@zincapp/znvault-cli 4.19.0 → 4.21.0

package/dist/commands/superadmin/rootkey.js

@@ -0,0 +1,223 @@
+// Path: src/commands/superadmin/rootkey.ts
+/**
+ * `znvault superadmin rootkey` — root-of-trust provider chain for the
+ * vault's bootstrap key (BSK).
+ *
+ * Routes (superadmin only, deployment-wide, no tenant scoping):
+ *   GET  /v1/superadmin/rootkey/status
+ *   POST /v1/superadmin/rootkey/verify
+ *   POST /v1/superadmin/rootkey/wrap      { provider }
+ *
+ * Contract: no command prints key material — the server never returns
+ * any; the publishable KCV fingerprint is the only key identity shown.
+ * No command can remove an envelope or the cleartext key file
+ * (retirement is a separate, deliberate server-side procedure that has
+ * no API in this release). `verify` exits 1 when any configured provider
+ * fails or mismatches, so it can gate migrations and drive monitoring.
+ */
+import Table from 'cli-table3';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+// ─── Helpers ───────────────────────────────────────────────────────────────
+function formatDate(iso) {
+    if (!iso)
+        return '-';
+    try {
+        return new Date(iso).toLocaleString();
+    }
+    catch {
+        return iso;
+    }
+}
+// ─── Handlers ──────────────────────────────────────────────────────────────
+export async function rootkeyStatus(options) {
+    const spinner = output.spinner('Fetching root key provider status...').start();
+    try {
+        const response = await client.get('/v1/superadmin/rootkey/status');
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        const resolution = response.resolution;
+        // Effective degraded = boot resolution OR the latest periodic probe;
+        // status must never report last-boot nostalgia as current health.
+        const effectiveDegraded = resolution !== null &&
+            (resolution.degraded || resolution.lastProbe?.degraded === true);
+        output.section('Root Key Provider Status');
+        output.keyValue({
+            'Degraded': resolution ? (effectiveDegraded ? 'YES — investigate' : 'no') : 'unknown (no resolution)',
+            'Served by (last boot)': resolution?.servedBy ?? '-',
+            'Active KCV': resolution?.kcv ?? '-',
+            'Resolved at': formatDate(resolution?.resolvedAt),
+            'Total latency': resolution ? `${String(resolution.totalLatencyMs)}ms` : '-',
+            'Last probe': resolution?.lastProbe
+                ? `${formatDate(resolution.lastProbe.at)} — ${resolution.lastProbe.degraded ? 'DEGRADED' : 'healthy'}`
+                : 'never (probe has not run yet)',
+            'Cleartext file on this node': response.localFile.present ? 'present' : 'absent',
+        });
+        if (effectiveDegraded) {
+            output.warn('The chain is DEGRADED: a configured provider failed or had no material ' +
+                'at the last resolution or probe. The node is up, but redundancy is reduced.');
+        }
+        if (resolution) {
+            const table = new Table({
+                head: ['Priority', 'Provider', 'Outcome', 'Latency'],
+                style: { head: ['cyan'] },
+            });
+            for (const attempt of resolution.attempts) {
+                const priority = resolution.configured.find((c) => c.id === attempt.providerId)?.priority ?? '-';
+                table.push([
+                    String(priority),
+                    attempt.providerId,
+                    attempt.outcome + (attempt.error ? ` (${attempt.error})` : ''),
+                    attempt.latencyMs === undefined ? '-' : `${String(attempt.latencyMs)}ms`,
+                ]);
+            }
+            console.log(table.toString());
+        }
+        if (resolution?.lastProbe) {
+            const probeTable = new Table({
+                head: ['Probe: Provider', 'Outcome', 'KCV', 'Latency'],
+                style: { head: ['cyan'] },
+            });
+            for (const result of resolution.lastProbe.results) {
+                probeTable.push([
+                    result.providerId,
+                    result.outcome + (result.error ? ` (${result.error})` : ''),
+                    result.kcv ?? '-',
+                    `${String(result.latencyMs)}ms`,
+                ]);
+            }
+            console.log(probeTable.toString());
+        }
+        if (response.envelopes.length > 0) {
+            const table = new Table({
+                head: ['Envelope', 'Key ID', 'KCV', 'Updated'],
+                style: { head: ['cyan'] },
+            });
+            for (const envelope of response.envelopes) {
+                table.push([
+                    envelope.provider_id,
+                    envelope.key_id ?? '-',
+                    envelope.kcv,
+                    formatDate(envelope.updated_at),
+                ]);
+            }
+            console.log(table.toString());
+        }
+        else {
+            output.info('No provider envelopes exist yet (create one with: rootkey wrap --provider <id>).');
+        }
+    }
+    catch (err) {
+        spinner.fail('Failed to fetch root key status');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function rootkeyVerify(options) {
+    const spinner = output.spinner('Verifying every configured root key provider...').start();
+    try {
+        const response = await client.post('/v1/superadmin/rootkey/verify', {});
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+        }
+        else {
+            const table = new Table({
+                head: ['Provider', 'Outcome', 'KCV', 'Latency'],
+                style: { head: ['cyan'] },
+            });
+            for (const result of response.results) {
+                table.push([
+                    result.providerId,
+                    result.outcome + (result.error ? ` (${result.error})` : ''),
+                    result.kcv ?? '-',
+                    `${String(result.latencyMs)}ms`,
+                ]);
+            }
+            console.log(table.toString());
+        }
+        if (response.allMatch) {
+            if (!options.json) {
+                output.success(`All configured providers agree with the active key (KCV ${response.activeKcv}).`);
+            }
+            return;
+        }
+        // STRICT gate: anything other than 'match' fails — including a
+        // provider with no material. A green result on an unprovisioned
+        // provider would let an operator reorder priorities onto nothing.
+        const failing = response.results
+            .filter((r) => r.outcome !== 'match')
+            .map((r) => r.providerId);
+        output.error(`Root key verification FAILED for: ${failing.join(', ')}. ` +
+            'Do not change provider priorities or retire anything until every ' +
+            'configured provider verifies.');
+        process.exit(1);
+    }
+    catch (err) {
+        spinner.fail('Root key verification failed');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+/**
+ * Mirror of the server's schema constraint. Enforced BEFORE any output or
+ * request: an operator who accidentally pastes a secret as --provider must
+ * see nothing echo it — not the spinner, not an error, not CI logs.
+ */
+const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+export async function rootkeyWrap(options) {
+    if (!PROVIDER_ID_PATTERN.test(options.provider)) {
+        output.error('Invalid provider id: expected 1-32 lowercase letters, digits or hyphens ' +
+            "(e.g. 'aws-kms'). The value you passed is not echoed on purpose.");
+        process.exit(1);
+    }
+    const spinner = output.spinner(`Wrapping the bootstrap key into '${options.provider}'...`).start();
+    try {
+        const receipt = await client.post('/v1/superadmin/rootkey/wrap', { provider: options.provider });
+        spinner.stop();
+        if (options.json) {
+            output.json(receipt);
+            return;
+        }
+        output.section('Root Key Envelope Written');
+        output.keyValue({
+            'Provider': receipt.providerId,
+            'Key ID': receipt.keyId ?? '-',
+            'KCV': receipt.kcv,
+            'Created': formatDate(receipt.createdAt),
+        });
+        output.success(`Envelope for '${receipt.providerId}' persisted (replicates to every node via the database).`);
+        output.info("Next: run 'znvault superadmin rootkey verify' to prove every provider opens the same key.");
+    }
+    catch (err) {
+        spinner.fail('Failed to wrap the bootstrap key');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+// ─── Registration ──────────────────────────────────────────────────────────
+export function registerRootkeyCommands(parent) {
+    const rootkey = parent
+        .command('rootkey')
+        .description('Root-of-trust provider chain for the bootstrap key (superadmin only)');
+    rootkey
+        .command('status')
+        .description('Show configured providers, last-boot resolution, degraded flag and KCV')
+        .option('--json', 'Output as JSON')
+        .action(rootkeyStatus);
+    rootkey
+        .command('verify')
+        .description('Probe every configured provider and compare KCVs; exits 1 on any failure')
+        .option('--json', 'Output as JSON')
+        .action(rootkeyVerify);
+    rootkey
+        .command('wrap')
+        .description("Wrap the current bootstrap key into a provider's envelope (never retires anything)")
+        .requiredOption('--provider <id>', "Configured envelope provider id (e.g. 'aws-kms')")
+        .option('--json', 'Output the receipt as JSON')
+        .action(rootkeyWrap);
+}
+//# sourceMappingURL=rootkey.js.map

package/dist/commands/superadmin/rootkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootkey.js","sourceRoot":"","sources":["../../../src/commands/superadmin/rootkey.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AA4E9C,8EAA8E;AAE9E,SAAS,UAAU,CAAC,GAA8B;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,+BAA+B,CAChC,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,iBAAiB,GACrB,UAAU,KAAK,IAAI;YACnB,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC;YACd,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB;YACrG,uBAAuB,EAAE,UAAU,EAAE,QAAQ,IAAI,GAAG;YACpD,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,GAAG;YACpC,aAAa,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;YACjD,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC5E,YAAY,EAAE,UAAU,EAAE,SAAS;gBACjC,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE;gBACtG,CAAC,CAAC,+BAA+B;YACnC,6BAA6B,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SACjF,CAAC,CAAC;QAEH,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,yEAAyE;gBACvE,6EAA6E,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;gBACtB,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC;gBACpD,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GACZ,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC;gBAClF,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,CAAC,QAAQ,CAAC;oBAChB,OAAO,CAAC,UAAU;oBAClB,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI;iBACzE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC;gBAC3B,IAAI,EAAE,CAAC,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;gBACtD,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,GAAG,IAAI,GAAG;oBACjB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;gBACtB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;gBAC9C,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,CAAC,WAAW;oBACpB,QAAQ,CAAC,MAAM,IAAI,GAAG;oBACtB,QAAQ,CAAC,GAAG;oBACZ,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,KAAK,EAAE,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,+BAA+B,EAC/B,EAAE,CACH,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;gBACtB,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;gBAC/C,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,GAAG,IAAI,GAAG;oBACjB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,CACZ,2DAA2D,QAAQ,CAAC,SAAS,IAAI,CAClF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CACV,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACzD,mEAAmE;YACnE,+BAA+B,CAClC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAGjC;IACC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,KAAK,CACV,0EAA0E;YACxE,kEAAkE,CACrE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAC5B,oCAAoC,OAAO,CAAC,QAAQ,MAAM,CAC3D,CAAC,KAAK,EAAE,CAAC;IAEV,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,6BAA6B,EAC7B,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC/B,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG;YAC9B,KAAK,EAAE,OAAO,CAAC,GAAG;YAClB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CACZ,iBAAiB,OAAO,CAAC,UAAU,0DAA0D,CAC9F,CAAC;QACF,MAAM,CAAC,IAAI,CACT,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sEAAsE,CAAC,CAAC;IAEvF,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oFAAoF,CAAC;SACjG,cAAc,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC;SAC9C,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC"}

package/dist/lib/config/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/lib/config/store.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AA6B9C;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,IAAI,CAAC,WAAW,CAclC,CAAC;AAKH;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/lib/config/store.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAgC9C;;;GAGG;AACH,eAAO,MAAM,KAAK,EAAE,IAAI,CAAC,WAAW,CAclC,CAAC;AAKH;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAE9D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAEjD;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,IAAI,CAElC;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}

package/dist/lib/config/store.js

@@ -22,6 +22,9 @@ function getStoreInstance() {
         const configDir = process.env.ZNVAULT_CONFIG_DIR;
         _store = new Conf({
             projectName: 'znvault',
+            // Profiles contain rotating access/refresh tokens. Preserve 0600 on
+            // every atomic rewrite instead of inheriting a permissive process umask.
+            configFileMode: 0o600,
             // Use custom config directory if specified (for test isolation)
             ...(configDir ? { cwd: configDir } : {}),
             defaults: {

package/dist/lib/config/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/lib/config/store.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;;;;GAQG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,kCAAkC;AAClC,IAAI,MAAM,GAA6B,IAAI,CAAC;AAE5C;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,8DAA8D;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEjD,MAAM,GAAG,IAAI,IAAI,CAAc;YAC7B,WAAW,EAAE,SAAS;YACtB,gEAAgE;YAChE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,EAAE;gBACR,aAAa,EAAE,eAAe;gBAC9B,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAsB,IAAI,KAAK,CAAC,EAAuB,EAAE;IACzE,GAAG,CAAC,OAAO,EAAE,IAA6B;QACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,IAA6B,EAAE,KAAc;QACxD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACnC,QAA+C,CAAC,IAAc,CAAC,GAAG,KAAK,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,oDAAoD;AACpD,IAAI,sBAAsB,GAAkB,IAAI,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,sBAAsB,GAAG,OAAO,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,IAAI,CAAC;IACd,sBAAsB,GAAG,IAAI,CAAC;AAChC,CAAC"}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/lib/config/store.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;;;;GAQG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,kCAAkC;AAClC,IAAI,MAAM,GAA6B,IAAI,CAAC;AAE5C;;;GAGG;AACH,SAAS,gBAAgB;IACvB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,8DAA8D;QAC9D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAEjD,MAAM,GAAG,IAAI,IAAI,CAAc;YAC7B,WAAW,EAAE,SAAS;YACtB,oEAAoE;YACpE,yEAAyE;YACzE,cAAc,EAAE,KAAK;YACrB,gEAAgE;YAChE,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,QAAQ,EAAE;gBACR,aAAa,EAAE,eAAe;gBAC9B,QAAQ,EAAE,EAAE;gBACZ,OAAO,EAAE,EAAE;aACZ;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,KAAK,GAAsB,IAAI,KAAK,CAAC,EAAuB,EAAE;IACzE,GAAG,CAAC,OAAO,EAAE,IAA6B;QACxC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,GAAG,CAAC,OAAO,EAAE,IAA6B,EAAE,KAAc;QACxD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QACnC,QAA+C,CAAC,IAAc,CAAC,GAAG,KAAK,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAC,CAAC;AAEH,oDAAoD;AACpD,IAAI,sBAAsB,GAAkB,IAAI,CAAC;AAEjD;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAsB;IACtD,sBAAsB,GAAG,OAAO,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,KAAK,CAAC,KAAK,EAAE,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,KAAK,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,GAAG,IAAI,CAAC;IACd,sBAAsB,GAAG,IAAI,CAAC;AAChC,CAAC"}

package/dist/lib/lmk-escrow-restore.d.ts

@@ -0,0 +1,33 @@
+export interface RestoreBootstrapKeyOptions {
+    /** A complete escrow bundle. It is fully verified before anything is written. */
+    bundle: Buffer;
+    /** Where the bootstrap key file should end up, e.g. `${DATA_DIR}/lmk.bin`. */
+    targetPath: string;
+}
+export interface RestoreBootstrapKeyReport {
+    /**
+     * `RESTORED` — the file did not exist and was written.
+     * `ALREADY_PRESENT` — the file already held this exact key; nothing changed.
+     */
+    outcome: 'RESTORED' | 'ALREADY_PRESENT';
+    targetPath: string;
+    bundleId: string;
+    copyLabel: string;
+    activeLmkVersion: number;
+    /** Publishable fingerprint. Safe for logs, receipts and drill records. */
+    bskSha256: string;
+}
+/**
+ * Restore the bootstrap key carried by `bundle` to `targetPath`.
+ *
+ * Refuses, without touching anything, when the target already holds a
+ * *different* key. Replacing a live bootstrap key silently destroys every
+ * secret it protects, and the loss stays invisible until the next unwrap —
+ * so the only safe response is to stop and let a human look. Restoring a key
+ * that is already in place is a no-op, so the drill is repeatable.
+ *
+ * The write is atomic and read back before success is reported. A write that
+ * was not read back is not a restore.
+ */
+export declare function restoreBootstrapKeyFromBundle(options: RestoreBootstrapKeyOptions): RestoreBootstrapKeyReport;
+//# sourceMappingURL=lmk-escrow-restore.d.ts.map

package/dist/lib/lmk-escrow-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lmk-escrow-restore.d.ts","sourceRoot":"","sources":["../../src/lib/lmk-escrow-restore.ts"],"names":[],"mappings":"AAqCA,MAAM,WAAW,0BAA0B;IACzC,iFAAiF;IACjF,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,OAAO,EAAE,UAAU,GAAG,iBAAiB,CAAC;IACxC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,6BAA6B,CAC3C,OAAO,EAAE,0BAA0B,GAClC,yBAAyB,CAsD3B"}

package/dist/lib/lmk-escrow-restore.js

@@ -0,0 +1,124 @@
+// Path: src/lib/lmk-escrow-restore.ts
+//
+// Restore a bootstrap key from a verified escrow bundle.
+//
+// This is the other half of `lmk escrow snapshot`. Without it the escrow copy
+// could be written and checked but never used, and zn-vault's startup guard —
+// which now refuses to boot when DATA_DIR/lmk.bin is missing and lmk_versions
+// holds real versions — pointed at a recovery path that had no implementation.
+//
+// SCOPE: this writes the plaintext bootstrap key file, which is the correct
+// target while the deployment stores the BSK that way. If a root-key provider
+// is later introduced and the plaintext file is retired, this module needs a
+// matching mode that re-wraps instead. Until then the plaintext file is the
+// supported recovery target and this is the supported way to produce it.
+import { closeSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, statSync, unlinkSync, writeSync, } from 'node:fs';
+import { timingSafeEqual } from 'node:crypto';
+import { basename, dirname, isAbsolute, join } from 'node:path';
+import { withVerifiedBootstrapKey, } from './lmk-escrow.js';
+const BSK_BYTES = 32;
+const FILE_MODE = 0o600;
+/**
+ * Restore the bootstrap key carried by `bundle` to `targetPath`.
+ *
+ * Refuses, without touching anything, when the target already holds a
+ * *different* key. Replacing a live bootstrap key silently destroys every
+ * secret it protects, and the loss stays invisible until the next unwrap —
+ * so the only safe response is to stop and let a human look. Restoring a key
+ * that is already in place is a no-op, so the drill is repeatable.
+ *
+ * The write is atomic and read back before success is reported. A write that
+ * was not read back is not a restore.
+ */
+export function restoreBootstrapKeyFromBundle(options) {
+    const { bundle, targetPath } = options;
+    if (!isAbsolute(targetPath) && !targetPath.startsWith('.')) {
+        // Relative paths are accepted (tests and DATA_DIR defaults use them) but a
+        // bare filename with no directory part has no safe temp-file location.
+        if (dirname(targetPath) === '.' && basename(targetPath) === targetPath) {
+            throw new Error('Bootstrap key target must include a directory');
+        }
+    }
+    const directory = dirname(targetPath);
+    if (!existsSync(directory)) {
+        throw new Error(`Bootstrap key target directory does not exist: ${directory}`);
+    }
+    // Verification first, always: a corrupted bundle must not create a file, not
+    // even an empty one.
+    return withVerifiedBootstrapKey(bundle, (bsk, report) => {
+        if (bsk.length !== BSK_BYTES) {
+            throw new Error('Verified bundle carries a bootstrap key of unexpected length');
+        }
+        if (existsSync(targetPath)) {
+            const current = readFileSync(targetPath);
+            const identical = current.length === bsk.length && timingSafeEqual(current, bsk);
+            current.fill(0);
+            if (identical) {
+                return describe('ALREADY_PRESENT', targetPath, report);
+            }
+            throw new Error(`Refusing to restore: ${targetPath} already holds a different bootstrap key. ` +
+                `Overwriting it would destroy every secret wrapped under the current key, ` +
+                `and the loss would not surface until the next unwrap. Move the existing ` +
+                `file aside deliberately, after establishing which key is correct, then ` +
+                `run this again.`);
+        }
+        writeAtomically(targetPath, bsk);
+        const readBack = readFileSync(targetPath);
+        const matches = readBack.length === bsk.length && timingSafeEqual(readBack, bsk);
+        readBack.fill(0);
+        if (!matches) {
+            unlinkSync(targetPath);
+            throw new Error('Bootstrap key read-back did not match the bundle; the partial file was removed');
+        }
+        return describe('RESTORED', targetPath, report);
+    });
+}
+function describe(outcome, targetPath, report) {
+    return {
+        outcome,
+        targetPath,
+        bundleId: report.bundleId,
+        copyLabel: report.copyLabel,
+        activeLmkVersion: report.activeLmkVersion,
+        bskSha256: report.bskSha256,
+    };
+}
+/**
+ * Write through a sibling temp file and rename, so an interrupted write can
+ * never leave a truncated bootstrap key where a whole one is expected. A
+ * truncated key is indistinguishable from a wrong one at rest and fails only
+ * later, which is the worst way for this to fail.
+ */
+function writeAtomically(targetPath, contents) {
+    const directory = dirname(targetPath);
+    const temporary = join(directory, `.${basename(targetPath)}.restore-tmp`);
+    if (existsSync(temporary))
+        unlinkSync(temporary);
+    let handle = null;
+    try {
+        // wx: fail if it exists. Mode is set at creation, never widened later.
+        handle = openSync(temporary, 'wx', FILE_MODE);
+        writeSync(handle, contents, 0, contents.length, 0);
+        fsyncSync(handle);
+        closeSync(handle);
+        handle = null;
+        if (statSync(temporary).size !== contents.length) {
+            throw new Error('Short write while restoring the bootstrap key');
+        }
+        renameSync(temporary, targetPath);
+    }
+    catch (error) {
+        if (handle !== null) {
+            try {
+                closeSync(handle);
+            }
+            catch {
+                // The original error is the one worth reporting.
+            }
+        }
+        if (existsSync(temporary))
+            unlinkSync(temporary);
+        throw error;
+    }
+}
+//# sourceMappingURL=lmk-escrow-restore.js.map

package/dist/lib/lmk-escrow-restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lmk-escrow-restore.js","sourceRoot":"","sources":["../../src/lib/lmk-escrow-restore.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,EAAE;AACF,yDAAyD;AACzD,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AAEzE,OAAO,EACL,SAAS,EACT,UAAU,EACV,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,QAAQ,EACR,UAAU,EACV,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEhE,OAAO,EACL,wBAAwB,GAEzB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,SAAS,GAAG,KAAK,CAAC;AAuBxB;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,6BAA6B,CAC3C,OAAmC;IAEnC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IAEvC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,UAAU,EAAE,CAAC;YACvE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kDAAkD,SAAS,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,6EAA6E;IAC7E,qBAAqB;IACrB,OAAO,wBAAwB,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;QACtD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,SAAS,GACb,OAAO,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,QAAQ,CAAC,iBAAiB,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YACzD,CAAC;YACD,MAAM,IAAI,KAAK,CACb,wBAAwB,UAAU,4CAA4C;gBAC5E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,yEAAyE;gBACzE,iBAAiB,CACpB,CAAC;QACJ,CAAC;QAED,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QACjF,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,UAAU,CAAC,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,gFAAgF,CACjF,CAAC;QACJ,CAAC;QAED,OAAO,QAAQ,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CACf,OAA6C,EAC7C,UAAkB,EAClB,MAAmC;IAEnC,OAAO;QACL,OAAO;QACP,UAAU;QACV,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAgB;IAC3D,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,QAAQ,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC;IAE1E,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,UAAU,CAAC,SAAS,CAAC,CAAC;IAEjD,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,IAAI,CAAC;QACH,uEAAuE;QACvE,MAAM,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QAC9C,SAAS,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnD,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,SAAS,CAAC,MAAM,CAAC,CAAC;QAClB,MAAM,GAAG,IAAI,CAAC;QAEd,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,SAAS,CAAC,MAAM,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,UAAU,CAAC,SAAS,CAAC,CAAC;QACjD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/lmk-escrow.d.ts

@@ -40,6 +40,18 @@ export interface LmkEscrowWriteReceipt extends LmkEscrowVerificationReport {
  */
 export declare function buildLmkEscrowBundle(options: BuildLmkEscrowBundleOptions): Buffer;
 export declare function verifyLmkEscrowBundleBuffer(bundle: Buffer): LmkEscrowVerificationReport;
+/**
+ * Run the full bundle verification and hand the live bootstrap key to `fn`.
+ *
+ * The key is never returned: it is valid only for the duration of the
+ * callback and is zeroised afterwards, on success and on failure alike.
+ * Callers must not copy it, log it, or let it escape the callback.
+ *
+ * Verification is not a formality here. It proves cryptographically that this
+ * BSK unwraps the LMK versions the bundle carries, so a bundle that passes has
+ * the right key, not merely a well-formed one.
+ */
+export declare function withVerifiedBootstrapKey<T>(bundle: Buffer, fn: (bsk: Buffer, report: LmkEscrowVerificationReport) => T): T;
 export declare function makeLmkEscrowFilename(report: LmkEscrowVerificationReport): string;
 /**
  * Write once to the final filename, flush, reopen from the destination and

package/dist/lib/lmk-escrow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lmk-escrow.d.ts","sourceRoot":"","sources":["../../src/lib/lmk-escrow.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAoF/D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,yBAAyB,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,IAAI,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,UAAU,GAAG,uBAAuB,CAAC;IACrD,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AA8KD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CA2CjF;AAgLD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAyEvF;AAgCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,MAAM,CAKjF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CA+CvB;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,2BAA2B,CAa1F"}
+{"version":3,"file":"lmk-escrow.d.ts","sourceRoot":"","sources":["../../src/lib/lmk-escrow.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAoF/D,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,yBAAyB,CAAC;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,IAAI,CAAC;IACZ,aAAa,EAAE,CAAC,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,UAAU,GAAG,uBAAuB,CAAC;IACrD,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,qBAAqB,EAAE,MAAM,EAAE,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,qBAAsB,SAAQ,2BAA2B;IACxE,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AA8KD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,2BAA2B,GAAG,MAAM,CA2CjF;AA0PD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,MAAM,GAAG,2BAA2B,CAOvF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,EACxC,MAAM,EAAE,MAAM,EACd,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,2BAA2B,KAAK,CAAC,GAC1D,CAAC,CAQH;AAgCD,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,MAAM,CAKjF;AAED;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,2BAA2B,GACnC,qBAAqB,CA+CvB;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,2BAA2B,CAa1F"}

package/dist/lib/lmk-escrow.js

@@ -371,77 +371,104 @@ function parseBundle(bundle) {
         throw error;
     }
 }
-export function verifyLmkEscrowBundleBuffer(bundle) {
-    const parsed = parseBundle(bundle);
-    try {
-        if (parsed.metadata.bskSha256 !== sha256Hex(parsed.bsk)) {
-            throw new Error('BSK fingerprint does not match the escrow metadata');
+function zeroiseParsedBundle(parsed) {
+    parsed.bsk.fill(0);
+    parsed.bundleDigest.fill(0);
+    for (const row of parsed.wrappedLmks)
+        row.wrapped?.fill(0);
+}
+function validateParsedBundle(parsed) {
+    if (parsed.metadata.bskSha256 !== sha256Hex(parsed.bsk)) {
+        throw new Error('BSK fingerprint does not match the escrow metadata');
+    }
+    if (parsed.metadata.lmkVersions.length !== parsed.wrappedLmks.length) {
+        throw new Error('LMK inventory count does not match binary records');
+    }
+    const recoverableVersions = [];
+    const unrecoverableVersions = [];
+    const seen = new Set();
+    let activeCount = 0;
+    let activeVersion = null;
+    for (let index = 0; index < parsed.wrappedLmks.length; index += 1) {
+        const row = parsed.wrappedLmks[index];
+        const metadata = parsed.metadata.lmkVersions[index];
+        if (row.version !== metadata.version || seen.has(row.version)) {
+            throw new Error('LMK inventory order/version mismatch');
         }
-        if (parsed.metadata.lmkVersions.length !== parsed.wrappedLmks.length) {
-            throw new Error('LMK inventory count does not match binary records');
+        seen.add(row.version);
+        if (metadata.status === 'ACTIVE') {
+            activeCount += 1;
+            activeVersion = row.version;
         }
-        const recoverableVersions = [];
-        const unrecoverableVersions = [];
-        const seen = new Set();
-        let activeCount = 0;
-        let activeVersion = null;
-        for (let index = 0; index < parsed.wrappedLmks.length; index += 1) {
-            const row = parsed.wrappedLmks[index];
-            const metadata = parsed.metadata.lmkVersions[index];
-            if (row.version !== metadata.version || seen.has(row.version)) {
-                throw new Error('LMK inventory order/version mismatch');
-            }
-            seen.add(row.version);
-            if (metadata.status === 'ACTIVE') {
-                activeCount += 1;
-                activeVersion = row.version;
-            }
-            if (row.wrapped === null) {
-                if (metadata.materialState !== 'UNRECOVERABLE' || metadata.wrappedBytes !== 0) {
-                    throw new Error(`LMK version ${String(row.version)} material-state mismatch`);
-                }
-                unrecoverableVersions.push(row.version);
+        if (row.wrapped === null) {
+            if (metadata.materialState !== 'UNRECOVERABLE' || metadata.wrappedBytes !== 0) {
+                throw new Error(`LMK version ${String(row.version)} material-state mismatch`);
             }
-            else {
-                if (metadata.materialState !== 'WRAPPED' || metadata.wrappedBytes !== row.wrapped.length) {
-                    throw new Error(`LMK version ${String(row.version)} wrapped-material mismatch`);
-                }
-                validateWrappedLmk(parsed.bsk, row.wrapped, row.version);
-                recoverableVersions.push(row.version);
-            }
-        }
-        if (activeCount !== 1)
-            throw new Error(`Expected one ACTIVE LMK, found ${String(activeCount)}`);
-        if (activeVersion !== parsed.metadata.activeLmkVersion) {
-            throw new Error('ACTIVE LMK version does not match the escrow metadata summary');
-        }
-        if (!recoverableVersions.includes(parsed.metadata.activeLmkVersion)) {
-            throw new Error('The ACTIVE LMK is not recoverable from this bundle');
+            unrecoverableVersions.push(row.version);
         }
-        const complete = unrecoverableVersions.length === 0;
-        if (parsed.metadata.allAvailableVersionsRecoverable !== complete) {
-            throw new Error('Recoverability summary does not match LMK inventory');
+        else {
+            if (metadata.materialState !== 'WRAPPED' || metadata.wrappedBytes !== row.wrapped.length) {
+                throw new Error(`LMK version ${String(row.version)} wrapped-material mismatch`);
+            }
+            validateWrappedLmk(parsed.bsk, row.wrapped, row.version);
+            recoverableVersions.push(row.version);
         }
-        return {
-            valid: true,
-            formatVersion: 1,
-            bundleId: `sha256:${parsed.bundleDigest.toString('hex')}`,
-            createdAt: parsed.metadata.createdAt,
-            copyLabel: parsed.metadata.copyLabel,
-            activeLmkVersion: parsed.metadata.activeLmkVersion,
-            recoverability: complete ? 'COMPLETE' : 'KNOWN_HISTORICAL_GAPS',
-            recoverableVersions,
-            unrecoverableVersions,
-            bskSha256: parsed.metadata.bskSha256,
-            backupId: parsed.metadata.backup.state === 'VERIFIED' ? parsed.metadata.backup.id : null,
-            activeRotationId: parsed.metadata.activeRotation?.rotationId ?? null,
-        };
+    }
+    if (activeCount !== 1)
+        throw new Error(`Expected one ACTIVE LMK, found ${String(activeCount)}`);
+    if (activeVersion !== parsed.metadata.activeLmkVersion) {
+        throw new Error('ACTIVE LMK version does not match the escrow metadata summary');
+    }
+    if (!recoverableVersions.includes(parsed.metadata.activeLmkVersion)) {
+        throw new Error('The ACTIVE LMK is not recoverable from this bundle');
+    }
+    const complete = unrecoverableVersions.length === 0;
+    if (parsed.metadata.allAvailableVersionsRecoverable !== complete) {
+        throw new Error('Recoverability summary does not match LMK inventory');
+    }
+    return {
+        valid: true,
+        formatVersion: 1,
+        bundleId: `sha256:${parsed.bundleDigest.toString('hex')}`,
+        createdAt: parsed.metadata.createdAt,
+        copyLabel: parsed.metadata.copyLabel,
+        activeLmkVersion: parsed.metadata.activeLmkVersion,
+        recoverability: complete ? 'COMPLETE' : 'KNOWN_HISTORICAL_GAPS',
+        recoverableVersions,
+        unrecoverableVersions,
+        bskSha256: parsed.metadata.bskSha256,
+        backupId: parsed.metadata.backup.state === 'VERIFIED' ? parsed.metadata.backup.id : null,
+        activeRotationId: parsed.metadata.activeRotation?.rotationId ?? null,
+    };
+}
+export function verifyLmkEscrowBundleBuffer(bundle) {
+    const parsed = parseBundle(bundle);
+    try {
+        return validateParsedBundle(parsed);
     }
     finally {
-        parsed.bsk.fill(0);
-        parsed.bundleDigest.fill(0);
-        for (const row of parsed.wrappedLmks)
-            row.wrapped?.fill(0);
+        zeroiseParsedBundle(parsed);
+    }
+}
+/**
+ * Run the full bundle verification and hand the live bootstrap key to `fn`.
+ *
+ * The key is never returned: it is valid only for the duration of the
+ * callback and is zeroised afterwards, on success and on failure alike.
+ * Callers must not copy it, log it, or let it escape the callback.
+ *
+ * Verification is not a formality here. It proves cryptographically that this
+ * BSK unwraps the LMK versions the bundle carries, so a bundle that passes has
+ * the right key, not merely a well-formed one.
+ */
+export function withVerifiedBootstrapKey(bundle, fn) {
+    const parsed = parseBundle(bundle);
+    try {
+        const report = validateParsedBundle(parsed);
+        return fn(parsed.bsk, report);
+    }
+    finally {
+        zeroiseParsedBundle(parsed);
     }
 }
 function assertSafeDestination(mountPath, requireDedicatedMount) {