@coffre/core 0.6.2 → 0.7.0

package/dist/{access-DvwZzqRR.js → access-B1wpMzEB.js}

@@ -370,6 +370,24 @@ function grantKind(grant) {
 /** The most places a scope asked for names: far more than any credential needs, and a bound on what a request makes the app check. */
 const MAX_SCOPE_PLACES = 1e3;
 /**
+* Whether a personal token's scope may name `role`: one that manages no
+* access. A token acting as its person reaches their secrets and places,
+* never who holds them, so it cannot hand anyone, itself included, more
+* than it was given. A project's Owner who wants a token for all of it
+* names `maintainer`.
+*/
+function delegable(role) {
+	return !roleGrants(role, "grant.manage");
+}
+/** The roles a personal token's scope may name, in catalogue order. */
+const DELEGABLE_ROLES = ROLE_NAMES.filter(delegable);
+/**
+* The longest a personal token lasts: a week. It is for an afternoon's
+* script or agent, and whoever needs it longer makes another, as a person,
+* rather than keep one around.
+*/
+const MAX_PERSONAL_TOKEN_MINUTES = 10080;
+/**
 * A credential's scope, by path as the API names it, in words, each role
 * with its places: `developer on market/dev, api/dev; viewer on market/prod`.
 */
@@ -426,6 +444,16 @@ function allows(holder, permission, place) {
 	if (instanceRoleGrants(holder.role, permission) && inScope(holder.scope, place)) return true;
 	return holdsAt(holder.grants, permission, place);
 }
+/**
+* Whether the credential a request came in on, a scoped token or binding,
+* leaves `permission` at `place` to its holder: always, for a session. A
+* personal config's owner holds its every permission by reading its parent
+* (docs/design/forking.md), and a token of theirs is still held to the
+* role its scope names there: a viewer's token reads it, and writes nothing.
+*/
+function withinCredential(holder, permission, place) {
+	return holder.credentialScope == null || holdsAt(holder.credentialScope, permission, place);
+}
 /** Whether a grant among `grants` covers `place` with a role that holds `permission`. */
 function holdsAt(grants, permission, place) {
 	return grants.some((grant) => covers(grant, place) && roleGrants(grant.role, permission));
@@ -447,7 +475,7 @@ function mayManageAccess(actor, place) {
 * does none of these.
 */
 function runsInstance(holder) {
-	return administers(holder.role) && unscoped(holder.scope);
+	return holder.credentialScope == null && administers(holder.role) && unscoped(holder.scope);
 }
 /**
 * Whether `holder` may give a service account `role` at `place`: where
@@ -455,11 +483,12 @@ function runsInstance(holder) {
 * everything `role` does. A Developer on `market/dev` gives viewer or
 * developer there, never maintainer; a grant on `market` takes holding it
 * on all of `market`. `setting` is null for a service account, which sets
-* up none.
+* up none; a request on a credential with a scope sets none up either,
+* since what it set up would outlive it.
 */
 function givesService(holder, setting, role, place) {
 	if (mayManageAccess(holder, place)) return true;
-	return setting !== null && inScope(setting, place) && ROLES[role].permissions.every((permission) => allows(holder, permission, place));
+	return setting !== null && holder.credentialScope == null && inScope(setting, place) && ROLES[role].permissions.every((permission) => allows(holder, permission, place));
 }
 /** Whether `holder` gives a service account anything anywhere among `places`: whether they set any up. */
 function setsUpServices(holder, setting, places) {
@@ -511,7 +540,7 @@ function issuesCredential(holder, setting, actor, account, scope) {
 * Anyone else reads the places they hold `audit.read` in.
 */
 function readsWholeLog(holder) {
-	return instanceRoleGrants(holder.role, "audit.read") && unscoped(holder.scope);
+	return holder.credentialScope == null && instanceRoleGrants(holder.role, "audit.read") && unscoped(holder.scope);
 }
 /**
 * Whether the holder may make a project: an Admin or Owner whose scope
@@ -521,7 +550,7 @@ function readsWholeLog(holder) {
 */
 function makesProjects(holder) {
 	const { projects, environments } = holder.scope;
-	return administers(holder.role) && environments === "all" && (projects === "all" || "except" in projects);
+	return holder.credentialScope == null && administers(holder.role) && environments === "all" && (projects === "all" || "except" in projects);
 }
 //#endregion
-export { readsWholeLog as A, isScope as C, mayManageAccess as D, managesService as E, unscoped as F, convertEveryProjectGrants as I, runsInstance as M, scopeInWords as N, normalScope as O, setsUpServices as P, isRole as S, makesProjects as T, grantKind as _, NOTHING as a, isCredentialScope as b, ROLES as c, admits as d, allows as f, givesService as g, credentialScopeInWords as h, MAX_SCOPE_PLACES as i, roleGrants as j, ownsInstance as k, ROLE_NAMES as l, covers as m, INSTANCE_ROLES as n, PERMISSIONS as o, assignableToEnvironment as p, INSTANCE_ROLE_NAMES as r, PROJECT_ONLY_PERMISSIONS as s, EVERYWHERE as t, administers as u, inScope as v, issuesCredential as w, isInstanceRole as x, instanceRoleGrants as y };
+export { mayManageAccess as A, convertEveryProjectGrants as B, isCredentialScope as C, issuesCredential as D, isScope as E, runsInstance as F, scopeInWords as I, setsUpServices as L, ownsInstance as M, readsWholeLog as N, makesProjects as O, roleGrants as P, unscoped as R, instanceRoleGrants as S, isRole as T, credentialScopeInWords as _, MAX_PERSONAL_TOKEN_MINUTES as a, grantKind as b, PERMISSIONS as c, ROLE_NAMES as d, administers as f, covers as g, assignableToEnvironment as h, INSTANCE_ROLE_NAMES as i, normalScope as j, managesService as k, PROJECT_ONLY_PERMISSIONS as l, allows as m, EVERYWHERE as n, MAX_SCOPE_PLACES as o, admits as p, INSTANCE_ROLES as r, NOTHING as s, DELEGABLE_ROLES as t, ROLES as u, delegable as v, isInstanceRole as w, inScope as x, givesService as y, withinCredential as z };

package/dist/{access-BpcBLDW9.d.ts → access-CONhKG2P.d.ts}

@@ -293,12 +293,32 @@ declare function grantKind(grant: GrantPlace): 'project' | 'environment' | null;
  *   account   developer on market/dev, then viewer on market/prod too
  *   token     developer on market/dev, issued before market/prod
  *   request   reads and writes market/dev, never market/prod
+ *
+ * A person's personal token carries one too, each grant one they held when
+ * they made it (`delegable` roles only), and is weighed the same way
+ * against what they hold now, by their instance role or their grants.
  */
 type CredentialScope = readonly (GrantPlace & {
   role: Role;
 })[];
 /** The most places a scope asked for names: far more than any credential needs, and a bound on what a request makes the app check. */
 declare const MAX_SCOPE_PLACES = 1000;
+/**
+ * Whether a personal token's scope may name `role`: one that manages no
+ * access. A token acting as its person reaches their secrets and places,
+ * never who holds them, so it cannot hand anyone, itself included, more
+ * than it was given. A project's Owner who wants a token for all of it
+ * names `maintainer`.
+ */
+declare function delegable(role: Role): boolean;
+/** The roles a personal token's scope may name, in catalogue order. */
+declare const DELEGABLE_ROLES: readonly Role[];
+/**
+ * The longest a personal token lasts: a week. It is for an afternoon's
+ * script or agent, and whoever needs it longer makes another, as a person,
+ * rather than keep one around.
+ */
+declare const MAX_PERSONAL_TOKEN_MINUTES: number;
 /**
  * A credential's scope, by path as the API names it, in words, each role
  * with its places: `developer on market/dev, api/dev; viewer on market/prod`.
@@ -320,7 +340,13 @@ type Holdings = {
   grants: readonly (GrantPlace & {
     role: Role;
   })[];
-  /** The scope of the credential a request came in on, past which nothing reaches; absent or null for a session's. */
+  /**
+   * The scope of the credential a request came in on, past which nothing
+   * reaches; absent or null for a session's. A scope names places, so a
+   * request made with one holds nothing of the instance's own: it does not
+   * run the instance, read its whole log or make projects, whatever its
+   * holder's instance role.
+   */
   credentialScope?: CredentialScope | null;
 };
 /** Someone who holds nothing: a stranger, a removed member, a tampered row. */
@@ -342,6 +368,14 @@ declare function covers(grant: GrantPlace, place: Place): boolean;
  * `billing`.
  */
 declare function allows(holder: Holdings, permission: Permission, place: Place): boolean;
+/**
+ * Whether the credential a request came in on, a scoped token or binding,
+ * leaves `permission` at `place` to its holder: always, for a session. A
+ * personal config's owner holds its every permission by reading its parent
+ * (docs/design/forking.md), and a token of theirs is still held to the
+ * role its scope names there: a viewer's token reads it, and writes nothing.
+ */
+declare function withinCredential(holder: Holdings, permission: Permission, place: Place): boolean;
 /**
  * Whether the actor may give or take grants at this place: with
  * `grant.manage` there, from a project grant or an instance role whose
@@ -373,7 +407,8 @@ type ServiceSetting = Scope;
  * everything `role` does. A Developer on `market/dev` gives viewer or
  * developer there, never maintainer; a grant on `market` takes holding it
  * on all of `market`. `setting` is null for a service account, which sets
- * up none.
+ * up none; a request on a credential with a scope sets none up either,
+ * since what it set up would outlive it.
  */
 declare function givesService(holder: Holdings, setting: ServiceSetting | null, role: Role, place: Place): boolean;
 /** Whether `holder` gives a service account anything anywhere among `places`: whether they set any up. */
@@ -425,4 +460,4 @@ declare function readsWholeLog(holder: Holdings): boolean;
  */
 declare function makesProjects(holder: Holdings): boolean;
 //#endregion
-export { instanceRoleGrants as A, ownsInstance as B, allows as C, givesService as D, credentialScopeInWords as E, issuesCredential as F, setsUpServices as G, roleGrants as H, makesProjects as I, ConversionInput as J, unscoped as K, managesService as L, isInstanceRole as M, isRole as N, grantKind as O, isScope as P, convertEveryProjectGrants as Q, mayManageAccess as R, admits as S, covers as T, runsInstance as U, readsWholeLog as V, scopeInWords as W, EveryProjectGrant as X, ConvertedGrant as Y, Narrowed as Z, Role as _, Holdings as a, ServiceSetting as b, InstanceRole as c, PERMISSIONS as d, PROJECT_ONLY_PERMISSIONS as f, ROLE_NAMES as g, ROLES as h, GrantPlace as i, isCredentialScope as j, inScope as k, MAX_SCOPE_PLACES as l, Place as m, EVERYWHERE as n, INSTANCE_ROLES as o, Permission as p, Conversion as q, Filter as r, INSTANCE_ROLE_NAMES as s, CredentialScope as t, NOTHING as u, Scope as v, assignableToEnvironment as w, administers as x, ServiceAccount as y, normalScope as z };
+export { ConvertedGrant as $, givesService as A, managesService as B, administers as C, covers as D, assignableToEnvironment as E, isInstanceRole as F, roleGrants as G, normalScope as H, isRole as I, setsUpServices as J, runsInstance as K, isScope as L, inScope as M, instanceRoleGrants as N, credentialScopeInWords as O, isCredentialScope as P, ConversionInput as Q, issuesCredential as R, ServiceSetting as S, allows as T, ownsInstance as U, mayManageAccess as V, readsWholeLog as W, withinCredential as X, unscoped as Y, Conversion as Z, ROLES as _, GrantPlace as a, Scope as b, INSTANCE_ROLE_NAMES as c, MAX_SCOPE_PLACES as d, EveryProjectGrant as et, NOTHING as f, Place as g, Permission as h, Filter as i, grantKind as j, delegable as k, InstanceRole as l, PROJECT_ONLY_PERMISSIONS as m, DELEGABLE_ROLES as n, convertEveryProjectGrants as nt, Holdings as o, PERMISSIONS as p, scopeInWords as q, EVERYWHERE as r, INSTANCE_ROLES as s, CredentialScope as t, Narrowed as tt, MAX_PERSONAL_TOKEN_MINUTES as u, ROLE_NAMES as v, admits as w, ServiceAccount as x, Role as y, makesProjects as z };

package/dist/access.d.ts

@@ -1,2 +1,2 @@
-import { A as instanceRoleGrants, B as ownsInstance, C as allows, D as givesService, E as credentialScopeInWords, F as issuesCredential, G as setsUpServices, H as roleGrants, I as makesProjects, J as ConversionInput, K as unscoped, L as managesService, M as isInstanceRole, N as isRole, O as grantKind, P as isScope, Q as convertEveryProjectGrants, R as mayManageAccess, S as admits, T as covers, U as runsInstance, V as readsWholeLog, W as scopeInWords, X as EveryProjectGrant, Y as ConvertedGrant, Z as Narrowed, _ as Role, a as Holdings, b as ServiceSetting, c as InstanceRole, d as PERMISSIONS, f as PROJECT_ONLY_PERMISSIONS, g as ROLE_NAMES, h as ROLES, i as GrantPlace, j as isCredentialScope, k as inScope, l as MAX_SCOPE_PLACES, m as Place, n as EVERYWHERE, o as INSTANCE_ROLES, p as Permission, q as Conversion, r as Filter, s as INSTANCE_ROLE_NAMES, t as CredentialScope, u as NOTHING, v as Scope, w as assignableToEnvironment, x as administers, y as ServiceAccount, z as normalScope } from "./access-BpcBLDW9.js";
-export { type Conversion, type ConversionInput, type ConvertedGrant, CredentialScope, EVERYWHERE, type EveryProjectGrant, Filter, GrantPlace, Holdings, INSTANCE_ROLES, INSTANCE_ROLE_NAMES, InstanceRole, MAX_SCOPE_PLACES, NOTHING, type Narrowed, PERMISSIONS, PROJECT_ONLY_PERMISSIONS, Permission, Place, ROLES, ROLE_NAMES, Role, Scope, ServiceAccount, ServiceSetting, administers, admits, allows, assignableToEnvironment, convertEveryProjectGrants, covers, credentialScopeInWords, givesService, grantKind, inScope, instanceRoleGrants, isCredentialScope, isInstanceRole, isRole, isScope, issuesCredential, makesProjects, managesService, mayManageAccess, normalScope, ownsInstance, readsWholeLog, roleGrants, runsInstance, scopeInWords, setsUpServices, unscoped };
+import { $ as ConvertedGrant, A as givesService, B as managesService, C as administers, D as covers, E as assignableToEnvironment, F as isInstanceRole, G as roleGrants, H as normalScope, I as isRole, J as setsUpServices, K as runsInstance, L as isScope, M as inScope, N as instanceRoleGrants, O as credentialScopeInWords, P as isCredentialScope, Q as ConversionInput, R as issuesCredential, S as ServiceSetting, T as allows, U as ownsInstance, V as mayManageAccess, W as readsWholeLog, X as withinCredential, Y as unscoped, Z as Conversion, _ as ROLES, a as GrantPlace, b as Scope, c as INSTANCE_ROLE_NAMES, d as MAX_SCOPE_PLACES, et as EveryProjectGrant, f as NOTHING, g as Place, h as Permission, i as Filter, j as grantKind, k as delegable, l as InstanceRole, m as PROJECT_ONLY_PERMISSIONS, n as DELEGABLE_ROLES, nt as convertEveryProjectGrants, o as Holdings, p as PERMISSIONS, q as scopeInWords, r as EVERYWHERE, s as INSTANCE_ROLES, t as CredentialScope, tt as Narrowed, u as MAX_PERSONAL_TOKEN_MINUTES, v as ROLE_NAMES, w as admits, x as ServiceAccount, y as Role, z as makesProjects } from "./access-CONhKG2P.js";
+export { type Conversion, type ConversionInput, type ConvertedGrant, CredentialScope, DELEGABLE_ROLES, EVERYWHERE, type EveryProjectGrant, Filter, GrantPlace, Holdings, INSTANCE_ROLES, INSTANCE_ROLE_NAMES, InstanceRole, MAX_PERSONAL_TOKEN_MINUTES, MAX_SCOPE_PLACES, NOTHING, type Narrowed, PERMISSIONS, PROJECT_ONLY_PERMISSIONS, Permission, Place, ROLES, ROLE_NAMES, Role, Scope, ServiceAccount, ServiceSetting, administers, admits, allows, assignableToEnvironment, convertEveryProjectGrants, covers, credentialScopeInWords, delegable, givesService, grantKind, inScope, instanceRoleGrants, isCredentialScope, isInstanceRole, isRole, isScope, issuesCredential, makesProjects, managesService, mayManageAccess, normalScope, ownsInstance, readsWholeLog, roleGrants, runsInstance, scopeInWords, setsUpServices, unscoped, withinCredential };

package/dist/access.js

@@ -1,2 +1,2 @@
-import { A as readsWholeLog, C as isScope, D as mayManageAccess, E as managesService, F as unscoped, I as convertEveryProjectGrants, M as runsInstance, N as scopeInWords, O as normalScope, P as setsUpServices, S as isRole, T as makesProjects, _ as grantKind, a as NOTHING, b as isCredentialScope, c as ROLES, d as admits, f as allows, g as givesService, h as credentialScopeInWords, i as MAX_SCOPE_PLACES, j as roleGrants, k as ownsInstance, l as ROLE_NAMES, m as covers, n as INSTANCE_ROLES, o as PERMISSIONS, p as assignableToEnvironment, r as INSTANCE_ROLE_NAMES, s as PROJECT_ONLY_PERMISSIONS, t as EVERYWHERE, u as administers, v as inScope, w as issuesCredential, x as isInstanceRole, y as instanceRoleGrants } from "./access-DvwZzqRR.js";
-export { EVERYWHERE, INSTANCE_ROLES, INSTANCE_ROLE_NAMES, MAX_SCOPE_PLACES, NOTHING, PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, administers, admits, allows, assignableToEnvironment, convertEveryProjectGrants, covers, credentialScopeInWords, givesService, grantKind, inScope, instanceRoleGrants, isCredentialScope, isInstanceRole, isRole, isScope, issuesCredential, makesProjects, managesService, mayManageAccess, normalScope, ownsInstance, readsWholeLog, roleGrants, runsInstance, scopeInWords, setsUpServices, unscoped };
+import { A as mayManageAccess, B as convertEveryProjectGrants, C as isCredentialScope, D as issuesCredential, E as isScope, F as runsInstance, I as scopeInWords, L as setsUpServices, M as ownsInstance, N as readsWholeLog, O as makesProjects, P as roleGrants, R as unscoped, S as instanceRoleGrants, T as isRole, _ as credentialScopeInWords, a as MAX_PERSONAL_TOKEN_MINUTES, b as grantKind, c as PERMISSIONS, d as ROLE_NAMES, f as administers, g as covers, h as assignableToEnvironment, i as INSTANCE_ROLE_NAMES, j as normalScope, k as managesService, l as PROJECT_ONLY_PERMISSIONS, m as allows, n as EVERYWHERE, o as MAX_SCOPE_PLACES, p as admits, r as INSTANCE_ROLES, s as NOTHING, t as DELEGABLE_ROLES, u as ROLES, v as delegable, w as isInstanceRole, x as inScope, y as givesService, z as withinCredential } from "./access-B1wpMzEB.js";
+export { DELEGABLE_ROLES, EVERYWHERE, INSTANCE_ROLES, INSTANCE_ROLE_NAMES, MAX_PERSONAL_TOKEN_MINUTES, MAX_SCOPE_PLACES, NOTHING, PERMISSIONS, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_NAMES, administers, admits, allows, assignableToEnvironment, convertEveryProjectGrants, covers, credentialScopeInWords, delegable, givesService, grantKind, inScope, instanceRoleGrants, isCredentialScope, isInstanceRole, isRole, isScope, issuesCredential, makesProjects, managesService, mayManageAccess, normalScope, ownsInstance, readsWholeLog, roleGrants, runsInstance, scopeInWords, setsUpServices, unscoped, withinCredential };

package/dist/envelope.d.ts

@@ -1,4 +1,4 @@
-import { d as checkContext, f as encodeAad, l as AAD_VERSION, t as KekRegistry, u as SecretContext } from "./registry-C0NGpxcc.js";
+import { d as checkContext, f as encodeAad, l as AAD_VERSION, p as ownerKey, t as KekRegistry, u as SecretContext } from "./registry-Bd7hPoY4.js";
 //#region src/envelope.d.ts
 /**
  * Current envelope format version. Stored on every row so the format can change
@@ -47,4 +47,4 @@ export declare function seal(plaintext: Buffer, ctx: SecretContext, keks: KekReg
 /** Unwrap the envelope's DEK under the registry and decrypt: `decrypt` and the unwrap in one. */
 export declare function open(envelope: Envelope, ctx: SecretContext, keks: KekRegistry): Promise<Buffer>;
 //#endregion
-export { AAD_VERSION, SecretContext, checkContext, encodeAad };
+export { AAD_VERSION, SecretContext, checkContext, encodeAad, ownerKey };

package/dist/envelope.js

@@ -1,4 +1,4 @@
-import { a as AAD_VERSION, o as checkContext, s as encodeAad } from "./types-Mi7-Tzj9.js";
+import { a as AAD_VERSION, c as ownerKey, o as checkContext, s as encodeAad } from "./types-E1Sz50n6.js";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 //#region src/envelope.ts
 const IV_BYTES = 12;
@@ -80,4 +80,4 @@ async function open(envelope, ctx, keks) {
 	}
 }
 //#endregion
-export { AAD_VERSION, ENVELOPE_VERSION, checkContext, decrypt, encodeAad, encrypt, freshDek, open, seal };
+export { AAD_VERSION, ENVELOPE_VERSION, checkContext, decrypt, encodeAad, encrypt, freshDek, open, ownerKey, seal };

package/dist/identity.d.ts

@@ -1,4 +1,4 @@
-import { BindingClaims, BindingInvalid, BindingPolicy, ClaimValue, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, REQUIRED_CLAIMS, Starts, WORKLOAD_PROFILES, WorkloadProfile, canonicalClaims, checkBinding, checkFetchUrl, claimValues, defaultIssuer, differingClaims, fullRef, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, workflowRef } from "./workloads.js";
+import { BindingClaims, BindingInvalid, BindingPolicy, ClaimValue, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_ISSUER_BYTES, REQUIRED_CLAIMS, Starts, WORKLOAD_PROFILES, WorkloadProfile, canonicalClaims, checkBinding, checkFetchUrl, claimAt, claimValues, defaultIssuer, differingClaims, fullRef, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, workflowRef } from "./workloads.js";
 import { JSONWebKeySet, JWTPayload } from "jose";
 //#region src/identity/github-app.d.ts
 /**
@@ -604,8 +604,9 @@ export declare function unseal<T>(key: Uint8Array, sealed: string | undefined |
 //#endregion
 //#region src/identity/tokens.d.ts
 /**
- * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
- * service tokens.
+ * Bearer credentials coffre issues itself: browser sessions, CLI sessions,
+ * service tokens, and personal tokens, which act as the person who made
+ * them within the scope they named.
  *
  * A token is a kind prefix and 32 random bytes, e.g.
  * `coffre_cli_Qm9Y...`. The prefix tells a person (or a secret scanner) what a
@@ -614,7 +615,7 @@ export declare function unseal<T>(key: Uint8Array, sealed: string | undefined |
  * right tool here, unlike for passwords: 256 bits of randomness leave nothing
  * to brute-force.
  */
-export type CredentialKind = 'browser' | 'cli' | 'service';
+export type CredentialKind = 'browser' | 'cli' | 'service' | 'personal';
 export declare function generateToken(kind: CredentialKind): string;
 /** Whether a string has the shape of a coffre token, before any lookup. */
 export declare function isCoffreToken(value: string): boolean;
@@ -683,6 +684,8 @@ export type WorkloadRefusal =
 'expired' |
 /** Its `iat` is more than an hour ago, or not yet. */
 'too_old' |
+/** It lives longer than an hour, `exp` − `iat`, where its binding carries its keys. */
+'too_long' |
 /** Its `nbf` is still to come. */
 'not_yet_valid' |
 /** Its audience is not this instance alone. */
@@ -715,12 +718,14 @@ export declare function decodeWorkloadToken(token: string): DecodedToken;
  * algorithms fixed and nothing taken from the header but `alg` and `kid`;
  * the issuer exactly; `exp`, `nbf` and `iat` within the tolerance, `iat` at
  * most an hour old; and the audience, this instance's public URL alone.
- * Returns the verified claims.
+ * With `maxLifetime`, in seconds, a token whose `exp` is further than that
+ * from its `iat` is refused too. Returns the verified claims.
  */
 export declare function verifyWorkloadToken(token: string, keys: JSONWebKeySet, expected: {
   issuer: string;
   audience: string;
   now: Date;
+  maxLifetime?: number;
 }): Promise<JWTPayload & DecodedToken['claims']>;
 /**
  * Why a token issued at `iat` may not be exchanged at `now`, both in
@@ -729,5 +734,42 @@ export declare function verifyWorkloadToken(token: string, keys: JSONWebKeySet,
  * both ask it.
  */
 export declare function issuedRefusal(iat: number, now: number): WorkloadTokenRefused | null;
+/** At most this many keys in a set, fetched or uploaded. */
+export declare const MAX_KEYS = 32;
+/** One key of an uploaded set, as an owner sees it: its `kid`, its algorithm, and its RFC 7638 thumbprint. */
+export type KeySummary = {
+  kid: string | null;
+  alg: (typeof WORKLOAD_ALGORITHMS)[number];
+  thumbprint: string;
+};
+/**
+ * A key set uploaded with a binding, as the binding keeps it: its public
+ * keys alone, as canonical JSON, and that JSON's SHA-256, in hex, which
+ * stands in the binding where a URL would and so is under its MAC.
+ */
+export type UploadedKeys = {
+  jwks: string;
+  digest: string;
+  keys: KeySummary[];
+};
+/** A key set that cannot be uploaded, said so an owner can fix it. */
+export declare class KeysInvalid extends Error {
+  constructor(message: string);
+}
+/**
+ * An issuer's public keys, as uploaded for a binding: a JWKS, `{ "keys": [
+ * … ] }`, of RSA keys of 2048 bits or more, for RS256, and P-256 keys, for
+ * ES256, each kept with only the members that verify (`kty`, `kid`, `use`,
+ * `alg` and the key), in the order of their thumbprints, so that one set
+ * however listed has one digest. An RSA key's parameters are checked
+ * before jose sees them, since it takes some that verify anything: an
+ * exponent of 1 makes every signature its message. Keys for encryption are
+ * left out, as from a fetched set; a private or a symmetric key refuses the
+ * whole set, since coffre keeps no secret of an issuer's. Throws
+ * `KeysInvalid`.
+ */
+export declare function uploadedKeys(value: unknown): Promise<UploadedKeys>;
+/** The keys of a set `uploadedKeys` kept, as an owner sees them. */
+export declare function keySummaries(jwks: string): KeySummary[];
 //#endregion
-export { BindingClaims, BindingInvalid, BindingPolicy, ClaimValue, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, type JSONWebKeySet, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, REQUIRED_CLAIMS, Starts, WORKLOAD_PROFILES, WorkloadProfile, canonicalClaims, checkBinding, checkFetchUrl, claimValues, defaultIssuer, differingClaims, fullRef, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, workflowRef };
+export { BindingClaims, BindingInvalid, BindingPolicy, ClaimValue, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, type JSONWebKeySet, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_ISSUER_BYTES, REQUIRED_CLAIMS, Starts, WORKLOAD_PROFILES, WorkloadProfile, canonicalClaims, checkBinding, checkFetchUrl, claimAt, claimValues, defaultIssuer, differingClaims, fullRef, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, workflowRef };

package/dist/identity.js

@@ -1,7 +1,7 @@
-import { BindingInvalid, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, REQUIRED_CLAIMS, WORKLOAD_PROFILES, canonicalClaims, checkBinding, checkFetchUrl, claimValues, defaultIssuer, differingClaims, fullRef, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, workflowRef } from "./workloads.js";
+import { BindingInvalid, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_ISSUER_BYTES, REQUIRED_CLAIMS, WORKLOAD_PROFILES, canonicalClaims, checkBinding, checkFetchUrl, claimAt, claimValues, defaultIssuer, differingClaims, fullRef, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, workflowRef } from "./workloads.js";
 import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from "node:crypto";
 import * as oauth from "oauth4webapi";
-import { createLocalJWKSet, createRemoteJWKSet, errors, jwtVerify } from "jose";
+import { createLocalJWKSet, createRemoteJWKSet, errors, importJWK, jwtVerify } from "jose";
 //#region src/identity/github-app.ts
 /** GitHub could not be asked, or refused the app: the message says which, for a person, and carries no credential. */
 var GitHubAppUnavailable = class extends Error {
@@ -996,9 +996,10 @@ function unseal(key, sealed, now = Date.now()) {
 const PREFIX = {
 	browser: "coffre_web_",
 	cli: "coffre_cli_",
-	service: "coffre_svc_"
+	service: "coffre_svc_",
+	personal: "coffre_pat_"
 };
-const TOKEN = /^coffre_(web|cli|svc)_[A-Za-z0-9_-]{43}$/;
+const TOKEN = /^coffre_(web|cli|svc|pat)_[A-Za-z0-9_-]{43}$/;
 function generateToken(kind) {
 	return PREFIX[kind] + randomBytes(32).toString("base64url");
 }
@@ -1154,28 +1155,32 @@ function decodeWorkloadToken(token) {
 * algorithms fixed and nothing taken from the header but `alg` and `kid`;
 * the issuer exactly; `exp`, `nbf` and `iat` within the tolerance, `iat` at
 * most an hour old; and the audience, this instance's public URL alone.
-* Returns the verified claims.
+* With `maxLifetime`, in seconds, a token whose `exp` is further than that
+* from its `iat` is refused too. Returns the verified claims.
 */
 async function verifyWorkloadToken(token, keys, expected) {
+	const options = {
+		algorithms: [...WORKLOAD_ALGORITHMS],
+		issuer: expected.issuer,
+		clockTolerance: 30,
+		requiredClaims: [
+			"iss",
+			"sub",
+			"exp",
+			"iat"
+		],
+		currentDate: expected.now
+	};
 	let payload;
 	try {
-		({payload} = await jwtVerify(token, createLocalJWKSet(keys), {
-			algorithms: [...WORKLOAD_ALGORITHMS],
-			issuer: expected.issuer,
-			clockTolerance: 30,
-			requiredClaims: [
-				"iss",
-				"sub",
-				"exp",
-				"iat"
-			],
-			currentDate: expected.now
-		}));
+		({payload} = await jwtVerify(token, createLocalJWKSet(keys), options));
 	} catch (error) {
-		throw refusalOf(error);
+		if (!(error instanceof errors.JWKSMultipleMatchingKeys)) throw refusalOf(error);
+		payload = await anyKey(token, error, options);
 	}
 	const issued = issuedRefusal(payload.iat, expected.now.getTime() / 1e3);
 	if (issued !== null) throw issued;
+	if (expected.maxLifetime !== void 0 && payload.exp - payload.iat > expected.maxLifetime) throw new WorkloadTokenRefused("too_long", `the token lives longer than ${expected.maxLifetime / 60} minutes, from its iat to its exp: ask for a shorter one`);
 	const { aud } = payload;
 	if (!(aud === expected.audience || Array.isArray(aud) && aud.length === 1 && aud[0] === expected.audience)) throw new WorkloadTokenRefused("audience", `the token is for ${JSON.stringify(aud ?? null)}, not ${expected.audience} alone`);
 	return payload;
@@ -1191,6 +1196,19 @@ function issuedRefusal(iat, now) {
 	if (iat - now > 30) return new WorkloadTokenRefused("too_old", "the token says it was issued in the future");
 	return null;
 }
+/**
+* A token that names no key, or one several keys share, verified by
+* whichever of them signed it: a set may hold several, as while its issuer
+* rotates. At most `MAX_KEYS` tries, each a signature check alone.
+*/
+async function anyKey(token, matching, options) {
+	for await (const key of matching) try {
+		return (await jwtVerify(token, key, options)).payload;
+	} catch (error) {
+		if (!(error instanceof errors.JWSSignatureVerificationFailed)) throw refusalOf(error);
+	}
+	throw new WorkloadTokenRefused("signature", "the token's signature does not verify");
+}
 function refusalOf(error) {
 	if (error instanceof errors.JWKSNoMatchingKey) return new WorkloadTokenRefused("unknown_key", "the token's key is not among the issuer's");
 	if (error instanceof errors.JWTExpired) return error.claim === "iat" ? new WorkloadTokenRefused("too_old", `the token was issued more than ${MAX_TOKEN_AGE_SECONDS / 60} minutes ago`) : new WorkloadTokenRefused("expired", "the token has expired");
@@ -1205,5 +1223,137 @@ function refusalOf(error) {
 	if (error instanceof errors.JOSEError) return new WorkloadTokenRefused("signature", `the token does not verify: ${error.code}`);
 	return new WorkloadTokenRefused("signature", "the token does not verify");
 }
+/** At most this many keys in a set, fetched or uploaded. */
+const MAX_KEYS = 32;
+/** A key set that cannot be uploaded, said so an owner can fix it. */
+var KeysInvalid = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "KeysInvalid";
+	}
+};
+/** Members that only a private or a symmetric key has. */
+const PRIVATE_MEMBERS = [
+	"d",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"oth",
+	"k"
+];
+/**
+* An issuer's public keys, as uploaded for a binding: a JWKS, `{ "keys": [
+* … ] }`, of RSA keys of 2048 bits or more, for RS256, and P-256 keys, for
+* ES256, each kept with only the members that verify (`kty`, `kid`, `use`,
+* `alg` and the key), in the order of their thumbprints, so that one set
+* however listed has one digest. An RSA key's parameters are checked
+* before jose sees them, since it takes some that verify anything: an
+* exponent of 1 makes every signature its message. Keys for encryption are
+* left out, as from a fetched set; a private or a symmetric key refuses the
+* whole set, since coffre keeps no secret of an issuer's. Throws
+* `KeysInvalid`.
+*/
+async function uploadedKeys(value) {
+	const listed = value?.keys;
+	if (typeof value !== "object" || value === null || !Array.isArray(listed)) throw new KeysInvalid("the keys are a JWKS: { \"keys\": [ … ] }");
+	if (listed.length > 32) throw new KeysInvalid(`a key set holds at most 32 keys`);
+	const keys = [];
+	for (const [i, given] of listed.entries()) {
+		if (typeof given !== "object" || given === null || Array.isArray(given)) throw new KeysInvalid(`key ${i + 1} is not a JWK`);
+		const jwk = given;
+		const named = typeof jwk.kid === "string" ? `key ${jwk.kid}` : `key ${i + 1}`;
+		if (PRIVATE_MEMBERS.some((member) => member in jwk)) throw new KeysInvalid(`${named} is a private or a secret key: upload the issuer's public keys only`);
+		if (jwk.use === "enc") continue;
+		if (jwk.use !== void 0 && jwk.use !== "sig") throw new KeysInvalid(`${named} has use ${JSON.stringify(jwk.use)}: sig, or none`);
+		if (jwk.kid !== void 0 && (typeof jwk.kid !== "string" || jwk.kid === "" || jwk.kid.length > 256)) throw new KeysInvalid(`key ${i + 1}'s kid is not a string`);
+		if (jwk.kid !== void 0 && keys.some((key) => key.kid === jwk.kid)) throw new KeysInvalid(`two keys are ${named}`);
+		let alg;
+		let key;
+		if (jwk.kty === "RSA" && (jwk.alg === void 0 || jwk.alg === "RS256")) {
+			alg = "RS256";
+			const [n, e] = [integer(jwk.n), integer(jwk.e)];
+			if (n === null || e === null) throw new KeysInvalid(`${named} is an RSA key without n and e, each a base64url integer in its fewest bytes`);
+			if (n.toString(2).length < 2048) throw new KeysInvalid(`${named} is an RSA key under 2048 bits`);
+			if (n % 2n === 0n) throw new KeysInvalid(`${named} is not a valid RSA key`);
+			if (e % 2n === 0n || e <= 65536n || e >= 2n ** 256n) throw new KeysInvalid(`${named}'s exponent is not one an RSA key signs with: odd, from 65537`);
+			key = {
+				kty: "RSA",
+				...kidAndUse(jwk),
+				alg,
+				n: jwk.n,
+				e: jwk.e
+			};
+		} else if (jwk.kty === "EC" && jwk.crv === "P-256" && (jwk.alg === void 0 || jwk.alg === "ES256")) {
+			alg = "ES256";
+			if (!coordinate(jwk.x) || !coordinate(jwk.y)) throw new KeysInvalid(`${named} is an EC key without x and y, each 32 bytes in base64url`);
+			key = {
+				kty: "EC",
+				...kidAndUse(jwk),
+				alg,
+				crv: "P-256",
+				x: jwk.x,
+				y: jwk.y
+			};
+		} else throw new KeysInvalid(`${named} is not an RSA key for RS256 or a P-256 key for ES256, the two coffre accepts`);
+		try {
+			await importJWK(key, alg);
+		} catch {
+			throw new KeysInvalid(`${named} is not a valid ${key.kty} key`);
+		}
+		keys.push(key);
+	}
+	if (keys.length === 0) throw new KeysInvalid("the key set holds no key that signs");
+	const sorted = keys.map((key) => [`${thumbprint(key)} ${JSON.stringify(key)}`, key]).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+	const jwks = JSON.stringify({ keys: sorted.map(([, key]) => key) });
+	return {
+		jwks,
+		digest: createHash("sha256").update(jwks, "utf8").digest("hex"),
+		keys: keySummaries(jwks)
+	};
+}
+/** The keys of a set `uploadedKeys` kept, as an owner sees them. */
+function keySummaries(jwks) {
+	return JSON.parse(jwks).keys.map((key) => ({
+		kid: key.kid ?? null,
+		alg: key.kty === "RSA" ? "RS256" : "ES256",
+		thumbprint: thumbprint(key)
+	}));
+}
+/** A key's RFC 7638 thumbprint: the SHA-256 of its required members alone, in lexicographic order. */
+function thumbprint(key) {
+	const required = key.kty === "RSA" ? {
+		e: key.e,
+		kty: key.kty,
+		n: key.n
+	} : {
+		crv: key.crv,
+		kty: key.kty,
+		x: key.x,
+		y: key.y
+	};
+	return createHash("sha256").update(JSON.stringify(required), "utf8").digest("base64url");
+}
+const BASE64URL = /^[A-Za-z0-9_-]+$/;
+/** A P-256 coordinate as JWK writes one: 32 bytes, in base64url exactly, so that one key has one spelling. */
+function coordinate(value) {
+	if (typeof value !== "string" || !BASE64URL.test(value)) return false;
+	const bytes = Buffer.from(value, "base64url");
+	return bytes.length === 32 && bytes.toString("base64url") === value;
+}
+/** An unsigned integer as JWK writes one, base64url in its fewest bytes; null for anything else. */
+function integer(value) {
+	if (typeof value !== "string" || !BASE64URL.test(value)) return null;
+	const bytes = Buffer.from(value, "base64url");
+	if (bytes.length === 0 || bytes[0] === 0 || bytes.toString("base64url") !== value) return null;
+	return BigInt(`0x${bytes.toString("hex")}`);
+}
+function kidAndUse(jwk) {
+	return {
+		...jwk.kid === void 0 ? {} : { kid: jwk.kid },
+		...jwk.use === void 0 ? {} : { use: "sig" }
+	};
+}
 //#endregion
-export { ACCESS_JWT_HEADER, AccessIdentityVerifier, BindingInvalid, CLOCK_TOLERANCE_SECONDS, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, GitHubApp, GitHubAppUnavailable, GitHubSigninProvider, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_LISTING_REQUESTS, MAX_TOKEN_AGE_SECONDS, MAX_TOKEN_BYTES, OidcSigninProvider, REQUIRED_CLAIMS, SigninError, TOKEN_MARGIN_MS, WORKLOAD_ALGORITHMS, WORKLOAD_PROFILES, WorkloadTokenRefused, canonicalClaims, checkBinding, checkFetchUrl, claimValues, cloudflareAccess, decodeWorkloadToken, defaultIssuer, defineSignin, deriveKey, differingClaims, fullRef, generateToken, github, githubApp, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, google, hashToken, isCoffreToken, issuedRefusal, microsoft, oidc, pkcs8Of, publicOrigin, seal, signin, toPrincipal, tokenHint, tokenKind, unseal, verifyWorkloadToken, workflowRef };
+export { ACCESS_JWT_HEADER, AccessIdentityVerifier, BindingInvalid, CLOCK_TOLERANCE_SECONDS, EVENT_EXPOSURE, GITHUB_EVENTS, GITHUB_ISSUER, GITLAB_ISSUER, GITLAB_PIPELINE_SOURCES, GitHubApp, GitHubAppUnavailable, GitHubSigninProvider, KeysInvalid, MAX_BINDINGS, MAX_CLAIMS, MAX_CLAIM_BYTES, MAX_ISSUER_BYTES, MAX_KEYS, MAX_LISTING_REQUESTS, MAX_TOKEN_AGE_SECONDS, MAX_TOKEN_BYTES, OidcSigninProvider, REQUIRED_CLAIMS, SigninError, TOKEN_MARGIN_MS, WORKLOAD_ALGORITHMS, WORKLOAD_PROFILES, WorkloadTokenRefused, canonicalClaims, checkBinding, checkFetchUrl, claimAt, claimValues, cloudflareAccess, decodeWorkloadToken, defaultIssuer, defineSignin, deriveKey, differingClaims, fullRef, generateToken, github, githubApp, githubEventsAt, githubReusable, githubWorkflow, gitlabProject, google, hashToken, isCoffreToken, issuedRefusal, keySummaries, microsoft, oidc, pkcs8Of, publicOrigin, seal, signin, toPrincipal, tokenHint, tokenKind, unseal, uploadedKeys, verifyWorkloadToken, workflowRef };

package/dist/kek.d.ts

@@ -1,4 +1,4 @@
-import { a as KekProvider, c as WrappedDek, i as KekCancelledError, n as DEK_BYTES, o as KekUnavailableError, r as KekBadClaimError, s as KeyOperation, t as KekRegistry, u as SecretContext } from "./registry-C0NGpxcc.js";
+import { a as KekProvider, c as WrappedDek, i as KekCancelledError, n as DEK_BYTES, o as KekUnavailableError, r as KekBadClaimError, s as KeyOperation, t as KekRegistry, u as SecretContext } from "./registry-Bd7hPoY4.js";
 //#region src/kek/local.d.ts
 /**
  * A KEK held in local process memory, loaded from configuration.

package/dist/kek.js

@@ -1,5 +1,5 @@
 import { deriveLogKey } from "./audit.js";
-import { i as KekUnavailableError, n as KekBadClaimError, o as checkContext, r as KekCancelledError, s as encodeAad, t as DEK_BYTES } from "./types-Mi7-Tzj9.js";
+import { i as KekUnavailableError, n as KekBadClaimError, o as checkContext, r as KekCancelledError, s as encodeAad, t as DEK_BYTES } from "./types-E1Sz50n6.js";
 import { createCipheriv, createDecipheriv, createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 //#region src/kek/cancellation.ts
 function checkOperation(operation, uncertain = false) {
@@ -425,7 +425,8 @@ function encryptionContext(ctx) {
 	return {
 		"coffre:project": ctx.projectId,
 		"coffre:environment": ctx.environmentId,
-		"coffre:secret": ctx.secretId
+		"coffre:secret": ctx.secretId,
+		...ctx.owner === void 0 ? {} : { "coffre:owner": ctx.owner }
 	};
 }
 /**