@coffre/vault 0.1.6 → 0.1.7

package/dist/cloudflare.d.ts

@@ -45,6 +45,7 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
     checkpointKeys: Record<string, import("@coffre/core/vault").CheckpointKey>;
     rootAdmins: string[];
   }>;
+  keyChecks(): Promise<import("@coffre/core/vault").KeyChecks>;
   verifyLog(input: VerifyLogInput): Promise<import("@coffre/core/vault").LogVerification>;
   /** No HTTP surface: only the app's service binding reaches the vault. */
   fetch(): Response;

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-PQvFopA6.js";
+import { n as prepareVault, t as openVault } from "./vault-BV36qTZy.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -60,6 +60,9 @@ var VaultEntrypoint = class extends WorkerEntrypoint {
 	async about() {
 		return (await this.#vault()).about();
 	}
+	async keyChecks() {
+		return (await this.#vault()).keyChecks();
+	}
 	async verifyLog(input) {
 		return (await this.#vault()).verifyLog(input);
 	}

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-PQvFopA6.js";
+import { n as prepareVault, t as openVault } from "./vault-BV36qTZy.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";
@@ -15,6 +15,7 @@ const METHODS = [
 	"remove",
 	"checkpoint",
 	"about",
+	"keyChecks",
 	"verifyLog"
 ];
 /**

package/dist/{vault-PQvFopA6.js → vault-BV36qTZy.js}

@@ -1,6 +1,6 @@
 import { ACCESS_ACTIONS, checkpointMessage, describeAccessFault, verifyCheckpoint } from "@coffre/core/vault";
-import { DEK_BYTES, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
-import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
+import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
+import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { tablesOf } from "@coffre/db";
 import { allows, assignableToEnvironment, isRole, isSyncPrincipal, mayManageAccess } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
@@ -821,20 +821,6 @@ const LOCK_TIMEOUT_MS = 15e3;
 const PRINCIPAL = /^(user|token|sync):[^\s:][^\s]*$/;
 /** Who acts for the vault itself, as when it gives a root admin a member row. */
 const VAULT_ACTOR = "system:vault";
-/**
-* A KEK's check: a known value, the size of a data key, wrapped under it in
-* a context no secret has (the nil UUID), and kept in a `key.check` entry.
-* Opening it again tells the vault its KEK is the one that wrapped the
-* data, without opening any data.
-*/
-const KEY_CHECK = "key.check";
-const KEY_CHECK_VALUE = createHash("sha256").update("coffre.kek.check.v1").digest();
-const NIL = "00000000-0000-0000-0000-000000000000";
-const KEY_CHECK_CONTEXT = {
-	projectId: NIL,
-	environmentId: NIL,
-	secretId: NIL
-};
 /** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
 const KEY_CHECK_SAMPLE = 3;
 /** The vault's first entry under a new key, which the keys it replaced count only before (`#settle`). */
@@ -1950,7 +1936,7 @@ var VaultService = class {
 			const mismatch = `the vault key ${kek.keyId}${kek.provider === "local" ? "" : ` (${kek.provider})`}, kek or previousKeks in the vault's config, is not the one that wrapped these values`;
 			const check = checks.get(`${kek.provider}:${kek.keyId}`);
 			if (check !== void 0) {
-				if (!await opens(check, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE)) return mismatch;
+				if (!await opens(unwrappable(check.wrapped), KEY_CHECK_CONTEXT, KEY_CHECK_VALUE)) return mismatch;
 				continue;
 			}
 			const samples = await wrappedUnder(this.#db, kek.provider, kek.keyId, KEY_CHECK_SAMPLE);
@@ -1984,13 +1970,21 @@ var VaultService = class {
 		}
 		return null;
 	}
-	/** Each KEK's recorded check value, by `provider:keyId`. */
+	/** Each KEK's recorded check value, by `provider:keyId`, and the entry that holds it. */
 	async #checkValues(db) {
 		const checks = /* @__PURE__ */ new Map();
 		for (const entry of await vaultEntriesOf(db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
 			if (!this.#authentic(entry)) continue;
-			const wrapped = JSON.parse(entry.metadata);
-			checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
+			const { kekProvider, kekId, kekVersion, bytes } = JSON.parse(entry.metadata);
+			checks.set(`${kekProvider}:${kekId}`, {
+				seq: entry.seq,
+				wrapped: {
+					kekProvider,
+					kekId,
+					kekVersion,
+					bytes
+				}
+			});
 		}
 		return checks;
 	}
@@ -2066,6 +2060,21 @@ var VaultService = class {
 			rootAdmins: this.#config.rootAdmins.map((email) => `user:${email}`)
 		};
 	}
+	async keyChecks() {
+		await this.#kekMismatch();
+		const { provider, keyId } = this.#config.keks.primary;
+		const checks = [...(await this.#checkValues(this.#db)).values()].sort((a, b) => a.seq < b.seq ? 1 : -1).map(({ seq, wrapped }) => ({
+			...wrapped,
+			seq: Number(seq)
+		}));
+		return {
+			current: {
+				kekProvider: provider,
+				kekId: keyId
+			},
+			checks
+		};
+	}
 	verifyLog(input) {
 		return this.#verifyAll([], input.upTo ?? null);
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.6",
-    "@coffre/db": "0.1.6"
+    "@coffre/core": "0.1.7",
+    "@coffre/db": "0.1.7"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/cloudflare.ts

@@ -78,6 +78,7 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   async remove(input: RemoveInput) { return (await this.#vault()).remove(input); }
   async checkpoint() { return (await this.#vault()).checkpoint(); }
   async about() { return (await this.#vault()).about(); }
+  async keyChecks() { return (await this.#vault()).keyChecks(); }
   async verifyLog(input: VerifyLogInput) { return (await this.#vault()).verifyLog(input); }
 
   /** No HTTP surface: only the app's service binding reaches the vault. */

package/src/local.ts

@@ -15,6 +15,7 @@ export const METHODS = [
   'remove',
   'checkpoint',
   'about',
+  'keyChecks',
   'verifyLog',
 ] as const satisfies readonly (keyof Vault)[];
 

package/src/vault.ts

@@ -1,4 +1,4 @@
-import { createHash, randomUUID, timingSafeEqual } from 'node:crypto';
+import { randomUUID, timingSafeEqual } from 'node:crypto';
 
 import {
   allows,
@@ -14,6 +14,9 @@ import { verifyEntries, type LogKey, type StoredEntry } from '@coffre/core/audit
 import { checkContext, type SecretContext } from '@coffre/core/envelope';
 import {
   DEK_BYTES,
+  KEY_CHECK,
+  KEY_CHECK_CONTEXT,
+  KEY_CHECK_VALUE,
   KekBadClaimError,
   KekCancelledError,
   KekUnavailableError,
@@ -34,6 +37,7 @@ import {
   type CheckpointKey,
   type Grant,
   type GrantChange,
+  type KeyChecks,
   type LogHead,
   type LogVerification,
   type Outcome,
@@ -150,16 +154,11 @@ const PRINCIPAL = /^(user|token|sync):[^\s:][^\s]*$/;
 /** Who acts for the vault itself, as when it gives a root admin a member row. */
 const VAULT_ACTOR = 'system:vault';
 
-/**
- * A KEK's check: a known value, the size of a data key, wrapped under it in
- * a context no secret has (the nil UUID), and kept in a `key.check` entry.
- * Opening it again tells the vault its KEK is the one that wrapped the
- * data, without opening any data.
- */
-const KEY_CHECK = 'key.check';
-const KEY_CHECK_VALUE = createHash('sha256').update('coffre.kek.check.v1').digest();
-const NIL = '00000000-0000-0000-0000-000000000000';
-const KEY_CHECK_CONTEXT: SecretContext = { projectId: NIL, environmentId: NIL, secretId: NIL };
+// A KEK's check: a known value, the size of a data key, wrapped under it in
+// a context no secret has (the nil UUID), and kept in a `key.check` entry
+// (@coffre/core/kek). Opening it again tells the vault its KEK is the one
+// that wrapped the data, without opening any data; `coffre verify keys`
+// holds an escrowed key to it the same way.
 
 /** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
 const KEY_CHECK_SAMPLE = 3;
@@ -1352,7 +1351,7 @@ class VaultService implements Vault {
       const mismatch = `the vault key ${kek.keyId}${kek.provider === 'local' ? '' : ` (${kek.provider})`}, kek or previousKeks in the vault's config, is not the one that wrapped these values`;
       const check = checks.get(`${kek.provider}:${kek.keyId}`);
       if (check !== undefined) {
-        if (!(await opens(check, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE))) return mismatch;
+        if (!(await opens(unwrappable(check.wrapped), KEY_CHECK_CONTEXT, KEY_CHECK_VALUE))) return mismatch;
         continue;
       }
       const samples = await store.wrappedUnder(this.#db, kek.provider, kek.keyId, KEY_CHECK_SAMPLE);
@@ -1378,14 +1377,14 @@ class VaultService implements Vault {
     return null;
   }
 
-  /** Each KEK's recorded check value, by `provider:keyId`. */
-  async #checkValues(db: Queryable): Promise<Map<string, WrappedDek>> {
-    const checks = new Map<string, WrappedDek>();
+  /** Each KEK's recorded check value, by `provider:keyId`, and the entry that holds it. */
+  async #checkValues(db: Queryable): Promise<Map<string, { seq: bigint; wrapped: WrappedKey }>> {
+    const checks = new Map<string, { seq: bigint; wrapped: WrappedKey }>();
     for (const entry of await store.vaultEntriesOf(db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
       // A check in the vault's name that the vault did not write proves nothing either way.
       if (!this.#authentic(entry)) continue;
-      const wrapped = JSON.parse(entry.metadata) as WrappedKey;
-      checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
+      const { kekProvider, kekId, kekVersion, bytes } = JSON.parse(entry.metadata) as WrappedKey;
+      checks.set(`${kekProvider}:${kekId}`, { seq: entry.seq, wrapped: { kekProvider, kekId, kekVersion, bytes } });
     }
     return checks;
   }
@@ -1464,6 +1463,16 @@ class VaultService implements Vault {
     };
   }
 
+  async keyChecks(): Promise<KeyChecks> {
+    // A vault key with no check yet gets one first, as before the first key operation.
+    await this.#kekMismatch();
+    const { provider, keyId } = this.#config.keks.primary;
+    const checks = [...(await this.#checkValues(this.#db)).values()]
+      .sort((a, b) => (a.seq < b.seq ? 1 : -1))
+      .map(({ seq, wrapped }) => ({ ...wrapped, seq: Number(seq) }));
+    return { current: { kekProvider: provider, kekId: keyId }, checks };
+  }
+
   verifyLog(input: VerifyLogInput): Promise<LogVerification> {
     return this.#verifyAll([], input.upTo ?? null);
   }