@coffre/core 0.4.4 → 0.4.6

package/dist/identity.d.ts

@@ -475,6 +475,11 @@ export type CredentialKind = 'browser' | 'cli' | 'service';
 export declare function generateToken(kind: CredentialKind): string;
 /** Whether a string has the shape of a coffre token, before any lookup. */
 export declare function isCoffreToken(value: string): boolean;
+/**
+ * The kind a token's prefix says, before any lookup. Its hash covers the
+ * prefix, so a token found under its hash is the kind it says.
+ */
+export declare function tokenKind(token: string): CredentialKind | null;
 export declare function hashToken(token: string): Buffer;
 /**
  * Enough of a token to recognize it in a list, never enough to use it: the

package/dist/identity.js

@@ -630,6 +630,14 @@ function generateToken(kind) {
 function isCoffreToken(value) {
 	return TOKEN.test(value);
 }
+/**
+* The kind a token's prefix says, before any lookup. Its hash covers the
+* prefix, so a token found under its hash is the kind it says.
+*/
+function tokenKind(token) {
+	if (!TOKEN.test(token)) return null;
+	return Object.keys(PREFIX).find((kind) => token.startsWith(PREFIX[kind])) ?? null;
+}
 function hashToken(token) {
 	return createHash("sha256").update(token, "utf8").digest();
 }
@@ -822,4 +830,4 @@ function refusalOf(error) {
 	return new WorkloadTokenRefused("signature", "the token does not verify");
 }
 //#endregion
-export { ACCESS_JWT_HEADER, AccessIdentityVerifier, BindingInvalid, CLOCK_TOLERANCE_SECONDS, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, GitHubSigninProvider, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_TOKEN_AGE_SECONDS, MAX_TOKEN_BYTES, OidcSigninProvider, REQUIRED_CLAIMS, SigninError, WORKLOAD_ALGORITHMS, WORKLOAD_PROFILES, WorkloadTokenRefused, canonicalClaims, checkBinding, checkFetchUrl, cloudflareAccess, decodeWorkloadToken, defaultIssuer, defineSignin, deriveKey, fullRef, generateToken, github, githubReusable, githubWorkflow, gitlabProject, google, hashToken, isCoffreToken, issuedRefusal, microsoft, oidc, publicOrigin, seal, signin, toPrincipal, tokenHint, unseal, verifyWorkloadToken, workflowRef };
+export { ACCESS_JWT_HEADER, AccessIdentityVerifier, BindingInvalid, CLOCK_TOLERANCE_SECONDS, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, GitHubSigninProvider, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_TOKEN_AGE_SECONDS, MAX_TOKEN_BYTES, OidcSigninProvider, REQUIRED_CLAIMS, SigninError, WORKLOAD_ALGORITHMS, WORKLOAD_PROFILES, WorkloadTokenRefused, canonicalClaims, checkBinding, checkFetchUrl, cloudflareAccess, decodeWorkloadToken, defaultIssuer, defineSignin, deriveKey, fullRef, generateToken, github, githubReusable, githubWorkflow, gitlabProject, google, hashToken, isCoffreToken, issuedRefusal, microsoft, oidc, publicOrigin, seal, signin, toPrincipal, tokenHint, tokenKind, unseal, verifyWorkloadToken, workflowRef };

package/dist/mcp.js

@@ -23,7 +23,7 @@ const MCP_SCOPE_INFO = {
 	},
 	reveal: {
 		label: "Reveal values",
-		description: "Secret values, sent to the app. They become part of its conversation, wherever it keeps it."
+		description: "Secret values, sent to the app."
 	},
 	"manage-access": {
 		label: "Manage access",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/core",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "What coffre's packages share: roles, envelopes, identity, the audit chain and the vault's contract.",
   "license": "MIT",
   "repository": {
@@ -84,7 +84,7 @@
     "@types/node": "26.1.1",
     "tsdown": "0.23.0",
     "typescript": "5.9.3",
-    "@coffre/conformance": "0.4.4"
+    "@coffre/conformance": "0.4.6"
   },
   "scripts": {
     "build": "tsdown",

package/src/identity/tokens.ts

@@ -30,6 +30,15 @@ export function isCoffreToken(value: string): boolean {
   return TOKEN.test(value);
 }
 
+/**
+ * The kind a token's prefix says, before any lookup. Its hash covers the
+ * prefix, so a token found under its hash is the kind it says.
+ */
+export function tokenKind(token: string): CredentialKind | null {
+  if (!TOKEN.test(token)) return null;
+  return (Object.keys(PREFIX) as CredentialKind[]).find((kind) => token.startsWith(PREFIX[kind])) ?? null;
+}
+
 export function hashToken(token: string): Buffer {
   return createHash('sha256').update(token, 'utf8').digest();
 }

package/src/mcp.ts

@@ -21,7 +21,7 @@ export const MCP_SCOPE_INFO: Record<McpScope, { label: string; description: stri
   },
   reveal: {
     label: 'Reveal values',
-    description: 'Secret values, sent to the app. They become part of its conversation, wherever it keeps it.',
+    description: 'Secret values, sent to the app.',
   },
   'manage-access': {
     label: 'Manage access',