Metadata-Version: 2.4
Name: prometheus-crypto
Version: 2.0.0
Summary: World-class CLI for symmetric encryption of secrets - legacy v1 compatible, modern v2 secure
Project-URL: Homepage, https://github.com/Kemquiros/Prometheus
Project-URL: Documentation, https://kemquiros.github.io/Prometheus/
Project-URL: Repository, https://github.com/Kemquiros/Prometheus
Project-URL: Issues, https://github.com/Kemquiros/Prometheus/issues
License: MIT
License-File: LICENSE.md
Classifier: Development Status :: 4 - Beta
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security :: Cryptography
Classifier: Topic :: Utilities
Requires-Python: >=3.10
Requires-Dist: keyring>=25.0
Requires-Dist: platformdirs>=4.2
Requires-Dist: pydantic-settings>=2.3
Requires-Dist: pydantic>=2.7
Requires-Dist: pyyaml>=6.0
Requires-Dist: rich>=13.7
Requires-Dist: tomli-w>=1.0
Requires-Dist: typer[all]>=0.12
Requires-Dist: typing-extensions>=4.6
Provides-Extra: crypto
Requires-Dist: argon2-cffi>=23.1; extra == 'crypto'
Requires-Dist: cryptography>=42.0; extra == 'crypto'
Provides-Extra: dev
Requires-Dist: bandit>=1.7; extra == 'dev'
Requires-Dist: codespell>=2.4; extra == 'dev'
Requires-Dist: hypothesis>=6.92; extra == 'dev'
Requires-Dist: mutmut>=2.4; extra == 'dev'
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pip-audit>=2.7; extra == 'dev'
Requires-Dist: pre-commit>=3.7; extra == 'dev'
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
Requires-Dist: pytest-mock>=3.14; extra == 'dev'
Requires-Dist: pytest-xdist>=3.5; extra == 'dev'
Requires-Dist: pytest>=8.2; extra == 'dev'
Requires-Dist: ruff>=0.5; extra == 'dev'
Description-Content-Type: text/markdown

# Prometheus

[![CI](https://github.com/Kemquiros/Prometheus/actions/workflows/ci.yml/badge.svg)](https://github.com/Kemquiros/Prometheus/actions)
[![Python](https://img.shields.io/pypi/pyversions/prometheus-crypto)](https://pypi.org/project/prometheus-crypto/)
[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE.md)

World-class CLI for symmetric encryption of secrets. Legacy v1 compatible, modern v2 secure.

## Features

- **Crypto v2 (recommended):** ChaCha20-Poly1305 + Argon2id — authenticated encryption with forward secrecy
- **Crypto v1 (legacy):** XOR + SHA-256 + Base64 — backward compatible, NOT recommended for new encryption
- **Auto-detect:** Automatically detects algorithm version from ciphertext format
- **Interactive mode:** Guided prompts for encrypt/decrypt operations
- **Multiple output formats:** Human-readable panels, JSON, quiet mode

## Install

```bash
pip install prometheus-crypto
```

Or with optional Argon2id support (recommended):

```bash
pip install "prometheus-crypto[crypto]"
```

## Quick Start

### Encrypt

```bash
# Interactive mode
prometheus encrypt --secret "my-secret-key" --plaintext "password123"

# JSON output
prometheus encrypt --secret "my-secret-key" --plaintext "password123" --format json

# Quiet output (just the ciphertext)
prometheus encrypt --secret "my-secret-key" --plaintext "password123" --format quiet

# Force v1 legacy algorithm
prometheus encrypt --secret "my-secret-key" --plaintext "password123" --algo v1
```

### Decrypt

```bash
# Auto-detect version from ciphertext
prometheus decrypt --secret "my-secret-key" --ciphertext "v2|salt|nonce|ct|tag"

# JSON output
prometheus decrypt --secret "my-secret-key" --ciphertext "v2|salt|nonce|ct|tag" --format json
```

### Interactive Mode

```bash
prometheus interactive
```

```
Choose operation:
  (e) Encrypt
  (d) Decrypt
  (v) Show version
  (f) Finish
>> e
Secret: my-secret-key
Password: password123
┌─────────────── Encrypted ───────────────┐
│ v2|...                                  │
└──────────────── algorithm: v2 ──────────┘
```

### Version & Info

```bash
prometheus version    # Algorithm info
prometheus info       # Full architecture details
```

## Architecture

```
src/prometheus/
├── domain/          # Core business logic (no dependencies)
│   ├── entities.py  # Profile, GlobalConfig
│   ├── value_objects.py  # SecretKey, Plaintext, Ciphertext
│   ├── ports.py     # CryptoPort, ConfigPort, StoragePort, OutputPort
│   └── events.py    # Domain events
├── cipher/          # Crypto adapters
│   ├── v1_legacy/   # XOR + SHA-256 + Base64 (INMUTABLE)
│   ├── v2_modern/   # ChaCha20-Poly1305 + Argon2id
│   └── factory.py   # Auto-detect version, adapter selection
├── cli/             # Typer + Rich CLI
│   └── app.py       # encrypt, decrypt, interactive, version, info
└── adapters/        # Future: storage, config, keyring adapters
```

Hexagonal architecture (Ports & Adapters):
- **Domain** is pure business logic with zero I/O dependencies
- **Ports** define interfaces (CryptoPort, ConfigPort, StoragePort, OutputPort)
- **Adapters** implement those interfaces for concrete technologies

## Security

### v2 (Recommended)

- **Key derivation:** Argon2id (OWASP 2024: 3 iterations, 64MB memory, 4 parallelism)
- **Fallback:** PBKDF2-SHA256 (600k iterations) if argon2-cffi is not installed
- **Encryption:** ChaCha20-Poly1305 AEAD (12-byte nonce, 16-byte tag)
- **Forward secrecy:** Random salt + nonce per encryption
- **Format:** `v2|salt_b64|nonce_b64|ciphertext_b64|tag_b64`

### v1 (Legacy)

- **NOT cryptographically secure**
- XOR + SHA-256 + Base64/latin1 encoding
- Retained solely for backward compatibility with existing v1 ciphertexts
- **Do not use for new encryption** — use v2 instead

## Development

### Setup

```bash
git clone https://github.com/Kemquiros/Prometheus.git
cd Prometheus
python -m venv .venv
source .venv/bin/activate
pip install -e ".[crypto,dev]"
```

### Quality

```bash
ruff check src/ tests/         # Lint
mypy src/prometheus/ --strict  # Type check
pytest tests/ -v               # Tests
```

### Test Coverage

```bash
pytest tests/ --cov=prometheus --cov-report=term-missing
```

Coverage threshold: 90% (enforced in CI).

## License

MIT — see [LICENSE.md](LICENSE.md)
