Function encrypt

tools/credential-tools.mjs:58–127

()

}

function encrypt() {
  if (!existsSync(PLAINTEXT_PATH)) {
    console.error(
      `Missing ${PLAINTEXT_PATH}. Create it with the multi-provider schema (e.g. { "twitter": { "accounts": [...] } }).`
    );
    process.exit(1);
  }

  const plaintext = readFileSync(PLAINTEXT_PATH, 'utf-8');
  const parsed = JSON.parse(plaintext);
  const hasTwitter = Array.isArray(parsed?.twitter?.accounts) && parsed.twitter.accounts.length > 0;
  const hasBluesky = Array.isArray(parsed?.bluesky?.accounts) && parsed.bluesky.accounts.length > 0;
  if (!hasTwitter && !hasBluesky) {
    console.error(
      'credentials.json must include a non-empty twitter.accounts and/or bluesky.accounts array (see credentials.example.json).'
    );
    process.exit(1);
  }
  if (hasBluesky) {
    const bskyFields = ['identifier', 'appPassword', 'service'];
    for (let i = 0; i < parsed.bluesky.accounts.length; i++) {
      const cred = parsed.bluesky.accounts[i];
      const id = `bluesky.accounts[${i}]`;
      if (cred === null || typeof cred !== 'object' || Array.isArray(cred)) {
        console.error(`${id}: each account must be a plain object`);
        process.exit(1);
      }
      for (const field of bskyFields) {
        const v = cred[field];
        if (typeof v !== 'string' || v.length === 0) {
          console.error(`${id}: "${field}" must be a non-empty string`);
          process.exit(1);
        }
      }
    }
  }

  let keyB64url;
  if (existsSync(KEY_PATH)) {
    keyB64url = readFileSync(KEY_PATH, 'utf-8').trim();
  } else {
    const rawKey = randomBytes(32);
    keyB64url = rawKey.toString('base64url');
    writeFileSync(KEY_PATH, keyB64url + '\n', 'utf-8');
    console.log('\nNew encryption key written to .credential-key');
    console.log('Set Worker secret: wrangler secret put CREDENTIAL_KEY');
    console.log('Paste this value (base64url, one line):\n');
    console.log(keyB64url);
    console.log('');
  }

  const key = base64UrlToBuffer(keyB64url);
  if (key.length !== 32) {
    console.error('.credential-key must decode to 32 bytes (AES-256). Use base64url.');
    process.exit(1);
  }

  const iv = randomBytes(12);