@coffre/core 0.2.0 → 0.4.0

package/dist/access.d.ts

@@ -52,11 +52,46 @@ export declare function isRole(value: string): value is Role;
 export declare function roleGrants(role: Role, permission: Permission): boolean;
 /** Roles that hold a project-only permission can only be granted on a project. */
 export declare function assignableToEnvironment(role: Role): boolean;
-/** A place a permission applies to: a project, or one of its environments. */
+/**
+ * A place a permission applies to: a project, or one of its environments,
+ * named by its slug too, which grants on every project match by. A slug
+ * not read (null) matches no grant on a slug.
+ */
 export type Place = {
   projectId: string;
-  environmentId?: string | null;
+  environmentId?: null;
+} | {
+  projectId: string;
+  environmentId: string;
+  environmentSlug: string | null;
+};
+/**
+ * Where a grant applies, by the fields it fills (`grantKind`):
+ *
+ *   market        projectId
+ *   market/dev    projectId and environmentId
+ *   *             neither: every project, the ones created later too
+ *   *, on dev     environmentSlug only: the environment of that slug in every project
+ */
+export type GrantPlace = {
+  /** The project, also of an environment's grant; null only on every project. */
+  projectId: string | null;
+  environmentId: string | null;
+  /** On every project, the one environment slug it covers; null for all of them, and on a project's grant. */
+  environmentSlug: string | null;
 };
+/**
+ * What a grant's fields say it is on, or null when they say nothing
+ * coherent: an environment without its project, as a grant whose
+ * environment row is gone reads, or a slug beside an id. A grant is on
+ * every project only when it names no place at all; anything else that
+ * lacks a field covers nothing.
+ */
+export declare function grantKind(grant: GrantPlace): 'project' | 'environment' | 'every-project' | null;
+/** Every project, as a path names it. */
+export declare const EVERY_PROJECT = "*";
+/** A grant on every project as a path: `*`, or `*` and the environment slug it covers in each. */
+export declare function everyProjectPath(environmentSlug: string | null): string;
 /**
  * What someone holds: everything a permission check reads. The app builds
  * it from what the vault says once per request; the vault builds it from
@@ -69,22 +104,33 @@ export type Holdings = {
   /** Root admins and active users with the instance `owner` role. */
   isOwner: boolean;
   /** Live grants only. */
-  grants: readonly {
-    projectId: string;
-    environmentId: string | null;
+  grants: readonly (GrantPlace & {
     role: Role;
-  }[];
+  })[];
 };
 /**
- * Whether `holder` may do `permission` at `place`.
+ * Whether a grant at `grant` reaches `place`:
  *
- *   on a project       its project grant; owners also manage every project
- *   on an environment  its environment grant or its project's grant
+ *   market        market and each of its environments
+ *   market/dev    market/dev
+ *   *             every project and every environment
+ *   *, on dev     each environment whose slug is dev, in every project
  *
- * An environment grant never reaches up to the project: `developer` on
- * `market/prod` does not let anyone rename `market`.
+ * An environment's grant never reaches up to its project, whether it names
+ * the environment or its slug.
+ */
+export declare function covers(grant: GrantPlace, place: Place): boolean;
+/**
+ * Whether `holder` may do `permission` at `place`: a grant that covers it
+ * gives the role's permissions there, and grants add up. Owners also manage
+ * every project. `developer` on `market/prod` does not let anyone rename
+ * `market`.
  */
 export declare function allows(holder: Holdings, permission: Permission, place: Place): boolean;
-/** Whether the actor may manage grants on this project. */
-export declare function mayManageAccess(actor: Holdings, place: Place): boolean;
+/**
+ * Whether the actor may manage grants at this place: on a project or its
+ * environments, with `grant.manage` on the project; on every project, as an
+ * instance owner or a root admin only.
+ */
+export declare function mayManageAccess(actor: Holdings, place: GrantPlace): boolean;
 //#endregion

package/dist/access.js

@@ -74,23 +74,62 @@ function assignableToEnvironment(role) {
 	return !ROLES[role].permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission));
 }
 /**
-* Whether `holder` may do `permission` at `place`.
+* What a grant's fields say it is on, or null when they say nothing
+* coherent: an environment without its project, as a grant whose
+* environment row is gone reads, or a slug beside an id. A grant is on
+* every project only when it names no place at all; anything else that
+* lacks a field covers nothing.
+*/
+function grantKind(grant) {
+	if (grant.environmentId !== null) return grant.projectId !== null && grant.environmentSlug === null ? "environment" : null;
+	if (grant.projectId !== null) return grant.environmentSlug === null ? "project" : null;
+	return "every-project";
+}
+/** Every project, as a path names it. */
+const EVERY_PROJECT = "*";
+/** A grant on every project as a path: `*`, or `*` and the environment slug it covers in each. */
+function everyProjectPath(environmentSlug) {
+	return environmentSlug === null ? "*" : `*/${environmentSlug}`;
+}
+/**
+* Whether a grant at `grant` reaches `place`:
 *
-*   on a project       its project grant; owners also manage every project
-*   on an environment  its environment grant or its project's grant
+*   market        market and each of its environments
+*   market/dev    market/dev
+*   *             every project and every environment
+*   *, on dev     each environment whose slug is dev, in every project
 *
-* An environment grant never reaches up to the project: `developer` on
-* `market/prod` does not let anyone rename `market`.
+* An environment's grant never reaches up to its project, whether it names
+* the environment or its slug.
+*/
+function covers(grant, place) {
+	switch (grantKind(grant)) {
+		case "environment": return grant.projectId === place.projectId && grant.environmentId === (place.environmentId ?? null);
+		case "project": return grant.projectId === place.projectId;
+		case "every-project": return grant.environmentSlug === null || place.environmentId != null && place.environmentSlug !== null && place.environmentSlug === grant.environmentSlug;
+		case null: return false;
+	}
+}
+/**
+* Whether `holder` may do `permission` at `place`: a grant that covers it
+* gives the role's permissions there, and grants add up. Owners also manage
+* every project. `developer` on `market/prod` does not let anyone rename
+* `market`.
 */
 function allows(holder, permission, place) {
 	if (holder.isRootAdmin) return true;
-	const environmentId = place.environmentId ?? null;
-	if (environmentId === null && holder.isOwner && PROJECT_ONLY_PERMISSIONS.includes(permission)) return true;
-	return holder.grants.some((grant) => grant.projectId === place.projectId && (grant.environmentId === null || grant.environmentId === environmentId) && roleGrants(grant.role, permission));
+	if (place.environmentId == null && holder.isOwner && PROJECT_ONLY_PERMISSIONS.includes(permission)) return true;
+	return holder.grants.some((grant) => covers(grant, place) && roleGrants(grant.role, permission));
 }
-/** Whether the actor may manage grants on this project. */
+/**
+* Whether the actor may manage grants at this place: on a project or its
+* environments, with `grant.manage` on the project; on every project, as an
+* instance owner or a root admin only.
+*/
 function mayManageAccess(actor, place) {
-	return allows(actor, "grant.manage", { projectId: place.projectId });
+	const kind = grantKind(place);
+	if (kind === "every-project") return actor.isOwner || actor.isRootAdmin;
+	return kind !== null && place.projectId !== null && allows(actor, "grant.manage", { projectId: place.projectId });
 }
 //#endregion
-export { PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, allows, assignableToEnvironment, isRole, mayManageAccess, roleGrants };
+export { EVERY_PROJECT, PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, allows, assignableToEnvironment, covers, everyProjectPath, grantKind, isRole, mayManageAccess, roleGrants };

package/dist/identity.d.ts

@@ -192,6 +192,8 @@ export type SigninConfig = {
   cliSessionDays: number;
   /** CI runs signing in as services with their platform's ID token, when on (`workloads.ts`). */
   workloads: WorkloadsConfig | null;
+  /** MCP clients acting as the people who connect them, when on (docs/design/mcp.md). */
+  mcp: McpConfig | null;
 };
 /**
  * Workload identity: CI runs that sign in as a service with the ID token
@@ -231,6 +233,36 @@ export type WorkloadsConfig = {
   allowLoopback: boolean;
   limits: WorkloadLimits;
 };
+/**
+ * MCP clients, Claude among them, acting as the people who connect them,
+ * with coffre as their OAuth authorization server (docs/design/mcp.md). Off
+ * unless the deployment turns it on.
+ */
+export type McpOptions = {
+  /**
+   * The limits every unauthenticated OAuth request passes before coffre does
+   * any work for it, one per source address and one for all together, and
+   * the one each connection's tool calls pass. On Workers, three
+   * rate-limiting bindings; on Node, `processLimits()` from
+   * `@coffre/server/node`. Required.
+   */
+  limits: McpLimits;
+  /**
+   * Lets a client's metadata document be plain HTTP on loopback: for local
+   * development and conformance. Refused unless the public URL is loopback
+   * too.
+   */
+  allowLoopbackClientsForDevelopment?: boolean;
+};
+export type McpLimits = {
+  perSource: RateLimiter;
+  perConnection: RateLimiter;
+  total: RateLimiter;
+};
+export type McpConfig = {
+  allowLoopback: boolean;
+  limits: McpLimits;
+};
 type Credentials = {
   clientId: string;
   clientSecret: string;
@@ -291,6 +323,7 @@ export declare function defineSignin(options: {
   browserSessionHours?: number;
   cliSessionDays?: number;
   workloads?: WorkloadsOptions;
+  mcp?: McpOptions;
 }): SigninConfig;
 //#endregion
 //#region src/identity/types.d.ts
@@ -394,6 +427,8 @@ export type SigninOptions = {
   cliSessionDays?: number;
   /** Lets CI runs sign in as services with their platform's ID token: `{}` turns it on. */
   workloads?: WorkloadsOptions;
+  /** Lets MCP clients, Claude among them, act as the people who connect them (docs/mcp.md). */
+  mcp?: McpOptions;
 };
 /**
  * coffre's own sign-in page, with these providers:

package/dist/identity.js

@@ -452,7 +452,19 @@ function defineSignin(options) {
 		},
 		browserSessionHours: lifetime(options.browserSessionHours, "browserSessionHours", 12, 168),
 		cliSessionDays: lifetime(options.cliSessionDays, "cliSessionDays", 30, 365),
-		workloads: options.workloads === void 0 ? null : workloadsConfig(options.workloads, publicOrigin(options.publicUrl))
+		workloads: options.workloads === void 0 ? null : workloadsConfig(options.workloads, publicOrigin(options.publicUrl)),
+		mcp: options.mcp === void 0 ? null : mcpConfig(options.mcp, publicOrigin(options.publicUrl))
+	};
+}
+/** MCP, checked: its three limits given, each one a limiter; loopback clients only on a loopback instance. */
+function mcpConfig(options, publicUrl) {
+	const limiter = (value) => typeof value?.limit === "function";
+	if (!limiter(options.limits?.perSource) || !limiter(options.limits?.perConnection) || !limiter(options.limits?.total)) throw new Error("mcp needs its limits, per source, per connection and in total: on Workers, three rate-limiting bindings; on Node, processLimits()");
+	const loopback = options.allowLoopbackClientsForDevelopment === true;
+	if (loopback && !isLoopback(new URL(publicUrl))) throw new Error(`mcp.allowLoopbackClientsForDevelopment is for an instance on loopback, and ${publicUrl} is not one: turn it off`);
+	return {
+		allowLoopback: loopback,
+		limits: options.limits
 	};
 }
 /** Workloads, checked: both limits given, each one a limiter; loopback issuers only on a loopback instance. */
@@ -544,7 +556,8 @@ function toSignin(options) {
 		},
 		browserSessionHours: options.browserSessionHours,
 		cliSessionDays: options.cliSessionDays,
-		workloads: options.workloads
+		workloads: options.workloads,
+		mcp: options.mcp
 	};
 }
 //#endregion

package/dist/mcp.d.ts

@@ -0,0 +1,96 @@
+//#region src/mcp.d.ts
+/**
+ * What MCP clients may be, and do: the scopes a person grants one, and the
+ * rules its identity and redirects must pass (docs/design/mcp.md, sections
+ * 4 and 5). Plain functions over strings, for the server and the consent
+ * page alike.
+ */
+/** In the order the consent page lists them; `browse` is always granted. */
+export declare const MCP_SCOPES: readonly ["browse", "write", "read-values", "manage-access"];
+export type McpScope = (typeof MCP_SCOPES)[number];
+export declare const MCP_SCOPE_INFO: Record<McpScope, {
+  label: string;
+  description: string;
+}>;
+export declare function isMcpScope(value: string): value is McpScope;
+/**
+ * The scopes a space-separated `scope` asks for, in catalogue order, with
+ * `browse` always among them; and the ones coffre does not know, which the
+ * caller refuses as `invalid_scope`.
+ */
+export declare function parseScopes(value: string | null | undefined): {
+  scopes: McpScope[];
+  unknown: string[];
+};
+/** Scopes as one string, in catalogue order: how a connection stores them and a token answer says them. */
+export declare function scopeString(scopes: Iterable<McpScope>): string;
+/** A person's choice at consent: what was asked, minus what they unticked, and never without `browse`. */
+export declare function grantedScopes(asked: readonly McpScope[], chosen: readonly string[]): McpScope[];
+/**
+ * Whether a connection granted `granted` supersedes an earlier one of the
+ * same client that holds `held`: it grants all of that and more, as a
+ * step-up does. The earlier one then ends, once the new one's code is
+ * redeemed; one with the same scopes, a second laptop say, stays.
+ */
+export declare function supersedes(granted: readonly McpScope[], held: readonly McpScope[]): boolean;
+/** A client's redirect, refused: the message says why, for the consent page and the registration answer. */
+export declare class ClientInvalid extends Error {
+  constructor(message: string);
+}
+export type RedirectKind = 'https' | 'loopback';
+/**
+ * Where a redirect may go: HTTPS anywhere, or plain HTTP on loopback, which
+ * a native client such as Claude Code listens on (RFC 8252). No custom
+ * scheme, no fragment, no user or password.
+ */
+export declare function redirectKind(value: string): RedirectKind;
+/**
+ * Whether a requested redirect is one a client registered. Both are parsed
+ * first, so `http://127.0.0.1:33418` and `http://127.0.0.1:33418/` are one
+ * URL. A loopback one matches on any port, as RFC 8252 lets a native client
+ * bind whichever it can; everything else exactly.
+ */
+export declare function redirectMatches(registered: string, requested: string): boolean;
+/** The redirect's host, as the consent page shows it: `localhost` for every loopback one. */
+export declare function redirectHost(value: string): string;
+/** What coffre knows of a client, from its metadata document or its registration. */
+export type ClientMetadata = {
+  /** The document's URL, or the ID a registration was given. */
+  clientId: string;
+  /** Its own claim: shown, never trusted. */
+  name: string;
+  /** For a document, its URL's host; for a registration, null: it has none to vouch for it. */
+  host: string | null;
+  redirectUris: string[];
+  registration: 'cimd' | 'dcr';
+};
+/**
+ * Whether `value` is a Client ID Metadata Document's URL: HTTPS, with a
+ * path, and nothing a document's address has no use for. On a loopback
+ * instance, a loopback one too, for development and conformance.
+ */
+export declare function isClientIdUrl(value: string, options: {
+  allowLoopback: boolean;
+}): boolean;
+/**
+ * A fetched Client ID Metadata Document, checked: it names itself, a name
+ * and its redirects, and it is a public client. An HTTPS redirect must be on
+ * the document's own host, so the consent page names one host: Claude's
+ * `https://claude.ai/api/mcp/auth_callback` is on `claude.ai`, where its
+ * document is.
+ */
+export declare function clientFromDocument(clientId: string, document: unknown): ClientMetadata;
+/**
+ * What a registration may keep of what it asked for (RFC 7591): the
+ * redirects coffre accepts, the others left out rather than failing it, as
+ * the RFC lets a server replace what was asked. Cursor registers a
+ * `cursor://` callback beside its loopback and HTTPS ones; refused whole,
+ * it could not connect at all.
+ */
+export declare function registrationRedirects(value: unknown): {
+  kept: string[];
+  dropped: string[];
+};
+/** A client's name as shown: its own, cut short, or its host when it gives none. */
+export declare function clientName(value: unknown, fallback: string): string;
+//#endregion

package/dist/mcp.js

@@ -0,0 +1,201 @@
+//#region src/mcp.ts
+/**
+* What MCP clients may be, and do: the scopes a person grants one, and the
+* rules its identity and redirects must pass (docs/design/mcp.md, sections
+* 4 and 5). Plain functions over strings, for the server and the consent
+* page alike.
+*/
+/** In the order the consent page lists them; `browse` is always granted. */
+const MCP_SCOPES = [
+	"browse",
+	"write",
+	"read-values",
+	"manage-access"
+];
+const MCP_SCOPE_INFO = {
+	browse: {
+		label: "Browse",
+		description: "Projects, environments, key names, history, access and the audit log. Never a value."
+	},
+	write: {
+		label: "Write",
+		description: "Set, generate, rename, archive and restore secrets; create projects and environments. Each change waits for your approval on coffre."
+	},
+	"read-values": {
+		label: "Read values",
+		description: "Secret values, sent to the app. They become part of its conversation, wherever it keeps it."
+	},
+	"manage-access": {
+		label: "Manage access",
+		description: "Grants, members, service tokens and trusted workloads. Each change waits for your approval on coffre."
+	}
+};
+/** What OAuth's `offline_access` asks for, a refresh token, every connection has: accepted and dropped. */
+const IGNORED_SCOPES = /* @__PURE__ */ new Set(["offline_access"]);
+function isMcpScope(value) {
+	return MCP_SCOPES.includes(value);
+}
+/**
+* The scopes a space-separated `scope` asks for, in catalogue order, with
+* `browse` always among them; and the ones coffre does not know, which the
+* caller refuses as `invalid_scope`.
+*/
+function parseScopes(value) {
+	const asked = new Set((value ?? "").split(" ").filter((scope) => scope !== "" && !IGNORED_SCOPES.has(scope)));
+	const unknown = [...asked].filter((scope) => !isMcpScope(scope));
+	return {
+		scopes: MCP_SCOPES.filter((scope) => scope === "browse" || asked.has(scope)),
+		unknown
+	};
+}
+/** Scopes as one string, in catalogue order: how a connection stores them and a token answer says them. */
+function scopeString(scopes) {
+	const held = new Set(scopes);
+	return MCP_SCOPES.filter((scope) => held.has(scope)).join(" ");
+}
+/** A person's choice at consent: what was asked, minus what they unticked, and never without `browse`. */
+function grantedScopes(asked, chosen) {
+	const picked = new Set(chosen);
+	return MCP_SCOPES.filter((scope) => scope === "browse" || asked.includes(scope) && picked.has(scope));
+}
+/**
+* Whether a connection granted `granted` supersedes an earlier one of the
+* same client that holds `held`: it grants all of that and more, as a
+* step-up does. The earlier one then ends, once the new one's code is
+* redeemed; one with the same scopes, a second laptop say, stays.
+*/
+function supersedes(granted, held) {
+	return held.every((scope) => granted.includes(scope)) && granted.some((scope) => !held.includes(scope));
+}
+/** A client's redirect, refused: the message says why, for the consent page and the registration answer. */
+var ClientInvalid = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "ClientInvalid";
+	}
+};
+const LOOPBACK_HOSTS = /* @__PURE__ */ new Set([
+	"127.0.0.1",
+	"[::1]",
+	"localhost"
+]);
+/**
+* Where a redirect may go: HTTPS anywhere, or plain HTTP on loopback, which
+* a native client such as Claude Code listens on (RFC 8252). No custom
+* scheme, no fragment, no user or password.
+*/
+function redirectKind(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new ClientInvalid(`${value} is not a URL`);
+	}
+	if (url.username !== "" || url.password !== "") throw new ClientInvalid(`${value} carries a user or password`);
+	if (url.hash !== "" || value.includes("#")) throw new ClientInvalid(`${value} has a fragment`);
+	if (url.protocol === "https:") return "https";
+	if (url.protocol === "http:" && LOOPBACK_HOSTS.has(url.hostname)) return "loopback";
+	throw new ClientInvalid(`${value} is neither HTTPS nor HTTP on loopback (127.0.0.1, [::1] or localhost)`);
+}
+/**
+* Whether a requested redirect is one a client registered. Both are parsed
+* first, so `http://127.0.0.1:33418` and `http://127.0.0.1:33418/` are one
+* URL. A loopback one matches on any port, as RFC 8252 lets a native client
+* bind whichever it can; everything else exactly.
+*/
+function redirectMatches(registered, requested) {
+	let a;
+	let b;
+	try {
+		redirectKind(requested);
+		a = new URL(registered);
+		b = new URL(requested);
+	} catch {
+		return false;
+	}
+	if (a.protocol === "http:" && LOOPBACK_HOSTS.has(a.hostname)) return b.protocol === "http:" && a.hostname === b.hostname && a.pathname === b.pathname && a.search === b.search;
+	return a.href === b.href;
+}
+/** The redirect's host, as the consent page shows it: `localhost` for every loopback one. */
+function redirectHost(value) {
+	const url = new URL(value);
+	return redirectKind(value) === "loopback" ? "localhost" : url.host;
+}
+const MAX_REDIRECTS = 10;
+const MAX_NAME = 100;
+/**
+* Whether `value` is a Client ID Metadata Document's URL: HTTPS, with a
+* path, and nothing a document's address has no use for. On a loopback
+* instance, a loopback one too, for development and conformance.
+*/
+function isClientIdUrl(value, options) {
+	if (!value.startsWith("https://") && !(options.allowLoopback && value.startsWith("http://"))) return false;
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	if (url.href !== value || url.pathname === "/" || url.search !== "" || url.hash !== "") return false;
+	if (url.username !== "" || url.password !== "" || /\/\.\.?(\/|$)/.test(url.pathname)) return false;
+	return url.protocol === "https:" || LOOPBACK_HOSTS.has(url.hostname);
+}
+/**
+* A fetched Client ID Metadata Document, checked: it names itself, a name
+* and its redirects, and it is a public client. An HTTPS redirect must be on
+* the document's own host, so the consent page names one host: Claude's
+* `https://claude.ai/api/mcp/auth_callback` is on `claude.ai`, where its
+* document is.
+*/
+function clientFromDocument(clientId, document) {
+	if (typeof document !== "object" || document === null || Array.isArray(document)) throw new ClientInvalid("the client metadata document is not a JSON object");
+	const fields = document;
+	if (fields.client_id !== clientId) throw new ClientInvalid("the client metadata document names another client_id than its own URL");
+	const method = fields.token_endpoint_auth_method;
+	if (method !== void 0 && method !== "none") throw new ClientInvalid(`the client authenticates with ${String(method)}; coffre takes public clients only, with PKCE`);
+	const host = new URL(clientId).host;
+	const uris = redirectList(fields.redirect_uris);
+	for (const uri of uris) if (redirectKind(uri) === "https" && new URL(uri).host !== host) throw new ClientInvalid(`${uri} is not on ${host}, where the client's metadata document is`);
+	return {
+		clientId,
+		name: clientName(fields.client_name, host),
+		host,
+		redirectUris: uris,
+		registration: "cimd"
+	};
+}
+/**
+* What a registration may keep of what it asked for (RFC 7591): the
+* redirects coffre accepts, the others left out rather than failing it, as
+* the RFC lets a server replace what was asked. Cursor registers a
+* `cursor://` callback beside its loopback and HTTPS ones; refused whole,
+* it could not connect at all.
+*/
+function registrationRedirects(value) {
+	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_REDIRECTS || value.some((uri) => typeof uri !== "string" || uri.length > 400)) throw new ClientInvalid(`redirect_uris must list 1 to ${MAX_REDIRECTS} URLs`);
+	const kept = [];
+	const dropped = [];
+	for (const uri of value) try {
+		redirectKind(uri);
+		if (!kept.includes(uri)) kept.push(uri);
+	} catch {
+		dropped.push(uri);
+	}
+	if (kept.length === 0) throw new ClientInvalid(`none of the redirect_uris is HTTPS or HTTP on loopback: ${dropped.join(", ")}`);
+	return {
+		kept,
+		dropped
+	};
+}
+/** A client's name as shown: its own, cut short, or its host when it gives none. */
+function clientName(value, fallback) {
+	const name = typeof value === "string" ? value.replace(/[\p{Cc}\p{Cf}]/gu, "").trim() : "";
+	return name === "" ? fallback : name.slice(0, MAX_NAME);
+}
+function redirectList(value) {
+	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_REDIRECTS || value.some((uri) => typeof uri !== "string")) throw new ClientInvalid(`the client metadata document must list 1 to ${MAX_REDIRECTS} redirect_uris`);
+	for (const uri of value) redirectKind(uri);
+	return value;
+}
+//#endregion
+export { ClientInvalid, MCP_SCOPES, MCP_SCOPE_INFO, clientFromDocument, clientName, grantedScopes, isClientIdUrl, isMcpScope, parseScopes, redirectHost, redirectKind, redirectMatches, registrationRedirects, scopeString, supersedes };

package/dist/pages.d.ts

@@ -12,6 +12,13 @@ export declare const PREFERENCE_COOKIES: {
   readonly theme: "coffre-theme";
   readonly sidebar: "coffre-sidebar";
 };
+/**
+ * A project's pages beside its environments': `/projects/market/settings`
+ * sits where `/projects/market/prod` does, so no environment takes one of
+ * these names (`environmentSlug` in `./schemas.ts`). A tab a project gains
+ * adds its word here.
+ */
+export declare const PROJECT_PAGES: readonly ["users", "service-accounts", "settings"];
 /** The preferences in a `Cookie` header, or in `document.cookie`, which reads the same. */
 export declare function preferencesIn(cookies: string | null): Preferences;
 /** What a server route or a page says, rendered without coffre's request middleware. */

package/dist/pages.js

@@ -4,6 +4,17 @@ const PREFERENCE_COOKIES = {
 	theme: "coffre-theme",
 	sidebar: "coffre-sidebar"
 };
+/**
+* A project's pages beside its environments': `/projects/market/settings`
+* sits where `/projects/market/prod` does, so no environment takes one of
+* these names (`environmentSlug` in `./schemas.ts`). A tab a project gains
+* adds its word here.
+*/
+const PROJECT_PAGES = [
+	"users",
+	"service-accounts",
+	"settings"
+];
 /** The preferences in a `Cookie` header, or in `document.cookie`, which reads the same. */
 function preferencesIn(cookies) {
 	const value = (name) => {
@@ -21,4 +32,4 @@ function preferencesIn(cookies) {
 /** What a server route or a page says, rendered without coffre's request middleware. */
 const NO_MIDDLEWARE = "coffre's request middleware is not installed: add coffreMiddleware, from @coffre/server/start, to createStart(() => ({ requestMiddleware: [coffreMiddleware] })) in the app's src/start.ts";
 //#endregion
-export { NO_MIDDLEWARE, PREFERENCE_COOKIES, preferencesIn };
+export { NO_MIDDLEWARE, PREFERENCE_COOKIES, PROJECT_PAGES, preferencesIn };

package/dist/schemas.d.ts

@@ -1,16 +1,36 @@
 import { z } from "zod";
 //#region src/schemas.d.ts
 export declare const slug: z.ZodString;
+/** An environment's slug: any slug but the name of one of its project's pages. */
+export declare const environmentSlug: z.ZodString;
+/**
+ * A deleted project or environment keeps its row as a tombstone, under a
+ * slug no live place can hold: `market~deleted-2026-10-05`. The `~` is the
+ * whole rule: a place is deleted when its slug, or its project's, holds one.
+ * `@coffre/db/dialect`'s `tombstone()` is the same rule in SQL.
+ */
+export declare const TOMBSTONE = "~";
+export declare function isTombstone(slug: string): boolean;
+/** The slug a place deleted on `day` keeps: the `n`th that day is `market~deleted-2026-10-05-<n>`. */
+export declare function tombstoneOf(slug: string, day: Date, n?: number): string;
 export declare const displayName: z.ZodString;
+/** A folder: 1 to 64 characters, no `/`, no control character, no space at either end (the tables check it too). */
+export declare const folderName: z.ZodString;
 export declare const secretKey: z.ZodString;
+/**
+ * A member as people read it, in a message or on a page: a service account
+ * as `service:<name>`, though the API, the vault and the log keep the
+ * `token:<name>` their signed entries hold.
+ */
+export declare function shownMember(member: string): string;
 export declare const principalType: z.ZodEnum<{
   user: "user";
   service: "service";
 }>;
 export declare const principalId: z.ZodString;
 export declare const instanceRole: z.ZodEnum<{
-  owner: "owner";
   user: "user";
+  owner: "owner";
 }>;
 export declare const grantId: z.ZodString;
 export declare const emailAddress: z.ZodString;