@sebastienrousseau/crypto-cli 0.0.8 → 0.0.24

package/dist/program/sign.js

@@ -0,0 +1,130 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerVerify = exports.registerSign = exports.parseKeyFile = exports.SIGNING_ALGORITHMS = void 0;
+const promises_1 = require("node:fs/promises");
+const commander_1 = require("commander");
+const modern_1 = require("@sebastienrousseau/crypto-lib/modern");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const mlDsa = (level) => ({
+    sign: (key, msg) => (0, modern_1.mlDsaSign)(level, key, msg).signature,
+    verify: (key, msg, sig) => (0, modern_1.mlDsaVerify)(level, key, msg, sig).valid,
+});
+const SIGNERS = {
+    ed25519: {
+        sign: (key, msg) => (0, modern_1.ed25519Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.ed25519Verify)(key, msg, sig).valid,
+    },
+    ed448: {
+        sign: (key, msg) => (0, modern_1.ed448Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.ed448Verify)(key, msg, sig).valid,
+    },
+    p256: {
+        sign: (key, msg) => (0, modern_1.p256Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.p256Verify)(key, msg, sig).valid,
+    },
+    p384: {
+        sign: (key, msg) => (0, modern_1.p384Sign)(key, msg).signature,
+        verify: (key, msg, sig) => (0, modern_1.p384Verify)(key, msg, sig).valid,
+    },
+    "ml-dsa-44": mlDsa(44),
+    "ml-dsa-65": mlDsa(65),
+    "ml-dsa-87": mlDsa(87),
+};
+exports.SIGNING_ALGORITHMS = Object.keys(SIGNERS);
+const HEX = /^(?:[0-9a-fA-F]{2})+$/;
+const asRecord = (value) => typeof value === "object" && value !== null
+    ? value
+    : {};
+const parseJson = (raw) => {
+    try {
+        return JSON.parse(raw.toString("utf8"));
+    }
+    catch {
+        throw new Error("the key file is not JSON from crypto-cli keygen --json");
+    }
+};
+const parseKeyFile = (raw, field) => {
+    const key = asRecord(parseJson(raw));
+    const { algorithm, kid } = key;
+    if (typeof algorithm !== "string" || !Object.hasOwn(SIGNERS, algorithm)) {
+        throw new Error(`the key must be a signing key from crypto-cli keygen --json ` +
+            `(${exports.SIGNING_ALGORITHMS.join(", ")})`);
+    }
+    const material = key[field];
+    if (typeof material !== "string") {
+        throw new Error(`the key file has no ${field}`);
+    }
+    return {
+        algorithm,
+        kid: typeof kid === "string" ? kid : undefined,
+        material,
+        signer: SIGNERS[algorithm],
+    };
+};
+exports.parseKeyFile = parseKeyFile;
+const readKey = async (ctx, opts, file, field) => {
+    const source = { file: opts.keyFile, stdin: opts.keyStdin };
+    const raw = await (0, secrets_1.requireSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.KEY_FLAGS,
+        dataOnStdin: (0, io_1.isStdin)(file),
+        checkMode: field === "privateKey",
+    }, "key");
+    return (0, exports.parseKeyFile)(raw, field);
+};
+const JSON_OPTION = ["--json", "print the result as one line of JSON"];
+const signatureCommand = (program, name, description, key) => (0, secrets_1.withSecretOptions)(program
+    .command(name)
+    .description(description)
+    .argument("[file]", `file to ${name}; '-' or omitted reads standard input`), secrets_1.KEY_FLAGS, { ...key, takesData: true });
+const registerSign = (program, ctx) => signatureCommand(program, "sign", "Sign a file with a key pair from keygen --json and print the " +
+    "signature in hex", {
+    what: "key pair",
+    format: `keygen --json output (${exports.SIGNING_ALGORITHMS.join(", ")})`,
+})
+    .option(...JSON_OPTION)
+    .action(async (file, opts) => {
+    const key = await readKey(ctx, opts, file, "privateKey");
+    const signature = key.signer.sign(key.material, await (0, io_1.readInput)(file, ctx.io));
+    const result = { signature, algorithm: key.algorithm, kid: key.kid };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, signature);
+});
+exports.registerSign = registerSign;
+const readSignature = async (opts) => {
+    if (opts.signature !== undefined)
+        return opts.signature.trim();
+    if (opts.signatureFile === undefined) {
+        throw new io_1.UsageError("missing signature: pass --signature <hex> or --signature-file <path>");
+    }
+    return (0, io_1.valueOrJsonField)(await (0, promises_1.readFile)(opts.signatureFile), "signature");
+};
+const checkSignature = (key, data, signature) => {
+    if (!HEX.test(signature))
+        return false;
+    try {
+        return key.signer.verify(key.material, data, signature);
+    }
+    catch {
+        return false;
+    }
+};
+const registerVerify = (program, ctx) => signatureCommand(program, "verify", "Verify a signature from sign; exits 1 when it is not valid", {
+    what: "public key",
+    format: "keygen --json output, or JSON with algorithm and publicKey",
+})
+    .addOption(new commander_1.Option("--signature <hex>", "the signature, in hex").conflicts("signatureFile"))
+    .option("--signature-file <path>", "read the signature from a file (sign output or its --json line)")
+    .option(...JSON_OPTION)
+    .action(async (file, opts) => {
+    const signature = await readSignature(opts);
+    const key = await readKey(ctx, opts, file, "publicKey");
+    const valid = checkSignature(key, await (0, io_1.readInput)(file, ctx.io), signature);
+    const result = { valid, algorithm: key.algorithm, kid: key.kid };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, valid ? "valid" : "invalid");
+    if (!valid)
+        ctx.exitCode = io_1.EXIT.FAILURE;
+});
+exports.registerVerify = registerVerify;
+//# sourceMappingURL=sign.js.map

package/dist/program/stream-multi.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+import { type MultiPqRecipient } from "@sebastienrousseau/crypto-lib/streaming";
+import { type RunContext } from "./io";
+export declare const parseMultiChunkSize: (value?: string) => number | undefined;
+export declare const parseRecipients: (value?: string) => MultiPqRecipient[];
+export declare const registerStreamMulti: (stream: Command, ctx: RunContext) => void;
+//# sourceMappingURL=stream-multi.d.ts.map

package/dist/program/stream-multi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-multi.d.ts","sourceRoot":"","sources":["../../src/program/stream-multi.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAIpE,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAS7D,CAAC;AAoCF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,gBAAgB,EAsBhE,CAAC;AA4HF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,EAAE,KAAK,UAAU,KAAG,IAGtE,CAAC"}

package/dist/program/stream-multi.js

@@ -0,0 +1,163 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerStreamMulti = exports.parseRecipients = exports.parseMultiChunkSize = void 0;
+const fs = __importStar(require("node:fs"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
+const io_1 = require("./io");
+const stream_1 = require("./stream");
+const parseMultiChunkSize = (value) => {
+    if (value === undefined)
+        return undefined;
+    const size = Number(value);
+    if (!Number.isSafeInteger(size) || size < 1024 || size > 16777216) {
+        throw new io_1.UsageError("--chunk-size must be an integer between 1024 and 16777216");
+    }
+    return size;
+};
+exports.parseMultiChunkSize = parseMultiChunkSize;
+const validateRecipientItem = (item) => {
+    if (!item ||
+        typeof item !== "object" ||
+        typeof item.recipientId !== "string" ||
+        typeof item.recipientX25519Public !==
+            "string" ||
+        typeof item.recipientMlKemPublic !== "string") {
+        throw new io_1.UsageError("each recipient must have recipientId, recipientX25519Public, and recipientMlKemPublic strings");
+    }
+    return item;
+};
+const parseRecipients = (value) => {
+    if (!value) {
+        throw new io_1.UsageError("missing recipients: --recipients is required (JSON array or file path)");
+    }
+    let raw = value.trim();
+    if (!raw.startsWith("[") && fs.existsSync(raw)) {
+        raw = fs.readFileSync(raw, "utf8").trim();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new io_1.UsageError("invalid JSON in --recipients");
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0) {
+        throw new io_1.UsageError("--recipients must be a non-empty array of recipient objects");
+    }
+    return parsed.map(validateRecipientItem);
+};
+exports.parseRecipients = parseRecipients;
+const registerStreamMultiEncrypt = (stream, ctx) => {
+    stream
+        .command("multi-encrypt")
+        .description("Encrypt for multiple recipients with post-quantum hybrid STREAM AEAD")
+        .argument("[file]", "file to encrypt; '-' or omitted reads standard input")
+        .option("-r, --recipients <json-or-path>", "JSON array string or file path containing recipient public key descriptors")
+        .option("-c, --chunk-size <bytes>", "chunk size in bytes (minimum 1024, default 65536)")
+        .option("--json", "print the result as one line of JSON")
+        .action(async (file, opts) => {
+        const recipients = (0, exports.parseRecipients)(opts.recipients);
+        const chunkSize = (0, exports.parseMultiChunkSize)(opts.chunkSize);
+        const input = await (0, io_1.readInput)(file, ctx.io);
+        const result = (0, streaming_1.streamMultiPqEncrypt)({
+            recipients,
+            plaintext: input,
+            ...(chunkSize !== undefined ? { chunkSize } : {}),
+        });
+        const b64 = Buffer.from(result.ciphertext).toString("base64");
+        (0, io_1.emit)(ctx.io, Boolean(opts.json), {
+            ciphertext: b64,
+            algorithm: result.algorithm,
+            recipientCount: result.recipientCount,
+        }, b64);
+    });
+};
+const executeStreamMultiDecrypt = (ctx, opts, ciphertext, chunkSize) => {
+    let decResult;
+    try {
+        decResult = (0, streaming_1.streamMultiPqDecrypt)({
+            recipientX25519Secret: opts.x25519Secret,
+            recipientMlKemSecret: opts.mlKemSecret,
+            ...(opts.recipientId !== undefined
+                ? { recipientId: opts.recipientId }
+                : {}),
+            ciphertext,
+            ...(chunkSize !== undefined ? { chunkSize } : {}),
+        });
+    }
+    catch {
+        throw new Error("decryption failed: wrong key, or the input was modified or truncated");
+    }
+    if (!opts.json) {
+        ctx.io.stdout(decResult.plaintext);
+        (0, crypto_lib_1.wipeMemory)(decResult.plaintext);
+        return;
+    }
+    const b64 = Buffer.from(decResult.plaintext).toString("base64");
+    (0, crypto_lib_1.wipeMemory)(decResult.plaintext);
+    (0, io_1.emit)(ctx.io, true, {
+        plaintext: b64,
+        recipientId: decResult.recipientId,
+        encoding: "base64",
+        algorithm: "multi-x25519-ml-kem-768-xchacha20-poly1305-stream",
+    }, "");
+};
+const registerStreamMultiDecrypt = (stream, ctx) => {
+    stream
+        .command("multi-decrypt")
+        .description("Decrypt multi-recipient post-quantum hybrid STREAM ciphertext; exits 1 on error")
+        .argument("[file]", "output of stream multi-encrypt (base64 or its --json line)")
+        .option("-x, --x25519-secret <hex>", "recipient X25519 secret key (hex)")
+        .option("-m, --ml-kem-secret <hex>", "recipient ML-KEM-768 secret key (hex)")
+        .option("-i, --recipient-id <id>", "optional recipient identifier for direct slot lookup")
+        .option("-c, --chunk-size <bytes>", "chunk size in bytes")
+        .option("--json", "print the result as one line of JSON")
+        .action(async (file, opts) => {
+        if (!opts.x25519Secret || !opts.mlKemSecret) {
+            throw new io_1.UsageError("missing recipient secret key: both --x25519-secret and --ml-kem-secret are required");
+        }
+        const chunkSize = (0, exports.parseMultiChunkSize)(opts.chunkSize);
+        const ciphertext = (0, stream_1.parseCiphertext)(await (0, io_1.readInput)(file, ctx.io));
+        executeStreamMultiDecrypt(ctx, opts, ciphertext, chunkSize);
+    });
+};
+const registerStreamMulti = (stream, ctx) => {
+    registerStreamMultiEncrypt(stream, ctx);
+    registerStreamMultiDecrypt(stream, ctx);
+};
+exports.registerStreamMulti = registerStreamMulti;
+//# sourceMappingURL=stream-multi.js.map

package/dist/program/stream.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const parseChunkSize: (value?: string) => number | undefined;
+export declare const parseCiphertext: (input: Buffer) => Buffer;
+export declare const registerStream: (program: Command, ctx: RunContext) => void;
+//# sourceMappingURL=stream.d.ts.map

package/dist/program/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/program/stream.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAuBd,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAOxD,CAAC;AAGF,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MAM/C,CAAC;AAqGF,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,KAAG,IAOlE,CAAC"}

package/dist/program/stream.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerStream = exports.parseCiphertext = exports.parseChunkSize = void 0;
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
+const io_1 = require("./io");
+const stream_multi_1 = require("./stream-multi");
+const BASE64 = /^[A-Za-z0-9+/]+={0,2}$/;
+const parseChunkSize = (value) => {
+    if (value === undefined)
+        return undefined;
+    const size = Number(value);
+    if (!Number.isSafeInteger(size) || size < 64) {
+        throw new io_1.UsageError("--chunk-size must be an integer >= 64");
+    }
+    return size;
+};
+exports.parseChunkSize = parseChunkSize;
+const parseCiphertext = (input) => {
+    const text = (0, io_1.valueOrJsonField)(input, "ciphertext");
+    if (!BASE64.test(text)) {
+        throw new Error("the input is not base64 from crypto-cli stream encrypt");
+    }
+    return Buffer.from(text, "base64");
+};
+exports.parseCiphertext = parseCiphertext;
+const registerStreamEncrypt = (stream, ctx) => {
+    stream
+        .command("encrypt")
+        .description("Encrypt with post-quantum hybrid STREAM AEAD (X25519 + ML-KEM-768)")
+        .argument("[file]", "file to encrypt; '-' or omitted reads standard input")
+        .option("-x, --x25519-public <hex>", "recipient X25519 public key (hex)")
+        .option("-m, --ml-kem-public <hex>", "recipient ML-KEM-768 public key (hex)")
+        .option("-c, --chunk-size <bytes>", "chunk size in bytes (minimum 64, default 65536)")
+        .option("--json", "print the result as one line of JSON")
+        .action(async (file, opts) => {
+        if (!opts.x25519Public || !opts.mlKemPublic) {
+            throw new io_1.UsageError("missing recipient public key: both --x25519-public and --ml-kem-public are required");
+        }
+        const chunkSize = (0, exports.parseChunkSize)(opts.chunkSize);
+        const input = await (0, io_1.readInput)(file, ctx.io);
+        const result = (0, streaming_1.streamPqEncrypt)({
+            recipientX25519Public: opts.x25519Public,
+            recipientMlKemPublic: opts.mlKemPublic,
+            plaintext: input,
+            ...(chunkSize !== undefined ? { chunkSize } : {}),
+        });
+        const b64 = Buffer.from(result.ciphertext).toString("base64");
+        (0, io_1.emit)(ctx.io, Boolean(opts.json), { ciphertext: b64, algorithm: result.algorithm }, b64);
+    });
+};
+const registerStreamDecrypt = (stream, ctx) => {
+    stream
+        .command("decrypt")
+        .description("Decrypt post-quantum hybrid STREAM ciphertext; exits 1 on error")
+        .argument("[file]", "output of stream encrypt (base64 or its --json line)")
+        .option("-x, --x25519-secret <hex>", "recipient X25519 secret key (hex)")
+        .option("-m, --ml-kem-secret <hex>", "recipient ML-KEM-768 secret key (hex)")
+        .option("-c, --chunk-size <bytes>", "chunk size in bytes")
+        .option("--json", "print the result as one line of JSON")
+        .action(async (file, opts) => {
+        if (!opts.x25519Secret || !opts.mlKemSecret) {
+            throw new io_1.UsageError("missing recipient secret key: both --x25519-secret and --ml-kem-secret are required");
+        }
+        const chunkSize = (0, exports.parseChunkSize)(opts.chunkSize);
+        const ciphertext = (0, exports.parseCiphertext)(await (0, io_1.readInput)(file, ctx.io));
+        let plaintext;
+        try {
+            plaintext = (0, streaming_1.streamPqDecrypt)({
+                recipientX25519Secret: opts.x25519Secret,
+                recipientMlKemSecret: opts.mlKemSecret,
+                ciphertext,
+                ...(chunkSize !== undefined ? { chunkSize } : {}),
+            });
+        }
+        catch {
+            throw new Error("decryption failed: wrong key, or the input was modified or truncated");
+        }
+        if (!opts.json) {
+            ctx.io.stdout(plaintext);
+            (0, crypto_lib_1.wipeMemory)(plaintext);
+            return;
+        }
+        const b64 = Buffer.from(plaintext).toString("base64");
+        (0, crypto_lib_1.wipeMemory)(plaintext);
+        (0, io_1.emit)(ctx.io, true, {
+            plaintext: b64,
+            encoding: "base64",
+            algorithm: "x25519-ml-kem-768-xchacha20-poly1305",
+        }, "");
+    });
+};
+const registerStream = (program, ctx) => {
+    const stream = program
+        .command("stream")
+        .description("Post-quantum hybrid streaming AEAD operations");
+    registerStreamEncrypt(stream, ctx);
+    registerStreamDecrypt(stream, ctx);
+    (0, stream_multi_1.registerStreamMulti)(stream, ctx);
+};
+exports.registerStream = registerStream;
+//# sourceMappingURL=stream.js.map

package/dist/program/usage.d.ts

@@ -0,0 +1,7 @@
+export declare const USAGE_MARKERS: {
+    readonly start: "<!-- cli-usage:start (generated: pnpm run readme:usage) -->";
+    readonly end: "<!-- cli-usage:end -->";
+};
+export declare const renderUsage: () => string;
+export declare const replaceUsage: (readme: string) => string;
+//# sourceMappingURL=usage.d.ts.map

package/dist/program/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../../src/program/usage.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,aAAa;;;CAGhB,CAAC;AAgBX,eAAO,MAAM,WAAW,QAAO,MAQ9B,CAAC;AAQF,eAAO,MAAM,YAAY,GAAI,QAAQ,MAAM,KAAG,MAW7C,CAAC"}

package/dist/program/usage.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.replaceUsage = exports.renderUsage = exports.USAGE_MARKERS = void 0;
+const index_1 = require("./index");
+exports.USAGE_MARKERS = {
+    start: "<!-- cli-usage:start (generated: pnpm run readme:usage) -->",
+    end: "<!-- cli-usage:end -->",
+};
+const walk = (command, prefix) => {
+    const name = prefix ? `${prefix} ${command.name()}` : command.name();
+    return [
+        [name, command],
+        ...command.commands.flatMap((sub) => walk(sub, name)),
+    ];
+};
+const renderUsage = () => {
+    const program = (0, index_1.buildProgram)({ io: (0, index_1.processIO)(), exitCode: index_1.EXIT.OK }, "");
+    const sections = walk(program, "").map(([name, command]) => {
+        command.configureHelp({ helpWidth: 80 });
+        return `#### \`${name}\`\n\n\`\`\`text\n${command.helpInformation()}\`\`\`\n`;
+    });
+    return [exports.USAGE_MARKERS.start, "", ...sections, exports.USAGE_MARKERS.end].join("\n");
+};
+exports.renderUsage = renderUsage;
+const replaceUsage = (readme) => {
+    const start = readme.indexOf(exports.USAGE_MARKERS.start);
+    const end = readme.indexOf(exports.USAGE_MARKERS.end);
+    if (start < 0 || end < start) {
+        throw new Error("README.md has no cli-usage block");
+    }
+    return (readme.slice(0, start) +
+        (0, exports.renderUsage)() +
+        readme.slice(end + exports.USAGE_MARKERS.end.length));
+};
+exports.replaceUsage = replaceUsage;
+//# sourceMappingURL=usage.js.map

package/package.json

@@ -12,51 +12,46 @@
     "source": "git",
     "target": "git://github.com/sebastienrousseau/crypto-service.git"
   },
+  "type": "commonjs",
   "bin": {
     "crypto-cli": "dist/cli.js",
     "cryptocli": "dist/cli.js"
   },
+  "exports": {
+    "./package.json": "./package.json"
+  },
   "bugs": {
     "url": "https://github.com/sebastienrousseau/crypto-service/issues"
   },
   "dependencies": {
-    "figlet": "^1.6.0",
+    "commander": "^15.0.0",
+    "figlet": "^1.12.0",
     "kleur": "^4.1.5",
     "prompts": "^2.4.2",
-    "@sebastienrousseau/crypto-cbom": "0.0.8",
-    "@sebastienrousseau/crypto-lib": "0.0.8"
+    "@sebastienrousseau/crypto-kms": "0.0.24",
+    "@sebastienrousseau/crypto-lib": "0.0.24",
+    "@sebastienrousseau/crypto-cbom": "0.0.24"
   },
   "description": "The Crypto Lib Command Line Interface (CLI) is a unified tool to perform common cryptographic operations such as key generation, data encryption, digital signing, and signature verification which are invoked from the command prompt or terminal.",
   "devDependencies": {
     "@sebastienrousseau/c8-config": "^0.0.7",
     "@sebastienrousseau/eslint-config": "^0.0.7",
     "@sebastienrousseau/jsdoc-config": "^0.0.7",
-    "@sebastienrousseau/markdownlint-config": "^0.0.1",
-    "@sebastienrousseau/mocha-config": "^0.0.5",
+    "@sebastienrousseau/markdownlint-config": "^0.0.7",
+    "@sebastienrousseau/mocha-config": "^0.0.7",
     "@sebastienrousseau/prettier-config": "^0.0.7",
-    "@sebastienrousseau/remark-config": "^0.0.7",
-    "@types/chai": "^4.3.7",
+    "@types/chai": "^5.2.3",
     "@types/chai-as-promised": "^8.0.2",
     "@types/figlet": "^1.5.6",
-    "@types/mocha": "^10.0.2",
+    "@types/mocha": "^10.0.10",
     "@types/node": "^26.6.3",
     "@types/prompts": "^2.4.5",
-    "@typescript-eslint/eslint-plugin": "^6.21.0",
-    "@typescript-eslint/parser": "^6.21.0",
     "c8": "^12.0.0",
-    "chai": "^4.5.0",
-    "chai-as-promised": "^7.1.2",
-    "eslint": "^8.57.1",
-    "eslint-import-resolver-typescript": "^3.10.1",
-    "eslint-plugin-import": "^2.28.1",
+    "chai": "^6.3.0",
+    "chai-as-promised": "^8.0.2",
     "filesizes": "^0.1.2",
-    "mocha": "^10.8.2",
-    "prettier": "^3.9.8",
-    "remark-cli": "^12.0.0",
-    "remark-footnotes": "^5.0.0",
-    "remark-preset-lint-consistent": "^6.0.1",
-    "remark-preset-lint-markdown-style-guide": "^5.1.3",
-    "remark-preset-lint-recommended": "^7.0.1",
+    "mocha": "^12.0.3",
+    "prettier": "^3.9.9",
     "rimraf": "^6.1.3",
     "ts-node": "^10.9.1",
     "typedoc": "^0.28.20",
@@ -96,29 +91,21 @@
   ],
   "license": "MIT OR Apache-2.0",
   "license_URI": "http://www.opensource.org/licenses/mit-license.php",
-  "main": "./dist/cli.js",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "require": "./dist/cli.js",
-      "import": "./dist/cli.js"
-    }
-  },
   "name": "@sebastienrousseau/crypto-cli",
   "private": false,
   "publishConfig": {
     "access": "public"
   },
-  "types": "./dist/index.d.ts",
   "sideEffects": false,
-  "version": "0.0.8",
+  "version": "0.0.24",
   "scripts": {
     "build": "tsc --build tsconfig.json",
     "clean": "rimraf ./coverage ./dist ./docs",
-    "lint": "eslint --ext .ts src __tests__",
-    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "lint": "eslint src __tests__",
+    "lint:fix": "eslint --cache --fix src __tests__",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check \"src/**/*.ts\"",
+    "readme:usage": "node scripts/readme-usage.mjs",
     "start": "node dist/cli.js",
     "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
     "docs": "typedoc"