@coffre/vault 0.1.15 → 0.1.17

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-1yVV2L0_.js";
-import { n as prepareVault, t as openVault } from "./vault-BmEa1SIQ.js";
+import { n as prepareVault, t as openVault } from "./vault-BexBMpZL.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-1yVV2L0_.js";
-import { n as prepareVault, t as openVault } from "./vault-BmEa1SIQ.js";
+import { n as prepareVault, t as openVault } from "./vault-BexBMpZL.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{vault-BmEa1SIQ.js → vault-BexBMpZL.js}

@@ -914,6 +914,10 @@ const MESSAGES = {
 	wrong_kek: "this vault's key does not open the data it holds",
 	tampered: "this member's record failed the vault's integrity check"
 };
+/** The credential a CI run's request came in on, as its entries record it: copied, never decided on. */
+function traced(correlation) {
+	return correlation.credentialId == null ? {} : { credentialId: correlation.credentialId };
+}
 /**
 * The one implementation of `Vault`. Every decision is one transaction on
 * the shared database: it locks the rows of the members it is about, reads
@@ -1335,7 +1339,8 @@ var VaultService = class {
 				requestId: input.requestId,
 				metadata: JSON.stringify({
 					...detail,
-					secretVersionId: id
+					secretVersionId: id,
+					...traced(input)
 				})
 			};
 			return {
@@ -1424,6 +1429,7 @@ var VaultService = class {
 						operation: action,
 						expiresAt: at + this.#prepared.options.keyBudgetMs + 2 * LOCK_TIMEOUT_MS,
 						...call.input.purpose === void 0 ? {} : { purpose: call.input.purpose },
+						...traced(call.input),
 						keys: secrets.map((secret, item) => ({
 							item,
 							subject: secret.path,
@@ -2392,6 +2398,7 @@ const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
 function validateCorrelation(input) {
 	if (input.requestId != null) validateText(input.requestId);
 	if (input.operationId != null && (typeof input.operationId !== "string" || !UUID.test(input.operationId))) throw new Error(`operationId must be a lowercase UUID, got: ${String(input.operationId)}`);
+	if (input.credentialId != null && (typeof input.credentialId !== "string" || !UUID.test(input.credentialId))) throw new Error(`credentialId must be a lowercase UUID, got: ${String(input.credentialId)}`);
 }
 /** Validate the entire batch before any provider sees a key. */
 function validateItems(items, field) {
@@ -2452,7 +2459,8 @@ function keyEntry(action, principal, secret, decision, code, correlation, detail
 			subject: secret.path,
 			...action === "key.wrap" ? { secretId: secret.secretId } : {},
 			version: secret.version,
-			...detail
+			...detail,
+			...traced(correlation)
 		})
 	};
 }
@@ -2470,9 +2478,13 @@ function accessEntry(actor, action, principal, decision, correlation, detail, co
 		subjectPrincipal: PRINCIPAL.test(principal) ? principal : null,
 		operationId: correlation.operationId ?? null,
 		requestId: correlation.requestId ?? null,
-		metadata: JSON.stringify(PRINCIPAL.test(principal) ? detail : {
+		metadata: JSON.stringify(PRINCIPAL.test(principal) ? {
+			...detail,
+			...traced(correlation)
+		} : {
 			subject: principal,
-			...detail
+			...detail,
+			...traced(correlation)
 		})
 	};
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.15",
-    "@coffre/db": "0.1.15"
+    "@coffre/core": "0.1.17",
+    "@coffre/db": "0.1.17"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/vault.ts

@@ -265,7 +265,12 @@ type Decision = {
 type KeyAction = 'secret.read' | 'key.wrap' | 'key.rewrap';
 
 /** What ties an entry to the app's request, and to the one action it is part of. */
-type Correlation = { requestId?: string | null; operationId?: string | null };
+type Correlation = { requestId?: string | null; operationId?: string | null; credentialId?: string | null };
+
+/** The credential a CI run's request came in on, as its entries record it: copied, never decided on. */
+function traced(correlation: Correlation): { credentialId?: string } {
+  return correlation.credentialId == null ? {} : { credentialId: correlation.credentialId };
+}
 
 /** Why a member's row is not the one the vault last wrote; rows.ts. */
 type Fault = 'mac' | 'stale';
@@ -714,7 +719,7 @@ class VaultService implements Vault {
         if (version === undefined) return {
           actor: input.principal, action, decision: 'deny', code: 'bad_claim',
           operationId: input.operationId, requestId: input.requestId,
-          metadata: JSON.stringify({ ...detail, secretVersionId: id }),
+          metadata: JSON.stringify({ ...detail, secretVersionId: id, ...traced(input) }),
         };
         return { ...keyEntry(action, input.principal, version.secret, 'deny', 'bad_claim', input, detail), secretVersionId: id };
       }));
@@ -824,6 +829,7 @@ class VaultService implements Vault {
             // Member and outcome locks can each wait before accounting is overdue.
             expiresAt: at + this.#prepared.options.keyBudgetMs + 2 * LOCK_TIMEOUT_MS,
             ...(call.input.purpose === undefined ? {} : { purpose: call.input.purpose }),
+            ...traced(call.input),
             keys: secrets.map((secret, item) => ({ item, subject: secret.path, secretId: secret.secretId, version: secret.version })),
           }),
         }]);
@@ -1712,6 +1718,9 @@ function validateCorrelation(input: Correlation): void {
   if (input.operationId != null && (typeof input.operationId !== 'string' || !UUID.test(input.operationId))) {
     throw new Error(`operationId must be a lowercase UUID, got: ${String(input.operationId)}`);
   }
+  if (input.credentialId != null && (typeof input.credentialId !== 'string' || !UUID.test(input.credentialId))) {
+    throw new Error(`credentialId must be a lowercase UUID, got: ${String(input.credentialId)}`);
+  }
 }
 
 /** Validate the entire batch before any provider sees a key. */
@@ -1780,6 +1789,7 @@ function keyEntry(
       ...(action === 'key.wrap' ? { secretId: secret.secretId } : {}),
       version: secret.version,
       ...detail,
+      ...traced(correlation),
     }),
   };
 }
@@ -1813,7 +1823,7 @@ function accessEntry(
     subjectPrincipal: PRINCIPAL.test(principal) ? principal : null,
     operationId: correlation.operationId ?? null,
     requestId: correlation.requestId ?? null,
-    metadata: JSON.stringify(PRINCIPAL.test(principal) ? detail : { subject: principal, ...detail }),
+    metadata: JSON.stringify(PRINCIPAL.test(principal) ? { ...detail, ...traced(correlation) } : { subject: principal, ...detail, ...traced(correlation) }),
   };
 }