@umbra-privacy/qos-ceremony 0.1.0 → 0.1.2

package/README.md

@@ -11,7 +11,7 @@ at it.
 ## Install
 
 ```bash
-npm i -g @umbra-privacy/qos-ceremony      # provides the `ceremony` command
+npm i -g @umbra-privacy/qos-ceremony      # provides the `qos-ceremony` command
 ```
 
 ## Use
@@ -21,25 +21,25 @@ export CEREMONY_API=https://<coordinator>/ \
        CEREMONY_NAMESPACE=<service> CEREMONY_NONCE=<nonce> \
        CEREMONY_ALIAS=p1 CEREMONY_SECRET=/path/to/p1.secret
 
-ceremony keygen                # once, offline — generate your key; give the pubkey to an admin
-ceremony share                 # shareSet: derive + upload your (encrypted) genesis share
-ceremony approve --yes         # manifestSet: review + sign the manifest (verify the pivot hash!)
-ceremony provision             # shareSet: re-encrypt your share to the enclave's ephemeral key
-ceremony status                # read-only phase + blockers
+qos-ceremony keygen                # once, offline — generate your key; give the pubkey to an admin
+qos-ceremony share                 # shareSet: derive + upload your (encrypted) genesis share
+qos-ceremony approve --yes         # manifestSet: review + sign the manifest (verify the pivot hash!)
+qos-ceremony provision             # shareSet: re-encrypt your share to the enclave's ephemeral key
+qos-ceremony status                # read-only phase + blockers
 ```
 
-`shift-traffic` (ops, needs AWS creds): `ceremony shift-traffic --service arith --stack <s> --weights '{"<old>":0,"<new>":100}'`.
+`shift-traffic` (ops, needs AWS creds): `qos-ceremony shift-traffic --service arith --stack <s> --weights '{"<old>":0,"<new>":100}'`.
 
 ## Commands
 
-| Command | Set | What |
-|---|---|---|
-| `keygen` | any | generate seed (local) + print pubkey to register |
-| `share` | shareSet | derive quorum-key share from genesis; upload (ciphertext) |
-| `approve` | manifestSet | review + sign the manifest |
-| `provision` | shareSet | re-encrypt share to the enclave ephemeral key; post it |
-| `status` | — | read-only phase + blockers |
-| `shift-traffic` | ops | blue-green weighted ALB cutover across a service's colors |
+| Command         | Set         | What                                                      |
+| --------------- | ----------- | --------------------------------------------------------- |
+| `keygen`        | any         | generate seed (local) + print pubkey to register          |
+| `share`         | shareSet    | derive quorum-key share from genesis; upload (ciphertext) |
+| `approve`       | manifestSet | review + sign the manifest                                |
+| `provision`     | shareSet    | re-encrypt share to the enclave ephemeral key; post it    |
+| `status`        | —           | read-only phase + blockers                                |
+| `shift-traffic` | ops         | blue-green weighted ALB cutover across a service's colors |
 
 Flags mirror env: `--api --namespace --nonce --alias --secret-path --yubikey
 --pcr3-preimage-path --qos-release-dir --qos-client`.

package/dist-cli/cli.js

@@ -32720,11 +32720,14 @@ var QosClient = class {
 
 // ../qos-core/src/state.ts
 function allMembers(sets) {
-  return Array.from(/* @__PURE__ */ new Set([...sets.manifest.members, ...sets.share.members, ...sets.patch.members]));
+  return Array.from(
+    /* @__PURE__ */ new Set([...sets.manifest.members, ...sets.share.members, ...sets.patch.members])
+  );
 }
 function blockers(s) {
   const out = [];
-  if (s.dr_blocker) out.push(`DR: ${s.dr_blocker.reason} (since ${s.dr_blocker.since}) \u2014 share set must re-post`);
+  if (s.dr_blocker)
+    out.push(`DR: ${s.dr_blocker.reason} (since ${s.dr_blocker.since}) \u2014 share set must re-post`);
   switch (s.phase) {
     case "Init":
     case "CollectingPubkeys": {
@@ -32735,7 +32738,8 @@ function blockers(s) {
     }
     case "GenesisBooted": {
       const need = s.sets.share.members.filter((m3) => !s.shares_derived.includes(m3));
-      if (need.length) out.push(`waiting for shareSet members to derive+upload shares: ${need.join(", ")}`);
+      if (need.length)
+        out.push(`waiting for shareSet members to derive+upload shares: ${need.join(", ")}`);
       else out.push("all shares derived \u2014 coordinator will generate the manifest on next advance");
       break;
     }
@@ -32743,16 +32747,24 @@ function blockers(s) {
     case "CollectingApprovals": {
       const have = s.approvals.length;
       const need = s.sets.manifest.threshold - have;
-      if (need > 0) out.push(`waiting for ${need} more manifestSet approval(s) (have ${have}/${s.sets.manifest.threshold})`);
+      if (need > 0)
+        out.push(
+          `waiting for ${need} more manifestSet approval(s) (have ${have}/${s.sets.manifest.threshold})`
+        );
       else if (s.mode === "forward")
-        out.push(`approval threshold met \u2014 coordinator will key-forward Q from ${s.source_cluster} on next advance`);
+        out.push(
+          `approval threshold met \u2014 coordinator will key-forward Q from ${s.source_cluster} on next advance`
+        );
       else out.push("approval threshold met \u2014 coordinator will boot-standard on next advance");
       break;
     }
     case "Booted":
     case "CollectingShares": {
       const need = s.sets.share.threshold - s.shares_posted;
-      if (need > 0) out.push(`waiting for ${need} more provisioned share(s) (have ${s.shares_posted}/${s.sets.share.threshold})`);
+      if (need > 0)
+        out.push(
+          `waiting for ${need} more provisioned share(s) (have ${s.shares_posted}/${s.sets.share.threshold})`
+        );
       else out.push("share threshold met \u2014 enclave reconstructing quorum key");
       break;
     }
@@ -32859,7 +32871,14 @@ var CeremonyApi = class {
     const wd = new Workdir("ceremony-sign-");
     try {
       const ts = Date.now();
-      const canonical = buildSignedPayload({ alias: signer.alias, namespace: ns, nonce, route, ts, artifact });
+      const canonical = buildSignedPayload({
+        alias: signer.alias,
+        namespace: ns,
+        nonce,
+        route,
+        ts,
+        artifact
+      });
       const payloadPath = wd.writeText("payload.json", canonical);
       const sigPath = wd.path("payload.sig");
       if (signer.secret.yubikey) {
@@ -32879,15 +32898,36 @@ var CeremonyApi = class {
     }
   }
   async putPubkey(ns, nonce, alias, pubkeyHex, signer) {
-    const r5 = await this.signedRequest("POST", ns, nonce, "pubkey", { pubkey: pubkeyHex }, { alias, ...signer });
+    const r5 = await this.signedRequest(
+      "POST",
+      ns,
+      nonce,
+      "pubkey",
+      { pubkey: pubkeyHex },
+      { alias, ...signer }
+    );
     if (!r5.ok) throw new Error(`putPubkey: ${r5.status} ${await r5.text()}`);
   }
   async putShare(ns, nonce, alias, shareB64, signer) {
-    const r5 = await this.signedRequest("PUT", ns, nonce, "share", { share: shareB64 }, { alias, ...signer });
+    const r5 = await this.signedRequest(
+      "PUT",
+      ns,
+      nonce,
+      "share",
+      { share: shareB64 },
+      { alias, ...signer }
+    );
     if (!r5.ok) throw new Error(`putShare: ${r5.status} ${await r5.text()}`);
   }
   async postApproval(ns, nonce, alias, approvalB64, signer) {
-    const r5 = await this.signedRequest("POST", ns, nonce, "approval", { approval: approvalB64 }, { alias, ...signer });
+    const r5 = await this.signedRequest(
+      "POST",
+      ns,
+      nonce,
+      "approval",
+      { approval: approvalB64 },
+      { alias, ...signer }
+    );
     if (!r5.ok) throw new Error(`postApproval: ${r5.status} ${await r5.text()}`);
   }
   async postEphShare(ns, nonce, alias, ephShareB64, approvalB64, signer) {
@@ -32926,9 +32966,19 @@ function resolveQosBin(explicit) {
   if (explicit) return explicit;
   if (process.env.QOS_CLIENT_BIN) return process.env.QOS_CLIENT_BIN;
   const embedded = (0, import_node_path2.join)(__dirname, "bin", `qos_client-${process.platform}-${process.arch}`);
-  if ((0, import_node_fs2.existsSync)(embedded)) return embedded;
+  if ((0, import_node_fs2.existsSync)(embedded)) {
+    ensureExecutable(embedded);
+    return embedded;
+  }
   return void 0;
 }
+function ensureExecutable(path) {
+  try {
+    const mode = (0, import_node_fs2.statSync)(path).mode;
+    if ((mode & 73) !== 73) (0, import_node_fs2.chmodSync)(path, mode | 493);
+  } catch {
+  }
+}
 
 // src/commands/keygen.ts
 async function keygen(o3) {
@@ -32946,13 +32996,9 @@ async function keygen(o3) {
   const pubPath = `${secretPath}.pub`;
   qos.generateFileKey(secretPath, pubPath);
   const pubHex = (0, import_node_fs3.readFileSync)(pubPath, "utf8").trim();
-  console.log(
-    `keygen: seed written to ${secretPath} (keep it safe \u2014 it never leaves this device)`
-  );
+  console.log(`keygen: seed written to ${secretPath} (keep it safe \u2014 it never leaves this device)`);
   console.log(`keygen: pubkey written to ${pubPath}`);
-  console.log(
-    "\nRegister this operator (admin, IAM-gated) so it can join ceremonies:"
-  );
+  console.log("\nRegister this operator (admin, IAM-gated) so it can join ceremonies:");
   console.log(
     "  aws lambda invoke --function-name qos-coordinator-admin-<stack> --cli-binary-format raw-in-base64-out \\"
   );
@@ -32974,7 +33020,12 @@ function resolve(o3) {
   const nonce = Number(nonceStr);
   if (!Number.isInteger(nonce)) throw new Error(`--nonce must be an integer, got ${nonceStr}`);
   const alias = req(o3.alias ?? process.env.CEREMONY_ALIAS, "--alias");
-  const secret = o3.yubikey ? { yubikey: true } : { secretPath: req(o3.secretPath ?? process.env.CEREMONY_SECRET, "--secret-path / CEREMONY_SECRET") };
+  const secret = o3.yubikey ? { yubikey: true } : {
+    secretPath: req(
+      o3.secretPath ?? process.env.CEREMONY_SECRET,
+      "--secret-path / CEREMONY_SECRET"
+    )
+  };
   return {
     api,
     qos,
@@ -33000,7 +33051,8 @@ async function buildSetDirs(ctx, wd, sets) {
     const dir = wd.dir(name);
     for (const alias of set.members) {
       const hex = members[alias];
-      if (!hex) throw new Error(`operator '${alias}' has no registered pubkey (admin register-operator)`);
+      if (!hex)
+        throw new Error(`operator '${alias}' has no registered pubkey (admin register-operator)`);
       (0, import_node_fs4.writeFileSync)(`${dir}/${alias}.pub`, hex);
     }
     (0, import_node_fs4.writeFileSync)(`${dir}/quorum_threshold`, `${set.threshold}`);
@@ -33016,7 +33068,12 @@ async function pullGenesisDir(ctx, wd) {
   const dir = wd.dir("namespace");
   await pullArtifact(ctx, wd, "genesis/genesis_output", "namespace/genesis_output");
   await pullArtifact(ctx, wd, "genesis/quorum_key.pub", "namespace/quorum_key.pub").catch(() => "");
-  await pullArtifact(ctx, wd, "genesis/genesis_attestation_doc", "namespace/genesis_attestation_doc").catch(() => "");
+  await pullArtifact(
+    ctx,
+    wd,
+    "genesis/genesis_attestation_doc",
+    "namespace/genesis_attestation_doc"
+  ).catch(() => "");
   return dir;
 }
 async function fetchState(ctx) {
@@ -33039,8 +33096,13 @@ async function share(o3) {
       secret: ctx.secret
     });
     const shareB64 = wd.readBytes(`${ctx.alias}.share`).toString("base64");
-    await ctx.api.putShare(ctx.namespace, ctx.nonce, ctx.alias, shareB64, { secret: ctx.secret, qos: ctx.qos });
-    console.log(`share: derived + uploaded encrypted share for '${ctx.alias}' (${ctx.namespace}/${ctx.nonce})`);
+    await ctx.api.putShare(ctx.namespace, ctx.nonce, ctx.alias, shareB64, {
+      secret: ctx.secret,
+      qos: ctx.qos
+    });
+    console.log(
+      `share: derived + uploaded encrypted share for '${ctx.alias}' (${ctx.namespace}/${ctx.nonce})`
+    );
   } finally {
     wd.cleanup();
   }
@@ -33053,29 +33115,10 @@ async function approve(o3) {
   const state2 = await fetchState(ctx);
   const wd = new Workdir("ceremony-approve-");
   try {
-    const manifestPath = await pullArtifact(
-      ctx,
-      wd,
-      "manifest/manifest",
-      "manifest"
-    );
-    const pivotHashPath = await pullArtifact(
-      ctx,
-      wd,
-      "manifest/pivot.hash",
-      "pivot.hash"
-    );
-    const quorumKeyPath = await pullArtifact(
-      ctx,
-      wd,
-      "genesis/quorum_key.pub",
-      "quorum_key.pub"
-    );
-    const { manifestSetDir, shareSetDir, patchSetDir } = await buildSetDirs(
-      ctx,
-      wd,
-      state2.sets
-    );
+    const manifestPath = await pullArtifact(ctx, wd, "manifest/manifest", "manifest");
+    const pivotHashPath = await pullArtifact(ctx, wd, "manifest/pivot.hash", "pivot.hash");
+    const quorumKeyPath = await pullArtifact(ctx, wd, "genesis/quorum_key.pub", "quorum_key.pub");
+    const { manifestSetDir, shareSetDir, patchSetDir } = await buildSetDirs(ctx, wd, state2.sets);
     const approvalsDir = wd.dir("approvals");
     const json = ctx.qos.display(manifestPath, "manifest");
     console.log("\n===== MANIFEST UNDER REVIEW =====");
@@ -33113,13 +33156,10 @@ async function approve(o3) {
     const nsFlat = state2.namespace.replace(/\//g, "-");
     const approvalFile = `${ctx.alias}-${nsFlat}-${state2.nonce}.approval`;
     const approvalB64 = wd.readBytes(`approvals/${approvalFile}`).toString("base64");
-    await ctx.api.postApproval(
-      ctx.namespace,
-      ctx.nonce,
-      ctx.alias,
-      approvalB64,
-      { secret: ctx.secret, qos: ctx.qos }
-    );
+    await ctx.api.postApproval(ctx.namespace, ctx.nonce, ctx.alias, approvalB64, {
+      secret: ctx.secret,
+      qos: ctx.qos
+    });
     console.log(`approve: uploaded approval '${approvalFile}'`);
   } finally {
     wd.cleanup();
@@ -33133,8 +33173,18 @@ async function provision(o3) {
   const wd = new Workdir("ceremony-provision-");
   try {
     const gen = state2.boot_generation ?? 0;
-    const attestationDocPath = await pullArtifact(ctx, wd, `provision/g${gen}/attestation_doc`, "attestation_doc");
-    const manifestEnvelopePath = await pullArtifact(ctx, wd, "manifest/manifest_envelope", "manifest_envelope");
+    const attestationDocPath = await pullArtifact(
+      ctx,
+      wd,
+      `provision/g${gen}/attestation_doc`,
+      "attestation_doc"
+    );
+    const manifestEnvelopePath = await pullArtifact(
+      ctx,
+      wd,
+      "manifest/manifest_envelope",
+      "manifest_envelope"
+    );
     const sharePath = await pullArtifact(ctx, wd, `shares/${ctx.alias}.share`, `${ctx.alias}.share`);
     const { manifestSetDir } = await buildSetDirs(ctx, wd, state2.sets);
     const ephWrappedSharePath = wd.path(`${ctx.alias}.eph_share`);
@@ -33169,7 +33219,8 @@ async function status(o3) {
   const apiUrl = o3.api ?? process.env.CEREMONY_API;
   const namespace = o3.namespace ?? process.env.CEREMONY_NAMESPACE;
   const nonceStr = o3.nonce ?? process.env.CEREMONY_NONCE;
-  if (!apiUrl || !namespace || !nonceStr) throw new Error("status requires --api --namespace --nonce");
+  if (!apiUrl || !namespace || !nonceStr)
+    throw new Error("status requires --api --namespace --nonce");
   const api = new CeremonyApi(apiUrl);
   const s = await api.getState(namespace, Number(nonceStr));
   console.log(`namespace : ${s.namespace}`);
@@ -33190,7 +33241,9 @@ var import_client_elastic_load_balancing_v2 = __toESM(require_dist_cjs16());
 function buildWeightedForward(tgs, weights) {
   for (const k5 of Object.keys(weights)) {
     if (!tgs.some((t) => t.nonce === Number(k5))) {
-      throw new Error(`shift-traffic: weight given for nonce ${k5} but no matching target group was found`);
+      throw new Error(
+        `shift-traffic: weight given for nonce ${k5} but no matching target group was found`
+      );
     }
   }
   if (tgs.length === 0) throw new Error("shift-traffic: no target groups to forward to");
@@ -33223,16 +33276,21 @@ async function discoverColorTargetGroups(elbv2, service, stack, role) {
       const tags = Object.fromEntries((desc.Tags ?? []).map((t) => [t.Key, t.Value]));
       if (tags.TeeService === service && tags.Stack === stack && tags.Role === role && tags.Nonce) {
         const src = batch.find((b5) => b5.arn === desc.ResourceArn);
-        if (src) matched.push({ nonce: Number(tags.Nonce), arn: desc.ResourceArn, lbArn: src.lbArn });
+        if (src)
+          matched.push({ nonce: Number(tags.Nonce), arn: desc.ResourceArn, lbArn: src.lbArn });
       }
     }
   }
   if (matched.length === 0) {
-    throw new Error(`shift-traffic: no ${role} target groups found for service '${service}' stack '${stack}'`);
+    throw new Error(
+      `shift-traffic: no ${role} target groups found for service '${service}' stack '${stack}'`
+    );
   }
   const lbArn = matched[0].lbArn;
   if (!matched.every((m3) => m3.lbArn === lbArn)) {
-    throw new Error(`shift-traffic: ${role} target groups span multiple load balancers \u2014 refusing to guess`);
+    throw new Error(
+      `shift-traffic: ${role} target groups span multiple load balancers \u2014 refusing to guess`
+    );
   }
   return { lbArn, tgs: matched };
 }
@@ -33250,7 +33308,11 @@ async function shiftTraffic(opts) {
   const role = opts.listener ?? "app";
   const elbv2 = opts.client ?? new import_client_elastic_load_balancing_v2.ElasticLoadBalancingV2Client(opts.region ? { region: opts.region } : {});
   const { lbArn, tgs } = await discoverColorTargetGroups(elbv2, opts.service, opts.stack, role);
-  const listenerArn = await findListenerForTargetGroups(elbv2, lbArn, new Set(tgs.map((t) => t.arn)));
+  const listenerArn = await findListenerForTargetGroups(
+    elbv2,
+    lbArn,
+    new Set(tgs.map((t) => t.arn))
+  );
   const actions = buildWeightedForward(tgs, opts.weights);
   await elbv2.send(new import_client_elastic_load_balancing_v2.ModifyListenerCommand({ ListenerArn: listenerArn, DefaultActions: actions }));
   return { listenerArn, actions };
@@ -33264,7 +33326,13 @@ async function shiftTrafficCommand(o3) {
   const weights = {};
   for (const [k5, v] of Object.entries(parsed)) weights[Number(k5)] = v;
   const listener = o3.listener ?? "app";
-  const { listenerArn, actions } = await shiftTraffic({ service, stack, region: o3.region, listener, weights });
+  const { listenerArn, actions } = await shiftTraffic({
+    service,
+    stack,
+    region: o3.region,
+    listener,
+    weights
+  });
   const summary = (actions[0].ForwardConfig?.TargetGroups ?? []).map((t) => `${t.TargetGroupArn?.split("/").slice(-2, -1)[0] ?? t.TargetGroupArn}=${t.Weight}`).join(" ");
   console.log(`shift-traffic: ${service}/${stack} ${listener} listener \u2192 ${summary}`);
   console.log(`  listener: ${listenerArn}`);
@@ -33272,9 +33340,14 @@ async function shiftTrafficCommand(o3) {
 
 // src/cli.ts
 var program2 = new Command();
-program2.name("ceremony").description("QOS TEE operator ceremony CLI \u2014 your private key never leaves this device; all crypto via qos_client");
+program2.name("qos-ceremony").description(
+  "QOS TEE operator ceremony CLI \u2014 your private key never leaves this device; all crypto via qos_client"
+);
 function withCommon(cmd) {
-  return cmd.option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace, e.g. arith (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").option("--alias <alias>", "operator alias (env CEREMONY_ALIAS)").option("--secret-path <path>", "operator master-seed file \u2014 stays local (env CEREMONY_SECRET)").option("--yubikey", "use a YubiKey PIV key instead of a seed file").option("--pcr3-preimage-path <path>", "PCR3 preimage (IAM role ARN) file").option("--qos-release-dir <dir>", "QOS release dir (aws-x86_64.pcrs)").option("--qos-client <bin>", "qos_client binary path (env QOS_CLIENT_BIN; else embedded/PATH)").option("--unsafe-eph-path-override <path>", "[dev/mock only] read enclave ephemeral pubkey from this file");
+  return cmd.option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace, e.g. arith (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").option("--alias <alias>", "operator alias (env CEREMONY_ALIAS)").option("--secret-path <path>", "operator master-seed file \u2014 stays local (env CEREMONY_SECRET)").option("--yubikey", "use a YubiKey PIV key instead of a seed file").option("--pcr3-preimage-path <path>", "PCR3 preimage (IAM role ARN) file").option("--qos-release-dir <dir>", "QOS release dir (aws-x86_64.pcrs)").option("--qos-client <bin>", "qos_client binary path (env QOS_CLIENT_BIN; else embedded/PATH)").option(
+    "--unsafe-eph-path-override <path>",
+    "[dev/mock only] read enclave ephemeral pubkey from this file"
+  );
 }
 function run(fn) {
   return (o3) => fn(o3).catch((e5) => {
@@ -33282,12 +33355,12 @@ function run(fn) {
     process.exit(1);
   });
 }
-withCommon(program2.command("keygen").description("generate operator keypair; print pubkey to register (seed stays local)")).action(
-  run(keygen)
-);
-withCommon(program2.command("share").description("derive quorum-key share from genesis output; upload (encrypted)")).action(
-  run(share)
-);
+withCommon(
+  program2.command("keygen").description("generate operator keypair; print pubkey to register (seed stays local)")
+).action(run(keygen));
+withCommon(
+  program2.command("share").description("derive quorum-key share from genesis output; upload (encrypted)")
+).action(run(share));
 withCommon(
   program2.command("approve").description("review + sign the manifest (manifestSet)").option("--yes", "skip interactive confirm")
 ).action(run(approve));
@@ -33295,7 +33368,9 @@ withCommon(
   program2.command("provision").description("re-encrypt share to the enclave ephemeral key; post it (shareSet)")
 ).action(run(provision));
 program2.command("status").description("show ceremony phase + blockers (read-only)").option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").action(run(status));
-program2.command("shift-traffic").description("[ops] blue-green weighted traffic cutover across a service's colors (needs AWS creds)").option("--service <name>", "service name (env CEREMONY_SERVICE)").option("--stack <stack>", "stack (env CEREMONY_STACK)").option("--region <r>", "AWS region").option("--listener <app|control>", "which listener carries the split (default app)").option("--weights <json>", `nonce->weight map, e.g. '{"2026070601":0,"2026071501":100}'`).action(run(shiftTrafficCommand));
+program2.command("shift-traffic").description(
+  "[ops] blue-green weighted traffic cutover across a service's colors (needs AWS creds)"
+).option("--service <name>", "service name (env CEREMONY_SERVICE)").option("--stack <stack>", "stack (env CEREMONY_STACK)").option("--region <r>", "AWS region").option("--listener <app|control>", "which listener carries the split (default app)").option("--weights <json>", `nonce->weight map, e.g. '{"2026070601":0,"2026071501":100}'`).action(run(shiftTrafficCommand));
 program2.parseAsync(process.argv).catch((e5) => {
   console.error(e5);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umbra-privacy/qos-ceremony",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "QOS TEE operator ceremony CLI — keygen/share/approve/provision + shift-traffic over the coordinator API. All crypto runs in qos_client (embedded for common platforms); your private key never leaves the device. Ships NO coordinator code.",
   "keywords": [
     "qos",
@@ -17,7 +17,7 @@
     "directory": "tools/operator-cli"
   },
   "bin": {
-    "ceremony": "dist-cli/cli.js"
+    "qos-ceremony": "dist-cli/cli.js"
   },
   "main": "dist-cli/cli.js",
   "files": [
@@ -44,6 +44,6 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
     "bundle:cli": "esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist-cli/cli.js && chmod +x dist-cli/cli.js",
-    "embed:qos": "mkdir -p dist-cli/bin && ( [ -f ../../../qos/target/release/qos_client ] && cp -L ../../../qos/target/release/qos_client dist-cli/bin/qos_client-darwin-arm64 || true ) && ( [ -f ../ceremony/dist-lambda/qos_client ] && cp -L ../ceremony/dist-lambda/qos_client dist-cli/bin/qos_client-linux-x64 || true ) && ls -la dist-cli/bin"
+    "embed:qos": "mkdir -p dist-cli/bin && ( [ -f ../../../qos/target/release/qos_client ] && cp -L ../../../qos/target/release/qos_client dist-cli/bin/qos_client-darwin-arm64 || true ) && ( [ -f ../ceremony/dist-lambda/qos_client ] && cp -L ../ceremony/dist-lambda/qos_client dist-cli/bin/qos_client-linux-x64 || true ) && ( chmod +x dist-cli/bin/* 2>/dev/null || true ) && ls -la dist-cli/bin"
   }
 }