@coffre/vault 0.5.1 → 0.6.1

package/README.md

@@ -11,7 +11,7 @@ import { postgres, vault } from '@coffre/vault/cloudflare';
 export default vault((env) => ({
   database: postgres(env.VAULT_HYPERDRIVE), // coffre_vault_runtime, caching disabled
   kek: { id: env.VAULT_KEY_ID, key: env.VAULT_KEY }, // or awsKms({ keyArn, credentials }), with a signingKey
-  rootAdmins: env.ROOT_ADMINS.split(','),
+  owners: env.OWNERS.split(','), // Owners of the whole instance, whom nobody demotes while named
 }));
 ```
 

package/dist/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CGVAd1mz.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CwsWOH6j.js";
 import { AdmitInput, EndReferencesInput, ReferenceInput, RemoveInput, RewrapInput, SetAccessInput, SetSettingsInput, UnwrapInput, Vault, VerifyLogInput, WrapInput } from "@coffre/core/vault";
 import { PostgresDatabase, PostgresDatabase as PostgresDatabase$1, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -36,13 +36,9 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   access(principal: string): Promise<import("@coffre/core/vault").Access>;
   setAccess(input: SetAccessInput): Promise<import("@coffre/core/vault").Outcome<{
     changes: import("@coffre/core/vault").AccessChange[];
+    admitted?: import("@coffre/core/vault").Admitted;
   }>>;
-  admit(input: AdmitInput): Promise<import("@coffre/core/vault").Outcome<{
-    created: boolean;
-    role: import("@coffre/core/access").InstanceRole;
-    scope: import("@coffre/core/access").Scope;
-    generation: number;
-  }>>;
+  admit(input: AdmitInput): Promise<import("@coffre/core/vault").Outcome<import("@coffre/core/vault").Admitted>>;
   remove(input: RemoveInput): Promise<import("@coffre/core/vault").Outcome<{
     revoked: import("@coffre/core/vault").Grant[];
     generation: number;
@@ -56,7 +52,8 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   }>>;
   about(): Promise<{
     checkpointKeys: Record<string, import("@coffre/core/vault").CheckpointKey>;
-    rootAdmins: string[];
+    owners?: string[];
+    rootAdmins: [];
   }>;
   keyChecks(): Promise<import("@coffre/core/vault").KeyChecks>;
   verifyLog(input: VerifyLogInput): Promise<import("@coffre/core/vault").LogVerification>;

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-1yVV2L0_.js";
-import { n as prepareVault, t as openVault } from "./vault-CP8yU8xq.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-CQJS3OZZ.js";
+import { n as prepareVault, t as openVault } from "./vault-ihE3Yc4a.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/{index-CGVAd1mz.d.ts → index-CwsWOH6j.d.ts}

@@ -11,13 +11,13 @@ type Kek = {
   key: string;
 } | KekProvider;
 /**
- * What a deployment writes: every key coffre has, and who may always get
- * in. The app holds none of it.
+ * What a deployment writes: every key coffre has, and who owns the
+ * instance whatever its database says. The app holds none of it.
  *
  *   {
  *     kek: awsKms({ keyArn: env.KMS_KEY_ARN, credentials: { … } }),
  *     previousKeks: [{ id: 'vault-2025-01-10-k7q2xm', key: env.OLD_VAULT_KEY }],
- *     rootAdmins: ['admin@acme.example'],
+ *     owners: ['admin@acme.example'],
  *     signingKey: env.SIGNING_KEY, // required with a key service; derived from a local KEK otherwise
  *   }
  */
@@ -29,8 +29,6 @@ type VaultConfig = {
    * on, and verifying what the vault wrote under them before the rotation.
    */
   previousKeks?: readonly Kek[];
-  /** At least one email: the only way into a fresh instance, and the only members nobody can remove. */
-  rootAdmins: readonly string[];
   /**
    * 32 random bytes, base64: the seed of the vault's own keys, which MAC its
    * log entries, seal member rows and sign checkpoints. Leave it out with a
@@ -43,6 +41,30 @@ type VaultConfig = {
     count: number;
     windowMinutes: number;
   };
+} & Owners;
+/**
+ * At least one email, each an Owner of the whole instance: made one when
+ * the vault starts, and when they sign in, whatever their row says, and
+ * refused to anyone who would demote or remove them, themselves included.
+ * The way into a fresh instance, and back into one whose Owners are all
+ * locked out: add an email, deploy, sign in. Taking an email off makes
+ * them an Owner like any other, whom an Owner may demote. `rootAdmins`, as
+ * 0.5 named it, and `bootstrapOwners` are read until 0.7.
+ */
+type Owners = {
+  owners: readonly string[];
+  bootstrapOwners?: never;
+  rootAdmins?: never;
+} | {
+  /** @deprecated `owners`, read until 0.7. */
+  bootstrapOwners: readonly string[];
+  owners?: never;
+  rootAdmins?: never;
+} | {
+  /** @deprecated 0.5's name for `owners`, read until 0.7: a root admin is an Owner now. */
+  rootAdmins: readonly string[];
+  owners?: never;
+  bootstrapOwners?: never;
 };
 /** The signing key a local KEK stands for, when the vault is given none: HKDF-SHA-256 of the KEK. */
 declare function derivedSigningKey(kek: Uint8Array): Buffer;

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CGVAd1mz.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CwsWOH6j.js";
 export type * from "@coffre/core/vault";
 export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-1yVV2L0_.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-CQJS3OZZ.js";
 export { KekBadClaimError, KekUnavailableError, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CGVAd1mz.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CwsWOH6j.js";
 import { Vault, Vault as Vault$1 } from "@coffre/core/vault";
 import { Database } from "@coffre/db";
 import "@coffre/core/audit";

package/dist/node.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-1yVV2L0_.js";
-import { n as prepareVault, t as openVault } from "./vault-CP8yU8xq.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-CQJS3OZZ.js";
+import { n as prepareVault, t as openVault } from "./vault-ihE3Yc4a.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{src-1yVV2L0_.js → src-CQJS3OZZ.js}

@@ -55,7 +55,7 @@ function resolveVaultConfig(config) {
 	if (twice !== void 0) throw new Error(`two vault keys share an id: ${twice}`);
 	return {
 		keks: new KekRegistry(current, previous),
-		rootAdmins: checkRootAdmins(config.rootAdmins),
+		owners: checkOwners(config.owners ?? config.bootstrapOwners ?? config.rootAdmins ?? []),
 		signingKeys: signingKeys(config.signingKey, keks),
 		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit)
 	};
@@ -98,16 +98,16 @@ function isHumanEmail(value) {
 	return labels.every((label) => label.length > 0 && label.length <= 63 && /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
 }
 /**
-* Root admins, lowercased the way they are compared. At least one, in every
-* mode: they are the only way into a fresh instance, and the only members
-* nobody can remove.
+* The Owners the deployment names, lowercased the way they are compared.
+* At least one, in every mode: they are the only way into a fresh
+* instance, and back into one whose Owners are locked out.
 */
-function checkRootAdmins(emails) {
-	const rootAdmins = [...new Set(emails.map((entry) => entry.trim()).filter((entry) => entry.length > 0))];
-	if (rootAdmins.length === 0) throw new Error("rootAdmins must name at least one email, or nobody can manage coffre");
-	const invalid = rootAdmins.find((entry) => !isHumanEmail(entry));
-	if (invalid) throw new Error(`rootAdmins must be human email identities; invalid: ${invalid}`);
-	return rootAdmins.map((entry) => entry.toLowerCase());
+function checkOwners(emails) {
+	const owners = [...new Set(emails.map((entry) => entry.trim()).filter((entry) => entry.length > 0))];
+	if (owners.length === 0) throw new Error("owners must name at least one email, or nobody can manage coffre");
+	const invalid = owners.find((entry) => !isHumanEmail(entry));
+	if (invalid) throw new Error(`owners must be human email identities; invalid: ${invalid}`);
+	return [...new Set(owners.map((entry) => entry.toLowerCase()))];
 }
 //#endregion
 export { verifyCheckpoint as a, checkpointMessage$1 as i, KekUnavailableError$1 as n, derivedSigningKey as o, awsKms as r, resolveVaultConfig as s, KekBadClaimError$1 as t };