CLI Reference

CLI Reference

The bin/ directory contains operational and security tooling for local development and release management.

Package operations

Encrypt a directory

php bin/encrypt-directory.php <source-dir> <output-dir> <password>

This creates a V14 package directory using the package builder.

Decrypt a package

php bin/decrypt-package.php <package-dir-or-spkg14> <output-dir> <password> [recovery-key]

The command accepts either a package directory or a portable .spkg14 package.

Runtime and security checks

Self-check

php bin/self-check.php

Checks the required runtime features:

• PHP >= 8.2
• Sodium
• random_bytes()
• Argon2id13 support
• Zip

Security suite

Fast/default security suite:

php bin/security-test.php

Full regression suite:

php bin/security-test.php --full

The full mode discovers tests/*Test.php and runs the complete PHP regression set.

Source audit

php bin/source-audit.php

Checks the active source tree for selected patterns such as legacy branding, dangerous process-execution calls, and embedded private-key markers.

This is a targeted source policy check, not a substitute for code review.

Source inventory

php bin/source-inventory.php [project-root]

Produces an inventory of source material useful during release review.

Package maintenance

Cleanup

php bin/cleanup.php

Removes expired/temporary runtime material according to the application storage policies implemented by the cleanup helper.

Compact packages

php bin/compact-packages.php

Supports package storage cleanup/compaction. The script accepts:

--dry-run

for non-destructive inspection.

Benchmarking

php bin/benchmark.php

Provides local performance measurements for the encryption/decryption engine. Benchmark output should not be interpreted as a security guarantee.

Release signing

Generate a release key pair through:

php bin/generate-release-key.php

The private key must be stored outside the repository and outside the public web root.

Sign the active source tree with:

php bin/sign-release.php <private-key-hex-file> <project-root>

The script signs a canonical manifest covering:

app/
bin/
config/
public/
bootstrap.php
composer.json
composer.lock (when present)
VERSION

Runtime-generated release/storage material is excluded from the signed source scope.

Release verification

Verify a release with:

php bin/verify-release.php <release-root>

For an external trust root:

export SECURE_PACKAGE_TRUSTED_RELEASE_KEY_HEX='<64-hex-public-key>'
php bin/verify-release.php <release-root>

The verifier checks:

1. the release manifest exists;
2. the signature is valid;
3. the package/format/version identity is correct;
4. the manifest is canonical;
5. every listed source file exists;
6. every listed SHA-256 digest matches;
7. the embedded public key matches the pinned external trust root when one is supplied.

Secret generation

Generate a high-entropy application secret:

php bin/generate-secret.php

The default length is suitable for local secret generation, and the script allows a bounded length argument.

Operational guidance

Do not place production passwords, patterns, recovery keys, or release private keys directly in command history when avoidable. Prefer protected secret files, environment injection, or a controlled secret manager.