@coffre/cli 0.0.0 → 0.1.1

package/dist/templates/node/README.md

@@ -0,0 +1,108 @@
+# coffre on Node
+
+Two processes, configured in code:
+
+- `src/server.ts`, the server: the API, sign-in, the pages and a job every
+  five minutes, on one port. Put a proxy that terminates TLS in front of it.
+- `src/vault.ts`, the vault: the keys, and the members and grants, which it
+  keeps in the server's database through a login of its own. It answers
+  only the server, on a Unix socket.
+
+Run them as two users that share a group, and the process facing the network
+never holds the KEK. For local development, `server.ts` can run the vault
+in its own process instead; see the comment there. Everything below runs
+from this directory, on Node 24 or later.
+
+## 1. Settings
+
+```sh
+pnpm install
+cp server.env.example server.env
+cp vault.env.example vault.env
+```
+
+Fill both in: `PUBLIC_URL`, a GitHub OAuth app whose callback is
+`<PUBLIC_URL>/auth/callback/github`, `ROOT_ADMINS`, and the keys from
+
+```sh
+coffre keys
+```
+
+Run it with the CLI you ran `coffre init` with, or as
+`npx @coffre/cli keys`. It prints three keys and the KEK's id, once, and
+keeps no copy. Save its output in your password manager, with the OAuth
+client secret, before anything else. `KEK_ID`, `KEK` and `SIGNING_KEY` go in
+`vault.env`, and `AUDIT_CHAIN_KEY` in `server.env`, so that the server,
+which faces the network, never holds what decrypts a value:
+
+- `KEK` decrypts every value. Lose it, and every value is lost.
+- `SIGNING_KEY` signs the vault's log entries and member rows.
+- `AUDIT_CHAIN_KEY` signs the server's log entries, sessions and tokens.
+
+Lose either of the last two, and the log stops verifying and everyone is
+locked out.
+
+## 2. The database
+
+Use one Postgres database with three logins: its owner for migrations,
+`coffre_runtime` for the server, and `coffre_vault_runtime` for the vault.
+As an administrator, connect to the database with `psql` and create the
+runtime logins. `\password` prompts for each password without putting it
+in a SQL statement or shell history:
+
+```sql
+CREATE ROLE coffre_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+CREATE ROLE coffre_vault_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+\password coffre_runtime
+\password coffre_vault_runtime
+```
+
+Migrate as the owner, who must also be able to create and grant roles:
+
+```sh
+pnpm migrate "postgres://owner:…@db.example.com:5432/coffre"
+```
+
+The migration creates the `coffre_app` and `coffre_vault` group roles and
+grants each login only its group's rights. Only the vault writes members
+and grants; each login appends to the audit log only as itself. Run the
+migration again after every package upgrade, before starting either process.
+
+Fill `DATABASE_URL` in each env file with the same host and database, using
+`coffre_runtime` in `server.env` and `coffre_vault_runtime` in `vault.env`.
+URL-encode special characters in passwords. Neither process gets the owner's
+URL. Keep each env file readable only by its process's user (`chmod 600`).
+
+For tests and local development only, both URLs may instead name the same
+absolute SQLite file, e.g. `file:/tmp/coffre-local.db`; migrate that URL once.
+SQLite has no database logins or separation of privileges.
+
+## 3. Run
+
+```sh
+pnpm vault    # first: the server connects to its socket
+pnpm start
+```
+
+Then sign in at `PUBLIC_URL` as a root admin, and from a terminal:
+
+```sh
+coffre login https://secrets.example.com
+```
+
+Point a monitor at `<PUBLIC_URL>/readyz`: it turns red when the audit log
+stops taking writes or the vault stops checkpointing it.
+
+Everything coffre keeps is in the database: secrets, members, grants and
+the audit log. Back it up as one, keep the escrowed keys apart from it, and
+follow the [restore runbook](https://github.com/erwinkn/coffre/blob/main/docs/restore.md) to bring it back.
+
+`pnpm typecheck` checks the configuration against coffre's types.
+
+## Conformance
+
+`pnpm conformance` runs the vault and the server on SQLite in a temporary
+directory, signs people in through a stand-in GitHub, and checks what coffre
+must never do: show a value to someone without access, act for another site
+with someone's cookie, keep a removed member in, give a value it did not
+log. Run it after changing this project, and before deploying the change.

package/dist/templates/node/gitignore

@@ -0,0 +1,5 @@
+node_modules
+*.env
+*.db
+*.db-*
+*.sock

package/dist/templates/node/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "coffre-node",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "vault": "node --env-file=vault.env src/vault.ts",
+    "start": "node --env-file=server.env src/server.ts",
+    "migrate": "coffre-server migrate",
+    "typecheck": "tsc --noEmit",
+    "conformance": "coffre-conformance node"
+  },
+  "dependencies": {
+    "@coffre/server": "0.1.1",
+    "@coffre/vault": "0.1.1"
+  },
+  "devDependencies": {
+    "@coffre/conformance": "0.1.1",
+    "@types/node": "26.1.1",
+    "typescript": "5.9.3"
+  }
+}

package/dist/templates/node/pnpm-workspace.yaml

@@ -0,0 +1,7 @@
+# Do not install a version published in the last 7 days: most malicious
+# releases are yanked within hours, and a service that holds every credential
+# can wait a week. Coffre's own packages are exempt, so a fix to them lands
+# the day it is published; they depend on nothing newer than this allows.
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@coffre/*'

package/dist/templates/node/server.env.example

@@ -0,0 +1,18 @@
+# The server's settings, read by `pnpm start`. Copy to server.env.
+
+PORT=3000
+# Where people reach coffre, through the proxy that terminates TLS in front
+# of it: an origin, no path.
+PUBLIC_URL=https://secrets.example.com
+# The vault uses this Postgres database through a different login.
+DATABASE_URL=postgres://coffre_runtime:CHANGE_ME@127.0.0.1:5432/coffre
+# The vault's socket, as in vault.env.
+VAULT_SOCKET=vault.sock
+
+# A GitHub OAuth app whose callback is <PUBLIC_URL>/auth/callback/github.
+GITHUB_CLIENT_ID=
+GITHUB_CLIENT_SECRET=
+
+# From `coffre keys`, saved in your password manager first: signs the
+# server's log entries, sessions and tokens.
+AUDIT_CHAIN_KEY=

package/dist/templates/node/src/server.ts

@@ -0,0 +1,37 @@
+// coffre's server: the API, sign-in, pages and scheduled job, in one
+// process. It holds no KEK: it asks the vault, a process of its own
+// (src/vault.ts), over a Unix socket. Settings come from server.env.
+import { github, serve, signin } from '@coffre/server/node';
+import { connectVault } from '@coffre/vault/node';
+
+function env(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`${name} is not set; see server.env.example`);
+  return value;
+}
+
+const server = await serve({
+  port: Number(env('PORT')),
+  publicUrl: env('PUBLIC_URL'),
+  database: env('DATABASE_URL'),
+  vault: connectVault(env('VAULT_SOCKET')),
+  // For tests or local SQLite development only, the vault in this process:
+  // vault: await localVault({ database: env('DATABASE_URL'), kek: …, rootAdmins: […], signingKey: … }),
+  auth: signin({
+    providers: [
+      github({
+        clientId: env('GITHUB_CLIENT_ID'),
+        clientSecret: env('GITHUB_CLIENT_SECRET'),
+        // Set for GitHub Enterprise Server; github.com otherwise.
+        webUrl: process.env.GITHUB_URL,
+        apiUrl: process.env.GITHUB_API_URL,
+      }),
+    ],
+  }),
+  auditChainKey: env('AUDIT_CHAIN_KEY'),
+});
+console.log(`coffre is listening on ${server.url}`);
+
+for (const signal of ['SIGINT', 'SIGTERM'] as const) {
+  process.once(signal, () => void server.close().then(() => process.exit(0)));
+}

package/dist/templates/node/src/vault.ts

@@ -0,0 +1,27 @@
+// The vault: the keys, and the members and grants, which it keeps in the
+// server's database through a login of its own. It answers only on a Unix
+// socket, which it makes 0660: run it as its own user, sharing a group with
+// the server's, and nothing that faces the network can read the KEK.
+// Settings come from vault.env.
+import { serveVault } from '@coffre/vault/node';
+
+function env(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`${name} is not set; see vault.env.example`);
+  return value;
+}
+
+const vault = await serveVault({
+  socket: env('VAULT_SOCKET'),
+  database: env('DATABASE_URL'),
+  kek: { id: env('KEK_ID'), key: env('KEK') },
+  // After a rotation, the KEKs before it, so the data keys they wrapped
+  // still open: previousKeks: [{ id: 'kek-1', key: env('KEK_1') }],
+  rootAdmins: env('ROOT_ADMINS').split(',').map((email) => email.trim()),
+  signingKey: env('SIGNING_KEY'),
+});
+console.log(`the vault is listening on ${vault.socket}`);
+
+for (const signal of ['SIGINT', 'SIGTERM'] as const) {
+  process.once(signal, () => void vault.close().then(() => process.exit(0)));
+}

package/dist/templates/node/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "lib": ["ES2023"],
+    "types": ["node"],
+    "module": "nodenext",
+    "moduleResolution": "nodenext",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "erasableSyntaxOnly": true,
+    "verbatimModuleSyntax": true
+  },
+  "include": ["src"]
+}

package/dist/templates/node/vault.env.example

@@ -0,0 +1,16 @@
+# The vault's settings, read by `pnpm vault`. Copy to vault.env, readable by
+# the vault's user alone.
+
+VAULT_SOCKET=vault.sock
+# The server's Postgres database, as the vault's own login.
+DATABASE_URL=postgres://coffre_vault_runtime:CHANGE_ME@127.0.0.1:5432/coffre
+
+# From `coffre keys`, saved in your password manager first.
+# The key-encryption key, and its name. A rotation gives the new one a new name.
+KEK_ID=kek-1
+KEK=
+# Signs the vault's log entries, checkpoints and member rows.
+SIGNING_KEY=
+
+# Comma-separated emails: the first people in, whom nobody can remove.
+ROOT_ADMINS=you@example.com

package/dist/templates/workers/README.md

@@ -0,0 +1,137 @@
+# coffre on Cloudflare Workers
+
+Two Workers, configured in code:
+
+- `app/src/worker.ts`, the app: the API, sign-in, the pages and a Cron job
+  every five minutes. It reaches Postgres through Hyperdrive, and the vault
+  through a service binding.
+- `vault/src/worker.ts`, the vault: the keys, and the members and grants,
+  which it keeps in the same database through a login of its own. It has no
+  URL of its own.
+
+Settings that are not secret are `vars` in each `wrangler.jsonc`; secrets are
+Worker secrets. Everything below runs from this directory.
+
+## 1. Settings
+
+- `app/wrangler.jsonc`: `PUBLIC_URL`, and `GITHUB_CLIENT_ID` from a GitHub
+  OAuth app whose callback is `<PUBLIC_URL>/auth/callback/github`.
+- `vault/wrangler.jsonc`: `ROOT_ADMINS`, the emails of the first people in,
+  and `KEK_ID`, which `coffre keys` gives you below.
+
+## 2. The database
+
+coffre wants a Postgres database with three logins: its owner, for
+migrations; `coffre_runtime`, which the app runs as; and
+`coffre_vault_runtime`, which the vault runs as. Create the two as plain
+logins. As the database's administrator, connect with `psql` and run:
+
+```sql
+CREATE ROLE coffre_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+CREATE ROLE coffre_vault_runtime LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS;
+\password coffre_runtime
+\password coffre_vault_runtime
+```
+
+Each `\password` prompts for a different generated password. The owner
+must be able to create and grant roles: the migration creates `coffre_app`
+and `coffre_vault`, and grants each login its own group. Only the vault may
+write members and grants, and each appends to the log only as itself.
+URL-encode special characters in the passwords in these URLs:
+
+```sh
+pnpm install
+pnpm migrate "postgres://owner:…@db.example.com:5432/coffre"
+pnpm exec wrangler hyperdrive create coffre --caching-disabled \
+  --connection-string="postgres://coffre_runtime:…@db.example.com:5432/coffre"
+pnpm exec wrangler hyperdrive create coffre-vault --caching-disabled \
+  --connection-string="postgres://coffre_vault_runtime:…@db.example.com:5432/coffre"
+```
+
+Keep `--caching-disabled`: Hyperdrive otherwise caches reads for up to a
+minute, and a revoked token or a signed-out session could keep working that
+long. `wrangler.jsonc` cannot set it, so for a config made another way,
+check `caching` in `wrangler hyperdrive get <id>`.
+
+Put the ids they print under `hyperdrive`, the first in
+`app/wrangler.jsonc` and the second in `vault/wrangler.jsonc`. Run
+`pnpm migrate` again after every upgrade of `@coffre/server`, before
+deploying it.
+
+## 3. Keys
+
+```sh
+coffre keys
+```
+
+Run it with the CLI you ran `coffre init` with, or as
+`npx @coffre/cli keys`. It prints three keys and the KEK's id, once, and
+keeps no copy. Save its output in your password manager, with the GitHub
+client secret, before anything else. The vault gets `KEK` and `SIGNING_KEY`,
+and the app `AUDIT_CHAIN_KEY`, so that the app, which faces the network,
+never holds what decrypts a value:
+
+- `KEK` decrypts every value. Lose it, and every value is lost.
+- `SIGNING_KEY` signs the vault's log entries and member rows.
+- `AUDIT_CHAIN_KEY` signs the app's log entries, sessions and tokens.
+
+Lose either of the last two, and the log stops verifying and everyone is
+locked out. Put `KEK_ID` in `vault/wrangler.jsonc`, then set the secrets;
+each command prompts for the saved value:
+
+```sh
+pnpm exec wrangler secret put KEK -c vault/wrangler.jsonc
+pnpm exec wrangler secret put SIGNING_KEY -c vault/wrangler.jsonc
+pnpm exec wrangler secret put AUDIT_CHAIN_KEY -c app/wrangler.jsonc
+pnpm exec wrangler secret put GITHUB_CLIENT_SECRET -c app/wrangler.jsonc
+```
+
+Keep older KEKs after a rotation too: what they wrapped still needs them.
+
+## 4. Deploy
+
+```sh
+pnpm run deploy
+```
+
+deploys the vault, then the app, which binds to it. Route the app to
+`PUBLIC_URL` in the dashboard, or with `routes` in `app/wrangler.jsonc`, then
+sign in there as a root admin, and from a terminal:
+
+```sh
+coffre login https://secrets.example.com
+```
+
+Point a monitor at `<PUBLIC_URL>/readyz`: it turns red when the audit log
+stops taking writes or the vault stops checkpointing it.
+
+Everything coffre keeps is in the database: secrets, members, grants and
+the audit log. Back it up as one, keep the escrowed keys apart from it, and
+follow the [restore runbook](https://github.com/erwinkn/coffre/blob/main/docs/restore.md) to bring it back.
+
+## Locally
+
+`pnpm dev` runs both Workers with `wrangler dev`. Put local secrets in
+`app/.dev.vars` and `vault/.dev.vars`, and point Hyperdrive at a local
+database with `CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE`,
+for the app's login, and
+`CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_VAULT_HYPERDRIVE`, for the
+vault's.
+`pnpm typecheck` checks the configuration against coffre's types, and
+`pnpm build` bundles both Workers without deploying them.
+
+## Conformance
+
+```sh
+pnpm conformance \
+  --postgres "postgres://owner:…@127.0.0.1:5432" \
+  --runtime "postgres://coffre_runtime:…@127.0.0.1:5432" \
+  --vault-runtime "postgres://coffre_vault_runtime:…@127.0.0.1:5432"
+```
+
+runs both Workers under `wrangler dev`, on a database of their own that it
+creates on that Postgres and drops after, signs people in through a
+stand-in GitHub, and checks what coffre must never do: show a value to
+someone without access, act for another site with someone's cookie, keep a
+removed member in, give a value it did not log. Run it after changing this
+project, and before deploying the change.

package/dist/templates/workers/app/src/worker.ts

@@ -0,0 +1,33 @@
+// The app Worker: coffre's API, sign-in, pages and scheduled job. It reaches
+// the database through Hyperdrive and the keys only through the vault
+// Worker's service binding.
+import { coffre, github, postgres, signin, type Vault } from '@coffre/server/cloudflare';
+
+type Env = {
+  HYPERDRIVE: Hyperdrive;
+  VAULT: Vault;
+  PUBLIC_URL: string;
+  GITHUB_CLIENT_ID: string;
+  GITHUB_CLIENT_SECRET: string;
+  /** Set for GitHub Enterprise Server; github.com otherwise. */
+  GITHUB_URL?: string;
+  GITHUB_API_URL?: string;
+  AUDIT_CHAIN_KEY: string;
+};
+
+export default coffre((env: Env) => ({
+  publicUrl: env.PUBLIC_URL,
+  database: postgres(env.HYPERDRIVE),
+  vault: env.VAULT,
+  auth: signin({
+    providers: [
+      github({
+        clientId: env.GITHUB_CLIENT_ID,
+        clientSecret: env.GITHUB_CLIENT_SECRET,
+        webUrl: env.GITHUB_URL,
+        apiUrl: env.GITHUB_API_URL,
+      }),
+    ],
+  }),
+  auditChainKey: env.AUDIT_CHAIN_KEY,
+}));

package/dist/templates/workers/app/wrangler.jsonc

@@ -0,0 +1,35 @@
+// The app Worker. Settings that are not secret are `vars` below; the secrets
+// go in with `wrangler secret put <NAME> -c app/wrangler.jsonc`, and locally
+// in app/.dev.vars.
+{
+  "$schema": "../node_modules/wrangler/config-schema.json",
+  "name": "coffre",
+  "main": "src/worker.ts",
+  "compatibility_date": "2026-08-06",
+  "compatibility_flags": ["nodejs_compat"],
+  "workers_dev": false,
+  "observability": { "enabled": true },
+  "vars": {
+    // Where people reach coffre: an origin, no path. Add it as a route or
+    // custom domain too.
+    "PUBLIC_URL": "https://secrets.example.com",
+    // A GitHub OAuth app whose callback is <PUBLIC_URL>/auth/callback/github.
+    "GITHUB_CLIENT_ID": "replace-with-your-client-id"
+  },
+  "secrets": {
+    // AUDIT_CHAIN_KEY is from `coffre keys`; the app never gets the vault's keys.
+    "required": ["GITHUB_CLIENT_SECRET", "AUDIT_CHAIN_KEY"]
+  },
+  // `wrangler hyperdrive create coffre --caching-disabled --connection-string=<runtime login URL>`
+  // prints the id. Caching must stay off, or a revoked session keeps working
+  // for about a minute, and this file cannot set it: see README.md. Locally,
+  // CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_HYPERDRIVE stands in for
+  // the config.
+  "hyperdrive": [{ "binding": "HYPERDRIVE", "id": "replace-with-your-hyperdrive-id" }],
+  // The vault Worker, vault/wrangler.jsonc. Deploy it first.
+  "services": [{ "binding": "VAULT", "service": "coffre-vault" }],
+  // The heartbeat, audit checkpoints and due syncs.
+  "triggers": { "crons": ["*/5 * * * *"] },
+  // The pages' scripts, styles and fonts, all under /_coffre/assets/.
+  "assets": { "directory": "../node_modules/@coffre/ui/dist/client" }
+}

package/dist/templates/workers/gitignore

@@ -0,0 +1,3 @@
+node_modules
+.wrangler
+.dev.vars*

package/dist/templates/workers/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "coffre-workers",
+  "private": true,
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "scripts": {
+    "dev": "wrangler dev -c app/wrangler.jsonc -c vault/wrangler.jsonc",
+    "typecheck": "tsc --noEmit",
+    "build": "wrangler deploy --dry-run -c vault/wrangler.jsonc && wrangler deploy --dry-run -c app/wrangler.jsonc",
+    "migrate": "coffre-server migrate",
+    "deploy": "wrangler deploy -c vault/wrangler.jsonc && wrangler deploy -c app/wrangler.jsonc",
+    "conformance": "coffre-conformance workers"
+  },
+  "dependencies": {
+    "@coffre/server": "0.1.1",
+    "@coffre/ui": "0.1.1",
+    "@coffre/vault": "0.1.1"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "5.20260920.1",
+    "@coffre/conformance": "0.1.1",
+    "typescript": "5.9.3",
+    "wrangler": "4.118.0"
+  }
+}

package/dist/templates/workers/pnpm-workspace.yaml

@@ -0,0 +1,14 @@
+# wrangler's esbuild and workerd each come with an install script that checks
+# the platform binary it already has as an optional dependency. Neither needs
+# to run, and pnpm wants to be told.
+allowBuilds:
+  esbuild: false
+  workerd: false
+
+# Do not install a version published in the last 7 days: most malicious
+# releases are yanked within hours, and a service that holds every credential
+# can wait a week. Coffre's own packages are exempt, so a fix to them lands
+# the day it is published; they depend on nothing newer than this allows.
+minimumReleaseAge: 10080
+minimumReleaseAgeExclude:
+  - '@coffre/*'

package/dist/templates/workers/tsconfig.json

@@ -0,0 +1,14 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "lib": ["ES2023"],
+    "types": ["@cloudflare/workers-types"],
+    "module": "esnext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "skipLibCheck": true,
+    "isolatedModules": true
+  },
+  "include": ["app/src", "vault/src"]
+}

package/dist/templates/workers/vault/src/worker.ts

@@ -0,0 +1,21 @@
+// The vault Worker: the keys, and the members and grants, which it decides
+// on in the app's database through its own login. It has no route of its
+// own; only the app Worker's service binding reaches it.
+import { postgres, vault } from '@coffre/vault/cloudflare';
+
+type Env = {
+  VAULT_HYPERDRIVE: Hyperdrive;
+  KEK_ID: string;
+  KEK: string;
+  SIGNING_KEY: string;
+  ROOT_ADMINS: string;
+};
+
+export default vault((env: Env) => ({
+  database: postgres(env.VAULT_HYPERDRIVE),
+  kek: { id: env.KEK_ID, key: env.KEK },
+  // After a rotation, the KEKs before it, so the data keys they wrapped
+  // still open: previousKeks: [{ id: 'kek-2026-09', key: env.KEK_2026_09 }],
+  rootAdmins: env.ROOT_ADMINS.split(',').map((email) => email.trim()),
+  signingKey: env.SIGNING_KEY,
+}));

package/dist/templates/workers/vault/wrangler.jsonc

@@ -0,0 +1,29 @@
+// The vault Worker. No route and no workers.dev address: only the app
+// Worker's service binding reaches it. Its secrets go in with
+// `wrangler secret put <NAME> -c vault/wrangler.jsonc`, and locally in
+// vault/.dev.vars.
+{
+  "$schema": "../node_modules/wrangler/config-schema.json",
+  "name": "coffre-vault",
+  "main": "src/worker.ts",
+  "compatibility_date": "2026-08-06",
+  "compatibility_flags": ["nodejs_compat"],
+  "workers_dev": false,
+  "observability": { "enabled": true },
+  "vars": {
+    // Names the KEK below: from `coffre keys`. A rotation gives the new one a new id.
+    "KEK_ID": "kek-1",
+    // Comma-separated emails: the first people in, whom nobody can remove.
+    "ROOT_ADMINS": "you@example.com"
+  },
+  "secrets": {
+    // From `coffre keys`: wrangler secret put KEK, then SIGNING_KEY.
+    "required": ["KEK", "SIGNING_KEY"]
+  },
+  // The app's database, as the vault's own login: `wrangler hyperdrive
+  // create coffre-vault --caching-disabled --connection-string=<vault login
+  // URL>` prints the id. Its own config, not the app's: the vault writes
+  // members and grants, which the app's login may only read. Locally,
+  // CLOUDFLARE_HYPERDRIVE_LOCAL_CONNECTION_STRING_VAULT_HYPERDRIVE stands in.
+  "hyperdrive": [{ "binding": "VAULT_HYPERDRIVE", "id": "replace-with-your-vault-hyperdrive-id" }]
+}

package/package.json

@@ -1,8 +1,36 @@
 {
   "name": "@coffre/cli",
-  "version": "0.0.0",
-  "description": "Reserved for coffre, a self-hosted secrets manager. The first release replaces this placeholder.",
+  "version": "0.1.1",
+  "description": "The coffre command line: secrets in your shell, and `coffre init` for a new deployment.",
   "license": "MIT",
-  "homepage": "https://github.com/erwinkn/coffre",
-  "repository": { "type": "git", "url": "git+https://github.com/erwinkn/coffre.git", "directory": "packages/cli" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/erwinkn/coffre.git",
+    "directory": "packages/cli"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "files": [
+    "dist"
+  ],
+  "bin": {
+    "coffre": "./dist/main.js"
+  },
+  "exports": {
+    "./package.json": "./package.json"
+  },
+  "devDependencies": {
+    "@types/node": "26.1.1",
+    "tsdown": "0.23.0",
+    "typescript": "5.9.3",
+    "@coffre/core": "0.1.1",
+    "@coffre/client": "0.1.1"
+  },
+  "scripts": {
+    "build": "tsdown && node scripts/copy-templates.ts",
+    "typecheck": "tsc --noEmit",
+    "test": "node --conditions=coffre:source --test"
+  }
+}