@umbra-privacy/qos-ceremony 0.1.4 → 0.2.0

package/README.md

@@ -43,3 +43,60 @@ qos-ceremony status                # read-only phase + blockers
 
 Flags mirror env: `--api --namespace --nonce --alias --secret-path --yubikey
 --pcr3-preimage-path --qos-release-dir --qos-client`.
+
+## The at-rest layer
+
+A share is **double-sealed** everywhere it rests: the QOS P-256 envelope on the inside, an
+ML-KEM-1024 + X25519 envelope over it. `ceremony share` seals before upload and `ceremony provision`
+opens after download, so the singly-sealed form exists only inside a provision workdir, in the moment
+between recovery and re-encryption to the enclave's ephemeral key.
+
+The reason is the stored copy. `_shared/shares/<alias>.share` is durable and is the disaster-recovery
+material, so under P-256 alone a copy taken today is readable by a CRQC later. The outer layer closes
+that window without changing anything the enclave sees.
+
+### One-time setup, per operator
+
+```bash
+# a seed in the file — fine for a laptop ceremony or a test
+qos-ceremony encryption-key ~/.umbra/operator-encryption.json
+
+# a seed derived from hardware — only a salt is stored
+qos-ceremony encryption-key ~/.umbra/operator-encryption.json \
+  --challenge-command 'ykman otp calculate 2 {challenge}'
+```
+
+Then pass the key file to every ceremony command that touches a share:
+
+```bash
+export CEREMONY_ENCRYPTION_KEY=~/.umbra/operator-encryption.json
+qos-ceremony share       # derives, seals, uploads
+qos-ceremony provision   # downloads, opens, re-encrypts to the enclave
+```
+
+Add `--challenge-command` to `provision` when the key derives from hardware; the token must be
+present for that step and no other.
+
+### The tools directly
+
+`seal-share` and `unseal-share` are also exposed on their own, for a share handled outside the
+ceremony — a TVC deployment, or recovering one by hand. Arguments pass through to the underlying
+binary, so `--help` is the binary's own:
+
+```bash
+qos-ceremony seal-share --help
+qos-ceremony unseal-share --response quorum-key-response.json \
+  --key ~/.umbra/operator-encryption.json --out quorum_key_metadata.json   # tvc shape
+qos-ceremony unseal-share --response p1.share.sealed \
+  --key ~/.umbra/operator-encryption.json --out p1.share --format qos      # qos shape
+```
+
+`--format tvc` (the default) writes what `tvc keys re-encrypt-local-share` reads; `--format qos`
+writes the raw envelope `qos_client proxy-re-encrypt-share --share-path` reads.
+
+### Binaries
+
+`qos_client`, `umbra-encryption-key`, `umbra-seal-share` and `umbra-unseal-share` are embedded per
+platform. Override any of them with `--qos-client`, `--seal-share-bin`, `--unseal-share-bin`, or the
+matching `*_BIN` environment variable; on an uncovered platform the CLI falls back to the bare name
+on `PATH`.

package/dist-cli/cli.js

@@ -6437,10 +6437,10 @@ var init_hex_encoding = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js
-var import_node_fs5, calculateBodyLength;
+var import_node_fs6, calculateBodyLength;
 var init_calculateBodyLength = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js"() {
-    import_node_fs5 = require("node:fs");
+    import_node_fs6 = require("node:fs");
     calculateBodyLength = (body) => {
       if (!body) {
         return 0;
@@ -6453,11 +6453,11 @@ var init_calculateBodyLength = __esm({
         return body.size;
       } else if (typeof body.start === "number" && typeof body.end === "number") {
         return body.end + 1 - body.start;
-      } else if (body instanceof import_node_fs5.ReadStream) {
+      } else if (body instanceof import_node_fs6.ReadStream) {
         if (body.path != null) {
-          return (0, import_node_fs5.lstatSync)(body.path).size;
+          return (0, import_node_fs6.lstatSync)(body.path).size;
         } else if (typeof body.fd === "number") {
-          return (0, import_node_fs5.fstatSync)(body.fd).size;
+          return (0, import_node_fs6.fstatSync)(body.fd).size;
         }
       }
       throw new Error(`Body Length computation failed for ${body}`);
@@ -6756,11 +6756,11 @@ var init_types = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getHomeDir.js
-var import_node_os2, import_node_path4, homeDirCache, getHomeDirCacheKey, getHomeDir;
+var import_node_os2, import_node_path5, homeDirCache, getHomeDirCacheKey, getHomeDir;
 var init_getHomeDir = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getHomeDir.js"() {
     import_node_os2 = require("node:os");
-    import_node_path4 = require("node:path");
+    import_node_path5 = require("node:path");
     homeDirCache = {};
     getHomeDirCacheKey = () => {
       if (process && process.geteuid) {
@@ -6769,7 +6769,7 @@ var init_getHomeDir = __esm({
       return "DEFAULT";
     };
     getHomeDir = () => {
-      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${import_node_path4.sep}` } = process.env;
+      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${import_node_path5.sep}` } = process.env;
       if (HOME)
         return HOME;
       if (USERPROFILE)
@@ -6795,16 +6795,16 @@ var init_getProfileName = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js
-var import_node_crypto, import_node_path5, getSSOTokenFilepath;
+var import_node_crypto, import_node_path6, getSSOTokenFilepath;
 var init_getSSOTokenFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js"() {
     import_node_crypto = require("node:crypto");
-    import_node_path5 = require("node:path");
+    import_node_path6 = require("node:path");
     init_getHomeDir();
     getSSOTokenFilepath = (id) => {
       const hasher = (0, import_node_crypto.createHash)("sha1");
       const cacheName = hasher.update(id).digest("hex");
-      return (0, import_node_path5.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
+      return (0, import_node_path6.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
     };
   }
 });
@@ -6859,24 +6859,24 @@ var init_getConfigData = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.js
-var import_node_path6, ENV_CONFIG_PATH, getConfigFilepath;
+var import_node_path7, ENV_CONFIG_PATH, getConfigFilepath;
 var init_getConfigFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.js"() {
-    import_node_path6 = require("node:path");
+    import_node_path7 = require("node:path");
     init_getHomeDir();
     ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || (0, import_node_path6.join)(getHomeDir(), ".aws", "config");
+    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || (0, import_node_path7.join)(getHomeDir(), ".aws", "config");
   }
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.js
-var import_node_path7, ENV_CREDENTIALS_PATH, getCredentialsFilepath;
+var import_node_path8, ENV_CREDENTIALS_PATH, getCredentialsFilepath;
 var init_getCredentialsFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.js"() {
-    import_node_path7 = require("node:path");
+    import_node_path8 = require("node:path");
     init_getHomeDir();
     ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || (0, import_node_path7.join)(getHomeDir(), ".aws", "credentials");
+    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || (0, import_node_path8.join)(getHomeDir(), ".aws", "credentials");
   }
 });
 
@@ -6956,10 +6956,10 @@ var init_readFile = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/loadSharedConfigFiles.js
-var import_node_path8, swallowError, loadSharedConfigFiles;
+var import_node_path9, swallowError, loadSharedConfigFiles;
 var init_loadSharedConfigFiles = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/loadSharedConfigFiles.js"() {
-    import_node_path8 = require("node:path");
+    import_node_path9 = require("node:path");
     init_getConfigData();
     init_getConfigFilepath();
     init_getCredentialsFilepath();
@@ -6974,11 +6974,11 @@ var init_loadSharedConfigFiles = __esm({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = (0, import_node_path8.join)(homeDir, filepath.slice(2));
+        resolvedFilepath = (0, import_node_path9.join)(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = (0, import_node_path8.join)(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = (0, import_node_path9.join)(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile2(resolvedConfigFilepath, {
@@ -10082,17 +10082,17 @@ var init_HashCalculator = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/checksum/hash-stream-node/fileStreamHasher.js
-var import_node_fs6, fileStreamHasher, isReadStream;
+var import_node_fs7, fileStreamHasher, isReadStream;
 var init_fileStreamHasher = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/checksum/hash-stream-node/fileStreamHasher.js"() {
-    import_node_fs6 = require("node:fs");
+    import_node_fs7 = require("node:fs");
     init_HashCalculator();
     fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve2, reject) => {
       if (!isReadStream(fileStream)) {
         reject(new Error("Unable to calculate hash for non-file streams."));
         return;
       }
-      const fileStreamTee = (0, import_node_fs6.createReadStream)(fileStream.path, {
+      const fileStreamTee = (0, import_node_fs7.createReadStream)(fileStream.path, {
         start: fileStream.start,
         end: fileStream.end
       });
@@ -26697,7 +26697,7 @@ var require_dist_cjs11 = __commonJS({
     var { createHash: createHash5, createPrivateKey, createPublicKey, sign: sign2 } = require("node:crypto");
     var { promises } = require("node:fs");
     var { homedir: homedir2 } = require("node:os");
-    var { dirname: dirname3, join: join7 } = require("node:path");
+    var { dirname: dirname3, join: join8 } = require("node:path");
     var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
       profileData;
       init;
@@ -26853,10 +26853,10 @@ var require_dist_cjs11 = __commonJS({
         await promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
       }
       getTokenFilePath() {
-        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join7(homedir2(), ".aws", "login", "cache");
+        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join8(homedir2(), ".aws", "login", "cache");
         const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
         const loginSessionSha256 = createHash5("sha256").update(loginSessionBytes).digest("hex");
-        return join7(directory, `${loginSessionSha256}.json`);
+        return join8(directory, `${loginSessionSha256}.json`);
       }
       derToRawSignature(derSignature) {
         let offset = 2;
@@ -33090,16 +33090,134 @@ var fetchState = async (ctx) => {
   return ctx.api.getState(ctx.namespace, ctx.nonce);
 };
 
-// src/qosbin.ts
+// src/atrest.ts
+var import_node_child_process2 = require("node:child_process");
+var DEFAULT_AT_REST_TIMEOUT_MS = 6e4;
+var AtRestError = class extends Error {
+  constructor(binary, code, stdout, stderr) {
+    super(`${binary} failed (exit ${code}): ${stderr || stdout}`);
+    this.binary = binary;
+    this.code = code;
+    this.stdout = stdout;
+    this.stderr = stderr;
+    this.name = "AtRestError";
+  }
+};
+var buildAtRestClient = (options) => {
+  const sealBin = options.sealBin ?? "umbra-seal-share";
+  const unsealBin = options.unsealBin ?? "umbra-unseal-share";
+  const timeout = options.timeoutMs ?? DEFAULT_AT_REST_TIMEOUT_MS;
+  const run2 = (binary, args) => {
+    const result = (0, import_node_child_process2.spawnSync)(binary, [...args], {
+      encoding: "utf8",
+      timeout
+    });
+    const stdout = result.stdout ?? "";
+    const stderr = result.stderr ?? "";
+    if (result.error) {
+      throw new AtRestError(
+        binary,
+        null,
+        stdout,
+        `${stderr}${result.error.message}`
+      );
+    }
+    if (result.status !== 0) {
+      throw new AtRestError(binary, result.status, stdout, stderr);
+    }
+  };
+  return {
+    /**
+     * Wrap a share `qos_client after-genesis` wrote in the at-rest envelope.
+     *
+     * @param request - the share to wrap, the recipient's key file, and the binding it is sealed
+     * under. The index and share count are stated rather than inferred: a single share has no array
+     * to count them from, and both go into the AEAD's associated data, so misstating either fails to
+     * open rather than opening the wrong slot.
+     * @throws {@link AtRestError} when the binary is missing, times out, or exits non-zero — which
+     * includes an index outside the share set and a key file with no `encryptionPublicKey`.
+     * @example
+     * ```ts
+     * atRest.seal({
+     *   sharePath: wd.path("p1.share"),
+     *   encryptionKeyPath: "~/.umbra/operator-encryption.json",
+     *   operatorPublicKeyHex: members.p1,
+     *   quorumKeyPath: wd.path("namespace/quorum_key.pub"),
+     *   threshold: 2, shareCount: 3, index: 1,
+     *   outPath: wd.path("p1.share.sealed"),
+     * });
+     * ```
+     */
+    seal: (request) => run2(sealBin, [
+      "--share",
+      request.sharePath,
+      "--key",
+      request.encryptionKeyPath,
+      "--operator-public-key",
+      request.operatorPublicKeyHex,
+      "--quorum-key-path",
+      request.quorumKeyPath,
+      "--threshold",
+      String(request.threshold),
+      "--share-count",
+      String(request.shareCount),
+      "--index",
+      String(request.index),
+      "--out",
+      request.outPath
+    ]),
+    /**
+     * Peel the at-rest envelope back off, writing the raw QOS envelope `qos_client` expects.
+     *
+     * @param request - the sealed share, the operator's key file, and where to write the recovered
+     * envelope. `challengeCommand` is required only when the key file stores a salt rather than a
+     * seed, and overrides the command recorded in the file if the device moved.
+     * @throws {@link AtRestError} when the binary is missing, times out, or exits non-zero — which
+     * includes the envelope failing to open, whether from the wrong key, a restated binding, or a
+     * tampered ciphertext. Those are deliberately indistinguishable.
+     * @example
+     * ```ts
+     * atRest.unseal({
+     *   sealedPath: wd.path("p1.share.sealed"),
+     *   encryptionKeyPath: "~/.umbra/operator-encryption.json",
+     *   outPath: wd.path("p1.share"),
+     * });
+     * ```
+     */
+    unseal: (request) => run2(unsealBin, [
+      "--response",
+      request.sealedPath,
+      "--key",
+      request.encryptionKeyPath,
+      "--out",
+      request.outPath,
+      "--format",
+      "qos",
+      ...request.challengeCommand ? ["--challenge-command", request.challengeCommand] : []
+    ])
+  };
+};
+var createAtRestClient = (options = {}) => buildAtRestClient(options);
+
+// src/atrestbin.ts
 var import_node_fs3 = require("node:fs");
 var import_node_path2 = require("node:path");
-var resolveQosBin = (explicit) => {
+var ensureExecutable = (path) => {
+  try {
+    const mode = (0, import_node_fs3.statSync)(path).mode;
+    if ((mode & 73) !== 73) (0, import_node_fs3.chmodSync)(path, mode | 493);
+  } catch {
+    return;
+  }
+};
+var resolveAtRestBin = (tool, explicit) => {
   if (explicit) return explicit;
-  if (process.env.QOS_CLIENT_BIN) return process.env.QOS_CLIENT_BIN;
+  const fromEnv2 = process.env[`${tool.toUpperCase().replaceAll("-", "_")}_BIN`];
+  if (fromEnv2) return fromEnv2;
   const embedded = (0, import_node_path2.join)(
     __dirname,
     "bin",
-    `qos_client-${process.platform}-${process.arch}`
+    `${tool}-${process.platform}-${process.arch}`
   );
   if ((0, import_node_fs3.existsSync)(embedded)) {
     ensureExecutable(embedded);
@@ -33107,10 +33225,28 @@ var resolveQosBin = (explicit) => {
   }
   return void 0;
 };
-var ensureExecutable = (path) => {
+
+// src/qosbin.ts
+var import_node_fs4 = require("node:fs");
+var import_node_path3 = require("node:path");
+var resolveQosBin = (explicit) => {
+  if (explicit) return explicit;
+  if (process.env.QOS_CLIENT_BIN) return process.env.QOS_CLIENT_BIN;
+  const embedded = (0, import_node_path3.join)(
+    __dirname,
+    "bin",
+    `qos_client-${process.platform}-${process.arch}`
+  );
+  if ((0, import_node_fs4.existsSync)(embedded)) {
+    ensureExecutable2(embedded);
+    return embedded;
+  }
+  return void 0;
+};
+var ensureExecutable2 = (path) => {
   try {
-    const mode = (0, import_node_fs3.statSync)(path).mode;
-    if ((mode & 73) !== 73) (0, import_node_fs3.chmodSync)(path, mode | 493);
+    const mode = (0, import_node_fs4.statSync)(path).mode;
+    if ((mode & 73) !== 73) (0, import_node_fs4.chmodSync)(path, mode | 493);
   } catch {
     return;
   }
@@ -33141,15 +33277,25 @@ var resolve = (o3) => {
       "--secret-path / CEREMONY_SECRET"
     )
   };
+  const sealBin = resolveAtRestBin("umbra-seal-share", o3.sealShareBin);
+  const unsealBin = resolveAtRestBin("umbra-unseal-share", o3.unsealShareBin);
+  const atRest = createAtRestClient({
+    ...sealBin ? { sealBin } : {},
+    ...unsealBin ? { unsealBin } : {}
+  });
+  const encryptionKeyPath = o3.encryptionKeyPath ?? process.env.CEREMONY_ENCRYPTION_KEY;
   return {
     api,
     qos,
+    atRest,
     namespace,
     nonce,
     alias,
     secret,
     pcr3PreimagePath: req(o3.pcr3PreimagePath, "--pcr3-preimage-path"),
     qosReleaseDir: req(o3.qosReleaseDir, "--qos-release-dir"),
+    ...encryptionKeyPath ? { encryptionKeyPath } : {},
+    ...o3.challengeCommand ? { challengeCommand: o3.challengeCommand } : {},
     unsafeEphPathOverride: o3.unsafeEphPathOverride
   };
 };
@@ -33236,25 +33382,40 @@ var approve = async (o3) => {
   }
 };
 
+// src/commands/at-rest-tool.ts
+var import_node_child_process3 = require("node:child_process");
+var runAtRestTool = (tool, args) => {
+  const binary = resolveAtRestBin(tool) ?? tool;
+  const result = (0, import_node_child_process3.spawnSync)(binary, [...args], { stdio: "inherit" });
+  if (result.error) {
+    console.error(
+      `error: could not run ${binary}: ${result.error.message}
+This platform has no embedded build; install ${tool} on PATH or pass its path.`
+    );
+    process.exit(127);
+  }
+  process.exit(result.status ?? 1);
+};
+
 // src/commands/keygen.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path4 = require("node:path");
 var keygen = async (o3) => {
   const alias = o3.alias ?? process.env.CEREMONY_ALIAS ?? "operator";
   const secretPath = o3.secretPath ?? process.env.CEREMONY_SECRET;
   if (!secretPath) {
     throw new Error("keygen requires --secret-path (env CEREMONY_SECRET)");
   }
-  if ((0, import_node_fs4.existsSync)(secretPath)) {
+  if ((0, import_node_fs5.existsSync)(secretPath)) {
     throw new Error(
       `refusing to overwrite existing secret at ${secretPath} \u2014 you already have a key; give its pubkey (${secretPath}.pub) to an admin to register-operator`
     );
   }
-  (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(secretPath), { recursive: true, mode: 448 });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path4.dirname)(secretPath), { recursive: true, mode: 448 });
   const qos = createQosClient({ bin: resolveQosBin(o3.qosClient) });
   const pubPath = `${secretPath}.pub`;
   qos.generateFileKey(secretPath, pubPath);
-  const pubHex = (0, import_node_fs4.readFileSync)(pubPath, "utf8").trim();
+  const pubHex = (0, import_node_fs5.readFileSync)(pubPath, "utf8").trim();
   console.log(
     `keygen: seed written to ${secretPath} (keep it safe \u2014 it never leaves this device)`
   );
@@ -33289,12 +33450,23 @@ var provision = async (o3) => {
       "manifest/manifest_envelope",
       "manifest_envelope"
     );
-    const sharePath = await pullShared(
+    const sealedPath = await pullShared(
       ctx,
       wd,
       `shares/${ctx.alias}.share`,
-      `${ctx.alias}.share`
+      `${ctx.alias}.share.sealed`
     );
+    if (!ctx.encryptionKeyPath)
+      throw new Error(
+        "missing --encryption-key-path / CEREMONY_ENCRYPTION_KEY \u2014 the stored share is sealed under the at-rest layer and must be opened before it can be re-encrypted"
+      );
+    const sharePath = wd.path(`${ctx.alias}.share`);
+    ctx.atRest.unseal({
+      sealedPath,
+      encryptionKeyPath: ctx.encryptionKeyPath,
+      outPath: sharePath,
+      ...ctx.challengeCommand ? { challengeCommand: ctx.challengeCommand } : {}
+    });
     const { manifestSetDir } = await buildSetDirs(ctx, wd, state2.sets);
     const ephWrappedSharePath = wd.path(`${ctx.alias}.eph_share`);
     const approvalPath = wd.path(`${ctx.alias}.attestation.approval`);
@@ -33333,8 +33505,27 @@ var provision = async (o3) => {
 };
 
 // src/commands/share.ts
+var requireEncryptionKeyPath = (ctx) => {
+  if (!ctx.encryptionKeyPath)
+    throw new Error(
+      "missing --encryption-key-path / CEREMONY_ENCRYPTION_KEY \u2014 the share is sealed under the at-rest layer before upload; mint the key with umbra-encryption-key"
+    );
+  return ctx.encryptionKeyPath;
+};
 var share = async (o3) => {
   const ctx = resolve(o3);
+  const encryptionKeyPath = requireEncryptionKeyPath(ctx);
+  const state2 = await fetchState(ctx);
+  const shareSet = state2.sets.share;
+  const index = shareSet.members.indexOf(ctx.alias);
+  if (index < 0)
+    throw new Error(
+      `'${ctx.alias}' is not in the share set (${shareSet.members.join(", ")})`
+    );
+  const members = await ctx.api.getMembers(ctx.namespace, ctx.nonce);
+  const operatorPublicKeyHex = members[ctx.alias];
+  if (!operatorPublicKeyHex)
+    throw new Error(`no registered public key for operator '${ctx.alias}'`);
   const wd = createWorkdir("ceremony-share-");
   try {
     const namespaceDir = await pullGenesisDir(ctx, wd);
@@ -33347,13 +33538,32 @@ var share = async (o3) => {
       qosReleaseDir: ctx.qosReleaseDir,
       secret: ctx.secret
     });
-    const shareB64 = wd.readBytes(`${ctx.alias}.share`).toString("base64");
+    const quorumKeyPath = wd.path("namespace/quorum_key.pub");
+    try {
+      wd.readBytes("namespace/quorum_key.pub");
+    } catch {
+      throw new Error(
+        "the namespace has no _shared/quorum_key.pub \u2014 genesis has not published the quorum key, so the at-rest binding cannot be built"
+      );
+    }
+    const sealedRel = `${ctx.alias}.share.sealed`;
+    ctx.atRest.seal({
+      sharePath,
+      encryptionKeyPath,
+      operatorPublicKeyHex,
+      quorumKeyPath,
+      threshold: shareSet.threshold,
+      shareCount: shareSet.members.length,
+      index,
+      outPath: wd.path(sealedRel)
+    });
+    const shareB64 = wd.readBytes(sealedRel).toString("base64");
     await ctx.api.putShare(ctx.namespace, ctx.nonce, ctx.alias, shareB64, {
       secret: ctx.secret,
       qos: ctx.qos
     });
     console.log(
-      `share: derived + uploaded encrypted share for '${ctx.alias}' (${ctx.namespace}/${ctx.nonce})`
+      `share: derived + sealed + uploaded share ${index} of ${shareSet.members.length} for '${ctx.alias}' (${ctx.namespace}/${ctx.nonce})`
     );
   } finally {
     wd.cleanup();
@@ -33587,6 +33797,18 @@ var withCommon = (cmd) => {
   ).option("--yubikey", "use a YubiKey PIV key instead of a seed file").option("--pcr3-preimage-path <path>", "PCR3 preimage (IAM role ARN) file").option("--qos-release-dir <dir>", "QOS release dir (aws-x86_64.pcrs)").option(
     "--qos-client <bin>",
     "qos_client binary path (env QOS_CLIENT_BIN; else embedded/PATH)"
+  ).option(
+    "--encryption-key-path <path>",
+    "operator at-rest encryption key file from umbra-encryption-key (env CEREMONY_ENCRYPTION_KEY)"
+  ).option(
+    "--challenge-command <cmd>",
+    "challenge-response command when the encryption key derives from hardware"
+  ).option(
+    "--seal-share-bin <bin>",
+    "umbra-seal-share binary path (env UMBRA_SEAL_SHARE_BIN; else PATH)"
+  ).option(
+    "--unseal-share-bin <bin>",
+    "umbra-unseal-share binary path (env UMBRA_UNSEAL_SHARE_BIN; else PATH)"
   ).option(
     "--unsafe-eph-path-override <path>",
     "[dev/mock only] read enclave ephemeral pubkey from this file"
@@ -33605,7 +33827,7 @@ withCommon(
 ).action(run(keygen));
 withCommon(
   program2.command("share").description(
-    "derive quorum-key share from genesis output; upload (encrypted)"
+    "derive quorum-key share from genesis output; seal it and upload (double-sealed)"
   )
 ).action(run(share));
 withCommon(
@@ -33613,7 +33835,7 @@ withCommon(
 ).action(run(approve));
 withCommon(
   program2.command("provision").description(
-    "re-encrypt share to the enclave ephemeral key; post it (shareSet)"
+    "open the stored share and re-encrypt it to the enclave ephemeral key; post it (shareSet)"
   )
 ).action(run(provision));
 program2.command("status").description("show ceremony phase + blockers (read-only)").option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").action(run(status));
@@ -33635,6 +33857,24 @@ program2.command("shift-traffic").description(
   "--force",
   "skip the target-health precheck (allow shifting to a 0-healthy color)"
 ).action(run(shiftTrafficCommand));
+var atRestPassthrough = (name, command5, summary) => {
+  program2.command(command5).description(summary).allowUnknownOption().allowExcessArguments().helpOption(false).action(() => runAtRestTool(name, process.argv.slice(3)));
+};
+atRestPassthrough(
+  "umbra-encryption-key",
+  "encryption-key",
+  "mint or recover this operator's at-rest encryption key (run with --help for its flags)"
+);
+atRestPassthrough(
+  "umbra-seal-share",
+  "seal-share",
+  "wrap a share from qos_client after-genesis in the at-rest layer (--help for its flags)"
+);
+atRestPassthrough(
+  "umbra-unseal-share",
+  "unseal-share",
+  "peel the at-rest layer off a share, for tvc or qos (--help for its flags)"
+);
 program2.parseAsync(process.argv).catch((e5) => {
   console.error(e5);
   process.exit(1);

package/package.json

@@ -1,13 +1,15 @@
 {
   "name": "@umbra-privacy/qos-ceremony",
-  "version": "0.1.4",
-  "description": "QOS TEE operator ceremony CLI — keygen/share/approve/provision + shift-traffic over the coordinator API. All crypto runs in qos_client (embedded for common platforms); your private key never leaves the device. Ships NO coordinator code.",
+  "version": "0.2.0",
+  "description": "QOS TEE operator ceremony CLI — keygen/share/approve/provision + shift-traffic over the coordinator API, and the at-rest sealing tools. Shares are double-sealed everywhere they rest: ML-KEM-1024 over the QOS P-256 envelope. All crypto runs in embedded binaries (qos_client, umbra-encryption-key, umbra-seal-share, umbra-unseal-share); your private key never leaves the device. Ships NO coordinator code.",
   "keywords": [
     "qos",
     "tee",
     "nitro-enclave",
     "quorum",
     "ceremony",
+    "post-quantum",
+    "ml-kem",
     "umbra"
   ],
   "license": "MIT",