@coffre/core 0.1.1 → 0.1.3

package/dist/kek.js

@@ -67,7 +67,7 @@ var LocalKekProvider = class LocalKekProvider {
 	keyVersion;
 	#kek;
 	constructor(kek, keyId, keyVersion = "1") {
-		if (kek.length !== KEK_BYTES) throw new Error(`local KEK must be ${KEK_BYTES} bytes, got ${kek.length}`);
+		if (kek.length !== KEK_BYTES) throw new Error(`a local vault key must be ${KEK_BYTES} bytes, got ${kek.length}`);
 		this.#kek = kek;
 		this.keyId = keyId;
 		this.keyVersion = keyVersion;
@@ -159,7 +159,7 @@ var KekRegistry = class {
 		this.#primary = primary;
 		for (const provider of [primary, ...additional]) {
 			const ref = refOf(provider.provider, provider.keyId);
-			if (this.#byRef.has(ref)) throw new Error(`duplicate KEK in registry: ${ref}`);
+			if (this.#byRef.has(ref)) throw new Error(`duplicate vault key in registry: ${ref}`);
 			this.#byRef.set(ref, provider);
 		}
 	}
@@ -182,7 +182,7 @@ var KekRegistry = class {
 	unwrap(wrapped, ctx, operation) {
 		const ref = refOf(wrapped.kekProvider, wrapped.kekId);
 		const provider = this.#byRef.get(ref);
-		if (!provider) throw new Error(`no KEK configured for ${ref}; cannot unwrap`);
+		if (!provider) throw new Error(`no vault key configured for ${ref} (kek or previousKeks in the vault's config); cannot unwrap`);
 		return provider.unwrap(wrapped, ctx, operation);
 	}
 };

package/dist/vault.d.ts

@@ -146,11 +146,13 @@ export interface Vault {
     checkpoint: Checkpoint;
   }>>;
   /**
-   * What only the vault's configuration says, which the app shows: the key
-   * its checkpoints verify under, and the root admins, as principals.
+   * What the vault's configuration says, which the app shows: the keys its
+   * checkpoints verify under, by the key id each checkpoint names (the one
+   * it signs with now, and those of the KEKs it replaced), and the root
+   * admins, as principals.
    */
   about(): Promise<{
-    publicKey: string;
+    checkpointKeys: Record<string, CheckpointKey>;
     rootAdmins: string[];
   }>;
   /**
@@ -341,6 +343,16 @@ export type Checkpoint = {
   /** Ed25519 over `checkpointMessage(...)`, base64. */
   signature: string;
 };
+/**
+ * A public key the vault's checkpoints verify under, base64. One it
+ * replaced vouches only for checkpoints whose prefix ends before `until`,
+ * its first entry under the key that replaced it; the one it signs with now
+ * has none.
+ */
+export type CheckpointKey = {
+  publicKey: string;
+  until: number | null;
+};
 /** An entry of the vault's log, and so the chain up to it. */
 export type LogHead = {
   seq: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -68,7 +68,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.1.1"
+    "@coffre/conformance": "0.1.3"
   },
   "scripts": {
     "build": "tsdown",

package/src/kek/local.ts

@@ -25,7 +25,7 @@ export class LocalKekProvider implements KekProvider {
 
   constructor(kek: Buffer, keyId: string, keyVersion: string = '1') {
     if (kek.length !== KEK_BYTES) {
-      throw new Error(`local KEK must be ${KEK_BYTES} bytes, got ${kek.length}`);
+      throw new Error(`a local vault key must be ${KEK_BYTES} bytes, got ${kek.length}`);
     }
     this.#kek = kek;
     this.keyId = keyId;

package/src/kek/registry.ts

@@ -23,7 +23,7 @@ export class KekRegistry {
     for (const provider of [primary, ...additional]) {
       const ref = refOf(provider.provider, provider.keyId);
       if (this.#byRef.has(ref)) {
-        throw new Error(`duplicate KEK in registry: ${ref}`);
+        throw new Error(`duplicate vault key in registry: ${ref}`);
       }
       this.#byRef.set(ref, provider);
     }
@@ -56,7 +56,7 @@ export class KekRegistry {
       // Operationally this means a KEK was removed from configuration while
       // rows still reference it. Fail loudly rather than returning a decrypt
       // error that looks like corruption.
-      throw new Error(`no KEK configured for ${ref}; cannot unwrap`);
+      throw new Error(`no vault key configured for ${ref} (kek or previousKeks in the vault's config); cannot unwrap`);
     }
     return provider.unwrap(wrapped, ctx, operation);
   }

package/src/vault.ts

@@ -64,10 +64,12 @@ export interface Vault {
    */
   checkpoint(): Promise<Outcome<{ checkpoint: Checkpoint }>>;
   /**
-   * What only the vault's configuration says, which the app shows: the key
-   * its checkpoints verify under, and the root admins, as principals.
+   * What the vault's configuration says, which the app shows: the keys its
+   * checkpoints verify under, by the key id each checkpoint names (the one
+   * it signs with now, and those of the KEKs it replaced), and the root
+   * admins, as principals.
    */
-  about(): Promise<{ publicKey: string; rootAdmins: string[] }>;
+  about(): Promise<{ checkpointKeys: Record<string, CheckpointKey>; rootAdmins: string[] }>;
   /**
    * Check the whole log: rehash it from the first entry, the vault's
    * entries by their MACs, every checkpoint against the prefix it signed,
@@ -252,6 +254,14 @@ export type Checkpoint = {
   signature: string;
 };
 
+/**
+ * A public key the vault's checkpoints verify under, base64. One it
+ * replaced vouches only for checkpoints whose prefix ends before `until`,
+ * its first entry under the key that replaced it; the one it signs with now
+ * has none.
+ */
+export type CheckpointKey = { publicKey: string; until: number | null };
+
 /** An entry of the vault's log, and so the chain up to it. */
 export type LogHead = { seq: number; hash: string };