@umbra-privacy/qos-ceremony 0.2.0 → 0.3.0

package/dist-cli/cli.js

@@ -6437,10 +6437,10 @@ var init_hex_encoding = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js
-var import_node_fs6, calculateBodyLength;
+var import_node_fs7, calculateBodyLength;
 var init_calculateBodyLength = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js"() {
-    import_node_fs6 = require("node:fs");
+    import_node_fs7 = require("node:fs");
     calculateBodyLength = (body) => {
       if (!body) {
         return 0;
@@ -6453,11 +6453,11 @@ var init_calculateBodyLength = __esm({
         return body.size;
       } else if (typeof body.start === "number" && typeof body.end === "number") {
         return body.end + 1 - body.start;
-      } else if (body instanceof import_node_fs6.ReadStream) {
+      } else if (body instanceof import_node_fs7.ReadStream) {
         if (body.path != null) {
-          return (0, import_node_fs6.lstatSync)(body.path).size;
+          return (0, import_node_fs7.lstatSync)(body.path).size;
         } else if (typeof body.fd === "number") {
-          return (0, import_node_fs6.fstatSync)(body.fd).size;
+          return (0, import_node_fs7.fstatSync)(body.fd).size;
         }
       }
       throw new Error(`Body Length computation failed for ${body}`);
@@ -6756,11 +6756,11 @@ var init_types = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getHomeDir.js
-var import_node_os2, import_node_path5, homeDirCache, getHomeDirCacheKey, getHomeDir;
+var import_node_os2, import_node_path6, homeDirCache, getHomeDirCacheKey, getHomeDir;
 var init_getHomeDir = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getHomeDir.js"() {
     import_node_os2 = require("node:os");
-    import_node_path5 = require("node:path");
+    import_node_path6 = require("node:path");
     homeDirCache = {};
     getHomeDirCacheKey = () => {
       if (process && process.geteuid) {
@@ -6769,7 +6769,7 @@ var init_getHomeDir = __esm({
       return "DEFAULT";
     };
     getHomeDir = () => {
-      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${import_node_path5.sep}` } = process.env;
+      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${import_node_path6.sep}` } = process.env;
       if (HOME)
         return HOME;
       if (USERPROFILE)
@@ -6795,16 +6795,16 @@ var init_getProfileName = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js
-var import_node_crypto, import_node_path6, getSSOTokenFilepath;
+var import_node_crypto, import_node_path7, getSSOTokenFilepath;
 var init_getSSOTokenFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js"() {
     import_node_crypto = require("node:crypto");
-    import_node_path6 = require("node:path");
+    import_node_path7 = require("node:path");
     init_getHomeDir();
     getSSOTokenFilepath = (id) => {
       const hasher = (0, import_node_crypto.createHash)("sha1");
       const cacheName = hasher.update(id).digest("hex");
-      return (0, import_node_path6.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
+      return (0, import_node_path7.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
     };
   }
 });
@@ -6859,24 +6859,24 @@ var init_getConfigData = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.js
-var import_node_path7, ENV_CONFIG_PATH, getConfigFilepath;
+var import_node_path8, ENV_CONFIG_PATH, getConfigFilepath;
 var init_getConfigFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.js"() {
-    import_node_path7 = require("node:path");
+    import_node_path8 = require("node:path");
     init_getHomeDir();
     ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || (0, import_node_path7.join)(getHomeDir(), ".aws", "config");
+    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || (0, import_node_path8.join)(getHomeDir(), ".aws", "config");
   }
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.js
-var import_node_path8, ENV_CREDENTIALS_PATH, getCredentialsFilepath;
+var import_node_path9, ENV_CREDENTIALS_PATH, getCredentialsFilepath;
 var init_getCredentialsFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.js"() {
-    import_node_path8 = require("node:path");
+    import_node_path9 = require("node:path");
     init_getHomeDir();
     ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || (0, import_node_path8.join)(getHomeDir(), ".aws", "credentials");
+    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || (0, import_node_path9.join)(getHomeDir(), ".aws", "credentials");
   }
 });
 
@@ -6956,10 +6956,10 @@ var init_readFile = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/loadSharedConfigFiles.js
-var import_node_path9, swallowError, loadSharedConfigFiles;
+var import_node_path10, swallowError, loadSharedConfigFiles;
 var init_loadSharedConfigFiles = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/loadSharedConfigFiles.js"() {
-    import_node_path9 = require("node:path");
+    import_node_path10 = require("node:path");
     init_getConfigData();
     init_getConfigFilepath();
     init_getCredentialsFilepath();
@@ -6974,11 +6974,11 @@ var init_loadSharedConfigFiles = __esm({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = (0, import_node_path9.join)(homeDir, filepath.slice(2));
+        resolvedFilepath = (0, import_node_path10.join)(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = (0, import_node_path9.join)(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = (0, import_node_path10.join)(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile2(resolvedConfigFilepath, {
@@ -10082,17 +10082,17 @@ var init_HashCalculator = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/checksum/hash-stream-node/fileStreamHasher.js
-var import_node_fs7, fileStreamHasher, isReadStream;
+var import_node_fs8, fileStreamHasher, isReadStream;
 var init_fileStreamHasher = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/checksum/hash-stream-node/fileStreamHasher.js"() {
-    import_node_fs7 = require("node:fs");
+    import_node_fs8 = require("node:fs");
     init_HashCalculator();
     fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve2, reject) => {
       if (!isReadStream(fileStream)) {
         reject(new Error("Unable to calculate hash for non-file streams."));
         return;
       }
-      const fileStreamTee = (0, import_node_fs7.createReadStream)(fileStream.path, {
+      const fileStreamTee = (0, import_node_fs8.createReadStream)(fileStream.path, {
         start: fileStream.start,
         end: fileStream.end
       });
@@ -12311,8 +12311,8 @@ var init_requestBuilder = __esm({
       async build() {
         const { hostname, protocol = "https", port, path: basePath } = await this.context.endpoint();
         this.path = basePath;
-        for (const resolvePath of this.resolvePathStack) {
-          resolvePath(this.path);
+        for (const resolvePath2 of this.resolvePathStack) {
+          resolvePath2(this.path);
         }
         return new HttpRequest({
           protocol,
@@ -26697,7 +26697,7 @@ var require_dist_cjs11 = __commonJS({
     var { createHash: createHash5, createPrivateKey, createPublicKey, sign: sign2 } = require("node:crypto");
     var { promises } = require("node:fs");
     var { homedir: homedir2 } = require("node:os");
-    var { dirname: dirname3, join: join8 } = require("node:path");
+    var { dirname: dirname4, join: join9 } = require("node:path");
     var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
       profileData;
       init;
@@ -26845,7 +26845,7 @@ var require_dist_cjs11 = __commonJS({
       }
       async saveToken(token) {
         const tokenFilePath = this.getTokenFilePath();
-        const directory = dirname3(tokenFilePath);
+        const directory = dirname4(tokenFilePath);
         try {
           await promises.mkdir(directory, { recursive: true });
         } catch (error2) {
@@ -26853,10 +26853,10 @@ var require_dist_cjs11 = __commonJS({
         await promises.writeFile(tokenFilePath, JSON.stringify(token, null, 2), "utf8");
       }
       getTokenFilePath() {
-        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join8(homedir2(), ".aws", "login", "cache");
+        const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join9(homedir2(), ".aws", "login", "cache");
         const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
         const loginSessionSha256 = createHash5("sha256").update(loginSessionBytes).digest("hex");
-        return join8(directory, `${loginSessionSha256}.json`);
+        return join9(directory, `${loginSessionSha256}.json`);
       }
       derToRawSignature(derSignature) {
         let offset = 2;
@@ -33382,6 +33382,49 @@ var approve = async (o3) => {
   }
 };
 
+// src/commands/fetch-config.ts
+var import_node_fs5 = require("node:fs");
+var import_node_path4 = require("node:path");
+var FILES = [
+  { artifact: "config/pcr3_preimage", local: "pcr3_preimage" },
+  {
+    artifact: "config/qos_release/aws-x86_64.pcrs",
+    local: "qos_release/aws-x86_64.pcrs"
+  }
+];
+var fetchConfig = async (o3) => {
+  const apiUrl = o3.api ?? process.env.CEREMONY_API;
+  const namespace = o3.namespace ?? process.env.CEREMONY_NAMESPACE;
+  const nonceStr = o3.nonce ?? process.env.CEREMONY_NONCE;
+  if (!apiUrl || !namespace || !nonceStr)
+    throw new Error("fetch-config requires --api --namespace --nonce");
+  const outDir = (0, import_node_path4.resolve)(o3.out ?? ".");
+  const api = createCeremonyApi(apiUrl);
+  const nonce = Number(nonceStr);
+  for (const f5 of FILES) {
+    const bytes = await api.getArtifact(namespace, nonce, f5.artifact);
+    const target = (0, import_node_path4.join)(outDir, f5.local);
+    (0, import_node_fs5.mkdirSync)((0, import_node_path4.dirname)(target), { recursive: true });
+    (0, import_node_fs5.writeFileSync)(target, bytes);
+    console.log(`fetch-config: wrote ${target} (${bytes.length} bytes)`);
+  }
+  console.log("");
+  console.log("Pass these to every operator command:");
+  console.log(
+    `  --pcr3-preimage-path ${(0, import_node_path4.join)(outDir, "pcr3_preimage")} --qos-release-dir ${(0, import_node_path4.join)(outDir, "qos_release")}`
+  );
+  console.log("");
+  console.log(
+    "These are the values you check the enclave's attestation AGAINST. Fetching them from the"
+  );
+  console.log(
+    "pipeline that deployed it is convenience, not proof \u2014 for a production ceremony, derive the"
+  );
+  console.log(
+    "role ARN from the stack and the PCRs from the reproducible qos build, and diff them."
+  );
+};
+
 // src/commands/at-rest-tool.ts
 var import_node_child_process3 = require("node:child_process");
 var runAtRestTool = (tool, args) => {
@@ -33398,24 +33441,24 @@ This platform has no embedded build; install ${tool} on PATH or pass its path.`
 };
 
 // src/commands/keygen.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path5 = require("node:path");
 var keygen = async (o3) => {
   const alias = o3.alias ?? process.env.CEREMONY_ALIAS ?? "operator";
   const secretPath = o3.secretPath ?? process.env.CEREMONY_SECRET;
   if (!secretPath) {
     throw new Error("keygen requires --secret-path (env CEREMONY_SECRET)");
   }
-  if ((0, import_node_fs5.existsSync)(secretPath)) {
+  if ((0, import_node_fs6.existsSync)(secretPath)) {
     throw new Error(
       `refusing to overwrite existing secret at ${secretPath} \u2014 you already have a key; give its pubkey (${secretPath}.pub) to an admin to register-operator`
     );
   }
-  (0, import_node_fs5.mkdirSync)((0, import_node_path4.dirname)(secretPath), { recursive: true, mode: 448 });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.dirname)(secretPath), { recursive: true, mode: 448 });
   const qos = createQosClient({ bin: resolveQosBin(o3.qosClient) });
   const pubPath = `${secretPath}.pub`;
   qos.generateFileKey(secretPath, pubPath);
-  const pubHex = (0, import_node_fs5.readFileSync)(pubPath, "utf8").trim();
+  const pubHex = (0, import_node_fs6.readFileSync)(pubPath, "utf8").trim();
   console.log(
     `keygen: seed written to ${secretPath} (keep it safe \u2014 it never leaves this device)`
   );
@@ -33838,6 +33881,9 @@ withCommon(
     "open the stored share and re-encrypt it to the enclave ephemeral key; post it (shareSet)"
   )
 ).action(run(provision));
+program2.command("fetch-config").description(
+  "download the ceremony's public release files (pcr3_preimage + qos_release) \u2014 no AWS creds needed"
+).option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").option("--out <dir>", "directory to write into (default: cwd)").action(run(fetchConfig));
 program2.command("status").description("show ceremony phase + blockers (read-only)").option("--api <url>", "coordinator API base URL (env CEREMONY_API)").option("--namespace <ns>", "ceremony namespace (env CEREMONY_NAMESPACE)").option("--nonce <n>", "manifest nonce (env CEREMONY_NONCE)").action(run(status));
 program2.command("shift-traffic").description(
   "[ops] blue-green weighted traffic cutover across a service's colors (needs AWS creds)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umbra-privacy/qos-ceremony",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "QOS TEE operator ceremony CLI — keygen/share/approve/provision + shift-traffic over the coordinator API, and the at-rest sealing tools. Shares are double-sealed everywhere they rest: ML-KEM-1024 over the QOS P-256 envelope. All crypto runs in embedded binaries (qos_client, umbra-encryption-key, umbra-seal-share, umbra-unseal-share); your private key never leaves the device. Ships NO coordinator code.",
   "keywords": [
     "qos",