@coffre/core 0.1.0 → 0.1.2

package/dist/vault.d.ts

@@ -146,11 +146,13 @@ export interface Vault {
     checkpoint: Checkpoint;
   }>>;
   /**
-   * What only the vault's configuration says, which the app shows: the key
-   * its checkpoints verify under, and the root admins, as principals.
+   * What the vault's configuration says, which the app shows: the keys its
+   * checkpoints verify under, by the key id each checkpoint names (the one
+   * it signs with now, and those of the KEKs it replaced), and the root
+   * admins, as principals.
    */
   about(): Promise<{
-    publicKey: string;
+    checkpointKeys: Record<string, CheckpointKey>;
     rootAdmins: string[];
   }>;
   /**
@@ -341,6 +343,16 @@ export type Checkpoint = {
   /** Ed25519 over `checkpointMessage(...)`, base64. */
   signature: string;
 };
+/**
+ * A public key the vault's checkpoints verify under, base64. One it
+ * replaced vouches only for checkpoints whose prefix ends before `until`,
+ * its first entry under the key that replaced it; the one it signs with now
+ * has none.
+ */
+export type CheckpointKey = {
+  publicKey: string;
+  until: number | null;
+};
 /** An entry of the vault's log, and so the chain up to it. */
 export type LogHead = {
   seq: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -68,7 +68,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.1.0"
+    "@coffre/conformance": "0.1.2"
   },
   "scripts": {
     "build": "tsdown",

package/src/vault.ts

@@ -64,10 +64,12 @@ export interface Vault {
    */
   checkpoint(): Promise<Outcome<{ checkpoint: Checkpoint }>>;
   /**
-   * What only the vault's configuration says, which the app shows: the key
-   * its checkpoints verify under, and the root admins, as principals.
+   * What the vault's configuration says, which the app shows: the keys its
+   * checkpoints verify under, by the key id each checkpoint names (the one
+   * it signs with now, and those of the KEKs it replaced), and the root
+   * admins, as principals.
    */
-  about(): Promise<{ publicKey: string; rootAdmins: string[] }>;
+  about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; rootAdmins: string[] }>;
   /**
    * Check the whole log: rehash it from the first entry, the vault's
    * entries by their MACs, every checkpoint against the prefix it signed,
@@ -252,6 +254,14 @@ export type Checkpoint = {
   signature: string;
 };
 
+/**
+ * A public key the vault's checkpoints verify under, base64. One it
+ * replaced vouches only for checkpoints whose prefix ends before `until`,
+ * its first entry under the key that replaced it; the one it signs with now
+ * has none.
+ */
+export type CheckpointKey = { publicKey: string; until: number | null };
+
 /** An entry of the vault's log, and so the chain up to it. */
 export type LogHead = { seq: number; hash: string };