sec-ry 1.1.5 → 1.1.7

package/dist/cli.bundle.js

@@ -170,7 +170,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "sec-ry",
-      version: "1.1.5",
+      version: "1.1.7",
       description: "ChaCha20-Poly1305 / AES-256-GCM token encryption CLI and library",
       main: "dist/index.js",
       types: "dist/index.d.ts",
@@ -300,13 +300,16 @@ var require_ui = __commonJS({
     function box(rows) {
       if (exports2.QUIET)
         return;
+      const MAX_W = 80;
       const lw = Math.max(...rows.map((r) => r.label.length));
+      const valMax = MAX_W - lw - 6;
       const lines = rows.map((r) => {
         const pad = " ".repeat(lw - r.label.length + 1);
         const vc = r.valueColor ?? _c.hi;
-        return `${_c.gray}${r.label}${_c.r}${pad}${vc}${r.value}${_c.r}`;
+        const val = r.value.length > valMax ? r.value.slice(0, valMax - 1) + "\u2026" : r.value;
+        return `${_c.gray}${r.label}${_c.r}${pad}${vc}${val}${_c.r}`;
       });
-      const width = Math.max(...lines.map(_visLen)) + 4;
+      const width = Math.min(MAX_W, Math.max(...lines.map(_visLen)) + 4);
       const hline = (l, r) => `${_c.gray}${l}${"\u2500".repeat(width - 2)}${r}${_c.r}
 `;
       _ui(hline("\u250C", "\u2510"));
@@ -428,9 +431,11 @@ var require_args = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.parseArgs = parseArgs;
     exports2.getFlag = getFlag;
+    exports2.getFlags = getFlags;
     exports2.hasFlag = hasFlag;
     function parseArgs(argv) {
       const flags = {};
+      const multi = {};
       const positional = [];
       let i = 0;
       const cmd = argv[0] ?? "";
@@ -439,10 +444,16 @@ var require_args = __commonJS({
         const a = argv[i];
         if (a.startsWith("-")) {
           const key = a.replace(/^-+/, "");
-          const next = argv[i + 1];
-          if (next && !next.startsWith("-")) {
-            flags[key] = next;
-            i += 2;
+          const vals = [];
+          let j = i + 1;
+          while (j < argv.length && !argv[j].startsWith("-")) {
+            vals.push(argv[j]);
+            j++;
+          }
+          if (vals.length > 0) {
+            flags[key] = vals[0];
+            multi[key] = vals;
+            i = j;
           } else {
             flags[key] = true;
             i++;
@@ -452,7 +463,7 @@ var require_args = __commonJS({
           i++;
         }
       }
-      return { cmd, positional, flags };
+      return { cmd, positional, flags, multi };
     }
     function getFlag(flags, ...keys) {
       for (const k of keys) {
@@ -462,6 +473,13 @@ var require_args = __commonJS({
       }
       return void 0;
     }
+    function getFlags(multi, ...keys) {
+      for (const k of keys) {
+        if (multi[k] && multi[k].length > 0)
+          return multi[k];
+      }
+      return [];
+    }
     function hasFlag(flags, ...keys) {
       return keys.some((k) => k in flags);
     }
@@ -989,6 +1007,9 @@ var require_crypto = __commonJS({
     exports2.inspectToken = inspectToken;
     exports2.generatePassword = generatePassword;
     exports2.parseExpiry = parseExpiry;
+    exports2._unseal = _unseal;
+    exports2.sealEnc = sealEnc;
+    exports2.open = open;
     exports2.seal = seal;
     exports2.sealVerify = sealVerify;
     exports2.sealS2 = sealS2;
@@ -1190,24 +1211,118 @@ var require_crypto = __commonJS({
       const u = { s: 1e3, m: 6e4, h: 36e5, d: 864e5 };
       return Date.now() + parseInt(m[1], 10) * u[m[2]];
     }
+    var _PFX_SE = "secry:se:";
+    var _PFX_SEI = "secry:sei:";
+    var _CPX_SE = "sec:se:";
+    var _CPX_SEI = "sec:sei:";
+    var _SYM_VAL = /* @__PURE__ */ Symbol("sealed.value");
+    function _makeSeal(value) {
+      const obj = /* @__PURE__ */ Object.create(null);
+      Object.defineProperty(obj, _SYM_VAL, { value, enumerable: false, configurable: false, writable: false });
+      obj.toString = () => "[sealed]";
+      obj.toJSON = () => "[sealed]";
+      obj.valueOf = () => "[sealed]";
+      obj[Symbol.toPrimitive] = () => "[sealed]";
+      obj[/* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom")] = () => "[sealed]";
+      Object.freeze(obj);
+      return obj;
+    }
+    function _unseal(s) {
+      return s[_SYM_VAL];
+    }
+    var _MAX_IPS = 5;
+    function sealEnc(value, masterKey, opts = {}) {
+      const compact = !!opts.compact;
+      const sl = compact ? _SL_C : _SL;
+      const salt = (0, crypto_1.randomBytes)(sl);
+      const nonce = (0, crypto_1.randomBytes)(_NL);
+      const key = _kdf(masterKey, salt);
+      let ips = [];
+      if (opts.ip) {
+        ips = Array.isArray(opts.ip) ? opts.ip : [opts.ip];
+        if (!opts.ipForce && ips.length > _MAX_IPS)
+          throw Object.assign(new Error(`max ${_MAX_IPS} IPs allowed (use ipForce to override)`), { code: "ERR_TOO_MANY_IPS" });
+      }
+      let inner;
+      if (ips.length > 0) {
+        const hashes = ips.map((ip) => (0, crypto_1.createHmac)("sha256", key).update(ip, "utf8").digest());
+        inner = Buffer.concat([Buffer.from([1, ips.length]), ...hashes, Buffer.from(value, "utf8")]);
+      } else {
+        inner = Buffer.concat([Buffer.from([0, 0]), Buffer.from(value, "utf8")]);
+      }
+      const ciph = (0, crypto_1.createCipheriv)(_ALG_V1, key, nonce, { authTagLength: _TL });
+      const body = Buffer.concat([ciph.update(inner), ciph.final()]);
+      const tag = ciph.getAuthTag();
+      const pfx = ips.length > 0 ? compact ? _CPX_SEI : _PFX_SEI : compact ? _CPX_SE : _PFX_SE;
+      return pfx + Buffer.concat([salt, nonce, tag, body]).toString("base64url");
+    }
+    async function open(token, masterKey, cb, opts = {}) {
+      const pfx = token.startsWith(_PFX_SEI) ? _PFX_SEI : token.startsWith(_CPX_SEI) ? _CPX_SEI : token.startsWith(_PFX_SE) ? _PFX_SE : token.startsWith(_CPX_SE) ? _CPX_SE : null;
+      if (!pfx)
+        throw Object.assign(new Error("invalid seal-enc token"), { code: "ERR_FORMAT" });
+      const compact = pfx === _CPX_SE || pfx === _CPX_SEI;
+      const sl = compact ? _SL_C : _SL;
+      const payload = Buffer.from(token.slice(pfx.length), "base64url");
+      const salt = payload.subarray(0, sl);
+      const nonce = payload.subarray(sl, sl + _NL);
+      const tag = payload.subarray(sl + _NL, sl + _NL + _TL);
+      const body = payload.subarray(sl + _NL + _TL);
+      const key = _kdf(masterKey, salt);
+      let inner;
+      try {
+        const dc = (0, crypto_1.createDecipheriv)(_ALG_V1, key, nonce, { authTagLength: _TL });
+        dc.setAuthTag(tag);
+        inner = Buffer.concat([dc.update(body), dc.final()]);
+      } catch {
+        throw Object.assign(new Error("wrong master key or corrupted token"), { code: "ERR_AUTH" });
+      }
+      const hasIp = inner[0] === 1;
+      if (hasIp) {
+        if (!opts.ip)
+          throw Object.assign(new Error("this token requires an ip"), { code: "ERR_IP_REQUIRED" });
+        const count = inner[1];
+        const hashes = [];
+        for (let i = 0; i < count; i++)
+          hashes.push(inner.subarray(2 + i * 32, 2 + (i + 1) * 32));
+        const given = (0, crypto_1.createHmac)("sha256", key).update(opts.ip, "utf8").digest();
+        const matched = hashes.some((h) => h.length === given.length && require("crypto").timingSafeEqual(h, given));
+        if (!matched)
+          throw Object.assign(new Error("ip mismatch"), { code: "ERR_IP_MISMATCH" });
+        const value2 = inner.subarray(2 + count * 32).toString("utf8");
+        const sealed2 = _makeSeal(value2);
+        const result = await cb(sealed2);
+        sealed2[_SYM_VAL];
+        return result;
+      }
+      const value = inner.subarray(2).toString("utf8");
+      const sealed = _makeSeal(value);
+      return await cb(sealed);
+    }
     var _PFX_S1 = "secry:s1:";
     var _PFX_S2 = "secry:s2:";
+    var _CPX_S1 = "sec:s1:";
+    var _CPX_S2 = "sec:s2:";
     var _PEPPER_S2 = "enclove.secry.s2.pepper.v1";
-    function seal(input, secret) {
-      const salt = (0, crypto_1.randomBytes)(16);
+    function seal(input, secret, compact = false) {
+      const sl = compact ? _SL_C : 16;
+      const pfx = compact ? _CPX_S1 : _PFX_S1;
+      const salt = (0, crypto_1.randomBytes)(sl);
       const key = (0, crypto_1.scryptSync)(Buffer.from(secret, "utf8"), salt, 32, _SCRYPT);
       const mac = (0, crypto_1.createHmac)("sha256", key).update(input, "utf8").digest();
-      return _PFX_S1 + Buffer.concat([salt, mac]).toString("base64url");
+      return pfx + Buffer.concat([salt, mac]).toString("base64url");
     }
     function sealVerify(input, secret, token) {
-      if (!token.startsWith(_PFX_S1))
+      const isCompact = token.startsWith(_CPX_S1);
+      const pfx = isCompact ? _CPX_S1 : _PFX_S1;
+      if (!token.startsWith(pfx) && !token.startsWith(_PFX_S1))
         return false;
       try {
-        const raw = Buffer.from(token.slice(_PFX_S1.length), "base64url");
-        if (raw.length < 48)
+        const sl = isCompact ? _SL_C : 16;
+        const raw = Buffer.from(token.slice(pfx.length), "base64url");
+        if (raw.length < sl + 32)
           return false;
-        const salt = raw.subarray(0, 16);
-        const mac = raw.subarray(16);
+        const salt = raw.subarray(0, sl);
+        const mac = raw.subarray(sl);
         const key = (0, crypto_1.scryptSync)(Buffer.from(secret, "utf8"), salt, 32, _SCRYPT);
         const exp = (0, crypto_1.createHmac)("sha256", key).update(input, "utf8").digest();
         return exp.length === mac.length && require("crypto").timingSafeEqual(exp, mac);
@@ -1215,23 +1330,28 @@ var require_crypto = __commonJS({
         return false;
       }
     }
-    async function sealS2(input, secret) {
-      const salt = (0, crypto_1.randomBytes)(32);
+    async function sealS2(input, secret, compact = false) {
+      const sl = compact ? _SL_C : 32;
+      const pfx = compact ? _CPX_S2 : _PFX_S2;
+      const salt = (0, crypto_1.randomBytes)(sl);
       const peppered = Buffer.from(_PEPPER_S2 + secret, "utf8");
       const key = (0, crypto_1.scryptSync)(peppered, salt, 32, _SCRYPT_S2);
       const { blake3: blake32 } = await Promise.resolve().then(() => __importStar((init_blake3(), __toCommonJS(blake3_exports))));
       const out = blake32(new TextEncoder().encode(input), { key, dkLen: 64 });
-      return _PFX_S2 + Buffer.concat([salt, Buffer.from(out)]).toString("base64url");
+      return pfx + Buffer.concat([salt, Buffer.from(out)]).toString("base64url");
     }
     async function sealVerifyS2(input, secret, token) {
-      if (!token.startsWith(_PFX_S2))
+      const isCompact = token.startsWith(_CPX_S2);
+      const pfx = isCompact ? _CPX_S2 : _PFX_S2;
+      if (!token.startsWith(pfx) && !token.startsWith(_PFX_S2))
         return false;
       try {
-        const raw = Buffer.from(token.slice(_PFX_S2.length), "base64url");
-        if (raw.length < 96)
+        const sl = isCompact ? _SL_C : 32;
+        const raw = Buffer.from(token.slice(pfx.length), "base64url");
+        if (raw.length < sl + 64)
           return false;
-        const salt = raw.subarray(0, 32);
-        const mac = raw.subarray(32);
+        const salt = raw.subarray(0, sl);
+        const mac = raw.subarray(sl);
         const peppered = Buffer.from(_PEPPER_S2 + secret, "utf8");
         const key = (0, crypto_1.scryptSync)(peppered, salt, 32, _SCRYPT_S2);
         const { blake3: blake32 } = await Promise.resolve().then(() => __importStar((init_blake3(), __toCommonJS(blake3_exports))));
@@ -2110,8 +2230,48 @@ ${_c.gray}${"\u2500".repeat(48)}${_c.r}
 var require_seal = __commonJS({
   "dist/cmd/seal.js"(exports2) {
     "use strict";
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.cmdSeal = cmdSeal;
+    exports2.cmdSei = cmdSei;
+    exports2.cmdSeiOpen = cmdSeiOpen;
+    exports2.cmdSealOpen = cmdSealOpen;
     exports2.cmdSealVerify = cmdSealVerify;
     var crypto_1 = require_crypto();
     var password_1 = require_password();
@@ -2119,6 +2279,17 @@ var require_seal = __commonJS({
     var clip_1 = require_clip();
     var rc_1 = require_rc();
     var args_12 = require_args();
+    var os = __importStar(require("os"));
+    function _localIp() {
+      const ifaces = os.networkInterfaces();
+      for (const name of Object.keys(ifaces)) {
+        for (const iface of ifaces[name] ?? []) {
+          if (iface.family === "IPv4" && !iface.internal)
+            return iface.address;
+        }
+      }
+      return "127.0.0.1";
+    }
     async function cmdSeal(parsed2) {
       const rc = (0, rc_1.loadRC)();
       const text = parsed2.positional[0];
@@ -2129,8 +2300,49 @@ var require_seal = __commonJS({
       const useClip = (0, args_12.hasFlag)(parsed2.flags, "clip") || !!rc.clip;
       const quiet = (0, args_12.hasFlag)(parsed2.flags, "quiet") || (0, args_12.hasFlag)(parsed2.flags, "q");
       const useS2 = (0, args_12.hasFlag)(parsed2.flags, "s2");
+      const useEnc = (0, args_12.hasFlag)(parsed2.flags, "enc");
+      const useIp = (0, args_12.hasFlag)(parsed2.flags, "ip");
+      const ipForce = (0, args_12.hasFlag)(parsed2.flags, "ipf");
+      const compact = (0, args_12.hasFlag)(parsed2.flags, "compact");
       const t0 = Date.now();
-      const token = useS2 ? await (0, crypto_1.sealS2)(text, secret) : (0, crypto_1.seal)(text, secret);
+      if (useEnc) {
+        let ips;
+        if (useIp) {
+          const extras = (0, args_12.getFlags)(parsed2.multi, "ip");
+          ips = extras.length > 0 ? [_localIp(), ...extras] : [_localIp()];
+        } else if (ipForce) {
+          const extras = (0, args_12.getFlags)(parsed2.multi, "ipf");
+          ips = extras.length > 0 ? [_localIp(), ...extras] : [_localIp()];
+        }
+        if (ips && !ipForce && ips.length > 5)
+          (0, ui_12.err)("max 5 IPs allowed \u2014 use --ipf to override");
+        const token2 = (0, crypto_1.sealEnc)(text, secret, { ip: ips, ipForce, compact });
+        const elapsed2 = Date.now() - t0;
+        if (!quiet) {
+          (0, ui_12.section)("seal");
+          (0, ui_12.box)([
+            { label: "input", value: text.length > 52 ? text.slice(0, 52) + "\u2026" : text },
+            { label: "algo", value: "AES-256-GCM / scrypt" },
+            { label: "mode", value: `reversible${ips ? ` \xB7 ip-bound (${ips.length})` : ""}${compact ? " \xB7 compact" : ""}` },
+            ...ips ? ips.map((ip, i) => ({ label: `ip[${i}]`, value: ip })) : [],
+            { label: "note", value: ips ? "use seal:open \u2014 any of the bound IPs are accepted" : "use seal:open to retrieve" },
+            { label: "token", value: token2 }
+          ]);
+          (0, ui_12.ms)(elapsed2);
+        }
+        if (useClip) {
+          const copied = (0, clip_1.copyToClipboard)(token2);
+          if (copied) {
+            const { info } = require_ui();
+            if (!quiet)
+              info("copied to clipboard");
+          } else if (!quiet)
+            (0, ui_12.warn)("--clip: no clipboard tool found");
+        }
+        (0, ui_12.data)(token2);
+        return;
+      }
+      const token = useS2 ? await (0, crypto_1.sealS2)(text, secret, compact) : (0, crypto_1.seal)(text, secret, compact);
       const elapsed = Date.now() - t0;
       if (!quiet) {
         (0, ui_12.section)("seal");
@@ -2138,7 +2350,8 @@ var require_seal = __commonJS({
           { label: "input", value: text.length > 52 ? text.slice(0, 52) + "\u2026" : text },
           { label: "algo", value: useS2 ? "BLAKE3 / scrypt N=2^16" : "HMAC-SHA256 / scrypt" },
           { label: "version", value: useS2 ? "s2" : "s1" },
-          { label: "note", value: "one-way \u2014 cannot be reversed" },
+          { label: "mode", value: "one-way" },
+          { label: "note", value: "cannot be reversed" },
           { label: "token", value: token }
         ]);
         (0, ui_12.ms)(elapsed);
@@ -2156,6 +2369,104 @@ var require_seal = __commonJS({
       }
       (0, ui_12.data)(token);
     }
+    async function cmdSei(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const text = parsed2.positional[0];
+      if (!text)
+        (0, ui_12.err)("missing <value> argument");
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      const secret = (0, password_1.resolvePassword)(rawPw ?? "");
+      const ipForce = (0, args_12.hasFlag)(parsed2.flags, "ipf");
+      const compact = (0, args_12.hasFlag)(parsed2.flags, "compact");
+      const useClip = (0, args_12.hasFlag)(parsed2.flags, "clip") || !!rc.clip;
+      const quiet = (0, args_12.hasFlag)(parsed2.flags, "quiet") || (0, args_12.hasFlag)(parsed2.flags, "q");
+      const t0 = Date.now();
+      const extraIp = (0, args_12.getFlags)(parsed2.multi, "ip");
+      const extraIpf = (0, args_12.getFlags)(parsed2.multi, "ipf");
+      const extras = ipForce ? extraIpf : extraIp;
+      const ips = [_localIp(), ...extras];
+      if (!ipForce && ips.length > 5)
+        (0, ui_12.err)("max 5 IPs allowed \u2014 use --ipf to override");
+      const token = (0, crypto_1.sealEnc)(text, secret, { ip: ips, ipForce, compact });
+      const elapsed = Date.now() - t0;
+      if (!quiet) {
+        (0, ui_12.section)("sei");
+        (0, ui_12.box)([
+          { label: "input", value: text.length > 52 ? text.slice(0, 52) + "\u2026" : text },
+          { label: "algo", value: "AES-256-GCM / scrypt" },
+          { label: "mode", value: `${compact ? "compact (sec:sei:)" : "full (secry:sei:)"} \xB7 ip-bound (${ips.length})` },
+          ...ips.map((ip, i) => ({ label: `ip[${i}]`, value: ip })),
+          { label: "note", value: "reversible \u2014 use sei:open to retrieve" },
+          { label: "token", value: token }
+        ]);
+        (0, ui_12.ms)(elapsed);
+      }
+      if (useClip) {
+        const copied = (0, clip_1.copyToClipboard)(token);
+        if (copied) {
+          const { info } = require_ui();
+          if (!quiet)
+            info("copied to clipboard");
+        } else if (!quiet)
+          (0, ui_12.warn)("--clip: no clipboard tool found");
+      }
+      (0, ui_12.data)(token);
+    }
+    async function cmdSeiOpen(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const token = parsed2.positional[0];
+      if (!token)
+        (0, ui_12.err)("missing <token> argument");
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      if (!rawPw)
+        (0, ui_12.err)("-sw <secret> is required");
+      const secret = (0, password_1.resolvePassword)(rawPw);
+      const quiet = (0, args_12.hasFlag)(parsed2.flags, "quiet") || (0, args_12.hasFlag)(parsed2.flags, "q");
+      const t0 = Date.now();
+      const detectedIp = _localIp();
+      await (0, crypto_1.open)(token, secret, (sealed) => {
+        const elapsed = Date.now() - t0;
+        const value = (0, crypto_1._unseal)(sealed);
+        if (!quiet) {
+          (0, ui_12.section)("sei open");
+          (0, ui_12.box)([
+            { label: "token", value: token.length > 52 ? token.slice(0, 52) + "\u2026" : token },
+            { label: "ip", value: detectedIp },
+            { label: "result", value }
+          ]);
+          (0, ui_12.ms)(elapsed);
+        }
+        (0, ui_12.data)(value);
+      }, { ip: detectedIp });
+    }
+    async function cmdSealOpen(parsed2) {
+      const rc = (0, rc_1.loadRC)();
+      const token = parsed2.positional[0];
+      if (!token)
+        (0, ui_12.err)("missing <token> argument");
+      const rawPw = (0, args_12.getFlag)(parsed2.flags, "sw") ?? rc.password;
+      if (!rawPw)
+        (0, ui_12.err)("-sw <secret> is required");
+      const secret = (0, password_1.resolvePassword)(rawPw);
+      const quiet = (0, args_12.hasFlag)(parsed2.flags, "quiet") || (0, args_12.hasFlag)(parsed2.flags, "q");
+      const t0 = Date.now();
+      const needsIp = token.startsWith("secry:sei:") || token.startsWith("sec:sei:");
+      const detectedIp = needsIp ? _localIp() : void 0;
+      await (0, crypto_1.open)(token, secret, (sealed) => {
+        const elapsed = Date.now() - t0;
+        const value = (0, crypto_1._unseal)(sealed);
+        if (!quiet) {
+          (0, ui_12.section)("seal open");
+          (0, ui_12.box)([
+            { label: "token", value: token.length > 52 ? token.slice(0, 52) + "\u2026" : token },
+            ...detectedIp ? [{ label: "ip", value: detectedIp }] : [],
+            { label: "result", value }
+          ]);
+          (0, ui_12.ms)(elapsed);
+        }
+        (0, ui_12.data)(value);
+      }, detectedIp ? { ip: detectedIp } : {});
+    }
     async function cmdSealVerify(parsed2) {
       const rc = (0, rc_1.loadRC)();
       const text = parsed2.positional[0];
@@ -7153,9 +7464,18 @@ async function main() {
     case "seal":
       await (0, seal_1.cmdSeal)(parsed);
       break;
+    case "seal:open":
+      await (0, seal_1.cmdSealOpen)(parsed);
+      break;
     case "seal:verify":
       await (0, seal_1.cmdSealVerify)(parsed);
       break;
+    case "sei":
+      await (0, seal_1.cmdSei)(parsed);
+      break;
+    case "sei:open":
+      await (0, seal_1.cmdSeiOpen)(parsed);
+      break;
     case "changelog":
     case "changes":
       await (0, changelog_1.cmdChangelog)(parsed);