@coffre/core 0.1.11 → 0.1.12

package/dist/access.d.ts

@@ -85,16 +85,6 @@ export type Holdings = {
  * `market/prod` does not let anyone rename `market`.
  */
 export declare function allows(holder: Holdings, permission: Permission, place: Place): boolean;
-/** A sync reads as a principal of its own, `sync:<id>`. */
-export declare function isSyncPrincipal(principal: string): boolean;
-/**
- * Whether `actor` may set `subject`'s role at `place`, or take it away
- * (`role` null). `grant.manage` on the project decides, with one addition:
- * whoever may manage a project's environments may let a sync read an
- * environment they can read themselves, and take that away again, since
- * adding and removing syncs is theirs to do.
- */
-export declare function mayManageAccess(actor: Holdings, subject: string, change: Place & {
-  role: Role | null;
-}): boolean;
+/** Whether the actor may manage grants on this project. */
+export declare function mayManageAccess(actor: Holdings, place: Place): boolean;
 //#endregion

package/dist/access.js

@@ -88,22 +88,9 @@ function allows(holder, permission, place) {
 	if (environmentId === null && holder.isOwner && PROJECT_ONLY_PERMISSIONS.includes(permission)) return true;
 	return holder.grants.some((grant) => grant.projectId === place.projectId && (grant.environmentId === null || grant.environmentId === environmentId) && roleGrants(grant.role, permission));
 }
-/** A sync reads as a principal of its own, `sync:<id>`. */
-function isSyncPrincipal(principal) {
-	return principal.startsWith("sync:");
-}
-/**
-* Whether `actor` may set `subject`'s role at `place`, or take it away
-* (`role` null). `grant.manage` on the project decides, with one addition:
-* whoever may manage a project's environments may let a sync read an
-* environment they can read themselves, and take that away again, since
-* adding and removing syncs is theirs to do.
-*/
-function mayManageAccess(actor, subject, change) {
-	if (allows(actor, "grant.manage", { projectId: change.projectId })) return true;
-	if (!isSyncPrincipal(subject) || !allows(actor, "environment.manage", { projectId: change.projectId })) return false;
-	if (change.role === null) return true;
-	return change.role === "viewer" && (change.environmentId ?? null) !== null && allows(actor, "secret.read", change);
+/** Whether the actor may manage grants on this project. */
+function mayManageAccess(actor, place) {
+	return allows(actor, "grant.manage", { projectId: place.projectId });
 }
 //#endregion
-export { PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, allows, assignableToEnvironment, isRole, isSyncPrincipal, mayManageAccess, roleGrants };
+export { PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, allows, assignableToEnvironment, isRole, mayManageAccess, roleGrants };

package/dist/schemas.d.ts

@@ -9,10 +9,9 @@ export declare const principalType: z.ZodEnum<{
 }>;
 export declare const principalId: z.ZodString;
 export declare const instanceRole: z.ZodEnum<{
-  user: "user";
   owner: "owner";
+  user: "user";
 }>;
 export declare const grantId: z.ZodString;
 export declare const emailAddress: z.ZodString;
-export declare const syncId: z.ZodString;
 //#endregion

package/dist/schemas.js

@@ -8,6 +8,5 @@ const principalId = z.string().trim().min(1).max(320);
 const instanceRole = z.enum(["user", "owner"]);
 const grantId = z.string().uuid();
 const emailAddress = z.string().email().max(320);
-const syncId = z.string().uuid();
 //#endregion
-export { displayName, emailAddress, grantId, instanceRole, principalId, principalType, secretKey, slug, syncId };
+export { displayName, emailAddress, grantId, instanceRole, principalId, principalType, secretKey, slug };

package/dist/vault.d.ts

@@ -256,7 +256,7 @@ export type KeyChecks = {
   })[];
 };
 /** Why someone reads: shown in the log, and the same rules apply to each. */
-export type Purpose = 'reveal' | 'run' | 'compare' | 'sync';
+export type Purpose = 'reveal' | 'run' | 'compare';
 /** Ties the vault's entries to the app's request and audit rows. */
 type Correlation = {
   requestId?: string | null;
@@ -340,15 +340,6 @@ export type AdmitInput = Correlation & {
 export type RemoveInput = Correlation & {
   actor: string;
   principal: string;
-  /**
-   * For a sync: the environment it pushes from. Whoever may manage it there
-   * may stop the sync, also once its grant there is revoked and only the
-   * one on its credential is left.
-   */
-  source?: {
-    projectId: string;
-    environmentId: string;
-  };
 };
 /**
  * A prefix of the log the vault signed: every entry up to `seq`, the last

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -69,7 +69,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.1.11"
+    "@coffre/conformance": "0.1.12"
   },
   "scripts": {
     "build": "tsdown",

package/src/access.ts

@@ -126,27 +126,7 @@ export function allows(holder: Holdings, permission: Permission, place: Place):
   );
 }
 
-/** A sync reads as a principal of its own, `sync:<id>`. */
-export function isSyncPrincipal(principal: string): boolean {
-  return principal.startsWith('sync:');
-}
-
-/**
- * Whether `actor` may set `subject`'s role at `place`, or take it away
- * (`role` null). `grant.manage` on the project decides, with one addition:
- * whoever may manage a project's environments may let a sync read an
- * environment they can read themselves, and take that away again, since
- * adding and removing syncs is theirs to do.
- */
-export function mayManageAccess(
-  actor: Holdings,
-  subject: string,
-  change: Place & { role: Role | null },
-): boolean {
-  if (allows(actor, 'grant.manage', { projectId: change.projectId })) return true;
-  if (!isSyncPrincipal(subject) || !allows(actor, 'environment.manage', { projectId: change.projectId })) {
-    return false;
-  }
-  if (change.role === null) return true;
-  return change.role === 'viewer' && (change.environmentId ?? null) !== null && allows(actor, 'secret.read', change);
+/** Whether the actor may manage grants on this project. */
+export function mayManageAccess(actor: Holdings, place: Place): boolean {
+  return allows(actor, 'grant.manage', { projectId: place.projectId });
 }

package/src/schemas.ts

@@ -8,4 +8,3 @@ export const principalId = z.string().trim().min(1).max(320);
 export const instanceRole = z.enum(['user', 'owner']);
 export const grantId = z.string().uuid();
 export const emailAddress = z.string().email().max(320);
-export const syncId = z.string().uuid();

package/src/vault.ts

@@ -158,7 +158,7 @@ export type WrappedKey = { kekProvider: string; kekId: string; kekVersion: strin
 export type KeyChecks = { current: { kekProvider: string; kekId: string }; checks: (WrappedKey & { seq: number })[] };
 
 /** Why someone reads: shown in the log, and the same rules apply to each. */
-export type Purpose = 'reveal' | 'run' | 'compare' | 'sync';
+export type Purpose = 'reveal' | 'run' | 'compare';
 
 /** Ties the vault's entries to the app's request and audit rows. */
 type Correlation = {
@@ -245,12 +245,7 @@ export type AdmitInput = Correlation & {
 export type RemoveInput = Correlation & {
   actor: string;
   principal: string;
-  /**
-   * For a sync: the environment it pushes from. Whoever may manage it there
-   * may stop the sync, also once its grant there is revoked and only the
-   * one on its credential is left.
-   */
-  source?: { projectId: string; environmentId: string };
+
 };
 
 /**