@coffre/core 0.1.13 → 0.1.15

package/dist/dotenv.d.ts

@@ -35,6 +35,8 @@ export declare function parseDotenv(input: string): ParseResult;
  * escapes the parser knows (`\\`, `\"`, `\n`, `\r`).
  */
 export declare function formatDotenv(entries: Iterable<readonly [key: string, value: string]>): string;
+/** Reject names and values that cannot be passed intact in an environment. */
+export declare function assertEnvironmentEntry(key: string, value: string): void;
 /**
  * Write entries as POSIX shell `export` statements, for
  * `eval "$(coffre export … --format shell)"`. Single quotes are the only

package/dist/dotenv.js

@@ -156,12 +156,13 @@ const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
 function formatDotenv(entries) {
 	let out = "";
 	for (const [key, value] of entries) {
-		assertWritable(key, value);
+		assertEnvironmentEntry(key, value);
 		out += `${key}=${quoteDotenv(value)}\n`;
 	}
 	return out;
 }
-function assertWritable(key, value) {
+/** Reject names and values that cannot be passed intact in an environment. */
+function assertEnvironmentEntry(key, value) {
 	if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
 	if (value.includes("\0")) throw new Error(`${key} contains a NUL byte`);
 }
@@ -185,10 +186,10 @@ function quoteDotenv(value) {
 function formatShellExports(entries) {
 	let out = "";
 	for (const [key, value] of entries) {
-		assertWritable(key, value);
+		assertEnvironmentEntry(key, value);
 		out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
 	}
 	return out;
 }
 //#endregion
-export { formatDotenv, formatShellExports, parseDotenv };
+export { assertEnvironmentEntry, formatDotenv, formatShellExports, parseDotenv };

package/dist/vault.d.ts

@@ -141,9 +141,12 @@ export interface Vault {
   }>>;
   /**
    * Sign the log up to its last entry, in an `audit.checkpoint` entry of
-   * the vault's, if the whole chain recomputes from its first entry, the
-   * vault's entries by their MACs, and the prefix the last checkpoint signed
-   * is still there. The vault reads the log itself: it takes nobody's word
+   * the vault's, if the chain recomputes, the vault's entries by their MACs,
+   * and the prefix the last checkpoint signed is still there. The first
+   * checkpoint of each hour recomputes from the first entry; the others
+   * resume from the prefix the last one signed, which the vault recomputed
+   * itself, while it still has every entry and ends at the hash it signed.
+   * The vault reads the log itself: it takes nobody's word
    * for where it ends, or for what came before. It checks every
    * member's row too, as `access` would, and logs a `vault.tampered` for
    * each one changed around it: lists read rows without asking the vault.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.1.13",
+  "version": "0.1.15",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -69,7 +69,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.1.13"
+    "@coffre/conformance": "0.1.15"
   },
   "scripts": {
     "build": "tsdown",

package/src/dotenv.ts

@@ -199,13 +199,14 @@ const PLAIN_VALUE = /^[A-Za-z0-9_./:@+,=%?-]*$/;
 export function formatDotenv(entries: Iterable<readonly [key: string, value: string]>): string {
   let out = '';
   for (const [key, value] of entries) {
-    assertWritable(key, value);
+    assertEnvironmentEntry(key, value);
     out += `${key}=${quoteDotenv(value)}\n`;
   }
   return out;
 }
 
-function assertWritable(key: string, value: string): void {
+/** Reject names and values that cannot be passed intact in an environment. */
+export function assertEnvironmentEntry(key: string, value: string): void {
   if (!KEY_RE.test(key)) throw new Error(`${JSON.stringify(key)} is not a valid variable name`);
   if (value.includes('\u0000')) throw new Error(`${key} contains a NUL byte`);
 }
@@ -235,7 +236,7 @@ function quoteDotenv(value: string): string {
 export function formatShellExports(entries: Iterable<readonly [key: string, value: string]>): string {
   let out = '';
   for (const [key, value] of entries) {
-    assertWritable(key, value);
+    assertEnvironmentEntry(key, value);
     out += `export ${key}='${value.replaceAll("'", "'\\''")}'\n`;
   }
   return out;

package/src/vault.ts

@@ -55,9 +55,12 @@ export interface Vault {
 
   /**
    * Sign the log up to its last entry, in an `audit.checkpoint` entry of
-   * the vault's, if the whole chain recomputes from its first entry, the
-   * vault's entries by their MACs, and the prefix the last checkpoint signed
-   * is still there. The vault reads the log itself: it takes nobody's word
+   * the vault's, if the chain recomputes, the vault's entries by their MACs,
+   * and the prefix the last checkpoint signed is still there. The first
+   * checkpoint of each hour recomputes from the first entry; the others
+   * resume from the prefix the last one signed, which the vault recomputed
+   * itself, while it still has every entry and ends at the hash it signed.
+   * The vault reads the log itself: it takes nobody's word
    * for where it ends, or for what came before. It checks every
    * member's row too, as `access` would, and logs a `vault.tampered` for
    * each one changed around it: lists read rows without asking the vault.