ymohammed006/cxf-kit

cxf-kit is a TypeScript toolkit for working with a data format called the FIDO Credential Exchange Format, or CXF. This is a standardized way for password managers and similar tools to export and import saved logins, passkeys, credit cards, and other stored credentials so people can move their data between different apps without losing information. The kit provides code to read this format, write it back out, check whether a given file follows the rules correctly, and a command line tool for doing the same from a terminal. The library can read a CXF file whether it arrives as plain JSON text, JSON bytes, or a ZIP archive, and it deliberately preserves anything it does not recognize rather than silently dropping it, since future versions of the format may add new credential types the tool was not built to fully understand. A validator then checks the parsed data against the official rules and reports any problems as structured warnings or errors, each with a stable code, so other tools can react to specific issues programmatically. A core guarantee of the project is that reading a file and then writing it back out produces an equivalent result every time, even for unusual or slightly broken input, so the tool can be trusted not to quietly change or lose data during a round trip. The included command line tool offers a validate command and an inspect command. The inspect command intentionally only prints structural information, like credential types and counts, and never prints sensitive values such as passwords or card numbers, with no way to override this behavior. Because CXF files can come from untrusted sources, the toolkit includes defenses against maliciously crafted archives, such as limits on how much a ZIP file can decompress to and strict checks that prevent file paths inside an archive from escaping their intended folder. It requires Node.js 18 or newer and has one runtime dependency for handling ZIP archives.