@coffre/core 0.1.11 → 0.1.13

package/dist/access.d.ts

@@ -85,16 +85,6 @@ export type Holdings = {
  * `market/prod` does not let anyone rename `market`.
  */
 export declare function allows(holder: Holdings, permission: Permission, place: Place): boolean;
-/** A sync reads as a principal of its own, `sync:<id>`. */
-export declare function isSyncPrincipal(principal: string): boolean;
-/**
- * Whether `actor` may set `subject`'s role at `place`, or take it away
- * (`role` null). `grant.manage` on the project decides, with one addition:
- * whoever may manage a project's environments may let a sync read an
- * environment they can read themselves, and take that away again, since
- * adding and removing syncs is theirs to do.
- */
-export declare function mayManageAccess(actor: Holdings, subject: string, change: Place & {
-  role: Role | null;
-}): boolean;
+/** Whether the actor may manage grants on this project. */
+export declare function mayManageAccess(actor: Holdings, place: Place): boolean;
 //#endregion

package/dist/access.js

@@ -88,22 +88,9 @@ function allows(holder, permission, place) {
 	if (environmentId === null && holder.isOwner && PROJECT_ONLY_PERMISSIONS.includes(permission)) return true;
 	return holder.grants.some((grant) => grant.projectId === place.projectId && (grant.environmentId === null || grant.environmentId === environmentId) && roleGrants(grant.role, permission));
 }
-/** A sync reads as a principal of its own, `sync:<id>`. */
-function isSyncPrincipal(principal) {
-	return principal.startsWith("sync:");
-}
-/**
-* Whether `actor` may set `subject`'s role at `place`, or take it away
-* (`role` null). `grant.manage` on the project decides, with one addition:
-* whoever may manage a project's environments may let a sync read an
-* environment they can read themselves, and take that away again, since
-* adding and removing syncs is theirs to do.
-*/
-function mayManageAccess(actor, subject, change) {
-	if (allows(actor, "grant.manage", { projectId: change.projectId })) return true;
-	if (!isSyncPrincipal(subject) || !allows(actor, "environment.manage", { projectId: change.projectId })) return false;
-	if (change.role === null) return true;
-	return change.role === "viewer" && (change.environmentId ?? null) !== null && allows(actor, "secret.read", change);
+/** Whether the actor may manage grants on this project. */
+function mayManageAccess(actor, place) {
+	return allows(actor, "grant.manage", { projectId: place.projectId });
 }
 //#endregion
-export { PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, allows, assignableToEnvironment, isRole, isSyncPrincipal, mayManageAccess, roleGrants };
+export { PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, allows, assignableToEnvironment, isRole, mayManageAccess, roleGrants };

package/dist/schemas.d.ts

@@ -9,10 +9,9 @@ export declare const principalType: z.ZodEnum<{
 }>;
 export declare const principalId: z.ZodString;
 export declare const instanceRole: z.ZodEnum<{
-  user: "user";
   owner: "owner";
+  user: "user";
 }>;
 export declare const grantId: z.ZodString;
 export declare const emailAddress: z.ZodString;
-export declare const syncId: z.ZodString;
 //#endregion

package/dist/schemas.js

@@ -8,6 +8,5 @@ const principalId = z.string().trim().min(1).max(320);
 const instanceRole = z.enum(["user", "owner"]);
 const grantId = z.string().uuid();
 const emailAddress = z.string().email().max(320);
-const syncId = z.string().uuid();
 //#endregion
-export { displayName, emailAddress, grantId, instanceRole, principalId, principalType, secretKey, slug, syncId };
+export { displayName, emailAddress, grantId, instanceRole, principalId, principalType, secretKey, slug };

package/dist/vault.d.ts

@@ -67,6 +67,12 @@ export declare function describeAccessFault(fault: AccessFault, names?: FaultNam
 export declare function checkpointMessage(checkpoint: Omit<Checkpoint, 'signature' | 'keyId'>): Uint8Array<ArrayBuffer>;
 /** Whether `checkpoint` was signed by the key whose raw public half is `publicKey`. */
 export declare function verifyCheckpoint(checkpoint: Checkpoint, publicKey: string): Promise<boolean>;
+/**
+ * `verifyCheckpoint` for many checkpoints signed by one key, the key
+ * imported once: a full verification checks every checkpoint, one every
+ * five minutes.
+ */
+export declare function checkpointVerifier(publicKey: string): Promise<(checkpoint: Checkpoint) => Promise<boolean>>;
 //#endregion
 //#region src/vault.d.ts
 /**
@@ -162,11 +168,13 @@ export interface Vault {
    */
   keyChecks(): Promise<KeyChecks>;
   /**
-   * Check the whole log: rehash it from the first entry, the vault's
-   * entries by their MACs, every checkpoint against the prefix it signed,
+   * Check the whole log: the vault's entries by their MACs, every
+   * checkpoint against the prefix it signed, the key batches accounted for,
    * and replay it to see that who is a member, and what they hold, follow
-   * from it. A verdict and nothing else, so anyone may ask; the app asks
-   * for owners.
+   * from it. The links and hashes of the chain are the caller's to
+   * recompute through `upTo`, as the app does first; with none, the vault
+   * recomputes them all itself. A verdict and nothing else, so anyone may
+   * ask; the app asks for owners.
    */
   verifyLog(input: VerifyLogInput): Promise<LogVerification>;
 }
@@ -256,7 +264,7 @@ export type KeyChecks = {
   })[];
 };
 /** Why someone reads: shown in the log, and the same rules apply to each. */
-export type Purpose = 'reveal' | 'run' | 'compare' | 'sync';
+export type Purpose = 'reveal' | 'run' | 'compare';
 /** Ties the vault's entries to the app's request and audit rows. */
 type Correlation = {
   requestId?: string | null;
@@ -340,15 +348,6 @@ export type AdmitInput = Correlation & {
 export type RemoveInput = Correlation & {
   actor: string;
   principal: string;
-  /**
-   * For a sync: the environment it pushes from. Whoever may manage it there
-   * may stop the sync, also once its grant there is revoked and only the
-   * one on its credential is left.
-   */
-  source?: {
-    projectId: string;
-    environmentId: string;
-  };
 };
 /**
  * A prefix of the log the vault signed: every entry up to `seq`, the last
@@ -381,9 +380,11 @@ export type LogHead = {
 };
 export type VerifyLogInput = {
   /**
-   * The last entry the app verified, its own entries by its key: the vault
-   * checks the log still holds it, so between them both authors' entries
-   * are authenticated over the same prefix.
+   * The last entry the app verified, every link and hash up to it
+   * recomputed and its own entries checked by its key: the vault checks the
+   * log still holds it, so between them both authors' entries are
+   * authenticated over the same prefix, and the vault leaves the links to
+   * the app.
    */
   upTo?: LogHead | null;
 };

package/dist/vault.js

@@ -6,8 +6,16 @@ function checkpointMessage(checkpoint) {
 }
 /** Whether `checkpoint` was signed by the key whose raw public half is `publicKey`. */
 async function verifyCheckpoint(checkpoint, publicKey) {
+	return (await checkpointVerifier(publicKey))(checkpoint);
+}
+/**
+* `verifyCheckpoint` for many checkpoints signed by one key, the key
+* imported once: a full verification checks every checkpoint, one every
+* five minutes.
+*/
+async function checkpointVerifier(publicKey) {
 	const key = await crypto.subtle.importKey("raw", new Uint8Array(Buffer.from(publicKey, "base64")), { name: "Ed25519" }, false, ["verify"]);
-	return crypto.subtle.verify("Ed25519", key, new Uint8Array(Buffer.from(checkpoint.signature, "base64")), checkpointMessage(checkpoint));
+	return (checkpoint) => crypto.subtle.verify("Ed25519", key, new Uint8Array(Buffer.from(checkpoint.signature, "base64")), checkpointMessage(checkpoint));
 }
 //#endregion
 //#region src/access-fault.ts
@@ -42,4 +50,4 @@ const ACCESS_ACTIONS = [
 	"access.revoke"
 ];
 //#endregion
-export { ACCESS_ACTIONS, checkpointMessage, describeAccessFault, verifyCheckpoint };
+export { ACCESS_ACTIONS, checkpointMessage, checkpointVerifier, describeAccessFault, verifyCheckpoint };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -69,7 +69,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.1.11"
+    "@coffre/conformance": "0.1.13"
   },
   "scripts": {
     "build": "tsdown",

package/src/access.ts

@@ -126,27 +126,7 @@ export function allows(holder: Holdings, permission: Permission, place: Place):
   );
 }
 
-/** A sync reads as a principal of its own, `sync:<id>`. */
-export function isSyncPrincipal(principal: string): boolean {
-  return principal.startsWith('sync:');
-}
-
-/**
- * Whether `actor` may set `subject`'s role at `place`, or take it away
- * (`role` null). `grant.manage` on the project decides, with one addition:
- * whoever may manage a project's environments may let a sync read an
- * environment they can read themselves, and take that away again, since
- * adding and removing syncs is theirs to do.
- */
-export function mayManageAccess(
-  actor: Holdings,
-  subject: string,
-  change: Place & { role: Role | null },
-): boolean {
-  if (allows(actor, 'grant.manage', { projectId: change.projectId })) return true;
-  if (!isSyncPrincipal(subject) || !allows(actor, 'environment.manage', { projectId: change.projectId })) {
-    return false;
-  }
-  if (change.role === null) return true;
-  return change.role === 'viewer' && (change.environmentId ?? null) !== null && allows(actor, 'secret.read', change);
+/** Whether the actor may manage grants on this project. */
+export function mayManageAccess(actor: Holdings, place: Place): boolean {
+  return allows(actor, 'grant.manage', { projectId: place.projectId });
 }

package/src/checkpoint.ts

@@ -8,6 +8,15 @@ export function checkpointMessage(checkpoint: Omit<Checkpoint, 'signature' | 'ke
 
 /** Whether `checkpoint` was signed by the key whose raw public half is `publicKey`. */
 export async function verifyCheckpoint(checkpoint: Checkpoint, publicKey: string): Promise<boolean> {
+  return (await checkpointVerifier(publicKey))(checkpoint);
+}
+
+/**
+ * `verifyCheckpoint` for many checkpoints signed by one key, the key
+ * imported once: a full verification checks every checkpoint, one every
+ * five minutes.
+ */
+export async function checkpointVerifier(publicKey: string): Promise<(checkpoint: Checkpoint) => Promise<boolean>> {
   const key = await crypto.subtle.importKey('raw', new Uint8Array(Buffer.from(publicKey, 'base64')), { name: 'Ed25519' }, false, ['verify']);
-  return crypto.subtle.verify('Ed25519', key, new Uint8Array(Buffer.from(checkpoint.signature, 'base64')), checkpointMessage(checkpoint));
+  return (checkpoint) => crypto.subtle.verify('Ed25519', key, new Uint8Array(Buffer.from(checkpoint.signature, 'base64')), checkpointMessage(checkpoint));
 }

package/src/schemas.ts

@@ -8,4 +8,3 @@ export const principalId = z.string().trim().min(1).max(320);
 export const instanceRole = z.enum(['user', 'owner']);
 export const grantId = z.string().uuid();
 export const emailAddress = z.string().email().max(320);
-export const syncId = z.string().uuid();

package/src/vault.ts

@@ -1,7 +1,7 @@
 import type { AccessFault } from './access-fault.ts';
 import type { Role } from './access.ts';
 
-export { checkpointMessage, verifyCheckpoint } from './checkpoint.ts';
+export { checkpointMessage, checkpointVerifier, verifyCheckpoint } from './checkpoint.ts';
 export { describeAccessFault, type AccessFault, type FaultGrant, type FaultNames } from './access-fault.ts';
 
 /**
@@ -77,11 +77,13 @@ export interface Vault {
    */
   keyChecks(): Promise<KeyChecks>;
   /**
-   * Check the whole log: rehash it from the first entry, the vault's
-   * entries by their MACs, every checkpoint against the prefix it signed,
+   * Check the whole log: the vault's entries by their MACs, every
+   * checkpoint against the prefix it signed, the key batches accounted for,
    * and replay it to see that who is a member, and what they hold, follow
-   * from it. A verdict and nothing else, so anyone may ask; the app asks
-   * for owners.
+   * from it. The links and hashes of the chain are the caller's to
+   * recompute through `upTo`, as the app does first; with none, the vault
+   * recomputes them all itself. A verdict and nothing else, so anyone may
+   * ask; the app asks for owners.
    */
   verifyLog(input: VerifyLogInput): Promise<LogVerification>;
 }
@@ -158,7 +160,7 @@ export type WrappedKey = { kekProvider: string; kekId: string; kekVersion: strin
 export type KeyChecks = { current: { kekProvider: string; kekId: string }; checks: (WrappedKey & { seq: number })[] };
 
 /** Why someone reads: shown in the log, and the same rules apply to each. */
-export type Purpose = 'reveal' | 'run' | 'compare' | 'sync';
+export type Purpose = 'reveal' | 'run' | 'compare';
 
 /** Ties the vault's entries to the app's request and audit rows. */
 type Correlation = {
@@ -245,12 +247,7 @@ export type AdmitInput = Correlation & {
 export type RemoveInput = Correlation & {
   actor: string;
   principal: string;
-  /**
-   * For a sync: the environment it pushes from. Whoever may manage it there
-   * may stop the sync, also once its grant there is revoked and only the
-   * one on its credential is left.
-   */
-  source?: { projectId: string; environmentId: string };
+
 };
 
 /**
@@ -281,9 +278,11 @@ export type LogHead = { seq: number; hash: string };
 
 export type VerifyLogInput = {
   /**
-   * The last entry the app verified, its own entries by its key: the vault
-   * checks the log still holds it, so between them both authors' entries
-   * are authenticated over the same prefix.
+   * The last entry the app verified, every link and hash up to it
+   * recomputed and its own entries checked by its key: the vault checks the
+   * log still holds it, so between them both authors' entries are
+   * authenticated over the same prefix, and the vault leaves the links to
+   * the app.
    */
   upTo?: LogHead | null;
 };