@sigma-auth/cli 0.0.1

package/src/cookies.ts

@@ -0,0 +1,170 @@
+import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { dirname } from "node:path";
+import { ensureDir } from "./fsutil.ts";
+
+export type Cookie = {
+	domain: string;
+	includeSubdomains: boolean;
+	path: string;
+	secure: boolean;
+	expires: number;
+	name: string;
+	value: string;
+};
+
+function parseSetCookie(header: string, requestUrl: string): Cookie | null {
+	const parts = header.split(";").map((part) => part.trim());
+	const nv = parts[0];
+	if (!nv) {
+		return null;
+	}
+	const eq = nv.indexOf("=");
+	if (eq <= 0) {
+		return null;
+	}
+	const name = nv.slice(0, eq);
+	const value = nv.slice(eq + 1);
+	const url = new URL(requestUrl);
+	let domain = url.hostname;
+	let path = "/";
+	let secure = false;
+	let expires = 0;
+	for (const part of parts.slice(1)) {
+		const [k, v] = part.split("=").map((item) => item.trim());
+		const key = k?.toLowerCase();
+		if (key === "domain" && v) {
+			domain = v.replace(/^\./, "");
+		} else if (key === "path" && v) {
+			path = v;
+		} else if (key === "secure") {
+			secure = true;
+		} else if (key === "max-age" && v) {
+			expires = Math.floor(Date.now() / 1000) + Number.parseInt(v, 10);
+		}
+	}
+	return {
+		domain,
+		includeSubdomains: domain !== "localhost",
+		path,
+		secure,
+		expires,
+		name,
+		value,
+	};
+}
+
+export function loadJar(path: string): Cookie[] {
+	if (!existsSync(path)) {
+		return [];
+	}
+	const cookies: Cookie[] = [];
+	for (const line of readFileSync(path, "utf8").split("\n")) {
+		if (!line || line.startsWith("#")) {
+			continue;
+		}
+		const cols = line.split("\t");
+		if (cols.length < 7) {
+			continue;
+		}
+		const [domain, flag, path, secure, expires, name, value] = cols;
+		if (!domain || !path || !name || value === undefined) {
+			continue;
+		}
+		cookies.push({
+			domain: domain.replace(/^\./, ""),
+			includeSubdomains: flag === "TRUE",
+			path,
+			secure: secure === "TRUE",
+			expires: Number.parseInt(expires ?? "0", 10) || 0,
+			name,
+			value,
+		});
+	}
+	return cookies;
+}
+
+export function saveJar(path: string, cookies: Cookie[]): void {
+	ensureDir(dirname(path));
+	const lines = [
+		"# Netscape HTTP Cookie File",
+		"# https://curl.se/docs/http-cookies.html",
+		"",
+	];
+	for (const cookie of cookies) {
+		const domain = cookie.includeSubdomains ? `.${cookie.domain}` : cookie.domain;
+		lines.push(
+			[
+				domain,
+				cookie.includeSubdomains ? "TRUE" : "FALSE",
+				cookie.path,
+				cookie.secure ? "TRUE" : "FALSE",
+				String(cookie.expires),
+				cookie.name,
+				cookie.value,
+			].join("\t")
+		);
+	}
+	writeFileSync(path, `${lines.join("\n")}\n`, { encoding: "utf8", mode: 0o600 });
+	chmodSync(path, 0o600);
+}
+
+export function mergeSetCookies(
+	jarPath: string,
+	requestUrl: string,
+	headers: Headers
+): Cookie[] {
+	const cookies = loadJar(jarPath);
+	const setCookies =
+		typeof headers.getSetCookie === "function"
+			? headers.getSetCookie()
+			: headers.get("set-cookie")
+				? [headers.get("set-cookie") as string]
+				: [];
+	for (const header of setCookies) {
+		const parsed = parseSetCookie(header, requestUrl);
+		if (!parsed) {
+			continue;
+		}
+		const idx = cookies.findIndex(
+			(item) => item.name === parsed.name && item.domain === parsed.domain
+		);
+		if (idx >= 0) {
+			cookies[idx] = parsed;
+		} else {
+			cookies.push(parsed);
+		}
+	}
+	saveJar(jarPath, cookies);
+	return cookies;
+}
+
+export function cookieHeaderFor(url: string, cookies: Cookie[]): string {
+	const target = new URL(url);
+	const now = Math.floor(Date.now() / 1000);
+	return cookies
+		.filter((cookie) => {
+			if (cookie.expires > 0 && cookie.expires < now) {
+				return false;
+			}
+			if (cookie.secure && target.protocol !== "https:") {
+				return false;
+			}
+			const host = target.hostname;
+			const domainOk =
+				host === cookie.domain ||
+				(cookie.includeSubdomains && host.endsWith(`.${cookie.domain}`));
+			const pathOk =
+				target.pathname === cookie.path ||
+				target.pathname.startsWith(
+					cookie.path.endsWith("/") ? cookie.path : `${cookie.path}/`
+				) ||
+				cookie.path === "/";
+			return domainOk && pathOk;
+		})
+		.map((cookie) => `${cookie.name}=${cookie.value}`)
+		.join("; ");
+}
+
+export function sessionCookieNames(cookies: Cookie[]): string[] {
+	return cookies.map((cookie) => cookie.name);
+}

package/src/error.ts

@@ -0,0 +1,72 @@
+export class CliError extends Error {
+	readonly exitCode: number;
+	readonly code: string;
+	readonly status?: number;
+
+	constructor(
+		exitCode: number,
+		code: string,
+		message: string,
+		status?: number
+	) {
+		super(message);
+		this.name = "CliError";
+		this.exitCode = exitCode;
+		this.code = code;
+		this.status = status;
+	}
+}
+
+export function usage(message: string): never {
+	throw new CliError(1, "usage", message);
+}
+
+export function cryptoFail(message: string): never {
+	throw new CliError(7, "crypto", message);
+}
+
+export function ioFail(message: string): never {
+	throw new CliError(7, "io", message);
+}
+
+export function envFail(message: string): never {
+	throw new CliError(1, "env", message);
+}
+
+export function exitForHttp(status: number): number {
+	if (status === 401 || status === 403) {
+		return 2;
+	}
+	if (status === 404) {
+		return 3;
+	}
+	if (status === 409) {
+		return 4;
+	}
+	if (status === 429) {
+		return 5;
+	}
+	if (status >= 500) {
+		return 6;
+	}
+	return 1;
+}
+
+export function codeForHttp(status: number): string {
+	if (status === 401 || status === 403) {
+		return "auth";
+	}
+	if (status === 404) {
+		return "not_found";
+	}
+	if (status === 409) {
+		return "conflict";
+	}
+	if (status === 429) {
+		return "rate_limit";
+	}
+	if (status >= 500) {
+		return "server";
+	}
+	return "usage";
+}

package/src/fsutil.ts

@@ -0,0 +1,48 @@
+import {
+	chmodSync,
+	existsSync,
+	mkdirSync,
+	readFileSync,
+	statSync,
+	writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+import { ioFail, usage } from "./error.ts";
+
+export function ensureDir(path: string, mode = 0o700): void {
+	mkdirSync(path, { recursive: true, mode });
+	chmodSync(path, mode);
+}
+
+export function writeSecretFile(
+	path: string,
+	contents: string,
+	force: boolean
+): void {
+	if (existsSync(path) && !force) {
+		usage(`refusing to overwrite ${path} (pass --force)`);
+	}
+	ensureDir(dirname(path));
+	writeFileSync(path, contents, { encoding: "utf8", mode: 0o600 });
+	chmodSync(path, 0o600);
+}
+
+export function readText(path: string): string {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		ioFail(`cannot read ${path}`);
+	}
+}
+
+export function fileMode(path: string): number {
+	try {
+		return statSync(path).mode & 0o777;
+	} catch {
+		return 0;
+	}
+}
+
+export function pathExists(path: string): boolean {
+	return existsSync(path);
+}

package/src/http.ts

@@ -0,0 +1,90 @@
+import {
+	CliError,
+	codeForHttp,
+	exitForHttp,
+} from "./error.ts";
+import {
+	cookieHeaderFor,
+	loadJar,
+	mergeSetCookies,
+} from "./cookies.ts";
+
+export type HttpClient = {
+	baseUrl: string;
+	cookieJar: string;
+	timeoutMs: number;
+	fetchImpl: typeof fetch;
+};
+
+export function createHttp(opts: {
+	baseUrl: string;
+	cookieJar: string;
+	timeoutMs: number;
+	fetchImpl?: typeof fetch;
+}): HttpClient {
+	return {
+		baseUrl: opts.baseUrl,
+		cookieJar: opts.cookieJar,
+		timeoutMs: opts.timeoutMs,
+		fetchImpl: opts.fetchImpl ?? fetch,
+	};
+}
+
+export async function requestJson(
+	client: HttpClient,
+	method: string,
+	path: string,
+	opts?: {
+		body?: unknown;
+		headers?: Record<string, string>;
+		withCookies?: boolean;
+		saveCookies?: boolean;
+	}
+): Promise<{ status: number; headers: Headers; json: unknown; text: string }> {
+	const url = `${client.baseUrl}${path}`;
+	const headers = new Headers(opts?.headers);
+	if (opts?.body !== undefined && !headers.has("content-type")) {
+		headers.set("content-type", "application/json");
+	}
+	if (opts?.withCookies) {
+		const cookie = cookieHeaderFor(url, loadJar(client.cookieJar));
+		if (cookie) {
+			headers.set("cookie", cookie);
+		}
+	}
+	const response = await client.fetchImpl(url, {
+		method,
+		headers,
+		body:
+			opts?.body === undefined
+				? undefined
+				: typeof opts.body === "string"
+					? opts.body
+					: JSON.stringify(opts.body),
+		signal: AbortSignal.timeout(client.timeoutMs),
+	});
+	if (opts?.saveCookies) {
+		mergeSetCookies(client.cookieJar, url, response.headers);
+	}
+	const text = await response.text();
+	let json: unknown = null;
+	if (text) {
+		try {
+			json = JSON.parse(text);
+		} catch {
+			json = null;
+		}
+	}
+	return { status: response.status, headers: response.headers, json, text };
+}
+
+export function throwHttp(path: string, status: number, json: unknown, text: string): never {
+	const record = json && typeof json === "object" ? (json as Record<string, unknown>) : {};
+	const message =
+		(typeof record.error_description === "string" && record.error_description) ||
+		(typeof record.message === "string" && record.message) ||
+		(typeof record.error === "string" && record.error) ||
+		text ||
+		`${path} failed with ${status}`;
+	throw new CliError(exitForHttp(status), codeForHttp(status), message, status);
+}

package/src/identity.ts

@@ -0,0 +1,155 @@
+import { HD, Mnemonic, PrivateKey } from "@bsv/sdk";
+import {
+	type BapMasterBackup,
+	decryptBackup,
+	encryptBackup,
+	isLegacyBackup,
+	isType42Backup,
+} from "bitcoin-backup";
+import { BAP } from "bsv-bap";
+import { cryptoFail } from "./error.ts";
+
+export type PublicIdentity = {
+	bapId: string;
+	pubkey: string;
+	address: string;
+	label?: string;
+	createdAt?: string;
+	ids: string[];
+};
+
+export function createMasterBackup(label: string): {
+	mnemonic: string;
+	backup: BapMasterBackup;
+	bapId: string;
+	pubkey: string;
+	address: string;
+} {
+	const mnemonic = Mnemonic.fromRandom();
+	const hdKey = HD.fromSeed(mnemonic.toSeed());
+	const rootKey = hdKey.derive("m/0'/0");
+	const rootPk = rootKey.privKey?.toWif();
+	if (!rootPk) {
+		cryptoFail("Failed to derive wallet root private key");
+	}
+	const bap = new BAP({ rootPk });
+	const first = bap.newId();
+	const backup: BapMasterBackup = {
+		rootPk,
+		ids: bap.exportIds(),
+		createdAt: new Date().toISOString(),
+		label,
+	};
+	const member = first.getAccountKey();
+	return {
+		mnemonic: mnemonic.toString(),
+		backup,
+		bapId: first.bapId,
+		pubkey: member.toPublicKey().toString(),
+		address: member.toAddress().toString(),
+	};
+}
+
+export function bapFromBackup(backup: BapMasterBackup): InstanceType<typeof BAP> {
+	let bap: InstanceType<typeof BAP>;
+	if (isLegacyBackup(backup)) {
+		bap = new BAP(backup.xprv);
+	} else if (isType42Backup(backup)) {
+		bap = new BAP({ rootPk: backup.rootPk });
+	} else {
+		cryptoFail("backup is not a Type42 or legacy master backup");
+	}
+	if (backup.ids && backup.ids.length > 0) {
+		bap.importIds(backup.ids);
+	}
+	return bap;
+}
+
+export function publicFields(
+	backup: BapMasterBackup,
+	bapId?: string
+): PublicIdentity {
+	const bap = bapFromBackup(backup);
+	const ids = bap.listIds();
+	if (ids.length === 0) {
+		cryptoFail("backup has no identities; run identity create");
+	}
+	const selected = bapId ?? ids[0];
+	if (!selected || !ids.includes(selected)) {
+		cryptoFail(`BAP id not found in backup${bapId ? `: ${bapId}` : ""}`);
+	}
+	const member = bap.getId(selected);
+	if (!member) {
+		cryptoFail(`BAP id not found: ${selected}`);
+	}
+	const key = member.getAccountKey();
+	return {
+		bapId: selected,
+		pubkey: key.toPublicKey().toString(),
+		address: key.toAddress().toString(),
+		label: "label" in backup ? backup.label : undefined,
+		createdAt: "createdAt" in backup ? backup.createdAt : undefined,
+		ids,
+	};
+}
+
+export function memberWif(backup: BapMasterBackup, bapId?: string): {
+	wif: string;
+	bapId: string;
+	pubkey: string;
+	address: string;
+} {
+	const fields = publicFields(backup, bapId);
+	const bap = bapFromBackup(backup);
+	const member = bap.getId(fields.bapId);
+	if (!member) {
+		cryptoFail(`BAP id not found: ${fields.bapId}`);
+	}
+	return {
+		wif: member.getAccountKey().toWif(),
+		bapId: fields.bapId,
+		pubkey: fields.pubkey,
+		address: fields.address,
+	};
+}
+
+export function rootPubkey(backup: BapMasterBackup): string | null {
+	if (isType42Backup(backup)) {
+		return PrivateKey.fromWif(backup.rootPk).toPublicKey().toString();
+	}
+	return null;
+}
+
+export async function encryptMaster(
+	backup: BapMasterBackup,
+	password: string
+): Promise<string> {
+	return encryptBackup(backup, password);
+}
+
+export async function decryptMaster(ciphertext: string, password: string): Promise<BapMasterBackup> {
+	try {
+		const decrypted = await decryptBackup(ciphertext, password);
+		if (isType42Backup(decrypted) || isLegacyBackup(decrypted)) {
+			return decrypted;
+		}
+		cryptoFail("decrypted backup is not a master backup");
+	} catch (error) {
+		const message = error instanceof Error ? error.message : "decrypt failed";
+		cryptoFail(message);
+	}
+}
+
+export function looksLikePlaintextBackup(text: string): boolean {
+	try {
+		const parsed = JSON.parse(text) as Record<string, unknown>;
+		return (
+			typeof parsed.rootPk === "string" ||
+			typeof parsed.xprv === "string" ||
+			typeof parsed.wif === "string" ||
+			typeof parsed.mnemonic === "string"
+		);
+	} catch {
+		return false;
+	}
+}

package/src/index.ts

@@ -0,0 +1,62 @@
+#!/usr/bin/env bun
+
+import { boolFlag, parseArgs } from "./args.ts";
+import {
+	authSignIn,
+	backupEncrypt,
+	backupPush,
+	doctor,
+	HELP,
+	identityCreate,
+	identityInfo,
+	oauthRegister,
+} from "./commands.ts";
+import { loadConfig } from "./config.ts";
+import { usage } from "./error.ts";
+import { reportError } from "./output.ts";
+
+export async function run(argv: string[]): Promise<number> {
+	const json = argv.includes("--json");
+	const quiet = argv.includes("--quiet");
+	try {
+		const args = parseArgs(argv);
+		const cfg = loadConfig(args);
+		if (boolFlag(args, "help") || args.positional[0] === "help") {
+			process.stdout.write(HELP);
+			return 0;
+		}
+		const [group, command] = args.positional;
+		if (group === "identity" && command === "create") {
+			return await identityCreate(args, cfg);
+		}
+		if (group === "identity" && command === "info") {
+			return await identityInfo(args, cfg);
+		}
+		if (group === "backup" && command === "encrypt") {
+			return await backupEncrypt(args, cfg);
+		}
+		if (group === "backup" && command === "push") {
+			return await backupPush(args, cfg);
+		}
+		if (group === "auth" && command === "sign-in") {
+			return await authSignIn(args, cfg);
+		}
+		if (group === "oauth" && command === "register") {
+			return await oauthRegister(args, cfg);
+		}
+		if (group === "doctor") {
+			return await doctor(args, cfg);
+		}
+		if (!group) {
+			process.stdout.write(HELP);
+			return 0;
+		}
+		usage(`unknown command: ${args.positional.join(" ")}`);
+	} catch (error) {
+		return reportError({ json, quiet }, error);
+	}
+}
+
+if (import.meta.main) {
+	process.exit(await run(process.argv.slice(2)));
+}

package/src/output.ts

@@ -0,0 +1,50 @@
+import { CliError } from "./error.ts";
+
+export type OutputMode = {
+	json: boolean;
+	quiet: boolean;
+};
+
+export function printJson(ok: boolean, data: unknown, error?: unknown): void {
+	if (ok) {
+		process.stdout.write(`${JSON.stringify({ ok: true, data })}\n`);
+		return;
+	}
+	process.stdout.write(`${JSON.stringify({ ok: false, error })}\n`);
+}
+
+export function printHuman(mode: OutputMode, text: string): void {
+	if (mode.quiet || mode.json) {
+		return;
+	}
+	process.stdout.write(`${text}\n`);
+}
+
+export function printWarn(mode: OutputMode, text: string): void {
+	if (mode.json) {
+		return;
+	}
+	process.stderr.write(`${text}\n`);
+}
+
+export function reportError(mode: OutputMode, err: unknown): number {
+	if (err instanceof CliError) {
+		if (mode.json) {
+			printJson(false, undefined, {
+				code: err.code,
+				message: err.message,
+				status: err.status,
+			});
+		} else if (!mode.quiet) {
+			process.stderr.write(`${err.message}\n`);
+		}
+		return err.exitCode;
+	}
+	const message = err instanceof Error ? err.message : String(err);
+	if (mode.json) {
+		printJson(false, undefined, { code: "io", message });
+	} else {
+		process.stderr.write(`${message}\n`);
+	}
+	return 1;
+}

package/src/password.ts

@@ -0,0 +1,54 @@
+import { readFileSync } from "node:fs";
+import type { ParsedArgs } from "./args.ts";
+import { boolFlag, flag } from "./args.ts";
+import { MIN_PASSWORD_LENGTH } from "./config.ts";
+import { cryptoFail, usage } from "./error.ts";
+
+function envPassword(): string | undefined {
+	if (!("SIGMA_BACKUP_PASSWORD" in process.env)) {
+		return undefined;
+	}
+	const value = process.env.SIGMA_BACKUP_PASSWORD;
+	if (value === undefined || value === "") {
+		usage("SIGMA_BACKUP_PASSWORD is set but empty");
+	}
+	return value;
+}
+
+export async function resolvePassword(
+	args: ParsedArgs,
+	required: boolean
+): Promise<string | undefined> {
+	const fromFile = flag(args, "password-file");
+	const fromStdin = boolFlag(args, "password-stdin");
+	const fromEnv = envPassword();
+	const sources = [fromFile, fromStdin ? "stdin" : undefined, fromEnv].filter(
+		(item) => item !== undefined
+	);
+	if (sources.length > 1) {
+		usage("use exactly one of --password-file, --password-stdin, or SIGMA_BACKUP_PASSWORD");
+	}
+	if (sources.length === 0) {
+		if (required) {
+			usage("password required: --password-file, --password-stdin, or SIGMA_BACKUP_PASSWORD");
+		}
+		return undefined;
+	}
+
+	let password: string;
+	if (fromFile) {
+		password = readFileSync(fromFile, "utf8").trim();
+	} else if (fromStdin) {
+		password = (await Bun.stdin.text()).trim();
+	} else {
+		password = fromEnv as string;
+	}
+
+	if (password === "") {
+		usage("password is empty");
+	}
+	if (password.length < MIN_PASSWORD_LENGTH) {
+		cryptoFail(`password must be at least ${MIN_PASSWORD_LENGTH} characters`);
+	}
+	return password;
+}