@volter/world-core 2.0.28 → 2.0.30

package/dist/src/credential.d.ts

@@ -58,6 +58,17 @@ export declare class MemoryCredentialStorage implements CredentialStorage {
 }
 export declare function sealCredential(kekSecret: string, payload: CredentialPayload, placedAt: string, slot?: string, bound?: string): Promise<SealedUnderKey>;
 export declare function openSealedCredential(kekSecret: string, sealed: SealedCredential, slot?: string, bound?: string): Promise<CredentialPayload>;
+/** What a rewrap made of a record: its new form, current (already under the newest version), or not this sealer's to
+ *  vouch for (another key's, or an answer whose version it could not read): only `current` says nothing is left. */
+export type Rewrapped = {
+    status: 'rewrapped';
+    sealed: SealedCredential;
+} | {
+    status: 'current';
+} | {
+    status: 'foreign';
+    reason: string;
+};
 /** Seals and opens credentials. A host chooses one (`setSealer`); a key it holds (`keySealer`), or a vault that holds
  *  the key and wraps for it (`transitSealer`). */
 export interface Sealer {
@@ -65,6 +76,11 @@ export interface Sealer {
     seal(payload: CredentialPayload, placedAt: string, slot?: string, bound?: string): Promise<SealedCredential>;
     /** `bound`: the destination it is opened for; a record bound elsewhere refuses */
     open(sealed: SealedCredential, slot?: string, bound?: string): Promise<CredentialPayload>;
+    /** The record with its DEK wrapped under the newest version of its key, without the DEK leaving the sealer (a
+     *  vault's `transit/rewrap` after a rotation): `rewrapped` with its new form, `current` when it already is, `foreign`
+     *  when it is not this sealer's to vouch for. What an operator's sweep runs after rotating a key, before raising its
+     *  minimum decryption version. */
+    rewrap?(sealed: SealedCredential): Promise<Rewrapped>;
 }
 /** Wraps under a key the host holds (the user's key file, a deployment secret): `v: 1` records. */
 export declare function keySealer(kekSecret: () => string): Sealer;

package/dist/src/credential.js

@@ -257,5 +257,20 @@ export function transitSealer(options) {
                 throw new Error('credential unseal failed: wrong slot or corrupted record');
             }
         },
+        async rewrap(sealed) {
+            // only this sealer's own records: a key's (v1) or another transit key's are not its to rewrap
+            if (sealed.v !== 2)
+                return { status: 'foreign', reason: 'sealed under a host key' };
+            if (sealed.transitKey !== named)
+                return { status: 'foreign', reason: `sealed by ${sealed.transitKey}` };
+            const { ciphertext } = await call('rewrap', { ciphertext: sealed.wrappedDek });
+            const version = (wrapped) => { const m = typeof wrapped === 'string' ? /^vault:v(\d+):/.exec(wrapped) : null; return m ? Number(m[1]) : null; };
+            const before = version(sealed.wrappedDek);
+            const after = version(ciphertext);
+            if (before === null || after === null)
+                return { status: 'foreign', reason: 'a wrapped key whose version could not be read' };
+            // the vault rewraps to a fresh ciphertext at the same version when the key has not moved: current, nothing written
+            return after > before ? { status: 'rewrapped', sealed: { ...sealed, wrappedDek: String(ciphertext) } } : { status: 'current' };
+        },
     };
 }

package/dist/src/index.d.ts

@@ -48,7 +48,7 @@ export * as git from './git/index.js';
 export { PLACEHOLDER_REMOTE, beginPlaceholderPull, endPlaceholderPull, placeholderPullActive, placeholderPullMarkerPath, withPlaceholderPull, placeholderEventsFor } from './placeholder-remote.js';
 export { ownFields, subjectHistory, rebaseBranch, cutCheckpoint, appendParentEntry, wholeLog, branchEntries, branchLogPath, branchMetaPath, CHECKPOINT_EVERY, dropCheckpoint, foldEntries, landedCopy, landedIds, parentEntries, parentLogPath, position, readBranchMeta, readTree, toEntry, toEvent, unpushedEntries, writeBranchMeta } from './log.js';
 export type { BranchMeta, Entry, EntryOp, Receipt } from './log.js';
-export { sealCredential, openSealedCredential, MemoryCredentialStorage, keySealer, transitSealer, type Sealer, type TransitSealerOptions, type SealedByVault, type SealedUnderKey } from './credential.js';
+export { sealCredential, openSealedCredential, MemoryCredentialStorage, keySealer, transitSealer, type Rewrapped, type Sealer, type TransitSealerOptions, type SealedByVault, type SealedUnderKey } from './credential.js';
 export type { CredentialPayload, CredentialStorage, SealedCredential } from './credential.js';
 export { validateRemoteOrigin, buildRemoteExecute, type CredentialCustody } from './executor.js';
 export type { TwinAuthStrategy } from './executor.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@volter/world-core",
-  "version": "2.0.28",
+  "version": "2.0.30",
   "description": "The kernel of Volter World: one log per twin, branches as pointers, checkpoints, the fold that keeps a twin current, the head that performs a write against the vendor, references, and the git plane. A twin package builds on it; the runtime serves it.",
   "keywords": [
     "twin",

package/src/credential.ts

@@ -178,6 +178,10 @@ export async function openSealedCredential(kekSecret: string, sealed: SealedCred
 
 // ── a sealer: what seals and opens a host's credentials ─────────────────────────────────────
 
+/** What a rewrap made of a record: its new form, current (already under the newest version), or not this sealer's to
+ *  vouch for (another key's, or an answer whose version it could not read): only `current` says nothing is left. */
+export type Rewrapped = { status: 'rewrapped'; sealed: SealedCredential } | { status: 'current' } | { status: 'foreign'; reason: string };
+
 /** Seals and opens credentials. A host chooses one (`setSealer`); a key it holds (`keySealer`), or a vault that holds
  *  the key and wraps for it (`transitSealer`). */
 export interface Sealer {
@@ -185,6 +189,11 @@ export interface Sealer {
   seal(payload: CredentialPayload, placedAt: string, slot?: string, bound?: string): Promise<SealedCredential>;
   /** `bound`: the destination it is opened for; a record bound elsewhere refuses */
   open(sealed: SealedCredential, slot?: string, bound?: string): Promise<CredentialPayload>;
+  /** The record with its DEK wrapped under the newest version of its key, without the DEK leaving the sealer (a
+   *  vault's `transit/rewrap` after a rotation): `rewrapped` with its new form, `current` when it already is, `foreign`
+   *  when it is not this sealer's to vouch for. What an operator's sweep runs after rotating a key, before raising its
+   *  minimum decryption version. */
+  rewrap?(sealed: SealedCredential): Promise<Rewrapped>;
 }
 
 /** Wraps under a key the host holds (the user's key file, a deployment secret): `v: 1` records. */
@@ -262,7 +271,7 @@ export function transitSealer(options: TransitSealerOptions): Sealer {
     if (status >= 500) renewedAt = 0;
     if (status >= 300) console.warn(`[credential] the vault at ${addr} did not renew this host's token (${status})`);
   };
-  const call = async (op: 'encrypt' | 'decrypt' | 'hmac', body: Record<string, string | number>, key = options.key): Promise<Record<string, string>> => {
+  const call = async (op: 'encrypt' | 'decrypt' | 'hmac' | 'rewrap', body: Record<string, string | number>, key = options.key): Promise<Record<string, string>> => {
     const which = `${mount}/${key}`;
     let response: Response;
     try {
@@ -328,5 +337,16 @@ export function transitSealer(options: TransitSealerOptions): Sealer {
         throw new Error('credential unseal failed: wrong slot or corrupted record');
       }
     },
+    async rewrap(sealed) {
+      // only this sealer's own records: a key's (v1) or another transit key's are not its to rewrap
+      if (sealed.v !== 2) return { status: 'foreign', reason: 'sealed under a host key' };
+      if (sealed.transitKey !== named) return { status: 'foreign', reason: `sealed by ${sealed.transitKey}` };
+      const { ciphertext } = await call('rewrap', { ciphertext: sealed.wrappedDek });
+      const version = (wrapped: unknown): number | null => { const m = typeof wrapped === 'string' ? /^vault:v(\d+):/.exec(wrapped) : null; return m ? Number(m[1]) : null; };
+      const before = version(sealed.wrappedDek); const after = version(ciphertext);
+      if (before === null || after === null) return { status: 'foreign', reason: 'a wrapped key whose version could not be read' };
+      // the vault rewraps to a fresh ciphertext at the same version when the key has not moved: current, nothing written
+      return after > before ? { status: 'rewrapped', sealed: { ...sealed, wrappedDek: String(ciphertext) } } : { status: 'current' };
+    },
   };
 }

package/src/index.ts

@@ -296,7 +296,7 @@ export { PLACEHOLDER_REMOTE, beginPlaceholderPull, endPlaceholderPull, placehold
 
 export { ownFields, subjectHistory, rebaseBranch, cutCheckpoint, appendParentEntry, wholeLog, branchEntries, branchLogPath, branchMetaPath, CHECKPOINT_EVERY, dropCheckpoint, foldEntries, landedCopy, landedIds, parentEntries, parentLogPath, position, readBranchMeta, readTree, toEntry, toEvent, unpushedEntries, writeBranchMeta } from './log.ts';
 export type { BranchMeta, Entry, EntryOp, Receipt } from './log.ts';
-export { sealCredential, openSealedCredential, MemoryCredentialStorage, keySealer, transitSealer, type Sealer, type TransitSealerOptions, type SealedByVault, type SealedUnderKey } from './credential.ts';
+export { sealCredential, openSealedCredential, MemoryCredentialStorage, keySealer, transitSealer, type Rewrapped, type Sealer, type TransitSealerOptions, type SealedByVault, type SealedUnderKey } from './credential.ts';
 export type { CredentialPayload, CredentialStorage, SealedCredential } from './credential.ts';
 export { validateRemoteOrigin, buildRemoteExecute, type CredentialCustody } from './executor.ts';
 export type { TwinAuthStrategy } from './executor.ts';