@zincapp/znvault-cli 4.24.1 → 4.24.3

package/dist/commands/dynamic-secrets/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/index.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AA6BzC,cAAc,YAAY,CAAC;AAE3B,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6UrE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/index.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAuCzC,cAAc,YAAY,CAAC;AAE3B,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAyZrE"}

package/dist/commands/dynamic-secrets/index.js

@@ -5,6 +5,8 @@ import { generateCredentials } from './creds.js';
 import { listLeases, getLease, renewLease, revokeLease, } from './lease.js';
 import { registerAllowedHostsCommands } from './allowed-hosts.js';
 import { registerTemplatesCommands } from './templates.js';
+import { getMintOperationStatus, issueMintPermit, revokeMintOperation, } from './permit.js';
+import { closeRecoveryFence, getRecoveryFenceStatus, openRecoveryFence, } from './recovery-fence.js';
 // Re-export types
 export * from './types.js';
 export function registerDynamicSecretsCommands(program) {
@@ -192,7 +194,7 @@ Notes:
         .description('Create a new role for a connection (from a fixed template, or raw SQL as an escape hatch)')
         .option('--name <name>', 'Role name')
         .option('--description <desc>', 'Role description')
-        .option('--template <name>', 'Create from a fixed, versioned server template (e.g. readonly, readwrite, ddl, migrate) — mutually exclusive with the raw SQL flags below')
+        .option('--template <name>', 'Create from a fixed, versioned server template (e.g. readonly, readwrite, ddl, migrate, packleader-client-v1-recovery) — mutually exclusive with the raw SQL flags below')
         .option('--template-version <n>', 'Template version (defaults to latest on the server if omitted)')
         .option('--creation-statements <sql>', '[raw mode, requires dynamic-secrets:roles:write-raw] SQL statements to create credentials (semicolon-separated)')
         .option('--revocation-statements <sql>', '[raw mode] SQL statements to revoke credentials (semicolon-separated)')
@@ -217,6 +219,11 @@ Examples:
   # prints a "bundle_not_applied" warning.
   znvault dynasec role create <mysql-connection-id> --name migrator --template migrate
 
+  # Recovery Fence v1: the server creates this role permanently disabled.
+  # It can mint only through an OPEN fence plus a one-shot permit.
+  znvault dynasec role create <mysql-connection-id> --name packleader-recovery \
+    --template packleader-client-v1-recovery --template-version 1
+
   # Raw mode (escape hatch): hand-write the SQL yourself. Requires the
   # separate "dynamic-secrets:roles:write-raw" permission (NOT auto-granted —
   # ask an admin to grant it if you get a 403).
@@ -225,7 +232,7 @@ Examples:
     --revocation-statements "DROP ROLE IF EXISTS \\"{{username}}\\""
 
 Template catalog (v1, fixed server-side — see "znvault dynasec templates list"):
-  MySQL:      readonly, readwrite, ddl, migrate
+  MySQL:      readonly, readwrite, ddl, migrate, packleader-client-v1-recovery
   PostgreSQL: readonly, readwrite     (ddl/migrate are MySQL-only; using them
                                         on a PostgreSQL connection 400s with
                                         ddl_unsupported_for_engine)
@@ -244,6 +251,7 @@ Notes:
     role
         .command('update <role-id>')
         .description('Update a role')
+        .requiredOption('--expected-config-revision <n>', 'Exact role CAS revision returned by role get')
         .option('--description <desc>', 'Role description')
         .option('--creation-statements <sql>', 'SQL statements to create credentials (semicolon-separated)')
         .option('--revocation-statements <sql>', 'SQL statements to revoke credentials (semicolon-separated)')
@@ -257,6 +265,7 @@ Notes:
         .command('delete <role-id>')
         .alias('rm')
         .description('Delete a role (blocked while retained lease history exists)')
+        .requiredOption('--expected-config-revision <n>', 'Exact role CAS revision returned by role get')
         .option('--force', 'Skip confirmation only; does not bypass lease-history retention')
         .option('--json', 'Output as JSON')
         .action(deleteRole);
@@ -309,5 +318,59 @@ Notes:
     // Templates Commands
     // -------------------------------------------------------------------------
     registerTemplatesCommands(dynasec);
+    // -------------------------------------------------------------------------
+    // Recovery Fence v1
+    // -------------------------------------------------------------------------
+    const fence = dynasec
+        .command('recovery-fence')
+        .description('Open, inspect, and close PostgreSQL-authoritative recovery fences');
+    fence
+        .command('open <role-id> <run-id>')
+        .description('Open an idempotent recovery fence around a disabled MySQL role')
+        .requiredOption('--consumer-api-key-id <id>', 'API key bound to all permits in this fence')
+        .requiredOption('--expected-role-revision <n>', 'Pinned role configuration revision')
+        .requiredOption('--expected-role-config-sha256 <hex>', 'Pinned lowercase role configuration SHA-256')
+        .requiredOption('--expires-in-seconds <n>', 'Fence lifetime (PostgreSQL clock)')
+        .requiredOption('--purpose <purpose>', 'Bounded operational purpose')
+        .option('--json', 'Output as JSON')
+        .action(openRecoveryFence);
+    fence
+        .command('status <role-id> <run-id>')
+        .description('Get recovery fence state and drain counters')
+        .option('--json', 'Output as JSON')
+        .action(getRecoveryFenceStatus);
+    fence
+        .command('close <role-id> <run-id>')
+        .description('Advance the fence epoch, drain operations, and verify final closure')
+        .requiredOption('--expected-fence-epoch <n>', 'The OPEN epoch being closed')
+        .option('--json', 'Output as JSON')
+        .action(closeRecoveryFence);
+    const permit = dynasec
+        .command('permit')
+        .description('Issue and inspect one-shot recovery mint permits');
+    permit
+        .command('issue <role-id>')
+        .description('Issue an idempotent maxMints=1 permit (strict operator permission required)')
+        .requiredOption('--fence-id <id>', 'Open recovery fence ID')
+        .requiredOption('--consumer-api-key-id <id>', 'Consumer API key bound to the permit')
+        .requiredOption('--phase <phase>', 'Recovery phase (issue one permit per phase)')
+        .requiredOption('--expires-in-seconds <n>', 'Permit lifetime')
+        .requiredOption('--credential-ttl-seconds <n>', 'Target credential lifetime')
+        .option('--privilege-overlay <overlay>', 'NONE or MYSQL_SCHEMA_LOCK_TABLES (never arbitrary SQL)', 'NONE')
+        .requiredOption('--reason <reason>', 'Auditable recovery reason')
+        .requiredOption('--idempotency-key <uuid>', 'UUID persisted with the request; reuse it unchanged after an uncertain response')
+        .option('--json', 'Output as JSON')
+        .action(issueMintPermit);
+    permit
+        .command('status <permit-id> <request-id>')
+        .description('Get an idempotent permit operation by request ID')
+        .option('--json', 'Output as JSON')
+        .action(getMintOperationStatus);
+    permit
+        .command('revoke <permit-id> <request-id>')
+        .description('Revoke by request ID, including a pre-acquire tombstone')
+        .option('--reason <reason>', 'Revocation reason')
+        .option('--json', 'Output as JSON')
+        .action(revokeMintOperation);
 }
 //# sourceMappingURL=index.js.map

package/dist/commands/dynamic-secrets/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAO9C,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,kBAAkB;AAClB,cAAc,YAAY,CAAC;AAE3B,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBzB,CAAC,CAAC;IAED,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAE1G,UAAU;SACP,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,eAAe,CAAC,CAAC;IAE3B,UAAU;SACP,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,UAAU;SACP,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAC1C,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,8BAA8B,EAAE,4BAA4B,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SACxD,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;SAC9D,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B,UAAU;SACP,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SACxD,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;SAC9D,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACrE,MAAM,CAAC,uCAAuC,EAAE,yHAAyH,CAAC;SAC1K,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B,UAAU;SACP,OAAO,CAAC,qBAAqB,CAAC;SAC9B,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CAAC,SAAS,EAAE,iEAAiE,CAAC;SACpF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B,UAAU;SACP,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1B,UAAU;SACP,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CACV,qFAAqF;QACrF,6FAA6F;QAC7F,0CAA0C;QAC1C,0FAA0F;QAC1F,4BAA4B,CAC7B;SACA,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACxE,MAAM,CACL,oBAAoB,EACpB,0FAA0F;QAC1F,+FAA+F;QAC/F,sGAAsG,CACvG;SACA,MAAM,CAAC,2BAA2B,EAAE,oEAAoE,CAAC;SACzG,MAAM,CAAC,0BAA0B,EAAE,qFAAqF,CAAC;SACzH,MAAM,CAAC,wBAAwB,EAAE,iFAAiF,CAAC;SACnH,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CzB,CAAC;SACG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,UAAU;SACP,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,sFAAsF;QACtF,mFAAmF,CACpF;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;CAgBzB,CAAC;SACG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEjC,4EAA4E;IAC5E,gBAAgB;IAChB,4EAA4E;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAE5E,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,gBAAgB,CAAC;SAC7B,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACtD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,SAAS,CAAC,CAAC;IAErB,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI;SACD,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,2FAA2F,CAAC;SACxG,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC;SACpC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,mBAAmB,EAAE,2IAA2I,CAAC;SACxK,MAAM,CAAC,wBAAwB,EAAE,gEAAgE,CAAC;SAClG,MAAM,CAAC,6BAA6B,EAAE,iHAAiH,CAAC;SACxJ,MAAM,CAAC,+BAA+B,EAAE,uEAAuE,CAAC;SAChH,MAAM,CAAC,0BAA0B,EAAE,sEAAsE,CAAC;SAC1G,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,gCAAgC,EAAE,mEAAmE,CAAC;SAC7G,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCzB,CAAC;SACG,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI;SACD,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,eAAe,CAAC;SAC5B,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,6BAA6B,EAAE,4DAA4D,CAAC;SACnG,MAAM,CAAC,+BAA+B,EAAE,4DAA4D,CAAC;SACrG,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;SAC/F,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI;SACD,OAAO,CAAC,kBAAkB,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,6DAA6D,CAAC;SAC1E,MAAM,CAAC,SAAS,EAAE,iEAAiE,CAAC;SACpF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEzG,KAAK;SACF,OAAO,CAAC,oBAAoB,CAAC;SAC7B,KAAK,CAAC,KAAK,CAAC;SACZ,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAE/E,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAC1C,MAAM,CAAC,mBAAmB,EAAE,8DAA8D,CAAC;SAC3F,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,KAAK;SACF,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpB,KAAK;SACF,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,eAAe,CAAC;SAC5B,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC;SACtC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAC5E,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAEtC,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAC5E,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAO9C,OAAO,EACL,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,SAAS,EACT,OAAO,EACP,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EACL,UAAU,EACV,QAAQ,EACR,UAAU,EACV,WAAW,GACZ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,4BAA4B,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,sBAAsB,EACtB,eAAe,EACf,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,kBAAkB;AAClB,cAAc,YAAY,CAAC;AAE3B,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,6DAA6D,CAAC;SAC1E,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBzB,CAAC,CAAC;IAED,4EAA4E;IAC5E,sBAAsB;IACtB,4EAA4E;IAC5E,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,6BAA6B,CAAC,CAAC;IAE1G,UAAU;SACP,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,+BAA+B,CAAC;SAC5C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,eAAe,CAAC,CAAC;IAE3B,UAAU;SACP,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,aAAa,CAAC,CAAC;IAEzB,UAAU;SACP,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kCAAkC,CAAC;SAC/C,MAAM,CAAC,eAAe,EAAE,iBAAiB,CAAC;SAC1C,MAAM,CAAC,eAAe,EAAE,qCAAqC,CAAC;SAC9D,MAAM,CAAC,8BAA8B,EAAE,4BAA4B,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SACxD,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;SAC9D,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B,UAAU;SACP,OAAO,CAAC,qBAAqB,CAAC;SAC9B,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,sBAAsB,EAAE,wBAAwB,CAAC;SACxD,MAAM,CAAC,uBAAuB,EAAE,0BAA0B,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,+BAA+B,CAAC;SAC9D,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,wCAAwC,CAAC;SACrE,MAAM,CAAC,uCAAuC,EAAE,yHAAyH,CAAC;SAC1K,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B,UAAU;SACP,OAAO,CAAC,qBAAqB,CAAC;SAC9B,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CAAC,SAAS,EAAE,iEAAiE,CAAC;SACpF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAE5B,UAAU;SACP,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,4BAA4B,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,cAAc,CAAC,CAAC;IAE1B,UAAU;SACP,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CACV,qFAAqF;QACrF,6FAA6F;QAC7F,0CAA0C;QAC1C,0FAA0F;QAC1F,4BAA4B,CAC7B;SACA,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACxE,MAAM,CACL,oBAAoB,EACpB,0FAA0F;QAC1F,+FAA+F;QAC/F,sGAAsG,CACvG;SACA,MAAM,CAAC,2BAA2B,EAAE,oEAAoE,CAAC;SACzG,MAAM,CAAC,0BAA0B,EAAE,qFAAqF,CAAC;SACzH,MAAM,CAAC,wBAAwB,EAAE,iFAAiF,CAAC;SACnH,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6CzB,CAAC;SACG,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,UAAU;SACP,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CACV,sFAAsF;QACtF,mFAAmF,CACpF;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;CAgBzB,CAAC;SACG,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAEjC,4EAA4E;IAC5E,gBAAgB;IAChB,4EAA4E;IAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,yBAAyB,CAAC,CAAC;IAE5E,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,gBAAgB,CAAC;SAC7B,MAAM,CAAC,mBAAmB,EAAE,yBAAyB,CAAC;SACtD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,SAAS,CAAC,CAAC;IAErB,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI;SACD,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,2FAA2F,CAAC;SACxG,MAAM,CAAC,eAAe,EAAE,WAAW,CAAC;SACpC,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,mBAAmB,EAAE,0KAA0K,CAAC;SACvM,MAAM,CAAC,wBAAwB,EAAE,gEAAgE,CAAC;SAClG,MAAM,CAAC,6BAA6B,EAAE,iHAAiH,CAAC;SACxJ,MAAM,CAAC,+BAA+B,EAAE,uEAAuE,CAAC;SAChH,MAAM,CAAC,0BAA0B,EAAE,sEAAsE,CAAC;SAC1G,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,gCAAgC,EAAE,mEAAmE,CAAC;SAC7G,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,WAAW,CAAC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CzB,CAAC;SACG,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI;SACD,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,eAAe,CAAC;SAC5B,cAAc,CAAC,gCAAgC,EAAE,8CAA8C,CAAC;SAChG,MAAM,CAAC,sBAAsB,EAAE,kBAAkB,CAAC;SAClD,MAAM,CAAC,6BAA6B,EAAE,4DAA4D,CAAC;SACnG,MAAM,CAAC,+BAA+B,EAAE,4DAA4D,CAAC;SACrG,MAAM,CAAC,0BAA0B,EAAE,2DAA2D,CAAC;SAC/F,MAAM,CAAC,yBAAyB,EAAE,wBAAwB,CAAC;SAC3D,MAAM,CAAC,qBAAqB,EAAE,wBAAwB,CAAC;SACvD,MAAM,CAAC,kBAAkB,EAAE,qCAAqC,CAAC;SACjE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,IAAI;SACD,OAAO,CAAC,kBAAkB,CAAC;SAC3B,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,6DAA6D,CAAC;SAC1E,cAAc,CAAC,gCAAgC,EAAE,8CAA8C,CAAC;SAChG,MAAM,CAAC,SAAS,EAAE,iEAAiE,CAAC;SACpF,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,4EAA4E;IAC5E,uBAAuB;IACvB,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,+BAA+B,CAAC,CAAC;IAEzG,KAAK;SACF,OAAO,CAAC,oBAAoB,CAAC;SAC7B,KAAK,CAAC,KAAK,CAAC;SACZ,WAAW,CAAC,mCAAmC,CAAC;SAChD,MAAM,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;SACtD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAE/B,4EAA4E;IAC5E,iBAAiB;IACjB,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC;IAE/E,KAAK;SACF,OAAO,CAAC,MAAM,CAAC;SACf,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,wBAAwB,CAAC;SACrC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAC1C,MAAM,CAAC,mBAAmB,EAAE,8DAA8D,CAAC;SAC3F,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,KAAK;SACF,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAEpB,KAAK;SACF,OAAO,CAAC,kBAAkB,CAAC;SAC3B,WAAW,CAAC,eAAe,CAAC;SAC5B,MAAM,CAAC,iBAAiB,EAAE,oBAAoB,CAAC;SAC/C,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,UAAU,CAAC,CAAC;IAEtB,KAAK;SACF,OAAO,CAAC,mBAAmB,CAAC;SAC5B,WAAW,CAAC,2DAA2D,CAAC;SACxE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,SAAS,EAAE,mBAAmB,CAAC;SACtC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,WAAW,CAAC,CAAC;IAEvB,4EAA4E;IAC5E,yBAAyB;IACzB,4EAA4E;IAC5E,4BAA4B,CAAC,OAAO,CAAC,CAAC;IAEtC,4EAA4E;IAC5E,qBAAqB;IACrB,4EAA4E;IAC5E,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEnC,4EAA4E;IAC5E,oBAAoB;IACpB,4EAA4E;IAC5E,MAAM,KAAK,GAAG,OAAO;SAClB,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CAAC,mEAAmE,CAAC,CAAC;IAEpF,KAAK;SACF,OAAO,CAAC,yBAAyB,CAAC;SAClC,WAAW,CAAC,gEAAgE,CAAC;SAC7E,cAAc,CAAC,4BAA4B,EAAE,4CAA4C,CAAC;SAC1F,cAAc,CAAC,8BAA8B,EAAE,oCAAoC,CAAC;SACpF,cAAc,CAAC,qCAAqC,EAAE,6CAA6C,CAAC;SACpG,cAAc,CAAC,0BAA0B,EAAE,mCAAmC,CAAC;SAC/E,cAAc,CAAC,qBAAqB,EAAE,6BAA6B,CAAC;SACpE,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAE7B,KAAK;SACF,OAAO,CAAC,2BAA2B,CAAC;SACpC,WAAW,CAAC,6CAA6C,CAAC;SAC1D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAElC,KAAK;SACF,OAAO,CAAC,0BAA0B,CAAC;SACnC,WAAW,CAAC,qEAAqE,CAAC;SAClF,cAAc,CAAC,4BAA4B,EAAE,6BAA6B,CAAC;SAC3E,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAG,OAAO;SACnB,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kDAAkD,CAAC,CAAC;IAEnE,MAAM;SACH,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CAAC,6EAA6E,CAAC;SAC1F,cAAc,CAAC,iBAAiB,EAAE,wBAAwB,CAAC;SAC3D,cAAc,CAAC,4BAA4B,EAAE,sCAAsC,CAAC;SACpF,cAAc,CAAC,iBAAiB,EAAE,6CAA6C,CAAC;SAChF,cAAc,CAAC,0BAA0B,EAAE,iBAAiB,CAAC;SAC7D,cAAc,CAAC,8BAA8B,EAAE,4BAA4B,CAAC;SAC5E,MAAM,CACL,+BAA+B,EAC/B,wDAAwD,EACxD,MAAM,CACP;SACA,cAAc,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SAChE,cAAc,CACb,0BAA0B,EAC1B,iFAAiF,CAClF;SACA,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,eAAe,CAAC,CAAC;IAE3B,MAAM;SACH,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAElC,MAAM;SACH,OAAO,CAAC,iCAAiC,CAAC;SAC1C,WAAW,CAAC,yDAAyD,CAAC;SACtE,MAAM,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;SAChD,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,mBAAmB,CAAC,CAAC;AACjC,CAAC"}

package/dist/commands/dynamic-secrets/permit.d.ts

@@ -0,0 +1,5 @@
+import type { PermitIssueOptions, PermitRevokeOptions, PermitStatusOptions } from './recovery-types.js';
+export declare function issueMintPermit(roleId: string, options: PermitIssueOptions): Promise<void>;
+export declare function getMintOperationStatus(permitId: string, requestId: string, options: PermitStatusOptions): Promise<void>;
+export declare function revokeMintOperation(permitId: string, requestId: string, options: PermitRevokeOptions): Promise<void>;
+//# sourceMappingURL=permit.d.ts.map

package/dist/commands/dynamic-secrets/permit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/permit.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAGV,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAoC7B,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqChG;AAED,wBAAsB,sBAAsB,CAC1C,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAef;AAED,wBAAsB,mBAAmB,CACvC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,IAAI,CAAC,CAgBf"}

package/dist/commands/dynamic-secrets/permit.js

@@ -0,0 +1,104 @@
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+import { idempotencyUuid, positiveSafeInteger } from './recovery-parse.js';
+function printPermit(permit) {
+    output.keyValue({
+        'Permit ID': permit.permitId,
+        'Fence ID': permit.fenceId,
+        'Fence epoch': permit.fenceEpoch,
+        'State': permit.state,
+        'Consumer API key': permit.consumerApiKeyId,
+        'Phase': permit.phase,
+        'Overlay': permit.privilegeOverlay,
+        'Mints': `${permit.mintsConsumed.toString()}/${permit.maxMints.toString()}`,
+        'Credential TTL': `${permit.credentialTtlSeconds.toString()}s`,
+        'Expires': permit.expiresAt,
+        'Role revision': permit.roleRevision,
+        'Role config SHA-256': permit.roleConfigSha256,
+        'Effective grant plan SHA-256': permit.effectiveGrantPlanSha256,
+    });
+}
+function printOperation(operation) {
+    output.keyValue({
+        'Operation ID': operation.operationId,
+        'Permit ID': operation.permitId,
+        'Request ID': operation.requestId,
+        'State': operation.state,
+        'Fence ID': operation.fenceId,
+        'Fence epoch': operation.fenceEpoch,
+        'Role ID': operation.roleId,
+        'Role revision': operation.roleRevision,
+        'Lease ID': operation.leaseId ?? '-',
+        'Credential expires': operation.credentialExpiresAt ?? '-',
+        'Last error': operation.lastErrorCode ?? '-',
+    });
+}
+export async function issueMintPermit(roleId, options) {
+    const spinner = output.spinner('Issuing one-shot recovery mint permit...').start();
+    try {
+        if (options.privilegeOverlay !== 'NONE'
+            && options.privilegeOverlay !== 'MYSQL_SCHEMA_LOCK_TABLES') {
+            throw new Error('--privilege-overlay must be NONE or MYSQL_SCHEMA_LOCK_TABLES');
+        }
+        const privilegeOverlay = options.privilegeOverlay;
+        const response = await client.request({
+            method: 'POST',
+            path: `/v1/dynamic-secrets/roles/${encodeURIComponent(roleId)}/mint-permits`,
+            headers: { 'Idempotency-Key': idempotencyUuid(options.idempotencyKey) },
+            body: {
+                fenceId: options.fenceId,
+                consumerApiKeyId: options.consumerApiKeyId,
+                phase: options.phase,
+                expiresInSeconds: positiveSafeInteger(options.expiresInSeconds, '--expires-in-seconds'),
+                credentialTtlSeconds: positiveSafeInteger(options.credentialTtlSeconds, '--credential-ttl-seconds'),
+                privilegeOverlay,
+                reason: options.reason,
+            },
+        });
+        spinner.succeed('Recovery mint permit issued');
+        if (options.json)
+            output.json(response);
+        else
+            printPermit(response);
+    }
+    catch (err) {
+        spinner.fail('Failed to issue recovery mint permit');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function getMintOperationStatus(permitId, requestId, options) {
+    const spinner = output.spinner('Fetching recovery mint operation...').start();
+    try {
+        const response = await client.get(`/v1/dynamic-secrets/mint-permits/${encodeURIComponent(permitId)}` +
+            `/operations/${encodeURIComponent(requestId)}`);
+        spinner.stop();
+        if (options.json)
+            output.json(response);
+        else
+            printOperation(response);
+    }
+    catch (err) {
+        spinner.fail('Failed to fetch recovery mint operation');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function revokeMintOperation(permitId, requestId, options) {
+    const spinner = output.spinner('Revoking recovery mint operation...').start();
+    try {
+        const response = await client.put(`/v1/dynamic-secrets/mint-permits/${encodeURIComponent(permitId)}` +
+            `/operations/${encodeURIComponent(requestId)}/revoke`, options.reason ? { reason: options.reason } : {});
+        spinner.succeed('Recovery mint operation revoked');
+        if (options.json)
+            output.json(response);
+        else
+            printOperation(response);
+    }
+    catch (err) {
+        spinner.fail('Failed to revoke recovery mint operation');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=permit.js.map

package/dist/commands/dynamic-secrets/permit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit.js","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/permit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAC,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAC,eAAe,EAAE,mBAAmB,EAAC,MAAM,qBAAqB,CAAC;AASzE,SAAS,WAAW,CAAC,MAAkB;IACrC,MAAM,CAAC,QAAQ,CAAC;QACd,WAAW,EAAE,MAAM,CAAC,QAAQ;QAC5B,UAAU,EAAE,MAAM,CAAC,OAAO;QAC1B,aAAa,EAAE,MAAM,CAAC,UAAU;QAChC,OAAO,EAAE,MAAM,CAAC,KAAK;QACrB,kBAAkB,EAAE,MAAM,CAAC,gBAAgB;QAC3C,OAAO,EAAE,MAAM,CAAC,KAAK;QACrB,SAAS,EAAE,MAAM,CAAC,gBAAgB;QAClC,OAAO,EAAE,GAAG,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE;QAC3E,gBAAgB,EAAE,GAAG,MAAM,CAAC,oBAAoB,CAAC,QAAQ,EAAE,GAAG;QAC9D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,eAAe,EAAE,MAAM,CAAC,YAAY;QACpC,qBAAqB,EAAE,MAAM,CAAC,gBAAgB;QAC9C,8BAA8B,EAAE,MAAM,CAAC,wBAAwB;KAChE,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,SAAwB;IAC9C,MAAM,CAAC,QAAQ,CAAC;QACd,cAAc,EAAE,SAAS,CAAC,WAAW;QACrC,WAAW,EAAE,SAAS,CAAC,QAAQ;QAC/B,YAAY,EAAE,SAAS,CAAC,SAAS;QACjC,OAAO,EAAE,SAAS,CAAC,KAAK;QACxB,UAAU,EAAE,SAAS,CAAC,OAAO;QAC7B,aAAa,EAAE,SAAS,CAAC,UAAU;QACnC,SAAS,EAAE,SAAS,CAAC,MAAM;QAC3B,eAAe,EAAE,SAAS,CAAC,YAAY;QACvC,UAAU,EAAE,SAAS,CAAC,OAAO,IAAI,GAAG;QACpC,oBAAoB,EAAE,SAAS,CAAC,mBAAmB,IAAI,GAAG;QAC1D,YAAY,EAAE,SAAS,CAAC,aAAa,IAAI,GAAG;KAC7C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,OAA2B;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,0CAA0C,CAAC,CAAC,KAAK,EAAE,CAAC;IACnF,IAAI,CAAC;QACH,IACE,OAAO,CAAC,gBAAgB,KAAK,MAAM;eAChC,OAAO,CAAC,gBAAgB,KAAK,0BAA0B,EAC1D,CAAC;YACD,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QACD,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QAClD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAa;YAChD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,eAAe;YAC5E,OAAO,EAAE,EAAC,iBAAiB,EAAE,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,EAAC;YACrE,IAAI,EAAE;gBACJ,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,gBAAgB,EAAE,mBAAmB,CAAC,OAAO,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;gBACvF,oBAAoB,EAAE,mBAAmB,CACvC,OAAO,CAAC,oBAAoB,EAC5B,0BAA0B,CAC3B;gBACD,gBAAgB;gBAChB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB;SACF,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACnC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,QAAgB,EAChB,SAAiB,EACjB,OAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,oCAAoC,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YAClE,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAC/C,CAAC;QACF,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACnC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;QACxD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,QAAgB,EAChB,SAAiB,EACjB,OAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC,KAAK,EAAE,CAAC;IAC9E,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAC/B,oCAAoC,kBAAkB,CAAC,QAAQ,CAAC,EAAE;YAClE,eAAe,kBAAkB,CAAC,SAAS,CAAC,SAAS,EACrD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAC,CAAC,CAAC,CAAC,EAAE,CAC/C,CAAC;QACF,OAAO,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;QACnD,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACnC,cAAc,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACzD,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/dynamic-secrets/recovery-fence.d.ts

@@ -0,0 +1,5 @@
+import type { RecoveryFenceCloseOptions, RecoveryFenceOpenOptions, RecoveryFenceStatusOptions } from './recovery-types.js';
+export declare function openRecoveryFence(roleId: string, runId: string, options: RecoveryFenceOpenOptions): Promise<void>;
+export declare function getRecoveryFenceStatus(roleId: string, runId: string, options: RecoveryFenceStatusOptions): Promise<void>;
+export declare function closeRecoveryFence(roleId: string, runId: string, options: RecoveryFenceCloseOptions): Promise<void>;
+//# sourceMappingURL=recovery-fence.d.ts.map

package/dist/commands/dynamic-secrets/recovery-fence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-fence.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/recovery-fence.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,yBAAyB,EACzB,wBAAwB,EACxB,0BAA0B,EAC3B,MAAM,qBAAqB,CAAC;AA4B7B,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC,CAcf"}

package/dist/commands/dynamic-secrets/recovery-fence.js

@@ -0,0 +1,84 @@
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+import { positiveSafeInteger, sha256Hex } from './recovery-parse.js';
+function fencePath(roleId, runId) {
+    return `/v1/dynamic-secrets/roles/${encodeURIComponent(roleId)}` +
+        `/recovery-fences/${encodeURIComponent(runId)}`;
+}
+function printFence(fence) {
+    output.keyValue({
+        'Fence ID': fence.fenceId,
+        'Run ID': fence.runId,
+        'State': fence.state,
+        'Fence epoch': fence.fenceEpoch,
+        'Close epoch': fence.closeEpoch ?? '-',
+        'Role enabled': String(fence.roleEnabled),
+        'Role revision': fence.roleRevision,
+        'Role config SHA-256': fence.roleConfigSha256,
+        'Grant plan SHA-256': fence.grantPlanSha256,
+        'In-flight mints': fence.inFlightMints,
+        'Active leases': fence.activeLeases,
+        'Recovery required': fence.recoveryRequired,
+        'Non-terminal operations': fence.nonterminalOperations,
+        'Ready permits': fence.readyPermits,
+        'Expires': fence.expiresAt,
+        'Closed': fence.closedAt ?? '-',
+    });
+}
+export async function openRecoveryFence(roleId, runId, options) {
+    const spinner = output.spinner('Opening PostgreSQL-authoritative recovery fence...').start();
+    try {
+        const response = await client.put(fencePath(roleId, runId), {
+            consumerApiKeyId: options.consumerApiKeyId,
+            expectedRoleRevision: positiveSafeInteger(options.expectedRoleRevision, '--expected-role-revision'),
+            expectedRoleConfigSha256: sha256Hex(options.expectedRoleConfigSha256, '--expected-role-config-sha256'),
+            expiresInSeconds: positiveSafeInteger(options.expiresInSeconds, '--expires-in-seconds'),
+            purpose: options.purpose,
+        });
+        spinner.succeed('Recovery fence opened');
+        if (options.json)
+            output.json(response);
+        else
+            printFence(response);
+    }
+    catch (err) {
+        spinner.fail('Failed to open recovery fence');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function getRecoveryFenceStatus(roleId, runId, options) {
+    const spinner = output.spinner('Fetching recovery fence...').start();
+    try {
+        const response = await client.get(fencePath(roleId, runId));
+        spinner.stop();
+        if (options.json)
+            output.json(response);
+        else
+            printFence(response);
+    }
+    catch (err) {
+        spinner.fail('Failed to fetch recovery fence');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+export async function closeRecoveryFence(roleId, runId, options) {
+    const spinner = output.spinner('Closing and verifying recovery fence...').start();
+    try {
+        const response = await client.put(`${fencePath(roleId, runId)}/close`, {
+            expectedFenceEpoch: positiveSafeInteger(options.expectedFenceEpoch, '--expected-fence-epoch'),
+        });
+        spinner.succeed('Recovery fence closed and verified');
+        if (options.json)
+            output.json(response);
+        else
+            printFence(response);
+    }
+    catch (err) {
+        spinner.fail('Failed to close recovery fence');
+        output.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=recovery-fence.js.map

package/dist/commands/dynamic-secrets/recovery-fence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-fence.js","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/recovery-fence.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,MAAM,EAAC,MAAM,qBAAqB,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAC,mBAAmB,EAAE,SAAS,EAAC,MAAM,qBAAqB,CAAC;AAQnE,SAAS,SAAS,CAAC,MAAc,EAAE,KAAa;IAC9C,OAAO,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,EAAE;QAC9D,oBAAoB,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,KAAoB;IACtC,MAAM,CAAC,QAAQ,CAAC;QACd,UAAU,EAAE,KAAK,CAAC,OAAO;QACzB,QAAQ,EAAE,KAAK,CAAC,KAAK;QACrB,OAAO,EAAE,KAAK,CAAC,KAAK;QACpB,aAAa,EAAE,KAAK,CAAC,UAAU;QAC/B,aAAa,EAAE,KAAK,CAAC,UAAU,IAAI,GAAG;QACtC,cAAc,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC;QACzC,eAAe,EAAE,KAAK,CAAC,YAAY;QACnC,qBAAqB,EAAE,KAAK,CAAC,gBAAgB;QAC7C,oBAAoB,EAAE,KAAK,CAAC,eAAe;QAC3C,iBAAiB,EAAE,KAAK,CAAC,aAAa;QACtC,eAAe,EAAE,KAAK,CAAC,YAAY;QACnC,mBAAmB,EAAE,KAAK,CAAC,gBAAgB;QAC3C,yBAAyB,EAAE,KAAK,CAAC,qBAAqB;QACtD,eAAe,EAAE,KAAK,CAAC,YAAY;QACnC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG;KAChC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,KAAa,EACb,OAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,oDAAoD,CAAC,CAAC,KAAK,EAAE,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE;YACzE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,oBAAoB,EAAE,mBAAmB,CACvC,OAAO,CAAC,oBAAoB,EAC5B,0BAA0B,CAC3B;YACD,wBAAwB,EAAE,SAAS,CACjC,OAAO,CAAC,wBAAwB,EAChC,+BAA+B,CAChC;YACD,gBAAgB,EAAE,mBAAmB,CAAC,OAAO,CAAC,gBAAgB,EAAE,sBAAsB,CAAC;YACvF,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QACzC,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACnC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,MAAc,EACd,KAAa,EACb,OAAmC;IAEnC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,KAAK,EAAE,CAAC;IACrE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,IAAI,EAAE,CAAC;QACf,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACnC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAc,EACd,KAAa,EACb,OAAkC;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,KAAK,EAAE,CAAC;IAClF,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgB,GAAG,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,QAAQ,EAAE;YACpF,kBAAkB,EAAE,mBAAmB,CAAC,OAAO,CAAC,kBAAkB,EAAE,wBAAwB,CAAC;SAC9F,CAAC,CAAC;QACH,OAAO,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACtD,IAAI,OAAO,CAAC,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;;YACnC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;QAC/C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}

package/dist/commands/dynamic-secrets/recovery-parse.d.ts

@@ -0,0 +1,4 @@
+export declare function positiveSafeInteger(raw: string, option: string): number;
+export declare function sha256Hex(raw: string, option: string): string;
+export declare function idempotencyUuid(raw: string): string;
+//# sourceMappingURL=recovery-parse.d.ts.map

package/dist/commands/dynamic-secrets/recovery-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-parse.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/recovery-parse.ts"],"names":[],"mappings":"AAGA,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAMvE;AAED,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAK7D;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKnD"}

package/dist/commands/dynamic-secrets/recovery-parse.js

@@ -0,0 +1,22 @@
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+export function positiveSafeInteger(raw, option) {
+    const value = Number(raw);
+    if (!Number.isSafeInteger(value) || value <= 0) {
+        throw new Error(`${option} must be a positive integer`);
+    }
+    return value;
+}
+export function sha256Hex(raw, option) {
+    if (!SHA256_HEX.test(raw)) {
+        throw new Error(`${option} must be a lowercase SHA-256 hex digest`);
+    }
+    return raw;
+}
+export function idempotencyUuid(raw) {
+    if (!UUID.test(raw)) {
+        throw new Error('--idempotency-key must be a UUID');
+    }
+    return raw;
+}
+//# sourceMappingURL=recovery-parse.js.map

package/dist/commands/dynamic-secrets/recovery-parse.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-parse.js","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/recovery-parse.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,GAAG,gBAAgB,CAAC;AACpC,MAAM,IAAI,GAAG,4EAA4E,CAAC;AAE1F,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAc;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,6BAA6B,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,GAAW,EAAE,MAAc;IACnD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/commands/dynamic-secrets/recovery-types.d.ts

@@ -0,0 +1,117 @@
+/** Wire contracts for Dynamic Secrets Recovery Fence v1. */
+export type RecoveryPrivilegeOverlay = 'NONE' | 'MYSQL_SCHEMA_LOCK_TABLES';
+export type RecoveryFenceState = 'OPEN' | 'CLOSING' | 'CLOSED';
+export type MintPermitState = 'READY' | 'CONSUMED';
+export type MintOperationState = 'READY' | 'CLAIMED' | 'UNKNOWN' | 'CONSUMED' | 'DELIVERED' | 'REVOKING' | 'REVOKED' | 'CANCELLED_NO_TARGET' | 'FAILED_NO_TARGET' | 'EXPIRED_REVOKED' | 'RECOVERY_REQUIRED';
+export interface RecoveryFence {
+    fenceId: string;
+    runId: string;
+    fenceEpoch: number;
+    closeEpoch: number | null;
+    state: RecoveryFenceState;
+    roleEnabled: false;
+    roleRevision: number;
+    roleConfigSha256: string;
+    grantPlanSha256: string;
+    inFlightMints: number;
+    activeLeases: number;
+    recoveryRequired: number;
+    nonterminalOperations: number;
+    readyPermits: number;
+    expiresAt: string;
+    closedAt: string | null;
+}
+export interface MintPermit {
+    permitId: string;
+    fenceId: string;
+    fenceEpoch: number;
+    state: MintPermitState;
+    maxMints: 1;
+    mintsConsumed: 0 | 1;
+    roleRevision: number;
+    roleConfigSha256: string;
+    grantPlanSha256: string;
+    effectiveGrantPlanSha256: string;
+    consumerApiKeyId: string;
+    phase: string;
+    privilegeOverlay: RecoveryPrivilegeOverlay;
+    credentialTtlSeconds: number;
+    expiresAt: string;
+}
+export interface RecoveryHpkeEnvelope {
+    version: 'hpke-v1';
+    suite: 'X25519-HKDF-SHA256-ChaCha20Poly1305';
+    enc: string;
+    ciphertext: string;
+    aadSha256: string;
+}
+export interface RecoveryHpkeCredential {
+    permitId: string;
+    requestId: string;
+    state: 'CONSUMED' | 'DELIVERED';
+    envelopeSha256: string;
+    deliveryFormat: 'hpke-v1';
+    envelope: RecoveryHpkeEnvelope;
+    aad: string;
+}
+export interface MintOperation {
+    operationId: string;
+    tenantId: string;
+    permitId: string;
+    requestId: string;
+    state: MintOperationState;
+    fenceId: string;
+    fenceEpoch: number;
+    roleId: string;
+    roleRevision: number;
+    roleConfigSha256: string;
+    grantPlanSha256: string;
+    effectiveGrantPlanSha256: string;
+    privilegeOverlay: RecoveryPrivilegeOverlay;
+    consumerApiKeyId: string;
+    leaseId: string | null;
+    username: string | null;
+    credentialExpiresAt: string | null;
+    createdAt: string;
+    claimedAt: string | null;
+    consumedAt: string | null;
+    deliveredAt: string | null;
+    terminalAt: string | null;
+    lastErrorCode: string | null;
+    credential?: RecoveryHpkeCredential;
+}
+export interface PermitIssueOptions {
+    fenceId: string;
+    consumerApiKeyId: string;
+    phase: string;
+    expiresInSeconds: string;
+    credentialTtlSeconds: string;
+    /** Untrusted Commander string; validated before the request is sent. */
+    privilegeOverlay: string;
+    reason: string;
+    idempotencyKey: string;
+    json?: boolean;
+}
+export interface PermitStatusOptions {
+    json?: boolean;
+}
+export interface PermitRevokeOptions {
+    reason?: string;
+    json?: boolean;
+}
+export interface RecoveryFenceOpenOptions {
+    consumerApiKeyId: string;
+    expectedRoleRevision: string;
+    expectedRoleConfigSha256: string;
+    expiresInSeconds: string;
+    purpose: string;
+    json?: boolean;
+}
+export interface RecoveryFenceStatusOptions {
+    json?: boolean;
+}
+export interface RecoveryFenceCloseOptions {
+    expectedFenceEpoch: string;
+    json?: boolean;
+}
+//# sourceMappingURL=recovery-types.d.ts.map

package/dist/commands/dynamic-secrets/recovery-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-types.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/recovery-types.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAE5D,MAAM,MAAM,wBAAwB,GAAG,MAAM,GAAG,0BAA0B,CAAC;AAC3E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAC/D,MAAM,MAAM,eAAe,GAAG,OAAO,GAAG,UAAU,CAAC;AACnD,MAAM,MAAM,kBAAkB,GAC1B,OAAO,GACP,SAAS,GACT,SAAS,GACT,UAAU,GACV,WAAW,GACX,UAAU,GACV,SAAS,GACT,qBAAqB,GACrB,kBAAkB,GAClB,iBAAiB,GACjB,mBAAmB,CAAC;AAExB,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,WAAW,EAAE,KAAK,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,CAAC,CAAC;IACZ,aAAa,EAAE,CAAC,GAAG,CAAC,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,oBAAoB,EAAE,MAAM,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,SAAS,CAAC;IACnB,KAAK,EAAE,qCAAqC,CAAC;IAC7C,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,UAAU,GAAG,WAAW,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,SAAS,CAAC;IAC1B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,wBAAwB,CAAC;IAC3C,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,CAAC,EAAE,sBAAsB,CAAC;CACrC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,wEAAwE;IACxE,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,wBAAwB;IACvC,gBAAgB,EAAE,MAAM,CAAC;IACzB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,wBAAwB,EAAE,MAAM,CAAC;IACjC,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB"}

package/dist/commands/dynamic-secrets/recovery-types.js

@@ -0,0 +1,3 @@
+/** Wire contracts for Dynamic Secrets Recovery Fence v1. */
+export {};
+//# sourceMappingURL=recovery-types.js.map

package/dist/commands/dynamic-secrets/recovery-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-types.js","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/recovery-types.ts"],"names":[],"mappings":"AAAA,4DAA4D"}

package/dist/commands/dynamic-secrets/role.d.ts

@@ -1,4 +1,4 @@
-import type { RoleCreateOptions, RoleUpdateOptions } from './types.js';
+import type { RoleCreateOptions, RoleDeleteOptions, RoleUpdateOptions } from './types.js';
 export declare function listRoles(options: {
     connection?: string;
     json?: boolean;
@@ -8,8 +8,5 @@ export declare function getRole(roleId: string, options: {
 }): Promise<void>;
 export declare function createRole(connectionId: string, options: RoleCreateOptions): Promise<void>;
 export declare function updateRole(roleId: string, options: RoleUpdateOptions): Promise<void>;
-export declare function deleteRole(roleId: string, options: {
-    force?: boolean;
-    json?: boolean;
-}): Promise<void>;
+export declare function deleteRole(roleId: string, options: RoleDeleteOptions): Promise<void>;
 //# sourceMappingURL=role.d.ts.map

package/dist/commands/dynamic-secrets/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/role.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAgC,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGrG,wBAAsB,SAAS,CAAC,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C/F;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxF;AAcD,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyFhG;AAqDD,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B1F;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B5G"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../../src/commands/dynamic-secrets/role.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAGV,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EAClB,MAAM,YAAY,CAAC;AAIpB,wBAAsB,SAAS,CAAC,OAAO,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6C/F;AAED,wBAAsB,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCxF;AAcD,wBAAsB,UAAU,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyFhG;AAqDD,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+B1F;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC1F"}

package/dist/commands/dynamic-secrets/role.js

@@ -7,6 +7,7 @@ import inquirer from 'inquirer';
 import { client } from '../../lib/client.js';
 import * as output from '../../lib/output.js';
 import { formatDate, formatTtl } from './helpers.js';
+import { positiveSafeInteger } from './recovery-parse.js';
 export async function listRoles(options) {
     const spinner = output.spinner('Fetching roles...').start();
     try {
@@ -65,6 +66,9 @@ export async function getRole(roleId, options) {
             'Username Template': response.usernameTemplate,
             'Default TTL': formatTtl(response.defaultTtlSeconds),
             'Max TTL': formatTtl(response.maxTtlSeconds),
+            'Config Revision': response.configRevision?.toString() ?? '-',
+            'Config SHA-256': response.configSha256 ?? '-',
+            'Grant Plan SHA-256': response.grantPlanSha256 ?? '-',
             'Active Leases': String(response.activeLeases ?? 0),
             'Created': formatDate(response.createdAt),
             'Updated': formatDate(response.updatedAt),
@@ -224,7 +228,9 @@ function describeRoleCreateError(err, options) {
 export async function updateRole(roleId, options) {
     const spinner = output.spinner('Updating role...').start();
     try {
-        const body = {};
+        const body = {
+            expectedConfigRevision: positiveSafeInteger(options.expectedConfigRevision, '--expected-config-revision'),
+        };
         if (options.description !== undefined)
             body.description = options.description;
         if (options.creationStatements)
@@ -269,7 +275,9 @@ export async function deleteRole(roleId, options) {
     }
     const spinner = output.spinner('Deleting role...').start();
     try {
-        await client.delete(`/v1/dynamic-secrets/roles/${roleId}`);
+        const expectedConfigRevision = positiveSafeInteger(options.expectedConfigRevision, '--expected-config-revision');
+        await client.delete(`/v1/dynamic-secrets/roles/${roleId}`
+            + `?expectedConfigRevision=${expectedConfigRevision.toString()}`);
         spinner.succeed('Role deleted');
         if (options.json) {
             output.json({ success: true, roleId });