@coffre/vault 0.9.0 → 0.10.0

package/dist/cloudflare.d.ts

@@ -1,5 +1,5 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as People, i as KekProvider, l as checkpointMessage, m as derivedSigningKey, n as AwsKmsOptions, o as SecretContext, p as VaultConfig, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-BkHJR9Gt.js";
-import { AdmitInput, EndReferencesInput, ReferenceInput, RemoveInput, RewrapInput, SetAccessInput, SetSettingsInput, UnwrapInput, Vault, VerifyLogInput, WrapInput } from "@coffre/core/vault";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CByXzyi-.js";
+import { AdmitInput, ChangePolicyInput, EndReferencesInput, ReferenceInput, RemoveInput, RewrapInput, SetAccessInput, SetSettingsInput, UnwrapInput, Vault, VerifyLogInput, WrapInput } from "@coffre/core/vault";
 import { PostgresDatabase, PostgresDatabase as PostgresDatabase$1, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
 export * from "@coffre/core/vault";
@@ -19,14 +19,8 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   unwrap(input: UnwrapInput): Promise<import("@coffre/core/vault").Outcome<{
     keys: string[];
   }>>;
-  wrap(input: WrapInput): Promise<import("@coffre/core/vault").Outcome<{
-    wrapped: import("@coffre/core/vault").WrappedKey[];
-    seqs: number[];
-  }>>;
-  rewrap(input: RewrapInput): Promise<import("@coffre/core/vault").Outcome<{
-    wrapped: import("@coffre/core/vault").WrappedKey[];
-    seqs: number[];
-  }>>;
+  wrap(input: WrapInput): Promise<import("@coffre/core/vault").Outcome<import("@coffre/core/vault").Wrapped>>;
+  rewrap(input: RewrapInput): Promise<import("@coffre/core/vault").Outcome<import("@coffre/core/vault").Wrapped>>;
   reference(input: ReferenceInput): Promise<import("@coffre/core/vault").Outcome<{
     seqs: number[];
   }>>;
@@ -47,6 +41,11 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   setSettings(input: SetSettingsInput): Promise<import("@coffre/core/vault").Outcome<{
     settings: import("@coffre/core/vault").Settings;
   }>>;
+  policy(): Promise<import("@coffre/core/access").Policy>;
+  changePolicy(input: ChangePolicyInput): Promise<import("@coffre/core/vault").Outcome<{
+    policy: import("@coffre/core/access").Policy;
+    seq: number | null;
+  }>>;
   checkpoint(): Promise<import("@coffre/core/vault").Outcome<{
     checkpoint: import("@coffre/core/vault").Checkpoint;
   }>>;
@@ -63,4 +62,4 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
 /** The vault Worker's default export, `VaultEntrypoint`, configured from its `env`. */
 export declare function vault<Env>(configure_: (env: Env) => WorkersVaultConfig): typeof VaultEntrypoint;
 //#endregion
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type People, type PostgresDatabase, type SecretContext, type Vault, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, postgres, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type PostgresDatabase, type SecretContext, type Vault, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, postgres, verifyCheckpoint };

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-BcttALFQ.js";
-import { n as prepareVault, t as openVault } from "./vault-lBbyZ3kQ.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-D82jyprb.js";
+import { n as prepareVault, t as openVault } from "./vault-COqZ12ny.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -76,6 +76,12 @@ var VaultEntrypoint = class extends WorkerEntrypoint {
 	async setSettings(input) {
 		return this.#call((vault) => vault.setSettings(input));
 	}
+	async policy() {
+		return this.#call((vault) => vault.policy());
+	}
+	async changePolicy(input) {
+		return this.#call((vault) => vault.changePolicy(input));
+	}
 	async checkpoint() {
 		return this.#call((vault) => vault.checkpoint());
 	}

package/dist/{index-BkHJR9Gt.d.ts → index-CByXzyi-.d.ts}

@@ -2,15 +2,6 @@ import { checkpointMessage as checkpointMessage$1, verifyCheckpoint } from "@cof
 import { AwsCredentials, AwsKmsOptions, KekBadClaimError as KekBadClaimError$1, KekProvider, KekProvider as KekProvider$1, KekRegistry, KekUnavailableError as KekUnavailableError$1, WrappedDek, awsKms } from "@coffre/core/kek";
 import { SecretContext } from "@coffre/core/envelope";
 //#region src/config.d.ts
-/**
- * What a person's reads open (docs/design/credential-proxy.md): `values`,
- * as any member's; or `stand-ins`, where a person, on any credential of
- * theirs (a session, a personal token, an MCP connection), opens values
- * only for coffre to use for them, never to be handed back: the credential
- * proxy injects them, and the deployment's `expose` list names the few it
- * may pass on. Service accounts read values either way.
- */
-type People = 'values' | 'stand-ins';
 /**
  * A key-encryption key: 32 random bytes, base64, and the id envelopes record
  * it under; or one a key service holds, such as `awsKms({ keyArn, … })`.
@@ -50,8 +41,12 @@ type VaultConfig = {
     count: number;
     windowMinutes: number;
   };
-  /** What a person's reads open (`People`): `values` unless set. */
-  people?: People;
+  /**
+   * @deprecated Gone in 0.10, and refused: each key says who sees it now. Mark
+   * those no person may read sensitive (`coffre mark <env> sensitive`), and
+   * give people read through their roles where they should see values.
+   */
+  people?: 'gone in 0.10: mark keys sensitive (coffre mark <env> sensitive), and let roles say who reads the rest';
 } & Owners;
 /**
  * At least one email, each an Owner of the whole instance: made one when
@@ -80,4 +75,4 @@ type Owners = {
 /** The signing key a local KEK stands for, when the vault is given none: HKDF-SHA-256 of the KEK. */
 declare function derivedSigningKey(kek: Uint8Array): Buffer;
 //#endregion
-export { KekUnavailableError$1 as a, awsKms as c, Kek as d, People as f, KekProvider$1 as i, checkpointMessage$1 as l, derivedSigningKey as m, AwsKmsOptions as n, SecretContext as o, VaultConfig as p, KekBadClaimError$1 as r, WrappedDek as s, AwsCredentials as t, verifyCheckpoint as u };
+export { KekUnavailableError$1 as a, awsKms as c, Kek as d, VaultConfig as f, KekProvider$1 as i, checkpointMessage$1 as l, AwsKmsOptions as n, SecretContext as o, derivedSigningKey as p, KekBadClaimError$1 as r, WrappedDek as s, AwsCredentials as t, verifyCheckpoint as u };

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as People, i as KekProvider, l as checkpointMessage, m as derivedSigningKey, n as AwsKmsOptions, o as SecretContext, p as VaultConfig, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-BkHJR9Gt.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CByXzyi-.js";
 export type * from "@coffre/core/vault";
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type People, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-BcttALFQ.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-D82jyprb.js";
 export { KekBadClaimError, KekUnavailableError, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as People, i as KekProvider, l as checkpointMessage, m as derivedSigningKey, n as AwsKmsOptions, o as SecretContext, p as VaultConfig, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-BkHJR9Gt.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CByXzyi-.js";
 import { Vault, Vault as Vault$1 } from "@coffre/core/vault";
 import { Database } from "@coffre/db";
 import "@coffre/core/audit";
@@ -45,4 +45,4 @@ export declare function serveVault(config: NodeVaultConfig & {
 /** The vault that `serveVault` runs, from the server's side of its socket. */
 export declare function connectVault(socket: string): Vault;
 //#endregion
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type LocalVault, type People, type SecretContext, type Vault, type VaultConfig, type VaultOptions, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type LocalVault, type SecretContext, type Vault, type VaultConfig, type VaultOptions, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-BcttALFQ.js";
-import { n as prepareVault, t as openVault } from "./vault-lBbyZ3kQ.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-D82jyprb.js";
+import { n as prepareVault, t as openVault } from "./vault-COqZ12ny.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";
@@ -17,6 +17,8 @@ const METHODS = [
 	"remove",
 	"settings",
 	"setSettings",
+	"policy",
+	"changePolicy",
 	"checkpoint",
 	"about",
 	"keyChecks",

package/dist/{src-BcttALFQ.js → src-D82jyprb.js}

@@ -48,6 +48,7 @@ function kek(entry) {
 }
 /** Check a deployment's vault configuration, failing on the first problem. */
 function resolveVaultConfig(config) {
+	if ("people" in config && config.people !== void 0) throw new Error(`people is gone in 0.10 (it was ${JSON.stringify(config.people)}): each key says who sees it now. Remove people, mark the keys no person may read sensitive (coffre mark <env> sensitive, or coffre set <env>/<KEY> --sensitive), and let roles say who reads the rest (docs/design/credential-proxy.md)`);
 	const keks = [config.kek, ...config.previousKeks ?? []].map(kek);
 	const [current, ...previous] = keks.map((entry) => entry.provider);
 	const refs = [current, ...previous].map(({ provider, keyId }) => `${provider}:${keyId}`);
@@ -57,8 +58,7 @@ function resolveVaultConfig(config) {
 		keks: new KekRegistry(current, previous),
 		owners: checkOwners(config.owners ?? config.bootstrapOwners ?? config.rootAdmins ?? []),
 		signingKeys: signingKeys(config.signingKey, keks),
-		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit),
-		people: checkPeople(config.people ?? "values")
+		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit)
 	};
 }
 /**
@@ -81,10 +81,6 @@ function signingKeys(given, keks) {
 	}
 	return [signing, ...derived].filter((key, i, all) => all.findIndex((other) => other.equals(key)) === i);
 }
-function checkPeople(people) {
-	if (people !== "values" && people !== "stand-ins") throw new Error(`people is 'values' or 'stand-ins'; got ${JSON.stringify(people)}`);
-	return people;
-}
 function checkBulkLimit({ count, windowMinutes }) {
 	if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) throw new Error("bulkLimit needs a whole count of at least 1 and a window above 0 minutes");
 	return {