@secretgenerator/cli 2.0.0

package/README.md

@@ -0,0 +1,89 @@
+# @secretgenerator/cli
+
+Zero-config installer for the [secretgenerator](https://secretgenerator.org)
+CLI. Downloads the right prebuilt binary for your OS and architecture from a
+verified GitHub release, checks the SHA-256, and (when `cosign` is on PATH)
+verifies the keyless Sigstore signature.
+
+## Install
+
+```sh
+# One-off invocation, no global install:
+npx secretgenerator --json -n 24
+
+# Project-local:
+npm install --save-dev @secretgenerator/cli
+
+# Global:
+npm install -g @secretgenerator/cli
+```
+
+The first invocation downloads the binary (~2 MB) for your platform and caches
+it inside the package. Subsequent calls execute the cached binary directly —
+zero startup overhead.
+
+## Why prefer this over `go install`?
+
+- **Zero Go toolchain required.** `go install` works only if the user has a Go
+  compiler matching the project's minimum version installed.
+- **Verified by default.** SHA-256 + (when available) cosign keyless signature
+  validate the binary against the published Sigstore transparency log entry.
+- **Pinned per release.** The npm package version mirrors the secretgenerator
+  CLI tag, so `npm install @secretgenerator/cli@2.0.0` always pulls the exact
+  signed v2.0.0 binary.
+- **AI-agent-friendly.** Agents writing Node/TypeScript prefer `npx X`. This
+  wrapper makes secretgenerator a drop-in replacement for `crypto.randomUUID`
+  and `crypto.randomBytes` in agent-generated scaffolding.
+
+## Verification chain
+
+```
+You ─trust─▶ Sigstore Fulcio root
+            │
+            └─signs cert tied to─▶ GitHub Actions OIDC identity
+                                  │
+                                  └─signs─▶ checksums.txt
+                                          │
+                                          └─pins SHA-256 of─▶ archive
+                                                            │
+                                                            └─contains─▶ binary you run
+```
+
+If `cosign` is not installed, the package still verifies the SHA-256 against
+the same `checksums.txt` (downloaded from the same HTTPS GitHub host that
+signed it). To upgrade to the strongest tier, install cosign:
+
+```sh
+brew install cosign        # macOS
+# or: https://docs.sigstore.dev/cosign/installation
+```
+
+When cosign is available the postinstall step verifies that `checksums.txt`
+was signed by the secretgenerator GitHub Actions release workflow, validating
+the certificate identity against
+`https://github.com/rafaelperoco/secretgenerator/.github/workflows/release.yml@refs/tags/v.*`.
+
+## Environment overrides
+
+| Variable                          | Effect                                                            |
+| --------------------------------- | ----------------------------------------------------------------- |
+| `SECRETGENERATOR_VERSION`         | Pin a specific release tag, overriding the package's own version. |
+| `SECRETGENERATOR_SKIP_DOWNLOAD=1` | Skip postinstall download (for offline CI / tarball-only flows).  |
+
+## Supported platforms
+
+| OS      | Architectures   |
+| ------- | --------------- |
+| Linux   | x64, arm64      |
+| macOS   | x64, arm64      |
+| Windows | x64             |
+
+For other platforms, install from source:
+
+```sh
+go install github.com/rafaelperoco/secretgenerator/cmd/secretgenerator@latest
+```
+
+## License
+
+MIT. Source: [github.com/rafaelperoco/secretgenerator](https://github.com/rafaelperoco/secretgenerator).

package/dist/install.js

@@ -0,0 +1,158 @@
+#!/usr/bin/env node
+// postinstall hook: download the secretgenerator binary for the current
+// platform, verify its integrity, extract it next to dist/run.js so the
+// `bin` entry can exec it directly.
+//
+// Download steps (each fails fast with a clear message):
+//   1. Determine the right release version (env override or package.json).
+//   2. Compute archive name + URL.
+//   3. Fetch the archive, checksums.txt, checksums.txt.sig, checksums.txt.pem.
+//   4. Verify the archive's SHA-256 against checksums.txt.
+//   5. (Optional) Verify cosign keyless signature on checksums.txt.
+//   6. Extract the binary, drop it at <packageRoot>/bin/<binary>.
+//   7. Save a marker file at <packageRoot>/bin/.installed so run.js can
+//      detect a successful install on subsequent invocations.
+import { createWriteStream, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { createReadStream } from "node:fs";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { spawnSync } from "node:child_process";
+import { Readable } from "node:stream";
+import { pipeline } from "node:stream/promises";
+import { detectAsset, UnsupportedPlatformError } from "./platform.js";
+import { cosignAvailable, verifyChecksum, verifyCosign, IntegrityError, } from "./verify.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// dist/install.js is in `cli/dist/`, packageRoot is `cli/`.
+const packageRoot = path.resolve(__dirname, "..");
+const binDir = path.join(packageRoot, "bin");
+const installedMarker = path.join(binDir, ".installed");
+const REPO = "rafaelperoco/secretgenerator";
+main().catch((err) => {
+    // Do not exit 1 — that would block `npm install` for legitimate users
+    // (CI environments without network, npm install in tarball-only mode,
+    // etc.). Print a clear error so the user can retry on first run.
+    console.error(`[secretgenerator] install failed: ${err.message}`);
+    console.error(`[secretgenerator] you can retry by running \`npx secretgenerator --version\`, ` +
+        `or install manually from ${`https://github.com/${REPO}/releases/latest`}.`);
+    process.exit(0);
+});
+async function main() {
+    if (process.env.SECRETGENERATOR_SKIP_DOWNLOAD === "1") {
+        console.log("[secretgenerator] SECRETGENERATOR_SKIP_DOWNLOAD=1; skipping postinstall");
+        return;
+    }
+    let asset;
+    try {
+        asset = detectAsset();
+    }
+    catch (err) {
+        if (err instanceof UnsupportedPlatformError) {
+            console.warn(`[secretgenerator] ${err.message}`);
+            return;
+        }
+        throw err;
+    }
+    const version = readVersion();
+    const archiveName = `secretgenerator_${stripV(version)}_${asset.suffix}`;
+    const baseUrl = `https://github.com/${REPO}/releases/download/${version}`;
+    const archiveUrl = `${baseUrl}/${archiveName}`;
+    const checksumsUrl = `${baseUrl}/checksums.txt`;
+    const sigUrl = `${baseUrl}/checksums.txt.sig`;
+    const pemUrl = `${baseUrl}/checksums.txt.pem`;
+    console.log(`[secretgenerator] downloading ${archiveName}`);
+    const work = mkdtempSync(path.join(tmpdir(), "secretgen-install-"));
+    try {
+        const archivePath = path.join(work, archiveName);
+        const checksumsPath = path.join(work, "checksums.txt");
+        const sigPath = path.join(work, "checksums.txt.sig");
+        const pemPath = path.join(work, "checksums.txt.pem");
+        await Promise.all([
+            download(archiveUrl, archivePath),
+            download(checksumsUrl, checksumsPath),
+            download(sigUrl, sigPath, { allowMissing: true }),
+            download(pemUrl, pemPath, { allowMissing: true }),
+        ]);
+        const checksumsText = readFileSync(checksumsPath, "utf8");
+        verifyChecksum(archivePath, archiveName, checksumsText);
+        console.log(`[secretgenerator] SHA-256 verified for ${archiveName}`);
+        if (existsSync(sigPath) && existsSync(pemPath) && cosignAvailable()) {
+            if (verifyCosign(checksumsPath, pemPath, sigPath)) {
+                console.log("[secretgenerator] cosign keyless signature verified (Sigstore/Fulcio)");
+            }
+        }
+        else if (!cosignAvailable()) {
+            console.log("[secretgenerator] cosign not on PATH; skipped Sigstore signature check (SHA-256 still verified)");
+        }
+        mkdirSync(binDir, { recursive: true });
+        extract(archivePath, binDir, asset.format);
+        const binPath = path.join(binDir, asset.binary);
+        if (!existsSync(binPath)) {
+            throw new IntegrityError(`archive ${archiveName} did not contain ${asset.binary} after extraction`);
+        }
+        if (process.platform !== "win32") {
+            // Mark executable.
+            const fs = await import("node:fs");
+            fs.chmodSync(binPath, 0o755);
+        }
+        writeFileSync(installedMarker, JSON.stringify({ version, asset: asset.suffix, installedAt: new Date().toISOString() }));
+        console.log(`[secretgenerator] installed ${binPath} (release ${version})`);
+    }
+    finally {
+        try {
+            rmSync(work, { recursive: true, force: true });
+        }
+        catch {
+            // tempdir cleanup is best-effort
+        }
+    }
+}
+function readVersion() {
+    // Allow override (used by smoke tests pinning a specific tag).
+    if (process.env.SECRETGENERATOR_VERSION) {
+        return process.env.SECRETGENERATOR_VERSION;
+    }
+    const pkg = JSON.parse(readFileSync(path.join(packageRoot, "package.json"), "utf8"));
+    return `v${pkg.version}`;
+}
+function stripV(v) {
+    return v.startsWith("v") ? v.slice(1) : v;
+}
+async function download(url, out, opts = {}) {
+    const res = await fetch(url, { redirect: "follow" });
+    if (res.status === 404 && opts.allowMissing) {
+        return;
+    }
+    if (!res.ok || !res.body) {
+        throw new Error(`download ${url} -> HTTP ${res.status}`);
+    }
+    const nodeStream = Readable.fromWeb(res.body);
+    await pipeline(nodeStream, createWriteStream(out));
+}
+function extract(archive, dest, format) {
+    if (format === "tar.gz") {
+        const r = spawnSync("tar", ["-xzf", archive, "-C", dest], {
+            stdio: "inherit",
+        });
+        if (r.status !== 0)
+            throw new Error(`tar exit ${r.status}`);
+        return;
+    }
+    // zip — use Node's built-in zlib + a small inflate; the simplest cross-
+    // platform approach on Windows is `tar -xf` which Windows 10+ ships
+    // with. Fall back to PowerShell Expand-Archive if tar is missing.
+    const r = spawnSync("tar", ["-xf", archive, "-C", dest], {
+        stdio: "inherit",
+    });
+    if (r.status !== 0) {
+        const ps = spawnSync("powershell", ["-Command", `Expand-Archive -Path '${archive}' -DestinationPath '${dest}' -Force`], { stdio: "inherit" });
+        if (ps.status !== 0) {
+            throw new Error("zip extraction failed: tar and Expand-Archive both errored");
+        }
+    }
+}
+// Reading the archive is delegated to `tar` / `Expand-Archive`; the
+// pipeline-and-stream imports above are kept because download() uses them.
+void createReadStream;
+//# sourceMappingURL=install.js.map

package/dist/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":";AACA,wEAAwE;AACxE,wEAAwE;AACxE,oCAAoC;AACpC,EAAE;AACF,yDAAyD;AACzD,2EAA2E;AAC3E,mCAAmC;AACnC,+EAA+E;AAC/E,2DAA2D;AAC3D,oEAAoE;AACpE,kEAAkE;AAClE,wEAAwE;AACxE,8DAA8D;AAE9D,OAAO,EACL,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAEhD,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EACL,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,GACf,MAAM,aAAa,CAAC;AAErB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,4DAA4D;AAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;AAExD,MAAM,IAAI,GAAG,8BAA8B,CAAC;AAE5C,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,sEAAsE;IACtE,sEAAsE;IACtE,iEAAiE;IACjE,OAAO,CAAC,KAAK,CAAC,qCAAqC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CACX,gFAAgF;QAC9E,4BAA4B,sBAAsB,IAAI,kBAAkB,GAAG,CAC9E,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,IAAI,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,GAAG,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,yEAAyE,CAAC,CAAC;QACvF,OAAO;IACT,CAAC;IAED,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,WAAW,GAAG,mBAAmB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;IACzE,MAAM,OAAO,GAAG,sBAAsB,IAAI,sBAAsB,OAAO,EAAE,CAAC;IAC1E,MAAM,UAAU,GAAG,GAAG,OAAO,IAAI,WAAW,EAAE,CAAC;IAC/C,MAAM,YAAY,GAAG,GAAG,OAAO,gBAAgB,CAAC;IAChD,MAAM,MAAM,GAAG,GAAG,OAAO,oBAAoB,CAAC;IAC9C,MAAM,MAAM,GAAG,GAAG,OAAO,oBAAoB,CAAC;IAE9C,OAAO,CAAC,GAAG,CAAC,iCAAiC,WAAW,EAAE,CAAC,CAAC;IAC5D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAEpE,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QAErD,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC;YACjC,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC;YACrC,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;YACjD,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;SAClD,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,YAAY,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;QAC1D,cAAc,CAAC,WAAW,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,0CAA0C,WAAW,EAAE,CAAC,CAAC;QAErE,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,eAAe,EAAE,EAAE,CAAC;YACpE,IAAI,YAAY,CAAC,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;gBAClD,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;aAAM,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CACT,iGAAiG,CAClG,CAAC;QACJ,CAAC;QAED,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,cAAc,CACtB,WAAW,WAAW,oBAAoB,KAAK,CAAC,MAAM,mBAAmB,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,mBAAmB;YACnB,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;YACnC,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,CAAC;QAED,aAAa,CACX,eAAe,EACf,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CACxF,CAAC;QACF,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,aAAa,OAAO,GAAG,CAAC,CAAC;IAC7E,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,WAAW;IAClB,+DAA+D;IAC/D,IAAI,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAElF,CAAC;IACF,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,QAAQ,CACrB,GAAW,EACX,GAAW,EACX,OAAmC,EAAE;IAErC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,YAAY,GAAG,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,IAA6C,CAAC,CAAC;IACvF,MAAM,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe,EAAE,IAAY,EAAE,MAAwB;IACtE,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACxD,KAAK,EAAE,SAAS;SACjB,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,wEAAwE;IACxE,oEAAoE;IACpE,kEAAkE;IAClE,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QACvD,KAAK,EAAE,SAAS;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,SAAS,CAClB,YAAY,EACZ,CAAC,UAAU,EAAE,yBAAyB,OAAO,uBAAuB,IAAI,UAAU,CAAC,EACnF,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;QACF,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;AACH,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,KAAK,gBAAgB,CAAC"}

package/dist/platform.js

@@ -0,0 +1,45 @@
+// Maps Node's process.platform / process.arch to the asset filenames
+// goreleaser produces for secretgenerator releases. The mapping must match
+// .goreleaser.yaml's archive name template:
+//   {{.ProjectName}}_{{.Version}}_{{.Os}}_{{.Arch}}.{tar.gz|zip}
+import os from "node:os";
+export class UnsupportedPlatformError extends Error {
+    constructor(platform, arch) {
+        super(`secretgenerator: no prebuilt release for ${platform}/${arch}. ` +
+            "Supported: linux/amd64, linux/arm64, darwin/amd64, darwin/arm64, windows/amd64. " +
+            "If your platform is unsupported, install from source via " +
+            "`go install github.com/rafaelperoco/secretgenerator/cmd/secretgenerator@latest`.");
+    }
+}
+export function detectAsset() {
+    const platform = process.platform;
+    const arch = process.arch;
+    switch (`${platform}/${arch}`) {
+        case "linux/x64":
+            return { suffix: "linux_amd64.tar.gz", format: "tar.gz", binary: "secretgenerator" };
+        case "linux/arm64":
+            return { suffix: "linux_arm64.tar.gz", format: "tar.gz", binary: "secretgenerator" };
+        case "darwin/x64":
+            return { suffix: "darwin_amd64.tar.gz", format: "tar.gz", binary: "secretgenerator" };
+        case "darwin/arm64":
+            return { suffix: "darwin_arm64.tar.gz", format: "tar.gz", binary: "secretgenerator" };
+        case "win32/x64":
+            return { suffix: "windows_amd64.zip", format: "zip", binary: "secretgenerator.exe" };
+        default:
+            throw new UnsupportedPlatformError(platform, arch);
+    }
+}
+/** Where the downloaded binary is cached on disk. Honors NPM-style local
+ * install layouts (the npm package's own dir) since postinstall runs there. */
+export function cacheDir(packageRoot) {
+    return packageRoot;
+}
+export function homedirSafe() {
+    try {
+        return os.homedir();
+    }
+    catch {
+        return "/tmp";
+    }
+}
+//# sourceMappingURL=platform.js.map

package/dist/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../src/platform.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,2EAA2E;AAC3E,4CAA4C;AAC5C,iEAAiE;AAEjE,OAAO,EAAE,MAAM,SAAS,CAAC;AAWzB,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,QAAgB,EAAE,IAAY;QACxC,KAAK,CACH,4CAA4C,QAAQ,IAAI,IAAI,IAAI;YAC9D,kFAAkF;YAClF,2DAA2D;YAC3D,kFAAkF,CACrF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAC1B,QAAQ,GAAG,QAAQ,IAAI,IAAI,EAAE,EAAE,CAAC;QAC9B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACvF,KAAK,aAAa;YAChB,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACvF,KAAK,YAAY;YACf,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACxF,KAAK,cAAc;YACjB,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;QACxF,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACvF;YACE,MAAM,IAAI,wBAAwB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;+EAC+E;AAC/E,MAAM,UAAU,QAAQ,CAAC,WAAmB;IAC1C,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC"}

package/dist/run.js

@@ -0,0 +1,68 @@
+#!/usr/bin/env node
+// `npx secretgenerator <args>` entry point.
+//
+// On first run after install, the binary lives at <packageRoot>/bin/.
+// This wrapper simply execs it with the user's argv. We pass the user's
+// stdio through unchanged so JSON pipelines, audit logs, and TTY-aware
+// behavior all work transparently.
+//
+// If the postinstall step did not run (some npm install configurations,
+// CI containers without network), we fall back to invoking install on
+// demand the first time the binary is missing. This makes the package
+// resilient to npm's `--ignore-scripts`.
+import { spawn } from "node:child_process";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { detectAsset, UnsupportedPlatformError } from "./platform.js";
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const packageRoot = path.resolve(__dirname, "..");
+const binDir = path.join(packageRoot, "bin");
+main().catch((err) => {
+    console.error(`secretgenerator: ${err.message}`);
+    process.exit(1);
+});
+async function main() {
+    let asset;
+    try {
+        asset = detectAsset();
+    }
+    catch (err) {
+        if (err instanceof UnsupportedPlatformError) {
+            console.error(err.message);
+            process.exit(2);
+        }
+        throw err;
+    }
+    const binary = path.join(binDir, asset.binary);
+    if (!existsSync(binary)) {
+        // Lazy install: --ignore-scripts users only pay the cost on first run.
+        console.error("[secretgenerator] binary not found; running install (this happens once per machine)");
+        const installScript = path.join(__dirname, "install.js");
+        await runChild(process.execPath, [installScript], "inherit");
+        if (!existsSync(binary)) {
+            throw new Error(`binary still missing at ${binary} after install; check earlier output for the reason`);
+        }
+    }
+    const status = await runChild(binary, process.argv.slice(2), "inherit");
+    process.exit(status);
+}
+function runChild(cmd, args, stdio) {
+    return new Promise((resolve, reject) => {
+        const child = spawn(cmd, args, {
+            stdio,
+            // Forward signals so Ctrl-C in npx propagates to the child.
+            windowsHide: true,
+        });
+        child.on("error", reject);
+        child.on("exit", (code, signal) => {
+            if (signal) {
+                // Re-raise the signal to the parent so shell-level exit code
+                // semantics (130 for SIGINT, etc.) are preserved.
+                process.kill(process.pid, signal);
+            }
+            resolve(code ?? 0);
+        });
+    });
+}
+//# sourceMappingURL=run.js.map

package/dist/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":";AACA,4CAA4C;AAC5C,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,mCAAmC;AACnC,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,yCAAyC;AAEzC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEtE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAClD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAE7C,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,IAAI;IACjB,IAAI,KAAK,CAAC;IACV,IAAI,CAAC;QACH,KAAK,GAAG,WAAW,EAAE,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,wBAAwB,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,uEAAuE;QACvE,OAAO,CAAC,KAAK,CACX,qFAAqF,CACtF,CAAC;QACF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QACzD,MAAM,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,qDAAqD,CACvF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAc,EAAE,KAAgB;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;YAC7B,KAAK;YACL,4DAA4D;YAC5D,WAAW,EAAE,IAAI;SAClB,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAChC,IAAI,MAAM,EAAE,CAAC;gBACX,6DAA6D;gBAC7D,kDAAkD;gBAClD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;YACD,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/verify.js

@@ -0,0 +1,94 @@
+// Verification helpers used during postinstall. Two layers:
+//
+// 1. SHA-256 against the `checksums.txt` published by goreleaser. This
+//    is the minimum integrity check; it ensures the archive matches what
+//    the GitHub release advertised.
+//
+// 2. Cosign keyless signature on `checksums.txt.sig` / `checksums.txt.pem`,
+//    when the `cosign` binary is on PATH. This is the strongest tier:
+//    proves the checksums file was produced by the
+//    secretgenerator GitHub Actions workflow (Sigstore Fulcio + GitHub
+//    OIDC). When cosign is not present we still trust the SHA-256 because
+//    the file came from the same HTTPS GitHub host that signed it; the
+//    cosign step is a defense-in-depth, not the primary chain.
+//
+// We deliberately do NOT bundle a cosign binary in the npm package; we
+// fall through gracefully so machines without cosign still get the
+// installer to work.
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+export class IntegrityError extends Error {
+}
+/** Returns lowercase-hex SHA-256 of a file. */
+export function sha256OfFile(p) {
+    const h = createHash("sha256");
+    h.update(readFileSync(p));
+    return h.digest("hex");
+}
+/** Parses the goreleaser-style checksums.txt:
+ *
+ *   abc...123  secretgenerator_v2.0.0_linux_amd64.tar.gz
+ *
+ * Returns a map from filename to lowercase-hex SHA-256. Lines that do not
+ * match the shape are silently skipped (the file may contain blank lines
+ * or future headers).
+ */
+export function parseChecksums(text) {
+    const m = new Map();
+    for (const line of text.split(/\r?\n/)) {
+        const match = line.match(/^([0-9a-f]{64})\s+\*?(.+?)\s*$/i);
+        if (match) {
+            m.set(match[2], match[1].toLowerCase());
+        }
+    }
+    return m;
+}
+/** Throws IntegrityError when the SHA-256 of `archivePath` does not
+ *  match the entry for `archiveName` in `checksums.txt`. */
+export function verifyChecksum(archivePath, archiveName, checksumsText) {
+    const map = parseChecksums(checksumsText);
+    const expected = map.get(archiveName);
+    if (!expected) {
+        throw new IntegrityError(`checksums.txt has no entry for ${archiveName}. ` +
+            "Was the release truncated, or is this an unexpected version tag?");
+    }
+    const got = sha256OfFile(archivePath);
+    if (got !== expected) {
+        throw new IntegrityError(`SHA-256 mismatch for ${archiveName}: got ${got}, want ${expected}. ` +
+            "The archive was modified in transit. Aborting installation.");
+    }
+    return expected;
+}
+/** Returns true when `cosign` is on PATH. Used to gate the keyless
+ *  signature verification step (best-effort, optional). */
+export function cosignAvailable() {
+    const r = spawnSync("cosign", ["version"], { stdio: "ignore" });
+    return r.status === 0;
+}
+/** Verifies cosign keyless signature on checksums.txt. The certificate
+ *  identity is constrained to the secretgenerator release workflow; only
+ *  files signed by that identity pass. Returns true on success, false
+ *  (with a console.warn) on any failure — failure is non-fatal because
+ *  the SHA-256 chain already authenticated the archive. */
+export function verifyCosign(checksumsPath, certPath, sigPath) {
+    const args = [
+        "verify-blob",
+        "--certificate",
+        certPath,
+        "--signature",
+        sigPath,
+        "--certificate-identity-regexp",
+        "https://github.com/rafaelperoco/secretgenerator/.github/workflows/release.yml@refs/tags/v.*",
+        "--certificate-oidc-issuer",
+        "https://token.actions.githubusercontent.com",
+        checksumsPath,
+    ];
+    const r = spawnSync("cosign", args, { encoding: "utf8" });
+    if (r.status !== 0) {
+        console.warn(`[secretgenerator] cosign verification failed (non-fatal): ${(r.stderr || "").trim()}`);
+        return false;
+    }
+    return true;
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,yEAAyE;AACzE,oCAAoC;AACpC,EAAE;AACF,4EAA4E;AAC5E,sEAAsE;AACtE,mDAAmD;AACnD,uEAAuE;AACvE,0EAA0E;AAC1E,uEAAuE;AACvE,+DAA+D;AAC/D,EAAE;AACF,uEAAuE;AACvE,mEAAmE;AACnE,qBAAqB;AAErB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,OAAO,cAAe,SAAQ,KAAK;CAAG;AAE5C,+CAA+C;AAC/C,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,CAAC,GAAG,IAAI,GAAG,EAAkB,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC5D,IAAI,KAAK,EAAE,CAAC;YACV,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;4DAC4D;AAC5D,MAAM,UAAU,cAAc,CAC5B,WAAmB,EACnB,WAAmB,EACnB,aAAqB;IAErB,MAAM,GAAG,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,cAAc,CACtB,kCAAkC,WAAW,IAAI;YAC/C,kEAAkE,CACrE,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,cAAc,CACtB,wBAAwB,WAAW,SAAS,GAAG,UAAU,QAAQ,IAAI;YACnE,6DAA6D,CAChE,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;2DAC2D;AAC3D,MAAM,UAAU,eAAe;IAC7B,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACxB,CAAC;AAED;;;;2DAI2D;AAC3D,MAAM,UAAU,YAAY,CAC1B,aAAqB,EACrB,QAAgB,EAChB,OAAe;IAEf,MAAM,IAAI,GAAG;QACX,aAAa;QACb,eAAe;QACf,QAAQ;QACR,aAAa;QACb,OAAO;QACP,+BAA+B;QAC/B,6FAA6F;QAC7F,2BAA2B;QAC3B,6CAA6C;QAC7C,aAAa;KACd,CAAC;IACF,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CACV,6DAA6D,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CACvF,CAAC;QACF,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -0,0 +1,53 @@
+{
+  "name": "@secretgenerator/cli",
+  "version": "2.0.0",
+  "description": "Zero-config installer for the secretgenerator CLI. Downloads the right binary for your OS/arch from a verified GitHub release, checks the SHA-256, and (when cosign is available) verifies the keyless Sigstore signature.",
+  "type": "module",
+  "license": "MIT",
+  "homepage": "https://secretgenerator.org",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/rafaelperoco/secretgenerator.git",
+    "directory": "cli"
+  },
+  "keywords": [
+    "secretgenerator",
+    "secret-generation",
+    "password-generator",
+    "csprng",
+    "cli",
+    "auditable",
+    "sigstore",
+    "slsa",
+    "cosign"
+  ],
+  "bin": {
+    "secretgenerator": "dist/run.js"
+  },
+  "main": "dist/run.js",
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.json && chmod +x dist/run.js",
+    "prepack": "npm run build",
+    "postinstall": "node dist/install.js || echo 'secretgenerator: postinstall skipped (likely a tarball-only environment); run `npx secretgenerator --help` to retry'"
+  },
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "os": [
+    "linux",
+    "darwin",
+    "win32"
+  ],
+  "cpu": [
+    "x64",
+    "arm64"
+  ],
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.6.0"
+  }
+}