@coffre/core 0.4.6 → 0.5.0

package/dist/access-pnJ-u4x2.js

@@ -0,0 +1,522 @@
+//#region src/access-conversion.ts
+function convertEveryProjectGrants(input) {
+	const { role, scope } = input.person ? instanceRoleFor(input.role, input.everyProject) : {
+		role: input.role,
+		scope: EVERYWHERE
+	};
+	const before = new Map(input.grants.map((grant) => [placeKey(grant), grant]));
+	const held = new Map(before);
+	const given = /* @__PURE__ */ new Map();
+	const narrowed = [];
+	const give = (at, wanted) => {
+		const place = {
+			projectId: at.project.id,
+			environmentId: at.environment?.id ?? null,
+			role: wanted.role,
+			expiresAt: wanted.expiresAt
+		};
+		held.set(placeKey(place), place);
+		given.set(placeKey(place), {
+			...place,
+			replaces: before.get(placeKey(place))?.role ?? null
+		});
+	};
+	const settle = (grant, at, wanted) => {
+		const place = at.environment === null ? { projectId: at.project.id } : {
+			projectId: at.project.id,
+			environmentId: at.environment.id,
+			environmentSlug: at.environment.slug
+		};
+		if (holdsAlready(role, scope, [...held.values()], wanted, place)) return;
+		const existing = held.get(at.environment?.id ?? at.project.id);
+		if (existing === void 0 || within(existing.role, wanted.role) && outlasts(wanted.expiresAt, existing.expiresAt)) {
+			give(at, wanted);
+			return;
+		}
+		if (at.environment === null) {
+			const down = [wanted, existing].filter((candidate) => assignableToEnvironment(candidate.role)).sort((a, b) => Number(roleGrants(a.role, "audit.read")) - Number(roleGrants(b.role, "audit.read")))[0];
+			if (down !== void 0) {
+				if (down === existing) give(at, wanted);
+				narrowed.push({
+					kind: "environments",
+					grant,
+					projectId: at.project.id,
+					role: down.role
+				});
+				for (const environment of at.project.environments) settle(grant, {
+					project: at.project,
+					environment
+				}, {
+					role: down.role,
+					expiresAt: down.expiresAt
+				});
+				return;
+			}
+		}
+		const keep = !roleGrants(wanted.role, "secret.read") || roleGrants(existing.role, "secret.read") ? existing : wanted;
+		const lose = keep === existing ? wanted : existing;
+		if (keep === wanted) give(at, wanted);
+		narrowed.push({
+			kind: "lost",
+			grant,
+			projectId: at.project.id,
+			environmentId: at.environment?.id ?? null,
+			lost: lose.role,
+			kept: keep.role,
+			keptUntil: keep.expiresAt
+		});
+	};
+	for (const grant of input.everyProject) {
+		if (byRole(role, scope, grant)) continue;
+		narrowed.push({
+			kind: "later-projects",
+			grant
+		});
+		for (const project of input.projects) {
+			const reached = grant.environmentSlug === null ? [null] : project.environments.filter((environment) => environment.slug === grant.environmentSlug);
+			for (const environment of reached) settle(grant, {
+				project,
+				environment
+			}, grant);
+		}
+	}
+	return {
+		role,
+		scope,
+		grants: [...given.values()],
+		narrowed
+	};
+}
+/**
+* The strongest instance role a person's lasting grants on every project
+* add up to, never more than they held: an owner of 0.4 (an Admin) who
+* read, wrote and retired secrets everywhere is an Owner; anyone else is a
+* Developer or an Auditor where those grants were on all of every project,
+* or on some environment slugs (Developer first), or stays as they were.
+*/
+function instanceRoleFor(previous, everyProject) {
+	const lasting = everyProject.filter((grant) => grant.expiresAt === null);
+	const all = lasting.find((grant) => grant.environmentSlug === null)?.role;
+	if (previous === "admin") {
+		const adds = all === void 0 ? [] : ROLES[all].permissions;
+		return {
+			role: INSTANCE_ROLES.owner.permissions.every((permission) => instanceRoleGrants("admin", permission) || adds.includes(permission)) ? "owner" : "admin",
+			scope: EVERYWHERE
+		};
+	}
+	if (previous !== "member") return {
+		role: previous,
+		scope: EVERYWHERE
+	};
+	const fits = (role, held) => INSTANCE_ROLES[role].permissions.every((permission) => roleGrants(held, permission));
+	const candidates = ["developer", "auditor"];
+	for (const role of candidates) if (all !== void 0 && fits(role, all)) return {
+		role,
+		scope: EVERYWHERE
+	};
+	for (const role of candidates) {
+		const only = lasting.filter((grant) => grant.environmentSlug !== null && fits(role, grant.role)).map((grant) => grant.environmentSlug);
+		if (only.length > 0) return {
+			role,
+			scope: normalScope({
+				projects: "all",
+				environments: { only }
+			})
+		};
+	}
+	return {
+		role: "member",
+		scope: EVERYWHERE
+	};
+}
+/** Whether the instance role, in its scope, holds all a grant on every project did, wherever it did, for good. */
+function byRole(role, scope, grant) {
+	return scope.projects === "all" && (grant.environmentSlug === null ? scope.environments === "all" : admits(scope.environments, grant.environmentSlug)) && ROLES[grant.role].permissions.every((permission) => instanceRoleGrants(role, permission));
+}
+/** Whether every permission of the grant's role is held at `at` already, by the role or by grants lasting as long. */
+function holdsAlready(role, scope, held, grant, at) {
+	const lasting = held.filter((other) => outlasts(other.expiresAt, grant.expiresAt));
+	return ROLES[grant.role].permissions.every((permission) => allows({
+		isRootAdmin: false,
+		role,
+		scope,
+		grants: lasting
+	}, permission, at));
+}
+/** Whether `role` holds nothing `wider` does not. */
+function within(role, wider) {
+	return ROLES[role].permissions.every((permission) => roleGrants(wider, permission));
+}
+/** Whether an end of `a` comes no sooner than one of `b`; null is never. */
+function outlasts(a, b) {
+	return a === null || b !== null && a >= b;
+}
+function placeKey(place) {
+	return place.environmentId ?? place.projectId;
+}
+//#endregion
+//#region src/access.ts
+/**
+* Who may do what: seven permissions, the six project roles a grant names,
+* and the five instance roles a person holds across every project.
+*
+* Deliberately constants and not tables or a policy language. A grant names
+* one role for one member on one place, a person's instance role names one
+* role and its scope, and a check is a lookup in this file, so authorisation
+* stays something you can read end to end.
+*/
+const PERMISSIONS = [
+	"secret.read",
+	"secret.write",
+	"secret.archive",
+	"audit.read",
+	"environment.manage",
+	"grant.manage",
+	"project.manage"
+];
+/**
+* Permissions that only make sense on a project. Granting
+* `environment.manage` on one environment would be incoherent: what it
+* authorises is creating that environment's siblings.
+*/
+const PROJECT_ONLY_PERMISSIONS = [
+	"environment.manage",
+	"grant.manage",
+	"project.manage"
+];
+const ROLES = {
+	viewer: {
+		name: "Viewer",
+		description: "Read secret values.",
+		permissions: ["secret.read"]
+	},
+	developer: {
+		name: "Developer",
+		description: "Read and write secrets.",
+		permissions: ["secret.read", "secret.write"]
+	},
+	maintainer: {
+		name: "Maintainer",
+		description: "Read, write and retire secrets, and manage environments.",
+		permissions: [
+			"secret.read",
+			"secret.write",
+			"secret.archive",
+			"environment.manage"
+		]
+	},
+	"access-manager": {
+		name: "Access manager",
+		description: "Manage who has access. Cannot read secret values.",
+		permissions: ["grant.manage"]
+	},
+	auditor: {
+		name: "Auditor",
+		description: "Read the audit log. Cannot read secret values.",
+		permissions: ["audit.read"]
+	},
+	owner: {
+		name: "Owner",
+		description: "Everything, including reading secret values.",
+		permissions: [...PERMISSIONS]
+	}
+};
+const ROLE_NAMES = Object.keys(ROLES);
+function isRole(value) {
+	return Object.hasOwn(ROLES, value);
+}
+function roleGrants(role, permission) {
+	return ROLES[role].permissions.includes(permission);
+}
+/** Roles that hold a project-only permission can only be granted on a project. */
+function assignableToEnvironment(role) {
+	return !ROLES[role].permissions.some((permission) => PROJECT_ONLY_PERMISSIONS.includes(permission));
+}
+/**
+* A person's role on the whole instance: what they hold in every project
+* their scope covers, before any grant. Service accounts are always
+* members, and hold only what their grants give. Admins and owners also
+* run the instance (`runsInstance`) when nothing narrows their scope.
+*/
+const INSTANCE_ROLES = {
+	member: {
+		name: "Member",
+		description: "Only what projects grant.",
+		permissions: []
+	},
+	auditor: {
+		name: "Auditor",
+		description: "Read the audit log. No secret values.",
+		permissions: ["audit.read"]
+	},
+	developer: {
+		name: "Developer",
+		description: "Read and write secrets.",
+		permissions: ["secret.read", "secret.write"]
+	},
+	admin: {
+		name: "Admin",
+		description: "Manage people, service accounts, projects and access. No secret values.",
+		permissions: [
+			"audit.read",
+			"environment.manage",
+			"grant.manage",
+			"project.manage"
+		]
+	},
+	owner: {
+		name: "Owner",
+		description: "Everything an admin does, and read every secret.",
+		permissions: [...PERMISSIONS]
+	}
+};
+const INSTANCE_ROLE_NAMES = Object.keys(INSTANCE_ROLES);
+function isInstanceRole(value) {
+	return Object.hasOwn(INSTANCE_ROLES, value);
+}
+function instanceRoleGrants(role, permission) {
+	return INSTANCE_ROLES[role].permissions.includes(permission);
+}
+/** The roles that manage people and access: Admin, and Owner, which adds every secret. */
+function administers(role) {
+	return role === "admin" || role === "owner";
+}
+/** Every project and every environment. */
+const EVERYWHERE = {
+	projects: "all",
+	environments: "all"
+};
+/** Whether a scope narrows nothing. */
+function unscoped(scope) {
+	return scope.projects === "all" && scope.environments === "all";
+}
+/** Whether a filter takes in a project's id or an environment's slug; one not read (null) is in none that lists. */
+function admits(filter, value) {
+	if (filter === "all") return true;
+	if (value == null) return false;
+	return "only" in filter ? filter.only.includes(value) : !filter.except.includes(value);
+}
+/**
+* One way to write each scope, which the vault seals and the log replays:
+* lists sorted, without repeats; an empty `except` is `all`. An empty
+* `only` stays: it takes in nothing.
+*/
+function normalScope(scope) {
+	const normal = (filter) => {
+		if (filter === "all") return "all";
+		if ("only" in filter) return { only: [...new Set(filter.only)].sort() };
+		return filter.except.length === 0 ? "all" : { except: [...new Set(filter.except)].sort() };
+	};
+	return {
+		projects: normal(scope.projects),
+		environments: normal(scope.environments)
+	};
+}
+/** Whether `value` is a scope as `normalScope` writes it, and as the vault stores it. */
+function isScope(value) {
+	const isFilter = (filter) => {
+		if (filter === "all") return true;
+		if (typeof filter !== "object" || filter === null || Array.isArray(filter)) return false;
+		const keys = Object.keys(filter);
+		if (keys.length !== 1 || keys[0] !== "only" && keys[0] !== "except") return false;
+		const list = filter[keys[0]];
+		return Array.isArray(list) && list.every((item) => typeof item === "string" && item.length > 0);
+	};
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const { projects, environments, ...rest } = value;
+	return Object.keys(rest).length === 0 && isFilter(projects) && isFilter(environments);
+}
+/**
+* A scope in words, its projects named as the caller has them (slugs, at
+* the API's edges): `All projects`, `All projects · dev only`,
+* `web, api`, `All projects but billing · all but prod`.
+*/
+function scopeInWords(scope) {
+	const list = (names) => names.join(", ");
+	const { projects, environments } = scope;
+	const where = projects === "all" ? "All projects" : "only" in projects ? projects.only.length === 0 ? "No projects" : list(projects.only) : `All projects but ${list(projects.except)}`;
+	if (environments === "all") return where;
+	if ("only" in environments) return `${where} · ${environments.only.length === 0 ? "no environments" : `${list(environments.only)} only`}`;
+	return `${where} · all but ${list(environments.except)}`;
+}
+/**
+* Whether a scope takes in a place. A project as a whole is in it only when
+* the scope keeps all of its environments: a role scoped to `dev` reaches
+* every `dev`, never a project around one.
+*/
+function inScope(scope, place) {
+	if (!admits(scope.projects, place.projectId)) return false;
+	if (place.environmentId == null) return scope.environments === "all";
+	return admits(scope.environments, place.environmentSlug);
+}
+/**
+* What a grant's fields say it is on, or null when they say nothing
+* coherent: an environment without its project, as a grant whose
+* environment row is gone reads, or neither, as the grants on every project
+* of 0.4 read until the vault replaces them. Null covers nothing.
+*/
+function grantKind(grant) {
+	if (grant.projectId === null) return null;
+	return grant.environmentId === null ? "project" : "environment";
+}
+/** The most places a scope asked for names: far more than any credential needs, and a bound on what a request makes the app check. */
+const MAX_SCOPE_PLACES = 1e3;
+/**
+* A credential's scope, by path as the API names it, in words, each role
+* with its places: `developer on market/dev, api/dev; viewer on market/prod`.
+*/
+function credentialScopeInWords(scope) {
+	const byRole = /* @__PURE__ */ new Map();
+	for (const [path, role] of Object.entries(scope)) byRole.set(role, [...byRole.get(role) ?? [], path]);
+	return [...byRole].map(([role, paths]) => `${role} on ${paths.join(", ")}`).join("; ") || "nothing";
+}
+/** Whether `value` is a credential's scope as the app stores it and the vault reads it: one grant a place, each role one that place takes. */
+function isCredentialScope(value) {
+	if (!Array.isArray(value)) return false;
+	const places = /* @__PURE__ */ new Set();
+	return value.every((grant) => {
+		if (typeof grant !== "object" || grant === null || Array.isArray(grant)) return false;
+		const { projectId, environmentId, role, ...rest } = grant;
+		if (Object.keys(rest).length > 0 || typeof projectId !== "string" || typeof role !== "string" || !isRole(role)) return false;
+		if (environmentId !== null && (typeof environmentId !== "string" || !assignableToEnvironment(role))) return false;
+		const place = `${projectId}/${environmentId ?? ""}`;
+		if (places.has(place)) return false;
+		places.add(place);
+		return true;
+	});
+}
+/** Someone who holds nothing: a stranger, a removed member, a tampered row. */
+const NOTHING = {
+	isRootAdmin: false,
+	role: "member",
+	scope: EVERYWHERE,
+	grants: []
+};
+/**
+* Whether a grant at `grant` reaches `place`:
+*
+*   market        market and each of its environments
+*   market/dev    market/dev
+*
+* An environment's grant never reaches up to its project.
+*/
+function covers(grant, place) {
+	switch (grantKind(grant)) {
+		case "environment": return grant.projectId === place.projectId && grant.environmentId === (place.environmentId ?? null);
+		case "project": return grant.projectId === place.projectId;
+		case null: return false;
+	}
+}
+/**
+* Whether `holder` may do `permission` at `place`: their instance role
+* gives its permissions inside its scope, a grant that covers the place
+* gives its role's there, and they add up. A Developer scoped to `dev` with
+* `viewer` on `billing` reads and writes every `dev`, and reads all of
+* `billing`.
+*/
+function allows(holder, permission, place) {
+	if (holder.credentialScope != null && !holdsAt(holder.credentialScope, permission, place)) return false;
+	if (holder.isRootAdmin) return true;
+	if (instanceRoleGrants(holder.role, permission) && inScope(holder.scope, place)) return true;
+	return holdsAt(holder.grants, permission, place);
+}
+/** Whether a grant among `grants` covers `place` with a role that holds `permission`. */
+function holdsAt(grants, permission, place) {
+	return grants.some((grant) => covers(grant, place) && roleGrants(grant.role, permission));
+}
+/**
+* Whether the actor may give or take grants at this place: with
+* `grant.manage` there, from a project grant or an instance role whose
+* scope takes it in. A grant on a project reaches all its environments, so
+* an admin scoped to `dev` manages `market/dev`'s grants, not `market`'s.
+*/
+function mayManageAccess(actor, place) {
+	return allows(actor, "grant.manage", place);
+}
+/**
+* Whether the holder runs the instance: a root admin, or an Admin or Owner
+* whose scope narrows nothing. They add and remove people, set instance
+* roles, and change the instance's settings; they read its whole log too
+* (`readsWholeLog`). A scoped Admin manages only inside its scope, so it
+* does none of these.
+*/
+function runsInstance(holder) {
+	return holder.isRootAdmin || administers(holder.role) && unscoped(holder.scope);
+}
+/**
+* Whether `holder` may give a service account `role` at `place`: where
+* they manage access, as anyone may; or inside the setting, where they hold
+* everything `role` does. A Developer on `market/dev` gives viewer or
+* developer there, never maintainer; a grant on `market` takes holding it
+* on all of `market`. `setting` is null for a service account, which sets
+* up none.
+*/
+function givesService(holder, setting, role, place) {
+	if (mayManageAccess(holder, place)) return true;
+	return setting !== null && inScope(setting, place) && ROLES[role].permissions.every((permission) => allows(holder, permission, place));
+}
+/** Whether `holder` gives a service account anything anywhere among `places`: whether they set any up. */
+function setsUpServices(holder, setting, places) {
+	if (runsInstance(holder)) return true;
+	return places.some((place) => ROLE_NAMES.some((role) => givesService(holder, setting, role, place)));
+}
+/**
+* Whether `holder`, the member `actor`, manages a service account: issues
+* and revokes its tokens, adds and removes its trust bindings, changes its
+* grants and removes it. A credential for it reads everything it holds, so
+* they must reach every grant it holds, as if giving it (`givesService`):
+* a Developer on `dev` manages an account on `market/dev`, and not one that
+* holds `market/prod` too. One that holds nothing, only the person who
+* admitted it: anyone else's token for it would read whatever it is given
+* next. Those who run the instance manage every one.
+*/
+function managesService(holder, setting, actor, account) {
+	if (runsInstance(holder)) return true;
+	if (account.grants.length === 0) return setting !== null && account.admittedBy === actor;
+	return account.grants.every((grant) => givesService(holder, setting, grant.role, grant.place));
+}
+/**
+* Whether `holder`, the member `actor`, may issue a token or a trust
+* binding of `account` whose scope is `scope`: they manage the account
+* (`managesService`), and each grant of the scope is one they could give it
+* (`givesService`) and one it holds, every permission of its role there.
+* For an account that holds `developer` on `market/dev`, a Developer of
+* `dev` issues `developer` or `viewer` there; nobody issues `market/prod`
+* for it, or `maintainer` on `market/dev`, until the account holds them.
+*/
+function issuesCredential(holder, setting, actor, account, scope) {
+	if (!managesService(holder, setting, actor, account)) return false;
+	const held = {
+		...NOTHING,
+		grants: account.grants.map(({ role, place }) => ({
+			projectId: place.projectId,
+			environmentId: place.environmentId ?? null,
+			role
+		}))
+	};
+	return scope.every(({ role, place }) => givesService(holder, setting, role, place) && ROLES[role].permissions.every((permission) => allows(held, permission, place)));
+}
+/**
+* Whether the holder reads the whole log, the instance's own entries
+* (sign-ins, people, service accounts, settings) with every project's, and
+* verifies it: whoever holds `audit.read` by an instance role whose scope
+* narrows nothing, an Auditor's included, and a root admin. Reading, not
+* running: an Auditor of the whole instance changes nothing it reads about.
+* Anyone else reads the places they hold `audit.read` in.
+*/
+function readsWholeLog(holder) {
+	return holder.isRootAdmin || instanceRoleGrants(holder.role, "audit.read") && unscoped(holder.scope);
+}
+/**
+* Whether the holder may make a project: an Admin or Owner whose scope
+* takes the new one in as a whole. A scope listing only some projects does
+* not list the new one; one that keeps only some environments does not
+* hold the project around them.
+*/
+function makesProjects(holder) {
+	if (holder.isRootAdmin) return true;
+	const { projects, environments } = holder.scope;
+	return administers(holder.role) && environments === "all" && (projects === "all" || "except" in projects);
+}
+//#endregion
+export { roleGrants as A, isScope as C, mayManageAccess as D, managesService as E, convertEveryProjectGrants as F, scopeInWords as M, setsUpServices as N, normalScope as O, unscoped as P, isRole as S, makesProjects as T, grantKind as _, NOTHING as a, isCredentialScope as b, ROLES as c, admits as d, allows as f, givesService as g, credentialScopeInWords as h, MAX_SCOPE_PLACES as i, runsInstance as j, readsWholeLog as k, ROLE_NAMES as l, covers as m, INSTANCE_ROLES as n, PERMISSIONS as o, assignableToEnvironment as p, INSTANCE_ROLE_NAMES as r, PROJECT_ONLY_PERMISSIONS as s, EVERYWHERE as t, administers as u, inScope as v, issuesCredential as w, isInstanceRole as x, instanceRoleGrants as y };

package/dist/access.d.ts

@@ -1,136 +1,2 @@
-//#region src/access.d.ts
-/**
- * Who may do what: seven permissions and the six roles that bundle them.
- *
- * Deliberately constants and not tables or a policy language. A grant names
- * one role for one member on one place, and a check is a lookup in this file,
- * so authorisation stays something you can read end to end.
- */
-export declare const PERMISSIONS: readonly ["secret.read", "secret.write", "secret.archive", "audit.read", "environment.manage", "grant.manage", "project.manage"];
-export type Permission = (typeof PERMISSIONS)[number];
-/**
- * Permissions that only make sense on a project. Granting
- * `environment.manage` on one environment would be incoherent: what it
- * authorises is creating that environment's siblings.
- */
-export declare const PROJECT_ONLY_PERMISSIONS: readonly Permission[];
-export declare const ROLES: {
-  readonly viewer: {
-    readonly name: "Viewer";
-    readonly description: "Read secret values.";
-    readonly permissions: readonly ["secret.read"];
-  };
-  readonly developer: {
-    readonly name: "Developer";
-    readonly description: "Read and write secrets.";
-    readonly permissions: readonly ["secret.read", "secret.write"];
-  };
-  readonly maintainer: {
-    readonly name: "Maintainer";
-    readonly description: "Read, write and retire secrets, and manage environments.";
-    readonly permissions: readonly ["secret.read", "secret.write", "secret.archive", "environment.manage"];
-  };
-  readonly 'access-manager': {
-    readonly name: "Access manager";
-    readonly description: "Manage who has access. Cannot read secret values.";
-    readonly permissions: readonly ["grant.manage"];
-  };
-  readonly auditor: {
-    readonly name: "Auditor";
-    readonly description: "Read the audit log. Cannot read secret values.";
-    readonly permissions: readonly ["audit.read"];
-  };
-  readonly owner: {
-    readonly name: "Owner";
-    readonly description: "Everything, including reading secret values.";
-    readonly permissions: readonly ["secret.read", "secret.write", "secret.archive", "audit.read", "environment.manage", "grant.manage", "project.manage"];
-  };
-};
-export type Role = keyof typeof ROLES;
-export declare const ROLE_NAMES: Role[];
-export declare function isRole(value: string): value is Role;
-export declare function roleGrants(role: Role, permission: Permission): boolean;
-/** Roles that hold a project-only permission can only be granted on a project. */
-export declare function assignableToEnvironment(role: Role): boolean;
-/**
- * A place a permission applies to: a project, or one of its environments,
- * named by its slug too, which grants on every project match by. A slug
- * not read (null) matches no grant on a slug.
- */
-export type Place = {
-  projectId: string;
-  environmentId?: null;
-} | {
-  projectId: string;
-  environmentId: string;
-  environmentSlug: string | null;
-};
-/**
- * Where a grant applies, by the fields it fills (`grantKind`):
- *
- *   market        projectId
- *   market/dev    projectId and environmentId
- *   *             neither: every project, the ones created later too
- *   *, on dev     environmentSlug only: the environment of that slug in every project
- */
-export type GrantPlace = {
-  /** The project, also of an environment's grant; null only on every project. */
-  projectId: string | null;
-  environmentId: string | null;
-  /** On every project, the one environment slug it covers; null for all of them, and on a project's grant. */
-  environmentSlug: string | null;
-};
-/**
- * What a grant's fields say it is on, or null when they say nothing
- * coherent: an environment without its project, as a grant whose
- * environment row is gone reads, or a slug beside an id. A grant is on
- * every project only when it names no place at all; anything else that
- * lacks a field covers nothing.
- */
-export declare function grantKind(grant: GrantPlace): 'project' | 'environment' | 'every-project' | null;
-/** Every project, as a path names it. */
-export declare const EVERY_PROJECT = "*";
-/** A grant on every project as a path: `*`, or `*` and the environment slug it covers in each. */
-export declare function everyProjectPath(environmentSlug: string | null): string;
-/**
- * What someone holds: everything a permission check reads. The app builds
- * it from what the vault says once per request; the vault builds it from
- * its own store. Both then ask the same functions below, so the rules
- * cannot drift apart.
- */
-export type Holdings = {
-  /** Named in the vault's configuration: everything, everywhere. */
-  isRootAdmin: boolean;
-  /** Root admins and active users with the instance `owner` role. */
-  isOwner: boolean;
-  /** Live grants only. */
-  grants: readonly (GrantPlace & {
-    role: Role;
-  })[];
-};
-/**
- * Whether a grant at `grant` reaches `place`:
- *
- *   market        market and each of its environments
- *   market/dev    market/dev
- *   *             every project and every environment
- *   *, on dev     each environment whose slug is dev, in every project
- *
- * An environment's grant never reaches up to its project, whether it names
- * the environment or its slug.
- */
-export declare function covers(grant: GrantPlace, place: Place): boolean;
-/**
- * Whether `holder` may do `permission` at `place`: a grant that covers it
- * gives the role's permissions there, and grants add up. Owners also manage
- * every project. `developer` on `market/prod` does not let anyone rename
- * `market`.
- */
-export declare function allows(holder: Holdings, permission: Permission, place: Place): boolean;
-/**
- * Whether the actor may manage grants at this place: on a project or its
- * environments, with `grant.manage` on the project; on every project, as an
- * instance owner or a root admin only.
- */
-export declare function mayManageAccess(actor: Holdings, place: GrantPlace): boolean;
-//#endregion
+import { A as instanceRoleGrants, B as readsWholeLog, C as allows, D as givesService, E as credentialScopeInWords, F as issuesCredential, G as unscoped, H as runsInstance, I as makesProjects, J as ConvertedGrant, K as Conversion, L as managesService, M as isInstanceRole, N as isRole, O as grantKind, P as isScope, R as mayManageAccess, S as admits, T as covers, U as scopeInWords, V as roleGrants, W as setsUpServices, X as Narrowed, Y as EveryProjectGrant, Z as convertEveryProjectGrants, _ as Role, a as Holdings, b as ServiceSetting, c as InstanceRole, d as PERMISSIONS, f as PROJECT_ONLY_PERMISSIONS, g as ROLE_NAMES, h as ROLES, i as GrantPlace, j as isCredentialScope, k as inScope, l as MAX_SCOPE_PLACES, m as Place, n as EVERYWHERE, o as INSTANCE_ROLES, p as Permission, q as ConversionInput, r as Filter, s as INSTANCE_ROLE_NAMES, t as CredentialScope, u as NOTHING, v as Scope, w as assignableToEnvironment, x as administers, y as ServiceAccount, z as normalScope } from "./access-CwsFLfTz.js";
+export { type Conversion, type ConversionInput, type ConvertedGrant, CredentialScope, EVERYWHERE, type EveryProjectGrant, Filter, GrantPlace, Holdings, INSTANCE_ROLES, INSTANCE_ROLE_NAMES, InstanceRole, MAX_SCOPE_PLACES, NOTHING, type Narrowed, PERMISSIONS, PROJECT_ONLY_PERMISSIONS, Permission, Place, ROLES, ROLE_NAMES, Role, Scope, ServiceAccount, ServiceSetting, administers, admits, allows, assignableToEnvironment, convertEveryProjectGrants, covers, credentialScopeInWords, givesService, grantKind, inScope, instanceRoleGrants, isCredentialScope, isInstanceRole, isRole, isScope, issuesCredential, makesProjects, managesService, mayManageAccess, normalScope, readsWholeLog, roleGrants, runsInstance, scopeInWords, setsUpServices, unscoped };