feat: add passphrase-encrypted export and import

README.md

@@ -99,6 +99,28 @@ manifest can call the config plugin instead, which adds the same entries:
 }
 ```
 
+## Encrypted export
+
+`encryptExport` turns an app-defined JSON payload into an
+[age](https://age-encryption.org) file encrypted to a passphrase, so a backup can
+be moved between devices by any means. `decryptExport` opens files that this
+library or `age -p -a` produced. Both run the scrypt key derivation in the Rust
+core on a native worker, off the JavaScript thread.
+
+```ts
+const file = await encryptExport(JSON.stringify(backup), passphrase);
+await FileSystem.writeAsStringAsync(path, file);
+
+const backup = JSON.parse(await decryptExport(await readAsStringAsync(path), passphrase));
+```
+
+Rejections carry a `code`:
+
+| `code` | Cause |
+| --- | --- |
+| `WrongPassphrase` | The passphrase does not open the file. |
+| `InvalidExport` | The payload exceeds 16 MiB, the passphrase is shorter than 8 characters when encrypting, or the input is not an intact age file. |
+
 ## License
 
 Apache-2.0. See [LICENSE](./LICENSE).

android/src/main/java/ai/kilo/reactnativessh/ReactNativeSshModule.kt

@@ -18,6 +18,8 @@ import ai.kilo.reactnativessh.uniffi.SshSession
 import ai.kilo.reactnativessh.uniffi.TransferProgress
 import ai.kilo.reactnativessh.uniffi.categoryIsRetryable
 import ai.kilo.reactnativessh.uniffi.coreVersion
+import ai.kilo.reactnativessh.uniffi.decryptExport
+import ai.kilo.reactnativessh.uniffi.encryptExport
 import ai.kilo.reactnativessh.uniffi.generateEd25519Key
 import ai.kilo.reactnativessh.uniffi.parsePrivateKey
 import android.content.Context
@@ -92,6 +94,14 @@ class ReactNativeSshModule : Module() {
       )
     }
 
+    AsyncFunction("encryptExport") { plaintextJson: String, passphrase: String ->
+      translateFailures { encryptExport(plaintextJson, passphrase) }
+    }
+
+    AsyncFunction("decryptExport") { armored: String, passphrase: String ->
+      translateFailures { decryptExport(armored, passphrase) }
+    }
+
     AsyncFunction("connect").SuspendBody { config: ConnectConfigRecord ->
       connectSession(config) { handler -> SshSession.connect(config.toNative(), handler) }
     }

android/src/main/java/ai/kilo/reactnativessh/SshErrors.kt

@@ -22,6 +22,7 @@ private fun SshException.code(): String = when (this) {
   is SshException.UnsupportedAlgorithm -> "UnsupportedAlgorithm"
   is SshException.KeyParse -> "KeyParse"
   is SshException.WrongPassphrase -> "WrongPassphrase"
+  is SshException.InvalidExport -> "InvalidExport"
   is SshException.ChannelClosed -> "ChannelClosed"
   is SshException.Protocol -> "Protocol"
   is SshException.KeyGeneration -> "KeyGeneration"

ios/ReactNativeSshModule.swift

@@ -41,6 +41,14 @@ public final class ReactNativeSshModule: Module {
       )
     }
 
+    AsyncFunction("encryptExport") { (plaintextJson: String, passphrase: String) throws -> String in
+      try translate { try encryptExport(plaintextJson: plaintextJson, passphrase: passphrase) }
+    }
+
+    AsyncFunction("decryptExport") { (armored: String, passphrase: String) throws -> String in
+      try translate { try decryptExport(armored: armored, passphrase: passphrase) }
+    }
+
     AsyncFunction("connect") { (config: ConnectConfigRecord) async throws -> String in
       try await self.connectSession(config)
     }

ios/SshErrors.swift

@@ -25,6 +25,8 @@ extension SshError {
       return "KeyParse"
     case .WrongPassphrase:
       return "WrongPassphrase"
+    case .InvalidExport:
+      return "InvalidExport"
     case .ChannelClosed:
       return "ChannelClosed"
     case .Protocol:
@@ -51,6 +53,7 @@ extension SshError {
       .AuthFailed(let message),
       .UnsupportedAlgorithm(let message),
       .KeyParse(let message),
+      .InvalidExport(let message),
       .ChannelClosed(let message),
       .Protocol(let message),
       .KeyGeneration(let message),