@tuskydp/cli 0.1.0 → 0.1.1

package/src/commands/encryption.ts

@@ -0,0 +1,305 @@
+import type { Command } from 'commander';
+import chalk from 'chalk';
+import inquirer from 'inquirer';
+import { getSDKClientFromParent } from '../sdk.js';
+import {
+  deriveMasterKey,
+  computeVerifier,
+  verifyPassphrase,
+  generateSalt,
+  generateMasterKey,
+  generateRecoveryKey,
+  wrapMasterKey,
+  unwrapMasterKey,
+} from '../crypto.js';
+import { storeMasterKey, loadMasterKey, clearSession } from '../lib/keyring.js';
+
+export function registerEncryptionCommands(program: Command) {
+  const encryption = program.command('encryption').description('Manage E2E encryption');
+
+  encryption.command('setup')
+    .description('Set encryption passphrase (first time only)')
+    .action(async () => {
+      const sdk = getSDKClientFromParent(encryption);
+
+      // Check if already set up
+      const { setupComplete } = await sdk.account.getEncryptionParams();
+      if (setupComplete) {
+        console.log(chalk.yellow('Encryption is already set up.'));
+        console.log(chalk.dim('Use: tusky encryption change-passphrase'));
+        return;
+      }
+
+      // Get passphrase
+      const answers = await inquirer.prompt([
+        {
+          type: 'password',
+          name: 'passphrase',
+          message: 'Enter encryption passphrase:',
+          mask: '*',
+          validate: (input: string) => input.length >= 8 || 'Passphrase must be at least 8 characters',
+        },
+        {
+          type: 'password',
+          name: 'confirm',
+          message: 'Confirm passphrase:',
+          mask: '*',
+        },
+      ]);
+
+      if (answers.passphrase !== answers.confirm) {
+        console.error(chalk.red('Passphrases do not match.'));
+        return;
+      }
+
+      // Generate random master key and derive wrapping key from passphrase
+      const masterKey = generateMasterKey();
+      const salt = generateSalt();
+      const wrappingKey = deriveMasterKey(answers.passphrase, salt);
+      const verifier = computeVerifier(wrappingKey);
+
+      // Wrap master key with wrapping key (for passphrase unlock)
+      const encryptedMasterKey = wrapMasterKey(masterKey, wrappingKey);
+
+      // Wrap master key with recovery key (for recovery flow)
+      const recoveryKeyRaw = generateRecoveryKey();
+      const wrappedMasterKeyBackup = wrapMasterKey(masterKey, recoveryKeyRaw);
+      const recoveryKeyBase64 = recoveryKeyRaw.toString('base64');
+
+      // Send to server
+      await sdk.account.setupEncryption({
+        salt: salt.toString('base64'),
+        verifier: verifier.toString('base64'),
+        encryptedMasterKey: encryptedMasterKey.toString('base64'),
+        wrappedMasterKeyBackup: wrappedMasterKeyBackup.toString('base64'),
+      });
+
+      // Store master key in session
+      storeMasterKey(masterKey);
+
+      // Display recovery key
+      console.log('');
+      console.log(chalk.yellow.bold('SAVE YOUR RECOVERY KEY — it will not be shown again:'));
+      console.log('');
+      console.log(chalk.bold(`  ${recoveryKeyBase64}`));
+      console.log('');
+
+      const confirmSaved = await inquirer.prompt([{
+        type: 'confirm',
+        name: 'saved',
+        message: 'Have you saved your recovery key?',
+        default: false,
+      }]);
+
+      if (!confirmSaved.saved) {
+        console.log(chalk.yellow('Please save your recovery key before continuing!'));
+        console.log(chalk.bold(`  ${recoveryKeyBase64}`));
+      }
+
+      console.log(chalk.green('Encryption configured successfully.'));
+    });
+
+  encryption.command('unlock')
+    .description('Unlock encryption for this session')
+    .option('--passphrase <passphrase>', 'Passphrase (non-interactive; also reads TUSKYDP_PASSWORD env var)')
+    .action(async (options: { passphrase?: string }) => {
+      const sdk = getSDKClientFromParent(encryption);
+
+      const { setupComplete, salt, verifier, encryptedMasterKey } = await sdk.account.getEncryptionParams();
+      if (!setupComplete) {
+        console.error(chalk.red('Encryption not set up. Run: tusky encryption setup'));
+        return;
+      }
+
+      // Resolve passphrase: flag > env var > interactive prompt
+      let passphrase = options.passphrase ?? process.env.TUSKYDP_PASSWORD;
+      if (!passphrase) {
+        const answers = await inquirer.prompt([{
+          type: 'password',
+          name: 'passphrase',
+          message: 'Enter encryption passphrase:',
+          mask: '*',
+        }]);
+        passphrase = answers.passphrase as string;
+      }
+
+      const saltBuffer = Buffer.from(salt!, 'base64');
+      const verifierBuffer = Buffer.from(verifier!, 'base64');
+      const wrappingKey = deriveMasterKey(passphrase, saltBuffer);
+
+      if (!verifyPassphrase(wrappingKey, verifierBuffer)) {
+        console.error(chalk.red('Invalid passphrase.'));
+        process.exit(1);
+      }
+
+      // Unwrap the real master key (or fall back to legacy where wrapping key = master key)
+      let masterKey: Buffer;
+      if (encryptedMasterKey) {
+        masterKey = unwrapMasterKey(Buffer.from(encryptedMasterKey, 'base64'), wrappingKey);
+      } else {
+        masterKey = wrappingKey;
+      }
+
+      storeMasterKey(masterKey);
+      console.log(chalk.green('Encryption session unlocked.'));
+    });
+
+  encryption.command('status')
+    .description('Show encryption status')
+    .action(async () => {
+      const sdk = getSDKClientFromParent(encryption);
+      const { setupComplete } = await sdk.account.getEncryptionParams();
+      const sessionActive = loadMasterKey() !== null;
+
+      console.log(`Encryption setup:   ${setupComplete ? chalk.green('Complete') : chalk.yellow('Not set up')}`);
+      console.log(`Session unlocked:   ${sessionActive ? chalk.green('Yes') : chalk.yellow('No')}`);
+    });
+
+  encryption.command('change-passphrase')
+    .description('Change encryption passphrase')
+    .action(async () => {
+      const sdk = getSDKClientFromParent(encryption);
+
+      const { setupComplete, salt, verifier, encryptedMasterKey } = await sdk.account.getEncryptionParams();
+      if (!setupComplete) {
+        console.error(chalk.red('Encryption not set up. Run: tusky encryption setup'));
+        return;
+      }
+
+      const answers = await inquirer.prompt([
+        {
+          type: 'password',
+          name: 'currentPassphrase',
+          message: 'Enter current passphrase:',
+          mask: '*',
+        },
+        {
+          type: 'password',
+          name: 'newPassphrase',
+          message: 'Enter new passphrase:',
+          mask: '*',
+          validate: (input: string) => input.length >= 8 || 'Passphrase must be at least 8 characters',
+        },
+        {
+          type: 'password',
+          name: 'confirmNew',
+          message: 'Confirm new passphrase:',
+          mask: '*',
+        },
+      ]);
+
+      if (answers.newPassphrase !== answers.confirmNew) {
+        console.error(chalk.red('New passphrases do not match.'));
+        return;
+      }
+
+      // Verify current passphrase
+      const currentSalt = Buffer.from(salt!, 'base64');
+      const currentVerifier = Buffer.from(verifier!, 'base64');
+      const currentWrappingKey = deriveMasterKey(answers.currentPassphrase, currentSalt);
+
+      if (!verifyPassphrase(currentWrappingKey, currentVerifier)) {
+        console.error(chalk.red('Invalid current passphrase.'));
+        return;
+      }
+
+      // Unwrap the real master key (or use wrapping key as legacy fallback)
+      let masterKey: Buffer;
+      if (encryptedMasterKey) {
+        masterKey = unwrapMasterKey(Buffer.from(encryptedMasterKey, 'base64'), currentWrappingKey);
+      } else {
+        masterKey = currentWrappingKey;
+      }
+
+      // Derive new wrapping key, re-wrap master key
+      const newSalt = generateSalt();
+      const newWrappingKey = deriveMasterKey(answers.newPassphrase, newSalt);
+      const newVerifier = computeVerifier(newWrappingKey);
+      const newEncryptedMasterKey = wrapMasterKey(masterKey, newWrappingKey);
+
+      // Generate new recovery key and wrap master key with it
+      const newRecoveryKey = generateRecoveryKey();
+      const newWrappedBackup = wrapMasterKey(masterKey, newRecoveryKey);
+
+      await sdk.account.resetEncryption({
+        salt: newSalt.toString('base64'),
+        verifier: newVerifier.toString('base64'),
+        encryptedMasterKey: newEncryptedMasterKey.toString('base64'),
+        wrappedMasterKeyBackup: newWrappedBackup.toString('base64'),
+      });
+
+      storeMasterKey(masterKey);
+
+      console.log(chalk.yellow.bold('NEW RECOVERY KEY (save it!):'));
+      console.log(chalk.bold(`  ${newRecoveryKey.toString('base64')}`));
+      console.log(chalk.green('Passphrase changed successfully.'));
+    });
+
+  encryption.command('recover')
+    .description('Recover master key with recovery key')
+    .action(async () => {
+      const sdk = getSDKClientFromParent(encryption);
+
+      const answers = await inquirer.prompt([
+        {
+          type: 'input',
+          name: 'recoveryKey',
+          message: 'Enter your recovery key (base64):',
+        },
+        {
+          type: 'password',
+          name: 'newPassphrase',
+          message: 'Enter new passphrase:',
+          mask: '*',
+          validate: (input: string) => input.length >= 8 || 'Passphrase must be at least 8 characters',
+        },
+        {
+          type: 'password',
+          name: 'confirmNew',
+          message: 'Confirm new passphrase:',
+          mask: '*',
+        },
+      ]);
+
+      if (answers.newPassphrase !== answers.confirmNew) {
+        console.error(chalk.red('Passphrases do not match.'));
+        return;
+      }
+
+      // Get wrapped master key backup from server
+      const { wrappedMasterKeyBackup } = await sdk.account.getRecoveryData();
+      const wrappedData = Buffer.from(wrappedMasterKeyBackup!, 'base64');
+      const recoveryKeyRaw = Buffer.from(answers.recoveryKey, 'base64');
+
+      let masterKey: Buffer;
+      try {
+        masterKey = unwrapMasterKey(wrappedData, recoveryKeyRaw);
+      } catch {
+        console.error(chalk.red('Invalid recovery key.'));
+        return;
+      }
+
+      // Derive new wrapping key from new passphrase, wrap the RECOVERED master key
+      const newSalt = generateSalt();
+      const newWrappingKey = deriveMasterKey(answers.newPassphrase, newSalt);
+      const newVerifier = computeVerifier(newWrappingKey);
+      const newEncryptedMasterKey = wrapMasterKey(masterKey, newWrappingKey);
+
+      // Generate new recovery key and wrap master key with it
+      const newRecoveryKey = generateRecoveryKey();
+      const newWrappedBackup = wrapMasterKey(masterKey, newRecoveryKey);
+
+      await sdk.account.resetEncryption({
+        salt: newSalt.toString('base64'),
+        verifier: newVerifier.toString('base64'),
+        encryptedMasterKey: newEncryptedMasterKey.toString('base64'),
+        wrappedMasterKeyBackup: newWrappedBackup.toString('base64'),
+      });
+
+      storeMasterKey(masterKey);
+
+      console.log(chalk.yellow.bold('NEW RECOVERY KEY (save it!):'));
+      console.log(chalk.bold(`  ${newRecoveryKey.toString('base64')}`));
+      console.log(chalk.green('Recovery successful. Passphrase reset.'));
+    });
+}

package/src/commands/export.ts

@@ -0,0 +1,251 @@
+/**
+ * `tusky export` — Export file metadata for disaster recovery.
+ *
+ * Dumps all file records (including Walrus blob IDs, encryption keys,
+ * and epoch info) to a JSON file. This allows users to recover their
+ * data directly from Walrus if the Tusky service is unavailable.
+ *
+ * The export contains everything needed to:
+ *   1. Fetch files from Walrus aggregators using blobId
+ *   2. Decrypt private vault files using wrappedKey + iv + master key
+ *   3. Renew Walrus epochs using blobObjectId + a Sui wallet
+ */
+
+import type { Command } from 'commander';
+import { writeFileSync } from 'fs';
+import { resolve } from 'path';
+import chalk from 'chalk';
+import { getApiUrl, getApiKey } from '../config.js';
+import { createSDKClient } from '../sdk.js';
+import { createSpinner } from '../lib/progress.js';
+
+export interface ExportedFile {
+  fileId: string;
+  name: string;
+  mimeType: string;
+  sizeBytes: number;
+  vaultId: string;
+  vaultName: string;
+  vaultVisibility: string;
+  folderId: string | null;
+  status: string;
+  /** Walrus content-addressed blob ID — use to fetch from any Walrus aggregator */
+  walrusBlobId: string | null;
+  /** Sui object ID — required for epoch renewal via Walrus CLI */
+  walrusBlobObjectId: string | null;
+  /** Epoch when Walrus storage expires (renew before this) */
+  walrusEpochEnd: string | null;
+  /** Whether the file is client-side encrypted */
+  encrypted: boolean;
+  /** AES-256-GCM file key, wrapped with the master key (base64) */
+  wrappedKey: string | null;
+  /** AES-256-GCM initialization vector (base64) */
+  encryptionIv: string | null;
+  /** SHA-256 of the plaintext — for integrity verification after decryption */
+  plaintextChecksumSha256: string | null;
+  /** Original plaintext size in bytes (before encryption) */
+  plaintextSizeBytes: number | null;
+  createdAt: string;
+}
+
+export interface ExportManifest {
+  version: 1;
+  exportedAt: string;
+  account: {
+    id: string;
+    email: string;
+    plan: string;
+  };
+  /** Account encryption params — needed to derive master key from passphrase */
+  encryption: {
+    setupComplete: boolean;
+    /** PBKDF2 salt (base64) */
+    salt: string | null;
+    /** HMAC verifier for passphrase validation (base64) */
+    verifier: string | null;
+    /** Master key wrapped with passphrase-derived key (base64) */
+    encryptedMasterKey: string | null;
+  };
+  walrusNetwork: string;
+  walrusAggregatorUrl: string;
+  totalFiles: number;
+  totalVaults: number;
+  files: ExportedFile[];
+  recovery: {
+    instructions: string[];
+  };
+}
+
+export function registerExportCommand(program: Command) {
+  program
+    .command('export')
+    .description('Export file metadata for disaster recovery (Walrus blob IDs, encryption keys)')
+    .option('-o, --output <path>', 'Output file path', 'tusky-export.json')
+    .option('--vault <vaultId>', 'Export only files from a specific vault')
+    .action(async (options: { output: string; vault?: string }) => {
+      const apiUrl = getApiUrl(program.opts().apiUrl);
+      const apiKey = getApiKey(program.opts().apiKey);
+      const sdk = createSDKClient(apiUrl, apiKey);
+
+      const spinner = createSpinner('Fetching account info...');
+      spinner.start();
+
+      try {
+        // Fetch account + encryption params
+        const account = await sdk.account.get();
+        const encryptionParams = await sdk.account.getEncryptionParams();
+
+        // Fetch all vaults
+        spinner.text = 'Fetching vaults...';
+        const allVaults = await sdk.vaults.list();
+        const vaults = options.vault
+          ? allVaults.filter((v) => v.id === options.vault)
+          : allVaults;
+
+        if (vaults.length === 0) {
+          spinner.fail(options.vault ? `Vault ${options.vault} not found.` : 'No vaults found.');
+          return;
+        }
+
+        // Build vault lookup
+        const vaultMap = new Map(allVaults.map((v) => [v.id, v]));
+
+        // Fetch all files with pagination
+        spinner.text = 'Fetching files...';
+        const exportedFiles: ExportedFile[] = [];
+
+        for (const vault of vaults) {
+          let cursor: string | undefined;
+          do {
+            const result = await sdk.files.list({
+              vaultId: vault.id,
+              limit: 100,
+              cursor,
+            });
+
+            for (const file of result.files) {
+              const v = vaultMap.get(file.vaultId);
+              exportedFiles.push({
+                fileId: file.id,
+                name: file.name,
+                mimeType: file.mimeType,
+                sizeBytes: file.sizeBytes,
+                vaultId: file.vaultId,
+                vaultName: v?.name ?? 'unknown',
+                vaultVisibility: v?.visibility ?? 'unknown',
+                folderId: file.folderId,
+                status: file.status,
+                walrusBlobId: file.walrusBlobId,
+                walrusBlobObjectId: file.walrusBlobObjectId,
+                walrusEpochEnd: file.walrusEpochEnd,
+                encrypted: file.encrypted,
+                wrappedKey: file.wrappedKey,
+                encryptionIv: file.encryptionIv,
+                plaintextChecksumSha256: file.plaintextChecksumSha256,
+                plaintextSizeBytes: file.plaintextSizeBytes,
+                createdAt: file.createdAt,
+              });
+            }
+
+            cursor = result.nextCursor ?? undefined;
+            spinner.text = `Fetching files... (${exportedFiles.length} so far)`;
+          } while (cursor);
+        }
+
+        // Determine Walrus network info
+        const tuskyEnv = process.env.TUSKY_ENV || 'production';
+        const isMainnet = tuskyEnv === 'production';
+        const walrusAggregatorUrl = isMainnet
+          ? 'https://aggregator.walrus.space'
+          : 'https://aggregator.walrus-testnet.walrus.space';
+
+        // Build manifest
+        const manifest: ExportManifest = {
+          version: 1,
+          exportedAt: new Date().toISOString(),
+          account: {
+            id: account.id,
+            email: account.email,
+            plan: account.planName,
+          },
+          encryption: {
+            setupComplete: encryptionParams.setupComplete,
+            salt: encryptionParams.salt ?? null,
+            verifier: encryptionParams.verifier ?? null,
+            encryptedMasterKey: encryptionParams.encryptedMasterKey ?? null,
+          },
+          walrusNetwork: isMainnet ? 'mainnet' : 'testnet',
+          walrusAggregatorUrl,
+          totalFiles: exportedFiles.length,
+          totalVaults: vaults.length,
+          files: exportedFiles,
+          recovery: {
+            instructions: [
+              '=== TUSKY DISASTER RECOVERY ===',
+              '',
+              'This file contains everything needed to recover your data independently of Tusky.',
+              '',
+              '--- DOWNLOAD FILES FROM WALRUS ---',
+              'For each file with a walrusBlobId, fetch directly from any Walrus aggregator:',
+              `  curl -o <filename> ${walrusAggregatorUrl}/v1/blobs/<walrusBlobId>`,
+              '  OR: walrus read <walrusBlobId> -o <filename>',
+              '  OR: tusky rehydrate <walrusBlobId> -o <filename>',
+              '',
+              '--- DECRYPT PRIVATE VAULT FILES ---',
+              'Files with encrypted=true are AES-256-GCM encrypted.',
+              '',
+              'Option A — Using the Tusky CLI decrypt command (easiest):',
+              '  tusky decrypt <encrypted-file> --export <this-file.json> -o <output>',
+              '  This reads the wrappedKey/iv from this manifest and prompts for your passphrase.',
+              '  You can also pass --passphrase <passphrase> or set TUSKYDP_PASSWORD env var.',
+              '  If the Tusky API is still reachable, you can skip the export and use:',
+              '  tusky decrypt <encrypted-file> --file-id <fileId> -o <output>',
+              '',
+              'Option B — Using the standalone script (zero dependencies, fully offline):',
+              '  node tusky-decrypt.mjs <encrypted-file> <output> <passphrase> <salt> <wrappedKey> <iv> [encryptedMasterKey]',
+              '  The salt and encryptedMasterKey come from your account encryption params.',
+              '',
+              'Option C — Manual decryption (any language with AES-256-GCM + PBKDF2):',
+              '  1. Derive wrapping key: PBKDF2(passphrase, salt, 600000 iterations, SHA-256, 32 bytes)',
+              '  2. If your account has an encryptedMasterKey, unwrap it: AES-256-GCM-decrypt(encryptedMasterKey, wrappingKey)',
+              '     Otherwise the wrapping key IS the master key (legacy accounts)',
+              '  3. Unwrap the file key: AES-256-GCM-decrypt(wrappedKey, masterKey)',
+              '     wrappedKey format: [12-byte IV | ciphertext | 16-byte auth tag]',
+              '  4. Decrypt the file: AES-256-GCM-decrypt(fileData, fileKey, encryptionIv)',
+              '     File data format: [ciphertext | 16-byte auth tag]',
+              '  5. Verify integrity: SHA-256(plaintext) should match plaintextChecksumSha256',
+              '',
+              '--- RENEW WALRUS EPOCHS ---',
+              'Files with a walrusBlobObjectId can have their storage extended:',
+              '  walrus extend <walrusBlobObjectId> --epochs 5',
+              'This requires a Sui wallet with WAL tokens. Check walrusEpochEnd to see when renewal is needed.',
+            ],
+          },
+        };
+
+        // Write to disk
+        const outputPath = resolve(options.output);
+        writeFileSync(outputPath, JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
+
+        spinner.succeed(`Exported ${exportedFiles.length} files from ${vaults.length} vault(s)`);
+        console.log(chalk.dim(`  Output: ${outputPath}`));
+        console.log('');
+
+        // Summary stats
+        const withBlob = exportedFiles.filter((f) => f.walrusBlobId).length;
+        const encrypted = exportedFiles.filter((f) => f.encrypted).length;
+        const hotOnly = exportedFiles.filter((f) => !f.walrusBlobId && f.status === 'hot').length;
+
+        console.log(`  On Walrus:     ${withBlob} files (recoverable from Walrus network)`);
+        console.log(`  Encrypted:     ${encrypted} files (require passphrase to decrypt)`);
+        if (hotOnly > 0) {
+          console.log(chalk.yellow(`  Hot only:      ${hotOnly} files (NOT yet on Walrus — only in Tusky hot cache)`));
+        }
+        console.log('');
+        console.log(chalk.yellow('  Store this file securely — it contains encryption keys.'));
+        console.log(chalk.dim('  See the "recovery.instructions" field inside for full recovery steps.'));
+      } catch (err: any) {
+        spinner.fail(`Export failed: ${err.message}`);
+      }
+    });
+}