@zincapp/znvault-cli 4.24.1 → 4.24.3

package/dist/commands/mysql/permit-broker.js

@@ -0,0 +1,365 @@
+/** Secure consumer lifecycle for `znvault mysql exec-permit`. */
+import { client } from '../../lib/client.js';
+import { createMyCnf } from './mycnf.js';
+import { assertMysqlExecCapabilities, assertMysqlOnPath, assertSafeMysqlDatabase, inspectMysqlClient, runMysql, } from './run.js';
+import { generateEphemeralRecoveryRecipient, openRecoveryCredential, } from './recovery-hpke.js';
+const RETRY_DELAYS_MS = [250, 1_000, 2_000];
+const OPERATION_SETTLE_TIMEOUT_MS = 120_000;
+const OPERATION_POLL_DELAYS_MS = [250, 500, 1_000, 2_000];
+const MAX_EXEC_PERMIT_SQL_BYTES = 16 * 1024 * 1024;
+const TERMINAL_STATES = new Set([
+    'REVOKED',
+    'EXPIRED_REVOKED',
+    'CANCELLED_NO_TARGET',
+    'FAILED_NO_TARGET',
+]);
+async function prepareExecPermitSql(options) {
+    if (options.input !== undefined) {
+        if (options.files && options.files.length > 0) {
+            throw new Error('Recovery SQL input and --file cannot be combined');
+        }
+        if (options.input.length > MAX_EXEC_PERMIT_SQL_BYTES) {
+            throw new Error(`Recovery SQL exceeds ${MAX_EXEC_PERMIT_SQL_BYTES} bytes`);
+        }
+        const copy = Buffer.from(options.input);
+        if (!copy.some(byte => byte > 0x20)) {
+            copy.fill(0);
+            throw new Error('Recovery SQL input is empty');
+        }
+        return copy;
+    }
+    if (!options.files || options.files.length === 0) {
+        throw new Error('znvault mysql exec-permit requires at least one --file with non-empty SQL');
+    }
+    const fs = await import('node:fs/promises');
+    const chunks = [];
+    let totalBytes = 0;
+    try {
+        for (const file of options.files) {
+            const handle = await fs.open(file, 'r');
+            let chunk;
+            try {
+                const stat = await handle.stat();
+                if (!stat.isFile()) {
+                    throw new Error(`Recovery SQL source is not a regular file: ${file}`);
+                }
+                chunk = await handle.readFile();
+            }
+            finally {
+                await handle.close();
+            }
+            totalBytes += chunk.length;
+            if (totalBytes > MAX_EXEC_PERMIT_SQL_BYTES) {
+                throw new Error(`Recovery SQL exceeds ${MAX_EXEC_PERMIT_SQL_BYTES} bytes`);
+            }
+            chunks.push(chunk);
+        }
+        const prepared = Buffer.concat(chunks, totalBytes);
+        if (!prepared.some(byte => byte > 0x20)) {
+            prepared.fill(0);
+            throw new Error('Recovery SQL files contain no executable input');
+        }
+        return prepared;
+    }
+    finally {
+        for (const chunk of chunks)
+            chunk.fill(0);
+    }
+}
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+function statusCode(error) {
+    return error?.statusCode;
+}
+function errorCode(error) {
+    return error?.errorCode;
+}
+function isRetryable(error) {
+    const status = statusCode(error);
+    return status === undefined || status >= 500;
+}
+async function retrySameRequest(request) {
+    let lastError;
+    for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+        try {
+            return await request();
+        }
+        catch (error) {
+            lastError = error;
+            if (!isRetryable(error) || attempt === RETRY_DELAYS_MS.length)
+                throw error;
+            await sleep(RETRY_DELAYS_MS[attempt] ?? 2_000);
+        }
+    }
+    throw lastError;
+}
+function operationPath(permitId, requestId) {
+    return `/v1/dynamic-secrets/mint-permits/${encodeURIComponent(permitId)}` +
+        `/operations/${encodeURIComponent(requestId)}`;
+}
+async function fetchCredential(permitId, requestId) {
+    return await retrySameRequest(async () => await client.get(`${operationPath(permitId, requestId)}/credential`));
+}
+async function acknowledgeCredential(permitId, requestId, envelopeSha256) {
+    return await retrySameRequest(async () => await client.put(`${operationPath(permitId, requestId)}/delivery-ack`, { envelopeSha256 }));
+}
+export async function revokePermitOperationWithRetry(permitId, requestId, reason) {
+    let lastError;
+    for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
+        try {
+            return await client.put(`${operationPath(permitId, requestId)}/revoke`, {
+                reason,
+            });
+        }
+        catch (error) {
+            const status = statusCode(error);
+            let retry = isRetryable(error);
+            // A terminal-state race is safe. Fetch the state so the receipt is exact.
+            if (status === 409) {
+                try {
+                    const current = await client.get(operationPath(permitId, requestId));
+                    if (TERMINAL_STATES.has(current.state))
+                        return current;
+                    retry = true;
+                }
+                catch {
+                    retry = true;
+                }
+            }
+            lastError = error;
+            if (!retry || attempt === RETRY_DELAYS_MS.length)
+                break;
+            await sleep(RETRY_DELAYS_MS[attempt] ?? 2_000);
+        }
+    }
+    const message = lastError instanceof Error ? lastError.message : 'unknown API failure';
+    console.warn(`[znvault] WARN: revoke by requestId did not complete for permit ${permitId}, ` +
+        `request ${requestId}. Retry with 'znvault dynasec permit revoke'. Last error: ${message}`);
+    return null;
+}
+function clearCredential(credential) {
+    if (!credential)
+        return;
+    credential.username = '';
+    credential.password = '';
+    credential.host = '';
+    credential.database = '';
+    credential.expiresAt = '';
+    credential.port = 0;
+}
+function assertDeliverableOperation(operation, permitId, requestId, fenceEpoch) {
+    if (operation.permitId !== permitId
+        || operation.requestId !== requestId
+        || operation.fenceEpoch !== fenceEpoch) {
+        throw new Error('Recovery operation response does not match permit, request, or fence epoch');
+    }
+    if (operation.state !== 'CONSUMED' && operation.state !== 'DELIVERED') {
+        throw new Error(`Recovery operation is ${operation.state}; no credential is safe to execute`);
+    }
+}
+async function waitForDeliverableOperation(initial, permitId, requestId, fenceEpoch) {
+    const deadline = Date.now() + OPERATION_SETTLE_TIMEOUT_MS;
+    let current = initial;
+    let poll = 0;
+    for (;;) {
+        if (current.permitId !== permitId
+            || current.requestId !== requestId
+            || current.fenceEpoch !== fenceEpoch) {
+            throw new Error('Recovery operation response does not match permit, request, or fence epoch');
+        }
+        if (current.state === 'CONSUMED' || current.state === 'DELIVERED')
+            return current;
+        if (TERMINAL_STATES.has(current.state) || current.state === 'RECOVERY_REQUIRED') {
+            throw new Error(`Recovery operation reached ${current.state}; no credential is safe to execute`);
+        }
+        if (Date.now() >= deadline) {
+            throw new Error(`Recovery operation remained ${current.state} for ${OPERATION_SETTLE_TIMEOUT_MS}ms`);
+        }
+        await sleep(OPERATION_POLL_DELAYS_MS[Math.min(poll, OPERATION_POLL_DELAYS_MS.length - 1)]);
+        poll++;
+        current = await retrySameRequest(async () => await client.get(operationPath(permitId, requestId)));
+    }
+}
+/**
+ * Consume, decrypt, ACK, execute, and revoke one one-shot recovery permit.
+ * Password material exists only in the HPKE plaintext buffer/object and an
+ * already-unlinked my.cnf inode inherited by the mysql child.
+ */
+export async function runExecPermit(options) {
+    // Recovery phases have fixed execution semantics. In particular --force,
+    // --one-database, --safe-updates, --reconnect and --wait could omit failed
+    // statements or turn a partial phase into exit 0. Public exec-permit exposes
+    // no passthrough, and internal callers are rejected before recipient
+    // generation or any one-shot consume request.
+    if (options.passthrough !== undefined && options.passthrough.length > 0) {
+        throw new Error('Recovery exec-permit does not accept mysql passthrough flags; ' +
+            'phase execution semantics are fixed.');
+    }
+    const recipient = await generateEphemeralRecoveryRecipient();
+    const consumeBody = Object.freeze({
+        fenceEpoch: options.fenceEpoch,
+        recipientKeyId: recipient.recipientKeyId,
+        recipientPublicKey: recipient.recipientPublicKey,
+        deliveryFormat: 'hpke-v1',
+    });
+    let cleanupArmed = false;
+    let cleanupPromise;
+    let operation;
+    let delivery;
+    let credential;
+    let cnf;
+    let sqlInput;
+    let revokeState = 'RECOVERY_REQUIRED';
+    const cleanup = (reason) => {
+        cleanupPromise ??= (async () => {
+            cnf?.cleanup();
+            clearCredential(credential);
+            if (!cleanupArmed)
+                return true;
+            const revoked = await revokePermitOperationWithRetry(options.permitId, options.requestId, reason);
+            if (revoked) {
+                revokeState = revoked.state;
+                return TERMINAL_STATES.has(revoked.state);
+            }
+            return false;
+        })();
+        return cleanupPromise;
+    };
+    const onSignal = (exitCode) => () => {
+        void (async () => {
+            await cleanup('znvault_mysql_exec_permit_signal');
+            process.exit(exitCode);
+        })();
+    };
+    const onSIGINT = onSignal(130);
+    const onSIGTERM = onSignal(143);
+    const onSIGHUP = onSignal(129);
+    const onUncaughtException = () => {
+        console.error('[znvault] Recovery mysql execution aborted by an uncaught exception');
+        void (async () => {
+            await cleanup('znvault_mysql_exec_permit_uncaught_exception');
+            process.exit(1);
+        })();
+    };
+    process.once('SIGINT', onSIGINT);
+    process.once('SIGTERM', onSIGTERM);
+    process.once('SIGHUP', onSIGHUP);
+    process.once('uncaughtException', onUncaughtException);
+    try {
+        // Prove option-file isolation before consuming the one-shot permit. The
+        // test/custom runner path deliberately skips probing a workstation binary.
+        if (options.run === undefined) {
+            assertMysqlExecCapabilities(inspectMysqlClient(assertMysqlOnPath()));
+        }
+        // Validate and freeze the exact SQL bytes before the one-shot server-side
+        // consume. Missing, unreadable or empty files therefore make zero API calls.
+        sqlInput = await prepareExecPermitSql(options);
+        cleanupArmed = true;
+        const consumeAttempt = { hadUncertainFailure: false };
+        try {
+            operation = await retrySameRequest(async () => {
+                try {
+                    return await client.put(operationPath(options.permitId, options.requestId), consumeBody);
+                }
+                catch (error) {
+                    if (isRetryable(error))
+                        consumeAttempt.hadUncertainFailure = true;
+                    throw error;
+                }
+            });
+        }
+        catch (error) {
+            // A definitive client error means the server rejected the consume before
+            // creating this operation. Do not burn the permit with a tombstone. The
+            // exception is recovery_request_id_conflict: it means this permit/request
+            // already exists with a different recipient key, which is exactly what a
+            // restarted process sees after losing its process-local HPKE private key.
+            // Confirm that operation through the subject-scoped GET, then leave cleanup
+            // armed so the finally path revokes it by requestId. For network/5xx
+            // ambiguity cleanup also remains armed and revoke is mandatory.
+            const status = statusCode(error);
+            if (!consumeAttempt.hadUncertainFailure
+                && status !== undefined
+                && status >= 400
+                && status < 500) {
+                cleanupArmed = false;
+                if (errorCode(error) === 'recovery_request_id_conflict') {
+                    try {
+                        const existing = await retrySameRequest(async () => await client.get(operationPath(options.permitId, options.requestId)));
+                        if (existing.permitId !== options.permitId
+                            || existing.requestId !== options.requestId) {
+                            throw new Error('Recovery operation lookup does not match the conflicted permit or request');
+                        }
+                        cleanupArmed = true;
+                    }
+                    catch (lookupError) {
+                        const lookupStatus = statusCode(lookupError);
+                        // Only the server's exact not-found result proves that no operation
+                        // exists at this subject-scoped path. Authentication, validation,
+                        // conflict, malformed and unavailable responses are ambiguous and
+                        // therefore remain fail-closed via a revoke attempt.
+                        cleanupArmed = !(lookupStatus === 404
+                            && errorCode(lookupError) === 'recovery_operation_not_found');
+                    }
+                }
+            }
+            throw error;
+        }
+        operation = await waitForDeliverableOperation(operation, options.permitId, options.requestId, options.fenceEpoch);
+        assertDeliverableOperation(operation, options.permitId, options.requestId, options.fenceEpoch);
+        delivery = operation.credential ?? await fetchCredential(options.permitId, options.requestId);
+        credential = await openRecoveryCredential({ delivery, operation, recipient });
+        // The database is authenticated HPKE plaintext but may originate in an old
+        // or compromised producer. Reject it before materialising credentials, ACK,
+        // or invoking mysql; the armed finally path revokes by requestId.
+        assertSafeMysqlDatabase(credential.database);
+        // Materialize the credential only into the already-unlinked option-file
+        // inode before ACK. If this fails, MySQL is never invoked and revoke runs.
+        cnf = await createMyCnf({
+            user: credential.username,
+            password: credential.password,
+            host: credential.host,
+            port: credential.port,
+        });
+        const acknowledged = await acknowledgeCredential(options.permitId, options.requestId, delivery.envelopeSha256);
+        if (acknowledged.state !== 'DELIVERED') {
+            throw new Error(`Recovery delivery ACK returned unexpected state ${acknowledged.state}`);
+        }
+        const run = options.run ?? (async (args) => await runMysql({
+            fd: args.fd,
+            fdPath: args.fdPath,
+            database: args.database,
+            mode: 'exec',
+            input: args.input,
+        }));
+        const mysqlExitCode = await run({
+            fd: cnf.fd,
+            fdPath: cnf.fdPath,
+            database: credential.database,
+            input: sqlInput,
+        });
+        const revoked = await cleanup('znvault_mysql_exec_permit_complete');
+        if (!revoked) {
+            throw new Error('MySQL completed, but revoke by requestId is not proven; run dynasec permit revoke immediately');
+        }
+        return {
+            permitId: options.permitId,
+            requestId: options.requestId,
+            operationId: operation.operationId,
+            deliveryState: 'DELIVERED',
+            mysqlExitCode,
+            revokeState,
+            envelopeSha256: delivery.envelopeSha256,
+        };
+    }
+    finally {
+        process.off('SIGINT', onSIGINT);
+        process.off('SIGTERM', onSIGTERM);
+        process.off('SIGHUP', onSIGHUP);
+        process.off('uncaughtException', onUncaughtException);
+        sqlInput?.fill(0);
+        await cleanup('znvault_mysql_exec_permit_failure');
+    }
+}
+//# sourceMappingURL=permit-broker.js.map

package/dist/commands/mysql/permit-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permit-broker.js","sourceRoot":"","sources":["../../../src/commands/mysql/permit-broker.ts"],"names":[],"mappings":"AAAA,iEAAiE;AAEjE,OAAO,EAAC,MAAM,EAAC,MAAM,qBAAqB,CAAC;AAC3C,OAAO,EAAC,WAAW,EAAmB,MAAM,YAAY,CAAC;AACzD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,QAAQ,GACT,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,kCAAkC,EAClC,sBAAsB,GAEvB,MAAM,oBAAoB,CAAC;AAM5B,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC5C,MAAM,2BAA2B,GAAG,OAAO,CAAC;AAC5C,MAAM,wBAAwB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAC1D,MAAM,yBAAyB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACnD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,SAAS;IACT,iBAAiB;IACjB,qBAAqB;IACrB,kBAAkB;CACnB,CAAC,CAAC;AAwBH,KAAK,UAAU,oBAAoB,CAAC,OAA0B;IAC5D,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,yBAAyB,EAAE,CAAC;YACrD,MAAM,IAAI,KAAK,CAAC,wBAAwB,yBAAyB,QAAQ,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACxC,IAAI,KAAa,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;oBACnB,MAAM,IAAI,KAAK,CAAC,8CAA8C,IAAI,EAAE,CAAC,CAAC;gBACxE,CAAC;gBACD,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClC,CAAC;oBAAS,CAAC;gBACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;YACvB,CAAC;YACD,UAAU,IAAI,KAAK,CAAC,MAAM,CAAC;YAC3B,IAAI,UAAU,GAAG,yBAAyB,EAAE,CAAC;gBAC3C,MAAM,IAAI,KAAK,CAAC,wBAAwB,yBAAyB,QAAQ,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;YACxC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAYD,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAQ,KAA+B,EAAE,UAAU,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAQ,KAA+B,EAAE,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,OAAO,MAAM,KAAK,SAAS,IAAI,MAAM,IAAI,GAAG,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAI,OAAyB;IAC1D,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,EAAE,CAAC;QACzB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,eAAe,CAAC,MAAM;gBAAE,MAAM,KAAK,CAAC;YAC3E,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB,EAAE,SAAiB;IACxD,OAAO,oCAAoC,kBAAkB,CAAC,QAAQ,CAAC,EAAE;QACvE,eAAe,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,SAAiB;IAEjB,OAAO,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CACxD,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CACnD,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,qBAAqB,CAClC,QAAgB,EAChB,SAAiB,EACjB,cAAsB;IAEtB,OAAO,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CACxD,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,EACpD,EAAC,cAAc,EAAC,CACjB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAClD,QAAgB,EAChB,SAAiB,EACjB,MAAc;IAEd,IAAI,SAAkB,CAAC;IACvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,eAAe,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAgB,GAAG,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,SAAS,EAAE;gBACrF,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YAC/B,0EAA0E;YAC1E,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,CAAgB,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;oBACpF,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC;wBAAE,OAAO,OAAO,CAAC;oBACvD,KAAK,GAAG,IAAI,CAAC;gBACf,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,IAAI,CAAC;gBACf,CAAC;YACH,CAAC;YACD,SAAS,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,eAAe,CAAC,MAAM;gBAAE,MAAM;YACxD,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC;IACvF,OAAO,CAAC,IAAI,CACV,mEAAmE,QAAQ,IAAI;QAC/E,WAAW,SAAS,6DAA6D,OAAO,EAAE,CAC3F,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,UAAmD;IAC1E,IAAI,CAAC,UAAU;QAAE,OAAO;IACxB,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzB,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzB,UAAU,CAAC,IAAI,GAAG,EAAE,CAAC;IACrB,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC;IACzB,UAAU,CAAC,SAAS,GAAG,EAAE,CAAC;IAC1B,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,0BAA0B,CACjC,SAAwB,EACxB,QAAgB,EAChB,SAAiB,EACjB,UAAkB;IAElB,IACE,SAAS,CAAC,QAAQ,KAAK,QAAQ;WAC5B,SAAS,CAAC,SAAS,KAAK,SAAS;WACjC,SAAS,CAAC,UAAU,KAAK,UAAU,EACtC,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,SAAS,CAAC,KAAK,KAAK,UAAU,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CACb,yBAAyB,SAAS,CAAC,KAAK,oCAAoC,CAC7E,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,2BAA2B,CACxC,OAAsB,EACtB,QAAgB,EAChB,SAAiB,EACjB,UAAkB;IAElB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,2BAA2B,CAAC;IAC1D,IAAI,OAAO,GAAG,OAAO,CAAC;IACtB,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,SAAS,CAAC;QACR,IACE,OAAO,CAAC,QAAQ,KAAK,QAAQ;eAC1B,OAAO,CAAC,SAAS,KAAK,SAAS;eAC/B,OAAO,CAAC,UAAU,KAAK,UAAU,EACpC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,OAAO,CAAC,KAAK,KAAK,UAAU,IAAI,OAAO,CAAC,KAAK,KAAK,WAAW;YAAE,OAAO,OAAO,CAAC;QAClF,IAAI,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;YAChF,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,CAAC,KAAK,oCAAoC,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,+BAA+B,OAAO,CAAC,KAAK,QAAQ,2BAA2B,IAAI,CACpF,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,CAAC,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,EAAE,CAAC;QACP,OAAO,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAC3D,aAAa,CAAC,QAAQ,EAAE,SAAS,CAAC,CACnC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA0B;IAC5D,yEAAyE;IACzE,2EAA2E;IAC3E,6EAA6E;IAC7E,qEAAqE;IACrE,8CAA8C;IAC9C,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS,IAAI,OAAO,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CACb,gEAAgE;YAChE,sCAAsC,CACvC,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,kCAAkC,EAAE,CAAC;IAC7D,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC;QAChC,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,SAAS,CAAC,cAAc;QACxC,kBAAkB,EAAE,SAAS,CAAC,kBAAkB;QAChD,cAAc,EAAE,SAAkB;KACnC,CAAC,CAAC;IAEH,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,cAA4C,CAAC;IACjD,IAAI,SAAoC,CAAC;IACzC,IAAI,QAA4C,CAAC;IACjD,IAAI,UAAmD,CAAC;IACxD,IAAI,GAA4B,CAAC;IACjC,IAAI,QAA4B,CAAC;IACjC,IAAI,WAAW,GAA2B,mBAAmB,CAAC;IAE9D,MAAM,OAAO,GAAG,CAAC,MAAc,EAAoB,EAAE;QACnD,cAAc,KAAK,CAAC,KAAK,IAAI,EAAE;YAC7B,GAAG,EAAE,OAAO,EAAE,CAAC;YACf,eAAe,CAAC,UAAU,CAAC,CAAC;YAC5B,IAAI,CAAC,YAAY;gBAAE,OAAO,IAAI,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAClD,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,EACjB,MAAM,CACP,CAAC;YACF,IAAI,OAAO,EAAE,CAAC;gBACZ,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC;gBAC5B,OAAO,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,cAAc,CAAC;IACxB,CAAC,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,QAAgB,EAAgB,EAAE,CAAC,GAAG,EAAE;QACxD,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;YAClD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,mBAAmB,GAAG,GAAS,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,qEAAqE,CAAC,CAAC;QACrF,KAAK,CAAC,KAAK,IAAI,EAAE;YACf,MAAM,OAAO,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CAAC,EAAE,CAAC;IACP,CAAC,CAAC;IAEF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACnC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACjC,OAAO,CAAC,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;IAEvD,IAAI,CAAC;QACH,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YAC9B,2BAA2B,CAAC,kBAAkB,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;QAED,0EAA0E;QAC1E,6EAA6E;QAC7E,QAAQ,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC/C,YAAY,GAAG,IAAI,CAAC;QAEpB,MAAM,cAAc,GAAG,EAAC,mBAAmB,EAAE,KAAK,EAAC,CAAC;QACpD,IAAI,CAAC;YACH,SAAS,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE;gBAC5C,IAAI,CAAC;oBACH,OAAO,MAAM,MAAM,CAAC,GAAG,CACrB,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,EAClD,WAAW,CACZ,CAAC;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,WAAW,CAAC,KAAK,CAAC;wBAAE,cAAc,CAAC,mBAAmB,GAAG,IAAI,CAAC;oBAClE,MAAM,KAAK,CAAC;gBACd,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yEAAyE;YACzE,wEAAwE;YACxE,0EAA0E;YAC1E,yEAAyE;YACzE,0EAA0E;YAC1E,4EAA4E;YAC5E,qEAAqE;YACrE,gEAAgE;YAChE,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YACjC,IACE,CAAC,cAAc,CAAC,mBAAmB;mBAChC,MAAM,KAAK,SAAS;mBACpB,MAAM,IAAI,GAAG;mBACb,MAAM,GAAG,GAAG,EACf,CAAC;gBACD,YAAY,GAAG,KAAK,CAAC;gBACrB,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,8BAA8B,EAAE,CAAC;oBACxD,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,GAAG,CAClE,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CACnD,CAAC,CAAC;wBACH,IACE,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;+BACnC,QAAQ,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS,EAC3C,CAAC;4BACD,MAAM,IAAI,KAAK,CACb,2EAA2E,CAC5E,CAAC;wBACJ,CAAC;wBACD,YAAY,GAAG,IAAI,CAAC;oBACtB,CAAC;oBAAC,OAAO,WAAW,EAAE,CAAC;wBACrB,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;wBAC7C,oEAAoE;wBACpE,kEAAkE;wBAClE,kEAAkE;wBAClE,qDAAqD;wBACrD,YAAY,GAAG,CAAC,CACd,YAAY,KAAK,GAAG;+BACjB,SAAS,CAAC,WAAW,CAAC,KAAK,8BAA8B,CAC7D,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,SAAS,GAAG,MAAM,2BAA2B,CAC3C,SAAS,EACT,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,UAAU,CACnB,CAAC;QACF,0BAA0B,CACxB,SAAS,EACT,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,UAAU,CACnB,CAAC;QAEF,QAAQ,GAAG,SAAS,CAAC,UAAU,IAAI,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9F,UAAU,GAAG,MAAM,sBAAsB,CAAC,EAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAC,CAAC,CAAC;QAE5E,2EAA2E;QAC3E,4EAA4E;QAC5E,kEAAkE;QAClE,uBAAuB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAE7C,wEAAwE;QACxE,2EAA2E;QAC3E,GAAG,GAAG,MAAM,WAAW,CAAC;YACtB,IAAI,EAAE,UAAU,CAAC,QAAQ;YACzB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,IAAI,EAAE,UAAU,CAAC,IAAI;YACrB,IAAI,EAAE,UAAU,CAAC,IAAI;SACtB,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,SAAS,EACjB,QAAQ,CAAC,cAAc,CACxB,CAAC;QACF,IAAI,YAAY,CAAC,KAAK,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,mDAAmD,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,EAAE,CAAC,MAAM,QAAQ,CAAC;YACvD,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC,CAAC;QACJ,MAAM,aAAa,GAAG,MAAM,GAAG,CAAC;YAC9B,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,QAAQ,EAAE,UAAU,CAAC,QAAQ;YAC7B,KAAK,EAAE,QAAQ;SAChB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,oCAAoC,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,aAAa,EAAE,WAAW;YAC1B,aAAa;YACb,WAAW;YACX,cAAc,EAAE,QAAQ,CAAC,cAAc;SACxC,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;QACtD,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,OAAO,CAAC,mCAAmC,CAAC,CAAC;IACrD,CAAC;AACH,CAAC"}

package/dist/commands/mysql/recovery-hpke.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Consumer-side HPKE for Dynamic Secrets Recovery Fence v1.
+ *
+ * The X25519 private key is a process-local CryptoKey. It is never serialized,
+ * written to disk, printed, placed in argv, or copied into the environment.
+ */
+import type { MintOperation, RecoveryHpkeCredential } from '../dynamic-secrets/recovery-types.js';
+declare const CREDENTIAL_SCHEMA = "znvault.dynsec.recovery-credential.v1";
+export interface EphemeralRecoveryRecipient {
+    readonly recipientPublicKey: string;
+    readonly recipientKeyId: string;
+    readonly privateKey: CryptoKey;
+}
+export interface RecoveryCredentialPlaintext {
+    schema: typeof CREDENTIAL_SCHEMA;
+    version: 1;
+    username: string;
+    password: string;
+    host: string;
+    port: number;
+    database: string;
+    expiresAt: string;
+}
+export declare function canonicalJsonBytes(value: unknown): Buffer;
+export declare function generateEphemeralRecoveryRecipient(): Promise<EphemeralRecoveryRecipient>;
+export declare function openRecoveryCredential(input: {
+    delivery: RecoveryHpkeCredential;
+    operation: MintOperation;
+    recipient: EphemeralRecoveryRecipient;
+}): Promise<RecoveryCredentialPlaintext>;
+export {};
+//# sourceMappingURL=recovery-hpke.d.ts.map

package/dist/commands/mysql/recovery-hpke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recovery-hpke.d.ts","sourceRoot":"","sources":["../../../src/commands/mysql/recovery-hpke.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,KAAK,EACV,aAAa,EACb,sBAAsB,EAGvB,MAAM,sCAAsC,CAAC;AAM9C,QAAA,MAAM,iBAAiB,0CAA0C,CAAC;AAOlE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,SAAS,CAAC;CAChC;AAYD,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,OAAO,iBAAiB,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAmDD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEzD;AAoMD,wBAAsB,kCAAkC,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAmB9F;AAED,wBAAsB,sBAAsB,CAAC,KAAK,EAAE;IAClD,QAAQ,EAAE,sBAAsB,CAAC;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,SAAS,EAAE,0BAA0B,CAAC;CACvC,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAqEvC"}