From a6bad4bb3ee1f738b2a8cabe809f0d47f474f306 Mon Sep 17 00:00:00 2001
From: adlee-was-taken <aaron.daniel.lee@gmail.com>
Date: Mon, 20 Apr 2026 17:30:56 -0400
Subject: [PATCH] feat(cli): relicario generate delegates to core (audit H6)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CLI no longer has its own charset-sampling path — uses the CSPRNG
generate_password / generate_passphrase in relicario-core, which use
rand::distributions::Uniform internally.
---
 crates/relicario-cli/src/main.rs | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/crates/relicario-cli/src/main.rs b/crates/relicario-cli/src/main.rs
index 9cd29a4..5dcb728 100644
--- a/crates/relicario-cli/src/main.rs
+++ b/crates/relicario-cli/src/main.rs
@@ -1173,7 +1173,34 @@ fn cmd_extract(query: String, aid: String, out: Option<PathBuf>) -> Result<()> {
     eprintln!("Wrote {} bytes to {}", plaintext.len(), out_path.display());
     Ok(())
 }
-fn cmd_generate(_l: u32, _b: bool, _w: u32, _s: String, _sep: String) -> Result<()> { bail!("not yet implemented"); }
+fn cmd_generate(length: u32, bip39: bool, words: u32, symbols: String, separator: String) -> Result<()> {
+    use relicario_core::{
+        generate_passphrase, generate_password, Capitalization, CharClasses,
+        GeneratorRequest, SymbolCharset,
+    };
+
+    let output = if bip39 {
+        generate_passphrase(&GeneratorRequest::Bip39 {
+            word_count: words,
+            separator,
+            capitalization: Capitalization::Lower,
+        })?
+    } else {
+        let symbol_charset = match symbols.as_str() {
+            "safe" => SymbolCharset::SafeOnly,
+            "extended" => SymbolCharset::Extended,
+            other => SymbolCharset::Custom(other.to_string()),
+        };
+        generate_password(&GeneratorRequest::Random {
+            length,
+            classes: CharClasses { lower: true, upper: true, digits: true, symbols: true },
+            symbol_charset,
+        })?
+    };
+
+    println!("{}", output.as_str());
+    Ok(())
+}
 fn cmd_settings(_a: SettingsAction) -> Result<()> { bail!("not yet implemented"); }
 fn cmd_sync() -> Result<()> { bail!("not yet implemented"); }
 fn cmd_device(_a: DeviceAction) -> Result<()> { bail!("not yet implemented"); }