@sigma-auth/cli 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Open Protocol Labs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,39 @@
+# @sigma-auth/cli
+
+Headless CLI for [Sigma Auth](https://auth.sigmaidentity.com). Create a Bitcoin (BAP) identity key **locally**, sign in with Bitcoin-Auth, push `bitcoin-backup` ciphertext, and register OAuth clients.
+
+The server never sees private keys. Identity is a BAP member key, not an API key.
+
+```bash
+bunx @sigma-auth/cli --help
+```
+
+## Agent one-shot
+
+```bash
+export SIGMA_AUTH_URL=https://auth.sigmaidentity.com
+export SIGMA_BACKUP_PASSWORD="$(openssl rand -base64 32)"
+
+bunx @sigma-auth/cli identity create \
+  --label "agent" \
+  --out ./identity.bep \
+  --signin \
+  --push-backup \
+  --json
+```
+
+## Commands
+
+| Command | Job |
+| --- | --- |
+| `sigma identity create` | Create Type42 master + first BAP, encrypt `.bep` |
+| `sigma identity info` | Public fields from a local backup |
+| `sigma backup encrypt` | JSON → `.bep` |
+| `sigma auth sign-in` | Member-key Bitcoin-Auth; cookie jar; register BAP |
+| `sigma backup push` | POST ciphertext only |
+| `sigma oauth register` | Session `/api/oauth-clients` or RFC 7591 DCR |
+| `sigma doctor` | Env, files, RFC 8414, session |
+
+Password sources (exactly one): `--password-file`, `--password-stdin`, or `SIGMA_BACKUP_PASSWORD`. `--password` on argv is rejected.
+
+Contract: `docs/specs/sigma-cli-v1.md` in [sigma-auth](https://github.com/b-open-io/sigma-auth).

package/package.json

@@ -0,0 +1,47 @@
+{
+	"name": "@sigma-auth/cli",
+	"version": "0.0.1",
+	"description": "Headless Sigma Auth CLI: create a BAP identity locally, sign in with Bitcoin-Auth, push encrypted backups, register OAuth clients",
+	"type": "module",
+	"bin": {
+		"sigma": "./src/index.ts"
+	},
+	"files": [
+		"src",
+		"README.md"
+	],
+	"scripts": {
+		"sigma": "bun run src/index.ts",
+		"test": "bun test tests",
+		"lint": "biome check .",
+		"build": "bun test tests"
+	},
+	"publishConfig": {
+		"access": "public"
+	},
+	"keywords": [
+		"sigma-auth",
+		"bitcoin",
+		"bap",
+		"oauth",
+		"cli"
+	],
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/b-open-io/sigma-auth-cli.git"
+	},
+	"engines": {
+		"bun": ">=1.1.0"
+	},
+	"dependencies": {
+		"@bsv/sdk": "^2.1.6",
+		"bitcoin-auth": "^0.0.8",
+		"bitcoin-backup": "^0.0.13",
+		"bsv-bap": "^0.3.3"
+	},
+	"devDependencies": {
+		"@types/bun": "latest",
+		"typescript": "^5"
+	}
+}

package/src/args.ts

@@ -0,0 +1,81 @@
+import { usage } from "./error.ts";
+
+const BOOL_FLAGS = new Set([
+	"json",
+	"quiet",
+	"force",
+	"help",
+	"signin",
+	"push-backup",
+	"show-mnemonic",
+	"public",
+	"password-stdin",
+]);
+
+const REPEATABLE = new Set(["redirect-uri", "grant-type"]);
+
+export type ParsedArgs = {
+	positional: string[];
+	flags: Record<string, string[]>;
+};
+
+export function flag(args: ParsedArgs, name: string): string | undefined {
+	const values = args.flags[name];
+	return values?.[0];
+}
+
+export function flagList(args: ParsedArgs, name: string): string[] {
+	return args.flags[name] ?? [];
+}
+
+export function boolFlag(args: ParsedArgs, name: string): boolean {
+	return args.flags[name]?.[0] === "true";
+}
+
+export function parseArgs(argv: string[]): ParsedArgs {
+	const positional: string[] = [];
+	const flags: Record<string, string[]> = {};
+
+	for (let i = 0; i < argv.length; i++) {
+		const token = argv[i];
+		if (token === undefined) {
+			break;
+		}
+		if (token === "--password" || token.startsWith("--password=")) {
+			usage("--password is not allowed; use --password-file, --password-stdin, or SIGMA_BACKUP_PASSWORD");
+		}
+		if (token === "-h") {
+			flags.help = ["true"];
+			continue;
+		}
+		if (token === "--") {
+			positional.push(...argv.slice(i + 1));
+			break;
+		}
+		if (!token.startsWith("--")) {
+			positional.push(token);
+			continue;
+		}
+		const eq = token.indexOf("=");
+		const name = (eq === -1 ? token.slice(2) : token.slice(2, eq)).trim();
+		if (!name) {
+			usage("empty flag");
+		}
+		if (BOOL_FLAGS.has(name)) {
+			const raw = eq === -1 ? "true" : token.slice(eq + 1);
+			flags[name] = [raw === "false" ? "false" : "true"];
+			continue;
+		}
+		const value = eq === -1 ? argv[++i] : token.slice(eq + 1);
+		if (value === undefined || value.startsWith("--")) {
+			usage(`missing value for --${name}`);
+		}
+		if (REPEATABLE.has(name)) {
+			flags[name] = [...(flags[name] ?? []), value];
+		} else {
+			flags[name] = [value];
+		}
+	}
+
+	return { positional, flags };
+}