@sebastienrousseau/crypto-cli 0.0.9 → 0.0.25

package/dist/program/kms.js

@@ -0,0 +1,247 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerCliKmsProvider = registerCliKmsProvider;
+exports.resetCliKmsProviders = resetCliKmsProviders;
+exports.resolveCliKmsProvider = resolveCliKmsProvider;
+exports.registerKms = registerKms;
+const commander_1 = require("commander");
+const crypto_kms_1 = require("@sebastienrousseau/crypto-kms");
+const io_1 = require("./io");
+const providerRegistry = new Map();
+providerRegistry.set("local", new crypto_kms_1.LocalKmsProvider());
+function registerCliKmsProvider(name, provider) {
+    providerRegistry.set(name.toLowerCase(), provider);
+}
+function resetCliKmsProviders() {
+    providerRegistry.clear();
+    providerRegistry.set("local", new crypto_kms_1.LocalKmsProvider());
+}
+function createCliAwsProvider() {
+    return new crypto_kms_1.AwsKmsProvider({
+        region: process.env["AWS_REGION"] ?? "us-east-1",
+    });
+}
+function createCliGcpProvider() {
+    return new crypto_kms_1.GcpKmsProvider({
+        projectId: process.env["GCP_PROJECT_ID"] ?? "test-project",
+        locationId: process.env["GCP_LOCATION_ID"] ?? "global",
+        keyRingId: process.env["GCP_KEY_RING_ID"] ?? "test-ring",
+        token: process.env["GCP_AUTH_TOKEN"] ?? "test-token",
+    });
+}
+function createCliVaultProvider() {
+    return new crypto_kms_1.VaultKmsProvider({
+        address: process.env["VAULT_ADDR"] ?? "http://localhost:8200",
+        token: process.env["VAULT_TOKEN"] ?? "test-token",
+    });
+}
+function createCliAzureProvider() {
+    return new crypto_kms_1.AzureKmsProvider({
+        vaultUrl: process.env["AZURE_VAULT_URL"] ?? "https://my-vault.vault.azure.net",
+    });
+}
+function createDefaultCliProvider(key, name) {
+    switch (key) {
+        case "aws":
+            return createCliAwsProvider();
+        case "gcp":
+            return createCliGcpProvider();
+        case "vault":
+            return createCliVaultProvider();
+        case "azure":
+            return createCliAzureProvider();
+        default:
+            throw new Error(`Unsupported KMS provider: ${name}`);
+    }
+}
+function resolveCliKmsProvider(name) {
+    const key = (name ?? "local").toLowerCase();
+    const existing = providerRegistry.get(key);
+    if (existing)
+        return existing;
+    const provider = createDefaultCliProvider(key, name);
+    providerRegistry.set(key, provider);
+    return provider;
+}
+function parseBytes(text) {
+    const isHex = /^[0-9a-fA-F]*$/.test(text) && text.length % 2 === 0;
+    return isHex
+        ? new Uint8Array(Buffer.from(text, "hex"))
+        : new Uint8Array(Buffer.from(text, "utf8"));
+}
+async function executeCreateKey(opts, ctx) {
+    const provider = resolveCliKmsProvider(opts.provider);
+    const meta = await provider.createKey(opts.algorithm, opts.usage);
+    const desc = [
+        `Key ID:    ${meta.keyId}`,
+        `Algorithm: ${meta.algorithm}`,
+        `Usage:     ${meta.usage}`,
+        `Provider:  ${meta.provider}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), meta, desc);
+}
+async function executeWrap(file, opts, ctx) {
+    const rawKey = opts.key
+        ? Buffer.from(opts.key, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const text = (0, io_1.valueOrJsonField)(rawKey, "key").trim();
+    const bytes = parseBytes(text);
+    const provider = resolveCliKmsProvider(opts.provider);
+    if (!provider.wrapKey) {
+        throw new Error(`Provider ${provider.name} does not support wrapKey`);
+    }
+    const res = await provider.wrapKey(opts.keyId, bytes);
+    const desc = [
+        `Key ID:      ${res.keyId}`,
+        `Wrapped Key: ${res.wrappedKey}`,
+        `Provider:    ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), { ...res, provider: provider.name }, desc);
+}
+async function executeUnwrap(file, opts, ctx) {
+    const rawWk = opts.wrappedKey
+        ? Buffer.from(opts.wrappedKey, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const wrappedKey = (0, io_1.valueOrJsonField)(rawWk, "wrappedKey").trim();
+    const provider = resolveCliKmsProvider(opts.provider);
+    if (!provider.unwrapKey) {
+        throw new Error(`Provider ${provider.name} does not support unwrapKey`);
+    }
+    const res = await provider.unwrapKey(opts.keyId, wrappedKey);
+    const hex = Buffer.from(res.unwrappedKey).toString("hex");
+    const data = { unwrappedKey: hex, keyId: res.keyId, provider: provider.name };
+    const desc = [
+        `Key ID:        ${res.keyId}`,
+        `Unwrapped Key: ${hex}`,
+        `Provider:      ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeDataKey(opts, ctx) {
+    const provider = resolveCliKmsProvider(opts.provider);
+    const res = await provider.generateDataKey(opts.keyId, opts.keySpec);
+    const hex = Buffer.from(res.plaintext).toString("hex");
+    const data = {
+        plaintext: hex,
+        ciphertext: res.ciphertext,
+        keyId: opts.keyId,
+        provider: provider.name,
+    };
+    const desc = [
+        `Key ID:     ${opts.keyId}`,
+        `Plaintext:  ${hex}`,
+        `Ciphertext: ${res.ciphertext}`,
+        `Provider:   ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeEncrypt(file, opts, ctx) {
+    const raw = opts.data
+        ? Buffer.from(opts.data, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const text = (0, io_1.valueOrJsonField)(raw, "data").trim();
+    const bytes = parseBytes(text);
+    const provider = resolveCliKmsProvider(opts.provider);
+    const res = await provider.encrypt(opts.keyId, bytes);
+    const data = { ...res, provider: provider.name };
+    const desc = [
+        `Key ID:     ${res.keyId}`,
+        `Ciphertext: ${res.ciphertext}`,
+        `Provider:   ${provider.name}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, desc);
+}
+async function executeDecrypt(file, opts, ctx) {
+    const raw = opts.ciphertext
+        ? Buffer.from(opts.ciphertext, "utf8")
+        : await (0, io_1.readInput)(file, ctx.io);
+    const ct = (0, io_1.valueOrJsonField)(raw, "ciphertext").trim();
+    const provider = resolveCliKmsProvider(opts.provider);
+    const res = await provider.decrypt(opts.keyId, ct);
+    const text = Buffer.from(res.plaintext).toString("utf8");
+    const hex = Buffer.from(res.plaintext).toString("hex");
+    const data = {
+        plaintext: text,
+        hex,
+        keyId: res.keyId,
+        provider: provider.name,
+    };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), data, text);
+}
+function registerKmsKeyOps(kms, ctx) {
+    kms
+        .command("create-key")
+        .description("Create a new managed key in KMS")
+        .option("-a, --algorithm <alg>", "Key algorithm", "aes-256-gcm")
+        .addOption(new commander_1.Option("-u, --usage <usage>", "Key usage")
+        .choices(["encrypt", "sign", "wrap"])
+        .default("encrypt"))
+        .option("-p, --provider <name>", "KMS provider (local, aws, gcp, vault, azure)", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (opts) => {
+        await executeCreateKey(opts, ctx);
+    });
+    kms
+        .command("generate-data-key")
+        .description("Generate a Data Encryption Key (DEK) via KMS")
+        .requiredOption("-k, --key-id <id>", "Key ID")
+        .option("-s, --key-spec <spec>", "Key spec (e.g. AES_256)", "AES_256")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (opts) => {
+        await executeDataKey(opts, ctx);
+    });
+}
+function registerKmsWrapOps(kms, ctx) {
+    kms
+        .command("wrap [file]")
+        .description("Wrap (encrypt) a key using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Wrapping Key ID")
+        .option("-w, --key <hex>", "Raw key material to wrap")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeWrap(file, opts, ctx);
+    });
+    kms
+        .command("unwrap [file]")
+        .description("Unwrap a wrapped key using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Wrapping Key ID")
+        .option("-w, --wrapped-key <str>", "Wrapped key string")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeUnwrap(file, opts, ctx);
+    });
+}
+function registerKmsCipherOps(kms, ctx) {
+    kms
+        .command("encrypt [file]")
+        .description("Encrypt data using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Key ID")
+        .option("-d, --data <text>", "Plaintext data to encrypt")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeEncrypt(file, opts, ctx);
+    });
+    kms
+        .command("decrypt [file]")
+        .description("Decrypt ciphertext using a KMS key")
+        .requiredOption("-k, --key-id <id>", "Key ID")
+        .option("-c, --ciphertext <str>", "Ciphertext to decrypt")
+        .option("-p, --provider <name>", "KMS provider", "local")
+        .option("--json", "Emit output as JSON")
+        .action(async (file, opts) => {
+        await executeDecrypt(file, opts, ctx);
+    });
+}
+function registerKms(program, ctx) {
+    const kms = program
+        .command("kms")
+        .description("Key Management Service (KMS) operations across native cloud providers");
+    registerKmsKeyOps(kms, ctx);
+    registerKmsWrapOps(kms, ctx);
+    registerKmsCipherOps(kms, ctx);
+}
+//# sourceMappingURL=kms.js.map

package/dist/program/opaque.d.ts

@@ -0,0 +1,4 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const registerOpaque: (program: Command, ctx: RunContext) => Command;
+//# sourceMappingURL=opaque.d.ts.map

package/dist/program/opaque.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaque.d.ts","sourceRoot":"","sources":["../../src/program/opaque.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAU,MAAM,WAAW,CAAC;AAE5C,OAAO,EAAoB,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAwUzD,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,KAAG,OASlE,CAAC"}

package/dist/program/opaque.js

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerOpaque = void 0;
+const commander_1 = require("commander");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const io_1 = require("./io");
+const secrets_1 = require("./secrets");
+const { pake } = crypto_lib_1.protocols;
+const SUITE_CHOICES = [
+    "P256-SHA256",
+    "ristretto255-SHA512",
+];
+const DEFAULT_SERVER_URL = "http://localhost:3000";
+function parseHex(hex) {
+    return new Uint8Array(Buffer.from(hex, "hex"));
+}
+function toHex(bytes) {
+    return Buffer.from(bytes).toString("hex");
+}
+function getServerUrl(opts) {
+    return (opts.serverUrl || process.env["CRYPTO_SERVER_URL"] || DEFAULT_SERVER_URL);
+}
+async function postJson(baseUrl, path, body) {
+    const url = `${baseUrl.replace(/\/+$/, "")}${path}`;
+    let res;
+    try {
+        res = await fetch(url, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+    }
+    catch (err) {
+        throw new Error(`failed to connect to server at ${url}: ${err.message}`, { cause: err });
+    }
+    const text = await res.text();
+    let json;
+    try {
+        json = JSON.parse(text);
+    }
+    catch (parseErr) {
+        throw new Error(`server returned non-JSON response (HTTP ${res.status}): ${text.slice(0, 100)}`, { cause: parseErr });
+    }
+    if (!res.ok) {
+        const p = json;
+        const msg = p.detail ?? p.title ?? `HTTP ${res.status}`;
+        throw new Error(`OPAQUE server error (${res.status}): ${msg}`);
+    }
+    return json;
+}
+async function promptPassword(ctx, confirm) {
+    const ask = ctx.io.promptSecret;
+    if (ask === undefined) {
+        throw new io_1.UsageError("missing password: pass --password-file <path> or " +
+            "--password-stdin (a prompt needs a terminal on stdin)");
+    }
+    const password = (await ask("Password")) ?? "";
+    if (confirm && (await ask("Repeat the password")) !== password) {
+        throw new Error("the passwords do not match");
+    }
+    return password;
+}
+async function readPassword(ctx, opts, confirm) {
+    const source = {
+        file: opts.passwordFile,
+        stdin: opts.passwordStdin,
+    };
+    const raw = await (0, secrets_1.readSecret)({
+        io: ctx.io,
+        source,
+        flags: secrets_1.PASSWORD_FLAGS,
+        dataOnStdin: false,
+        checkMode: true,
+    });
+    const password = raw === undefined
+        ? await promptPassword(ctx, confirm)
+        : raw.toString("utf8").replace(/\r?\n$/, "");
+    if (password === "")
+        throw new Error("the password is empty");
+    return password;
+}
+async function handleSetup(ctx, opts) {
+    const suite = opts.suite;
+    const setup = pake.createServerSetup({ suite });
+    const fake = pake.createFakeRecord({ suite });
+    const result = {
+        suite,
+        serverPublicKey: toHex(setup.serverPublicKey),
+        serverPrivateKey: toHex(setup.serverPrivateKey),
+        oprfSeed: toHex(setup.oprfSeed),
+        fakeRecord: toHex(pake.serializeRegistrationRecord(fake)),
+    };
+    const formatted = [
+        `OPAQUE Server Setup (${suite}):`,
+        `Server Public Key:  ${result.serverPublicKey}`,
+        `Server Private Key: ${result.serverPrivateKey}`,
+        `OPRF Seed:          ${result.oprfSeed}`,
+        `Fake Record:        ${result.fakeRecord}`,
+    ].join("\n");
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, formatted);
+}
+async function handleRegister(id, ctx, opts) {
+    const suite = opts.suite;
+    const serverUrl = getServerUrl(opts);
+    const password = await readPassword(ctx, opts, true);
+    const { request, blind } = pake.createRegistrationRequest(password, {
+        suite,
+    });
+    const initRes = await postJson(serverUrl, "/v2/opaque/register/init", {
+        credentialIdentifier: id,
+        request: toHex(pake.serializeRegistrationRequest(request)),
+        suite,
+    });
+    const responseBytes = parseHex(initRes.data.response);
+    const regResponse = pake.deserializeRegistrationResponse(responseBytes, suite);
+    const { record, exportKey } = pake.finalizeRegistrationRequest(password, blind, regResponse, {}, { suite });
+    await postJson(serverUrl, "/v2/opaque/register/finish", {
+        credentialIdentifier: id,
+        record: toHex(pake.serializeRegistrationRecord(record)),
+        suite,
+    });
+    const result = {
+        status: "registered",
+        credentialIdentifier: id,
+        suite,
+        exportKey: toHex(exportKey),
+    };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, `Registered credential '${id}' successfully`);
+}
+async function handleLogin(id, ctx, opts) {
+    const suite = opts.suite;
+    const serverUrl = getServerUrl(opts);
+    const password = await readPassword(ctx, opts, false);
+    const client = pake.generateKE1(password, { suite });
+    const initRes = await postJson(serverUrl, "/v2/opaque/login/init", {
+        credentialIdentifier: id,
+        ke1: toHex(pake.serializeKE1(client.ke1)),
+        suite,
+    });
+    const ke2Bytes = parseHex(initRes.data.ke2);
+    const ke2 = pake.deserializeKE2(ke2Bytes, suite);
+    const { ke3, sessionKey, exportKey } = pake.generateKE3(client.state, ke2, {});
+    const finishRes = await postJson(serverUrl, "/v2/opaque/login/finish", {
+        sessionId: initRes.data.sessionId,
+        ke3: toHex(pake.serializeKE3(ke3)),
+    });
+    const expectedKey = toHex(sessionKey);
+    if (finishRes.data.sessionKey !== expectedKey) {
+        throw new Error("server session key does not match client session key");
+    }
+    const result = {
+        status: "authenticated",
+        credentialIdentifier: id,
+        suite,
+        sessionKey: expectedKey,
+        exportKey: toHex(exportKey),
+    };
+    (0, io_1.emit)(ctx.io, Boolean(opts.json), result, `Authenticated as '${id}'. Session key: ${expectedKey}`);
+}
+function registerSetup(parent, ctx) {
+    parent
+        .command("setup")
+        .description("Generate server long-term keys and fake record")
+        .addOption(new commander_1.Option("-s, --suite <name>", "ciphersuite")
+        .choices(SUITE_CHOICES)
+        .default("P256-SHA256"))
+        .option("--json", "print result as JSON")
+        .action(async (opts) => handleSetup(ctx, opts));
+}
+function registerRegister(parent, ctx) {
+    (0, secrets_1.withSecretOptions)(parent
+        .command("register <id>")
+        .description("Register a password with an OPAQUE server")
+        .option("-u, --server-url <url>", "server base URL")
+        .addOption(new commander_1.Option("-s, --suite <name>", "ciphersuite")
+        .choices(SUITE_CHOICES)
+        .default("P256-SHA256"))
+        .option("--json", "print result as JSON"), secrets_1.PASSWORD_FLAGS, {
+        what: "password",
+        format: "one trailing line break is ignored",
+        takesData: false,
+    }).action(async (id, opts) => handleRegister(id, ctx, opts));
+}
+function registerLogin(parent, ctx) {
+    (0, secrets_1.withSecretOptions)(parent
+        .command("login <id>")
+        .description("Authenticate against an OPAQUE server")
+        .option("-u, --server-url <url>", "server base URL")
+        .addOption(new commander_1.Option("-s, --suite <name>", "ciphersuite")
+        .choices(SUITE_CHOICES)
+        .default("P256-SHA256"))
+        .option("--json", "print result as JSON"), secrets_1.PASSWORD_FLAGS, {
+        what: "password",
+        format: "one trailing line break is ignored",
+        takesData: false,
+    }).action(async (id, opts) => handleLogin(id, ctx, opts));
+}
+const registerOpaque = (program, ctx) => {
+    const opaque = program
+        .command("opaque")
+        .description("OPAQUE zero-knowledge password authentication (RFC 9807)")
+        .helpCommand(false);
+    registerSetup(opaque, ctx);
+    registerRegister(opaque, ctx);
+    registerLogin(opaque, ctx);
+    return opaque;
+};
+exports.registerOpaque = registerOpaque;
+//# sourceMappingURL=opaque.js.map

package/dist/program/stream-multi.d.ts

@@ -0,0 +1,7 @@
+import { Command } from "commander";
+import { type MultiPqRecipient } from "@sebastienrousseau/crypto-lib/streaming";
+import { type RunContext } from "./io";
+export declare const parseMultiChunkSize: (value?: string) => number | undefined;
+export declare const parseRecipients: (value?: string) => MultiPqRecipient[];
+export declare const registerStreamMulti: (stream: Command, ctx: RunContext) => void;
+//# sourceMappingURL=stream-multi.d.ts.map

package/dist/program/stream-multi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-multi.d.ts","sourceRoot":"","sources":["../../src/program/stream-multi.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAIpE,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAS7D,CAAC;AAoCF,eAAO,MAAM,eAAe,GAAI,QAAQ,MAAM,KAAG,gBAAgB,EAsBhE,CAAC;AA4HF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,OAAO,EAAE,KAAK,UAAU,KAAG,IAGtE,CAAC"}

package/dist/program/stream-multi.js

@@ -0,0 +1,163 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerStreamMulti = exports.parseRecipients = exports.parseMultiChunkSize = void 0;
+const fs = __importStar(require("node:fs"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
+const io_1 = require("./io");
+const stream_1 = require("./stream");
+const parseMultiChunkSize = (value) => {
+    if (value === undefined)
+        return undefined;
+    const size = Number(value);
+    if (!Number.isSafeInteger(size) || size < 1024 || size > 16777216) {
+        throw new io_1.UsageError("--chunk-size must be an integer between 1024 and 16777216");
+    }
+    return size;
+};
+exports.parseMultiChunkSize = parseMultiChunkSize;
+const validateRecipientItem = (item) => {
+    if (!item ||
+        typeof item !== "object" ||
+        typeof item.recipientId !== "string" ||
+        typeof item.recipientX25519Public !==
+            "string" ||
+        typeof item.recipientMlKemPublic !== "string") {
+        throw new io_1.UsageError("each recipient must have recipientId, recipientX25519Public, and recipientMlKemPublic strings");
+    }
+    return item;
+};
+const parseRecipients = (value) => {
+    if (!value) {
+        throw new io_1.UsageError("missing recipients: --recipients is required (JSON array or file path)");
+    }
+    let raw = value.trim();
+    if (!raw.startsWith("[") && fs.existsSync(raw)) {
+        raw = fs.readFileSync(raw, "utf8").trim();
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new io_1.UsageError("invalid JSON in --recipients");
+    }
+    if (!Array.isArray(parsed) || parsed.length === 0) {
+        throw new io_1.UsageError("--recipients must be a non-empty array of recipient objects");
+    }
+    return parsed.map(validateRecipientItem);
+};
+exports.parseRecipients = parseRecipients;
+const registerStreamMultiEncrypt = (stream, ctx) => {
+    stream
+        .command("multi-encrypt")
+        .description("Encrypt for multiple recipients with post-quantum hybrid STREAM AEAD")
+        .argument("[file]", "file to encrypt; '-' or omitted reads standard input")
+        .option("-r, --recipients <json-or-path>", "JSON array string or file path containing recipient public key descriptors")
+        .option("-c, --chunk-size <bytes>", "chunk size in bytes (minimum 1024, default 65536)")
+        .option("--json", "print the result as one line of JSON")
+        .action(async (file, opts) => {
+        const recipients = (0, exports.parseRecipients)(opts.recipients);
+        const chunkSize = (0, exports.parseMultiChunkSize)(opts.chunkSize);
+        const input = await (0, io_1.readInput)(file, ctx.io);
+        const result = (0, streaming_1.streamMultiPqEncrypt)({
+            recipients,
+            plaintext: input,
+            ...(chunkSize !== undefined ? { chunkSize } : {}),
+        });
+        const b64 = Buffer.from(result.ciphertext).toString("base64");
+        (0, io_1.emit)(ctx.io, Boolean(opts.json), {
+            ciphertext: b64,
+            algorithm: result.algorithm,
+            recipientCount: result.recipientCount,
+        }, b64);
+    });
+};
+const executeStreamMultiDecrypt = (ctx, opts, ciphertext, chunkSize) => {
+    let decResult;
+    try {
+        decResult = (0, streaming_1.streamMultiPqDecrypt)({
+            recipientX25519Secret: opts.x25519Secret,
+            recipientMlKemSecret: opts.mlKemSecret,
+            ...(opts.recipientId !== undefined
+                ? { recipientId: opts.recipientId }
+                : {}),
+            ciphertext,
+            ...(chunkSize !== undefined ? { chunkSize } : {}),
+        });
+    }
+    catch {
+        throw new Error("decryption failed: wrong key, or the input was modified or truncated");
+    }
+    if (!opts.json) {
+        ctx.io.stdout(decResult.plaintext);
+        (0, crypto_lib_1.wipeMemory)(decResult.plaintext);
+        return;
+    }
+    const b64 = Buffer.from(decResult.plaintext).toString("base64");
+    (0, crypto_lib_1.wipeMemory)(decResult.plaintext);
+    (0, io_1.emit)(ctx.io, true, {
+        plaintext: b64,
+        recipientId: decResult.recipientId,
+        encoding: "base64",
+        algorithm: "multi-x25519-ml-kem-768-xchacha20-poly1305-stream",
+    }, "");
+};
+const registerStreamMultiDecrypt = (stream, ctx) => {
+    stream
+        .command("multi-decrypt")
+        .description("Decrypt multi-recipient post-quantum hybrid STREAM ciphertext; exits 1 on error")
+        .argument("[file]", "output of stream multi-encrypt (base64 or its --json line)")
+        .option("-x, --x25519-secret <hex>", "recipient X25519 secret key (hex)")
+        .option("-m, --ml-kem-secret <hex>", "recipient ML-KEM-768 secret key (hex)")
+        .option("-i, --recipient-id <id>", "optional recipient identifier for direct slot lookup")
+        .option("-c, --chunk-size <bytes>", "chunk size in bytes")
+        .option("--json", "print the result as one line of JSON")
+        .action(async (file, opts) => {
+        if (!opts.x25519Secret || !opts.mlKemSecret) {
+            throw new io_1.UsageError("missing recipient secret key: both --x25519-secret and --ml-kem-secret are required");
+        }
+        const chunkSize = (0, exports.parseMultiChunkSize)(opts.chunkSize);
+        const ciphertext = (0, stream_1.parseCiphertext)(await (0, io_1.readInput)(file, ctx.io));
+        executeStreamMultiDecrypt(ctx, opts, ciphertext, chunkSize);
+    });
+};
+const registerStreamMulti = (stream, ctx) => {
+    registerStreamMultiEncrypt(stream, ctx);
+    registerStreamMultiDecrypt(stream, ctx);
+};
+exports.registerStreamMulti = registerStreamMulti;
+//# sourceMappingURL=stream-multi.js.map

package/dist/program/stream.d.ts

@@ -0,0 +1,6 @@
+import { Command } from "commander";
+import { type RunContext } from "./io";
+export declare const parseChunkSize: (value?: string) => number | undefined;
+export declare const parseCiphertext: (input: Buffer) => Buffer;
+export declare const registerStream: (program: Command, ctx: RunContext) => void;
+//# sourceMappingURL=stream.d.ts.map

package/dist/program/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/program/stream.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMpC,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,MAAM,CAAC;AAuBd,eAAO,MAAM,cAAc,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAOxD,CAAC;AAGF,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,MAM/C,CAAC;AAqGF,eAAO,MAAM,cAAc,GAAI,SAAS,OAAO,EAAE,KAAK,UAAU,KAAG,IAOlE,CAAC"}