networkluki-cipher 0.1.0__tar.gz

networkluki_cipher-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 networkluki
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

networkluki_cipher-0.1.0/PKG-INFO

@@ -0,0 +1,100 @@
+Metadata-Version: 2.4
+Name: networkluki-cipher
+Version: 0.1.0
+Summary: Educational monoalphabetic substitution cipher library and CLI
+Author: NetworkLuki
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/networkluki/cryptography
+Project-URL: Repository, https://github.com/networkluki/cryptography
+Project-URL: Issues, https://github.com/networkluki/cryptography/issues
+Keywords: cipher,substitution,education,cryptography,cli
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Education
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Education
+Classifier: Topic :: Security :: Cryptography
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# NetworkLuki Cipher
+
+[![CI](https://github.com/networkluki/cryptography/actions/workflows/ci.yml/badge.svg)](https://github.com/networkluki/cryptography/actions/workflows/ci.yml)
+
+An educational monoalphabetic substitution cipher, available as a Python library and command-line application. This project also contains cryptography and network research notes.
+
+> **Security warning:** This is a classical substitution cipher with a fixed default alphabet. It is trivial to break with frequency analysis and **must not** be used for passwords, private messages, authentication, file encryption, or any sensitive information. For real encryption, use a vetted cryptographic library and standard authenticated encryption.
+
+## Installation
+
+After the first PyPI release:
+
+```bash
+python -m pip install networkluki-cipher
+```
+
+From a checked-out repository, for development:
+
+```bash
+python -m pip install -e .
+```
+
+Requires Python 3.10 or newer. The runtime has no third-party dependencies.
+
+## CLI
+
+```bash
+networkluki-cipher show
+networkluki-cipher show-map
+networkluki-cipher enc "Hello, World!"
+networkluki-cipher dec "Oryyz, Mztyc!"
+printf '%s\n' 'Hello' | networkluki-cipher enc
+python -m networkluki_cipher show
+```
+
+`show` prints the plaintext alphabet and substitution alphabet on two lines. `show-map` prints all 26 mappings. `enc` and `dec` accept a single text argument or read standard input. A single unrecognized positional argument is treated as text to decrypt, for compatibility with the original script.
+
+The CLI enforces a 1 MiB UTF-8 input limit; input exceeding it fails with exit code 2. Non-ASCII characters and nonletters are preserved.
+
+The old local command remains available from the repository root:
+
+```bash
+python3 src/crypto.py show
+```
+
+## Python library
+
+```python
+from networkluki_cipher import build_maps, encrypt_text, decrypt_text
+
+enc, dec = build_maps()
+ciphertext = encrypt_text("Hello, World!", enc)
+assert decrypt_text(ciphertext, dec) == "Hello, World!"
+```
+
+`build_maps(cipher=...)` can accept a custom permutation of the 26 ASCII letters for demonstrations. Changing the substitution alphabet **does not** make the cipher secure.
+
+## Development and testing
+
+```bash
+python -m pip install -e .
+python -m unittest discover -s tests -v
+python -m pip install build twine
+python -m build
+python -m twine check --strict dist/*
+```
+
+Release steps and PyPI Trusted Publishing setup: [docs/PUBLISHING.md](docs/PUBLISHING.md).
+
+## Research repository
+
+Other material in this repository covers cryptography-focused research, network-layer concepts, visualizations, and reproducible experiments. Research and production-grade cryptography are separate from the educational cipher package.
+
+For each study, document the problem statement, related work, method, results, limitations, and conclusions. Explicitly record cryptographic assumptions and threat models. Cite relevant RFC, NIST, ISO, or peer-reviewed references. Include the commit hash when citing this repository as a research artifact.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

networkluki_cipher-0.1.0/README.md

@@ -0,0 +1,78 @@
+# NetworkLuki Cipher
+
+[![CI](https://github.com/networkluki/cryptography/actions/workflows/ci.yml/badge.svg)](https://github.com/networkluki/cryptography/actions/workflows/ci.yml)
+
+An educational monoalphabetic substitution cipher, available as a Python library and command-line application. This project also contains cryptography and network research notes.
+
+> **Security warning:** This is a classical substitution cipher with a fixed default alphabet. It is trivial to break with frequency analysis and **must not** be used for passwords, private messages, authentication, file encryption, or any sensitive information. For real encryption, use a vetted cryptographic library and standard authenticated encryption.
+
+## Installation
+
+After the first PyPI release:
+
+```bash
+python -m pip install networkluki-cipher
+```
+
+From a checked-out repository, for development:
+
+```bash
+python -m pip install -e .
+```
+
+Requires Python 3.10 or newer. The runtime has no third-party dependencies.
+
+## CLI
+
+```bash
+networkluki-cipher show
+networkluki-cipher show-map
+networkluki-cipher enc "Hello, World!"
+networkluki-cipher dec "Oryyz, Mztyc!"
+printf '%s\n' 'Hello' | networkluki-cipher enc
+python -m networkluki_cipher show
+```
+
+`show` prints the plaintext alphabet and substitution alphabet on two lines. `show-map` prints all 26 mappings. `enc` and `dec` accept a single text argument or read standard input. A single unrecognized positional argument is treated as text to decrypt, for compatibility with the original script.
+
+The CLI enforces a 1 MiB UTF-8 input limit; input exceeding it fails with exit code 2. Non-ASCII characters and nonletters are preserved.
+
+The old local command remains available from the repository root:
+
+```bash
+python3 src/crypto.py show
+```
+
+## Python library
+
+```python
+from networkluki_cipher import build_maps, encrypt_text, decrypt_text
+
+enc, dec = build_maps()
+ciphertext = encrypt_text("Hello, World!", enc)
+assert decrypt_text(ciphertext, dec) == "Hello, World!"
+```
+
+`build_maps(cipher=...)` can accept a custom permutation of the 26 ASCII letters for demonstrations. Changing the substitution alphabet **does not** make the cipher secure.
+
+## Development and testing
+
+```bash
+python -m pip install -e .
+python -m unittest discover -s tests -v
+python -m pip install build twine
+python -m build
+python -m twine check --strict dist/*
+```
+
+Release steps and PyPI Trusted Publishing setup: [docs/PUBLISHING.md](docs/PUBLISHING.md).
+
+## Research repository
+
+Other material in this repository covers cryptography-focused research, network-layer concepts, visualizations, and reproducible experiments. Research and production-grade cryptography are separate from the educational cipher package.
+
+For each study, document the problem statement, related work, method, results, limitations, and conclusions. Explicitly record cryptographic assumptions and threat models. Cite relevant RFC, NIST, ISO, or peer-reviewed references. Include the commit hash when citing this repository as a research artifact.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

networkluki_cipher-0.1.0/pyproject.toml

@@ -0,0 +1,36 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "networkluki-cipher"
+version = "0.1.0"
+description = "Educational monoalphabetic substitution cipher library and CLI"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{name = "NetworkLuki"}]
+keywords = ["cipher", "substitution", "education", "cryptography", "cli"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Education",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Education",
+    "Topic :: Security :: Cryptography",
+    "Operating System :: OS Independent",
+]
+
+[project.urls]
+Homepage = "https://github.com/networkluki/cryptography"
+Repository = "https://github.com/networkluki/cryptography"
+Issues = "https://github.com/networkluki/cryptography/issues"
+
+[project.scripts]
+networkluki-cipher = "networkluki_cipher.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["networkluki_cipher*"]
+namespaces = false

networkluki_cipher-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

networkluki_cipher-0.1.0/src/networkluki_cipher/__init__.py

@@ -0,0 +1,25 @@
+"""Educational substitution cipher API (not suitable for protecting secrets)."""
+
+from .cipher import (
+    CIPHER,
+    MAX_STDIN_BYTES,
+    PLAIN,
+    build_maps,
+    check_input_size,
+    decrypt_text,
+    encrypt_text,
+    read_bounded_stdin,
+    validate_key,
+)
+
+__all__ = [
+    "CIPHER",
+    "MAX_STDIN_BYTES",
+    "PLAIN",
+    "build_maps",
+    "check_input_size",
+    "decrypt_text",
+    "encrypt_text",
+    "read_bounded_stdin",
+    "validate_key",
+]

networkluki_cipher-0.1.0/src/networkluki_cipher/__main__.py

@@ -0,0 +1,6 @@
+"""Allow `python -m networkluki_cipher` after installation."""
+
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

networkluki_cipher-0.1.0/src/networkluki_cipher/cipher.py

@@ -0,0 +1,79 @@
+"""Educational monoalphabetic substitution cipher.
+
+This is not secure cryptography. Do not use it for secrets or sensitive data.
+"""
+
+from __future__ import annotations
+
+import string
+from typing import Dict, Mapping, TextIO, Tuple
+
+PLAIN = string.ascii_lowercase
+CIPHER = "PAQCRIXOVEHYJUZGSTKLNFMDBW"
+MAX_STDIN_BYTES = 1_048_576
+
+
+def validate_key(cipher: str) -> None:
+    """Require a permutation of the 26 ASCII letters (case-insensitive)."""
+    if not isinstance(cipher, str):
+        raise ValueError("Cipher key must be a string.")
+    if len(cipher) != 26:
+        raise ValueError("CIPHER must be exactly 26 characters long.")
+    if not cipher.isascii() or not cipher.isalpha():
+        raise ValueError("CIPHER must contain only letters A-Z.")
+    cipher_upper = cipher.upper()
+    if set(cipher_upper) != set(string.ascii_uppercase):
+        raise ValueError("CIPHER must contain each letter A-Z exactly once.")
+
+
+def build_maps(cipher: str = CIPHER) -> Tuple[Dict[str, str], Dict[str, str]]:
+    """Build plaintext-to-cipher and cipher-to-plaintext substitution maps."""
+    validate_key(cipher)
+    cipher_upper = cipher.upper()
+    enc = dict(zip(PLAIN, cipher_upper))
+    dec = {encrypted.lower(): plain for plain, encrypted in enc.items()}
+    return enc, dec
+
+
+def encrypt_text(text: str, enc: Mapping[str, str]) -> str:
+    """Substitute ASCII letters, keeping case and non-ASCII text unchanged."""
+    out: list[str] = []
+    for ch in text:
+        if ch in string.ascii_letters:
+            mapped = enc[ch.lower()]
+            out.append(mapped if ch.isupper() else mapped.lower())
+        else:
+            out.append(ch)
+    return "".join(out)
+
+
+def decrypt_text(text: str, dec: Mapping[str, str]) -> str:
+    """Reverse a substitution, keeping case and non-ASCII text unchanged."""
+    out: list[str] = []
+    for ch in text:
+        if ch in string.ascii_letters:
+            mapped = dec[ch.lower()]
+            out.append(mapped.upper() if ch.isupper() else mapped)
+        else:
+            out.append(ch)
+    return "".join(out)
+
+
+def check_input_size(text: str, limit: int = MAX_STDIN_BYTES) -> str:
+    """Return text after enforcing a UTF-8 byte limit."""
+    if not isinstance(limit, int) or limit < 0:
+        raise ValueError("Input limit must be a nonnegative integer.")
+    try:
+        byte_count = len(text.encode("utf-8"))
+    except UnicodeError as exc:
+        raise ValueError("Input is not valid UTF-8 text.") from exc
+    if byte_count > limit:
+        raise ValueError(f"Input exceeds maximum size of {limit} bytes.")
+    return text
+
+
+def read_bounded_stdin(stdin: TextIO, limit: int = MAX_STDIN_BYTES) -> str:
+    """Read at most limit + 1 characters, then enforce the UTF-8 byte limit."""
+    if not isinstance(limit, int) or limit < 0:
+        raise ValueError("Input limit must be a nonnegative integer.")
+    return check_input_size(stdin.read(limit + 1), limit)

networkluki_cipher-0.1.0/src/networkluki_cipher/cli.py

@@ -0,0 +1,97 @@
+"""Command-line interface for the educational substitution cipher."""
+
+from __future__ import annotations
+
+import argparse
+import string
+import sys
+from collections.abc import Sequence
+
+from .cipher import (
+    CIPHER,
+    MAX_STDIN_BYTES,
+    PLAIN,
+    build_maps,
+    check_input_size,
+    decrypt_text,
+    encrypt_text,
+    read_bounded_stdin,
+    validate_key,
+)
+
+
+def cmd_show() -> int:
+    print(PLAIN)
+    print(CIPHER)
+    return 0
+
+
+def cmd_show_map() -> int:
+    for plain, encrypted in zip(string.ascii_uppercase, CIPHER):
+        print(f"{plain} -> {encrypted}")
+    return 0
+
+
+def main(stdin_limit: int = MAX_STDIN_BYTES, argv: Sequence[str] | None = None) -> int:
+    """Run the CLI and return a process exit status."""
+    try:
+        validate_key(CIPHER)
+    except ValueError as exc:
+        print(f"Key error: {exc}", file=sys.stderr)
+        return 2
+
+    parser = argparse.ArgumentParser(
+        prog="networkluki-cipher",
+        description="Educational monoalphabetic substitution cipher (NOT secure encryption).",
+    )
+    parser.add_argument(
+        "cmd",
+        nargs="?",
+        help="show | show-map | enc | dec; other single values are decrypted",
+    )
+    parser.add_argument(
+        "text",
+        nargs="?",
+        help="Input text; for enc/dec, omit to read stdin",
+    )
+    args = parser.parse_args(argv)
+
+    if args.cmd == "show":
+        if args.text is not None:
+            parser.error("show does not accept a text argument")
+        return cmd_show()
+    if args.cmd == "show-map":
+        if args.text is not None:
+            parser.error("show-map does not accept a text argument")
+        return cmd_show_map()
+
+    enc, dec = build_maps()
+    if args.cmd in ("enc", "dec"):
+        try:
+            data = (
+                check_input_size(args.text, stdin_limit)
+                if args.text is not None
+                else read_bounded_stdin(sys.stdin, stdin_limit)
+            )
+        except (ValueError, UnicodeError, OSError) as exc:
+            print(f"Input error: {exc}", file=sys.stderr)
+            return 2
+        output = encrypt_text(data, enc) if args.cmd == "enc" else decrypt_text(data, dec)
+        print(output)
+        return 0
+
+    if args.cmd is not None and args.text is None:
+        try:
+            data = check_input_size(args.cmd, stdin_limit)
+        except ValueError as exc:
+            print(f"Input error: {exc}", file=sys.stderr)
+            return 2
+        print(decrypt_text(data, dec))
+        return 0
+
+    parser.print_help()
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

networkluki_cipher-0.1.0/src/networkluki_cipher.egg-info/PKG-INFO

@@ -0,0 +1,100 @@
+Metadata-Version: 2.4
+Name: networkluki-cipher
+Version: 0.1.0
+Summary: Educational monoalphabetic substitution cipher library and CLI
+Author: NetworkLuki
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/networkluki/cryptography
+Project-URL: Repository, https://github.com/networkluki/cryptography
+Project-URL: Issues, https://github.com/networkluki/cryptography/issues
+Keywords: cipher,substitution,education,cryptography,cli
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Education
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Education
+Classifier: Topic :: Security :: Cryptography
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# NetworkLuki Cipher
+
+[![CI](https://github.com/networkluki/cryptography/actions/workflows/ci.yml/badge.svg)](https://github.com/networkluki/cryptography/actions/workflows/ci.yml)
+
+An educational monoalphabetic substitution cipher, available as a Python library and command-line application. This project also contains cryptography and network research notes.
+
+> **Security warning:** This is a classical substitution cipher with a fixed default alphabet. It is trivial to break with frequency analysis and **must not** be used for passwords, private messages, authentication, file encryption, or any sensitive information. For real encryption, use a vetted cryptographic library and standard authenticated encryption.
+
+## Installation
+
+After the first PyPI release:
+
+```bash
+python -m pip install networkluki-cipher
+```
+
+From a checked-out repository, for development:
+
+```bash
+python -m pip install -e .
+```
+
+Requires Python 3.10 or newer. The runtime has no third-party dependencies.
+
+## CLI
+
+```bash
+networkluki-cipher show
+networkluki-cipher show-map
+networkluki-cipher enc "Hello, World!"
+networkluki-cipher dec "Oryyz, Mztyc!"
+printf '%s\n' 'Hello' | networkluki-cipher enc
+python -m networkluki_cipher show
+```
+
+`show` prints the plaintext alphabet and substitution alphabet on two lines. `show-map` prints all 26 mappings. `enc` and `dec` accept a single text argument or read standard input. A single unrecognized positional argument is treated as text to decrypt, for compatibility with the original script.
+
+The CLI enforces a 1 MiB UTF-8 input limit; input exceeding it fails with exit code 2. Non-ASCII characters and nonletters are preserved.
+
+The old local command remains available from the repository root:
+
+```bash
+python3 src/crypto.py show
+```
+
+## Python library
+
+```python
+from networkluki_cipher import build_maps, encrypt_text, decrypt_text
+
+enc, dec = build_maps()
+ciphertext = encrypt_text("Hello, World!", enc)
+assert decrypt_text(ciphertext, dec) == "Hello, World!"
+```
+
+`build_maps(cipher=...)` can accept a custom permutation of the 26 ASCII letters for demonstrations. Changing the substitution alphabet **does not** make the cipher secure.
+
+## Development and testing
+
+```bash
+python -m pip install -e .
+python -m unittest discover -s tests -v
+python -m pip install build twine
+python -m build
+python -m twine check --strict dist/*
+```
+
+Release steps and PyPI Trusted Publishing setup: [docs/PUBLISHING.md](docs/PUBLISHING.md).
+
+## Research repository
+
+Other material in this repository covers cryptography-focused research, network-layer concepts, visualizations, and reproducible experiments. Research and production-grade cryptography are separate from the educational cipher package.
+
+For each study, document the problem statement, related work, method, results, limitations, and conclusions. Explicitly record cryptographic assumptions and threat models. Cite relevant RFC, NIST, ISO, or peer-reviewed references. Include the commit hash when citing this repository as a research artifact.
+
+## License
+
+MIT. See [LICENSE](LICENSE).

networkluki_cipher-0.1.0/src/networkluki_cipher.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+LICENSE
+README.md
+pyproject.toml
+src/networkluki_cipher/__init__.py
+src/networkluki_cipher/__main__.py
+src/networkluki_cipher/cipher.py
+src/networkluki_cipher/cli.py
+src/networkluki_cipher.egg-info/PKG-INFO
+src/networkluki_cipher.egg-info/SOURCES.txt
+src/networkluki_cipher.egg-info/dependency_links.txt
+src/networkluki_cipher.egg-info/entry_points.txt
+src/networkluki_cipher.egg-info/top_level.txt
+tests/test_crypto.py

networkluki_cipher-0.1.0/src/networkluki_cipher.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

networkluki_cipher-0.1.0/src/networkluki_cipher.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+networkluki-cipher = networkluki_cipher.cli:main

networkluki_cipher-0.1.0/src/networkluki_cipher.egg-info/top_level.txt

@@ -0,0 +1 @@
+networkluki_cipher

networkluki_cipher-0.1.0/tests/test_crypto.py

@@ -0,0 +1,94 @@
+"""Unit and regression tests for the public API and command-line interface."""
+
+import io
+import unittest
+from contextlib import redirect_stdout
+from unittest.mock import patch
+
+from networkluki_cipher import (
+    CIPHER,
+    build_maps,
+    decrypt_text,
+    encrypt_text,
+    read_bounded_stdin,
+    validate_key,
+)
+from networkluki_cipher.cli import main
+
+
+class CipherTests(unittest.TestCase):
+    def test_default_key_is_a_valid_permutation(self):
+        validate_key(CIPHER)
+
+    def test_validate_key_rejects_duplicate_letters(self):
+        with self.assertRaisesRegex(ValueError, "exactly once"):
+            validate_key("A" * 26)
+
+    def test_validate_key_rejects_non_ascii_letters(self):
+        with self.assertRaisesRegex(ValueError, "only letters A-Z"):
+            validate_key("ABCDEFGHIJKLMNOPQRSTUVWXYÅ")
+
+    def test_validate_key_rejects_wrong_type(self):
+        with self.assertRaises(ValueError):
+            validate_key(None)
+
+    def test_build_maps_accepts_custom_permutation(self):
+        enc, dec = build_maps("ZYXWVUTSRQPONMLKJIHGFEDCBA")
+        self.assertEqual(encrypt_text("Abc", enc), "Zyx")
+        self.assertEqual(decrypt_text("Zyx", dec), "Abc")
+
+    def test_roundtrip_preserves_case_unicode_and_symbols(self):
+        enc, dec = build_maps()
+        original = "Hello, World! 123 åäö🛡️"
+        self.assertEqual(decrypt_text(encrypt_text(original, enc), dec), original)
+
+    def test_non_letters_unchanged(self):
+        enc, dec = build_maps()
+        original = "123-_=+åßé"
+        self.assertEqual(encrypt_text(original, enc), original)
+        self.assertEqual(decrypt_text(original, dec), original)
+
+    def test_read_bounded_stdin_rejects_oversized_text(self):
+        with self.assertRaisesRegex(ValueError, "maximum size"):
+            read_bounded_stdin(io.StringIO("abcd"), limit=3)
+
+    def test_read_bounded_stdin_counts_utf8_bytes(self):
+        with self.assertRaisesRegex(ValueError, "maximum size"):
+            read_bounded_stdin(io.StringIO("å"), limit=1)
+
+    def test_main_rejects_oversized_stdin(self):
+        with (
+            patch("sys.stdin", io.StringIO("abcd")),
+            patch("sys.stderr", new_callable=io.StringIO) as stderr,
+        ):
+            self.assertEqual(main(stdin_limit=3, argv=["enc"]), 2)
+            self.assertIn("maximum size of 3 bytes", stderr.getvalue())
+
+    def test_main_rejects_oversized_argument(self):
+        with patch("sys.stderr", new_callable=io.StringIO) as stderr:
+            self.assertEqual(main(stdin_limit=3, argv=["enc", "abcd"]), 2)
+            self.assertIn("maximum size of 3 bytes", stderr.getvalue())
+
+    def test_cli_show_produces_exactly_two_lines(self):
+        stdout = io.StringIO()
+        with redirect_stdout(stdout):
+            self.assertEqual(main(argv=["show"]), 0)
+        self.assertEqual(stdout.getvalue().splitlines(), ["abcdefghijklmnopqrstuvwxyz", CIPHER])
+
+    def test_cli_show_map_produces_26_lines(self):
+        stdout = io.StringIO()
+        with redirect_stdout(stdout):
+            self.assertEqual(main(argv=["show-map"]), 0)
+        self.assertEqual(len(stdout.getvalue().splitlines()), 26)
+
+    def test_cli_implicit_decrypt(self):
+        enc, _ = build_maps()
+        encrypted = encrypt_text("Hello", enc)
+        stdout = io.StringIO()
+        with redirect_stdout(stdout):
+            self.assertEqual(main(argv=[encrypted]), 0)
+        self.assertEqual(stdout.getvalue(), "Hello\n")
+
+
+if __name__ == "__main__":
+    unittest.main()