@umbra-privacy/qos-ceremony 0.1.1 → 0.1.3

package/dist-cli/cli.js

@@ -31567,7 +31567,7 @@ var require_dist_cjs16 = __commonJS({
     };
     var DescribeTargetGroupsCommand2 = class extends command5(_ep05, _mw05, "DescribeTargetGroups", DescribeTargetGroups$) {
     };
-    var DescribeTargetHealthCommand = class extends command5(_ep05, _mw05, "DescribeTargetHealth", DescribeTargetHealth$) {
+    var DescribeTargetHealthCommand2 = class extends command5(_ep05, _mw05, "DescribeTargetHealth", DescribeTargetHealth$) {
     };
     var DescribeTrustStoreAssociationsCommand = class extends command5(_ep05, _mw05, "DescribeTrustStoreAssociations", DescribeTrustStoreAssociations$) {
     };
@@ -31743,7 +31743,7 @@ var require_dist_cjs16 = __commonJS({
     var checkState$1 = async (client, input) => {
       let reason;
       try {
-        let result = await client.send(new DescribeTargetHealthCommand(input));
+        let result = await client.send(new DescribeTargetHealthCommand2(input));
         reason = result;
         try {
           const returnComparator = () => {
@@ -31782,7 +31782,7 @@ var require_dist_cjs16 = __commonJS({
     var checkState = async (client, input) => {
       let reason;
       try {
-        let result = await client.send(new DescribeTargetHealthCommand(input));
+        let result = await client.send(new DescribeTargetHealthCommand2(input));
         reason = result;
         try {
           const returnComparator = () => {
@@ -31846,7 +31846,7 @@ var require_dist_cjs16 = __commonJS({
       DescribeTagsCommand: DescribeTagsCommand2,
       DescribeTargetGroupAttributesCommand,
       DescribeTargetGroupsCommand: DescribeTargetGroupsCommand2,
-      DescribeTargetHealthCommand,
+      DescribeTargetHealthCommand: DescribeTargetHealthCommand2,
       DescribeTrustStoreAssociationsCommand,
       DescribeTrustStoreRevocationsCommand,
       DescribeTrustStoresCommand,
@@ -32185,7 +32185,7 @@ var require_dist_cjs16 = __commonJS({
     exports2.DescribeTargetGroupsInput$ = DescribeTargetGroupsInput$;
     exports2.DescribeTargetGroupsOutput$ = DescribeTargetGroupsOutput$;
     exports2.DescribeTargetHealth$ = DescribeTargetHealth$;
-    exports2.DescribeTargetHealthCommand = DescribeTargetHealthCommand;
+    exports2.DescribeTargetHealthCommand = DescribeTargetHealthCommand2;
     exports2.DescribeTargetHealthInput$ = DescribeTargetHealthInput$;
     exports2.DescribeTargetHealthInputIncludeEnum = DescribeTargetHealthInputIncludeEnum;
     exports2.DescribeTargetHealthOutput$ = DescribeTargetHealthOutput$;
@@ -32823,10 +32823,24 @@ var Workdir = class {
 };
 
 // ../qos-core/src/api.ts
+function enforceHttps(url) {
+  if (!url) throw new Error("coordinator base URL is required");
+  let u;
+  try {
+    u = new URL(url);
+  } catch {
+    throw new Error(`invalid coordinator base URL: ${url}`);
+  }
+  const isLocal = u.hostname === "localhost" || u.hostname === "127.0.0.1";
+  if (u.protocol !== "https:" && !(u.protocol === "http:" && isLocal)) {
+    throw new Error(`coordinator base URL must use https (got ${u.protocol}//${u.hostname})`);
+  }
+  return url;
+}
 var CeremonyApi = class {
   constructor(baseUrl) {
     this.baseUrl = baseUrl;
-    this.baseUrl = baseUrl.replace(/\/$/, "");
+    this.baseUrl = enforceHttps(baseUrl.replace(/\/$/, ""));
   }
   base(ns, nonce) {
     return `${this.baseUrl}/ceremony/${encodeURIComponent(ns)}/${nonce}`;
@@ -32843,6 +32857,13 @@ var CeremonyApi = class {
     if (!r5.ok) throw new Error(`getArtifact ${path}: ${r5.status} ${await r5.text()}`);
     return Buffer.from(await r5.text(), "base64");
   }
+  /** Fetch a namespace-shared artifact (`quorum_key.pub`, `shares/<alias>.share`) — nonce-free,
+   *  invariant across a service's colors. Same base64 encoding as getArtifact. */
+  async getSharedArtifact(ns, path) {
+    const r5 = await fetch(`${this.baseUrl}/shared/${encodeURIComponent(ns)}/${path}`);
+    if (!r5.ok) throw new Error(`getSharedArtifact ${path}: ${r5.status} ${await r5.text()}`);
+    return Buffer.from(await r5.text(), "base64");
+  }
   /** Registered operator pubkeys (alias → hex) for the ceremony's service. The
    *  registry is the source of member pubkeys (no per-ceremony upload). */
   async getMembers(ns, nonce) {
@@ -32966,9 +32987,19 @@ function resolveQosBin(explicit) {
   if (explicit) return explicit;
   if (process.env.QOS_CLIENT_BIN) return process.env.QOS_CLIENT_BIN;
   const embedded = (0, import_node_path2.join)(__dirname, "bin", `qos_client-${process.platform}-${process.arch}`);
-  if ((0, import_node_fs2.existsSync)(embedded)) return embedded;
+  if ((0, import_node_fs2.existsSync)(embedded)) {
+    ensureExecutable(embedded);
+    return embedded;
+  }
   return void 0;
 }
+function ensureExecutable(path) {
+  try {
+    const mode = (0, import_node_fs2.statSync)(path).mode;
+    if ((mode & 73) !== 73) (0, import_node_fs2.chmodSync)(path, mode | 493);
+  } catch {
+  }
+}
 
 // src/commands/keygen.ts
 async function keygen(o3) {
@@ -33031,15 +33062,28 @@ function resolve(o3) {
 
 // src/artifacts.ts
 var import_node_fs4 = require("node:fs");
+var SAFE_ALIAS = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function assertSafeAlias(alias) {
+  if (!SAFE_ALIAS.test(alias)) {
+    throw new Error(
+      `refusing coordinator-supplied member alias '${alias}' \u2014 not a safe filename (expected ${SAFE_ALIAS}); a malicious coordinator must not drive a local path`
+    );
+  }
+}
 async function pullArtifact(ctx, wd, apiPath, localRel) {
   const bytes = await ctx.api.getArtifact(ctx.namespace, ctx.nonce, apiPath);
   return wd.writeBytes(localRel, bytes);
 }
+async function pullShared(ctx, wd, sharedPath, localRel) {
+  const bytes = await ctx.api.getSharedArtifact(ctx.namespace, sharedPath);
+  return wd.writeBytes(localRel, bytes);
+}
 async function buildSetDirs(ctx, wd, sets) {
   const members = await ctx.api.getMembers(ctx.namespace, ctx.nonce);
   const build = (name, set) => {
     const dir = wd.dir(name);
     for (const alias of set.members) {
+      assertSafeAlias(alias);
       const hex = members[alias];
       if (!hex)
         throw new Error(`operator '${alias}' has no registered pubkey (admin register-operator)`);
@@ -33057,7 +33101,7 @@ async function buildSetDirs(ctx, wd, sets) {
 async function pullGenesisDir(ctx, wd) {
   const dir = wd.dir("namespace");
   await pullArtifact(ctx, wd, "genesis/genesis_output", "namespace/genesis_output");
-  await pullArtifact(ctx, wd, "genesis/quorum_key.pub", "namespace/quorum_key.pub").catch(() => "");
+  await pullShared(ctx, wd, "quorum_key.pub", "namespace/quorum_key.pub").catch(() => "");
   await pullArtifact(
     ctx,
     wd,
@@ -33107,7 +33151,7 @@ async function approve(o3) {
   try {
     const manifestPath = await pullArtifact(ctx, wd, "manifest/manifest", "manifest");
     const pivotHashPath = await pullArtifact(ctx, wd, "manifest/pivot.hash", "pivot.hash");
-    const quorumKeyPath = await pullArtifact(ctx, wd, "genesis/quorum_key.pub", "quorum_key.pub");
+    const quorumKeyPath = await pullShared(ctx, wd, "quorum_key.pub", "quorum_key.pub");
     const { manifestSetDir, shareSetDir, patchSetDir } = await buildSetDirs(ctx, wd, state2.sets);
     const approvalsDir = wd.dir("approvals");
     const json = ctx.qos.display(manifestPath, "manifest");
@@ -33175,7 +33219,7 @@ async function provision(o3) {
       "manifest/manifest_envelope",
       "manifest_envelope"
     );
-    const sharePath = await pullArtifact(ctx, wd, `shares/${ctx.alias}.share`, `${ctx.alias}.share`);
+    const sharePath = await pullShared(ctx, wd, `shares/${ctx.alias}.share`, `${ctx.alias}.share`);
     const { manifestSetDir } = await buildSetDirs(ctx, wd, state2.sets);
     const ephWrappedSharePath = wd.path(`${ctx.alias}.eph_share`);
     const approvalPath = wd.path(`${ctx.alias}.attestation.approval`);
@@ -33237,14 +33281,14 @@ function buildWeightedForward(tgs, weights) {
     }
   }
   if (tgs.length === 0) throw new Error("shift-traffic: no target groups to forward to");
-  return [
-    {
-      Type: "forward",
-      ForwardConfig: {
-        TargetGroups: tgs.map((t) => ({ TargetGroupArn: t.arn, Weight: weights[t.nonce] ?? 0 }))
-      }
-    }
-  ];
+  const resolved = tgs.map((t) => ({ TargetGroupArn: t.arn, Weight: weights[t.nonce] ?? 0 }));
+  const total = resolved.reduce((s, t) => s + (t.Weight ?? 0), 0);
+  if (total <= 0) {
+    throw new Error(
+      "shift-traffic: refusing \u2014 the resulting target-group weights sum to 0, which black-holes ALL client traffic (503). Give at least one color a positive weight."
+    );
+  }
+  return [{ Type: "forward", ForwardConfig: { TargetGroups: resolved } }];
 }
 async function discoverColorTargetGroups(elbv2, service, stack, role) {
   const all = [];
@@ -33286,13 +33330,22 @@ async function discoverColorTargetGroups(elbv2, service, stack, role) {
 }
 async function findListenerForTargetGroups(elbv2, lbArn, tgArns) {
   const r5 = await elbv2.send(new import_client_elastic_load_balancing_v2.DescribeListenersCommand({ LoadBalancerArn: lbArn }));
+  const matches = [];
   for (const l3 of r5.Listeners ?? []) {
     const forwards = (l3.DefaultActions ?? []).flatMap((a5) => a5.ForwardConfig?.TargetGroups ?? []);
-    if (forwards.some((t) => t.TargetGroupArn && tgArns.has(t.TargetGroupArn))) {
-      if (l3.ListenerArn) return l3.ListenerArn;
+    if (forwards.some((t) => t.TargetGroupArn && tgArns.has(t.TargetGroupArn)) && l3.ListenerArn) {
+      matches.push(l3.ListenerArn);
     }
   }
-  throw new Error("shift-traffic: no listener forwards to the discovered target groups");
+  if (matches.length === 0) {
+    throw new Error("shift-traffic: no listener forwards to the discovered target groups");
+  }
+  if (matches.length > 1) {
+    throw new Error(
+      `shift-traffic: ${matches.length} listeners forward to these target groups \u2014 refusing to guess which to modify`
+    );
+  }
+  return matches[0];
 }
 async function shiftTraffic(opts) {
   const role = opts.listener ?? "app";
@@ -33304,8 +33357,25 @@ async function shiftTraffic(opts) {
     new Set(tgs.map((t) => t.arn))
   );
   const actions = buildWeightedForward(tgs, opts.weights);
+  if (opts.dryRun) return { listenerArn, actions, applied: false };
+  if (!opts.force) {
+    const noHealthy = [];
+    for (const t of tgs) {
+      if ((opts.weights[t.nonce] ?? 0) <= 0) continue;
+      const h5 = await elbv2.send(new import_client_elastic_load_balancing_v2.DescribeTargetHealthCommand({ TargetGroupArn: t.arn }));
+      const healthy = (h5.TargetHealthDescriptions ?? []).filter(
+        (d5) => d5.TargetHealth?.State === "healthy"
+      ).length;
+      if (healthy === 0) noHealthy.push(t.nonce);
+    }
+    if (noHealthy.length > 0) {
+      throw new Error(
+        `shift-traffic: refusing cutover \u2014 color(s) [${noHealthy.join(", ")}] have 0 healthy targets; routing traffic to them would 503 every client. Wait for health, or pass --force.`
+      );
+    }
+  }
   await elbv2.send(new import_client_elastic_load_balancing_v2.ModifyListenerCommand({ ListenerArn: listenerArn, DefaultActions: actions }));
-  return { listenerArn, actions };
+  return { listenerArn, actions, applied: true };
 }
 async function shiftTrafficCommand(o3) {
   const service = o3.service ?? process.env.CEREMONY_SERVICE;
@@ -33316,16 +33386,36 @@ async function shiftTrafficCommand(o3) {
   const weights = {};
   for (const [k5, v] of Object.entries(parsed)) weights[Number(k5)] = v;
   const listener = o3.listener ?? "app";
-  const { listenerArn, actions } = await shiftTraffic({
+  const plan = await shiftTraffic({
+    service,
+    stack,
+    region: o3.region,
+    listener,
+    weights,
+    dryRun: true
+  });
+  const summary = (plan.actions[0].ForwardConfig?.TargetGroups ?? []).map((t) => `${t.TargetGroupArn?.split("/").slice(-2, -1)[0] ?? t.TargetGroupArn}=${t.Weight}`).join(" ");
+  console.log(`shift-traffic PLAN: ${service}/${stack} ${listener} listener \u2192 ${summary}`);
+  console.log(`  listener: ${plan.listenerArn}`);
+  if (o3.dryRun) {
+    console.log("  (dry-run \u2014 no change applied)");
+    return;
+  }
+  if (!o3.yes) {
+    throw new Error(
+      "shift-traffic: refusing to apply a live traffic cutover without --yes (review the PLAN above, then re-run with --yes; or use --dry-run)"
+    );
+  }
+  const applied = await shiftTraffic({
     service,
     stack,
     region: o3.region,
     listener,
-    weights
+    weights,
+    force: o3.force
   });
-  const summary = (actions[0].ForwardConfig?.TargetGroups ?? []).map((t) => `${t.TargetGroupArn?.split("/").slice(-2, -1)[0] ?? t.TargetGroupArn}=${t.Weight}`).join(" ");
-  console.log(`shift-traffic: ${service}/${stack} ${listener} listener \u2192 ${summary}`);
-  console.log(`  listener: ${listenerArn}`);
+  console.log(`shift-traffic APPLIED \u2192 ${summary}`);
+  console.log(`  listener: ${applied.listenerArn}`);
 }
 
 // src/cli.ts
@@ -33360,7 +33450,7 @@ withCommon(
 program2.command("status").description("show ceremony phase + blockers (read-only)").option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").action(run(status));
 program2.command("shift-traffic").description(
   "[ops] blue-green weighted traffic cutover across a service's colors (needs AWS creds)"
-).option("--service <name>", "service name (env CEREMONY_SERVICE)").option("--stack <stack>", "stack (env CEREMONY_STACK)").option("--region <r>", "AWS region").option("--listener <app|control>", "which listener carries the split (default app)").option("--weights <json>", `nonce->weight map, e.g. '{"2026070601":0,"2026071501":100}'`).action(run(shiftTrafficCommand));
+).option("--service <name>", "service name (env CEREMONY_SERVICE)").option("--stack <stack>", "stack (env CEREMONY_STACK)").option("--region <r>", "AWS region").option("--listener <app|control>", "which listener carries the split (default app)").option("--weights <json>", `nonce->weight map, e.g. '{"2026070601":0,"2026071501":100}'`).option("--dry-run", "print the planned weighted forward and exit without applying").option("--yes", "confirm applying the live traffic cutover (required unless --dry-run)").option("--force", "skip the target-health precheck (allow shifting to a 0-healthy color)").action(run(shiftTrafficCommand));
 program2.parseAsync(process.argv).catch((e5) => {
   console.error(e5);
   process.exit(1);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umbra-privacy/qos-ceremony",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "QOS TEE operator ceremony CLI — keygen/share/approve/provision + shift-traffic over the coordinator API. All crypto runs in qos_client (embedded for common platforms); your private key never leaves the device. Ships NO coordinator code.",
   "keywords": [
     "qos",
@@ -44,6 +44,6 @@
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
     "bundle:cli": "esbuild src/cli.ts --bundle --platform=node --target=node20 --format=cjs --outfile=dist-cli/cli.js && chmod +x dist-cli/cli.js",
-    "embed:qos": "mkdir -p dist-cli/bin && ( [ -f ../../../qos/target/release/qos_client ] && cp -L ../../../qos/target/release/qos_client dist-cli/bin/qos_client-darwin-arm64 || true ) && ( [ -f ../ceremony/dist-lambda/qos_client ] && cp -L ../ceremony/dist-lambda/qos_client dist-cli/bin/qos_client-linux-x64 || true ) && ls -la dist-cli/bin"
+    "embed:qos": "mkdir -p dist-cli/bin && ( [ -f ../../../qos/target/release/qos_client ] && cp -L ../../../qos/target/release/qos_client dist-cli/bin/qos_client-darwin-arm64 || true ) && ( [ -f ../ceremony/dist-lambda/qos_client ] && cp -L ../ceremony/dist-lambda/qos_client dist-cli/bin/qos_client-linux-x64 || true ) && ( chmod +x dist-cli/bin/* 2>/dev/null || true ) && ls -la dist-cli/bin"
   }
 }