@wolpertingerlabs/drawlatch 1.0.0-alpha.29 → 1.0.0-alpha.31

package/dist/remote/caller-bootstrap.js

@@ -1,61 +1,238 @@
 /**
- * Programmatic / non-interactive caller bootstrap (item E).
+ * Caller provisioning — drawlatch is the sole issuer of caller key material.
  *
- * The interactive `drawlatch sync` handshake stays the path for *remote*
- * enrollment (a caller on another machine proving identity over the network).
- * This module is for the zero-friction local case: a co-located client that
- * shares drawlatch's filesystem can provision a caller — complete with a fresh
- * keypair — without any invite-code dance.
+ * One primitive, two delivery modes (see plans/caller-credential-issuance.md):
+ *   - `issueCallerBundle()` — mint a keypair IN MEMORY, persist only the public
+ *     half, and return the credential bundle (download via the admin API, or the
+ *     `drawlatch issue-caller` CLI). The caller PRIVATE key never touches
+ *     drawlatch disk; it lives only inside the returned bundle.
+ *   - `issueLocalCaller()` — same primitive, but write the UNPACKED key files
+ *     straight into a co-located callboard's keys dir over the shared filesystem.
+ *     The same-host write IS the trust proof (replaces the old enroll-token dance).
  *
- * Two entry points:
- *   - `createCallerWithKeys()` — library function (also exposed as the
- *     password-gated `POST /api/admin/callers` admin endpoint).
- *   - `autoEnroll()` — loopback / shared-fs path: a client proves filesystem
- *     access by presenting the one-time token drawlatch writes into the config
- *     dir at startup, and gets a caller provisioned with zero interaction.
+ * `createCallerWithKeys()` (priv+pub on drawlatch disk) is retained for the
+ * password-gated `POST /api/admin/callers` create endpoint and tests.
  */
 import fs from 'node:fs';
 import path from 'node:path';
-import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { loadRemoteConfig, saveRemoteConfig, getConfigDir, getCallerKeysDir, } from '../shared/config.js';
-import { createCaller, callerExists } from '../shared/crypto/key-manager.js';
+import { loadRemoteConfig, saveRemoteConfig, getCallerKeysDir, } from '../shared/config.js';
+import { createCaller, exportServerPublicKeys, serverFingerprint, saveCallerPublicKeys, } from '../shared/crypto/key-manager.js';
+import { generateKeyBundle, serializeKeyBundle, extractPublicKeys, serializePublicKeys, fingerprint, } from '../shared/crypto/keys.js';
+import { generateBundleSalt, deriveBundleKey, encryptBundleField, DEFAULT_SCRYPT_PARAMS, } from '../shared/protocol/caller-bundle-crypto.js';
 import { setEnvVars } from '../shared/env-utils.js';
 import { createLogger } from '../shared/logger.js';
 const log = createLogger('caller-bootstrap');
 /** Valid caller alias: starts with a letter/number, then letters/numbers/-/_. */
 export const CALLER_ALIAS_REGEX = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+function assertValidAlias(alias) {
+    if (!CALLER_ALIAS_REGEX.test(alias)) {
+        throw new Error('Invalid alias: must start with a letter or number and contain only ' +
+            'letters, numbers, hyphens, and underscores');
+    }
+}
+/** Clone the `default` caller's connections (the new-caller default access). */
+function defaultConnections(config) {
+    const defaultCaller = config.callers.default;
+    return [...(defaultCaller?.connections ?? [])];
+}
 /**
- * Create a caller WITH a fresh keypair, registered in remote.config.json,
- * without the interactive sync handshake.
+ * Create a caller WITH a fresh keypair on drawlatch disk (priv+pub), registered
+ * in remote.config.json. Used by the dashboard "New caller" action.
  *
  * Throws on invalid alias, or if the caller (config entry or key dir) exists.
  */
 export function createCallerWithKeys(alias, opts = {}) {
-    if (!CALLER_ALIAS_REGEX.test(alias)) {
-        throw new Error('Invalid alias: must start with a letter or number and contain only ' +
-            'letters, numbers, hyphens, and underscores');
-    }
+    assertValidAlias(alias);
     const config = loadRemoteConfig();
-    if (alias in config.callers || callerExists(alias)) {
+    if (alias in config.callers || callerKeyDirExists(alias)) {
         throw new Error(`Caller "${alias}" already exists`);
     }
     // Generate the caller's keypair under keys/callers/<alias>/.
-    const { publicKeys, fingerprint } = createCaller(alias);
+    const { publicKeys, fingerprint: fp } = createCaller(alias);
     const name = opts.name ?? alias;
-    const defaultCaller = config.callers.default;
-    const connections = opts.connections ?? [...(defaultCaller?.connections ?? [])];
+    const connections = opts.connections ?? defaultConnections(config);
     config.callers[alias] = { name, connections };
     saveRemoteConfig(config);
-    log.info(`Created caller "${alias}" with keypair (${connections.length} connection(s), fingerprint ${fingerprint})`);
+    log.info(`Created caller "${alias}" with keypair (${connections.length} connection(s), fingerprint ${fp})`);
     return {
         alias,
         name,
-        fingerprint,
+        fingerprint: fp,
         publicKeys,
         keysDir: path.join(getCallerKeysDir(), alias),
         connections,
     };
 }
+/** Whether a caller key directory already holds key material. */
+function callerKeyDirExists(alias) {
+    const dir = path.join(getCallerKeysDir(), alias);
+    return (fs.existsSync(path.join(dir, 'signing.pub.pem')) ||
+        fs.existsSync(path.join(dir, 'signing.key.pem')));
+}
+/**
+ * Issue (or re-issue / rotate) a caller credential bundle.
+ *
+ *   1. Generate the Ed25519 + X25519 keypair IN MEMORY.
+ *   2. Register/update the caller in remote.config.json (connections, name,
+ *      source='bundle-issued').
+ *   3. Persist ONLY the public keys to keys/callers/<alias>/ (the private key
+ *      never touches drawlatch disk).
+ *   4. Assemble the v1 bundle (caller priv+pub, server pub-only, endpoint,
+ *      fingerprints, connections), optionally passphrase-wrapping the two
+ *      private PEMs.
+ *   5. Zero the derived key material from memory and return the bundle.
+ *
+ * Re-issuing an existing caller mints a FRESH keypair and overwrites the stored
+ * public key — invalidating the prior credential (the old private key can no
+ * longer authenticate). The bundle is returned once; drawlatch keeps no copy of
+ * the private material, so it is unrecoverable afterward.
+ */
+export function issueCallerBundle(opts) {
+    const { alias, endpointUrl, passphrase } = opts;
+    assertValidAlias(alias);
+    if (typeof endpointUrl !== 'string' || endpointUrl.trim() === '') {
+        throw new Error('endpointUrl is required');
+    }
+    const config = loadRemoteConfig();
+    const existing = config.callers[alias];
+    // Mint the keypair in memory and serialize before any disk writes.
+    const bundleKeys = generateKeyBundle();
+    const serialized = serializeKeyBundle(bundleKeys);
+    const publicKeys = serializePublicKeys(extractPublicKeys(bundleKeys));
+    const callerFp = fingerprint(extractPublicKeys(bundleKeys));
+    // Resolve name + connections (preserve existing values on re-issue).
+    const name = opts.name ?? existing?.name ?? alias;
+    const connections = opts.connections ?? existing?.connections ?? defaultConnections(config);
+    // Register/update the caller, preserving any unrelated fields (env, overrides…).
+    config.callers[alias] = {
+        ...(existing ?? {}),
+        name,
+        connections,
+        source: 'bundle-issued',
+    };
+    saveRemoteConfig(config);
+    // Persist ONLY the public keys (drops any stale private files from a prior mint).
+    saveCallerPublicKeys(alias, publicKeys);
+    const serverPub = exportServerPublicKeys();
+    const serverFp = serverFingerprint();
+    // Optionally passphrase-wrap the two private PEMs. The derived key is zeroed
+    // immediately after use; the plaintext PEMs are only referenced transiently.
+    let encryption = null;
+    let callerSigningPriv = serialized.signing.privateKey;
+    let callerExchangePriv = serialized.exchange.privateKey;
+    if (passphrase !== undefined && passphrase !== '') {
+        encryption = { kdf: 'scrypt', salt: generateBundleSalt(), ...DEFAULT_SCRYPT_PARAMS, alg: 'aes-256-gcm' };
+        const key = deriveBundleKey(passphrase, encryption);
+        callerSigningPriv = encryptBundleField(serialized.signing.privateKey, key);
+        callerExchangePriv = encryptBundleField(serialized.exchange.privateKey, key);
+        key.fill(0);
+    }
+    const bundle = {
+        version: 1,
+        callerAlias: alias,
+        fingerprint: callerFp,
+        createdAt: opts.createdAt ?? new Date().toISOString(),
+        expiresAt: null,
+        endpointUrl,
+        serverKeyFingerprint: serverFp,
+        connections,
+        caller: {
+            signing: { priv: callerSigningPriv, pub: serialized.signing.publicKey },
+            exchange: { priv: callerExchangePriv, pub: serialized.exchange.publicKey },
+        },
+        server: {
+            signing: { pub: serverPub.signing },
+            exchange: { pub: serverPub.exchange },
+        },
+        encryption,
+    };
+    // Best-effort: drop our references to the in-memory private material. (JS
+    // strings can't be explicitly zeroed; the guarantee that matters — the private
+    // key is never written to drawlatch disk — is enforced above.)
+    callerSigningPriv = '';
+    callerExchangePriv = '';
+    log.info(`Issued caller "${alias}" (${connections.length} connection(s), fingerprint ${callerFp}` +
+        `${encryption ? ', passphrase-wrapped' : ''}${existing ? ', re-issue' : ''})`);
+    return bundle;
+}
+/**
+ * Issue a caller and write the UNPACKED key files straight into a co-located
+ * callboard's keys dir over the shared filesystem (same-host write is the trust
+ * proof). drawlatch keeps only the public key; callboard gets the private key on
+ * its own disk — bit-for-bit the steady state of the old pairing flow, with no
+ * token dance.
+ *
+ * Writes, under `<keysDir>`:
+ *   - callers/<alias>/{signing,exchange}.{key,pub}.pem  (0600 / 0644)
+ *   - server/{signing,exchange}.pub.pem                 (0644)
+ */
+export function issueLocalCaller(opts) {
+    const alias = opts.alias ?? 'callboard-local';
+    assertValidAlias(alias);
+    const config = loadRemoteConfig();
+    const existing = config.callers[alias];
+    const bundleKeys = generateKeyBundle();
+    const serialized = serializeKeyBundle(bundleKeys);
+    const publicKeys = serializePublicKeys(extractPublicKeys(bundleKeys));
+    const callerFp = fingerprint(extractPublicKeys(bundleKeys));
+    const connections = opts.connections ?? existing?.connections ?? defaultConnections(config);
+    const name = opts.name ?? existing?.name ?? alias;
+    config.callers[alias] = {
+        ...(existing ?? {}),
+        name,
+        connections,
+        source: 'local-auto',
+    };
+    saveRemoteConfig(config);
+    // drawlatch keeps only the public half.
+    saveCallerPublicKeys(alias, publicKeys);
+    // Write the unpacked key files into callboard's keys dir.
+    const callerKeysDir = path.join(opts.keysDir, 'callers', alias);
+    fs.mkdirSync(callerKeysDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(callerKeysDir, 'signing.pub.pem'), serialized.signing.publicKey, { mode: 0o644 });
+    fs.writeFileSync(path.join(callerKeysDir, 'exchange.pub.pem'), serialized.exchange.publicKey, { mode: 0o644 });
+    fs.writeFileSync(path.join(callerKeysDir, 'signing.key.pem'), serialized.signing.privateKey, { mode: 0o600 });
+    fs.writeFileSync(path.join(callerKeysDir, 'exchange.key.pem'), serialized.exchange.privateKey, { mode: 0o600 });
+    // And the server's public keys so callboard can pin the server identity.
+    const serverPub = exportServerPublicKeys();
+    const serverDir = path.join(opts.keysDir, 'server');
+    fs.mkdirSync(serverDir, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(path.join(serverDir, 'signing.pub.pem'), serverPub.signing, { mode: 0o644 });
+    fs.writeFileSync(path.join(serverDir, 'exchange.pub.pem'), serverPub.exchange, { mode: 0o644 });
+    log.info(`Auto-shared local caller "${alias}" to ${callerKeysDir} ` +
+        `(${connections.length} connection(s), fingerprint ${callerFp})`);
+    return { alias, fingerprint: callerFp, callerKeysDir, connections };
+}
+/**
+ * First-boot hook: when drawlatch is supervised by a co-located callboard (which
+ * sets DRAWLATCH_LOCAL_CALLER_KEYS_DIR to its own keys dir), auto-share a default
+ * caller into that dir — but only once (skipped if the caller already exists).
+ *
+ * Replaces the retired enroll-token / `/sync/auto-enroll` path.
+ */
+export function maybeIssueLocalCaller() {
+    const keysDir = process.env.DRAWLATCH_LOCAL_CALLER_KEYS_DIR;
+    if (!keysDir)
+        return null;
+    const alias = process.env.DRAWLATCH_LOCAL_CALLER_ALIAS ?? 'callboard-local';
+    const config = loadRemoteConfig();
+    if (alias in config.callers && callerKeyDirExists(alias)) {
+        // Already provisioned on a prior boot — nothing to do.
+        return null;
+    }
+    const connectionsEnv = process.env.DRAWLATCH_LOCAL_CALLER_CONNECTIONS;
+    const connections = connectionsEnv
+        ? connectionsEnv.split(',').map((c) => c.trim()).filter(Boolean)
+        : undefined;
+    try {
+        return issueLocalCaller({ alias, keysDir, ...(connections && { connections }) });
+    }
+    catch (err) {
+        log.error(`Could not auto-share local caller "${alias}":`, err);
+        return null;
+    }
+}
+// ── Delete ──────────────────────────────────────────────────────────────────
 /**
  * Delete a caller: removes its config entry, prefixed env vars, and key dir.
  * The `default` caller cannot be deleted.
@@ -90,52 +267,4 @@ export function deleteCaller(alias) {
     }
     log.info(`Deleted caller "${alias}"`);
 }
-// ── Loopback / shared-fs auto-enroll ───────────────────────────────────────
-/** Path of the one-time enroll token file inside the config dir. */
-export function getEnrollTokenPath() {
-    return path.join(getConfigDir(), 'enroll.token');
-}
-/**
- * Write a fresh one-time enroll token into the config dir (mode 0600).
- *
- * Only a process with filesystem access to drawlatch's config dir can read it,
- * which is exactly the proof-of-co-location we want for `autoEnroll()`.
- * Called once at daemon startup; overwrites any stale token.
- */
-export function writeEnrollToken() {
-    const token = randomBytes(32).toString('hex');
-    const tokenPath = getEnrollTokenPath();
-    fs.mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
-    fs.writeFileSync(tokenPath, token, { mode: 0o600 });
-    return token;
-}
-/** Constant-time compare of the presented token against the on-disk token. */
-function tokenMatches(presented) {
-    const tokenPath = getEnrollTokenPath();
-    if (!fs.existsSync(tokenPath))
-        return false;
-    const onDisk = fs.readFileSync(tokenPath, 'utf8').trim();
-    const a = Buffer.from(onDisk);
-    const b = Buffer.from(presented);
-    if (a.length !== b.length)
-        return false;
-    return timingSafeEqual(a, b);
-}
-/**
- * Auto-enroll a co-located caller by presenting the one-time enroll token.
- *
- * Verifies the token proves filesystem access to the config dir, then either
- * creates a new caller with keys (if the alias is new) or returns the existing
- * one's metadata (idempotent). The token is single-use: it is rotated on every
- * successful enroll so a leaked token cannot be replayed.
- */
-export function autoEnroll(token, alias, opts = {}) {
-    if (!tokenMatches(token)) {
-        throw new Error('Invalid or expired enroll token');
-    }
-    const result = createCallerWithKeys(alias, opts);
-    // Rotate the token so it cannot be replayed.
-    writeEnrollToken();
-    return result;
-}
 //# sourceMappingURL=caller-bootstrap.js.map

package/dist/remote/server.js

@@ -31,7 +31,7 @@ import { isSecretSetForCaller } from '../shared/env-utils.js';
 import { toolHandlers } from './tool-dispatch.js';
 import { setTunnelUrl, getTunnelUrl } from './tunnel-state.js';
 import { migrateConfigDir } from '../shared/migrations.js';
-import { writeEnrollToken, autoEnroll } from './caller-bootstrap.js';
+import { maybeIssueLocalCaller } from './caller-bootstrap.js';
 import { createAdminRouter } from './admin.js';
 import { loginHandler, logoutHandler, checkAuthHandler, changePasswordHandler, requireAuth, } from '../auth/auth.js';
 // ── Environment loading ─────────────────────────────────────────────────────
@@ -218,8 +218,6 @@ export function createApp(options = {}) {
     app.use('/sync', express.text({ type: 'text/plain', limit: '64kb' }));
     // JSON for sync management endpoints (64kb limit — sync listen messages are tiny)
     app.use('/sync/listen', express.json({ limit: '64kb' }));
-    // JSON for the loopback auto-enroll endpoint (item E).
-    app.use('/sync/auto-enroll', express.json({ limit: '64kb' }));
     // Raw buffer for webhook endpoints (needed for signature verification)
     app.use('/webhooks', express.raw({ type: 'application/json', limit: '1mb' }));
     // ── Dashboard auth body/cookie parsers ───────────────────────────────────
@@ -711,38 +709,19 @@ export function createApp(options = {}) {
                 sessions.delete(id);
         }
     };
-    // ── Loopback auto-enroll (item E) ─────────────────────────────────────
-    // A co-located client that shares our filesystem proves co-location by
-    // presenting the one-time enroll token drawlatch wrote into the config dir,
-    // and gets a caller provisioned (with keys) without the invite-code dance.
-    // Loopback-only: never reachable from off-box.
-    app.post('/sync/auto-enroll', requireLoopback, (req, res) => {
-        const { token, alias, name } = (req.body ?? {});
-        if (!token || !alias) {
-            res.status(400).json({ error: 'Missing token or alias' });
-            return;
-        }
-        try {
-            const result = autoEnroll(token, alias, name !== undefined ? { name } : {});
-            reloadPeer(alias);
-            res.json({
-                alias: result.alias,
-                name: result.name,
-                fingerprint: result.fingerprint,
-                keysDir: result.keysDir,
-                connections: result.connections,
-            });
-        }
-        catch (err) {
-            const message = err instanceof Error ? err.message : String(err);
-            const status = /invalid or expired/i.test(message)
-                ? 403
-                : /already exists/i.test(message)
-                    ? 409
-                    : 400;
-            res.status(status).json({ error: message });
-        }
-    });
+    // Co-located callboard auto-share now happens at daemon boot via
+    // maybeIssueLocalCaller() (write-to-path over the shared filesystem). The old
+    // loopback `/sync/auto-enroll` enroll-token endpoint has been retired.
+    /** Endpoint URL to pin in an issued bundle when the request omits one:
+     *  the public tunnel URL if active, else the daemon's own host:port. */
+    const defaultEndpointUrl = () => {
+        const tunnel = getTunnelUrl();
+        if (tunnel)
+            return tunnel;
+        const bindHost = process.env.DRAWLATCH_HOST ?? config.host;
+        const reachable = bindHost === '0.0.0.0' ? '127.0.0.1' : bindHost;
+        return `http://${reachable}:${port}`;
+    };
     // JSON body parsing for the mutating admin endpoints (cookie-parser for /api
     // is already installed above; the daemon keeps its per-route parser pattern).
     app.use('/api/admin', express.json({ limit: '1mb' }));
@@ -754,6 +733,8 @@ export function createApp(options = {}) {
         refreshCaller: refreshCallerSessions,
         reloadPeer,
         removePeer,
+        audit: (action, details) => auditLog('admin', action, details ?? {}),
+        defaultEndpointUrl,
         version: PKG_VERSION,
         port,
         startedAt,
@@ -900,13 +881,19 @@ export function main() {
         console.log('[remote] No callers configured — server will accept sync requests.');
         console.log('[remote] To add callers, run: drawlatch sync');
     }
-    // Drop a one-time enroll token into the config dir so a co-located client
-    // that shares our filesystem can auto-enroll a caller (item E).
+    // First-boot auto-share: when supervised by a co-located callboard (which sets
+    // DRAWLATCH_LOCAL_CALLER_KEYS_DIR), mint a default caller and write the unpacked
+    // key files straight into callboard's keys dir. Idempotent (skipped once the
+    // caller exists). Replaces the retired enroll-token / /sync/auto-enroll path.
     try {
-        writeEnrollToken();
+        const local = maybeIssueLocalCaller();
+        if (local) {
+            console.log(`[remote] Auto-shared local caller "${local.alias}" → ${local.callerKeysDir} ` +
+                `(fingerprint ${local.fingerprint})`);
+        }
     }
     catch (err) {
-        console.warn('[remote] Could not write enroll token:', err);
+        console.warn('[remote] Could not auto-share local caller:', err);
     }
     const port = resolvePort(process.env.DRAWLATCH_PORT, config.port);
     const host = process.env.DRAWLATCH_HOST ?? config.host;

package/dist/shared/config.d.ts

@@ -151,10 +151,17 @@ export interface IngestorOverrides {
      *  during mergeIngestorConfig(). */
     params?: Record<string, unknown>;
 }
+/** How a caller's keypair was provisioned (drives the dashboard source badge). */
+export type CallerSource = 'local-auto' | 'bundle-issued';
 /** Per-caller access configuration */
 export interface CallerConfig {
     /** Human-readable name for this caller (used in audit logs) */
     name?: string;
+    /** How this caller's keypair was provisioned:
+     *   - 'bundle-issued' — minted via the credential-issuance flow (download/CLI)
+     *   - 'local-auto'    — auto-shared to a co-located callboard over the filesystem
+     *  Absent for callers created before issuance existed (e.g. via `sync`). */
+    source?: CallerSource;
     /** List of connection aliases — references built-in templates (e.g., "github")
      *  or custom connector aliases defined in the top-level connectors array. */
     connections: string[];

package/dist/shared/crypto/index.d.ts

@@ -1,4 +1,4 @@
 export { type KeyBundle, type SerializedKeyBundle, type PublicKeyBundle, type SerializedPublicKeys, generateKeyBundle, extractPublicKeys, serializeKeyBundle, deserializeKeyBundle, serializePublicKeys, deserializePublicKeys, saveKeyBundle, loadKeyBundle, loadPublicKeys, fingerprint, } from './keys.js';
 export { type DirectionalKey, type SessionKeys, deriveSessionKeys, EncryptedChannel, } from './channel.js';
-export { type CreateCallerResult, createCaller, exportCallerPublicKeys, exportServerPublicKeys, importCallerPublicKeys, saveServerPublicKeys, listCallers, callerExists, serverExists, callerFingerprint, serverFingerprint, } from './key-manager.js';
+export { type CreateCallerResult, createCaller, exportCallerPublicKeys, exportServerPublicKeys, importCallerPublicKeys, saveCallerPublicKeys, saveServerPublicKeys, listCallers, callerExists, serverExists, callerFingerprint, serverFingerprint, } from './key-manager.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/shared/crypto/index.js

@@ -1,4 +1,4 @@
 export { generateKeyBundle, extractPublicKeys, serializeKeyBundle, deserializeKeyBundle, serializePublicKeys, deserializePublicKeys, saveKeyBundle, loadKeyBundle, loadPublicKeys, fingerprint, } from './keys.js';
 export { deriveSessionKeys, EncryptedChannel, } from './channel.js';
-export { createCaller, exportCallerPublicKeys, exportServerPublicKeys, importCallerPublicKeys, saveServerPublicKeys, listCallers, callerExists, serverExists, callerFingerprint, serverFingerprint, } from './key-manager.js';
+export { createCaller, exportCallerPublicKeys, exportServerPublicKeys, importCallerPublicKeys, saveCallerPublicKeys, saveServerPublicKeys, listCallers, callerExists, serverExists, callerFingerprint, serverFingerprint, } from './key-manager.js';
 //# sourceMappingURL=index.js.map

package/dist/shared/crypto/key-manager.d.ts

@@ -33,9 +33,23 @@ export declare function exportCallerPublicKeys(alias: string, opts?: KeyManagerO
  * Reads from `keys/server/`.
  */
 export declare function exportServerPublicKeys(opts?: KeyManagerOpts): SerializedPublicKeys;
+/**
+ * Persist ONLY a caller's public keys under `keys/callers/<alias>/`.
+ *
+ * This is the public-only save path used by credential issuance: drawlatch mints
+ * the keypair in memory, hands the private half out in the bundle, and keeps only
+ * the public half on disk (so the private key never touches drawlatch's disk).
+ *
+ * Any stale PRIVATE key files left from a legacy on-disk mint (the old local
+ * bootstrap wrote priv+pub here) are removed, so re-issuing a previously
+ * full-keypair caller restores the public-only invariant.
+ */
+export declare function saveCallerPublicKeys(alias: string, keys: SerializedPublicKeys, opts?: KeyManagerOpts): void;
 /**
  * Import a caller's public keys. Saves under `keys/callers/<alias>/`.
  * Used by the server to store received caller public keys (e.g., via sync).
+ *
+ * Alias for {@link saveCallerPublicKeys} — both are the public-only persist path.
  */
 export declare function importCallerPublicKeys(alias: string, keys: SerializedPublicKeys, opts?: KeyManagerOpts): void;
 /**

package/dist/shared/crypto/key-manager.js

@@ -66,16 +66,38 @@ export function exportServerPublicKeys(opts) {
     return serializePublicKeys(pub);
 }
 /**
- * Import a caller's public keys. Saves under `keys/callers/<alias>/`.
- * Used by the server to store received caller public keys (e.g., via sync).
+ * Persist ONLY a caller's public keys under `keys/callers/<alias>/`.
+ *
+ * This is the public-only save path used by credential issuance: drawlatch mints
+ * the keypair in memory, hands the private half out in the bundle, and keeps only
+ * the public half on disk (so the private key never touches drawlatch's disk).
+ *
+ * Any stale PRIVATE key files left from a legacy on-disk mint (the old local
+ * bootstrap wrote priv+pub here) are removed, so re-issuing a previously
+ * full-keypair caller restores the public-only invariant.
  */
-export function importCallerPublicKeys(alias, keys, opts) {
+export function saveCallerPublicKeys(alias, keys, opts) {
     const dir = path.join(callerKeysDir(opts), alias);
     fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
     // Validate the keys are parseable before writing
     deserializePublicKeys(keys);
     fs.writeFileSync(path.join(dir, 'signing.pub.pem'), keys.signing, { mode: 0o644 });
     fs.writeFileSync(path.join(dir, 'exchange.pub.pem'), keys.exchange, { mode: 0o644 });
+    // Drop any private key material from an earlier on-disk mint.
+    for (const f of ['signing.key.pem', 'exchange.key.pem']) {
+        const p = path.join(dir, f);
+        if (fs.existsSync(p))
+            fs.rmSync(p, { force: true });
+    }
+}
+/**
+ * Import a caller's public keys. Saves under `keys/callers/<alias>/`.
+ * Used by the server to store received caller public keys (e.g., via sync).
+ *
+ * Alias for {@link saveCallerPublicKeys} — both are the public-only persist path.
+ */
+export function importCallerPublicKeys(alias, keys, opts) {
+    saveCallerPublicKeys(alias, keys, opts);
 }
 /**
  * Save server public keys. Writes to `keys/server/`.

package/dist/shared/protocol/caller-bundle-crypto.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Caller credential bundle — passphrase wrapping (scrypt KDF + AES-256-GCM AEAD).
+ *
+ * Split from the types module so the format types stay free of node:crypto and
+ * can be re-exported into the dashboard. Shared with callboard, which performs
+ * the inverse (decrypt) at import time when a bundle is passphrase-protected.
+ */
+import type { BundleEncryption } from './caller-bundle.js';
+/**
+ * Default scrypt parameters. N=16384 keeps the working set (128 * N * r bytes ≈
+ * 16 MiB) under Node's default scrypt `maxmem` (32 MiB) while remaining a sound
+ * interactive-use cost. The exact params are recorded in the bundle so callboard
+ * derives the same key regardless of future tuning.
+ */
+export declare const DEFAULT_SCRYPT_PARAMS: {
+    readonly n: 16384;
+    readonly r: 8;
+    readonly p: 1;
+};
+/** Generate a fresh base64-encoded scrypt salt (16 bytes). */
+export declare function generateBundleSalt(): string;
+/**
+ * Derive the AES-256 key for bundle wrapping from a passphrase + the salt and
+ * cost parameters recorded in the bundle's `encryption` block.
+ */
+export declare function deriveBundleKey(passphrase: string, enc: BundleEncryption): Buffer;
+/**
+ * Encrypt one private PEM with AES-256-GCM.
+ * Wire format: base64(IV[12] || authTag[16] || ciphertext).
+ */
+export declare function encryptBundleField(plaintext: string, key: Buffer): string;
+/**
+ * Decrypt one wrapped private PEM produced by {@link encryptBundleField}.
+ * Throws on a wrong passphrase or tampered ciphertext (GCM auth failure).
+ */
+export declare function decryptBundleField(wrapped: string, key: Buffer): string;
+//# sourceMappingURL=caller-bundle-crypto.d.ts.map

package/dist/shared/protocol/caller-bundle-crypto.js

@@ -0,0 +1,62 @@
+/**
+ * Caller credential bundle — passphrase wrapping (scrypt KDF + AES-256-GCM AEAD).
+ *
+ * Split from the types module so the format types stay free of node:crypto and
+ * can be re-exported into the dashboard. Shared with callboard, which performs
+ * the inverse (decrypt) at import time when a bundle is passphrase-protected.
+ */
+import crypto from 'node:crypto';
+/**
+ * Default scrypt parameters. N=16384 keeps the working set (128 * N * r bytes ≈
+ * 16 MiB) under Node's default scrypt `maxmem` (32 MiB) while remaining a sound
+ * interactive-use cost. The exact params are recorded in the bundle so callboard
+ * derives the same key regardless of future tuning.
+ */
+export const DEFAULT_SCRYPT_PARAMS = { n: 16384, r: 8, p: 1 };
+const KEY_LEN = 32; // AES-256
+const IV_LEN = 12; // GCM nonce
+const TAG_LEN = 16; // GCM auth tag
+const SCRYPT_MAXMEM = 64 * 1024 * 1024; // generous headroom over the working set
+/** Generate a fresh base64-encoded scrypt salt (16 bytes). */
+export function generateBundleSalt() {
+    return crypto.randomBytes(16).toString('base64');
+}
+/**
+ * Derive the AES-256 key for bundle wrapping from a passphrase + the salt and
+ * cost parameters recorded in the bundle's `encryption` block.
+ */
+export function deriveBundleKey(passphrase, enc) {
+    return crypto.scryptSync(passphrase, Buffer.from(enc.salt, 'base64'), KEY_LEN, {
+        N: enc.n,
+        r: enc.r,
+        p: enc.p,
+        maxmem: SCRYPT_MAXMEM,
+    });
+}
+/**
+ * Encrypt one private PEM with AES-256-GCM.
+ * Wire format: base64(IV[12] || authTag[16] || ciphertext).
+ */
+export function encryptBundleField(plaintext, key) {
+    const iv = crypto.randomBytes(IV_LEN);
+    const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+    const authTag = cipher.getAuthTag();
+    return Buffer.concat([iv, authTag, ciphertext]).toString('base64');
+}
+/**
+ * Decrypt one wrapped private PEM produced by {@link encryptBundleField}.
+ * Throws on a wrong passphrase or tampered ciphertext (GCM auth failure).
+ */
+export function decryptBundleField(wrapped, key) {
+    const data = Buffer.from(wrapped, 'base64');
+    if (data.length < IV_LEN + TAG_LEN)
+        throw new Error('Wrapped field too short');
+    const iv = data.subarray(0, IV_LEN);
+    const authTag = data.subarray(IV_LEN, IV_LEN + TAG_LEN);
+    const ciphertext = data.subarray(IV_LEN + TAG_LEN);
+    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf-8');
+}
+//# sourceMappingURL=caller-bundle-crypto.js.map