amw rotate-project prepares new credentials for a project created with amw init. It changes private files and bundle.json in the project; it does not overwrite an existing public/ build or deploy anything. Build to a new output folder, verify it, and publish the replacement carrier files and index as one release.
# Replace only the members key and edition ID.
amw rotate-project my-site members
amw build-project my-site my-site/public-next
amw verify-site my-site/public-next
# Instead, replace only the site-wide key.
amw rotate-project my-site site
amw build-project my-site my-site/public-next
# Or replace both in one release.
amw rotate-project my-site both
amw build-project my-site my-site/public-next
Use a new output path for each build. Do not run the rotation command again merely to retry a failed build: the new credentials are already in the project. Fix the build problem and rebuild with the same files. Remove AMW_CONTENT_KEY_HEX before a member rotation and AMW_INDEX_KEY_HEX before an external site-key rotation; the command rejects those environment overrides.
What each option changes
| Scope | Hosted /favicon.ico index |
External encrypted index |
|---|---|---|
members |
New random content key and key ID; .amw/keys/<new-id>.hex and .amwmember; public encoding key remains the same when app files are unchanged. |
Same member change; private index key bytes remain the same, but the changed index has a new locator, so reissue the newly built .amwkey or ICO to index-key holders. |
site |
New random encodingSalt in bundle.json changes the public AES-CTR encoding key and all encoded chunks. This is re-encoding, not access revocation. |
New private .amw/keys/index.hex; old index key is copied into .amw/rotations/ for recovery. Reissue the new .amwkey or ICO. The member key and ID stay the same. |
both |
Both hosted changes above. | Both external changes above. |
Old member .hex and .amwmember files remain under .amw/keys/ for recovery, but bundle.json points to a new ID. Do not share or publish those old files. New member links and QR codes must be generated from the new .amwmember file. If only the site key was rotated, the existing member key file remains valid for the new release.
Publishing a rotation
- Build the new release into a fresh folder. Verify it with
amw verify-site; for an external index, pass the new.amwkeyfile as the second argument. - Confirm that the new member key authenticates the protected resources and the old one does not. Keep the new
.amwmember,.amwkey, ICO, and QR files outside the hosted folder. - Replace the index and every modified carrier together. Remove old published carrier snapshots and purge relevant CDN caches. A mixed old/new response should fail hashes, but it can temporarily make the app unavailable. The runtime requests carrier ranges with
cache: 'no-store'; a CDN or mirror may still retain old bytes until purged. - Send only the new credentials to continuing recipients. For an external index, distribute its new locator file after any rebuilt index, including a member-only rotation. Generate new member QR links with
amw member-linkwhen members rotate. - Keep the old secret files in private backup storage only while needed for recovery. Deleting local backups does not revoke copies held elsewhere.
This is shared-key rotation, not per-person revocation. A former member's old key cannot decrypt newly published member ciphertext, and an old external index key cannot authenticate the new external index. Someone who already downloaded plaintext or a complete old index plus matching old carriers can still read that old release. A hosted index and its encoding key are public, so rotating site in hosted mode cannot exclude anyone. Strong rollback prevention or revoking one person requires an online trusted version/entitlement service, which this static prototype does not provide.
Standalone amw bundle builds
For builds that do not use amw init, rotate member material by generating a new random 32-byte AMW_CONTENT_KEY_HEX, changing keyId in the bundle config, and building a fresh overlay. Rotate an external index independently by replacing AMW_INDEX_KEY_HEX. To re-encode a hosted index without changing app source, set a new random 64-lowercase-hex encodingSalt in the bundle config. The compiler validates this field and derives a different public AES-CTR key. Do not embed the member or external index key in the config or public output. Back up owner-held keys privately, and verify the complete new release before replacing the old one.