@coffre/vault 0.1.2 → 0.1.3

package/README.md

@@ -10,7 +10,7 @@ import { postgres, vault } from '@coffre/vault/cloudflare';
 
 export default vault((env) => ({
   database: postgres(env.VAULT_HYPERDRIVE), // coffre_vault_runtime, caching disabled
-  kek: { id: env.KEK_ID, key: env.KEK }, // or awsKms({ keyArn, credentials }), with a signingKey
+  kek: { id: env.VAULT_KEY_ID, key: env.VAULT_KEY }, // or awsKms({ keyArn, credentials }), with a signingKey
   rootAdmins: env.ROOT_ADMINS.split(','),
 }));
 ```

package/dist/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CapZlhbz.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-DPxyTJNN.js";
 import { AdmitInput, RemoveInput, RewrapInput, SetAccessInput, UnwrapInput, Vault, VerifyLogInput, WrapInput } from "@coffre/core/vault";
 import { PostgresDatabase, PostgresDatabase as PostgresDatabase$1, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-D1C9S6VS.js";
-import { n as prepareVault, t as openVault } from "./vault-D5ZahBN1.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
+import { n as prepareVault, t as openVault } from "./vault-pexzy7Z-.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/{index-CapZlhbz.d.ts → index-DPxyTJNN.d.ts}

@@ -16,7 +16,7 @@ type Kek = {
  *
  *   {
  *     kek: awsKms({ keyArn: env.KMS_KEY_ARN, credentials: { … } }),
- *     previousKeks: [{ id: 'kek-2025-01', key: env.KEK_2025_01 }],
+ *     previousKeks: [{ id: 'vault-2025-01-10-k7q2xm', key: env.OLD_VAULT_KEY }],
  *     rootAdmins: ['admin@acme.example'],
  *     signingKey: env.SIGNING_KEY, // required with a key service; derived from a local KEK otherwise
  *   }

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CapZlhbz.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-DPxyTJNN.js";
 export type * from "@coffre/core/vault";
 export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-D1C9S6VS.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-DHuqw-IB.js";
 export { KekBadClaimError, KekUnavailableError, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CapZlhbz.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-DPxyTJNN.js";
 import { Vault, Vault as Vault$1 } from "@coffre/core/vault";
 import { Database } from "@coffre/db";
 import "@coffre/core/audit";

package/dist/node.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-D1C9S6VS.js";
-import { n as prepareVault, t as openVault } from "./vault-D5ZahBN1.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
+import { n as prepareVault, t as openVault } from "./vault-pexzy7Z-.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{src-D1C9S6VS.js → src-DHuqw-IB.js}

@@ -30,17 +30,17 @@ function derivedSigningKey(kek) {
 function kek(entry) {
 	if (!("wrap" in entry)) {
 		const { id, key } = entry;
-		if (!KEK_ID.test(id)) throw new Error(`KEK id "${id}" must be 1-64 letters, digits, dots, dashes or underscores`);
-		const raw = key32(key, `KEK ${id}`);
+		if (!KEK_ID.test(id)) throw new Error(`the vault key's ID "${id}" (kek.id) must be 1-64 letters, digits, dots, dashes or underscores`);
+		const raw = key32(key, `the vault key ${id}`);
 		return {
 			provider: new LocalKekProvider(raw, id),
 			signingKey: derivedSigningKey(raw)
 		};
 	}
 	const { provider, keyId, keyVersion } = entry;
-	if (typeof provider !== "string" || !KEK_PROVIDER.test(provider)) throw new Error(`a KEK provider's name must be 1-32 lowercase letters, digits or dashes; got "${String(provider)}"`);
-	if (typeof keyId !== "string" || !KEK_NAME.test(keyId) || typeof keyVersion !== "string" || !KEK_NAME.test(keyVersion)) throw new Error(`KEK ${provider}: keyId and keyVersion must be 1-255 visible ASCII characters`);
-	if (typeof entry.wrap !== "function" || typeof entry.unwrap !== "function") throw new Error(`KEK ${provider}:${keyId} needs wrap() and unwrap()`);
+	if (typeof provider !== "string" || !KEK_PROVIDER.test(provider)) throw new Error(`a key service's name (kek.provider) must be 1-32 lowercase letters, digits or dashes; got "${String(provider)}"`);
+	if (typeof keyId !== "string" || !KEK_NAME.test(keyId) || typeof keyVersion !== "string" || !KEK_NAME.test(keyVersion)) throw new Error(`vault key ${provider}: keyId and keyVersion must be 1-255 visible ASCII characters`);
+	if (typeof entry.wrap !== "function" || typeof entry.unwrap !== "function") throw new Error(`vault key ${provider}:${keyId} needs wrap() and unwrap()`);
 	return {
 		provider: entry,
 		signingKey: null
@@ -52,7 +52,7 @@ function resolveVaultConfig(config) {
 	const [current, ...previous] = keks.map((entry) => entry.provider);
 	const refs = [current, ...previous].map(({ provider, keyId }) => `${provider}:${keyId}`);
 	const twice = refs.find((ref, i) => refs.indexOf(ref) !== i);
-	if (twice !== void 0) throw new Error(`two KEKs share an id: ${twice}`);
+	if (twice !== void 0) throw new Error(`two vault keys share an id: ${twice}`);
 	return {
 		keks: new KekRegistry(current, previous),
 		rootAdmins: checkRootAdmins(config.rootAdmins),
@@ -76,7 +76,7 @@ function signingKeys(given, keks) {
 	else if (keks[0].signingKey !== null) signing = keks[0].signingKey;
 	else {
 		const { provider, keyId } = keks[0].provider;
-		throw new Error(`signingKey is required with the ${provider} KEK ${keyId}: the vault derives its signing key only from a KEK it holds, and a key service never hands its key over. Set signingKey to 32 random bytes, base64 (openssl rand -base64 32), and keep it with the KEK.`);
+		throw new Error(`signingKey is required with the ${provider} vault key ${keyId}: the vault derives its signing key only from a vault key it holds, and a key service never hands its key over. Set signingKey to 32 random bytes, base64 (openssl rand -base64 32), and keep it with the vault key.`);
 	}
 	return [signing, ...derived].filter((key, i, all) => all.findIndex((other) => other.equals(key)) === i);
 }

package/dist/{vault-D5ZahBN1.js → vault-pexzy7Z-.js}

@@ -377,7 +377,7 @@ function forward(entries, keys, current) {
 */
 function withCause(reason) {
 	if (!/^written under vault:\S+, a key this verifier does not hold$/.test(reason)) return reason;
-	return `${reason}: either it is forged, or the vault wrote it under another KEK or signing key, which must stay configured: a KEK that was replaced stays in previousKeks`;
+	return `${reason}: either it is forged, or the vault wrote it under another vault key or signing key, which must stay configured: a vault key that was replaced stays in the vault's config, in previousKeks`;
 }
 /**
 * Whether the log still holds `head` where it was: not rewritten, nor cut
@@ -890,7 +890,7 @@ const MESSAGES = {
 	root_admin: "root admins are set in the vault configuration",
 	invalid: "not something the rules allow",
 	log_broken: "the vault log does not hold from the last checkpoint",
-	wrong_kek: "this vault's KEK does not open the data it holds",
+	wrong_kek: "this vault's key does not open the data it holds",
 	tampered: "this member's record failed the vault's integrity check"
 };
 /**
@@ -1140,7 +1140,7 @@ var VaultService = class {
 				if (attempt < 3 && error instanceof Retry) continue;
 				throw error;
 			}
-			prepared.superseded = first === void 0 ? `the vault's entries are under ${newest.keyId}, a key this vault does not hold: it was given the wrong KEK or signing key, or a KEK it replaced is missing from previousKeks` : `the log moved on from this vault's key, ${current}, to ${newest.keyId}: a vault given a newer KEK replaced it, and a replaced key writes nothing more`;
+			prepared.superseded = first === void 0 ? `the vault's entries are under ${newest.keyId}, a key this vault does not hold: it was given the wrong vault key or signing key, or a vault key it replaced is missing from previousKeks in its config` : `the log moved on from this vault's key, ${current}, to ${newest.keyId}: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
 			return;
 		}
 	}
@@ -1189,7 +1189,7 @@ var VaultService = class {
 		return appendEntries(tx, prepared.logKey, entries, async (locked) => {
 			const rotation = await latestVaultEntry(locked, [KEY_ROTATE]);
 			if (rotation === void 0 || prepared.logKeys.some((key) => key.keyId === rotation.keyId)) return;
-			prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer KEK replaced it, and a replaced key writes nothing more`;
+			prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
 			throw new Error(prepared.superseded);
 		});
 	}
@@ -1956,7 +1956,7 @@ var VaultService = class {
 					throw error;
 				}
 			};
-			const mismatch = `this vault's ${kek.provider} KEK ${kek.keyId} does not open the data it holds: it is not the key that wrapped it`;
+			const mismatch = `the vault key ${kek.keyId}${kek.provider === "local" ? "" : ` (${kek.provider})`}, kek or previousKeks in the vault's config, is not the one that wrapped these values`;
 			const check = checks.get(`${kek.provider}:${kek.keyId}`);
 			if (check !== void 0) {
 				if (!await opens(check, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE)) return mismatch;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.2",
-    "@coffre/db": "0.1.2"
+    "@coffre/core": "0.1.3",
+    "@coffre/db": "0.1.3"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/cloudflare.ts

@@ -8,7 +8,7 @@
  *
  *   export default vault((env: Env) => ({
  *     database: postgres(env.HYPERDRIVE),
- *     kek: { id: 'kek-1', key: env.KEK }, // or awsKms({ keyArn, credentials }), with a signingKey
+ *     kek: { id: env.VAULT_KEY_ID, key: env.VAULT_KEY }, // or awsKms({ keyArn, credentials }), with a signingKey
  *     rootAdmins: ['admin@acme.example'],
  *   }));
  *

package/src/config.ts

@@ -38,7 +38,7 @@ export type Kek = { id: string; key: string } | KekProvider;
  *
  *   {
  *     kek: awsKms({ keyArn: env.KMS_KEY_ARN, credentials: { … } }),
- *     previousKeks: [{ id: 'kek-2025-01', key: env.KEK_2025_01 }],
+ *     previousKeks: [{ id: 'vault-2025-01-10-k7q2xm', key: env.OLD_VAULT_KEY }],
  *     rootAdmins: ['admin@acme.example'],
  *     signingKey: env.SIGNING_KEY, // required with a key service; derived from a local KEK otherwise
  *   }
@@ -87,19 +87,19 @@ export function derivedSigningKey(kek: Uint8Array): Buffer {
 function kek(entry: Kek): { provider: KekProvider; signingKey: Buffer | null } {
   if (!('wrap' in entry)) {
     const { id, key } = entry;
-    if (!KEK_ID.test(id)) throw new Error(`KEK id "${id}" must be 1-64 letters, digits, dots, dashes or underscores`);
-    const raw = key32(key, `KEK ${id}`);
+    if (!KEK_ID.test(id)) throw new Error(`the vault key's ID "${id}" (kek.id) must be 1-64 letters, digits, dots, dashes or underscores`);
+    const raw = key32(key, `the vault key ${id}`);
     return { provider: new LocalKekProvider(raw, id), signingKey: derivedSigningKey(raw) };
   }
   const { provider, keyId, keyVersion } = entry;
   if (typeof provider !== 'string' || !KEK_PROVIDER.test(provider)) {
-    throw new Error(`a KEK provider's name must be 1-32 lowercase letters, digits or dashes; got "${String(provider)}"`);
+    throw new Error(`a key service's name (kek.provider) must be 1-32 lowercase letters, digits or dashes; got "${String(provider)}"`);
   }
   if (typeof keyId !== 'string' || !KEK_NAME.test(keyId) || typeof keyVersion !== 'string' || !KEK_NAME.test(keyVersion)) {
-    throw new Error(`KEK ${provider}: keyId and keyVersion must be 1-255 visible ASCII characters`);
+    throw new Error(`vault key ${provider}: keyId and keyVersion must be 1-255 visible ASCII characters`);
   }
   if (typeof entry.wrap !== 'function' || typeof entry.unwrap !== 'function') {
-    throw new Error(`KEK ${provider}:${keyId} needs wrap() and unwrap()`);
+    throw new Error(`vault key ${provider}:${keyId} needs wrap() and unwrap()`);
   }
   return { provider: entry, signingKey: null };
 }
@@ -110,7 +110,7 @@ export function resolveVaultConfig(config: VaultConfig): ResolvedVaultConfig {
   const [current, ...previous] = keks.map((entry) => entry.provider);
   const refs = [current, ...previous].map(({ provider, keyId }) => `${provider}:${keyId}`);
   const twice = refs.find((ref, i) => refs.indexOf(ref) !== i);
-  if (twice !== undefined) throw new Error(`two KEKs share an id: ${twice}`);
+  if (twice !== undefined) throw new Error(`two vault keys share an id: ${twice}`);
   return {
     keks: new KekRegistry(current, previous),
     rootAdmins: checkRootAdmins(config.rootAdmins),
@@ -136,8 +136,8 @@ function signingKeys(given: string | undefined, keks: { provider: KekProvider; s
   else {
     const { provider, keyId } = keks[0].provider;
     throw new Error(
-      `signingKey is required with the ${provider} KEK ${keyId}: the vault derives its signing key only from a KEK it holds, ` +
-        'and a key service never hands its key over. Set signingKey to 32 random bytes, base64 (openssl rand -base64 32), and keep it with the KEK.',
+      `signingKey is required with the ${provider} vault key ${keyId}: the vault derives its signing key only from a vault key it holds, ` +
+        'and a key service never hands its key over. Set signingKey to 32 random bytes, base64 (openssl rand -base64 32), and keep it with the vault key.',
     );
   }
   return [signing, ...derived].filter((key, i, all) => all.findIndex((other) => other.equals(key)) === i);

package/src/log.ts

@@ -132,7 +132,7 @@ function forward(
  */
 function withCause(reason: string): string {
   if (!/^written under vault:\S+, a key this verifier does not hold$/.test(reason)) return reason;
-  return `${reason}: either it is forged, or the vault wrote it under another KEK or signing key, which must stay configured: a KEK that was replaced stays in previousKeks`;
+  return `${reason}: either it is forged, or the vault wrote it under another vault key or signing key, which must stay configured: a vault key that was replaced stays in the vault's config, in previousKeks`;
 }
 
 /**

package/src/vault.ts

@@ -223,7 +223,7 @@ const MESSAGES: Record<RefusalCode, string> = {
   root_admin: 'root admins are set in the vault configuration',
   invalid: 'not something the rules allow',
   log_broken: 'the vault log does not hold from the last checkpoint',
-  wrong_kek: "this vault's KEK does not open the data it holds",
+  wrong_kek: "this vault's key does not open the data it holds",
   tampered: "this member's record failed the vault's integrity check",
 };
 
@@ -531,8 +531,8 @@ class VaultService implements Vault {
       }
       prepared.superseded =
         first === undefined
-          ? `the vault's entries are under ${newest.keyId}, a key this vault does not hold: it was given the wrong KEK or signing key, or a KEK it replaced is missing from previousKeks`
-          : `the log moved on from this vault's key, ${current}, to ${newest.keyId}: a vault given a newer KEK replaced it, and a replaced key writes nothing more`;
+          ? `the vault's entries are under ${newest.keyId}, a key this vault does not hold: it was given the wrong vault key or signing key, or a vault key it replaced is missing from previousKeks in its config`
+          : `the log moved on from this vault's key, ${current}, to ${newest.keyId}: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
       return;
     }
   }
@@ -581,7 +581,7 @@ class VaultService implements Vault {
     return appendEntries(tx, prepared.logKey, entries, async (locked) => {
       const rotation = await store.latestVaultEntry(locked, [KEY_ROTATE]);
       if (rotation === undefined || prepared.logKeys.some((key) => key.keyId === rotation.keyId)) return;
-      prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer KEK replaced it, and a replaced key writes nothing more`;
+      prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
       throw new Error(prepared.superseded);
     });
   }
@@ -1359,7 +1359,7 @@ class VaultService implements Vault {
           throw error;
         }
       };
-      const mismatch = `this vault's ${kek.provider} KEK ${kek.keyId} does not open the data it holds: it is not the key that wrapped it`;
+      const mismatch = `the vault key ${kek.keyId}${kek.provider === 'local' ? '' : ` (${kek.provider})`}, kek or previousKeks in the vault's config, is not the one that wrapped these values`;
       const check = checks.get(`${kek.provider}:${kek.keyId}`);
       if (check !== undefined) {
         if (!(await opens(check, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE))) return mismatch;