@coffre/vault 0.10.0 → 0.10.2

package/dist/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CByXzyi-.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-zkW6DEm9.js";
 import { AdmitInput, ChangePolicyInput, EndReferencesInput, ReferenceInput, RemoveInput, RewrapInput, SetAccessInput, SetSettingsInput, UnwrapInput, Vault, VerifyLogInput, WrapInput } from "@coffre/core/vault";
 import { PostgresDatabase, PostgresDatabase as PostgresDatabase$1, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -48,6 +48,7 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   }>>;
   checkpoint(): Promise<import("@coffre/core/vault").Outcome<{
     checkpoint: import("@coffre/core/vault").Checkpoint;
+    warning?: string;
   }>>;
   about(): Promise<{
     checkpointKeys: Record<string, import("@coffre/core/vault").CheckpointKey>;

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-D82jyprb.js";
-import { n as prepareVault, t as openVault } from "./vault-COqZ12ny.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-B0d-W-SI.js";
+import { n as prepareVault, t as openVault } from "./vault-66Xf0Hw1.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/{index-CByXzyi-.d.ts → index-zkW6DEm9.d.ts}

@@ -36,7 +36,7 @@ type VaultConfig = {
    * service holds the KEK, as AWS KMS does: the vault never sees that key.
    */
   signingKey?: string;
-  /** At most `count` data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
+  /** At most `count` distinct data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
   bulkLimit?: {
     count: number;
     windowMinutes: number;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CByXzyi-.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-zkW6DEm9.js";
 export type * from "@coffre/core/vault";
 export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-D82jyprb.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-B0d-W-SI.js";
 export { KekBadClaimError, KekUnavailableError, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.d.ts

@@ -1,7 +1,10 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CByXzyi-.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-zkW6DEm9.js";
 import { Vault, Vault as Vault$1 } from "@coffre/core/vault";
 import { Database } from "@coffre/db";
+import "@coffre/core/access";
 import "@coffre/core/audit";
+import "@coffre/db/grants";
+import "@coffre/db/log";
 export * from "@coffre/core/vault";
 //#region src/vault.d.ts
 type VaultOptions = {
@@ -12,6 +15,14 @@ type VaultOptions = {
   keyBudgetMs?: number;
   /** Milliseconds added to the database's clock where the vault decides by it. Tests move time with it. */
   clockOffset?: () => number;
+  /** How far one call walks the log (`WALKS`); tests shorten them. */
+  walks?: Partial<Walks>;
+};
+/** How far one call walks the log, in entries: a checkpoint's walk from the last, its rehash of the past, and a verification's own walk. */
+type Walks = {
+  checkpoint: number;
+  scrub: number;
+  verify: number;
 };
 //#endregion
 //#region src/local.d.ts

package/dist/node.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-D82jyprb.js";
-import { n as prepareVault, t as openVault } from "./vault-COqZ12ny.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-B0d-W-SI.js";
+import { n as prepareVault, t as openVault } from "./vault-66Xf0Hw1.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{src-D82jyprb.js → src-B0d-W-SI.js}

@@ -3,9 +3,10 @@ import { KekBadClaimError as KekBadClaimError$1, KekRegistry, KekUnavailableErro
 import { hkdfSync } from "node:crypto";
 //#region src/config.ts
 /**
-* 1000 keys in 15 minutes: twenty `coffre run`s of a 50-key environment
-* back to back, which no person or deploy pipeline does, while a script
-* pulling every secret it can reach stops within a few seconds.
+* 1000 different keys in 15 minutes, which no person or deploy pipeline
+* reads, while a script pulling every secret it can reach stops within a
+* few seconds. A key read again counts once: a 50-key `coffre run` is 50
+* however often it runs.
 */
 const DEFAULT_BULK_LIMIT = {
 	count: 1e3,