@coffre/core 0.1.2 → 0.1.3

package/dist/kek.js

@@ -67,7 +67,7 @@ var LocalKekProvider = class LocalKekProvider {
 	keyVersion;
 	#kek;
 	constructor(kek, keyId, keyVersion = "1") {
-		if (kek.length !== KEK_BYTES) throw new Error(`local KEK must be ${KEK_BYTES} bytes, got ${kek.length}`);
+		if (kek.length !== KEK_BYTES) throw new Error(`a local vault key must be ${KEK_BYTES} bytes, got ${kek.length}`);
 		this.#kek = kek;
 		this.keyId = keyId;
 		this.keyVersion = keyVersion;
@@ -159,7 +159,7 @@ var KekRegistry = class {
 		this.#primary = primary;
 		for (const provider of [primary, ...additional]) {
 			const ref = refOf(provider.provider, provider.keyId);
-			if (this.#byRef.has(ref)) throw new Error(`duplicate KEK in registry: ${ref}`);
+			if (this.#byRef.has(ref)) throw new Error(`duplicate vault key in registry: ${ref}`);
 			this.#byRef.set(ref, provider);
 		}
 	}
@@ -182,7 +182,7 @@ var KekRegistry = class {
 	unwrap(wrapped, ctx, operation) {
 		const ref = refOf(wrapped.kekProvider, wrapped.kekId);
 		const provider = this.#byRef.get(ref);
-		if (!provider) throw new Error(`no KEK configured for ${ref}; cannot unwrap`);
+		if (!provider) throw new Error(`no vault key configured for ${ref} (kek or previousKeks in the vault's config); cannot unwrap`);
 		return provider.unwrap(wrapped, ctx, operation);
 	}
 };

package/dist/schemas.d.ts

@@ -9,8 +9,8 @@ export declare const principalType: z.ZodEnum<{
 }>;
 export declare const principalId: z.ZodString;
 export declare const instanceRole: z.ZodEnum<{
-  user: "user";
   owner: "owner";
+  user: "user";
 }>;
 export declare const grantId: z.ZodString;
 export declare const emailAddress: z.ZodString;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -68,7 +68,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.1.2"
+    "@coffre/conformance": "0.1.3"
   },
   "scripts": {
     "build": "tsdown",

package/src/kek/local.ts

@@ -25,7 +25,7 @@ export class LocalKekProvider implements KekProvider {
 
   constructor(kek: Buffer, keyId: string, keyVersion: string = '1') {
     if (kek.length !== KEK_BYTES) {
-      throw new Error(`local KEK must be ${KEK_BYTES} bytes, got ${kek.length}`);
+      throw new Error(`a local vault key must be ${KEK_BYTES} bytes, got ${kek.length}`);
     }
     this.#kek = kek;
     this.keyId = keyId;

package/src/kek/registry.ts

@@ -23,7 +23,7 @@ export class KekRegistry {
     for (const provider of [primary, ...additional]) {
       const ref = refOf(provider.provider, provider.keyId);
       if (this.#byRef.has(ref)) {
-        throw new Error(`duplicate KEK in registry: ${ref}`);
+        throw new Error(`duplicate vault key in registry: ${ref}`);
       }
       this.#byRef.set(ref, provider);
     }
@@ -56,7 +56,7 @@ export class KekRegistry {
       // Operationally this means a KEK was removed from configuration while
       // rows still reference it. Fail loudly rather than returning a decrypt
       // error that looks like corruption.
-      throw new Error(`no KEK configured for ${ref}; cannot unwrap`);
+      throw new Error(`no vault key configured for ${ref} (kek or previousKeks in the vault's config); cannot unwrap`);
     }
     return provider.unwrap(wrapped, ctx, operation);
   }