npm package: @orbiter-finance/keytool
Description: Private key AES encryption/decryption CLI
Latest version: 2.3.0

# Keytool — Secure AES Key Encryption & TLS Injection CLI Tool

## Overview

`keytool` is a TypeScript-based CLI utility for managing encrypted secrets, such as private keys, and securely injecting them into applications via a TLS channel. It provides the following features:

- AES-256-CBC encryption/decryption of key-value pairs (e.g. private keys)
- Secure TLS server to receive and manage secrets
- CLI-based injector client that pushes secrets over TLS
- Heartbeat mechanism to ensure secrets are fresh and connection is alive
- Self-signed certificate generation tool

---

## Project Structure

```
.
├── src/
│   ├── cli.ts
│   ├── crypto/
│   │   ├── encrypt.ts
│   │   ├── decrypt.ts
│   ├── commands/
│   │   ├── inject.ts
│   │   ├── serve.ts
│   │   └── generateCert.ts
│   ├── utils/
│       └── crypto.ts
├── makers.json               # Input plain-text key-value file
├── makers.encrypted.json     # Encrypted output file
├── package.json
├── tsconfig.json
├── README.md
```

---

## Installation

Install dependencies:

```bash
npm install
```

Build the project:

```bash
npm run build
```

You can run it directly via `npx` or install globally:

```bash
npx orbiter-keytool <command>
```

---

## CLI Usage

### Command format

```bash
npx orbiter-keytool <command> [options]
```

### Available Commands

| Command           | Description                                  |
|------------------|----------------------------------------------|
| `encrypt`         | Encrypt key-value pairs from JSON            |
| `decrypt`         | Decrypt key-value pairs from encrypted JSON  |
| `inject`          | Inject encrypted secrets over TLS with heartbeat |
| `serve`           | Start a secure server to receive secrets     |
| `generate-cert`   | Generate a self-signed TLS certificate       |

---

## Commands & Examples

### 🔐 `encrypt`

Encrypts a key-value JSON file using AES-256-CBC.

```bash
npx orbiter-keytool encrypt --key "yourMasterKey" --input makers.json --output makers.encrypted.json
```

### 🔓 `decrypt`

Decrypts an encrypted key-value JSON file.

```bash
npx orbiter-keytool decrypt --key "yourMasterKey" --input makers.encrypted.json
```

### 🚀 `inject`

Continuously sends keys from `.env` to the server with heartbeat monitoring.

```bash
npx orbiter-keytool inject --cert ./cert.pem --token yourToken --env .env --interval 30
```

`.env` file format:

```
0xabc...=privatekey1
0xdef...=privatekey2
```

### 🛡️ `serve`

Starts a TLS server and receives keys from injectors.

```bash
npx orbiter-keytool serve --cert ./cert.pem --key ./key.pem --token yourToken --port 8000 --timeout 90
```

- `token` must match between server and injector.
- `timeout` is the heartbeat inactivity timeout (seconds).

### 🔧 `generate-cert`

Generates a self-signed TLS cert for testing or internal use.

```bash
npx orbiter-keytool generate-cert --out ./certs --common-name localhost
```

---

## JSON Formats

### makers.json

```json
{
    "0xabc...": "privatekey1",
    "0xdef...": "privatekey2"
}
```

### makers.encrypted.json

```json
{
    "0xabc...": "iv_hex:encrypted_data_hex",
    "0xdef...": "iv_hex:encrypted_data_hex"
}
```

---

## Security Notes

- Avoid passing secrets via CLI directly to prevent exposure via shell history.
- Use `.env` files or prompt-based entry where possible.
- TLS is mandatory for key injection to ensure end-to-end encryption.
- Make sure your TLS certs are secured and not exposed.

---

## Development

To build the project:

```bash
npm run build
```

To publish to npm:

- Ensure `package.json` includes `files` or `.npmignore`
- Run:

```bash
npm login
npm publish --access public
```

---

## License

MIT License

---

## Contact

- GitHub: [https://github.com/orgs/Orbiter-Finance](https://github.com/orgs/Orbiter-Finance)
- Email: techsupport@orbiter.finance