neozip-cli 0.90.0 → 0.95.0

package/dist/src/archive/identity-key.js

@@ -0,0 +1,217 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IdentityKeyVersionError = exports.IdentityKeyTamperError = void 0;
+exports.unwrapX25519PrivateKey = unwrapX25519PrivateKey;
+exports.hasConfiguredIdentityKey = hasConfiguredIdentityKey;
+exports.resolveIdentityPrivateKeyHex = resolveIdentityPrivateKeyHex;
+const crypto = __importStar(require("node:crypto"));
+const ethers_1 = require("ethers");
+const wallet_identity_1 = require("../constants/wallet-identity");
+const crypto_self_1 = require("./crypto-self");
+const recipient_lookup_1 = require("./recipient-lookup");
+class IdentityKeyTamperError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IdentityKeyTamperError";
+    }
+}
+exports.IdentityKeyTamperError = IdentityKeyTamperError;
+class IdentityKeyVersionError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "IdentityKeyVersionError";
+    }
+}
+exports.IdentityKeyVersionError = IdentityKeyVersionError;
+function buildCanonicalAad(params) {
+    const lowerAddr = params.evmAddress.toLowerCase();
+    const addrBytes = Buffer.from(lowerAddr, "ascii");
+    if (params.x25519SpkiDer.length !== 44) {
+        throw new Error(`Unexpected SPKI DER length ${params.x25519SpkiDer.length}, expected 44 bytes`);
+    }
+    return Buffer.concat([
+        addrBytes,
+        Buffer.from([wallet_identity_1.WRAP_FORMAT_VERSION]),
+        params.x25519SpkiDer,
+    ]);
+}
+function deriveKek(rawEoaPrivBytes, saltB64) {
+    if (rawEoaPrivBytes.length !== 32) {
+        throw new Error("EOA private key must be 32 bytes");
+    }
+    const salt = Buffer.from(saltB64, "base64");
+    if (salt.length !== wallet_identity_1.WRAP_KDF_SALT_LEN) {
+        throw new Error(`Wrap KDF salt must be ${wallet_identity_1.WRAP_KDF_SALT_LEN} bytes`);
+    }
+    const okm = crypto.hkdfSync("sha256", rawEoaPrivBytes, salt, wallet_identity_1.WRAP_KDF_INFO, 32);
+    return Buffer.from(okm);
+}
+function pkcs8FromRaw(rawPriv) {
+    const prefix = Buffer.from("302e020100300506032b656e04200420", "hex");
+    return Buffer.concat([prefix, rawPriv]);
+}
+function unwrapX25519PrivateKey(params) {
+    const { bundle } = params;
+    if (bundle.wrapFormatVersion !== wallet_identity_1.WRAP_FORMAT_VERSION) {
+        throw new IdentityKeyVersionError(`Unsupported wrap format version ${bundle.wrapFormatVersion}`);
+    }
+    if (bundle.wrapAead !== wallet_identity_1.WRAP_AEAD || bundle.wrapKdfInfo !== wallet_identity_1.WRAP_KDF_INFO) {
+        throw new IdentityKeyVersionError("Unsupported wrap format");
+    }
+    const expectedSpki = Buffer.from(params.expectedSpkiDerB64, "base64");
+    if (expectedSpki.length !== 44 ||
+        !expectedSpki.subarray(0, wallet_identity_1.X25519_SPKI_PREFIX.length).equals(wallet_identity_1.X25519_SPKI_PREFIX)) {
+        throw new IdentityKeyTamperError("Invalid server X25519 SPKI");
+    }
+    const recomputedAad = buildCanonicalAad({
+        evmAddress: params.expectedEvmAddress,
+        x25519SpkiDer: expectedSpki,
+    });
+    const advertisedAad = Buffer.from(bundle.wrapAadB64, "base64");
+    if (advertisedAad.length !== recomputedAad.length ||
+        !crypto.timingSafeEqual(advertisedAad, recomputedAad)) {
+        throw new IdentityKeyTamperError("Wrap AAD does not match local recomputation");
+    }
+    const kek = deriveKek(params.rawEoaPrivBytes, bundle.wrapKdfSaltB64);
+    const iv = Buffer.from(bundle.wrapIvB64, "base64");
+    if (iv.length !== wallet_identity_1.WRAP_IV_LEN) {
+        kek.fill(0);
+        throw new IdentityKeyVersionError(`Invalid wrap IV length ${iv.length}`);
+    }
+    const wrapped = Buffer.from(bundle.wrappedPrivateKeyB64, "base64");
+    const ct = wrapped.subarray(0, wrapped.length - 16);
+    const tag = wrapped.subarray(wrapped.length - 16);
+    try {
+        const decipher = crypto.createDecipheriv("aes-256-gcm", kek, iv);
+        decipher.setAAD(recomputedAad);
+        decipher.setAuthTag(tag);
+        const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
+        if (pt.length !== 32) {
+            pt.fill(0);
+            throw new IdentityKeyTamperError("Unwrapped key length is not 32 bytes");
+        }
+        return pt;
+    }
+    finally {
+        kek.fill(0);
+    }
+}
+async function fetchJson(url, init) {
+    const response = await fetch(url, init);
+    const ct = response.headers.get("content-type") || "";
+    if (!ct.includes("json")) {
+        return { ok: response.ok, status: response.status, data: null };
+    }
+    try {
+        return {
+            ok: response.ok,
+            status: response.status,
+            data: (await response.json()),
+        };
+    }
+    catch {
+        return { ok: response.ok, status: response.status, data: null };
+    }
+}
+async function loadIdentityKeyFromWallet(config) {
+    const accessToken = config.tokenServiceAccessToken?.trim();
+    const walletKey = config.walletKey?.trim();
+    if (!accessToken || !walletKey) {
+        throw new Error("Wallet identity key requires NEOZIP_TOKEN_SERVICE_ACCESS_TOKEN and NEOZIP_WALLET_PASSKEY in MCP env.");
+    }
+    const self = await (0, crypto_self_1.fetchCryptoSelf)(config);
+    if (!self.ok) {
+        throw new Error(self.hint
+            ? `${self.error} (${self.hint})`
+            : self.error);
+    }
+    const walletId = self.data.walletId;
+    const expectedSpkiB64 = self.data.x25519PublicKey;
+    const baseUrl = (0, recipient_lookup_1.resolveTokenServiceBaseUrl)(config);
+    const auth = { Authorization: `Bearer ${accessToken}` };
+    const keyRes = await fetchJson(`${baseUrl}/identity/wallets/${walletId}/identity-key`, {
+        headers: auth,
+    });
+    if (!keyRes.ok || !keyRes.data?.success || !keyRes.data.identityKey) {
+        throw new Error(keyRes.data?.error ||
+            `Failed to fetch identity key (HTTP ${keyRes.status})`);
+    }
+    const bundle = keyRes.data.identityKey;
+    const wallet = new ethers_1.Wallet(walletKey);
+    const rawEoa = Buffer.from(wallet.privateKey.startsWith("0x")
+        ? wallet.privateKey.slice(2)
+        : wallet.privateKey, "hex");
+    const expectedAddr = bundle.evmAddress || wallet.address;
+    let x25519Private = null;
+    try {
+        x25519Private = unwrapX25519PrivateKey({
+            rawEoaPrivBytes: rawEoa,
+            bundle,
+            expectedEvmAddress: expectedAddr,
+            expectedSpkiDerB64: expectedSpkiB64,
+        });
+        const hex = x25519Private.toString("hex");
+        return hex;
+    }
+    finally {
+        rawEoa.fill(0);
+        if (x25519Private)
+            x25519Private.fill(0);
+    }
+}
+function hasConfiguredIdentityKey(config) {
+    return Boolean(config.identityPrivateKeyHex?.trim() ||
+        (config.tokenServiceAccessToken?.trim() && config.walletKey?.trim()));
+}
+/**
+ * Resolve X25519 private key hex for recipient-encrypted archives.
+ * Never pass through MCP tool arguments — env/config only.
+ */
+async function resolveIdentityPrivateKeyHex(config) {
+    const envHex = config.identityPrivateKeyHex?.trim();
+    if (envHex) {
+        const clean = envHex.startsWith("0x") ? envHex.slice(2) : envHex;
+        if (!/^[0-9a-fA-F]{64}$/.test(clean)) {
+            throw new Error("NEOZIP_IDENTITY_PRIVATE_KEY_HEX must be 64 hex characters (32-byte X25519 key)");
+        }
+        return clean.toLowerCase();
+    }
+    if (config.tokenServiceAccessToken && config.walletKey) {
+        return loadIdentityKeyFromWallet(config);
+    }
+    return null;
+}
+//# sourceMappingURL=identity-key.js.map

package/dist/src/archive/recipient-lookup.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.spkiBase64ToRawHex = spkiBase64ToRawHex;
+exports.resolveTokenServiceBaseUrl = resolveTokenServiceBaseUrl;
+exports.lookupRecipientByEmail = lookupRecipientByEmail;
+exports.resolveRecipientsFromEmails = resolveRecipientsFromEmails;
+const token_service_1 = require("neozip-blockchain/token-service");
+const wallet_identity_1 = require("../constants/wallet-identity");
+function spkiBase64ToRawHex(spkiBase64) {
+    const spkiDer = Buffer.from(spkiBase64, "base64");
+    if (spkiDer.length !== 44) {
+        throw new Error(`Unexpected SPKI DER length ${spkiDer.length}, expected 44 bytes for X25519`);
+    }
+    return spkiDer.subarray(12).toString("hex");
+}
+function resolveTokenServiceBaseUrl(config, serverUrl) {
+    return (0, token_service_1.getTokenServiceUrl)({
+        serverUrl: serverUrl || config.tokenServiceUrl || undefined,
+    }).replace(/\/+$/, "");
+}
+async function lookupRecipientByEmail(email, config, options) {
+    const trimmed = email.trim().toLowerCase();
+    if (!trimmed.includes("@")) {
+        throw new Error(`Invalid recipient email: ${email}`);
+    }
+    const baseUrl = resolveTokenServiceBaseUrl(config, options?.serverUrl);
+    const url = `${baseUrl}/crypto/public?email=${encodeURIComponent(trimmed)}`;
+    const response = await fetch(url, { method: "GET" });
+    const data = (await response.json());
+    if (!response.ok || !data.success || !data.crypto?.x25519PublicKey) {
+        throw new Error(data.error ||
+            `No public key found for ${trimmed} (HTTP ${response.status})`);
+    }
+    const publicKeyHex = spkiBase64ToRawHex(data.crypto.x25519PublicKey);
+    return {
+        identity: {
+            identity: trimmed,
+            identityType: wallet_identity_1.TOKEN_SERVICE_RECIPIENT_IDENTITY_TYPE,
+            address: data.crypto.evmAddress || "",
+            publicKeyHex,
+            keyFormat: "x25519",
+        },
+        evmAddress: data.crypto.evmAddress || "",
+        recipientSuites: data.crypto.recipientSuites,
+        cryptoProvisionedAt: data.crypto.cryptoProvisionedAt,
+    };
+}
+async function resolveRecipientsFromEmails(emails, config, options) {
+    const seen = new Set();
+    const recipients = [];
+    for (const email of emails) {
+        const normalized = email.trim().toLowerCase();
+        if (seen.has(normalized))
+            continue;
+        seen.add(normalized);
+        const { identity } = await lookupRecipientByEmail(normalized, config, options);
+        recipients.push(identity);
+    }
+    return recipients;
+}
+//# sourceMappingURL=recipient-lookup.js.map

package/dist/src/cli/output.js

@@ -0,0 +1,100 @@
+"use strict";
+/**
+ * Shared output layer for agent-friendly machine-readable output.
+ *
+ * Design rules (see dev_doc / AGENTS.md):
+ *  - Human text is the default. JSON is opt-in via `--format json` (or, on
+ *    neolist, the legacy `-j`/`--json` flag).
+ *  - Structured results and structured errors are written to STDOUT as a single
+ *    JSON object so a caller can parse stdout directly.
+ *  - Human hints, progress, and decorative logs go to STDERR (or are suppressed)
+ *    so they never corrupt JSON on stdout.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setOutputFormat = setOutputFormat;
+exports.getOutputFormat = getOutputFormat;
+exports.isJsonOutput = isJsonOutput;
+exports.detectOutputFormat = detectOutputFormat;
+exports.stripFormatFlag = stripFormatFlag;
+exports.emitResult = emitResult;
+exports.emitError = emitError;
+let currentFormat = 'text';
+/** Set the process-wide output format (call once, early, from each binary). */
+function setOutputFormat(format) {
+    currentFormat = format;
+}
+/** Get the current process-wide output format. */
+function getOutputFormat() {
+    return currentFormat;
+}
+/** Convenience predicate: are we emitting machine-readable JSON? */
+function isJsonOutput() {
+    return currentFormat === 'json';
+}
+/**
+ * Detect the desired output format from raw argv.
+ *
+ * Recognizes `--format json|text` and `--format=json|text`. The bare `--json`
+ * flag is intentionally NOT treated as an output switch here because on neozip /
+ * neounzip `--json` carries an input payload value. neolist handles its own
+ * legacy `--json`/`-j` output toggle and maps it to setOutputFormat('json').
+ */
+function detectOutputFormat(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--format') {
+            const value = argv[i + 1];
+            if (value === 'json')
+                return 'json';
+            if (value === 'text')
+                return 'text';
+        }
+        else if (arg.startsWith('--format=')) {
+            const value = arg.slice('--format='.length);
+            if (value === 'json')
+                return 'json';
+            if (value === 'text')
+                return 'text';
+        }
+    }
+    return 'text';
+}
+/**
+ * Remove `--format <value>` / `--format=<value>` tokens from argv so the
+ * existing per-binary parsers don't have to know about them.
+ */
+function stripFormatFlag(argv) {
+    const result = [];
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--format') {
+            // Skip the flag and its value.
+            i++;
+            continue;
+        }
+        if (arg.startsWith('--format=')) {
+            continue;
+        }
+        result.push(arg);
+    }
+    return result;
+}
+/**
+ * Emit a successful structured result as pretty JSON on stdout.
+ *
+ * Writes directly to process.stdout so it bypasses any `quiet` handling used to
+ * silence decorative human logs in JSON mode.
+ */
+function emitResult(result) {
+    const payload = { ok: true, ...result };
+    process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+}
+/**
+ * Emit a structured error as pretty JSON on stdout. Used by the exit-code
+ * helpers when running in JSON mode.
+ */
+function emitError(error) {
+    const payload = { ok: false, error };
+    process.stdout.write(JSON.stringify(payload, null, 2) + '\n');
+}
+//# sourceMappingURL=output.js.map

package/dist/src/cli/params.js

@@ -0,0 +1,122 @@
+"use strict";
+/**
+ * Agent input parsing: `--params` and `--json`.
+ *
+ *  - `--params '<JSON>'`  control/options object (the "how": level, encrypt,
+ *    blockchain, network, output dir, overwrite policy, ...). Maps onto the
+ *    binary's options object.
+ *  - `--json '<JSON>'`    payload object (the "what": archive + inputs/targets,
+ *    e.g. {archive, files, include, exclude, entries, exdir}). Maps onto
+ *    positional arguments.
+ *
+ * Either flag accepts `-` as its value to read the JSON document from stdin.
+ *
+ * Precedence: values from `--params`/`--json` seed the option/positional state
+ * BEFORE the normal flag loop runs, so explicit CLI flags always win.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseJsonObjectArg = parseJsonObjectArg;
+exports.extractAgentInput = extractAgentInput;
+const fs = __importStar(require("fs"));
+const validate_1 = require("./validate");
+/**
+ * Parse a JSON object from a flag value. A value of `-` reads from stdin.
+ * Throws ValidationError on invalid input or non-object JSON.
+ */
+function parseJsonObjectArg(raw, flag) {
+    return readJsonValue(raw, flag);
+}
+function readJsonValue(raw, flag) {
+    let text = raw;
+    if (raw === '-') {
+        try {
+            text = fs.readFileSync(0, 'utf8');
+        }
+        catch (err) {
+            throw new validate_1.ValidationError(`Failed to read ${flag} from stdin: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (err) {
+        throw new validate_1.ValidationError(`Invalid ${flag} JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new validate_1.ValidationError(`${flag} must be a JSON object`);
+    }
+    return parsed;
+}
+/**
+ * Extract `--params` / `--json` from argv. Returns the parsed objects plus argv
+ * with those tokens removed so the existing per-binary parser can run unchanged.
+ *
+ * Supports `--flag value`, `--flag=value`. A `-` value reads from stdin.
+ */
+function extractAgentInput(argv) {
+    const out = { argv: [] };
+    for (let i = 0; i < argv.length; i++) {
+        const arg = argv[i];
+        if (arg === '--params' || arg === '--json') {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                throw new validate_1.ValidationError(`${arg} requires a JSON value (or '-' for stdin)`);
+            }
+            i++;
+            const obj = readJsonValue(value, arg);
+            if (arg === '--params')
+                out.params = obj;
+            else
+                out.payload = obj;
+            continue;
+        }
+        if (arg.startsWith('--params=') || arg.startsWith('--json=')) {
+            const eq = arg.indexOf('=');
+            const flag = arg.slice(0, eq);
+            const value = arg.slice(eq + 1);
+            const obj = readJsonValue(value, flag);
+            if (flag === '--params')
+                out.params = obj;
+            else
+                out.payload = obj;
+            continue;
+        }
+        out.argv.push(arg);
+    }
+    return out;
+}
+//# sourceMappingURL=params.js.map