@zincapp/znvault-cli 4.22.1 → 4.24.0

package/dist/commands/lmk-escrow.js

@@ -5,9 +5,62 @@ import { lstatSync, readFileSync, realpathSync } from 'node:fs';
 import { LocalDBClient, isLocalDbAvailable } from '../lib/db.js';
 import { buildLmkEscrowBundle, makeLmkEscrowFilename, readAndVerifyLmkEscrowBundle, verifyLmkEscrowBundleBuffer, writeLmkEscrowBundleDirect, } from '../lib/lmk-escrow.js';
 import { restoreBootstrapKeyFromBundle } from '../lib/lmk-escrow-restore.js';
+import { resolveBskFromProvider } from '../lib/bsk-source.js';
+import { createSentinelClient } from '../lib/sentinel-client.js';
+import { registerLmkCeremonyCommands } from './lmk-ceremony.js';
 import { getLocalVaultVersion } from '../lib/local.js';
 import { getVersion } from '../lib/version.js';
 import * as output from '../lib/output.js';
+/**
+ * Obtain the bootstrap key for a snapshot, from a file or from the hardware
+ * root, and say which in the receipt.
+ *
+ * The provider path exists so the ceremony does not have to run wherever the
+ * cleartext key happens to live — in practice a production application node —
+ * and so that retiring `lmk.bin` does not permanently end the ability to take
+ * another escrow. See src/lib/bsk-source.ts.
+ */
+async function obtainBsk(options, database) {
+    if (options.fromProvider === undefined) {
+        const bskPath = resolveBskPath(options.bskPath);
+        return { bsk: readBsk(bskPath), source: `file:${bskPath}` };
+    }
+    if (options.bskPath !== undefined) {
+        throw new Error('--from-provider and --bsk-path are mutually exclusive: pick one source.');
+    }
+    if (options.fromProvider !== 'sentinel') {
+        // aws-kms is deliberately not offered. It would need AWS credentials on the
+        // ceremony host, which is a materially different trust story from an mTLS
+        // client certificate to an appliance sitting in the same room.
+        throw new Error(`--from-provider currently supports only 'sentinel', not ` +
+            `${JSON.stringify(options.fromProvider)}.`);
+    }
+    const envelope = await database.getRootKeyEnvelope('sentinel');
+    if (!envelope) {
+        const available = await database.listRootKeyEnvelopeProviders();
+        throw new Error('No root-key envelope recorded for provider \'sentinel\'. Providers with an ' +
+            `envelope: ${available.length > 0 ? available.join(', ') : '(none)'}.`);
+    }
+    const client = createSentinelClient({
+        url: requireOption(options.sentinelUrl, '--sentinel-url', 'ROOT_KEY_SENTINEL_URL'),
+        caPath: requireOption(options.sentinelCa, '--sentinel-ca', 'ROOT_KEY_SENTINEL_CA'),
+        certPath: requireOption(options.sentinelCert, '--sentinel-cert', 'ROOT_KEY_SENTINEL_CERT'),
+        keyPath: requireOption(options.sentinelKey, '--sentinel-key', 'ROOT_KEY_SENTINEL_KEY'),
+        timeoutMs: options.sentinelTimeoutMs === undefined
+            ? undefined
+            : Number(options.sentinelTimeoutMs),
+    });
+    const bsk = await resolveBskFromProvider(envelope, (ciphertext) => client.unwrap(ciphertext));
+    return { bsk, source: `provider:sentinel (${envelope.kcv})` };
+}
+/** A ceremony fails loudly on a missing input, never on a silent default. */
+function requireOption(value, flag, envVar) {
+    const resolved = value ?? process.env[envVar];
+    if (resolved === undefined || resolved === '') {
+        throw new Error(`${flag} is required with --from-provider (or set ${envVar}).`);
+    }
+    return resolved;
+}
 function resolveBskPath(explicitPath) {
     if (explicitPath !== undefined)
         return resolve(explicitPath);
@@ -41,7 +94,7 @@ function printReport(report) {
         'Historical gaps': report.unrecoverableVersions.length === 0
             ? 'none'
             : report.unrecoverableVersions.join(', '),
-        'BSK fingerprint': `sha256:${report.bskSha256}`,
+        'BSK fingerprint': report.bskKcv,
         'Backup binding': report.backupId ?? 'UNBOUND — LAB ONLY',
         'Active rotation': report.activeRotationId ?? 'none',
         ...('path' in report ? {
@@ -55,6 +108,7 @@ export function registerLmkEscrowCommands(lmk) {
     const escrow = lmk
         .command('escrow')
         .description('Local, direct-to-device BSK and versioned-LMK custody snapshots');
+    registerLmkCeremonyCommands(escrow);
     escrow
         .command('snapshot')
         .description('Capture the local BSK plus PostgreSQL-wrapped LMK generations and write ' +
@@ -62,6 +116,14 @@ export function registerLmkEscrowCommands(lmk) {
         .requiredOption('--mount <path>', 'Root of the mounted removable escrow device')
         .requiredOption('--copy-label <label>', 'Physical copy label, for example A or B')
         .option('--bsk-path <path>', 'Override LMK_PATH/DATA_DIR/lmk.bin')
+        .option('--from-provider <name>', "Source the BSK from a root-key provider instead of a file ('sentinel'). " +
+        'Lets the ceremony run on a dedicated host, and keeps escrow possible ' +
+        'after lmk.bin is retired.')
+        .option('--sentinel-url <url>', 'Sentinel base URL (https only)')
+        .option('--sentinel-ca <path>', 'CA bundle that must issue the appliance certificate')
+        .option('--sentinel-cert <path>', 'Client certificate presented to the appliance')
+        .option('--sentinel-key <path>', 'Its private key')
+        .option('--sentinel-timeout-ms <ms>', 'Request timeout (default 5000)')
         .option('--backup-id <id>', 'Bind the snapshot to a VERIFIED ZnVault backup record')
         .option('--allow-unbound-lab-snapshot', 'LAB ONLY: allow a snapshot with no verified backup binding')
         .option('--json', 'Output only the redacted receipt as JSON')
@@ -77,11 +139,13 @@ export function registerLmkEscrowCommands(lmk) {
         const database = new LocalDBClient();
         let bsk = null;
         let bundle = null;
+        let bskSource = '';
         try {
             // getLocalConfig(), called by LocalDBClient, loads DATA_DIR/LMK_PATH from
             // the service environment before this path is resolved.
-            const bskPath = resolveBskPath(options.bskPath);
-            bsk = readBsk(bskPath);
+            const obtained = await obtainBsk(options, database);
+            bsk = obtained.bsk;
+            bskSource = obtained.source;
             const snapshot = await database.captureLmkEscrow(options.backupId);
             bundle = buildLmkEscrowBundle({
                 snapshot,
@@ -101,11 +165,15 @@ export function registerLmkEscrowCommands(lmk) {
             });
             spinner.stop();
             if (options.json === true) {
-                output.json(receipt);
+                // The source belongs in the machine-readable receipt too: an acta
+                // that cannot distinguish a file-sourced ceremony from a
+                // hardware-root one records the wrong control.
+                output.json({ ...receipt, bskSource });
                 return;
             }
             output.section('LMK Escrow Snapshot Written and Read-Back Verified');
             printReport(receipt);
+            output.keyValue({ 'BSK source': bskSource });
             if (receipt.backupId === null) {
                 output.warn('This snapshot is not bound to a verified database backup and is LAB-ONLY evidence.');
             }
@@ -167,7 +235,7 @@ export function registerLmkEscrowCommands(lmk) {
             Copy: receipt.copyLabel,
             Bundle: receipt.bundleId,
             'Active LMK version': receipt.activeLmkVersion,
-            'BSK fingerprint': receipt.bskSha256,
+            'BSK fingerprint': receipt.bskKcv,
         });
         output.success(receipt.outcome === 'RESTORED'
             ? 'Written owner-only and read back. Record this receipt in the drill log.'

package/dist/commands/lmk-escrow.js.map

@@ -1 +1 @@
-{"version":3,"file":"lmk-escrow.js","sourceRoot":"","sources":["../../src/commands/lmk-escrow.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAoB3C,SAAS,cAAc,CAAC,YAAqB;IAC3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,aAAa,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,MAA2D;IAC9E,MAAM,CAAC,QAAQ,CAAC;QACd,WAAW,EAAE,MAAM,CAAC,QAAQ;QAC5B,YAAY,EAAE,MAAM,CAAC,SAAS;QAC9B,YAAY,EAAE,MAAM,CAAC,gBAAgB;QACrC,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,sBAAsB,EAAE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7D,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;YAC1D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,iBAAiB,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE;QAC/C,gBAAgB,EAAE,MAAM,CAAC,QAAQ,IAAI,oBAAoB;QACzD,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,IAAI,MAAM;QACpD,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC;YACrB,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,mBAAmB,EAAE,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iEAAiE,CAAC,CAAC;IAElF,MAAM;SACH,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,0EAA0E;QAC1E,0EAA0E,CAC3E;SACA,cAAc,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SAC/E,cAAc,CAAC,sBAAsB,EAAE,yCAAyC,CAAC;SACjF,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;SACjE,MAAM,CAAC,kBAAkB,EAAE,uDAAuD,CAAC;SACnF,MAAM,CACL,8BAA8B,EAC9B,4DAA4D,CAC7D;SACA,MAAM,CAAC,QAAQ,EAAE,0CAA0C,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,OAAwB,EAAE,EAAE;QACzC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,uEAAuE;gBACvE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,0EAA0E;YAC1E,wDAAwD;YACxD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAChD,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,GAAG,oBAAoB,CAAC;gBAC5B,QAAQ;gBACR,GAAG;gBACH,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,SAAS,CAAC,EAAE;gBACvG,QAAQ,EAAE,QAAQ,EAAE;gBACpB,YAAY,EAAE,oBAAoB,EAAE;gBACpC,UAAU,EAAE,UAAU,EAAE;gBACxB,kBAAkB,EAAE,OAAO,CAAC,uBAAuB,KAAK,IAAI;aAC7D,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,EAAE;gBACjD,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,QAAQ;aACT,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC;YACrE,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,KAAK,uBAAuB,EAAE,CAAC;gBACvD,MAAM,CAAC,IAAI,CACT,oHAAoH,CACrH,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,sFAAsF,CAAC;SACnG,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;SACnE,MAAM,CAAC,CAAC,UAAkB,EAAE,OAAsB,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACjD,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,OAAO,CAAC,0BAA0B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,qEAAqE,CAAC;SAClF,cAAc,CACb,iBAAiB,EACjB,qEAAqE,CACtE;SACA,MAAM,CAAC,QAAQ,EAAE,6CAA6C,CAAC;SAC/D,MAAM,CAAC,CAAC,UAAkB,EAAE,OAAuB,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,6BAA6B,CAAC;gBACtC,MAAM;gBACN,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,+BAA+B,CACpC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC;YACd,MAAM,EAAE,OAAO,CAAC,UAAU;YAC1B,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,oBAAoB,EAAE,OAAO,CAAC,gBAAgB;YAC9C,iBAAiB,EAAE,OAAO,CAAC,SAAS;SACrC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"lmk-escrow.js","sourceRoot":"","sources":["../../src/commands/lmk-escrow.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,4BAA4B,EAC5B,2BAA2B,EAC3B,0BAA0B,GAG3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAiB3C;;;;;;;;GAQG;AACH,KAAK,UAAU,SAAS,CACtB,OAAwB,EACxB,QAAuB;IAEvB,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,OAAO,EAAE,EAAE,CAAC;IAC9D,CAAC;IAED,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;QACxC,4EAA4E;QAC5E,0EAA0E;QAC1E,+DAA+D;QAC/D,MAAM,IAAI,KAAK,CACb,0DAA0D;YAC1D,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAC3C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,4BAA4B,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,6EAA6E;YAC7E,aAAa,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CACvE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC;QAClC,GAAG,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;QAClF,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,EAAE,sBAAsB,CAAC;QAClF,QAAQ,EAAE,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,EAAE,wBAAwB,CAAC;QAC1F,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;QACtF,SAAS,EAAE,OAAO,CAAC,iBAAiB,KAAK,SAAS;YAChD,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;KACtC,CAAC,CAAC;IAEH,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,QAAQ,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9F,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,sBAAsB,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC;AAChE,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,KAAyB,EAAE,IAAY,EAAE,MAAc;IAC5E,MAAM,QAAQ,GAAG,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,6CAA6C,MAAM,IAAI,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,SAAS,cAAc,CAAC,YAAqB;IAC3C,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7D,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,EAAE,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,OAAO,CAAC,IAAY;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,aAAa,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,MAA2D;IAC9E,MAAM,CAAC,QAAQ,CAAC;QACd,WAAW,EAAE,MAAM,CAAC,QAAQ;QAC5B,YAAY,EAAE,MAAM,CAAC,SAAS;QAC9B,YAAY,EAAE,MAAM,CAAC,gBAAgB;QACrC,gBAAgB,EAAE,MAAM,CAAC,cAAc;QACvC,sBAAsB,EAAE,MAAM,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7D,iBAAiB,EAAE,MAAM,CAAC,qBAAqB,CAAC,MAAM,KAAK,CAAC;YAC1D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC3C,iBAAiB,EAAE,MAAM,CAAC,MAAM;QAChC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,IAAI,oBAAoB;QACzD,iBAAiB,EAAE,MAAM,CAAC,gBAAgB,IAAI,MAAM;QACpD,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC;YACrB,aAAa,EAAE,MAAM,CAAC,IAAI;YAC1B,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,mBAAmB,EAAE,MAAM,CAAC,cAAc;SAC3C,CAAC,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,GAAY;IACpD,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,iEAAiE,CAAC,CAAC;IAElF,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAEpC,MAAM;SACH,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CACV,0EAA0E;QAC1E,0EAA0E,CAC3E;SACA,cAAc,CAAC,gBAAgB,EAAE,6CAA6C,CAAC;SAC/E,cAAc,CAAC,sBAAsB,EAAE,yCAAyC,CAAC;SACjF,MAAM,CAAC,mBAAmB,EAAE,oCAAoC,CAAC;SACjE,MAAM,CACL,wBAAwB,EACxB,0EAA0E;QAC1E,uEAAuE;QACvE,2BAA2B,CAC5B;SACA,MAAM,CAAC,sBAAsB,EAAE,gCAAgC,CAAC;SAChE,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,CAAC;SACrF,MAAM,CAAC,wBAAwB,EAAE,+CAA+C,CAAC;SACjF,MAAM,CAAC,uBAAuB,EAAE,iBAAiB,CAAC;SAClD,MAAM,CAAC,4BAA4B,EAAE,gCAAgC,CAAC;SACtE,MAAM,CAAC,kBAAkB,EAAE,uDAAuD,CAAC;SACnF,MAAM,CACL,8BAA8B,EAC9B,4DAA4D,CAC7D;SACA,MAAM,CAAC,QAAQ,EAAE,0CAA0C,CAAC;SAC5D,MAAM,CAAC,KAAK,EAAE,OAAwB,EAAE,EAAE;QACzC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,uEAAuE;gBACvE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,CAAC,uBAAuB,KAAK,IAAI,EAAE,CAAC;YAC/E,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,0EAA0E;YAC1E,wDAAwD;YACxD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;YACpD,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;YACnB,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;YAC5B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,GAAG,oBAAoB,CAAC;gBAC5B,QAAQ;gBACR,GAAG;gBACH,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,SAAS,CAAC,EAAE;gBACvG,QAAQ,EAAE,QAAQ,EAAE;gBACpB,YAAY,EAAE,oBAAoB,EAAE;gBACpC,UAAU,EAAE,UAAU,EAAE;gBACxB,kBAAkB,EAAE,OAAO,CAAC,uBAAuB,KAAK,IAAI;aAC7D,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;YAC1D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,aAAa,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,EAAE;gBACjD,SAAS,EAAE,OAAO,CAAC,KAAK;gBACxB,QAAQ;aACT,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,kEAAkE;gBAClE,yDAAyD;gBACzD,+CAA+C;gBAC/C,MAAM,CAAC,IAAI,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;gBACvC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC;YACrE,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,MAAM,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,KAAK,uBAAuB,EAAE,CAAC;gBACvD,MAAM,CAAC,IAAI,CACT,oHAAoH,CACrH,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,+EAA+E,CAAC,CAAC;QAClG,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC3C,MAAM,KAAK,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,sFAAsF,CAAC;SACnG,MAAM,CAAC,QAAQ,EAAE,iDAAiD,CAAC;SACnE,MAAM,CAAC,CAAC,UAAkB,EAAE,OAAsB,EAAE,EAAE;QACrD,MAAM,MAAM,GAAG,4BAA4B,CAAC,UAAU,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACjD,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,MAAM,CAAC,OAAO,CAAC,0BAA0B,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEL,MAAM;SACH,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,qEAAqE,CAAC;SAClF,cAAc,CACb,iBAAiB,EACjB,qEAAqE,CACtE;SACA,MAAM,CAAC,QAAQ,EAAE,6CAA6C,CAAC;SAC/D,MAAM,CAAC,CAAC,UAAkB,EAAE,OAAuB,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;QACjD,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,6BAA6B,CAAC;gBACtC,MAAM;gBACN,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,+BAA+B,CACpC,CAAC;QACF,MAAM,CAAC,QAAQ,CAAC;YACd,MAAM,EAAE,OAAO,CAAC,UAAU;YAC1B,IAAI,EAAE,OAAO,CAAC,SAAS;YACvB,MAAM,EAAE,OAAO,CAAC,QAAQ;YACxB,oBAAoB,EAAE,OAAO,CAAC,gBAAgB;YAC9C,iBAAiB,EAAE,OAAO,CAAC,MAAM;SAClC,CAAC,CAAC;QACH,MAAM,CAAC,OAAO,CACZ,OAAO,CAAC,OAAO,KAAK,UAAU;YAC5B,CAAC,CAAC,yEAAyE;YAC3E,CAAC,CAAC,8DAA8D,CACnE,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/lmk-preflight.d.ts

@@ -0,0 +1,3 @@
+import { type Command } from 'commander';
+export declare function registerLmkPreflightCommand(lmk: Command): void;
+//# sourceMappingURL=lmk-preflight.d.ts.map

package/dist/commands/lmk-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lmk-preflight.d.ts","sourceRoot":"","sources":["../../src/commands/lmk-preflight.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAiDzC,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAsE9D"}

package/dist/commands/lmk-preflight.js

@@ -0,0 +1,117 @@
+// Path: znvault-cli/src/commands/lmk-preflight.ts
+//
+// `znvault lmk preflight` — read-only, local, and it produces evidence.
+//
+// This is the command that answers "is this deployment in a state where a
+// key-lifecycle operation is safe to start?", and its two hard requirements
+// come from the same place: whoever reads the answer later was not in the room.
+//
+//   IT WRITES NOTHING. Not a row, not an audit entry. That is why it goes
+//   straight to PostgreSQL instead of through the API: both
+//   `/v1/superadmin/rootkey/status` and `.../verify` write an audit row, so
+//   asking them would falsify the property being asserted — invisibly.
+//
+//   IT PRINTS A VERDICT, AND EXITS ON IT. A preflight that reports problems in
+//   prose and exits 0 is a preflight that gets piped into a script and ignored.
+//   Any BLOCKING gate failing means exit 1.
+//
+// The evidence file is the input to the detached signature (A2) and to the
+// isolated-restore bench (D2). It carries the gate results AND everything the
+// gates were computed from, so they can be recomputed from the artefact alone.
+import { hostname } from 'node:os';
+import { writeFileSync } from 'node:fs';
+import * as output from '../lib/output.js';
+import { LocalDBClient, isLocalDbAvailable } from '../lib/db/index.js';
+import { buildEvidence } from '../lib/preflight.js';
+import { getVersion } from '../lib/version.js';
+function currentOperator() {
+    return (process.env.SUDO_USER ??
+        process.env.USER ??
+        `uid-${String(process.getuid?.() ?? 'unknown')}`);
+}
+function renderHuman(evidence) {
+    output.section('BSK Rotation Preflight');
+    output.keyValue({
+        Database: evidence.database.databaseName,
+        PostgreSQL: evidence.database.postgresVersion,
+        'Latest migration': evidence.database.latestMigration ?? 'unknown',
+        'WAL LSN': evidence.database.walLsn,
+        'Captured at': evidence.capturedAt,
+        Operator: `${evidence.operator}@${evidence.hostname}`,
+    });
+    output.table(['Gate', 'Severity', 'Status', 'Detail'], evidence.gates.map((g) => [g.id, g.severity, g.status, g.detail]));
+    if (evidence.verdict === 'GREEN') {
+        output.success('GREEN — every blocking gate passed. Informational findings above are ' +
+            'recorded, not ignored.');
+    }
+    else {
+        output.error('RED — at least one blocking gate failed. Do not start a key-lifecycle ' +
+            'operation until every one of them is resolved.');
+    }
+}
+export function registerLmkPreflightCommand(lmk) {
+    lmk
+        .command('preflight')
+        .description('Read-only inventory of the key hierarchy with pass/fail gates. Writes ' +
+        'nothing to the database and produces a JSON evidence artefact.')
+        .option('--json', 'Output only the evidence artefact as JSON')
+        .option('--out <path>', 'Also write the evidence artefact to this path')
+        .action(async (options) => {
+        if (!isLocalDbAvailable()) {
+            throw new Error('The preflight is local-only. Run it on a Vault node with local database ' +
+                'configuration: reading this state through the API would write audit rows, ' +
+                'and "zero writes" is the property being demonstrated.');
+        }
+        const database = new LocalDBClient();
+        let evidence;
+        try {
+            const snapshot = await database.capturePreflight();
+            const body = {
+                artifact: 'znvault-preflight-v1',
+                capturedAt: snapshot.capturedAt.toISOString(),
+                cliVersion: getVersion(),
+                operator: currentOperator(),
+                hostname: hostname(),
+                database: {
+                    databaseName: snapshot.databaseName,
+                    postgresVersion: snapshot.postgresVersion,
+                    walLsn: snapshot.walLsn,
+                    transactionSnapshot: snapshot.transactionSnapshot,
+                    latestMigration: snapshot.latestMigration,
+                },
+                lmkVersions: snapshot.lmkVersions,
+                rootKeyEnvelopes: snapshot.rootKeyEnvelopes,
+                rootKeyEnvelopesTablePresent: snapshot.rootKeyEnvelopesTablePresent,
+                activeRotations: snapshot.activeRotations,
+                auditHead: snapshot.auditHead,
+                latestVerifiedBackup: snapshot.latestVerifiedBackup,
+            };
+            evidence = buildEvidence(body);
+        }
+        finally {
+            await database.close();
+        }
+        // The artefact is written whatever the verdict. A red preflight is
+        // exactly the one worth keeping: it is the record of why an operation
+        // was not started, and the thing to diff against once it is fixed.
+        if (options.out !== undefined) {
+            writeFileSync(options.out, `${JSON.stringify(evidence, null, 2)}\n`, {
+                encoding: 'utf8',
+                mode: 0o600,
+            });
+        }
+        if (options.json === true) {
+            output.json(evidence);
+        }
+        else {
+            renderHuman(evidence);
+            if (options.out !== undefined) {
+                output.info(`Evidence written to ${options.out}`);
+            }
+        }
+        if (evidence.verdict === 'RED') {
+            process.exitCode = 1;
+        }
+    });
+}
+//# sourceMappingURL=lmk-preflight.js.map

package/dist/commands/lmk-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lmk-preflight.js","sourceRoot":"","sources":["../../src/commands/lmk-preflight.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,EAAE;AACF,wEAAwE;AACxE,EAAE;AACF,0EAA0E;AAC1E,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,0EAA0E;AAC1E,4DAA4D;AAC5D,4EAA4E;AAC5E,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,4CAA4C;AAC5C,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,+EAA+E;AAE/E,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAGxC,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACvE,OAAO,EAAE,aAAa,EAA8C,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAO/C,SAAS,eAAe;IACtB,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,SAAS;QACrB,OAAO,CAAC,GAAG,CAAC,IAAI;QAChB,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,SAAS,CAAC,EAAE,CACjD,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,QAA2B;IAC9C,MAAM,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACzC,MAAM,CAAC,QAAQ,CAAC;QACd,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY;QACxC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe;QAC7C,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,eAAe,IAAI,SAAS;QAClE,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM;QACnC,aAAa,EAAE,QAAQ,CAAC,UAAU;QAClC,QAAQ,EAAE,GAAG,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,EAAE;KACtD,CAAC,CAAC;IAEH,MAAM,CAAC,KAAK,CACV,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,EACxC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAClE,CAAC;IAEF,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,CAAC,OAAO,CACZ,uEAAuE;YACvE,wBAAwB,CACzB,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,KAAK,CACV,wEAAwE;YACxE,gDAAgD,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,GAAY;IACtD,GAAG;SACA,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CACV,wEAAwE;QACxE,gEAAgE,CACjE;SACA,MAAM,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC7D,MAAM,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACvE,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CACb,0EAA0E;gBAC1E,4EAA4E;gBAC5E,uDAAuD,CACxD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,aAAa,EAAE,CAAC;QACrC,IAAI,QAA2B,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACnD,MAAM,IAAI,GAAkB;gBAC1B,QAAQ,EAAE,sBAAsB;gBAChC,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,WAAW,EAAE;gBAC7C,UAAU,EAAE,UAAU,EAAE;gBACxB,QAAQ,EAAE,eAAe,EAAE;gBAC3B,QAAQ,EAAE,QAAQ,EAAE;gBACpB,QAAQ,EAAE;oBACR,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,eAAe,EAAE,QAAQ,CAAC,eAAe;oBACzC,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;oBACjD,eAAe,EAAE,QAAQ,CAAC,eAAe;iBAC1C;gBACD,WAAW,EAAE,QAAQ,CAAC,WAAW;gBACjC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;gBAC3C,4BAA4B,EAAE,QAAQ,CAAC,4BAA4B;gBACnE,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,SAAS,EAAE,QAAQ,CAAC,SAAS;gBAC7B,oBAAoB,EAAE,QAAQ,CAAC,oBAAoB;aACpD,CAAC;YACF,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,MAAM,QAAQ,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;QAED,mEAAmE;QACnE,sEAAsE;QACtE,mEAAmE;QACnE,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,aAAa,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACnE,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxB,CAAC;aAAM,CAAC;YACN,WAAW,CAAC,QAAQ,CAAC,CAAC;YACtB,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACpD,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YAC/B,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/lmk-restore-drill.d.ts

@@ -0,0 +1,3 @@
+import { type Command } from 'commander';
+export declare function registerLmkRestoreDrillCommands(lmk: Command): void;
+//# sourceMappingURL=lmk-restore-drill.d.ts.map

package/dist/commands/lmk-restore-drill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lmk-restore-drill.d.ts","sourceRoot":"","sources":["../../src/commands/lmk-restore-drill.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAoFzC,wBAAgB,+BAA+B,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,CAgGlE"}

package/dist/commands/lmk-restore-drill.js

@@ -0,0 +1,160 @@
+// Path: znvault-cli/src/commands/lmk-restore-drill.ts
+//
+// `znvault superadmin lmk restore-drill {pre,post}` — the two gates of an
+// isolated restore, wired to a real database and a real health endpoint.
+//
+// The drill it gates answers one question: can this escrow bundle bring back
+// THIS deployment's keys? Everything here exists because the obvious way to
+// answer it — start a vault and see if it comes up — answers a different
+// question and answers it wrong. A vault started against an empty database
+// takes the first-boot path, mints a new LMK, and reports a completely healthy
+// start. See src/lib/restore-drill.ts for the full note.
+//
+// Two phases, because the interesting failure is only visible before the vault
+// runs. Once it mints a replacement key the table holds an ordinary version 1
+// with material and nothing distinguishes it from a successful restore.
+//
+//   pre   after restoring the dump, BEFORE starting the vault
+//   post  after the vault is up
+//
+// Both refuse to run against anything that is not loopback: pointed at a live
+// deployment they would compare that deployment against the bundle and record
+// a successful restore in which nothing was restored.
+import { request as httpsRequest } from 'node:https';
+import pg from 'pg';
+import * as output from '../lib/output.js';
+import { readAndVerifyLmkEscrowBundle } from '../lib/lmk-escrow.js';
+import { assertBootedOnRestoredKeys, assertIsolatedTarget, assertRestoredDatabaseIsRecoverable, } from '../lib/restore-drill.js';
+async function readVersions(databaseUrl) {
+    const client = new pg.Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+        const result = await client.query(`SELECT version, status::text AS status, octet_length(wrapped_lmk) AS wrapped
+         FROM lmk_versions ORDER BY version`);
+        return result.rows.map((row) => ({
+            version: row.version,
+            status: row.status,
+            hasWrappedLmk: row.wrapped !== null && Number(row.wrapped) > 0,
+        }));
+    }
+    finally {
+        await client.end();
+    }
+}
+/**
+ * Fetch `/v1/health` from the bench node.
+ *
+ * TLS verification is off, and that is correct here rather than lazy: the bench
+ * node runs a self-signed certificate on loopback, and what the drill actually
+ * authenticates is the KCV in the body against the escrow bundle. Trusting the
+ * certificate would prove the node has a certificate.
+ */
+async function readHealth(healthUrl) {
+    return await new Promise((resolve, reject) => {
+        const req = httpsRequest(healthUrl, { rejectUnauthorized: false, timeout: 10_000 }, (res) => {
+            const chunks = [];
+            res.on('data', (chunk) => chunks.push(chunk));
+            res.on('end', () => {
+                try {
+                    resolve(JSON.parse(Buffer.concat(chunks).toString('utf8')));
+                }
+                catch (error) {
+                    reject(new Error(`Health endpoint did not return JSON: ${String(error)}`));
+                }
+            });
+        });
+        req.on('timeout', () => {
+            req.destroy(new Error('Health endpoint timed out after 10s'));
+        });
+        req.on('error', reject);
+        req.end();
+    });
+}
+function reportVersions(versions) {
+    output.table(['Version', 'Status', 'Wrapped material'], versions.map((v) => [
+        String(v.version),
+        v.status,
+        v.hasWrappedLmk ? 'yes' : 'no',
+    ]));
+}
+export function registerLmkRestoreDrillCommands(lmk) {
+    const drill = lmk
+        .command('restore-drill')
+        .description('Gates for an isolated restore drill. Run "pre" after restoring the dump ' +
+        'and BEFORE starting the vault, then "post" once it is up.');
+    drill
+        .command('pre')
+        .description('Assert the restored database actually carries recoverable key material. ' +
+        'Starting a vault against an empty one mints a new LMK and reports success.')
+        .requiredOption('--database-url <url>', 'Restored database (loopback only)')
+        .requiredOption('--escrow-bundle <path>', 'The escrow bundle being drilled')
+        .option('--json', 'Output the observed inventory as JSON')
+        .action(async (options) => {
+        assertIsolatedTarget(options.databaseUrl, 'database');
+        // Verifying the bundle also authenticates the BSK inside it against every
+        // recoverable LMK generation it carries, so a bundle that cannot open its
+        // own contents fails here rather than halfway through the drill.
+        const bundle = readAndVerifyLmkEscrowBundle(options.escrowBundle);
+        const versions = await readVersions(options.databaseUrl);
+        if (options.json === true) {
+            output.json({ phase: 'pre', bundle, versions });
+        }
+        else {
+            output.section('Restore drill — before starting the vault');
+            output.keyValue({
+                Bundle: bundle.bundleId,
+                'Copy label': bundle.copyLabel,
+                'BSK fingerprint': bundle.bskKcv,
+                'Expected ACTIVE LMK': bundle.activeLmkVersion,
+            });
+            reportVersions(versions);
+        }
+        assertRestoredDatabaseIsRecoverable(versions, bundle.activeLmkVersion);
+        if (options.json !== true) {
+            output.success('The restored database carries the key material the bundle describes. ' +
+                'Start the vault, then run the "post" phase.');
+        }
+    });
+    drill
+        .command('post')
+        .description('Assert the running vault came up on the ESCROWED key and the ESCROWED ' +
+        'LMK version — never on an exit code or an HTTP status.')
+        .requiredOption('--database-url <url>', 'Restored database (loopback only)')
+        .requiredOption('--escrow-bundle <path>', 'The escrow bundle being drilled')
+        .requiredOption('--health-url <url>', 'The bench node /v1/health (loopback only)')
+        .option('--json', 'Output the observed state as JSON')
+        .action(async (options) => {
+        assertIsolatedTarget(options.databaseUrl, 'database');
+        if (options.healthUrl === undefined)
+            throw new Error('--health-url is required');
+        assertIsolatedTarget(options.healthUrl, 'health endpoint');
+        const bundle = readAndVerifyLmkEscrowBundle(options.escrowBundle);
+        const health = await readHealth(options.healthUrl);
+        const versions = await readVersions(options.databaseUrl);
+        if (options.json === true) {
+            output.json({ phase: 'post', bundle, health, versions });
+        }
+        else {
+            output.section('Restore drill — after the vault started');
+            output.keyValue({
+                'Bundle BSK fingerprint': bundle.bskKcv,
+                'Node root-key fingerprint': health.rootKey?.kcv ?? '(no rootKey block)',
+                'Node provider': health.rootKey?.provider ?? '(none)',
+                Degraded: health.rootKey?.degraded === true ? 'YES' : 'no',
+                'Expected ACTIVE LMK': bundle.activeLmkVersion,
+            });
+            reportVersions(versions);
+        }
+        assertBootedOnRestoredKeys({
+            health,
+            versionsAfterBoot: versions,
+            expectedBskKcv: bundle.bskKcv,
+            expectedActiveVersion: bundle.activeLmkVersion,
+        });
+        if (options.json !== true) {
+            output.success('The vault booted on the escrowed bootstrap key and on the escrowed LMK ' +
+                'version. Nothing was minted. This bundle restores this deployment.');
+        }
+    });
+}
+//# sourceMappingURL=lmk-restore-drill.js.map

package/dist/commands/lmk-restore-drill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lmk-restore-drill.js","sourceRoot":"","sources":["../../src/commands/lmk-restore-drill.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,+EAA+E;AAC/E,yDAAyD;AACzD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,wEAAwE;AACxE,EAAE;AACF,8DAA8D;AAC9D,gCAAgC;AAChC,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,sDAAsD;AAEtD,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,MAAM,IAAI,CAAC;AAEpB,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAC;AACpE,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,mCAAmC,GAGpC,MAAM,yBAAyB,CAAC;AAejC,KAAK,UAAU,YAAY,CAAC,WAAmB;IAC7C,MAAM,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,WAAW,EAAE,CAAC,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B;4CACsC,CACvC,CAAC;QACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,aAAa,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;SAC/D,CAAC,CAAC,CAAC;IACN,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,UAAU,CAAC,SAAiB;IACzC,OAAO,MAAM,IAAI,OAAO,CAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACvD,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,EAAE;YAC1F,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACtD,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAe,CAAC,CAAC;gBAC5E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,wCAAwC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;YACrB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxB,GAAG,CAAC,GAAG,EAAE,CAAC;IACZ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,QAA8B;IACpD,MAAM,CAAC,KAAK,CACV,CAAC,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,EACzC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACjB,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;KAC/B,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,GAAY;IAC1D,MAAM,KAAK,GAAG,GAAG;SACd,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CACV,0EAA0E;QAC1E,2DAA2D,CAC5D,CAAC;IAEJ,KAAK;SACF,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CACV,0EAA0E;QAC1E,4EAA4E,CAC7E;SACA,cAAc,CAAC,sBAAsB,EAAE,mCAAmC,CAAC;SAC3E,cAAc,CAAC,wBAAwB,EAAE,iCAAiC,CAAC;SAC3E,MAAM,CAAC,QAAQ,EAAE,uCAAuC,CAAC;SACzD,MAAM,CAAC,KAAK,EAAE,OAAqB,EAAE,EAAE;QACtC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QAEtD,0EAA0E;QAC1E,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;YAC5D,MAAM,CAAC,QAAQ,CAAC;gBACd,MAAM,EAAE,MAAM,CAAC,QAAQ;gBACvB,YAAY,EAAE,MAAM,CAAC,SAAS;gBAC9B,iBAAiB,EAAE,MAAM,CAAC,MAAM;gBAChC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB;aAC/C,CAAC,CAAC;YACH,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,mCAAmC,CAAC,QAAQ,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,CACZ,uEAAuE;gBACvE,6CAA6C,CAC9C,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CACV,wEAAwE;QACxE,wDAAwD,CACzD;SACA,cAAc,CAAC,sBAAsB,EAAE,mCAAmC,CAAC;SAC3E,cAAc,CAAC,wBAAwB,EAAE,iCAAiC,CAAC;SAC3E,cAAc,CAAC,oBAAoB,EAAE,2CAA2C,CAAC;SACjF,MAAM,CAAC,QAAQ,EAAE,mCAAmC,CAAC;SACrD,MAAM,CAAC,KAAK,EAAE,OAAqB,EAAE,EAAE;QACtC,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QACjF,oBAAoB,CAAC,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAE3D,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAEzD,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;YAC1D,MAAM,CAAC,QAAQ,CAAC;gBACd,wBAAwB,EAAE,MAAM,CAAC,MAAM;gBACvC,2BAA2B,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,oBAAoB;gBACxE,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,IAAI,QAAQ;gBACrD,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI;gBAC1D,qBAAqB,EAAE,MAAM,CAAC,gBAAgB;aAC/C,CAAC,CAAC;YACH,cAAc,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,0BAA0B,CAAC;YACzB,MAAM;YACN,iBAAiB,EAAE,QAAQ;YAC3B,cAAc,EAAE,MAAM,CAAC,MAAM;YAC7B,qBAAqB,EAAE,MAAM,CAAC,gBAAgB;SAC/C,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,OAAO,CACZ,yEAAyE;gBACzE,oEAAoE,CACrE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/lmk.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lmk.d.ts","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAyHzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAsV1D"}
+{"version":3,"file":"lmk.d.ts","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AA2HzC,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAwV1D"}

package/dist/commands/lmk.js

@@ -14,11 +14,15 @@ import { client } from '../lib/client.js';
 import * as output from '../lib/output.js';
 import { promptConfirm } from '../lib/prompts.js';
 import { registerLmkEscrowCommands } from './lmk-escrow.js';
+import { registerLmkRestoreDrillCommands } from './lmk-restore-drill.js';
+import { registerLmkPreflightCommand } from './lmk-preflight.js';
 export function registerLmkCommands(program) {
     const lmk = program
         .command('lmk')
         .description('Local Master Key (LMK) management commands');
     registerLmkEscrowCommands(lmk);
+    registerLmkRestoreDrillCommands(lmk);
+    registerLmkPreflightCommand(lmk);
     const rotation = lmk
         .command('rotation')
         .description('LMK rotation operations');

package/dist/commands/lmk.js.map

@@ -1 +1 @@
-{"version":3,"file":"lmk.js","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,qCAAqC;AACrC,EAAE;AACF,4CAA4C;AAC5C,4EAA4E;AAC5E,gDAAgD;AAChD,0CAA0C;AAC1C,qDAAqD;AACrD,4DAA4D;AAC5D,EAAE;AACF,qEAAqE;AAIrE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAoH5D,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAE/B,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,oEAAoE;QACpE,4DAA4D,CAC7D;SACA,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CACL,UAAU,EACV,kEAAkE;QAClE,2EAA2E,CAC5E;SACA,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CAAC,UAAU,EAAE,qDAAqD,CAAC;SACzE,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,iBAAiB,CAClB;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,+BAA+B,EAC/B,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;gBACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;gBAC7C,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;gBACzC,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;gBAC/B,sBAAsB,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;gBAC5C,wBAAwB,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;gBAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CACT,oEAAoE;oBACpE,8DAA8D;oBAC9D,mCAAmC,CACpC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,kEAAkE;oBAClE,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAC/C,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,KAAK,WAAW,MAAM,EAAE,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,KAAK,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,kBAAkB,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CACV,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,EAChF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,aAAa,EAAE;YACzC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,WAAW,IAAI,GAAG;SACrB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAmB,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,UAAU,EAAE,CACvC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,YAAY,EAAE,MAAM,CAAC,SAAS;YAC9B,eAAe,EAAE,MAAM,CAAC,YAAY;YACpC,aAAa,EAAE,MAAM,CAAC,UAAU;YAChC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;YAC3F,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACxC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;SAC1C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,iEAAiE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CACV,yEAAyE;QACzE,qEAAqE;QACrE,sBAAsB,CACvB;SACA,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;SAClF,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAsB,EAAE,EAAE;QAC3D,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,iEAAiE;gBACjE,gEAAgE;gBAChE,+DAA+D,CAChE,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,mBAAmB,UAAU,GAAG,EAChC,KAAK,CACN,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,0BAA0B,UAAU,SAAS,EAC7C,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,+BAA+B,EAAE,CAC9D,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,kCAAkC;IAClC,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,6BAA6B,CAC9B;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,wCAAwC,EACxC,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,UAAU;oBACb,MAAM,CAAC,OAAO,CACZ,oEAAoE;wBACpE,0CAA0C,CAC3C,CAAC;oBACF,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;oBACtE,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;oBAC7D,MAAM;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mDAAmD;IACnD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E,CAC/E;SACA,MAAM,CAAC,SAAS,EAAE,iDAAiD,CAAC;SACpE,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC;SAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;SACzF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,4EAA4E;QAC5E,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiC,sBAAsB,CAAC,CAAC;YACtF,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACrC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM;aACnB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uCAAuC,CAAC;aACjF,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAwB,gCAAgC,EAAE;gBACxF,MAAM,EAAE,CAAC,KAAK;gBACd,kBAAkB,EAAE,WAAW;gBAC/B,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACvF,MAAM,CAAC,QAAQ,CAAC;gBACd,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;gBACvD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBACnE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAChD,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM;aAC5D,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC,QAAQ,mBAAmB,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,OAAO,CACZ,8EAA8E;oBAC9E,8DAA8D,CAC/D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,gCAAgC;AAChC,8EAA8E;AAC9E,KAAK,UAAU,QAAQ,CAAC,OAAsB;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,wEAAwE;YACxE,2EAA2E;YAC3E,oEAAoE;YACpE,2EAA2E;YAC3E,uDAAuD,CACxD,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oEAAoE;gBACpE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,SAAS;YACP,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,4CAA4C,EAChD,KAAK,CACN,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,4BAA4B,CAAC;SACrG,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC;QACH,MAAM,IAAI,GAAiD,EAAE,SAAS,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,eAAe,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,oDAAoD;oBACpD,0DAA0D;oBAC1D,qEAAqE,CACtE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,sBAAsB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB;oBACxE,wEAAwE;oBACxE,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACrE,uEAAuE;gBACvE,sBAAsB,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"lmk.js","sourceRoot":"","sources":["../../src/commands/lmk.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,qCAAqC;AACrC,EAAE;AACF,4CAA4C;AAC5C,4EAA4E;AAC5E,gDAAgD;AAChD,0CAA0C;AAC1C,qDAAqD;AACrD,4DAA4D;AAC5D,EAAE;AACF,qEAAqE;AAIrE,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,+BAA+B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AAoHjE,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,GAAG,GAAG,OAAO;SAChB,OAAO,CAAC,KAAK,CAAC;SACd,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,yBAAyB,CAAC,GAAG,CAAC,CAAC;IAC/B,+BAA+B,CAAC,GAAG,CAAC,CAAC;IACrC,2BAA2B,CAAC,GAAG,CAAC,CAAC;IAEjC,MAAM,QAAQ,GAAG,GAAG;SACjB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAE1C,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,oEAAoE;QACpE,4DAA4D,CAC7D;SACA,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CACL,UAAU,EACV,kEAAkE;QAClE,2EAA2E,CAC5E;SACA,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,yDAAyD;IACzD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,0BAA0B,EAAE,yDAAyD,CAAC;SAC7F,MAAM,CAAC,UAAU,EAAE,qDAAqD,CAAC;SACzE,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAsB,EAAE,EAAE;QACvC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,iBAAiB,CAClB;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,+BAA+B,EAC/B,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACpB,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;gBACtD,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;YACvC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,GAAG;gBACvC,kBAAkB,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;gBAC7C,gBAAgB,EAAE,MAAM,CAAC,SAAS,IAAI,GAAG;gBACzC,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC;gBAC/B,sBAAsB,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;gBAC5C,wBAAwB,EAAE,MAAM,CAAC,OAAO,IAAI,CAAC;gBAC7C,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;aAC7B,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,MAAM,CAAC,IAAI,CACT,oEAAoE;oBACpE,8DAA8D;oBAC9D,mCAAmC,CACpC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,kEAAkE;oBAClE,kBAAkB,CACnB,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAC9C,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,aAAa,EAAE,wBAAwB,CAAC;SAC/C,MAAM,CAAC,cAAc,EAAE,yBAAyB,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAoB,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,UAAU,KAAK,WAAW,MAAM,EAAE,CAAC;QAEjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,KAAK,EAAE,CAClC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,kBAAkB,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,MAAM,CAAC,KAAK,CACV,CAAC,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,uBAAuB,EAAE,SAAS,EAAE,IAAI,CAAC,EAChF,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,MAAM;YACR,GAAG,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,aAAa,EAAE;YACzC,GAAG,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,SAAS,EAAE;YAClD,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9B,CAAC,CAAC,WAAW,IAAI,GAAG;SACrB,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,iCAAiC;IACjC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,wCAAwC,CAAC;SACrD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAmB,EAAE,EAAE;QACxD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAC7B,0BAA0B,UAAU,EAAE,CACvC,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,gBAAgB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,QAAQ,CAAC;YACd,QAAQ,EAAE,MAAM,CAAC,MAAM;YACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,iBAAiB,EAAE,MAAM,CAAC,aAAa;YACvC,YAAY,EAAE,MAAM,CAAC,SAAS;YAC9B,eAAe,EAAE,MAAM,CAAC,YAAY;YACpC,aAAa,EAAE,MAAM,CAAC,UAAU;YAChC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;YAC9C,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG;YAC3F,aAAa,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACxC,cAAc,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;SAC1C,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,iEAAiE,CAAC,CAAC;QACxG,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mCAAmC;IACnC,4EAA4E;IAC5E,QAAQ;SACL,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CACV,yEAAyE;QACzE,qEAAqE;QACrE,sBAAsB,CACvB;SACA,MAAM,CAAC,qBAAqB,EAAE,mDAAmD,CAAC;SAClF,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,UAAkB,EAAE,OAAsB,EAAE,EAAE;QAC3D,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CACT,iEAAiE;gBACjE,gEAAgE;gBAChE,+DAA+D,CAChE,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,mBAAmB,UAAU,GAAG,EAChC,KAAK,CACN,CAAC;YACF,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,0BAA0B,UAAU,SAAS,EAC7C,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,+BAA+B,EAAE,CAC9D,CAAC;QAEF,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,kCAAkC;IAClC,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,6BAA6B,CAC9B;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAmB,EAAE,EAAE;QACpC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,mCAAmC,CAAC,CAAC,KAAK,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,wCAAwC,EACxC,EAAE,CACH,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;gBACtB,KAAK,UAAU;oBACb,MAAM,CAAC,OAAO,CACZ,oEAAoE;wBACpE,0CAA0C,CAC3C,CAAC;oBACF,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;oBACtE,MAAM;gBACR,KAAK,YAAY;oBACf,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;oBAC7D,MAAM;YACV,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;YACvD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,4EAA4E;IAC5E,mDAAmD;IACnD,4EAA4E;IAC5E,GAAG;SACA,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,yEAAyE;QACzE,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E,CAC/E;SACA,MAAM,CAAC,SAAS,EAAE,iDAAiD,CAAC;SACpE,MAAM,CAAC,SAAS,EAAE,uDAAuD,CAAC;SAC1E,MAAM,CAAC,oBAAoB,EAAE,2DAA2D,CAAC;SACzF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,OAAuB,EAAE,EAAE;QACxC,4EAA4E;QAC5E,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACtC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAiC,sBAAsB,CAAC,CAAC;YACtF,WAAW,GAAG,IAAI,CAAC,iBAAiB,CAAC;YACrC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,EAAE,EAAE,CAAC;gBACpD,MAAM,CAAC,KAAK,CAAC,yEAAyE,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM;aACnB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,uCAAuC,CAAC;aACjF,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAwB,gCAAgC,EAAE;gBACxF,MAAM,EAAE,CAAC,KAAK;gBACd,kBAAkB,EAAE,WAAW;gBAC/B,OAAO,EAAE,iBAAiB;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI;aAC9B,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACvF,MAAM,CAAC,QAAQ,CAAC;gBACd,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;gBACvD,wBAAwB,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBACnE,kBAAkB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO;gBAChD,yBAAyB,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM;aAC5D,CAAC,CAAC;YACH,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC,QAAQ,mBAAmB,MAAM,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACnB,MAAM,CAAC,OAAO,CACZ,8EAA8E;oBAC9E,8DAA8D,CAC/D,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;YACvC,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC;AAED,8EAA8E;AAC9E,mEAAmE;AACnE,gCAAgC;AAChC,8EAA8E;AAC9E,KAAK,UAAU,QAAQ,CAAC,OAAsB;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAE1C,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,CACT,wEAAwE;YACxE,2EAA2E;YAC3E,oEAAoE;YACpE,2EAA2E;YAC3E,uDAAuD,CACxD,CAAC;QACF,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CACT,oEAAoE;gBACpE,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,SAAS;YACP,CAAC,CAAC,2CAA2C;YAC7C,CAAC,CAAC,4CAA4C,EAChD,KAAK,CACN,CAAC;QACF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,4BAA4B,CAAC;SACrG,KAAK,EAAE,CAAC;IAEX,IAAI,CAAC;QACH,MAAM,IAAI,GAAiD,EAAE,SAAS,EAAE,CAAC;QACzE,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACtC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;YACxC,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,eAAe,EAAE,MAAM,CAAC,YAAY,IAAI,CAAC;gBACzC,aAAa,EAAE,MAAM,CAAC,UAAU,IAAI,CAAC;aACtC,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CACT,oDAAoD;oBACpD,0DAA0D;oBAC1D,qEAAqE,CACtE,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,OAAO,CACZ,sBAAsB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,sBAAsB;oBACxE,wEAAwE;oBACxE,uBAAuB,CACxB,CAAC;YACJ,CAAC;QACH,CAAC;aAAM,CAAC;YACN,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAC9B,sBAAsB,EACtB,IAAI,CACL,CAAC;YACF,OAAO,CAAC,IAAI,EAAE,CAAC;YAEf,IAAI,OAAO,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;YACvD,MAAM,CAAC,QAAQ,CAAC;gBACd,aAAa,EAAE,MAAM,CAAC,UAAU;gBAChC,iBAAiB,EAAE,MAAM,CAAC,aAAa;gBACvC,QAAQ,EAAE,MAAM,CAAC,MAAM;gBACvB,iBAAiB,EAAE,MAAM,CAAC,aAAa,IAAI,CAAC;aAC7C,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CACT,qEAAqE;gBACrE,uEAAuE;gBACvE,sBAAsB,CACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACpC,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/index.js

@@ -39,7 +39,7 @@ import { registerKmipCommands } from './commands/kmip/index.js';
 import { registerMysqlCommands } from './commands/mysql/index.js';
 import { registerMigrationCommands } from './commands/migration.js';
 import { client } from './lib/client.js';
-import { setRuntimeProfile, getActiveProfileName, getConfig, getPlugins, getCredentials, hasApiKey, getStoredApiKeyInfo, } from './lib/config.js';
+import { setRuntimeProfile, listProfileNames, profileExists, getActiveProfileName, getConfig, getPlugins, getCredentials, hasApiKey, getStoredApiKeyInfo, } from './lib/config.js';
 import { cliBanner, helpHint, cliStatusDisplay, quickCommands } from './lib/visual.js';
 import { runBackgroundUpdateCheck } from './lib/cli-update.js';
 import { setOutputMode, setQuietMode } from './lib/output-mode.js';
@@ -48,6 +48,18 @@ import { shouldSkipProfileIndicator } from './lib/banner-policy.js';
 import { configureContextHelp } from './lib/context-help.js';
 import { getVersion } from './lib/version.js';
 import { areCLIPluginsDisabled } from './plugins/policy.js';
+/**
+ * Name of the top-level command group an action belongs to — `profile` for
+ * `znvault profile create`, `superadmin` for `znvault superadmin rootkey
+ * verify` — or null when the action is the root command itself.
+ */
+function topLevelCommandName(actionCommand) {
+    let cmd = actionCommand;
+    while (cmd.parent?.parent) {
+        cmd = cmd.parent;
+    }
+    return cmd.parent ? cmd.name() : null;
+}
 const program = new Command();
 program
     .name('znvault')
@@ -76,8 +88,29 @@ program
     if (opts.quiet) {
         setQuietMode(true);
     }
-    // Set profile override (before any config access)
+    // Set profile override (before any config access).
+    //
+    // Fail closed on a profile that does not exist. getCurrentProfile() falls
+    // back to CONFIG_DEFAULTS (https://localhost:8443) for an unknown name so
+    // a fresh install works out of the box; applied to an explicit
+    // `--profile <name>` that default silently retargets the command at the
+    // operator's own machine. A runbook step like
+    // `znvault --profile prod superadmin rootkey verify` would then report on
+    // localhost, and a verification that answers about the wrong host is worse
+    // than one that refuses to answer.
+    //
+    // The `profile` command group is exempt so profile management itself is
+    // never locked out by its own guard.
     if (opts.profile) {
+        const commandGroup = topLevelCommandName(actionCommand);
+        if (commandGroup !== 'profile' && !profileExists(opts.profile)) {
+            const known = listProfileNames();
+            throw new Error(`unknown profile '${opts.profile}'. ` +
+                (known.length > 0
+                    ? `Configured profiles: ${known.join(', ')}.`
+                    : 'No profiles are configured.') +
+                " Create one with `znvault profile create <name> --vault-url <url>`, or run without --profile to use the active profile.");
+        }
         setRuntimeProfile(opts.profile);
     }
     // Apply URL/insecure overrides