sealkeep 0.8.1 → 0.11.0

package/dist/src/spool.d.ts

@@ -20,7 +20,7 @@
  * trying to save. Rename is atomic on one filesystem, so a concurrent reader
  * sees the old journal or the new one, never a mixture.
  */
-import { type ChunkHeader, type Suite, type Unlock, type WrappedKey } from "../packages/vaultline-crypto/src/index.js";
+import { type ChunkHeader, type Suite, type Unlock, type WrappedKey } from "../packages/sealkeep-crypto/src/index.js";
 export declare const SPOOL_VERSION = 1;
 export type SpoolJournal = {
     version: typeof SPOOL_VERSION;

package/dist/src/spool.js

@@ -23,7 +23,7 @@
 import { mkdir, open, readdir, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
 import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
-import { CryptoError, KEY_BYTES, unwrapArchiveKey, zeroize } from "../packages/vaultline-crypto/src/index.js";
+import { CryptoError, KEY_BYTES, unwrapArchiveKey, zeroize } from "../packages/sealkeep-crypto/src/index.js";
 import { fail } from "./errors.js";
 export const SPOOL_VERSION = 1;
 const spoolDir = (dataDir) => join(dataDir, "spool");

package/dist/src/start-tui.js

@@ -2,6 +2,7 @@ import { createInterface } from "node:readline/promises";
 import { emitKeypressEvents } from "node:readline";
 import { modeOptions } from "./start.js";
 import { bold, dim, blue, green } from "./ui.js";
+import { STORAGE_PREFIX_DEFAULT } from "./branding.js";
 /**
  * Interactive onboarding.
  *
@@ -105,7 +106,7 @@ export async function onboard() {
     return {
         mode: "free", provider,
         bucket: await ask("Bucket name"),
-        prefix: await ask("Prefix", "vaultline"),
+        prefix: await ask("Prefix", STORAGE_PREFIX_DEFAULT),
         project: provider === "gcs" ? await ask("Google Cloud project") : undefined,
         region: provider === "s3" ? await ask("Region", "us-east-1") : undefined,
         accountId: provider === "r2" ? await ask("Cloudflare account id") : undefined

package/dist/src/start.js

@@ -3,7 +3,7 @@ import { addRecipient, initialize } from "./vault.js";
 import { recoveryKit } from "./recovery.js";
 import { register, sealEscrow } from "./cloud.js";
 import { setupPlan } from "./storage-setup.js";
-import { fail, isVaultlineError } from "./errors.js";
+import { fail, isSealkeepError } from "./errors.js";
 /** An X25519 keypair for this machine. The private half never leaves it unsealed. */
 export function generateDeviceKeys() {
     const { publicKey, privateKey } = generateKeyPairSync("x25519");
@@ -65,7 +65,7 @@ export async function startPaid(dataDir, choice) {
         // every archive, so the vault is usable — but say so plainly rather than
         // printing a promise we did not keep.
         sealed = false;
-        escrowNote = `The sealed copy of your key could not be stored (${isVaultlineError(error) ? error.code : "unexpected error"}). Run \`sealkeep recovery seal\` once you are online.`;
+        escrowNote = `The sealed copy of your key could not be stored (${isSealkeepError(error) ? error.code : "unexpected error"}). Run \`sealkeep recovery seal\` once you are online.`;
     }
     return {
         mode: "paid", vaultId: config.vaultId, phrase, recoveryKit: recoveryKit(config), account, escrow,

package/dist/src/storage-endpoint.d.ts

@@ -0,0 +1,21 @@
+import type { StorageTargetConfig } from "./types.js";
+export type StorageAddress = {
+    address: string;
+    family: 4 | 6;
+};
+export type StorageAddressResolver = (hostname: string) => Promise<readonly StorageAddress[]>;
+export declare const systemStorageAddressResolver: StorageAddressResolver;
+/** A provider endpoint is an origin, never a URL carrying credentials or path state. */
+export declare function parseStorageEndpoint(value: string, label?: string): URL;
+export declare function isPublicStorageAddress(address: string): boolean;
+/**
+ * Resolves and validates one complete DNS answer set. Callers must use the
+ * returned addresses for the connection whose lookup triggered this check;
+ * resolving once here and again later would recreate a DNS-rebinding window.
+ */
+export declare function allowedStorageAddresses(hostname: string, options?: {
+    allowPrivate?: boolean;
+    resolver?: StorageAddressResolver;
+}): Promise<StorageAddress[]>;
+/** Early UX validation. The transport repeats this policy inside its actual socket lookup. */
+export declare function assertSafeStorageEndpoint(value: string, provider?: StorageTargetConfig["provider"], env?: NodeJS.ProcessEnv, resolver?: StorageAddressResolver): Promise<URL>;

package/dist/src/storage-endpoint.js

@@ -0,0 +1,122 @@
+import { lookup } from "node:dns/promises";
+import { isIP } from "node:net";
+import { fail } from "./errors.js";
+import { envFlag } from "./env.js";
+export const systemStorageAddressResolver = async (hostname) => (await lookup(hostname, { all: true, verbatim: true })).map((answer) => ({
+    address: answer.address,
+    family: answer.family,
+}));
+function normalizedHostname(hostname) {
+    return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function isLoopbackEndpointHost(hostname) {
+    const host = normalizedHostname(hostname);
+    return host === "localhost" || host.endsWith(".localhost")
+        || host === "::1" || host.startsWith("127.");
+}
+/** A provider endpoint is an origin, never a URL carrying credentials or path state. */
+export function parseStorageEndpoint(value, label = "Storage endpoint") {
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        return fail("invalid_argument", `${label} is not a valid URL.`);
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        fail("invalid_argument", `${label} must use https (or http for a loopback test service).`);
+    }
+    if (parsed.username || parsed.password) {
+        fail("invalid_argument", `${label} must not contain credentials.`);
+    }
+    if (parsed.pathname !== "/" || parsed.search || parsed.hash || value.includes("?") || value.includes("#")) {
+        fail("invalid_argument", `${label} must be only an origin, without a path, query, or fragment.`);
+    }
+    if (parsed.protocol === "http:" && !isLoopbackEndpointHost(parsed.hostname)) {
+        fail("invalid_argument", `${label} must use https unless it is a loopback test service.`);
+    }
+    return parsed;
+}
+function publicIpv4(address) {
+    const parts = address.split(".").map(Number);
+    if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255))
+        return false;
+    const [a, b, c] = parts;
+    if (a === 0 || a === 10 || a === 127 || a >= 224)
+        return false;
+    if (a === 100 && b >= 64 && b <= 127)
+        return false;
+    if (a === 169 && b === 254)
+        return false;
+    if (a === 172 && b >= 16 && b <= 31)
+        return false;
+    if (a === 192 && b === 0)
+        return false;
+    if (a === 192 && b === 168)
+        return false;
+    if (a === 198 && (b === 18 || b === 19))
+        return false;
+    if ((a === 192 && b === 0 && c === 2) || (a === 198 && b === 51 && c === 100) || (a === 203 && b === 0 && c === 113))
+        return false;
+    return true;
+}
+function publicIpv6(address) {
+    const lower = address.toLowerCase();
+    const mapped = /(?:^|:)ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(lower)?.[1];
+    if (mapped)
+        return publicIpv4(mapped);
+    // Restrict to global unicast, excluding documentation and transition ranges
+    // that could tunnel a request to an otherwise-blocked IPv4 destination.
+    const first = Number.parseInt(lower.split(":", 1)[0] || "0", 16);
+    if (!Number.isFinite(first) || first < 0x2000 || first > 0x3fff)
+        return false;
+    if (lower.startsWith("2001:db8:") || lower === "2001:db8::")
+        return false;
+    if (lower.startsWith("2001:0000:") || lower.startsWith("2001:0:"))
+        return false;
+    if (lower.startsWith("2002:"))
+        return false;
+    return true;
+}
+export function isPublicStorageAddress(address) {
+    const family = isIP(address);
+    return family === 4 ? publicIpv4(address) : family === 6 ? publicIpv6(address) : false;
+}
+/**
+ * Resolves and validates one complete DNS answer set. Callers must use the
+ * returned addresses for the connection whose lookup triggered this check;
+ * resolving once here and again later would recreate a DNS-rebinding window.
+ */
+export async function allowedStorageAddresses(hostname, options = {}) {
+    const host = normalizedHostname(hostname);
+    const literalFamily = isIP(host);
+    let answers;
+    try {
+        answers = literalFamily
+            ? [{ address: host, family: literalFamily }]
+            : await (options.resolver ?? systemStorageAddressResolver)(host);
+    }
+    catch {
+        return fail("invalid_argument", `Storage endpoint ${host} could not be resolved safely.`);
+    }
+    const unique = [...new Map(answers.map((answer) => [`${answer.family}:${answer.address.toLowerCase()}`, answer])).values()];
+    if (unique.length === 0 || unique.some((answer) => isIP(answer.address) !== answer.family)) {
+        fail("invalid_argument", `Storage endpoint ${host} did not resolve to a usable IP address.`);
+    }
+    if (!options.allowPrivate && unique.some((answer) => !isPublicStorageAddress(answer.address))) {
+        fail("invalid_argument", `Storage endpoint ${host} resolves to a private, local, or reserved address. Set SEALKEEP_ALLOW_PRIVATE_STORAGE_ENDPOINT=1 only for a trusted local emulator.`);
+    }
+    return unique;
+}
+/** Early UX validation. The transport repeats this policy inside its actual socket lookup. */
+export async function assertSafeStorageEndpoint(value, provider, env = process.env, resolver = systemStorageAddressResolver) {
+    const parsed = parseStorageEndpoint(value);
+    const allowPrivate = envFlag("ALLOW_PRIVATE_STORAGE_ENDPOINT", env);
+    const hostname = normalizedHostname(parsed.hostname);
+    if (provider === "r2" && !hostname.endsWith(".r2.cloudflarestorage.com") && !allowPrivate) {
+        fail("invalid_argument", "R2 endpoints must be an account origin ending in .r2.cloudflarestorage.com.");
+    }
+    if (!allowPrivate)
+        await allowedStorageAddresses(hostname, { resolver });
+    return parsed;
+}

package/dist/src/storage-setup.js

@@ -47,17 +47,17 @@ function s3Plan(input) {
                 title: "Create a least-privilege policy",
                 why: `This grants write and read under ${prefix}/ and nothing else — not the rest of the bucket, not other buckets.`,
                 link: "https://console.aws.amazon.com/iam/home#/policies$new?step=edit",
-                document: { name: "vaultline-policy.json", body: s3Policy(bucket, prefix) },
-                commands: [`aws iam create-policy --policy-name ${policyName} \\\n  --policy-document file://vaultline-policy.json`]
+                document: { name: "sealkeep-policy.json", body: s3Policy(bucket, prefix) },
+                commands: [`aws iam create-policy --policy-name ${policyName} \\\n  --policy-document file://sealkeep-policy.json`]
             },
             {
                 title: "Create a user and an access key",
                 why: "Sealkeep signs its own requests, so it needs a key rather than a role it cannot assume.",
                 link: "https://console.aws.amazon.com/iam/home#/users/create",
                 commands: [
-                    `aws iam create-user --user-name vaultline`,
-                    `aws iam attach-user-policy --user-name vaultline \\\n  --policy-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):policy/${policyName}`,
-                    `aws iam create-access-key --user-name vaultline`
+                    `aws iam create-user --user-name sealkeep`,
+                    `aws iam attach-user-policy --user-name sealkeep \\\n  --policy-arn arn:aws:iam::$(aws sts get-caller-identity --query Account --output text):policy/${policyName}`,
+                    `aws iam create-access-key --user-name sealkeep`
                 ]
             }
         ],
@@ -113,7 +113,7 @@ function gcsPlan(input) {
     const prefix = clean(input.prefix);
     const project = requireValue(input.project, "--project", "every Google Cloud resource belongs to a project");
     const location = input.region ?? "US";
-    const account = `vaultline@${project}.iam.gserviceaccount.com`;
+    const account = `sealkeep@${project}.iam.gserviceaccount.com`;
     return {
         provider: "gcs", bucket, prefix,
         steps: [
@@ -133,24 +133,24 @@ function gcsPlan(input) {
                 title: "Grant access to the prefix only",
                 why: `The IAM condition limits this account to objects under ${prefix}/, so it cannot read the rest of the bucket.`,
                 document: {
-                    name: "vaultline-binding.txt",
-                    body: `role: roles/storage.objectAdmin\nmember: serviceAccount:${account}\ncondition:\n  title: vaultline-prefix-only\n  expression: |\n    resource.name.startsWith("projects/_/buckets/${bucket}/objects/${prefix}/")`
+                    name: "sealkeep-binding.txt",
+                    body: `role: roles/storage.objectAdmin\nmember: serviceAccount:${account}\ncondition:\n  title: sealkeep-prefix-only\n  expression: |\n    resource.name.startsWith("projects/_/buckets/${bucket}/objects/${prefix}/")`
                 },
                 commands: [
-                    `gcloud storage buckets add-iam-policy-binding gs://${bucket} \\\n  --member="serviceAccount:${account}" \\\n  --role="roles/storage.objectAdmin" \\\n  --condition='expression=resource.name.startsWith("projects/_/buckets/${bucket}/objects/${prefix}/"),title=vaultline-prefix-only'`
+                    `gcloud storage buckets add-iam-policy-binding gs://${bucket} \\\n  --member="serviceAccount:${account}" \\\n  --role="roles/storage.objectAdmin" \\\n  --condition='expression=resource.name.startsWith("projects/_/buckets/${bucket}/objects/${prefix}/"),title=sealkeep-prefix-only'`
                 ]
             },
             {
                 title: "Create a key for the service account",
                 why: "Sealkeep needs the private key to sign upload URLs. It is stored in your OS keychain.",
                 link: `https://console.cloud.google.com/iam-admin/serviceaccounts?project=${project}`,
-                commands: [`gcloud iam service-accounts keys create vaultline-key.json \\\n  --iam-account=${account} --project=${project}`]
+                commands: [`gcloud iam service-accounts keys create sealkeep-key.json \\\n  --iam-account=${account} --project=${project}`]
             }
         ],
         finish: [
             `sealkeep storage configure --provider gcs --bucket ${bucket} --prefix ${prefix}`,
-            `node -e 'const k=require("./vaultline-key.json");process.stdout.write(JSON.stringify({clientEmail:k.client_email,privateKey:k.private_key}))' \\\n  | sealkeep storage credentials set`,
-            `rm vaultline-key.json   # the key now lives in your keychain`,
+            `node -e 'const k=require("./sealkeep-key.json");process.stdout.write(JSON.stringify({clientEmail:k.client_email,privateKey:k.private_key}))' \\\n  | sealkeep storage credentials set`,
+            `rm sealkeep-key.json   # the key now lives in your keychain`,
             `SEALKEEP_ENABLE_SIGNER=1 sealkeep upload --all`
         ],
         notes: [

package/dist/src/storage-targets.d.ts

@@ -9,21 +9,116 @@
  * bucket, so restore, search, and delete follow the record wherever it went.
  * Routing decides only where NEW seals go.
  */
-import type { StorageTargetConfig } from "./types.js";
+import type { RemoteObject, StorageDestinationIdentity, StorageTargetConfig } from "./types.js";
+import { type BackendName, type ProviderCredentialBinding, type ProviderCredentials } from "./secrets.js";
+import type { EndpointOverrides } from "./providers/index.js";
+export { assertSafeStorageEndpoint, parseStorageEndpoint } from "./storage-endpoint.js";
 export type StorageTarget = StorageTargetConfig;
+/** Exact account row which an editor actually rendered. `targetsJson` is kept
+ * byte-for-byte because the control plane compares it atomically; `updatedAt`
+ * is the row revision and also closes the otherwise possible A→B→A ABA gap.
+ * `accountScope` binds a browser/CLI draft to the login under which it loaded. */
+export type StorageTargetAccountBaseline = {
+    targetsJson: string | null;
+    updatedAt: string | null;
+    accountScope: string | null;
+};
+export type StorageTargetEditSnapshot = {
+    targets: StorageTarget[];
+    /** Null means the account row could not be read. It never means “absent”. */
+    accountBaseline: StorageTargetAccountBaseline | null;
+};
+export type TargetUsagePushOptions = {
+    /** Cancels both account reads and the final account write. */
+    signal?: AbortSignal;
+};
+type TargetCloudPushOptions = TargetUsagePushOptions & {
+    renewCloudToken?: boolean;
+    claimMachineIdentity?: boolean;
+    /** Report evidence against the account's routing row without authoring it. */
+    advisoryUsageOnly?: boolean;
+    expectedAuthGeneration?: string | null;
+    /** Exact local routing state which authorised this account write. */
+    expectedRoutingFingerprint?: string;
+    /** Exact account row the person or telemetry operation edited. */
+    accountBaseline?: StorageTargetAccountBaseline;
+};
+export declare function storageTargetAccountBaselineIsCurrent(dataDir: string, baseline: StorageTargetAccountBaseline): Promise<boolean>;
+/** Stable, serialisable identity used by both credential and copy bindings. */
+export declare function storageDestinationIdentity(target: StorageTarget, effectiveEndpoint?: string | undefined, gdriveAccountId?: string | null): StorageDestinationIdentity;
+/** Hash of a fixed-order tuple, never of user-controlled object key syntax. */
+export declare function storageDestinationFingerprint(destination: StorageDestinationIdentity): string;
+export declare function destinationIdentityForTarget(dataDir: string, target: StorageTarget, credentials?: ProviderCredentials): Promise<StorageDestinationIdentity>;
+export declare function destinationBindingForTarget(dataDir: string, target: StorageTarget, verifiedAt?: string | null, credentials?: ProviderCredentials): Promise<ProviderCredentialBinding>;
+export declare function storeProviderCredentialsForTarget(dataDir: string, target: StorageTarget, credentials: ProviderCredentials, preferred?: BackendName, verifiedAt?: string | null): Promise<{
+    backend: BackendName;
+}>;
+/** Provider host information is routing configuration, not a credential, so it
+ * travels with the account target and every machine signs against the same
+ * intended service. This also prevents a stale setup-wide endpoint from being
+ * accidentally reused for a different bucket target. */
+export declare function endpointOverridesForTarget(target: StorageTarget): EndpointOverrides;
+/**
+ * The setup wizard predates account-wide targets and kept its endpoint in
+ * setup.json. That value belongs to the one legacy `remoteStorage` target only:
+ * letting it bleed into a named target can sign an R2/S3 request for the right
+ * bucket against the wrong provider host. New targets carry their endpoint in
+ * routing metadata; only the synthesized `primary` target may use this fallback.
+ */
+export declare function endpointForTarget(dataDir: string, target: StorageTarget): Promise<string | undefined>;
+/** Effective provider overrides, including the narrowly-scoped legacy fallback. */
+export declare function endpointOverridesForResolvedTarget(dataDir: string, target: StorageTarget): Promise<EndpointOverrides>;
+/**
+ * Provider credentials belong to a machine, while routing rules belong to the
+ * account. New installs address a credential by target id so two BYO targets
+ * cannot overwrite one another; the vault id remains a read fallback only for
+ * the synthesized primary target created by older releases.
+ */
+export declare function credentialConfigIdForTarget(dataDir: string, target: StorageTarget): Promise<string | null>;
+/**
+ * Exact-copy routing guard. New records must match the immutable fingerprint.
+ * Legacy records are accepted only for globally addressed providers without a
+ * custom endpoint; R2/custom S3/Drive account identity is ambiguous and fails
+ * closed until a verified migration can stamp the copy.
+ */
+export declare function remoteCopyMatchesTarget(dataDir: string, target: StorageTarget, copy: Pick<RemoteObject, "provider" | "bucket" | "destination" | "destinationFingerprint">): Promise<boolean>;
+/** Whether this particular machine can use an account-wide destination now. */
+export declare function targetConnectedOnThisMachine(dataDir: string, target: StorageTarget, options?: {
+    renewCloudToken?: boolean;
+    signal?: AbortSignal;
+}): Promise<boolean>;
+export declare function targetConnectionEvidence(dataDir: string, target: StorageTarget, options?: {
+    renewCloudToken?: boolean;
+    signal?: AbortSignal;
+}): Promise<{
+    connected: boolean;
+    status: "credentials_verified" | "credentials_saved" | "credentials_missing" | "account_session";
+    verifiedAt: string | null;
+}>;
 /**
  * The effective target list. Explicit `storageTargets` in config wins;
  * otherwise the single `remoteStorage` entry is the one target; otherwise a
  * vault signed into the cloud account is managed-only — the same ladder the
  * rest of the product climbs.
  */
-export declare function resolveTargets(dataDir: string): Promise<StorageTarget[]>;
+type ResolveTargetsOptions = {
+    signal?: AbortSignal;
+    renewCloudToken?: boolean;
+    pullFromCloud?: boolean;
+};
+export declare function resolveTargets(dataDir: string, options?: ResolveTargetsOptions): Promise<StorageTarget[]>;
+/** One coherent edit view: the effective rows and the exact account revision
+ * they came from. Callers must carry `accountBaseline` unchanged into
+ * `setStorageTargets`; a fresh read at save time would authorise a stale UI. */
+export declare function storageTargetsForEditing(dataDir: string, options?: ResolveTargetsOptions): Promise<StorageTargetEditSnapshot>;
 /** Pushes the rules to the account so every other machine syncs them. Advisory: offline edits still apply locally. */
 /** Re-pushes the current rules with fresh usage stamps — machines are the only
  * ones who can see Drive and BYO bytes, so the account learns them from here. */
-export declare function pushTargetUsage(dataDir: string): Promise<void>;
-export declare function pushTargetsToCloud(dataDir: string, targets: StorageTarget[]): Promise<boolean>;
-/** Bytes each target currently holds, from the records: targetId when stamped, provider+bucket for older records. */
+export declare function pushTargetUsage(dataDir: string, options?: TargetUsagePushOptions): Promise<void>;
+export declare function pushTargetsToCloud(dataDir: string, targets: StorageTarget[], options?: TargetCloudPushOptions): Promise<boolean>;
+/** Bytes each target currently holds. A mutable display id is never enough to
+ * attribute a copy: the record must still name the target's immutable physical
+ * destination (or pass the deliberately narrow legacy compatibility rule). */
 export declare function targetUsage(dataDir: string, targets: StorageTarget[]): Promise<Map<string, number>>;
 /**
  * Where a new seal goes. Eligibility first (limit not blown, chunk-capable
@@ -33,11 +128,19 @@ export declare function targetUsage(dataDir: string, targets: StorageTarget[]):
  */
 export declare function chooseTarget(dataDir: string, input: {
     project?: string | null;
+    projectKey?: string | null;
     bytes: number;
     requireChunkCapable?: boolean;
+    requireManaged?: boolean;
     targetId?: string;
 }): Promise<StorageTarget>;
 /** Persist an explicit target list. Empty array removes the setting (back to single remoteStorage / managed). */
 export declare function setStorageTargets(dataDir: string, targets: StorageTarget[], options?: {
     push?: boolean;
-}): Promise<void>;
+    accountBaseline?: StorageTargetAccountBaseline | null;
+}): Promise<{
+    localSaved: boolean;
+    accountSynced: boolean | null;
+    accountConflict?: boolean;
+    accountStale?: boolean;
+}>;