@umbra-privacy/qos-ceremony 0.4.0 → 0.5.0

package/dist-cli/cli.js

@@ -6437,10 +6437,10 @@ var init_hex_encoding = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js
-var import_node_fs10, calculateBodyLength;
+var import_node_fs11, calculateBodyLength;
 var init_calculateBodyLength = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/serde/util-body-length/calculateBodyLength.js"() {
-    import_node_fs10 = require("node:fs");
+    import_node_fs11 = require("node:fs");
     calculateBodyLength = (body) => {
       if (!body) {
         return 0;
@@ -6453,11 +6453,11 @@ var init_calculateBodyLength = __esm({
         return body.size;
       } else if (typeof body.start === "number" && typeof body.end === "number") {
         return body.end + 1 - body.start;
-      } else if (body instanceof import_node_fs10.ReadStream) {
+      } else if (body instanceof import_node_fs11.ReadStream) {
         if (body.path != null) {
-          return (0, import_node_fs10.lstatSync)(body.path).size;
+          return (0, import_node_fs11.lstatSync)(body.path).size;
         } else if (typeof body.fd === "number") {
-          return (0, import_node_fs10.fstatSync)(body.fd).size;
+          return (0, import_node_fs11.fstatSync)(body.fd).size;
         }
       }
       throw new Error(`Body Length computation failed for ${body}`);
@@ -6756,11 +6756,11 @@ var init_types = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getHomeDir.js
-var import_node_os4, import_node_path7, homeDirCache, getHomeDirCacheKey, getHomeDir;
+var import_node_os4, import_node_path8, homeDirCache, getHomeDirCacheKey, getHomeDir;
 var init_getHomeDir = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getHomeDir.js"() {
     import_node_os4 = require("node:os");
-    import_node_path7 = require("node:path");
+    import_node_path8 = require("node:path");
     homeDirCache = {};
     getHomeDirCacheKey = () => {
       if (process && process.geteuid) {
@@ -6769,7 +6769,7 @@ var init_getHomeDir = __esm({
       return "DEFAULT";
     };
     getHomeDir = () => {
-      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${import_node_path7.sep}` } = process.env;
+      const { HOME, USERPROFILE, HOMEPATH, HOMEDRIVE = `C:${import_node_path8.sep}` } = process.env;
       if (HOME)
         return HOME;
       if (USERPROFILE)
@@ -6795,16 +6795,16 @@ var init_getProfileName = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js
-var import_node_crypto, import_node_path8, getSSOTokenFilepath;
+var import_node_crypto, import_node_path9, getSSOTokenFilepath;
 var init_getSSOTokenFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js"() {
     import_node_crypto = require("node:crypto");
-    import_node_path8 = require("node:path");
+    import_node_path9 = require("node:path");
     init_getHomeDir();
     getSSOTokenFilepath = (id) => {
       const hasher = (0, import_node_crypto.createHash)("sha1");
       const cacheName = hasher.update(id).digest("hex");
-      return (0, import_node_path8.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
+      return (0, import_node_path9.join)(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
     };
   }
 });
@@ -6859,24 +6859,24 @@ var init_getConfigData = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.js
-var import_node_path9, ENV_CONFIG_PATH, getConfigFilepath;
+var import_node_path10, ENV_CONFIG_PATH, getConfigFilepath;
 var init_getConfigFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getConfigFilepath.js"() {
-    import_node_path9 = require("node:path");
+    import_node_path10 = require("node:path");
     init_getHomeDir();
     ENV_CONFIG_PATH = "AWS_CONFIG_FILE";
-    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || (0, import_node_path9.join)(getHomeDir(), ".aws", "config");
+    getConfigFilepath = () => process.env[ENV_CONFIG_PATH] || (0, import_node_path10.join)(getHomeDir(), ".aws", "config");
   }
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.js
-var import_node_path10, ENV_CREDENTIALS_PATH, getCredentialsFilepath;
+var import_node_path11, ENV_CREDENTIALS_PATH, getCredentialsFilepath;
 var init_getCredentialsFilepath = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getCredentialsFilepath.js"() {
-    import_node_path10 = require("node:path");
+    import_node_path11 = require("node:path");
     init_getHomeDir();
     ENV_CREDENTIALS_PATH = "AWS_SHARED_CREDENTIALS_FILE";
-    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || (0, import_node_path10.join)(getHomeDir(), ".aws", "credentials");
+    getCredentialsFilepath = () => process.env[ENV_CREDENTIALS_PATH] || (0, import_node_path11.join)(getHomeDir(), ".aws", "credentials");
   }
 });
 
@@ -6956,10 +6956,10 @@ var init_readFile = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/loadSharedConfigFiles.js
-var import_node_path11, swallowError, loadSharedConfigFiles;
+var import_node_path12, swallowError, loadSharedConfigFiles;
 var init_loadSharedConfigFiles = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/loadSharedConfigFiles.js"() {
-    import_node_path11 = require("node:path");
+    import_node_path12 = require("node:path");
     init_getConfigData();
     init_getConfigFilepath();
     init_getCredentialsFilepath();
@@ -6974,11 +6974,11 @@ var init_loadSharedConfigFiles = __esm({
       const relativeHomeDirPrefix = "~/";
       let resolvedFilepath = filepath;
       if (filepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedFilepath = (0, import_node_path11.join)(homeDir, filepath.slice(2));
+        resolvedFilepath = (0, import_node_path12.join)(homeDir, filepath.slice(2));
       }
       let resolvedConfigFilepath = configFilepath;
       if (configFilepath.startsWith(relativeHomeDirPrefix)) {
-        resolvedConfigFilepath = (0, import_node_path11.join)(homeDir, configFilepath.slice(2));
+        resolvedConfigFilepath = (0, import_node_path12.join)(homeDir, configFilepath.slice(2));
       }
       const parsedFiles = await Promise.all([
         readFile2(resolvedConfigFilepath, {
@@ -10082,17 +10082,17 @@ var init_HashCalculator = __esm({
 });
 
 // ../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/checksum/hash-stream-node/fileStreamHasher.js
-var import_node_fs11, fileStreamHasher, isReadStream;
+var import_node_fs12, fileStreamHasher, isReadStream;
 var init_fileStreamHasher = __esm({
   "../../../node_modules/.pnpm/@smithy+core@3.29.6/node_modules/@smithy/core/dist-es/submodules/checksum/hash-stream-node/fileStreamHasher.js"() {
-    import_node_fs11 = require("node:fs");
+    import_node_fs12 = require("node:fs");
     init_HashCalculator();
     fileStreamHasher = (hashCtor, fileStream) => new Promise((resolve2, reject) => {
       if (!isReadStream(fileStream)) {
         reject(new Error("Unable to calculate hash for non-file streams."));
         return;
       }
-      const fileStreamTee = (0, import_node_fs11.createReadStream)(fileStream.path, {
+      const fileStreamTee = (0, import_node_fs12.createReadStream)(fileStream.path, {
         start: fileStream.start,
         end: fileStream.end
       });
@@ -26697,7 +26697,7 @@ var require_dist_cjs11 = __commonJS({
     var { createHash: createHash5, createPrivateKey, createPublicKey, sign: sign2 } = require("node:crypto");
     var { promises } = require("node:fs");
     var { homedir: homedir3 } = require("node:os");
-    var { dirname: dirname5, join: join11 } = require("node:path");
+    var { dirname: dirname6, join: join11 } = require("node:path");
     var LoginCredentialsFetcher = class _LoginCredentialsFetcher {
       profileData;
       init;
@@ -26845,7 +26845,7 @@ var require_dist_cjs11 = __commonJS({
       }
       async saveToken(token) {
         const tokenFilePath = this.getTokenFilePath();
-        const directory = dirname5(tokenFilePath);
+        const directory = dirname6(tokenFilePath);
         try {
           await promises.mkdir(directory, { recursive: true });
         } catch (error2) {
@@ -32821,12 +32821,18 @@ var parseMembersDoc = (value) => {
     Object.entries(operators).map(([alias, entry]) => {
       if (!isRecord(entry))
         throw new Error(`members: '${alias}' is not an object`);
-      const { pubkeyHex, encryptionKey } = entry;
+      const { pubkeyHex, encryptionKey, encryptionKeySalt } = entry;
       if (typeof pubkeyHex !== "string" || !HEX.test(pubkeyHex))
         throw new Error(`members: '${alias}' has no hex pubkeyHex`);
       if (encryptionKey !== void 0 && (typeof encryptionKey !== "string" || !HEX.test(encryptionKey)))
         throw new Error(`members: '${alias}' has a non-hex encryptionKey`);
-      const record = encryptionKey === void 0 ? { pubkeyHex } : { pubkeyHex, encryptionKey };
+      if (encryptionKeySalt !== void 0 && (typeof encryptionKeySalt !== "string" || !HEX.test(encryptionKeySalt)))
+        throw new Error(`members: '${alias}' has a non-hex encryptionKeySalt`);
+      const record = {
+        pubkeyHex,
+        ...encryptionKey === void 0 ? {} : { encryptionKey },
+        ...encryptionKeySalt === void 0 ? {} : { encryptionKeySalt }
+      };
       return [alias, record];
     })
   );
@@ -33238,6 +33244,28 @@ var buildAtRestClient = (options) => {
       ],
       Math.max(timeout, MINT_AT_REST_TIMEOUT_MS)
     ).trim(),
+    saltOf: (request) => run2(atRestBin, [
+      "key",
+      request.keyPath,
+      "--print-salt",
+      ...modeArgs(request.mode)
+    ]).trim(),
+    recoverKey: (request) => run2(
+      atRestBin,
+      [
+        "key",
+        request.outPath,
+        "--mode",
+        "hardware",
+        "--salt",
+        request.salt,
+        "--expect-public",
+        request.expectPublic,
+        "--challenge-command",
+        request.challengeCommand
+      ],
+      Math.max(timeout, MINT_AT_REST_TIMEOUT_MS)
+    ).trim(),
     verifyKey: (request) => run2(atRestBin, [
       "key",
       request.keyPath,
@@ -33576,12 +33604,10 @@ var keygen = async (o3) => {
     createQosClient({ bin, timeoutMs: PROVISION_TIMEOUT_MS }),
     o3.provision === true
   );
-  const encryptionKey = ensureAtRestKey(
-    createAtRestFor(o3),
-    keys,
-    o3.challengeCommand
-  );
-  printRegistration(alias, pubHex, encryptionKey);
+  const atRest = createAtRestFor(o3);
+  const encryptionKey = ensureAtRestKey(atRest, keys, o3.challengeCommand);
+  const salt = keys.mode === "hardware" ? atRest.saltOf({ keyPath: keys.encryptionKeyPath, mode: keys.mode }) : void 0;
+  printRegistration(alias, pubHex, encryptionKey, salt);
 };
 var fileIdentity = (qos, secretPath) => {
   const pubPath = `${secretPath}.pub`;
@@ -33626,7 +33652,7 @@ var ensureAtRestKey = (atRest, keys, challengeCommand) => {
   );
   return minted;
 };
-var printRegistration = (alias, pubHex, encryptionKey) => {
+var printRegistration = (alias, pubHex, encryptionKey, salt) => {
   console.log(
     "\nRegister this operator (admin, IAM-gated) so it can join ceremonies:"
   );
@@ -33634,7 +33660,7 @@ var printRegistration = (alias, pubHex, encryptionKey) => {
     "  aws lambda invoke --function-name qos-coordinator-admin-<stack> --cli-binary-format raw-in-base64-out \\"
   );
   console.log(
-    `    --payload '{"action":"register-operator","service":"<namespace>","alias":"${alias}","pubkeyHex":"${pubHex}","encryptionKey":"${encryptionKey}","sets":["manifest","share","patch"]}' /dev/stdout`
+    `    --payload '{"action":"register-operator","service":"<namespace>","alias":"${alias}","pubkeyHex":"${pubHex}","encryptionKey":"${encryptionKey}",` + (salt ? `"encryptionKeySalt":"${salt}",` : "") + `"sets":["manifest","share","patch"]}' /dev/stdout`
   );
 };
 var resolveYubikeyPublic = (qos, provisioner, mayProvision) => {
@@ -33893,15 +33919,82 @@ var provisionTvc = async (o3, deps = {
   }
 };
 
-// src/commands/share.ts
+// src/commands/recover-key.ts
 var import_node_fs9 = require("node:fs");
+var import_node_path7 = require("node:path");
+var localFiles = {
+  exists: import_node_fs9.existsSync,
+  makeDirectory: (path) => {
+    (0, import_node_fs9.mkdirSync)(path, { recursive: true, mode: 448 });
+  }
+};
+var required2 = (value, name) => {
+  if (!value) throw new Error(`recover-key requires ${name}`);
+  return value;
+};
+var recoverKey = async (o3, deps) => {
+  const alias = required2(o3.alias ?? process.env.CEREMONY_ALIAS, "--alias");
+  const namespace = required2(
+    o3.namespace ?? process.env.CEREMONY_NAMESPACE,
+    "--namespace"
+  );
+  const keys = resolveOperatorKeys(o3, alias);
+  if (keys.mode !== "hardware")
+    throw new Error(
+      "recover-key rebuilds a --yubikey key file from its registered salt; a --secret-path key file holds the seed itself, which no registry has, so it can only come from your backup"
+    );
+  const files = deps?.files ?? localFiles;
+  if (files.exists(keys.encryptionKeyPath))
+    throw new Error(
+      `${keys.encryptionKeyPath} already exists \u2014 nothing to recover; \`keygen --yubikey\` re-derives it from the device to prove it still matches`
+    );
+  const { atRest, api } = deps ?? {
+    files,
+    atRest: createAtRestFor(o3),
+    api: createCeremonyApi(
+      required2(o3.api ?? process.env.CEREMONY_API, "--api")
+    )
+  };
+  const record = (await api.getMemberRecords(namespace, 0))[alias];
+  if (!record) throw new Error(`'${alias}' is not registered for ${namespace}`);
+  if (!record.encryptionKey || !record.encryptionKeySalt)
+    throw new Error(
+      `the ${namespace} registry holds no encryptionKeySalt for '${alias}', so there is nothing to recover from \u2014 restore the key file from its backup, and re-register with the payload \`qos-ceremony keygen\` prints so the salt is on record next time`
+    );
+  files.makeDirectory((0, import_node_path7.dirname)(keys.encryptionKeyPath));
+  atRest.recoverKey({
+    outPath: keys.encryptionKeyPath,
+    salt: record.encryptionKeySalt,
+    expectPublic: record.encryptionKey,
+    challengeCommand: o3.challengeCommand ?? DEFAULT_CHALLENGE_COMMAND
+  });
+  console.log(
+    `recover-key: rebuilt ${keys.encryptionKeyPath} from the registered salt and this YubiKey; it derives the registered encryptionKey`
+  );
+  console.error(
+    atRestCustodyNotice("recover-key", "hardware", keys.encryptionKeyPath)
+  );
+};
+
+// src/commands/share.ts
+var import_node_fs10 = require("node:fs");
 var requireEncryptionKeyPath = (ctx) => {
-  if (!(0, import_node_fs9.existsSync)(ctx.encryptionKeyPath))
+  if (!(0, import_node_fs10.existsSync)(ctx.encryptionKeyPath))
     throw new Error(
       `no at-rest key at ${ctx.encryptionKeyPath} \u2014 the share is sealed under it before upload; run \`qos-ceremony keygen --alias ${ctx.alias} ${ctx.mode === "hardware" ? "--yubikey" : "--secret-path"}\` first`
     );
   return ctx.encryptionKeyPath;
 };
+var checkRegisteredSalt = (alias, localSalt, registered) => {
+  if (!registered)
+    throw new Error(
+      `no encryptionKeySalt is registered for '${alias}', so nothing was uploaded \u2014 the registry must hold it before a share is frozen under your key, or a lost key file cannot be rebuilt; re-register with the payload \`qos-ceremony keygen\` prints`
+    );
+  if (registered.toLowerCase() !== localSalt.toLowerCase())
+    throw new Error(
+      `the encryptionKeySalt registered for '${alias}' is not your key file's \u2014 a mistyped salt would rebuild a key that opens nothing; re-register with replaceEncryptionKeySalt: true and the salt keygen prints`
+    );
+};
 var checkRegisteredKey = (alias, localKey, registered) => {
   if (!registered)
     throw new Error(
@@ -34090,6 +34183,12 @@ var share = async (o3) => {
     ctx.atRest.publicKey({ keyPath: encryptionKeyPath, mode: ctx.mode }),
     record.encryptionKey
   );
+  if (ctx.mode === "hardware")
+    checkRegisteredSalt(
+      ctx.alias,
+      ctx.atRest.saltOf({ keyPath: encryptionKeyPath, mode: ctx.mode }),
+      record.encryptionKeySalt
+    );
   const wd = createWorkdir("ceremony-share-");
   try {
     if (o3.response)
@@ -34375,6 +34474,11 @@ withCommon(
     "with --yubikey, mint PIV 9c/9d only when qos_client reports them empty"
   )
 ).action(run(keygen));
+withCommon(
+  program2.command("recover-key").description(
+    "rebuild a lost --yubikey at-rest key file from the salt the registry holds and this YubiKey"
+  )
+).action(run(recoverKey));
 withCommon(
   program2.command("share").description(
     "upload your quorum-key share: lift it out of the quorum-gen response (--response), prove it opens under your at-rest key, and upload it double-sealed"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@umbra-privacy/qos-ceremony",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "QOS TEE operator ceremony CLI — keygen/share/approve/provision + shift-traffic over the coordinator API, and the at-rest sealing tools. Shares are double-sealed everywhere they rest: ML-KEM-1024 over the QOS P-256 envelope. All crypto runs in embedded binaries (qos_client, umbra-at-rest); your private key never leaves the device. Ships NO coordinator code.",
   "keywords": [
     "qos",