powerbin 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,121 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.

package/README.md

@@ -1,3 +1,100 @@
-# Temporary Holding Version
+# PowerBin CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Reveal and burn a PowerBin one-time text message from your terminal. Requires
+Node.js 22.12 or later. No account, pairing, global installation, or Rust toolchain
+is needed to reveal a link.
+
+```sh
+pnpx powerbin reveal 'https://your-powerbin.example/?link=<id>#<key>'
+```
+
+Paste the **complete original link**, including the key after `#`, and quote it.
+The CLI claims the ciphertext once, then decrypts it locally using the same Rust
+cryptography as the PowerBin native and browser apps. The key and plaintext are
+never sent to the server.
+
+## Output and scripting
+
+In a terminal, PowerBin prints the message with a short status. When stdout is
+piped or redirected, it contains the exact UTF-8 message bytes, including the
+original newlines. Status and errors go to stderr.
+
+```sh
+pnpx powerbin reveal '<complete link>' > message.txt
+pnpx powerbin reveal '<complete link>' --raw
+pnpx powerbin --help
+pnpx powerbin --version
+```
+
+`--raw` writes exact bytes even in a terminal and suppresses the success status.
+Normal terminal output escapes control characters from the message. Raw output
+is intended for scripts and trusted text.
+
+Use `--stdin` to supply a link through standard input instead of including it in
+the command line or shell history:
+
+```sh
+pnpx powerbin reveal --stdin
+```
+
+Paste one complete link and end the input with EOF, or pipe the link from another
+program. PowerBin does not persist links or messages. Your terminal, clipboard,
+shell, or redirected files may retain them.
+
+Exit codes: `0` for success, `1` for a reveal/decryption/output failure, and `2`
+for invalid arguments or a malformed link.
+
+## One-time behavior
+
+Running `reveal` checks compatibility without consuming the link, then claims it
+once. There is no confirmation prompt. Version 0.1.1 and later require the server
+to report `protocol_version: 2` in its availability response. Older servers and
+legacy v1 links are rejected before the consuming request. Update the PowerBin
+server and browser app together, reload the browser, and create a fresh link.
+
+Missing or malformed keys are rejected before contacting the server. A validly
+encoded but incorrect key can still consume the message before decryption fails.
+
+The CLI never retries or follows redirects for the consuming request. If the
+response is lost after the server claims the message, it cannot be recovered.
+If saving or printing the plaintext fails after a successful reveal, the link
+has already burned. Do not configure automatic retries around this command.
+
+Opening a link in the browser or fetching the readable `curl '<link>'` view only
+checks availability. Browser recipients must select **Reveal & burn** to consume
+it. Curl itself cannot decrypt because the URL fragment is not sent to the server.
+
+Links must use HTTPS. Plain HTTP is accepted only for loopback development
+servers (`localhost`, `127.0.0.1`, and `[::1]`).
+
+PowerBin is an unaudited demo. A guest link does not authenticate a named sender,
+and burning cannot retract copies already saved or displayed.
+
+## Development
+
+The CLI uses TypeScript for the command and a small WASM wrapper around the
+repository's shared `crypto` crate. The published package bundles compiled WASM
+and has no runtime npm dependencies or installation scripts.
+
+From the repository root:
+
+```sh
+pnpm install --frozen-lockfile
+pnpm run cli:build
+pnpm run cli:test
+```
+
+Building requires Rust with the `wasm32-unknown-unknown` target and
+`wasm-bindgen-cli` exactly 0.2.129. The build also recognizes this repository's
+existing `.tools/cargo`, `.tools/rustup`, and `.tools/wasm-bindgen` installations.
+The tests decrypt a fixture produced by the native Rust implementation and check
+the real CLI against local HTTP servers.
+
+Before releasing, build, run the tests, pack `cli`, and verify the tarball through
+an isolated installation. Publish that verified tarball using the npm account
+that owns the package. The `files` allowlist includes only runtime output,
+documentation, and license notices.
+
+## License
+
+CC0-1.0. Third-party Rust dependency licenses are included with the package.