powerbin 0.0.0-stage → 0.1.1

package/dist/client.js

@@ -0,0 +1,198 @@
+import { createRequire } from 'node:module';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+const MAX_RESPONSE_BYTES = 64 * 1024;
+export class CliError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = 'CliError';
+    }
+}
+export function parseLink(input) {
+    // URL() normalizes whitespace and credentials; validate those before any I/O.
+    if (!input || input.length > 8192 || /[\u0000-\u0020\u007f]/u.test(input)) {
+        throw new CliError('Expected the complete original PowerBin link, including its #key.', 2);
+    }
+    let url;
+    try {
+        url = new URL(input);
+    }
+    catch {
+        throw new CliError('Invalid PowerBin URL.', 2);
+    }
+    const loopback = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+    if (url.protocol !== 'https:' && !(url.protocol === 'http:' && loopback)) {
+        throw new CliError('PowerBin links must use HTTPS. HTTP is allowed only for local development.', 2);
+    }
+    if (url.username || url.password)
+        throw new CliError('PowerBin URLs cannot contain credentials.', 2);
+    if (url.pathname !== '/' || url.searchParams.size !== 1 || url.searchParams.getAll('link').length !== 1) {
+        throw new CliError('Expected a PowerBin link with the form https://host/?link=<id>#<key>.', 2);
+    }
+    const id = url.searchParams.get('link');
+    if (!UUID.test(id))
+        throw new CliError('The link contains an invalid message ID.', 2);
+    const secret = url.hash.slice(1);
+    if (!/^[A-Za-z0-9_-]{43}$/u.test(secret)) {
+        throw new CliError('The link is missing a valid decryption key. Paste the complete original link, including #key.', 2);
+    }
+    const key = Buffer.from(secret, 'base64url');
+    if (key.length !== 32 || key.toString('base64url') !== secret) {
+        key.fill(0);
+        throw new CliError('The link contains an invalid decryption key.', 2);
+    }
+    // UUIDs are stored and used as authenticated crypto context in canonical form.
+    const canonicalId = id.toLowerCase();
+    return { id: canonicalId, endpoint: `${url.origin}/api/links/${canonicalId}/reveal`, key };
+}
+function loadCrypto() {
+    try {
+        const crypto = createRequire(import.meta.url)('./crypto/powerbin_crypto.cjs');
+        if (typeof crypto.openGuest !== 'function')
+            throw new Error();
+        return crypto;
+    }
+    catch {
+        throw new CliError('The bundled decryption module could not load. Reinstall this package before revealing the message.');
+    }
+}
+function statusError(status) {
+    switch (status) {
+        case 400: return new CliError('The server rejected this link. Check that you pasted the complete original URL.');
+        case 401:
+        case 403: return new CliError('This service denied access to the message.');
+        case 404: return new CliError('This link is unavailable or does not exist.');
+        case 410: return new CliError('This link has already been consumed or has expired.');
+        case 429: return new CliError('This service is receiving too many reveal requests. Try again shortly.');
+        default: return new CliError('The server could not complete the reveal. The message may already have burned; do not automatically retry.');
+    }
+}
+async function responseBody(response) {
+    const chunks = [];
+    let length = 0;
+    const reader = response.body?.getReader();
+    if (!reader)
+        throw new Error();
+    try {
+        for (;;) {
+            const { value, done } = await reader.read();
+            if (done)
+                break;
+            length += value.byteLength;
+            if (length > MAX_RESPONSE_BYTES)
+                throw new Error();
+            chunks.push(value);
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+        reader.releaseLock();
+    }
+    return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks));
+}
+async function checkProtocol(link, timeoutMs) {
+    let response;
+    try {
+        response = await fetch(link.endpoint.slice(0, -'/reveal'.length), {
+            method: 'GET',
+            headers: { Accept: 'application/json' },
+            redirect: 'manual',
+            signal: AbortSignal.timeout(timeoutMs)
+        });
+    }
+    catch {
+        throw new CliError('The link availability check was lost or timed out. This request did not consume the message.');
+    }
+    if (response.status >= 300 && response.status < 400) {
+        await response.body?.cancel().catch(() => { });
+        throw new CliError('The service redirected the availability check. No redirect was followed. This request did not consume the message.');
+    }
+    if (!response.ok) {
+        await response.body?.cancel().catch(() => { });
+        const reason = [400, 401, 403, 404, 410, 429].includes(response.status)
+            ? statusError(response.status).message
+            : 'The server could not check this link.';
+        throw new CliError(`${reason} This request did not consume the message.`);
+    }
+    let metadata;
+    try {
+        metadata = JSON.parse(await responseBody(response));
+    }
+    catch {
+        throw new CliError('The link metadata response was incomplete or invalid. This request did not consume the message.');
+    }
+    if (!metadata || typeof metadata !== 'object' || !('protocol_version' in metadata) || metadata.protocol_version !== 2) {
+        throw new CliError('This link/server uses an unsupported encryption format. Update PowerBin server/browser, then create a new link. This request did not consume the message.');
+    }
+}
+/** Check compatibility without consuming, then make a single consuming request. */
+export async function revealLink(input, options = {}) {
+    const link = parseLink(input);
+    try {
+        const crypto = loadCrypto();
+        await checkProtocol(link, options.timeoutMs ?? 15_000);
+        let response;
+        try {
+            response = await fetch(link.endpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+                body: '{}',
+                redirect: 'manual',
+                signal: AbortSignal.timeout(options.timeoutMs ?? 15_000)
+            });
+        }
+        catch {
+            throw new CliError('The reveal response was lost or timed out. The message may already have burned; do not automatically retry.');
+        }
+        if (response.status >= 300 && response.status < 400) {
+            await response.body?.cancel().catch(() => { });
+            throw new CliError('The service redirected the reveal request. No redirect was followed. The message may already have burned.');
+        }
+        if (!response.ok) {
+            await response.body?.cancel().catch(() => { });
+            throw statusError(response.status);
+        }
+        let payload;
+        try {
+            const body = JSON.parse(await responseBody(response));
+            if (!body || typeof body !== 'object' || !('payload' in body) || typeof body.payload !== 'string'
+                || !/^[A-Za-z0-9_-]+$/u.test(body.payload))
+                throw new Error();
+            const bytes = Buffer.from(body.payload, 'base64url');
+            if (bytes.length < 29 || bytes.length > 32 * 1024 + 29 || bytes.toString('base64url') !== body.payload)
+                throw new Error();
+            payload = bytes;
+        }
+        catch {
+            throw new CliError('The message was claimed, but its encrypted response was incomplete or invalid. It cannot be revealed again.');
+        }
+        try {
+            const plaintext = crypto.openGuest(link.key, link.id, payload);
+            try {
+                new TextDecoder('utf-8', { fatal: true }).decode(plaintext);
+            }
+            catch {
+                plaintext.fill(0);
+                throw new Error();
+            }
+            return plaintext;
+        }
+        catch {
+            throw new CliError('The message was claimed, but decryption failed. Check the original link; the message cannot be revealed again.');
+        }
+        finally {
+            payload.fill(0);
+        }
+    }
+    finally {
+        link.key.fill(0);
+    }
+}
+/** Escape controls only in human terminal output; raw and piped bytes stay exact. */
+export function terminalText(text) {
+    return text.replace(/[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u202a-\u202e\u2066-\u2069]/gu, character => {
+        const code = character.charCodeAt(0);
+        return code < 256 ? `\\x${code.toString(16).padStart(2, '0')}` : `\\u${code.toString(16).padStart(4, '0')}`;
+    });
+}

package/dist/crypto/powerbin_crypto.cjs

@@ -0,0 +1,176 @@
+/* @ts-self-types="./powerbin_crypto.d.cts" */
+
+/**
+ * Decrypt a guest payload with the same protocol as PowerBin's native and web apps.
+ * The caller owns the lifetime of the JavaScript input and returned buffers.
+ * @param {Uint8Array} secret
+ * @param {string} item_id
+ * @param {Uint8Array} ciphertext
+ * @returns {Uint8Array}
+ */
+function openGuest(secret, item_id, ciphertext) {
+    try {
+        const retptr = wasm.__wbindgen_add_to_stack_pointer(-16);
+        const ptr0 = passArray8ToWasm0(secret, wasm.__wbindgen_export);
+        const len0 = WASM_VECTOR_LEN;
+        const ptr1 = passStringToWasm0(item_id, wasm.__wbindgen_export, wasm.__wbindgen_export2);
+        const len1 = WASM_VECTOR_LEN;
+        const ptr2 = passArray8ToWasm0(ciphertext, wasm.__wbindgen_export);
+        const len2 = WASM_VECTOR_LEN;
+        wasm.openGuest(retptr, ptr0, len0, ptr1, len1, ptr2, len2);
+        var r0 = getDataViewMemory0().getInt32(retptr + 4 * 0, true);
+        var r1 = getDataViewMemory0().getInt32(retptr + 4 * 1, true);
+        var r2 = getDataViewMemory0().getInt32(retptr + 4 * 2, true);
+        if (r2) {
+            throw takeObject(r1);
+        }
+        return takeObject(r0);
+    } finally {
+        wasm.__wbindgen_add_to_stack_pointer(16);
+    }
+}
+exports.openGuest = openGuest;
+function __wbg_get_imports() {
+    const import0 = {
+        __proto__: null,
+        __wbg_Error_30c8987f7c2ed4e2: function(arg0, arg1) {
+            const ret = Error(getStringFromWasm0(arg0, arg1));
+            return addHeapObject(ret);
+        },
+        __wbg___wbindgen_throw_41e9ee4f547fc59a: function(arg0, arg1) {
+            throw new Error(getStringFromWasm0(arg0, arg1));
+        },
+        __wbg_new_from_slice_9a868026ffa4208a: function(arg0, arg1) {
+            const ret = new Uint8Array(getArrayU8FromWasm0(arg0, arg1));
+            return addHeapObject(ret);
+        },
+    };
+    return {
+        __proto__: null,
+        "./powerbin_crypto_bg.js": import0,
+    };
+}
+
+function addHeapObject(obj) {
+    if (heap_next === heap.length) heap.push(heap.length + 1);
+    const idx = heap_next;
+    heap_next = heap[idx];
+
+    heap[idx] = obj;
+    return idx;
+}
+
+function dropObject(idx) {
+    if (idx < 1028) return;
+    heap[idx] = heap_next;
+    heap_next = idx;
+}
+
+function getArrayU8FromWasm0(ptr, len) {
+    ptr = ptr >>> 0;
+    return getUint8ArrayMemory0().subarray(ptr / 1, ptr / 1 + len);
+}
+
+let cachedDataViewMemory0 = null;
+function getDataViewMemory0() {
+    if (cachedDataViewMemory0 === null || cachedDataViewMemory0.buffer.detached === true || (cachedDataViewMemory0.buffer.detached === undefined && cachedDataViewMemory0.buffer !== wasm.memory.buffer)) {
+        cachedDataViewMemory0 = new DataView(wasm.memory.buffer);
+    }
+    return cachedDataViewMemory0;
+}
+
+function getStringFromWasm0(ptr, len) {
+    return decodeText(ptr >>> 0, len);
+}
+
+let cachedUint8ArrayMemory0 = null;
+function getUint8ArrayMemory0() {
+    if (cachedUint8ArrayMemory0 === null || cachedUint8ArrayMemory0.byteLength === 0) {
+        cachedUint8ArrayMemory0 = new Uint8Array(wasm.memory.buffer);
+    }
+    return cachedUint8ArrayMemory0;
+}
+
+function getObject(idx) { return heap[idx]; }
+
+let heap = new Array(1024).fill(undefined);
+heap.push(undefined, null, true, false);
+
+let heap_next = heap.length;
+
+function passArray8ToWasm0(arg, malloc) {
+    const ptr = malloc(arg.length * 1, 1) >>> 0;
+    getUint8ArrayMemory0().set(arg, ptr / 1);
+    WASM_VECTOR_LEN = arg.length;
+    return ptr;
+}
+
+function passStringToWasm0(arg, malloc, realloc) {
+    if (realloc === undefined) {
+        const buf = cachedTextEncoder.encode(arg);
+        const ptr = malloc(buf.length, 1) >>> 0;
+        getUint8ArrayMemory0().subarray(ptr, ptr + buf.length).set(buf);
+        WASM_VECTOR_LEN = buf.length;
+        return ptr;
+    }
+
+    let len = arg.length;
+    let ptr = malloc(len, 1) >>> 0;
+
+    const mem = getUint8ArrayMemory0();
+
+    let offset = 0;
+
+    for (; offset < len; offset++) {
+        const code = arg.charCodeAt(offset);
+        if (code > 0x7F) break;
+        mem[ptr + offset] = code;
+    }
+    if (offset !== len) {
+        if (offset !== 0) {
+            arg = arg.slice(offset);
+        }
+        ptr = realloc(ptr, len, len = offset + arg.length * 3, 1) >>> 0;
+        const view = getUint8ArrayMemory0().subarray(ptr + offset, ptr + len);
+        const ret = cachedTextEncoder.encodeInto(arg, view);
+
+        offset += ret.written;
+        ptr = realloc(ptr, len, offset, 1) >>> 0;
+    }
+
+    WASM_VECTOR_LEN = offset;
+    return ptr;
+}
+
+function takeObject(idx) {
+    const ret = getObject(idx);
+    dropObject(idx);
+    return ret;
+}
+
+let cachedTextDecoder = new TextDecoder('utf-8', { ignoreBOM: true, fatal: true });
+cachedTextDecoder.decode();
+function decodeText(ptr, len) {
+    return cachedTextDecoder.decode(getUint8ArrayMemory0().subarray(ptr, ptr + len));
+}
+
+const cachedTextEncoder = new TextEncoder();
+
+if (!('encodeInto' in cachedTextEncoder)) {
+    cachedTextEncoder.encodeInto = function (arg, view) {
+        const buf = cachedTextEncoder.encode(arg);
+        view.set(buf);
+        return {
+            read: arg.length,
+            written: buf.length
+        };
+    };
+}
+
+let WASM_VECTOR_LEN = 0;
+
+const wasmPath = `${__dirname}/powerbin_crypto_bg.wasm`;
+const wasmBytes = require('fs').readFileSync(wasmPath);
+const wasmModule = new WebAssembly.Module(wasmBytes);
+let wasmInstance = new WebAssembly.Instance(wasmModule, __wbg_get_imports());
+let wasm = wasmInstance.exports;

package/dist/crypto/powerbin_crypto.d.cts

@@ -0,0 +1,8 @@
+/* tslint:disable */
+/* eslint-disable */
+
+/**
+ * Decrypt a guest payload with the same protocol as PowerBin's native and web apps.
+ * The caller owns the lifetime of the JavaScript input and returned buffers.
+ */
+export function openGuest(secret: Uint8Array, item_id: string, ciphertext: Uint8Array): Uint8Array;

package/dist/crypto/powerbin_crypto_bg.wasm.d.ts

@@ -0,0 +1,7 @@
+/* tslint:disable */
+/* eslint-disable */
+export const memory: WebAssembly.Memory;
+export const openGuest: (a: number, b: number, c: number, d: number, e: number, f: number, g: number) => void;
+export const __wbindgen_add_to_stack_pointer: (a: number) => number;
+export const __wbindgen_export: (a: number, b: number) => number;
+export const __wbindgen_export2: (a: number, b: number, c: number, d: number) => number;

package/dist/index.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import { CliError, revealLink, terminalText } from './client.js';
+const help = `PowerBin — reveal a one-time message locally
+
+Usage:
+  powerbin reveal '<complete link, including #key>' [--raw]
+  powerbin reveal --stdin [--raw]
+
+Commands:
+  reveal       Claim, decrypt, and burn a one-time message
+
+Options:
+  --stdin      Read the original link from standard input
+  --raw        Write the exact message bytes without terminal formatting
+  -h, --help   Show this help
+  -v, --version Show the package version
+
+The decryption key stays on this computer. Revealing consumes the link once.
+Piped output contains only the exact message bytes; status goes to stderr.
+`;
+function argumentsForReveal(args) {
+    const result = { stdin: false, raw: false };
+    for (const argument of args) {
+        if (argument === '--raw' && !result.raw)
+            result.raw = true;
+        else if (argument === '--stdin' && !result.stdin)
+            result.stdin = true;
+        else if (argument.startsWith('-'))
+            throw new CliError('Unknown or repeated option. Run powerbin --help for usage.', 2);
+        else if (result.url === undefined)
+            result.url = argument;
+        else
+            throw new CliError('Reveal accepts one link. Run powerbin --help for usage.', 2);
+    }
+    if (result.stdin === (result.url !== undefined)) {
+        throw new CliError('Provide one complete link, or use --stdin to read it from standard input.', 2);
+    }
+    return result;
+}
+async function stdinLink() {
+    const chunks = [];
+    let size = 0;
+    for await (const chunk of process.stdin) {
+        const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        size += bytes.length;
+        if (size > 8192)
+            throw new CliError('Standard input must contain a single PowerBin link.', 2);
+        chunks.push(bytes);
+    }
+    try {
+        return new TextDecoder('utf-8', { fatal: true }).decode(Buffer.concat(chunks)).trim();
+    }
+    catch {
+        throw new CliError('Standard input must contain a valid UTF-8 PowerBin link.', 2);
+    }
+}
+async function writeMessage(bytes) {
+    await new Promise((resolve, reject) => {
+        process.stdout.write(bytes, error => error ? reject(error) : resolve());
+    });
+}
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.length === 0 || (args.length === 1 && ['--help', '-h'].includes(args[0]))
+        || (args[0] === 'reveal' && args.length === 2 && ['--help', '-h'].includes(args[1]))) {
+        process.stdout.write(help);
+        return;
+    }
+    if (args.length === 1 && ['--version', '-v'].includes(args[0])) {
+        const packageInfo = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
+        process.stdout.write(`${packageInfo.version}\n`);
+        return;
+    }
+    if (args[0] !== 'reveal')
+        throw new CliError('Unknown command. Run powerbin --help for usage.', 2);
+    const options = argumentsForReveal(args.slice(1));
+    const url = options.stdin ? await stdinLink() : options.url;
+    const plaintext = await revealLink(url);
+    try {
+        if (process.stdout.isTTY && !options.raw) {
+            process.stderr.write('PowerBin · one-time message\n\n');
+            const visible = terminalText(new TextDecoder().decode(plaintext));
+            await writeMessage(Buffer.from(visible + (visible.endsWith('\n') ? '' : '\n')));
+        }
+        else {
+            await writeMessage(plaintext);
+        }
+        if (!options.raw)
+            process.stderr.write('Revealed. The server copy has burned.\n');
+    }
+    catch {
+        throw new CliError('The message was revealed, but writing it to standard output failed. The link has already burned.');
+    }
+    finally {
+        plaintext.fill(0);
+    }
+}
+// Stream write failures are reported through their callbacks instead of a stack trace.
+process.stdout.on('error', () => { });
+process.stderr.on('error', () => { });
+main().catch(error => {
+    process.stderr.write(`PowerBin: ${error instanceof CliError ? error.message : 'The command could not complete.'}\n`);
+    process.exitCode = error instanceof CliError ? error.exitCode : 1;
+});

package/package.json

@@ -1,6 +1,50 @@
 {
   "name": "powerbin",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.1",
+  "description": "Reveal and burn PowerBin one-time messages from your terminal, with local decryption.",
+  "license": "CC0-1.0",
+  "type": "module",
+  "bin": {
+    "powerbin": "dist/index.js"
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.cjs",
+    "dist/**/*.wasm",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.cts",
+    "THIRD_PARTY_NOTICES.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": ">=22.12.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kobiebotha/powersync-native-shell-demo.git",
+    "directory": "cli"
+  },
+  "keywords": [
+    "powerbin",
+    "cli",
+    "one-time",
+    "encrypted",
+    "secret-sharing"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "devDependencies": {
+    "@types/node": "24.19.2",
+    "typescript": "7.0.2"
+  },
+  "scripts": {
+    "build": "pnpm run build:crypto && pnpm run build:notices && pnpm run build:ts",
+    "build:crypto": "node scripts/build-crypto.mjs",
+    "build:notices": "node scripts/build-notices.mjs",
+    "build:ts": "tsc -p tsconfig.json",
+    "check": "tsc -p tsconfig.json --noEmit",
+    "test": "node --test test/*.test.mjs"
+  }
 }