@sebastienrousseau/crypto-cli 0.0.8 → 0.0.24

package/dist/program/kms.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCliKmsProvider = registerCliKmsProvider;
+exports.resetCliKmsProviders = resetCliKmsProviders;
+exports.resolveCliKmsProvider = resolveCliKmsProvider;
+exports.registerKms = registerKms;
+const commander_1 = require("commander");
+const crypto_kms_1 = require("@sebastienrousseau/crypto-kms");
+const io_1 = require("./io");
+const providerRegistry = new Map();
+providerRegistry.set("local", new crypto_kms_1.LocalKmsProvider());
+function registerCliKmsProvider(name, provider) {
+    providerRegistry.set(name.toLowerCase(), provider);
+}
+function resetCliKmsProviders() {
+    providerRegistry.clear();
+    providerRegistry.set("local", new crypto_kms_1.LocalKmsProvider());
+}
+function createCliAwsProvider() {
+    return new crypto_kms_1.AwsKmsProvider({
+        region: process.env["AWS_REGION"] ?? "us-east-1",
+    });
+}
+function createCliGcpProvider() {
+    return new crypto_kms_1.GcpKmsProvider({
+        projectId: process.env["GCP_PROJECT_ID"] ?? "test-project",
+        locationId: process.env["GCP_LOCATION_ID"] ?? "global",
+        keyRingId: process.env["GCP_KEY_RING_ID"] ?? "test-ring",
+        token: process.env["GCP_AUTH_TOKEN"] ?? "test-token",
+    });
+}
+function createCliVaultProvider() {
+    return new crypto_kms_1.VaultKmsProvider({
+        address: process.env["VAULT_ADDR"] ?? "http://localhost:8200",
+        token: process.env["VAULT_TOKEN"] ?? "test-token",
+    });
+}
+function createCliAzureProvider() {
+    return new crypto_kms_1.AzureKmsProvider({
+        vaultUrl: process.env["AZURE_VAULT_URL"] ?? "https://my-vault.vault.azure.net",
+    });
+}
+function createDefaultCliProvider(key, name) {
+    switch (key) {
+        case "aws":
+            return createCliAwsProvider();
+        case "gcp":
+            return createCliGcpProvider();
+        case "vault":
+            return createCliVaultProvider();
+        case "azure":
+            return createCliAzureProvider();
+        default:
+            throw new Error(`Unsupported KMS provider: ${name}`);
+    }
+}
+function resolveCliKmsProvider(name) {
+    const key = (name ?? "local").toLowerCase();
+    const existing = providerRegistry.get(key);
+    if (existing)
+        return existing;
+    const provider = createDefaultCliProvider(key, name);
+    providerRegistry.set(key, provider);
+    return provider;
+}
+function parseBytes(text) {
+    const isHex = /^[0-9a-fA-F]*$/.test(text) && text.length % 2 === 0;
+    return isHex
+        ? new Uint8Array(Buffer.from(text, "hex"))
+        : new Uint8Array(Buffer.from(text, "utf8"));
+}
+async function executeCreateKey(opts, ctx) {
+    const provider = resolveCliKmsProvider(opts.provider);
+    const meta = await provider.createKey(opts.algorithm, opts.usage);
+    const desc = [
+        `Key ID:    ${meta.keyId}`,
+        `Algorithm: ${meta.algorithm}`,
+        `Usage:     ${meta.usage}`,
+        `Provider:  ${meta.provider}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), meta, desc);
+}
+async function executeWrap(file, opts, ctx) {
+    const rawKey = opts.key
+        ? Buffer.from(opts.key, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const text = (0, io_1.valueOrJsonField)(rawKey, "key").trim();
+    const bytes = parseBytes(text);
+    const provider = resolveCliKmsProvider(opts.provider);
+    if (!provider.wrapKey) {
+        throw new Error(`Provider ${provider.name} does not support wrapKey`);
+    }
+    const res = await provider.wrapKey(opts.keyId, bytes);
+    const desc = [
+        `Key ID:      ${res.keyId}`,
+        `Wrapped Key: ${res.wrappedKey}`,
+        `Provider:    ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), { ...res, provider: provider.name }, desc);
+}
+async function executeUnwrap(file, opts, ctx) {
+    const rawWk = opts.wrappedKey
+        ? Buffer.from(opts.wrappedKey, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const wrappedKey = (0, io_1.valueOrJsonField)(rawWk, "wrappedKey").trim();
+    const provider = resolveCliKmsProvider(opts.provider);
+    if (!provider.unwrapKey) {
+        throw new Error(`Provider ${provider.name} does not support unwrapKey`);
+    }
+    const res = await provider.unwrapKey(opts.keyId, wrappedKey);
+    const hex = Buffer.from(res.unwrappedKey).toString("hex");
+    const data = { unwrappedKey: hex, keyId: res.keyId, provider: provider.name };
+    const desc = [
+        `Key ID:        ${res.keyId}`,
+        `Unwrapped Key: ${hex}`,
+        `Provider:      ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeDataKey(opts, ctx) {
+    const provider = resolveCliKmsProvider(opts.provider);
+    const res = await provider.generateDataKey(opts.keyId, opts.keySpec);
+    const hex = Buffer.from(res.plaintext).toString("hex");
+    const data = {
+        plaintext: hex,
+        ciphertext: res.ciphertext,
+        keyId: opts.keyId,
+        provider: provider.name,
+    };
+    const desc = [
+        `Key ID:     ${opts.keyId}`,
+        `Plaintext:  ${hex}`,
+        `Ciphertext: ${res.ciphertext}`,
+        `Provider:   ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeEncrypt(file, opts, ctx) {
+    const raw = opts.data
+        ? Buffer.from(opts.data, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const text = (0, io_1.valueOrJsonField)(raw, "data").trim();
+    const bytes = parseBytes(text);
+    const provider = resolveCliKmsProvider(opts.provider);
+    const res = await provider.encrypt(opts.keyId, bytes);
+    const data = { ...res, provider: provider.name };
+    const desc = [
+        `Key ID:     ${res.keyId}`,
+        `Ciphertext: ${res.ciphertext}`,
+        `Provider:   ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeDecrypt(file, opts, ctx) {
+    const raw = opts.ciphertext
+        ? Buffer.from(opts.ciphertext, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const ct = (0, io_1.valueOrJsonField)(raw, "ciphertext").trim();
+    const provider = resolveCliKmsProvider(opts.provider);
+    const res = await provider.decrypt(opts.keyId, ct);
+    const text = Buffer.from(res.plaintext).toString("utf8");
+    const hex = Buffer.from(res.plaintext).toString("hex");
+    const data = {
+        plaintext: text,
+        hex,
+        keyId: res.keyId,
+        provider: provider.name,
+    };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, text);
+}
+function registerKmsKeyOps(kms, ctx) {
+    kms
+        .command("create-key")
+        .description("Create a new managed key in KMS")
+        .option("-a, --algorithm <alg>", "Key algorithm", "aes-256-gcm")
+        .addOption(new commander_1.Option("-u, --usage <usage>", "Key usage")
+        .choices(["encrypt", "sign", "wrap"])
+        .default("encrypt"))
+        .option("-p, --provider <name>", "KMS provider (local, aws, gcp, vault, azure)", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (opts) => {
+        await executeCreateKey(opts, ctx);
+    });
+    kms
+        .command("generate-data-key")
+        .description("Generate a Data Encryption Key (DEK) via KMS")
+        .requiredOption("-k, --key-id <id>", "Key ID")
+        .option("-s, --key-spec <spec>", "Key spec (e.g. AES_256)", "AES_256")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (opts) => {
+        await executeDataKey(opts, ctx);
+    });
+}
+function registerKmsWrapOps(kms, ctx) {
+    kms
+        .command("wrap [file]")
+        .description("Wrap (encrypt) a key using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Wrapping Key ID")
+        .option("-w, --key <hex>", "Raw key material to wrap")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeWrap(file, opts, ctx);
+    });
+    kms
+        .command("unwrap [file]")
+        .description("Unwrap a wrapped key using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Wrapping Key ID")
+        .option("-w, --wrapped-key <str>", "Wrapped key string")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeUnwrap(file, opts, ctx);
+    });
+}
+function registerKmsCipherOps(kms, ctx) {
+    kms
+        .command("encrypt [file]")
+        .description("Encrypt data using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Key ID")
+        .option("-d, --data <text>", "Plaintext data to encrypt")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeEncrypt(file, opts, ctx);
+    });
+    kms
+        .command("decrypt [file]")
+        .description("Decrypt ciphertext using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Key ID")
+        .option("-c, --ciphertext <str>", "Ciphertext to decrypt")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeDecrypt(file, opts, ctx);
+    });
+}
+function registerKms(program, ctx) {
+    const kms = program
+        .command("kms")
+        .description("Key Management Service (KMS) operations across native cloud providers");
+    registerKmsKeyOps(kms, ctx);
+    registerKmsWrapOps(kms, ctx);
+    registerKmsCipherOps(kms, ctx);
+}
+//# sourceMappingURL=kms.js.map

package/dist/program/opaque.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerOpaque: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=opaque.d.ts.map

package/dist/program/opaque.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/program/opaque.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAwUzD,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,KAAG,OASlE,CAAC"}

package/dist/program/opaque.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOpaque = void 0;
+const commander_1 = require("commander");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const { pake } = crypto_lib_1.protocols;
+const SUITE_CHOICES = [
+    "P256-SHA256",
+    "ristretto255-SHA512",
+];
+const DEFAULT_SERVER_URL = "http://localhost:3000";
+function parseHex(hex) {
+    return new Uint8Array(Buffer.from(hex, "hex"));
+}
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function getServerUrl(opts) {
+    return (opts.serverUrl || process.env["CRYPTO_SERVER_URL"] || DEFAULT_SERVER_URL);
+}
+async function postJson(baseUrl, path, body) {
+    const url = `${baseUrl.replace(/\/+$/, "")}${path}`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        throw new Error(`failed to connect to server at ${url}: ${err.message}`, { cause: err });
+    }
+    const text = await res.text();
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch (parseErr) {
+        throw new Error(`server returned non-JSON response (HTTP ${res.status}): ${text.slice(0, 100)}`, { cause: parseErr });
+    }
+    if (!res.ok) {
+        const p = json;
+        const msg = p.detail ?? p.title ?? `HTTP ${res.status}`;
+        throw new Error(`OPAQUE server error (${res.status}): ${msg}`);
+    }
+    return json;
+}
+async function promptPassword(ctx, confirm) {
+    const ask = ctx.io.promptSecret;
+    if (ask === undefined) {
+        throw new io_1.UsageError("missing password: pass --password-file <path> or " +
+            "--password-stdin (a prompt needs a terminal on stdin)");
+    }
+    const password = (await ask("Password")) ?? "";
+    if (confirm && (await ask("Repeat the password")) !== password) {
+        throw new Error("the passwords do not match");
+    }
+    return password;
+}
+async function readPassword(ctx, opts, confirm) {
+    const source = {
+        file: opts.passwordFile,
+        stdin: opts.passwordStdin,
+    };
+    const raw = await (0, secrets_1.readSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.PASSWORD_FLAGS,
+        dataOnStdin: false,
+        checkMode: true,
+    });
+    const password = raw === undefined
+        ? await promptPassword(ctx, confirm)
+        : raw.toString("utf8").replace(/\r?\n$/, "");
+    if (password === "")
+        throw new Error("the password is empty");
+    return password;
+}
+async function handleSetup(ctx, opts) {
+    const suite = opts.suite;
+    const setup = pake.createServerSetup({ suite });
+    const fake = pake.createFakeRecord({ suite });
+    const result = {
+        suite,
+        serverPublicKey: toHex(setup.serverPublicKey),
+        serverPrivateKey: toHex(setup.serverPrivateKey),
+        oprfSeed: toHex(setup.oprfSeed),
+        fakeRecord: toHex(pake.serializeRegistrationRecord(fake)),
+    };
+    const formatted = [
+        `OPAQUE Server Setup (${suite}):`,
+        `Server Public Key:  ${result.serverPublicKey}`,
+        `Server Private Key: ${result.serverPrivateKey}`,
+        `OPRF Seed:          ${result.oprfSeed}`,
+        `Fake Record:        ${result.fakeRecord}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, formatted);
+}
+async function handleRegister(id, ctx, opts) {
+    const suite = opts.suite;
+    const serverUrl = getServerUrl(opts);
+    const password = await readPassword(ctx, opts, true);
+    const { request, blind } = pake.createRegistrationRequest(password, {
+        suite,
+    });
+    const initRes = await postJson(serverUrl, "/v2/opaque/register/init", {
+        credentialIdentifier: id,
+        request: toHex(pake.serializeRegistrationRequest(request)),
+        suite,
+    });
+    const responseBytes = parseHex(initRes.data.response);
+    const regResponse = pake.deserializeRegistrationResponse(responseBytes, suite);
+    const { record, exportKey } = pake.finalizeRegistrationRequest(password, blind, regResponse, {}, { suite });
+    await postJson(serverUrl, "/v2/opaque/register/finish", {
+        credentialIdentifier: id,
+        record: toHex(pake.serializeRegistrationRecord(record)),
+        suite,
+    });
+    const result = {
+        status: "registered",
+        credentialIdentifier: id,
+        suite,
+        exportKey: toHex(exportKey),
+    };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, `Registered credential '${id}' successfully`);
+}
+async function handleLogin(id, ctx, opts) {
+    const suite = opts.suite;
+    const serverUrl = getServerUrl(opts);
+    const password = await readPassword(ctx, opts, false);
+    const client = pake.generateKE1(password, { suite });
+    const initRes = await postJson(serverUrl, "/v2/opaque/login/init", {
+        credentialIdentifier: id,
+        ke1: toHex(pake.serializeKE1(client.ke1)),
+        suite,
+    });
+    const ke2Bytes = parseHex(initRes.data.ke2);
+    const ke2 = pake.deserializeKE2(ke2Bytes, suite);
+    const { ke3, sessionKey, exportKey } = pake.generateKE3(client.state, ke2, {});
+    const finishRes = await postJson(serverUrl, "/v2/opaque/login/finish", {
+        sessionId: initRes.data.sessionId,
+        ke3: toHex(pake.serializeKE3(ke3)),
+    });
+    const expectedKey = toHex(sessionKey);
+    if (finishRes.data.sessionKey !== expectedKey) {
+        throw new Error("server session key does not match client session key");
+    }
+    const result = {
+        status: "authenticated",
+        credentialIdentifier: id,
+        suite,
+        sessionKey: expectedKey,
+        exportKey: toHex(exportKey),
+    };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, `Authenticated as '${id}'. Session key: ${expectedKey}`);
+}
+function registerSetup(parent, ctx) {
+    parent
+        .command("setup")
+        .description("Generate server long-term keys and fake record")
+        .addOption(new commander_1.Option("-s, --suite <name>", "ciphersuite")
+        .choices(SUITE_CHOICES)
+        .default("P256-SHA256"))
+        .option("--json", "print result as JSON")
+        .action(async (opts) => handleSetup(ctx, opts));
+}
+function registerRegister(parent, ctx) {
+    (0, secrets_1.withSecretOptions)(parent
+        .command("register <id>")
+        .description("Register a password with an OPAQUE server")
+        .option("-u, --server-url <url>", "server base URL")
+        .addOption(new commander_1.Option("-s, --suite <name>", "ciphersuite")
+        .choices(SUITE_CHOICES)
+        .default("P256-SHA256"))
+        .option("--json", "print result as JSON"), secrets_1.PASSWORD_FLAGS, {
+        what: "password",
+        format: "one trailing line break is ignored",
+        takesData: false,
+    }).action(async (id, opts) => handleRegister(id, ctx, opts));
+}
+function registerLogin(parent, ctx) {
+    (0, secrets_1.withSecretOptions)(parent
+        .command("login <id>")
+        .description("Authenticate against an OPAQUE server")
+        .option("-u, --server-url <url>", "server base URL")
+        .addOption(new commander_1.Option("-s, --suite <name>", "ciphersuite")
+        .choices(SUITE_CHOICES)
+        .default("P256-SHA256"))
+        .option("--json", "print result as JSON"), secrets_1.PASSWORD_FLAGS, {
+        what: "password",
+        format: "one trailing line break is ignored",
+        takesData: false,
+    }).action(async (id, opts) => handleLogin(id, ctx, opts));
+}
+const registerOpaque = (program, ctx) => {
+    const opaque = program
+        .command("opaque")
+        .description("OPAQUE zero-knowledge password authentication (RFC 9807)")
+        .helpCommand(false);
+    registerSetup(opaque, ctx);
+    registerRegister(opaque, ctx);
+    registerLogin(opaque, ctx);
+    return opaque;
+};
+exports.registerOpaque = registerOpaque;
+//# sourceMappingURL=opaque.js.map

package/dist/program/password.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerPassword: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=password.d.ts.map

package/dist/program/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/program/password.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,OAAO,EAOL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AA2Hd,eAAO,MAAM,gBAAgB,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAQjE,CAAC"}

package/dist/program/password.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPassword = void 0;
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const promptPassword = async (ctx, dataOnStdin, confirm) => {
+    const ask = ctx.io.promptSecret;
+    if (ask === undefined || dataOnStdin) {
+        throw new io_1.UsageError("missing password: pass --password-file <path> or " +
+            "--password-stdin (a prompt needs a terminal on stdin)");
+    }
+    const password = (await ask("Password")) ?? "";
+    if (confirm && (await ask("Repeat the password")) !== password) {
+        throw new Error("the passwords do not match");
+    }
+    return password;
+};
+const readPassword = async (ctx, opts, dataOnStdin, confirm) => {
+    const source = {
+        file: opts.passwordFile,
+        stdin: opts.passwordStdin,
+    };
+    const raw = await (0, secrets_1.readSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.PASSWORD_FLAGS,
+        dataOnStdin,
+        checkMode: true,
+    });
+    const password = raw === undefined
+        ? await promptPassword(ctx, dataOnStdin, confirm)
+        : raw.toString("utf8").replace(/\r?\n$/, "");
+    if (password === "")
+        throw new Error("the password is empty");
+    return password;
+};
+const passwordCommand = (command, takesData) => (0, secrets_1.withSecretOptions)(command, secrets_1.PASSWORD_FLAGS, {
+    what: "password",
+    format: "one trailing line break is ignored",
+    takesData,
+}).option("--json", "print the result as one line of JSON");
+const registerHash = (password, ctx) => passwordCommand(password
+    .command("hash")
+    .description("Hash a password with Argon2id (crypto-lib defaults: t=3, " +
+    "m=64 MiB, p=4) and print its PHC string"), false).action(async (opts) => {
+    const secret = await readPassword(ctx, opts, false, true);
+    const { phc, algorithm, params } = (0, modern_1.hashPassword)({ password: secret });
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), { phc, algorithm, params }, phc);
+});
+const registerVerify = (password, ctx) => passwordCommand(password
+    .command("verify")
+    .description("Check a password against a PHC string; exits 1 when it does not match")
+    .argument("[file]", "PHC string (password hash output or its --json line); '-' or " +
+    "omitted reads standard input"), true).action(async (file, opts) => {
+    const secret = await readPassword(ctx, opts, (0, io_1.isStdin)(file), false);
+    const phc = (0, io_1.valueOrJsonField)(await (0, io_1.readInput)(file, ctx.io), "phc");
+    const { valid } = (0, modern_1.verifyPasswordPhc)({ password: secret, phc });
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), { valid }, valid ? "valid" : "invalid");
+    if (!valid)
+        ctx.exitCode = io_1.EXIT.FAILURE;
+});
+const registerPassword = (program, ctx) => {
+    const password = program
+        .command("password")
+        .description("Hash or verify a password (Argon2id)")
+        .helpCommand(false);
+    registerHash(password, ctx);
+    registerVerify(password, ctx);
+    return password;
+};
+exports.registerPassword = registerPassword;
+//# sourceMappingURL=password.js.map

package/dist/program/secrets.d.ts

@@ -0,0 +1,30 @@
+import { Command } from "commander";
+import { type CliIO } from "./io";
+export interface SecretFlags {
+    file: string;
+    stdin: string;
+}
+export interface SecretSource {
+    file?: string | undefined;
+    stdin?: boolean | undefined;
+}
+export declare const KEY_FLAGS: SecretFlags;
+export declare const PASSWORD_FLAGS: SecretFlags;
+export declare const sharedModeWarning: (file: string, mode: number, platform: NodeJS.Platform) => string | undefined;
+export declare const readSecretFile: (file: string, io: CliIO, platform: NodeJS.Platform) => Promise<NonSharedBuffer>;
+export interface SecretHelp {
+    what: string;
+    format: string;
+    takesData: boolean;
+}
+export declare const withSecretOptions: (command: Command, flags: SecretFlags, help: SecretHelp) => Command;
+export interface SecretRequest {
+    io: CliIO;
+    source: SecretSource;
+    flags: SecretFlags;
+    dataOnStdin: boolean;
+    checkMode: boolean;
+}
+export declare const readSecret: (req: SecretRequest) => Promise<Buffer | undefined>;
+export declare const requireSecret: (req: SecretRequest, what: string) => Promise<Buffer<ArrayBufferLike>>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/program/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/program/secrets.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAyB,KAAK,KAAK,EAAE,MAAM,MAAM,CAAC;AAGzD,MAAM,WAAW,WAAW;IAE1B,IAAI,EAAE,MAAM,CAAC;IAEb,KAAK,EAAE,MAAM,CAAC;CACf;AAGD,MAAM,WAAW,YAAY;IAE3B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAE1B,KAAK,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC7B;AAGD,eAAO,MAAM,SAAS,EAAE,WAGvB,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,WAG5B,CAAC;AAeF,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,MAAM,MAAM,EACZ,UAAU,MAAM,CAAC,QAAQ,uBAU1B,CAAC;AAWF,eAAO,MAAM,cAAc,GACzB,MAAM,MAAM,EACZ,IAAI,KAAK,EACT,UAAU,MAAM,CAAC,QAAQ,6BAc1B,CAAC;AAGF,MAAM,WAAW,UAAU;IAEzB,IAAI,EAAE,MAAM,CAAC;IAEb,MAAM,EAAE,MAAM,CAAC;IAEf,SAAS,EAAE,OAAO,CAAC;CACpB;AAUD,eAAO,MAAM,iBAAiB,GAC5B,SAAS,OAAO,EAChB,OAAO,WAAW,EAClB,MAAM,UAAU,YAejB,CAAC;AAGF,MAAM,WAAW,aAAa;IAE5B,EAAE,EAAE,KAAK,CAAC;IAEV,MAAM,EAAE,YAAY,CAAC;IAErB,KAAK,EAAE,WAAW,CAAC;IAEnB,WAAW,EAAE,OAAO,CAAC;IAErB,SAAS,EAAE,OAAO,CAAC;CACpB;AASD,eAAO,MAAM,UAAU,GACrB,KAAK,aAAa,KACjB,OAAO,CAAC,MAAM,GAAG,SAAS,CAe5B,CAAC;AAQF,eAAO,MAAM,aAAa,GAAU,KAAK,aAAa,EAAE,MAAM,MAAM,qCAQnE,CAAC"}

package/dist/program/secrets.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requireSecret = exports.readSecret = exports.withSecretOptions = exports.readSecretFile = exports.sharedModeWarning = exports.PASSWORD_FLAGS = exports.KEY_FLAGS = void 0;
+const promises_1 = require("node:fs/promises");
+const commander_1 = require("commander");
+const io_1 = require("./io");
+exports.KEY_FLAGS = {
+    file: "--key-file",
+    stdin: "--key-stdin",
+};
+exports.PASSWORD_FLAGS = {
+    file: "--password-file",
+    stdin: "--password-stdin",
+};
+const SHARED_MODE_BITS = 0o077;
+const sharedModeWarning = (file, mode, platform) => {
+    if (platform === "win32" || (mode & SHARED_MODE_BITS) === 0) {
+        return undefined;
+    }
+    const octal = (mode & 0o777).toString(8).padStart(3, "0");
+    return (`crypto-cli: warning: ${file} can be read by other users ` +
+        `(mode ${octal}); restrict it with: chmod 600 ${file}\n`);
+};
+exports.sharedModeWarning = sharedModeWarning;
+const readSecretFile = async (file, io, platform) => {
+    const handle = await (0, promises_1.open)(file, "r");
+    try {
+        const warning = (0, exports.sharedModeWarning)(file, (await handle.stat()).mode, platform);
+        if (warning !== undefined)
+            io.stderr(warning);
+        return await handle.readFile();
+    }
+    finally {
+        await handle.close();
+    }
+};
+exports.readSecretFile = readSecretFile;
+const withSecretOptions = (command, flags, help) => {
+    const note = help.takesData ? " (the data must then be a file argument)" : "";
+    const stdinOption = new commander_1.Option(flags.stdin, `read the ${help.what} from standard input${note}`);
+    return command
+        .addOption(new commander_1.Option(`${flags.file} <path>`, `read the ${help.what} from a file: ${help.format}`).conflicts(stdinOption.attributeName()))
+        .addOption(stdinOption);
+};
+exports.withSecretOptions = withSecretOptions;
+const readSecret = async (req) => {
+    const { io, source, flags } = req;
+    if (source.stdin) {
+        if (req.dataOnStdin) {
+            throw new io_1.UsageError(`${flags.stdin} needs the data as a file argument: standard ` +
+                `input cannot carry both`);
+        }
+        return (0, io_1.readInput)(undefined, io);
+    }
+    if (source.file === undefined)
+        return undefined;
+    return req.checkMode
+        ? (0, exports.readSecretFile)(source.file, io, process.platform)
+        : (0, promises_1.readFile)(source.file);
+};
+exports.readSecret = readSecret;
+const requireSecret = async (req, what) => {
+    const secret = await (0, exports.readSecret)(req);
+    if (secret === undefined) {
+        throw new io_1.UsageError(`missing ${what}: pass ${req.flags.file} <path> or ${req.flags.stdin}`);
+    }
+    return secret;
+};
+exports.requireSecret = requireSecret;
+//# sourceMappingURL=secrets.js.map

package/dist/program/sign.d.ts

@@ -0,0 +1,18 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+interface Signer {
+    sign: (privateKey: string, message: Uint8Array) => string;
+    verify: (publicKey: string, message: Uint8Array, signature: string) => boolean;
+}
+export declare const SIGNING_ALGORITHMS: string[];
+interface LoadedKey {
+    algorithm: string;
+    kid?: string | undefined;
+    material: string;
+    signer: Signer;
+}
+export declare const parseKeyFile: (raw: Buffer, field: "privateKey" | "publicKey") => LoadedKey;
+export declare const registerSign: (program: Command, ctx: RunContext) => Command;
+export declare const registerVerify: (program: Command, ctx: RunContext) => Command;
+export {};
+//# sourceMappingURL=sign.d.ts.map

package/dist/program/sign.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign.d.ts","sourceRoot":"","sources":["../../src/program/sign.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAc5C,OAAO,EAOL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AASd,UAAU,MAAM;IACd,IAAI,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,KAAK,MAAM,CAAC;IAC1D,MAAM,EAAE,CACN,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,KACd,OAAO,CAAC;CACd;AAmCD,eAAO,MAAM,kBAAkB,UAAuB,CAAC;AAMvD,UAAU,SAAS;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AA0BD,eAAO,MAAM,YAAY,GACvB,KAAK,MAAM,EACX,OAAO,YAAY,GAAG,WAAW,KAChC,SAmBF,CAAC;AAkEF,eAAO,MAAM,YAAY,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YAoBxD,CAAC;AAiCP,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,YA+B1D,CAAC"}