) } : {}),
+        ...(opts.aad !== undefined ? { aad: stringToHex(opts.aad) } : {}),
+    });
+    const data = {
+        encapsulatedKey: res.encapsulatedKey,
+        ciphertext: res.ciphertext,
+    };
+    const desc = [
+        `Encapsulated: ${res.encapsulatedKey}`,
+        `Ciphertext:   ${res.ciphertext}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeOpen(file, opts, ctx) {
+    const raw = await (0, io_1.readInput)(file, ctx.io);
+    const ciphertext = (0, io_1.valueOrJsonField)(raw, "ciphertext").trim();
+    const res = (0, modern_1.hpkeOpen)({
+        recipientPrivateKey: opts.secretKey,
+        encapsulatedKey: opts.encapsulatedKey,
+        ciphertext,
+        suite: { kem: opts.kem, aead: opts.aead },
+        ...(opts.info !== undefined ? { info: stringToHex(opts.info) } : {}),
+        ...(opts.aad !== undefined ? { aad: stringToHex(opts.aad) } : {}),
+    });
+    const plaintext = Buffer.from(res.plaintext, "hex").toString("utf8");
+    const data = { plaintext, hex: res.plaintext };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, plaintext);
+}
+function registerHpke(program, ctx) {
+    const hpke = program
+        .command("hpke")
+        .description("Hybrid Public Key Encryption (HPKE RFC 9180 and PQ hybrid)");
+    hpke
+        .command("keygen")
+        .description("Generate an HPKE key pair")
+        .addOption(new commander_1.Option("-k, --kem <kem>", "key encapsulation mechanism")
+        .choices(KEM_CHOICES)
+        .default("x25519-ml-kem-768"))
+        .option("--json", "print key pair as JSON")
+        .action((opts) => executeKeygen(opts, ctx));
+    hpke
+        .command("seal [file]")
+        .description("Encrypt a message using HPKE")
+        .requiredOption("-p, --public-key <hex>", "recipient public key (hex)")
+        .addOption(new commander_1.Option("-k, --kem <kem>", "key encapsulation mechanism")
+        .choices(KEM_CHOICES)
+        .default("x25519-ml-kem-768"))
+        .addOption(new commander_1.Option("-a, --aead <aead>", "authenticated encryption algorithm")
+        .choices(AEAD_CHOICES)
+        .default("chacha20-poly1305"))
+        .option("--info <info>", "application-supplied info string")
+        .option("--aad <aad>", "additional authenticated data")
+        .option("--json", "print ciphertext and encapsulated key as JSON")
+        .action((file, opts) => executeSeal(file, opts, ctx));
+    hpke
+        .command("open [file]")
+        .description("Decrypt an HPKE ciphertext")
+        .requiredOption("-s, --secret-key <hex>", "recipient private key (hex)")
+        .requiredOption("-e, --encapsulated-key <hex>", "encapsulated key (hex)")
+        .addOption(new commander_1.Option("-k, --kem <kem>", "key encapsulation mechanism")
+        .choices(KEM_CHOICES)
+        .default("x25519-ml-kem-768"))
+        .addOption(new commander_1.Option("-a, --aead <aead>", "authenticated encryption algorithm")
+        .choices(AEAD_CHOICES)
+        .default("chacha20-poly1305"))
+        .option("--info <info>", "application-supplied info string")
+        .option("--aad <aad>", "additional authenticated data")
+        .option("--json", "print plaintext and hex as JSON")
+        .action((file, opts) => executeOpen(file, opts, ctx));
+}
+//# sourceMappingURL=hpke.js.map

package/dist/program/index.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+import { type CliIO, type RunContext } from "./io";
+export { EXIT, exitOnClosedPipe, processIO, type CliIO, type RunContext, } from "./io";
+export declare const buildProgram: (ctx: RunContext, version: string) => Command;
+export declare const run: (args: string[], io: CliIO) => Promise<number>;
+export declare const main: (args: string[], io: CliIO, menu: () => Promise<void>) => Promise<number>;
+//# sourceMappingURL=index.d.ts.map

package/dist/program/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/program/index.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAkB,MAAM,WAAW,CAAC;AAKpD,OAAO,EAAoB,KAAK,KAAK,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AASrE,OAAO,EACL,IAAI,EACJ,gBAAgB,EAChB,SAAS,EACT,KAAK,KAAK,EACV,KAAK,UAAU,GAChB,MAAM,MAAM,CAAC;AASd,eAAO,MAAM,YAAY,GAAI,KAAK,UAAU,EAAE,SAAS,MAAM,KAAG,OAyB/D,CAAC;AAmBF,eAAO,MAAM,GAAG,GAAU,MAAM,MAAM,EAAE,EAAE,IAAI,KAAK,KAAG,OAAO,CAAC,MAAM,CASnE,CAAC;AAWF,eAAO,MAAM,IAAI,GACf,MAAM,MAAM,EAAE,EACd,IAAI,KAAK,EACT,MAAM,MAAM,OAAO,CAAC,IAAI,CAAC,KACxB,OAAO,CAAC,MAAM,CAShB,CAAC"}

package/dist/program/index.js

@@ -0,0 +1,77 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.main = exports.run = exports.buildProgram = exports.processIO = exports.exitOnClosedPipe = exports.EXIT = void 0;
+const commander_1 = require("commander");
+const version_utils_1 = require("../utils/version.utils");
+const cbom_1 = require("./cbom");
+const hash_1 = require("./hash");
+const encrypt_1 = require("./encrypt");
+const io_1 = require("./io");
+const keygen_1 = require("./keygen");
+const password_1 = require("./password");
+const sign_1 = require("./sign");
+const stream_1 = require("./stream");
+const opaque_1 = require("./opaque");
+const hpke_1 = require("./hpke");
+const kms_1 = require("./kms");
+var io_2 = require("./io");
+Object.defineProperty(exports, "EXIT", { enumerable: true, get: function () { return io_2.EXIT; } });
+Object.defineProperty(exports, "exitOnClosedPipe", { enumerable: true, get: function () { return io_2.exitOnClosedPipe; } });
+Object.defineProperty(exports, "processIO", { enumerable: true, get: function () { return io_2.processIO; } });
+const buildProgram = (ctx, version) => {
+    const program = new commander_1.Command("crypto-cli")
+        .description("Cryptographic operations from the command line. Run without " +
+        "arguments in a terminal for the interactive menu.")
+        .version(version, "-V, --version", "print the version")
+        .helpOption("-h, --help", "print help")
+        .helpCommand(false)
+        .exitOverride()
+        .configureOutput({ writeOut: ctx.io.stdout, writeErr: ctx.io.stderr })
+        .showSuggestionAfterError();
+    (0, hash_1.registerHash)(program, ctx);
+    (0, keygen_1.registerKeygen)(program, ctx);
+    (0, encrypt_1.registerEncrypt)(program, ctx);
+    (0, encrypt_1.registerDecrypt)(program, ctx);
+    (0, sign_1.registerSign)(program, ctx);
+    (0, sign_1.registerVerify)(program, ctx);
+    (0, password_1.registerPassword)(program, ctx);
+    (0, cbom_1.registerCbom)(program, ctx);
+    (0, stream_1.registerStream)(program, ctx);
+    (0, opaque_1.registerOpaque)(program, ctx);
+    (0, hpke_1.registerHpke)(program, ctx);
+    (0, kms_1.registerKms)(program, ctx);
+    return program;
+};
+exports.buildProgram = buildProgram;
+const exitCodeFor = (err, io) => {
+    if (err instanceof commander_1.CommanderError) {
+        return err.exitCode === 0 ? io_1.EXIT.OK : io_1.EXIT.USAGE;
+    }
+    io.stderr(`crypto-cli: ${err.message}\n`);
+    return err instanceof io_1.UsageError ? io_1.EXIT.USAGE : io_1.EXIT.FAILURE;
+};
+const run = async (args, io) => {
+    const ctx = { io, exitCode: io_1.EXIT.OK };
+    const program = (0, exports.buildProgram)(ctx, await (0, version_utils_1.getVersion)());
+    try {
+        await program.parseAsync(args, { from: "user" });
+        return ctx.exitCode;
+    }
+    catch (err) {
+        return exitCodeFor(err, io);
+    }
+};
+exports.run = run;
+const main = async (args, io, menu) => {
+    if (args.length > 0)
+        return (0, exports.run)(args, io);
+    if (io.isTTY) {
+        await menu();
+        return io_1.EXIT.OK;
+    }
+    const ctx = { io, exitCode: io_1.EXIT.OK };
+    io.stderr((0, exports.buildProgram)(ctx, await (0, version_utils_1.getVersion)()).helpInformation());
+    return io_1.EXIT.USAGE;
+};
+exports.main = main;
+//# sourceMappingURL=index.js.map

package/dist/program/io.d.ts

@@ -0,0 +1,35 @@
+export declare const EXIT: {
+    readonly OK: 0;
+    readonly FAILURE: 1;
+    readonly USAGE: 2;
+};
+export type InputSource = AsyncIterable<Buffer | string> | Iterable<Buffer | string>;
+export interface CliIO {
+    stdin: InputSource;
+    stdout: (data: string | Uint8Array) => void;
+    stderr: (text: string) => void;
+    isTTY: boolean;
+    promptSecret?: ((message: string) => Promise<string | undefined>) | undefined;
+}
+export declare class UsageError extends Error {
+}
+export interface RunContext {
+    io: CliIO;
+    exitCode: number;
+}
+export declare const isInteractive: (input: {
+    isTTY?: boolean;
+}, output: {
+    isTTY?: boolean;
+}) => boolean;
+export declare const exitOnClosedPipe: (stream: NodeJS.EventEmitter, exit: (code: number) => void) => NodeJS.EventEmitter<any>;
+export declare const promptHidden: (message: string) => Promise<string | undefined>;
+export declare const secretPrompt: (stdin: {
+    isTTY?: boolean;
+}) => ((message: string) => Promise<string | undefined>) | undefined;
+export declare const processIO: () => CliIO;
+export declare const isStdin: (file: string | undefined) => file is undefined | "-";
+export declare const readInput: (file: string | undefined, io: CliIO) => Promise<Buffer<ArrayBuffer>>;
+export declare const valueOrJsonField: (input: Buffer, field: string) => string;
+export declare const emit: (io: CliIO, json: boolean, data: unknown, text: string) => void;
+//# sourceMappingURL=io.d.ts.map

package/dist/program/io.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"io.d.ts","sourceRoot":"","sources":["../../src/program/io.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,IAAI;;;;CAA2C,CAAC;AAG7D,MAAM,MAAM,WAAW,GACrB,aAAa,CAAC,MAAM,GAAG,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC;AAG7D,MAAM,WAAW,KAAK;IAEpB,KAAK,EAAE,WAAW,CAAC;IAEnB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC;IAE5C,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAE/B,KAAK,EAAE,OAAO,CAAC;IAKf,YAAY,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,GAAG,SAAS,CAAC;CAC/E;AAMD,qBAAa,UAAW,SAAQ,KAAK;CAAG;AAGxC,MAAM,WAAW,UAAU;IAEzB,EAAE,EAAE,KAAK,CAAC;IAEV,QAAQ,EAAE,MAAM,CAAC;CAClB;AASD,eAAO,MAAM,aAAa,GACxB,OAAO;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,EAC1B,QAAQ;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,YACY,CAAC;AAO1C,eAAO,MAAM,gBAAgB,GAC3B,QAAQ,MAAM,CAAC,YAAY,EAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,6BAK1B,CAAC;AASL,eAAO,MAAM,YAAY,GAAU,SAAS,MAAM,gCAQjD,CAAC;AAQF,eAAO,MAAM,YAAY,GAAI,OAAO;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,gBAhBX,MAAM,6CAiBV,CAAC;AAGzC,eAAO,MAAM,SAAS,QAAO,KAM3B,CAAC;AAgBH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,GAAG,SAAS,KAAG,IAAI,IAAI,SAAS,GAAG,GACnC,CAAC;AASrC,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,GAAG,SAAS,EAAE,IAAI,KAAK,iCACT,CAAC;AAUrD,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,EAAE,OAAO,MAAM,KAAG,MAQ/D,CAAC;AAWF,eAAO,MAAM,IAAI,GAAI,IAAI,KAAK,EAAE,MAAM,OAAO,EAAE,MAAM,OAAO,EAAE,MAAM,MAAM,SACpB,CAAC"}

package/dist/program/io.js

@@ -0,0 +1,65 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emit = exports.valueOrJsonField = exports.readInput = exports.isStdin = exports.processIO = exports.secretPrompt = exports.promptHidden = exports.exitOnClosedPipe = exports.isInteractive = exports.UsageError = exports.EXIT = void 0;
+const promises_1 = require("node:fs/promises");
+const prompts_1 = __importDefault(require("prompts"));
+exports.EXIT = { OK: 0, FAILURE: 1, USAGE: 2 };
+class UsageError extends Error {
+}
+exports.UsageError = UsageError;
+const isInteractive = (input, output) => Boolean(input.isTTY && output.isTTY);
+exports.isInteractive = isInteractive;
+const exitOnClosedPipe = (stream, exit) => stream.on("error", (err) => {
+    if (err.code !== "EPIPE")
+        throw err;
+    exit(exports.EXIT.OK);
+});
+exports.exitOnClosedPipe = exitOnClosedPipe;
+const promptHidden = async (message) => {
+    const answer = await (0, prompts_1.default)({
+        type: "password",
+        name: "secret",
+        message,
+        stdout: process.stderr,
+    });
+    return answer.secret;
+};
+exports.promptHidden = promptHidden;
+const secretPrompt = (stdin) => stdin.isTTY ? exports.promptHidden : undefined;
+exports.secretPrompt = secretPrompt;
+const processIO = () => ({
+    stdin: process.stdin,
+    stdout: (data) => process.stdout.write(data),
+    stderr: (text) => process.stderr.write(text),
+    isTTY: (0, exports.isInteractive)(process.stdin, process.stdout),
+    promptSecret: (0, exports.secretPrompt)(process.stdin),
+});
+exports.processIO = processIO;
+const readAll = async (stream) => {
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    return Buffer.concat(chunks);
+};
+const isStdin = (file) => file === undefined || file === "-";
+exports.isStdin = isStdin;
+const readInput = (file, io) => (0, exports.isStdin)(file) ? readAll(io.stdin) : (0, promises_1.readFile)(file);
+exports.readInput = readInput;
+const valueOrJsonField = (input, field) => {
+    const text = input.toString("utf8").trim();
+    if (!text.startsWith("{"))
+        return text;
+    const value = JSON.parse(text)[field];
+    if (typeof value !== "string") {
+        throw new Error(`the JSON input has no "${field}" string`);
+    }
+    return value;
+};
+exports.valueOrJsonField = valueOrJsonField;
+const emit = (io, json, data, text) => io.stdout(`${json ? JSON.stringify(data) : text}\n`);
+exports.emit = emit;
+//# sourceMappingURL=io.js.map

package/dist/program/keygen.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerKeygen: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=keygen.d.ts.map

package/dist/program/keygen.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keygen.d.ts","sourceRoot":"","sources":["../../src/program/keygen.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAQ5C,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AA0B7C,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAoB1D,CAAC"}

package/dist/program/keygen.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerKeygen = void 0;
+const commander_1 = require("commander");
+const keys_1 = require("@sebastienrousseau/crypto-lib/keys");
+const io_1 = require("./io");
+const describe = (key) => [
+    `Algorithm: ${key.algorithm}`,
+    `Key ID:    ${key.kid}`,
+    `Public:    ${key.publicKey}`,
+    `Private:   ${key.privateKey}`,
+].join("\n");
+const registerKeygen = (program, ctx) => program
+    .command("keygen")
+    .description("Generate a key pair (the private key is printed to stdout)")
+    .addOption(new commander_1.Option("-a, --algorithm <name>", "key algorithm")
+    .choices(keys_1.KEY_ALGORITHMS)
+    .makeOptionMandatory())
+    .option("--kid <id>", "key ID (default: thumbprint of the public key)")
+    .addOption(new commander_1.Option("--use <use>", "intended key usage").choices(["sig", "enc"]))
+    .option("--json", "print the key pair as one line of JSON")
+    .action((opts) => {
+    const metadata = {};
+    if (opts.kid !== undefined)
+        metadata.kid = opts.kid;
+    if (opts.use !== undefined)
+        metadata.use = opts.use;
+    const key = (0, keys_1.generateKeyPair)(opts.algorithm, metadata);
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), key, describe(key));
+});
+exports.registerKeygen = registerKeygen;
+//# sourceMappingURL=keygen.js.map

package/dist/program/kms.d.ts

@@ -0,0 +1,8 @@
+import { Command } from "commander";
+import { type KmsProvider } from "@sebastienrousseau/crypto-kms";
+import { type RunContext } from "./io";
+export declare function registerCliKmsProvider(name: string, provider: KmsProvider): void;
+export declare function resetCliKmsProviders(): void;
+export declare function resolveCliKmsProvider(name?: string): KmsProvider;
+export declare function registerKms(program: Command, ctx: RunContext): void;
+//# sourceMappingURL=kms.d.ts.map

package/dist/program/kms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/program/kms.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,EACL,KAAK,WAAW,EAMjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAM1E,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,WAAW,GACpB,IAAI,CAEN;AAGD,wBAAgB,oBAAoB,IAAI,IAAI,CAG3C;AA+CD,wBAAgB,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,WAAW,CAQhE;AAkQD,wBAAgB,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,IAAI,CASnE"}