@zincapp/znvault-cli 4.20.0 → 4.21.0

package/dist/commands/superadmin/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/superadmin/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AA6BtC,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI,CAwCzF"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/superadmin/index.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,8BAA8B,CAAC;AA8BtC,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,IAAI,CAyCzF"}

package/dist/commands/superadmin/index.js

@@ -18,6 +18,7 @@ import { registerHostCommands } from '../host/index.js';
 import { registerKmsCommands } from '../kms/index.js';
 import { registerKmipSuperadminCommands } from '../kmip/index.js';
 import { registerDynsecFenceCommands } from './dynsec-fence.js';
+import { registerRootkeyCommands } from './rootkey.js';
 import { registerPolicyCommands } from '../policy/index.js';
 import { registerQuarantineCommands } from '../quarantine.js';
 import { registerRoleCommands } from '../role.js';
@@ -53,6 +54,7 @@ export function registerSuperadminCommands(parent, _opts) {
         registerKmsCommands(superadmin, { context: 'superadmin' });
         registerKmipSuperadminCommands(superadmin);
         registerDynsecFenceCommands(superadmin);
+        registerRootkeyCommands(superadmin);
         registerPolicyCommands(superadmin, { context: 'superadmin' });
         registerQuarantineCommands(superadmin, { context: 'superadmin' });
         registerRoleCommands(superadmin, { context: 'superadmin' });

package/dist/commands/superadmin/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/superadmin/index.ts"],"names":[],"mappings":"AAAA,yCAAyC;AAoBzC,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,iEAAiE;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,0BAA0B,CAAC,MAAe,EAAE,KAAuB;IACjF,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM;SACtB,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,gEAAgE,CAAC,CAAC;IAEjF,0EAA0E;IAC1E,wEAAwE;IACxE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEjC,kEAAkE;IAClE,0DAA0D;IAC1D,mBAAmB,CAAC,YAAY,EAAE,GAAG,EAAE;QACrC,iCAAiC;QACjC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAErC,0BAA0B;QAC1B,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACnC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACpC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACrC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAChC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEnC,wBAAwB;QACxB,uBAAuB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/D,qBAAqB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,sBAAsB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9D,qBAAqB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,qBAAqB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5D,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,8BAA8B,CAAC,UAAU,CAAC,CAAC;QAC3C,2BAA2B,CAAC,UAAU,CAAC,CAAC;QACxC,sBAAsB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9D,0BAA0B,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5D,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/superadmin/index.ts"],"names":[],"mappings":"AAAA,yCAAyC;AAoBzC,OAAO,EACL,cAAc,EACd,mBAAmB,GAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,oEAAoE;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,iEAAiE;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,UAAU,0BAA0B,CAAC,MAAe,EAAE,KAAuB;IACjF,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,UAAU,GAAG,MAAM;SACtB,OAAO,CAAC,YAAY,CAAC;SACrB,WAAW,CAAC,gEAAgE,CAAC,CAAC;IAEjF,0EAA0E;IAC1E,wEAAwE;IACxE,oBAAoB,CAAC,UAAU,CAAC,CAAC;IAEjC,kEAAkE;IAClE,0DAA0D;IAC1D,mBAAmB,CAAC,YAAY,EAAE,GAAG,EAAE;QACrC,iCAAiC;QACjC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QAErC,0BAA0B;QAC1B,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACnC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACpC,wBAAwB,CAAC,UAAU,CAAC,CAAC;QACrC,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAChC,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEnC,wBAAwB;QACxB,uBAAuB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC/D,qBAAqB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,sBAAsB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9D,qBAAqB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,qBAAqB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5D,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,8BAA8B,CAAC,UAAU,CAAC,CAAC;QAC3C,2BAA2B,CAAC,UAAU,CAAC,CAAC;QACxC,uBAAuB,CAAC,UAAU,CAAC,CAAC;QACpC,sBAAsB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC9D,0BAA0B,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAClE,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC5D,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,mBAAmB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;QAC3D,oBAAoB,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commands/superadmin/rootkey.d.ts

@@ -0,0 +1,13 @@
+import type { Command } from 'commander';
+export declare function rootkeyStatus(options: {
+    json?: boolean;
+}): Promise<void>;
+export declare function rootkeyVerify(options: {
+    json?: boolean;
+}): Promise<void>;
+export declare function rootkeyWrap(options: {
+    provider: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function registerRootkeyCommands(parent: Command): void;
+//# sourceMappingURL=rootkey.d.ts.map

package/dist/commands/superadmin/rootkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootkey.d.ts","sourceRoot":"","sources":["../../../src/commands/superadmin/rootkey.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2FzC,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgG9E;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAsD9E;AASD,wBAAsB,WAAW,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2ChB;AAID,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAuB7D"}

package/dist/commands/superadmin/rootkey.js

@@ -0,0 +1,223 @@
+// Path: src/commands/superadmin/rootkey.ts
+/**
+ * `znvault superadmin rootkey` — root-of-trust provider chain for the
+ * vault's bootstrap key (BSK).
+ *
+ * Routes (superadmin only, deployment-wide, no tenant scoping):
+ *   GET  /v1/superadmin/rootkey/status
+ *   POST /v1/superadmin/rootkey/verify
+ *   POST /v1/superadmin/rootkey/wrap      { provider }
+ *
+ * Contract: no command prints key material — the server never returns
+ * any; the publishable KCV fingerprint is the only key identity shown.
+ * No command can remove an envelope or the cleartext key file
+ * (retirement is a separate, deliberate server-side procedure that has
+ * no API in this release). `verify` exits 1 when any configured provider
+ * fails or mismatches, so it can gate migrations and drive monitoring.
+ */
+import Table from 'cli-table3';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+// ─── Helpers ───────────────────────────────────────────────────────────────
+function formatDate(iso) {
+    if (!iso)
+        return '-';
+    try {
+        return new Date(iso).toLocaleString();
+    }
+    catch {
+        return iso;
+    }
+}
+// ─── Handlers ──────────────────────────────────────────────────────────────
+export async function rootkeyStatus(options) {
+    const spinner = output.spinner('Fetching root key provider status...').start();
+    try {
+        const response = await client.get('/v1/superadmin/rootkey/status');
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+            return;
+        }
+        const resolution = response.resolution;
+        // Effective degraded = boot resolution OR the latest periodic probe;
+        // status must never report last-boot nostalgia as current health.
+        const effectiveDegraded = resolution !== null &&
+            (resolution.degraded || resolution.lastProbe?.degraded === true);
+        output.section('Root Key Provider Status');
+        output.keyValue({
+            'Degraded': resolution ? (effectiveDegraded ? 'YES — investigate' : 'no') : 'unknown (no resolution)',
+            'Served by (last boot)': resolution?.servedBy ?? '-',
+            'Active KCV': resolution?.kcv ?? '-',
+            'Resolved at': formatDate(resolution?.resolvedAt),
+            'Total latency': resolution ? `${String(resolution.totalLatencyMs)}ms` : '-',
+            'Last probe': resolution?.lastProbe
+                ? `${formatDate(resolution.lastProbe.at)} — ${resolution.lastProbe.degraded ? 'DEGRADED' : 'healthy'}`
+                : 'never (probe has not run yet)',
+            'Cleartext file on this node': response.localFile.present ? 'present' : 'absent',
+        });
+        if (effectiveDegraded) {
+            output.warn('The chain is DEGRADED: a configured provider failed or had no material ' +
+                'at the last resolution or probe. The node is up, but redundancy is reduced.');
+        }
+        if (resolution) {
+            const table = new Table({
+                head: ['Priority', 'Provider', 'Outcome', 'Latency'],
+                style: { head: ['cyan'] },
+            });
+            for (const attempt of resolution.attempts) {
+                const priority = resolution.configured.find((c) => c.id === attempt.providerId)?.priority ?? '-';
+                table.push([
+                    String(priority),
+                    attempt.providerId,
+                    attempt.outcome + (attempt.error ? ` (${attempt.error})` : ''),
+                    attempt.latencyMs === undefined ? '-' : `${String(attempt.latencyMs)}ms`,
+                ]);
+            }
+            console.log(table.toString());
+        }
+        if (resolution?.lastProbe) {
+            const probeTable = new Table({
+                head: ['Probe: Provider', 'Outcome', 'KCV', 'Latency'],
+                style: { head: ['cyan'] },
+            });
+            for (const result of resolution.lastProbe.results) {
+                probeTable.push([
+                    result.providerId,
+                    result.outcome + (result.error ? ` (${result.error})` : ''),
+                    result.kcv ?? '-',
+                    `${String(result.latencyMs)}ms`,
+                ]);
+            }
+            console.log(probeTable.toString());
+        }
+        if (response.envelopes.length > 0) {
+            const table = new Table({
+                head: ['Envelope', 'Key ID', 'KCV', 'Updated'],
+                style: { head: ['cyan'] },
+            });
+            for (const envelope of response.envelopes) {
+                table.push([
+                    envelope.provider_id,
+                    envelope.key_id ?? '-',
+                    envelope.kcv,
+                    formatDate(envelope.updated_at),
+                ]);
+            }
+            console.log(table.toString());
+        }
+        else {
+            output.info('No provider envelopes exist yet (create one with: rootkey wrap --provider <id>).');
+        }
+    }
+    catch (err) {
+        spinner.fail('Failed to fetch root key status');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function rootkeyVerify(options) {
+    const spinner = output.spinner('Verifying every configured root key provider...').start();
+    try {
+        const response = await client.post('/v1/superadmin/rootkey/verify', {});
+        spinner.stop();
+        if (options.json) {
+            output.json(response);
+        }
+        else {
+            const table = new Table({
+                head: ['Provider', 'Outcome', 'KCV', 'Latency'],
+                style: { head: ['cyan'] },
+            });
+            for (const result of response.results) {
+                table.push([
+                    result.providerId,
+                    result.outcome + (result.error ? ` (${result.error})` : ''),
+                    result.kcv ?? '-',
+                    `${String(result.latencyMs)}ms`,
+                ]);
+            }
+            console.log(table.toString());
+        }
+        if (response.allMatch) {
+            if (!options.json) {
+                output.success(`All configured providers agree with the active key (KCV ${response.activeKcv}).`);
+            }
+            return;
+        }
+        // STRICT gate: anything other than 'match' fails — including a
+        // provider with no material. A green result on an unprovisioned
+        // provider would let an operator reorder priorities onto nothing.
+        const failing = response.results
+            .filter((r) => r.outcome !== 'match')
+            .map((r) => r.providerId);
+        output.error(`Root key verification FAILED for: ${failing.join(', ')}. ` +
+            'Do not change provider priorities or retire anything until every ' +
+            'configured provider verifies.');
+        process.exit(1);
+    }
+    catch (err) {
+        spinner.fail('Root key verification failed');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+/**
+ * Mirror of the server's schema constraint. Enforced BEFORE any output or
+ * request: an operator who accidentally pastes a secret as --provider must
+ * see nothing echo it — not the spinner, not an error, not CI logs.
+ */
+const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,31}$/;
+export async function rootkeyWrap(options) {
+    if (!PROVIDER_ID_PATTERN.test(options.provider)) {
+        output.error('Invalid provider id: expected 1-32 lowercase letters, digits or hyphens ' +
+            "(e.g. 'aws-kms'). The value you passed is not echoed on purpose.");
+        process.exit(1);
+    }
+    const spinner = output.spinner(`Wrapping the bootstrap key into '${options.provider}'...`).start();
+    try {
+        const receipt = await client.post('/v1/superadmin/rootkey/wrap', { provider: options.provider });
+        spinner.stop();
+        if (options.json) {
+            output.json(receipt);
+            return;
+        }
+        output.section('Root Key Envelope Written');
+        output.keyValue({
+            'Provider': receipt.providerId,
+            'Key ID': receipt.keyId ?? '-',
+            'KCV': receipt.kcv,
+            'Created': formatDate(receipt.createdAt),
+        });
+        output.success(`Envelope for '${receipt.providerId}' persisted (replicates to every node via the database).`);
+        output.info("Next: run 'znvault superadmin rootkey verify' to prove every provider opens the same key.");
+    }
+    catch (err) {
+        spinner.fail('Failed to wrap the bootstrap key');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+// ─── Registration ──────────────────────────────────────────────────────────
+export function registerRootkeyCommands(parent) {
+    const rootkey = parent
+        .command('rootkey')
+        .description('Root-of-trust provider chain for the bootstrap key (superadmin only)');
+    rootkey
+        .command('status')
+        .description('Show configured providers, last-boot resolution, degraded flag and KCV')
+        .option('--json', 'Output as JSON')
+        .action(rootkeyStatus);
+    rootkey
+        .command('verify')
+        .description('Probe every configured provider and compare KCVs; exits 1 on any failure')
+        .option('--json', 'Output as JSON')
+        .action(rootkeyVerify);
+    rootkey
+        .command('wrap')
+        .description("Wrap the current bootstrap key into a provider's envelope (never retires anything)")
+        .requiredOption('--provider <id>', "Configured envelope provider id (e.g. 'aws-kms')")
+        .option('--json', 'Output the receipt as JSON')
+        .action(rootkeyWrap);
+}
+//# sourceMappingURL=rootkey.js.map

package/dist/commands/superadmin/rootkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootkey.js","sourceRoot":"","sources":["../../../src/commands/superadmin/rootkey.ts"],"names":[],"mappings":"AAAA,2CAA2C;AAE3C;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,MAAM,YAAY,CAAC;AAE/B,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AA4E9C,8EAA8E;AAE9E,SAAS,UAAU,CAAC,GAA8B;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,KAAK,EAAE,CAAC;IAE/E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,+BAA+B,CAChC,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QACvC,qEAAqE;QACrE,kEAAkE;QAClE,MAAM,iBAAiB,GACrB,UAAU,KAAK,IAAI;YACnB,CAAC,UAAU,CAAC,QAAQ,IAAI,UAAU,CAAC,SAAS,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC;QACnE,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC;QAC3C,MAAM,CAAC,QAAQ,CAAC;YACd,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,yBAAyB;YACrG,uBAAuB,EAAE,UAAU,EAAE,QAAQ,IAAI,GAAG;YACpD,YAAY,EAAE,UAAU,EAAE,GAAG,IAAI,GAAG;YACpC,aAAa,EAAE,UAAU,CAAC,UAAU,EAAE,UAAU,CAAC;YACjD,eAAe,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAC5E,YAAY,EAAE,UAAU,EAAE,SAAS;gBACjC,CAAC,CAAC,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,MAAM,UAAU,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE;gBACtG,CAAC,CAAC,+BAA+B;YACnC,6BAA6B,EAAE,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;SACjF,CAAC,CAAC;QAEH,IAAI,iBAAiB,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,yEAAyE;gBACvE,6EAA6E,CAChF,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;gBACtB,IAAI,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC;gBACpD,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;gBAC1C,MAAM,QAAQ,GACZ,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,UAAU,CAAC,EAAE,QAAQ,IAAI,GAAG,CAAC;gBAClF,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,CAAC,QAAQ,CAAC;oBAChB,OAAO,CAAC,UAAU;oBAClB,OAAO,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC9D,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI;iBACzE,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;YAC1B,MAAM,UAAU,GAAG,IAAI,KAAK,CAAC;gBAC3B,IAAI,EAAE,CAAC,iBAAiB,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;gBACtD,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBAClD,UAAU,CAAC,IAAI,CAAC;oBACd,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,GAAG,IAAI,GAAG;oBACjB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;gBACtB,IAAI,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,CAAC;gBAC9C,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;gBAC1C,KAAK,CAAC,IAAI,CAAC;oBACT,QAAQ,CAAC,WAAW;oBACpB,QAAQ,CAAC,MAAM,IAAI,GAAG;oBACtB,QAAQ,CAAC,GAAG;oBACZ,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA2B;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,KAAK,EAAE,CAAC;IAE1F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAChC,+BAA+B,EAC/B,EAAE,CACH,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC;gBACtB,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,CAAC;gBAC/C,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;aAC1B,CAAC,CAAC;YACH,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtC,KAAK,CAAC,IAAI,CAAC;oBACT,MAAM,CAAC,UAAU;oBACjB,MAAM,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3D,MAAM,CAAC,GAAG,IAAI,GAAG;oBACjB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI;iBAChC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChC,CAAC;QAED,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;YACtB,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;gBAClB,MAAM,CAAC,OAAO,CACZ,2DAA2D,QAAQ,CAAC,SAAS,IAAI,CAClF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;aACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC5B,MAAM,CAAC,KAAK,CACV,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACzD,mEAAmE;YACnE,+BAA+B,CAClC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,2BAA2B,CAAC;AAExD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAGjC;IACC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,KAAK,CACV,0EAA0E;YACxE,kEAAkE,CACrE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAC5B,oCAAoC,OAAO,CAAC,QAAQ,MAAM,CAC3D,CAAC,KAAK,EAAE,CAAC;IAEV,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,IAAI,CAC/B,6BAA6B,EAC7B,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAC/B,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QAEf,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,CAAC;YACd,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG;YAC9B,KAAK,EAAE,OAAO,CAAC,GAAG;YAClB,SAAS,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CACZ,iBAAiB,OAAO,CAAC,UAAU,0DAA0D,CAC9F,CAAC;QACF,MAAM,CAAC,IAAI,CACT,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;QACjD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,8EAA8E;AAE9E,MAAM,UAAU,uBAAuB,CAAC,MAAe;IACrD,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,sEAAsE,CAAC,CAAC;IAEvF,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,wEAAwE,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,0EAA0E,CAAC;SACvF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oFAAoF,CAAC;SACjG,cAAc,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;SACrF,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC;SAC9C,MAAM,CAAC,WAAW,CAAC,CAAC;AACzB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zincapp/znvault-cli",
-  "version": "4.20.0",
+  "version": "4.21.0",
   "description": "Official CLI for ZnVault administration",
   "type": "module",
   "main": "dist/index.js",