rwn64 1.0.0

package/dist/cli.bundle.js

@@ -0,0 +1,1181 @@
+#!/usr/bin/env node
+"use strict";
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+
+// dist/lib/errors.js
+var require_errors = __commonJS({
+  "dist/lib/errors.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.installErrorHandler = installErrorHandler;
+    var _nc = !process.stderr.isTTY || process.env.NO_COLOR !== void 0;
+    var _e = _nc ? "" : "\x1B[31m";
+    var _c = _nc ? "" : "\x1B[36m";
+    var _d = _nc ? "" : "\x1B[2m";
+    var _r = _nc ? "" : "\x1B[0m";
+    var _DEFS = [
+      {
+        match: (m) => m.includes("rwn64:") && (m.includes("$") || m.includes("expanded")),
+        message: "token contains unescaped shell characters",
+        fix: "use single quotes:  rwn64 denc 'rwn64:v2:...' -sw password",
+        exit: 2
+      },
+      {
+        match: (m, c) => c === "EACCES" || m.includes("permission denied"),
+        message: "permission denied",
+        fix: "check file permissions",
+        exit: 2
+      },
+      {
+        match: (m, c) => c === "ENOMEM" || m.includes("out of memory") || m.includes("heap"),
+        message: "out of memory",
+        fix: "input may be too large. try: NODE_OPTIONS=--max-old-space-size=512 rwn64 ...",
+        exit: 2
+      },
+      {
+        match: (m) => m.includes("scrypt") || m.includes("memory limit exceeded"),
+        message: "scrypt memory limit exceeded",
+        fix: "device may have limited memory. try a shorter input or restart Termux",
+        exit: 2
+      },
+      {
+        match: (m, c) => c === "MODULE_NOT_FOUND" || m.includes("cannot find module"),
+        message: "internal module not found",
+        fix: "reinstall rwn64:  npm install -g rwn64",
+        exit: 1
+      },
+      {
+        match: (m, c) => c === "ERR_INVALID_ARG_TYPE" || c === "ERR_INVALID_ARG_VALUE" || m.includes("invalid argument"),
+        message: "invalid argument",
+        fix: "run  rwn64 -h  to see correct usage",
+        exit: 1
+      },
+      {
+        match: (m, c) => c === "ENOENT" || m.includes("no such file"),
+        message: "file not found",
+        fix: "check that the file path is correct",
+        exit: 2
+      }
+    ];
+    function _fmt(msg, fix) {
+      return `
+${_e}error${_r}  ${msg}
+${_d}fix${_r}    ${_c}${fix}${_r}
+`;
+    }
+    function _handle(err) {
+      const msg = (err.message ?? "").toLowerCase();
+      const code = err.code ?? "";
+      for (const d of _DEFS) {
+        if (d.match(msg, code)) {
+          process.stderr.write(_fmt(d.message, d.fix));
+          process.exit(d.exit);
+        }
+      }
+      return false;
+    }
+    function _unknown(msg) {
+      process.stderr.write(`
+${_e}error${_r}  unexpected error
+${_d}fix${_r}    ${_c}run  rwn64 -h  for usage${_r}
+${_d}      ${msg}${_r}
+`);
+      process.exit(1);
+    }
+    function installErrorHandler() {
+      process.on("uncaughtException", (err) => {
+        if (!_handle(err))
+          _unknown(err.message ?? String(err));
+      });
+      process.on("unhandledRejection", (reason) => {
+        const err = reason instanceof Error ? reason : new Error(String(reason));
+        if (!_handle(err))
+          _unknown(err.message);
+      });
+      process.on("warning", () => {
+      });
+      const _orig = process.emit.bind(process);
+      process.emit = (ev, ...a) => ev === "warning" ? false : _orig(ev, ...a);
+    }
+  }
+});
+
+// dist/lib/args.js
+var require_args = __commonJS({
+  "dist/lib/args.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.parseArgs = parseArgs;
+    exports2.getFlag = getFlag;
+    exports2.hasFlag = hasFlag;
+    function parseArgs(argv) {
+      const flags = {};
+      const positional = [];
+      let i = 0;
+      const cmd = argv[0] ?? "";
+      i = 1;
+      while (i < argv.length) {
+        const a = argv[i];
+        if (a.startsWith("-")) {
+          const key = a.replace(/^-+/, "");
+          const next = argv[i + 1];
+          if (next && !next.startsWith("-")) {
+            flags[key] = next;
+            i += 2;
+          } else {
+            flags[key] = true;
+            i++;
+          }
+        } else {
+          positional.push(a);
+          i++;
+        }
+      }
+      return { cmd, positional, flags };
+    }
+    function getFlag(flags, ...keys) {
+      for (const k of keys) {
+        const v = flags[k];
+        if (typeof v === "string")
+          return v;
+      }
+      return void 0;
+    }
+    function hasFlag(flags, ...keys) {
+      return keys.some((k) => k in flags);
+    }
+  }
+});
+
+// dist/lib/env.js
+var require_env = __commonJS({
+  "dist/lib/env.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.env = void 0;
+    function _detect() {
+      if (process.env.TERMUX_VERSION !== void 0 || (process.env.PREFIX ?? "").includes("com.termux") || (process.env.HOME ?? "").includes("com.termux"))
+        return "termux";
+      if (process.platform === "darwin")
+        return "macos";
+      if (process.platform === "linux")
+        return "linux";
+      return "unknown";
+    }
+    function _cols() {
+      try {
+        return process.stdout.columns || 80;
+      } catch {
+        return 80;
+      }
+    }
+    function _rows() {
+      try {
+        return process.stdout.rows || 24;
+      } catch {
+        return 24;
+      }
+    }
+    var _type = _detect();
+    exports2.env = {
+      type: _type,
+      isTermux: _type === "termux",
+      isLinux: _type === "linux",
+      isMacOS: _type === "macos",
+      hasTTY: !!process.stdin.isTTY,
+      hasRawMode: typeof process.stdin.setRawMode === "function",
+      hasColor: process.env.NO_COLOR === void 0 && !!process.stderr.isTTY,
+      cols: _cols(),
+      rows: _rows()
+    };
+  }
+});
+
+// dist/lib/ui.js
+var require_ui = __commonJS({
+  "dist/lib/ui.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.BIN = exports2.PKG = exports2.VERSION = void 0;
+    exports2.data = data;
+    exports2.err = err;
+    exports2.warn = warn;
+    exports2.box = box;
+    exports2.token = token;
+    exports2.ms = ms;
+    exports2.section = section;
+    exports2.usage = usage;
+    exports2.row = row;
+    var env_1 = require_env();
+    var _NC = !env_1.env.hasColor;
+    var _c = _NC ? {
+      r: "",
+      d: "",
+      b: "",
+      g: "",
+      y: "",
+      c: "",
+      e: "",
+      w: "",
+      dim: "",
+      hi: ""
+    } : {
+      r: "\x1B[0m",
+      d: "\x1B[2m",
+      b: "\x1B[1m",
+      g: "\x1B[32m",
+      y: "\x1B[33m",
+      c: "\x1B[36m",
+      e: "\x1B[31m",
+      w: "\x1B[37m",
+      dim: "\x1B[38;5;245m",
+      hi: "\x1B[38;5;252m"
+    };
+    exports2.VERSION = "1.0.0";
+    exports2.PKG = "rwn64";
+    exports2.BIN = "rwn64";
+    var _BOX = { tl: "\u250C", tr: "\u2510", bl: "\u2514", br: "\u2518", h: "\u2500", v: "\u2502" };
+    function _ui(s) {
+      process.stderr.write(s);
+    }
+    function data(s) {
+      process.stdout.write(s + "\n");
+    }
+    function err(msg, code = 1) {
+      _ui(`
+${_c.e}error${_c.r}  ${msg}
+`);
+      process.exit(code);
+    }
+    function warn(msg) {
+      _ui(`${_c.y}warn${_c.r}   ${msg}
+`);
+    }
+    function _visLen(s) {
+      return s.replace(/\x1b\[[0-9;]*m/g, "").length;
+    }
+    function _boxLine(inner, width) {
+      const pad = Math.max(0, width - _visLen(inner) - 2);
+      return `${_c.dim}${_BOX.v}${_c.r} ${inner}${" ".repeat(pad)} ${_c.dim}${_BOX.v}${_c.r}
+`;
+    }
+    function _hline(width, l, r) {
+      return `${_c.dim}${l}${_BOX.h.repeat(width - 2)}${r}${_c.r}
+`;
+    }
+    function box(rows) {
+      const lw = Math.max(...rows.map((r) => r.label.length));
+      const lines = rows.map((r) => {
+        const pad = " ".repeat(lw - r.label.length + 1);
+        const vc = r.valueColor ?? _c.hi;
+        return `${_c.dim}${r.label}${_c.r}${pad}${vc}${r.value}${_c.r}`;
+      });
+      const width = Math.max(...lines.map(_visLen)) + 4;
+      _ui(_hline(width, _BOX.tl, _BOX.tr));
+      for (const l of lines)
+        _ui(_boxLine(l, width));
+      _ui(_hline(width, _BOX.bl, _BOX.br));
+    }
+    function token(t) {
+      _ui(`
+${_c.hi}${t}${_c.r}
+
+`);
+    }
+    function ms(elapsed) {
+      _ui(`${_c.dim}done in ${elapsed}ms${_c.r}
+`);
+    }
+    function section(title) {
+      _ui(`
+${_c.w}${title}${_c.r}
+
+`);
+    }
+    function usage() {
+      _ui(`
+${_c.b}${_c.c}${exports2.PKG}${_c.r}  ${_c.dim}v${exports2.VERSION}${_c.r}  ChaCha20-Poly1305 / AES-256-GCM
+
+`);
+      const c = (s) => `  ${_c.c}${s}${_c.r}`;
+      const lines = [
+        `${_c.w}commands${_c.r}`,
+        ``,
+        c(`${exports2.BIN} enc    <text|@file>  -sw <password>`) + "   encrypt",
+        c(`${exports2.BIN} denc   <token>       -sw <password>`) + "   decrypt",
+        c(`${exports2.BIN} verify <token>       -sw <password>`) + "   verify token integrity",
+        c(`${exports2.BIN} fp     <text>        -sw <secret>  `) + "   HMAC fingerprint",
+        c(`${exports2.BIN} gen    [bytes]                     `) + "   generate secure password",
+        c(`${exports2.BIN} info   <token>                     `) + "   inspect token metadata",
+        c(`${exports2.BIN} history                            `) + "   show session history",
+        c(`${exports2.BIN} upgrade  (or -u)                   `) + "   check for updates",
+        ``,
+        `${_c.w}flags${_c.r}`,
+        ``,
+        `  ${_c.c}-sw <password>${_c.r}          password source`,
+        `  ${_c.c}--expires <time>${_c.r}        token expiry  (30s, 5m, 2h, 7d)`,
+        `  ${_c.c}--clip${_c.r}                  copy result to clipboard`,
+        `  ${_c.c}--out <file>${_c.r}            (denc) save output to file`,
+        `  ${_c.c}--no-color${_c.r}              disable ANSI colors`,
+        `  ${_c.c}-v, --version${_c.r}           print version`,
+        `  ${_c.c}-h, --help${_c.r}              show this help`,
+        ``,
+        `${_c.w}password sources${_c.r}`,
+        ``,
+        `  -sw mypassword        inline`,
+        `  -sw @~/.rwn64key       read from file  (recommended)`,
+        `  -sw env:RWN64_KEY      read from env variable`,
+        ``,
+        `${_c.w}.rwn64rc${_c.r}`,
+        ``,
+        `  password = env:RWN64_KEY`,
+        `  bytes    = 32`,
+        `  maxSize  = 20`,
+        `  clip     = false`,
+        ``,
+        `${_c.w}examples${_c.r}`,
+        ``,
+        `  rwn64 enc 'my secret'         -sw mypassword`,
+        `  rwn64 enc 'expires in 1 hour' -sw mypassword  --expires 1h`,
+        `  rwn64 enc @notes.txt          -sw mypassword`,
+        `  rwn64 denc 'rwn64:v2:...'      -sw mypassword`,
+        `  rwn64 denc 'rwn64:v2:...'      -sw mypassword  --out result.txt`,
+        `  TOKEN=$(rwn64 enc 'text' -sw pass)`,
+        `  rwn64 denc "$TOKEN" -sw pass`,
+        ``
+      ];
+      _ui(lines.join("\n") + "\n");
+    }
+    function row(label, value, color = _c.hi) {
+      const pad = " ".repeat(Math.max(1, 10 - label.length));
+      _ui(`${_c.dim}${label}${_c.r}${pad}${color}${value}${_c.r}
+`);
+    }
+  }
+});
+
+// dist/lib/crypto.js
+var require_crypto = __commonJS({
+  "dist/lib/crypto.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.VERSION = exports2.TOKEN_PREFIX = void 0;
+    exports2.encrypt = encrypt;
+    exports2.decrypt = decrypt;
+    exports2.verify = verify;
+    exports2.hmacFingerprint = hmacFingerprint;
+    exports2.inspectToken = inspectToken;
+    exports2.generatePassword = generatePassword;
+    exports2.parseExpiry = parseExpiry;
+    var crypto_1 = require("crypto");
+    var _PFX_V1 = "rwn64:v1:";
+    var _PFX_V2 = "rwn64:v2:";
+    var _ALG_V1 = "aes-256-gcm";
+    var _ALG_V2 = "chacha20-poly1305";
+    var _SL = 16;
+    var _NL = 12;
+    var _TL = 16;
+    var _KL = 32;
+    var _SCRYPT = { N: 16384, r: 8, p: 1 };
+    exports2.TOKEN_PREFIX = _PFX_V2;
+    exports2.VERSION = "v2";
+    function _kdf(pass, salt) {
+      const buf = Buffer.from(pass, "utf8");
+      const key = (0, crypto_1.scryptSync)(buf, salt, _KL, _SCRYPT);
+      buf.fill(0);
+      return key;
+    }
+    function _encExp(ms) {
+      const b = Buffer.allocUnsafe(8);
+      b.writeUInt32BE(Math.floor(ms / 4294967296), 0);
+      b.writeUInt32BE(ms >>> 0, 4);
+      return b;
+    }
+    function _decExp(b) {
+      return b.readUInt32BE(0) * 4294967296 + b.readUInt32BE(4);
+    }
+    function encrypt(plaintext, password, opts = {}) {
+      const salt = (0, crypto_1.randomBytes)(_SL);
+      const nonce = (0, crypto_1.randomBytes)(_NL);
+      const key = _kdf(password, salt);
+      const hasx = opts.expiresMs !== void 0;
+      const meta = Buffer.alloc(1);
+      meta[0] = hasx ? 1 : 0;
+      const inner = Buffer.concat([meta, hasx ? _encExp(opts.expiresMs) : Buffer.alloc(0), Buffer.from(plaintext, "utf8")]);
+      const ciph = (0, crypto_1.createCipheriv)(_ALG_V2, key, nonce, { authTagLength: _TL });
+      const body = Buffer.concat([ciph.update(inner), ciph.final()]);
+      const tag = ciph.getAuthTag();
+      return _PFX_V2 + Buffer.concat([salt, nonce, tag, body]).toString("base64url");
+    }
+    function decrypt(token, password) {
+      let pfx;
+      let alg;
+      let ver;
+      if (token.startsWith(_PFX_V2)) {
+        pfx = _PFX_V2;
+        alg = _ALG_V2;
+        ver = 2;
+      } else if (token.startsWith(_PFX_V1)) {
+        pfx = _PFX_V1;
+        alg = _ALG_V1;
+        ver = 1;
+      } else
+        throw Object.assign(new Error("invalid token format"), { code: "ERR_FORMAT" });
+      const payload = Buffer.from(token.slice(pfx.length), "base64url");
+      if (payload.length < _SL + _NL + _TL + 2)
+        throw Object.assign(new Error("token is too short or malformed"), { code: "ERR_MALFORMED" });
+      const salt = payload.subarray(0, _SL);
+      const nonce = payload.subarray(_SL, _SL + _NL);
+      const tag = payload.subarray(_SL + _NL, _SL + _NL + _TL);
+      const body = payload.subarray(_SL + _NL + _TL);
+      const key = _kdf(password, salt);
+      const dc = (0, crypto_1.createDecipheriv)(alg, key, nonce, ver === 2 ? { authTagLength: _TL } : void 0);
+      dc.setAuthTag(tag);
+      let inner;
+      try {
+        inner = Buffer.concat([dc.update(body), dc.final()]);
+      } catch {
+        throw Object.assign(new Error("wrong password or corrupted token"), { code: "ERR_AUTH" });
+      }
+      const hasx = inner[0] === 1;
+      if (hasx) {
+        const expMs = _decExp(inner.subarray(1, 9));
+        const expDate = new Date(expMs);
+        if (Date.now() > expMs)
+          throw Object.assign(new Error(`token expired at ${expDate.toISOString()}`), { code: "ERR_EXPIRED", expiredAt: expDate });
+        return { plaintext: inner.subarray(9).toString("utf8"), expiresAt: expDate, tokenVersion: ver };
+      }
+      return { plaintext: inner.subarray(1).toString("utf8"), tokenVersion: ver };
+    }
+    function verify(token, password) {
+      try {
+        decrypt(token, password);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    function hmacFingerprint(input, secret) {
+      return (0, crypto_1.createHmac)("sha256", secret).update(input).digest("hex").slice(0, 16);
+    }
+    function inspectToken(token) {
+      let pfx;
+      let algo;
+      let ver;
+      if (token.startsWith(_PFX_V2)) {
+        pfx = _PFX_V2;
+        algo = "ChaCha20-Poly1305";
+        ver = 2;
+      } else if (token.startsWith(_PFX_V1)) {
+        pfx = _PFX_V1;
+        algo = "AES-256-GCM";
+        ver = 1;
+      } else
+        throw Object.assign(new Error("invalid token format"), { code: "ERR_FORMAT" });
+      const payload = Buffer.from(token.slice(pfx.length), "base64url");
+      if (payload.length < _SL + _NL + _TL + 2)
+        throw Object.assign(new Error("token is too short or malformed"), { code: "ERR_MALFORMED" });
+      return { version: `v${ver}`, prefix: pfx, algo, saltHex: payload.subarray(0, _SL).toString("hex"), nonceHex: payload.subarray(_SL, _SL + _NL).toString("hex"), payloadBytes: payload.length };
+    }
+    function generatePassword(bytes = 24) {
+      return (0, crypto_1.randomBytes)(bytes).toString("base64url");
+    }
+    function parseExpiry(raw) {
+      const m = raw.match(/^(\d+)(s|m|h|d)$/);
+      if (!m)
+        throw new Error(`invalid expiry format: "${raw}" \u2014 use 30s, 5m, 2h, 7d`);
+      const u = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
+      return Date.now() + parseInt(m[1], 10) * u[m[2]];
+    }
+  }
+});
+
+// dist/lib/password.js
+var require_password = __commonJS({
+  "dist/lib/password.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.resolvePassword = resolvePassword;
+    exports2.describePasswordSource = describePasswordSource;
+    var fs_1 = require("fs");
+    function resolvePassword(raw) {
+      if (raw.startsWith("@")) {
+        const path = raw.slice(1).trim();
+        try {
+          return (0, fs_1.readFileSync)(path, "utf8").trim();
+        } catch {
+          throw Object.assign(new Error(`cannot read password file: ${path}`), { code: "ERR_PWFILE" });
+        }
+      }
+      if (raw.startsWith("env:")) {
+        const name = raw.slice(4).trim();
+        const val = process.env[name];
+        if (!val)
+          throw Object.assign(new Error(`env variable not set: ${name}`), { code: "ERR_PWENV" });
+        return val;
+      }
+      return raw;
+    }
+    function describePasswordSource(raw) {
+      if (raw.startsWith("@"))
+        return `file(${raw.slice(1)})`;
+      if (raw.startsWith("env:"))
+        return `env(${raw.slice(4)})`;
+      return "inline";
+    }
+  }
+});
+
+// dist/lib/clip.js
+var require_clip = __commonJS({
+  "dist/lib/clip.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.copyToClipboard = copyToClipboard;
+    exports2.clipAvailable = clipAvailable;
+    var child_process_1 = require("child_process");
+    var env_1 = require_env();
+    function _cmd() {
+      if (env_1.env.isMacOS)
+        return "pbcopy";
+      if (env_1.env.isTermux) {
+        try {
+          (0, child_process_1.execSync)("which termux-clipboard-set", { stdio: "ignore" });
+          return "termux-clipboard-set";
+        } catch {
+        }
+        return null;
+      }
+      for (const [bin, cmd] of [["xclip", "xclip -selection clipboard"], ["xsel", "xsel --clipboard --input"], ["wl-copy", "wl-copy"]]) {
+        try {
+          (0, child_process_1.execSync)(`which ${bin}`, { stdio: "ignore" });
+          return cmd;
+        } catch {
+        }
+      }
+      return null;
+    }
+    function copyToClipboard(text) {
+      const cmd = _cmd();
+      if (!cmd)
+        return false;
+      try {
+        (0, child_process_1.execSync)(cmd, { input: text, stdio: ["pipe", "ignore", "ignore"] });
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    function clipAvailable() {
+      return _cmd() !== null;
+    }
+  }
+});
+
+// dist/lib/rc.js
+var require_rc = __commonJS({
+  "dist/lib/rc.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.loadRC = loadRC;
+    var fs_1 = require("fs");
+    var path_1 = require("path");
+    var os_1 = require("os");
+    var _DEFAULTS = { bytes: 24, maxSize: 20, clip: false };
+    var _RC_FILE = ".rwn64rc";
+    function _parse(raw) {
+      const out = {};
+      for (const line of raw.split("\n")) {
+        const t = line.trim();
+        if (!t || t.startsWith("#"))
+          continue;
+        const eq = t.indexOf("=");
+        if (eq === -1)
+          continue;
+        const k = t.slice(0, eq).trim();
+        const v = t.slice(eq + 1).trim();
+        if (k === "password")
+          out.password = v;
+        if (k === "bytes")
+          out.bytes = parseInt(v, 10);
+        if (k === "maxSize")
+          out.maxSize = parseInt(v, 10);
+        if (k === "clip")
+          out.clip = v === "true";
+      }
+      return out;
+    }
+    function _load(path) {
+      if (!(0, fs_1.existsSync)(path))
+        return null;
+      try {
+        return _parse((0, fs_1.readFileSync)(path, "utf8"));
+      } catch {
+        return null;
+      }
+    }
+    function loadRC() {
+      const local = _load((0, path_1.resolve)(process.cwd(), _RC_FILE));
+      const global = _load((0, path_1.join)((0, os_1.homedir)(), _RC_FILE));
+      return { ..._DEFAULTS, ...global, ...local };
+    }
+  }
+});
+
+// dist/lib/history.js
+var require_history = __commonJS({
+  "dist/lib/history.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.recordHistory = recordHistory;
+    exports2.getHistory = getHistory;
+    exports2.clearHistory = clearHistory;
+    var fs_1 = require("fs");
+    var path_1 = require("path");
+    var os_1 = require("os");
+    var crypto_1 = require("crypto");
+    var _FILE = (0, path_1.join)((0, os_1.tmpdir)(), ".rwn64_history");
+    function _load() {
+      if (!(0, fs_1.existsSync)(_FILE))
+        return [];
+      try {
+        return JSON.parse((0, fs_1.readFileSync)(_FILE, "utf8"));
+      } catch {
+        return [];
+      }
+    }
+    function _save(e) {
+      try {
+        (0, fs_1.writeFileSync)(_FILE, JSON.stringify(e), "utf8");
+      } catch {
+      }
+    }
+    function recordHistory(cmd, token) {
+      const e = _load();
+      e.push({ ts: Date.now(), cmd, fp: (0, crypto_1.createHash)("sha256").update(token).digest("hex").slice(0, 8) });
+      if (e.length > 50)
+        e.splice(0, e.length - 50);
+      _save(e);
+    }
+    function getHistory() {
+      return _load();
+    }
+    function clearHistory() {
+      _save([]);
+    }
+  }
+});
+
+// dist/cmd/enc.js
+var require_enc = __commonJS({
+  "dist/cmd/enc.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdEnc = cmdEnc;
+    var fs_1 = require("fs");
+    var readline_1 = require("readline");
+    var crypto_1 = require_crypto();
+    var password_1 = require_password();
+    var ui_12 = require_ui();
+    var clip_1 = require_clip();
+    var rc_1 = require_rc();
+    var history_12 = require_history();
+    var env_1 = require_env();
+    var args_12 = require_args();
+    var _MAX = 20 * 1024 * 1024;
+    var _WARN = 5 * 1024 * 1024;
+    async function _confirm(msg) {
+      return new Promise((res) => {
+        const rl = (0, readline_1.createInterface)({ input: process.stdin, output: process.stderr });
+        rl.question(msg, (a) => {
+          rl.close();
+          res(a.trim().toLowerCase() === "y");
+        });
+      });
+    }
+    async function _interactive() {
+      return new Promise((resolve) => {
+        process.stderr.write("enter text: ");
+        let text = "";
+        if (env_1.env.hasRawMode) {
+          process.stdin.setRawMode(true);
+          process.stdin.resume();
+          process.stdin.setEncoding("utf8");
+          const onData = (ch) => {
+            if (ch === "\r" || ch === "\n") {
+              process.stdin.setRawMode(false);
+              process.stdin.pause();
+              process.stdin.removeListener("data", onData);
+              process.stderr.write("\n");
+              resolve(text);
+            } else if (ch === "") {
+              process.stderr.write("\naborted.\n");
+              process.exit(0);
+            } else if (ch === "\x7F") {
+              text = text.slice(0, -1);
+              process.stderr.write("\b \b");
+            } else {
+              text += ch;
+              process.stderr.write("\xB7");
+            }
+          };
+          process.stdin.on("data", onData);
+        } else {
+          const rl = (0, readline_1.createInterface)({ input: process.stdin, output: process.stderr });
+          rl.question("", (a) => {
+            rl.close();
+            resolve(a);
+          });
+        }
+      });
+    }
+    function _readInput(raw) {
+      if (raw.startsWith("@")) {
+        const path = raw.slice(1).trim();
+        if (!(0, fs_1.existsSync)(path))
+          (0, ui_12.err)(`file not found: ${path}`, 2);
+        const stat = (0, fs_1.statSync)(path);
+        if (stat.size > _MAX)
+          (0, ui_12.err)(`file too large: ${(stat.size / 1024 / 1024).toFixed(1)} MB. max 20 MB`, 2);
+        return { text: (0, fs_1.readFileSync)(path, "utf8"), source: `file(${path})`, bytes: stat.size };
+      }
+      const bytes = Buffer.byteLength(raw, "utf8");
+      return { text: raw, source: "arg", bytes };
+    }
+    async function cmdEnc(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      if (!rawPw)
+        (0, ui_12.err)("-sw <password> is required (or set 'password' in .rwn64rc)");
+      const password = (0, password_1.resolvePassword)(rawPw);
+      const pwSource = (0, password_1.describePasswordSource)(rawPw);
+      if (password.length < 8)
+        (0, ui_12.warn)("password is short (< 8 chars). consider a stronger password.");
+      let text;
+      let source;
+      let bytes;
+      const rawInput = parsed2.positional[0];
+      if (!rawInput) {
+        text = await _interactive();
+        source = "interactive";
+        bytes = Buffer.byteLength(text, "utf8");
+      } else {
+        const r = _readInput(rawInput);
+        text = r.text;
+        source = r.source;
+        bytes = r.bytes;
+      }
+      const mb = bytes / 1024 / 1024;
+      if (bytes > _WARN) {
+        let msg = `
+  input is ${mb.toFixed(1)} MB. may be slow.
+`;
+        if (env_1.env.isTermux)
+          msg += "  warning: files above 500 MB may crash Termux.\n";
+        msg += "  continue? [y/N] ";
+        if (!await _confirm(msg)) {
+          process.stderr.write("aborted.\n");
+          process.exit(0);
+        }
+      }
+      const rawExp = (0, args_12.getFlag)(parsed2.flags, "expires");
+      const expiresMs = rawExp ? (0, crypto_1.parseExpiry)(rawExp) : void 0;
+      const useClip = (0, args_12.hasFlag)(parsed2.flags, "clip") || !!rc.clip;
+      const sizeLabel = mb < 0.01 ? `${bytes} B` : `${mb.toFixed(2)} MB`;
+      const t0 = Date.now();
+      let tok;
+      try {
+        tok = (0, crypto_1.encrypt)(text, password, { expiresMs });
+      } catch (ex) {
+        (0, ui_12.err)(ex.message, 2);
+      }
+      const elapsed = Date.now() - t0;
+      (0, history_12.recordHistory)("enc", tok);
+      (0, ui_12.section)("encrypt");
+      (0, ui_12.box)([
+        { label: "input", value: source === "interactive" ? "(hidden)" : source === "arg" ? text.length > 52 ? text.slice(0, 52) + "\u2026" : text : source },
+        { label: "size", value: sizeLabel },
+        { label: "pw", value: pwSource },
+        { label: "algo", value: "ChaCha20-Poly1305 / scrypt" },
+        ...expiresMs ? [{ label: "expires", value: new Date(expiresMs).toISOString() }] : []
+      ]);
+      (0, ui_12.token)(tok);
+      (0, ui_12.ms)(elapsed);
+      if (useClip) {
+        const ok = (0, clip_1.copyToClipboard)(tok);
+        if (ok)
+          process.stderr.write("\n  copied to clipboard\n");
+        else
+          (0, ui_12.warn)("--clip: no clipboard tool found");
+      }
+      process.stderr.write("\n");
+      process.stdout.write(tok + "\n");
+    }
+  }
+});
+
+// dist/cmd/denc.js
+var require_denc = __commonJS({
+  "dist/cmd/denc.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdDenc = cmdDenc;
+    var fs_1 = require("fs");
+    var crypto_1 = require_crypto();
+    var password_1 = require_password();
+    var ui_12 = require_ui();
+    var clip_1 = require_clip();
+    var rc_1 = require_rc();
+    var history_12 = require_history();
+    var args_12 = require_args();
+    function cmdDenc(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const token = parsed2.positional[0];
+      if (!token)
+        (0, ui_12.err)("missing <token> argument");
+      if (token.startsWith("rwn64$")) {
+        (0, ui_12.err)("token uses '$' separator \u2014 did you use double quotes?\n  fix    use single quotes:  rwn64 denc 'rwn64:v2:...' -sw password", 2);
+      }
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      if (!rawPw)
+        (0, ui_12.err)("-sw <password> is required (or set 'password' in .rwn64rc)");
+      const password = (0, password_1.resolvePassword)(rawPw);
+      const pwSource = (0, password_1.describePasswordSource)(rawPw);
+      const outFile = (0, args_12.getFlag)(parsed2.flags, "out", "o");
+      const useClip = (0, args_12.hasFlag)(parsed2.flags, "clip") || !!rc.clip;
+      const t0 = Date.now();
+      let result;
+      try {
+        result = (0, crypto_1.decrypt)(token, password);
+      } catch (ex) {
+        const c = ex.code ?? "";
+        if (c === "ERR_EXPIRED")
+          (0, ui_12.err)(`token expired at ${ex.expiredAt?.toISOString()}`, 2);
+        if (c === "ERR_AUTH")
+          (0, ui_12.err)("wrong password or token has been tampered with", 2);
+        if (c === "ERR_FORMAT")
+          (0, ui_12.err)("value does not look like a rwn64 token", 2);
+        if (c === "ERR_MALFORMED")
+          (0, ui_12.err)("token is malformed or truncated", 2);
+        (0, ui_12.err)(ex.message, 2);
+      }
+      const elapsed = Date.now() - t0;
+      (0, history_12.recordHistory)("denc", token);
+      (0, ui_12.section)("decrypt");
+      (0, ui_12.box)([
+        { label: "token", value: token.length > 40 ? token.slice(0, 40) + "\u2026" : token },
+        { label: "pw", value: pwSource },
+        { label: "algo", value: result.tokenVersion === 2 ? "ChaCha20-Poly1305" : "AES-256-GCM" },
+        ...result.expiresAt ? [{ label: "expires", value: result.expiresAt.toISOString() }] : [],
+        { label: "result", value: result.plaintext.length > 52 ? result.plaintext.slice(0, 52) + "\u2026" : result.plaintext }
+      ]);
+      (0, ui_12.ms)(elapsed);
+      process.stderr.write("\n");
+      if (outFile) {
+        try {
+          (0, fs_1.writeFileSync)(outFile, result.plaintext, "utf8");
+          process.stderr.write(`  saved to ${outFile}
+
+`);
+        } catch {
+          (0, ui_12.err)(`could not write file: ${outFile}`, 2);
+        }
+      }
+      if (useClip) {
+        const ok = (0, clip_1.copyToClipboard)(result.plaintext);
+        if (ok)
+          process.stderr.write("  copied to clipboard\n\n");
+        else
+          (0, ui_12.warn)("--clip: no clipboard tool found");
+      }
+      if (!outFile)
+        (0, ui_12.data)(result.plaintext);
+    }
+  }
+});
+
+// dist/cmd/verify.js
+var require_verify = __commonJS({
+  "dist/cmd/verify.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdVerify = cmdVerify;
+    var crypto_1 = require_crypto();
+    var password_1 = require_password();
+    var ui_12 = require_ui();
+    var rc_1 = require_rc();
+    var args_12 = require_args();
+    function cmdVerify(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const token = parsed2.positional[0];
+      if (!token)
+        (0, ui_12.err)("missing <token> argument");
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      if (!rawPw)
+        (0, ui_12.err)("-sw <password> is required");
+      const password = (0, password_1.resolvePassword)(rawPw);
+      const t0 = Date.now();
+      const ok = (0, crypto_1.verify)(token, password);
+      const elapsed = Date.now() - t0;
+      (0, ui_12.section)("verify");
+      (0, ui_12.box)([
+        { label: "token", value: token.length > 40 ? token.slice(0, 40) + "\u2026" : token },
+        { label: "status", value: ok ? "valid" : "invalid", valueColor: ok ? "\x1B[32m" : "\x1B[31m" }
+      ]);
+      (0, ui_12.ms)(elapsed);
+      process.stderr.write("\n");
+      process.stdout.write((ok ? "valid" : "invalid") + "\n");
+      if (!ok)
+        process.exit(2);
+    }
+  }
+});
+
+// dist/cmd/info.js
+var require_info = __commonJS({
+  "dist/cmd/info.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdInfo = cmdInfo;
+    var crypto_1 = require_crypto();
+    var ui_12 = require_ui();
+    function cmdInfo(parsed2) {
+      const token = parsed2.positional[0];
+      if (!token)
+        (0, ui_12.err)("missing <token> argument");
+      let meta;
+      try {
+        meta = (0, crypto_1.inspectToken)(token);
+      } catch (ex) {
+        (0, ui_12.err)(ex.message, 2);
+      }
+      (0, ui_12.section)("token info");
+      (0, ui_12.box)([
+        { label: "prefix", value: meta.prefix },
+        { label: "version", value: meta.version },
+        { label: "algo", value: meta.algo },
+        { label: "kdf", value: "scrypt (N=16384,r=8,p=1)" },
+        { label: "salt", value: meta.saltHex },
+        { label: "nonce", value: meta.nonceHex },
+        { label: "bytes", value: String(meta.payloadBytes) + " (raw payload)" }
+      ]);
+      process.stderr.write("\n");
+    }
+  }
+});
+
+// dist/cmd/fp.js
+var require_fp = __commonJS({
+  "dist/cmd/fp.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdFp = cmdFp;
+    var crypto_1 = require_crypto();
+    var password_1 = require_password();
+    var ui_12 = require_ui();
+    var rc_1 = require_rc();
+    var args_12 = require_args();
+    function cmdFp(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const text = parsed2.positional[0];
+      if (!text)
+        (0, ui_12.err)("missing <text> argument");
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      if (!rawPw)
+        (0, ui_12.err)("-sw <secret> is required");
+      const secret = (0, password_1.resolvePassword)(rawPw);
+      const t0 = Date.now();
+      const fp = (0, crypto_1.hmacFingerprint)(text, secret);
+      const elapsed = Date.now() - t0;
+      (0, ui_12.section)("fingerprint");
+      (0, ui_12.box)([
+        { label: "input", value: text.length > 52 ? text.slice(0, 52) + "\u2026" : text },
+        { label: "algo", value: "HMAC-SHA256" },
+        { label: "fp", value: fp }
+      ]);
+      (0, ui_12.ms)(elapsed);
+      process.stderr.write("\n");
+      (0, ui_12.data)(fp);
+    }
+  }
+});
+
+// dist/cmd/gen.js
+var require_gen = __commonJS({
+  "dist/cmd/gen.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdGen = cmdGen;
+    var crypto_1 = require_crypto();
+    var ui_12 = require_ui();
+    var clip_1 = require_clip();
+    var rc_1 = require_rc();
+    var args_12 = require_args();
+    function cmdGen(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const raw = parsed2.positional[0];
+      const bytes = raw ? parseInt(raw, 10) : rc.bytes ?? 24;
+      const useClip = (0, args_12.hasFlag)(parsed2.flags, "clip") || !!rc.clip;
+      if (isNaN(bytes) || bytes < 8 || bytes > 256)
+        (0, ui_12.err)("bytes must be between 8 and 256");
+      const t0 = Date.now();
+      const pw = (0, crypto_1.generatePassword)(bytes);
+      const elapsed = Date.now() - t0;
+      (0, ui_12.section)("generate password");
+      (0, ui_12.box)([
+        { label: "bytes", value: String(bytes) },
+        { label: "entropy", value: `~${Math.floor(bytes * 6)} bits` },
+        { label: "password", value: pw }
+      ]);
+      (0, ui_12.ms)(elapsed);
+      process.stderr.write("\n");
+      if (useClip) {
+        const ok = (0, clip_1.copyToClipboard)(pw);
+        if (ok)
+          process.stderr.write("  copied to clipboard\n\n");
+        else
+          (0, ui_12.warn)("--clip: no clipboard tool found");
+      }
+      (0, ui_12.data)(pw);
+    }
+  }
+});
+
+// dist/cmd/history.js
+var require_history2 = __commonJS({
+  "dist/cmd/history.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdHistory = cmdHistory;
+    var history_12 = require_history();
+    var ui_12 = require_ui();
+    var args_12 = require_args();
+    function cmdHistory(parsed2) {
+      if ((0, args_12.hasFlag)(parsed2.flags, "clear")) {
+        (0, history_12.clearHistory)();
+        process.stderr.write("history cleared\n");
+        return;
+      }
+      const entries = (0, history_12.getHistory)();
+      if (entries.length === 0) {
+        (0, ui_12.warn)("no history yet");
+        return;
+      }
+      (0, ui_12.section)("history");
+      (0, ui_12.box)(entries.map((e) => ({ label: new Date(e.ts).toISOString().slice(0, 19).replace("T", " "), value: `${e.cmd.padEnd(5)}  fp:${e.fp}` })));
+      process.stderr.write("\n");
+    }
+  }
+});
+
+// dist/cmd/upgrade.js
+var require_upgrade = __commonJS({
+  "dist/cmd/upgrade.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.cmdUpgrade = cmdUpgrade;
+    var child_process_1 = require("child_process");
+    var ui_12 = require_ui();
+    function _latest() {
+      try {
+        return (0, child_process_1.execSync)("npm info rwn64 version", { encoding: "utf8", timeout: 8e3 }).trim();
+      } catch {
+        return null;
+      }
+    }
+    function _cmp(a, b) {
+      const pa = a.split(".").map(Number);
+      const pb = b.split(".").map(Number);
+      for (let i = 0; i < 3; i++) {
+        const d = (pa[i] ?? 0) - (pb[i] ?? 0);
+        if (d)
+          return d;
+      }
+      return 0;
+    }
+    function cmdUpgrade() {
+      (0, ui_12.section)("upgrade");
+      (0, ui_12.row)("current", ui_12.VERSION);
+      process.stderr.write("\nchecking npm registry...\n\n");
+      const latest = _latest();
+      if (!latest)
+        (0, ui_12.err)("could not reach npm registry. check your connection.", 1);
+      (0, ui_12.row)("latest", latest);
+      process.stderr.write("\n");
+      if (_cmp(latest, ui_12.VERSION) <= 0) {
+        (0, ui_12.row)("status", "already up to date");
+        process.stderr.write("\n");
+        return;
+      }
+      (0, ui_12.row)("status", `update available  ${ui_12.VERSION} \u2192 ${latest}`);
+      process.stderr.write("\nrun to update:\n\n");
+      process.stdout.write("npm install -g rwn64\n");
+      process.stderr.write("\n");
+    }
+  }
+});
+
+// dist/cli.js
+Object.defineProperty(exports, "__esModule", { value: true });
+var errors_1 = require_errors();
+(0, errors_1.installErrorHandler)();
+var args_1 = require_args();
+var ui_1 = require_ui();
+var enc_1 = require_enc();
+var denc_1 = require_denc();
+var verify_1 = require_verify();
+var info_1 = require_info();
+var fp_1 = require_fp();
+var gen_1 = require_gen();
+var history_1 = require_history2();
+var upgrade_1 = require_upgrade();
+if (process.argv.includes("--no-color"))
+  process.env.NO_COLOR = "1";
+var rawArgv = process.argv.slice(2).filter((a) => a !== "--no-color");
+if (rawArgv.length === 0 || rawArgv[0] === "-h" || rawArgv[0] === "--help") {
+  (0, ui_1.usage)();
+  process.exit(0);
+}
+if (rawArgv[0] === "-v" || rawArgv[0] === "--version") {
+  process.stdout.write(ui_1.VERSION + "\n");
+  process.exit(0);
+}
+var parsed = (0, args_1.parseArgs)(rawArgv);
+async function main() {
+  switch (parsed.cmd) {
+    case "enc":
+      await (0, enc_1.cmdEnc)(parsed);
+      break;
+    case "denc":
+      (0, denc_1.cmdDenc)(parsed);
+      break;
+    case "verify":
+      (0, verify_1.cmdVerify)(parsed);
+      break;
+    case "info":
+      (0, info_1.cmdInfo)(parsed);
+      break;
+    case "fp":
+      (0, fp_1.cmdFp)(parsed);
+      break;
+    case "gen":
+      (0, gen_1.cmdGen)(parsed);
+      break;
+    case "history":
+      (0, history_1.cmdHistory)(parsed);
+      break;
+    case "upgrade":
+    case "-u":
+    case "-upgrade":
+      (0, upgrade_1.cmdUpgrade)();
+      break;
+    default:
+      (0, ui_1.warn)(`unknown command: ${parsed.cmd}`);
+      (0, ui_1.usage)();
+      process.exit(1);
+  }
+}
+main().catch((e) => (0, ui_1.err)(e?.message ?? "unexpected error", 1));