@coffre/vault 0.10.2 → 0.11.0

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-B0d-W-SI.js";
-import { n as prepareVault, t as openVault } from "./vault-66Xf0Hw1.js";
+import { n as prepareVault, t as openVault } from "./vault-DEjPmLNt.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-B0d-W-SI.js";
-import { n as prepareVault, t as openVault } from "./vault-66Xf0Hw1.js";
+import { n as prepareVault, t as openVault } from "./vault-DEjPmLNt.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{vault-66Xf0Hw1.js → vault-DEjPmLNt.js}

@@ -2,7 +2,7 @@ import { ACCESS_ACTIONS, ACCESS_ACTIONS as ACCESS_ACTIONS$1, POLICY_REVISION, ch
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { prepared, tablesOf } from "@coffre/db";
-import { DEFAULT_POLICY, EVERYWHERE, EVERY_ENVIRONMENT, FIXED_ROLES, INSTANCE_ROLES, NOTHING, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_ID, UNWRITTEN_FORK_MS, allows, assignableToEnvironment, definitionProblem, givesService, grantKind, isBuiltinRole, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalDefinition, normalScope, ownsInstance, runsInstance, setsUpServices, unscoped, withinCredential } from "@coffre/core/access";
+import { DEFAULT_POLICY, EVERYWHERE, EVERY_ENVIRONMENT, FIXED_ROLES, INSTANCE_ROLES, NOTHING, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_ID, UNWRITTEN_FORK_MS, allows, assignableToEnvironment, definitionProblem, givesService, grantKind, isBuiltinRole, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalDefinition, normalScope, ownsInstance, ownsProject, readsSensitive, runsInstance, setsUpServices, unscoped, useOnly, withinCredential } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext, ownerKey } from "@coffre/core/envelope";
 import { TOMBSTONE, shownMember } from "@coffre/core/schemas";
@@ -43,6 +43,138 @@ async function signer(seed) {
 	};
 }
 //#endregion
+//#region src/decide.ts
+/**
+* Where a decision checks a permission: an environment, with its slug as
+* the store has it when it was read and is in the project claimed;
+* otherwise none, which no grant on a slug matches.
+*/
+function placeIn(place, environments) {
+	const environment = environments.get(place.environmentId);
+	const slug = environment?.projectId === place.projectId ? environment.slug : null;
+	return {
+		projectId: place.projectId,
+		environmentId: place.environmentId,
+		environmentSlug: slug
+	};
+}
+/**
+* A key of a personal config is its owner's alone (docs/design/forking.md,
+* section 4): no grant or role opens or wraps it, an Owner's included,
+* only its owner, while they read the environment it is a config of,
+* whatever the call is. Nor does any reference reach into or out of one.
+* Undefined for a key of any other environment, decided as ever.
+*/
+function personalRefusal(reader, principal, permission, secret, at, environments) {
+	const own = environments.get(secret.environmentId);
+	const elsewhere = at.environmentId !== secret.environmentId;
+	const held = elsewhere ? environments.get(at.environmentId) : own;
+	if (own?.owner == null && held?.owner == null) return void 0;
+	if (elsewhere || own === void 0 || principal !== own.owner || own.parentId === null) return "personal";
+	const parent = placeIn({
+		projectId: secret.projectId,
+		environmentId: own.parentId
+	}, environments);
+	const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
+	const refused = refuses(reader, "secret.use", parent, gone) === null ? null : refuses(reader, "secret.read", parent, gone);
+	if (refused !== null) return refused;
+	return withinCredential(reader.live, permission === "secret.read" ? "secret.use" : permission, parent) ? null : "no_grant";
+}
+/**
+* Why `reader` may not do `permission` at `where`, or null if they may. A
+* deleted place is refused before any grant is asked, so no kind of grant,
+* on the project, the environment or every project, can reach into one.
+*/
+function refuses(reader, permission, where, deleted) {
+	if (reader.status === "tampered") return "tampered";
+	if (reader.status === "removed") return "removed";
+	if (reader.status === "unknown") return "not_a_member";
+	if (deleted) return "deleted";
+	if (allows(reader.live, permission, where)) return null;
+	return allows(reader.all, permission, where) ? "expired" : "no_grant";
+}
+/**
+* What refuses each key of a call by where it is, before any `vet`: its
+* personal config's owner, any one of the permissions it `needs` besides,
+* `permission` itself, at `at`, its reference's holder or where it is; and
+* a key it `owns` that its reader does not own the project of.
+*/
+function keyRefusals(reader, call) {
+	const { principal, permission, secrets, at, environments, needs } = call;
+	const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
+	const refusalOf = (secret, i) => {
+		const personal = personalRefusal(reader, principal, permission, secret, at[i], environments);
+		if (personal !== void 0) return personal;
+		const also = needs[i];
+		if (also != null) {
+			const place = placeIn(at[i], environments);
+			const refused = also.map((need) => refuses(reader, need, place, gone(secret) || gone(at[i])));
+			if (refused.every((code) => code !== null)) return refused[0] ?? "no_grant";
+		}
+		return refuses(reader, permission, placeIn(at[i], environments), gone(secret) || gone(at[i]));
+	};
+	return secrets.map((secret, i) => {
+		const code = refusalOf(secret, i);
+		return code === null && call.owns?.[i] === true && !ownsProject(reader.live, secret.projectId) ? "not_allowed" : code;
+	});
+}
+/**
+* Each key's refusal once its sensitivity is weighed too, after `vet`. A
+* sensitive value is only ever used for a person, never handed back, by
+* whatever credential of theirs asks; and handed back to a service account
+* only on a credential an Owner of its own project issued, a reference's
+* source's too, whose value it is (`readsSensitive`, R32). And a fork
+* copies one, for anyone, a service account too, only where its app says
+* it keeps it sensitive (an app of 0.9, mid-deploy, would write the copy as
+* a secret its people read), and never one read through a reference.
+*/
+function sensitiveRefusals(codes, reader, call) {
+	const copying = call.action === "secret.read" && call.purpose === "copy";
+	const handedBack = call.action === "secret.read" && handsBack({
+		purpose: call.purpose ?? "",
+		keepsSensitive: call.keepsSensitive === true
+	});
+	const person = call.principal.startsWith("user:");
+	return call.secrets.map((secret, i) => {
+		const code = codes[i] ?? null;
+		if (code !== null || secret.sensitive !== true) return code;
+		if (copying && call.keepsSensitive !== true || copying && call.viaReference?.[i] === true || handedBack && person) return "sensitive";
+		if (handedBack && !readsSensitive(reader.live, secret.projectId)) return "not_owner_issued";
+		return null;
+	});
+}
+/**
+* Each key's refusal once a workload's listing is weighed too, after `vet`
+* and before its sensitivity (docs/design/workload-access.md, section 6.1).
+* A workload is handed back, for any purpose but the proxy's use, only a
+* value its credential lists where the value is held (`useOnly`): each
+* secret is that place, a reference's source, a fork's parent, whatever
+* place the call checked its permission at. A copy too, kept sensitive or
+* not: it would land where the workload may read it. The vault opens no
+* plain value, so every key here is a secret or a sensitive one.
+*/
+function useOnlyRefusals(codes, reader, call) {
+	const handedBack = call.action === "secret.read" && call.purpose !== "use";
+	return call.secrets.map((secret, i) => codes[i] ?? (handedBack && useOnly(reader.live, secret) ? "use_only" : null));
+}
+/**
+* Why `reader` may not make a reference at `holder` to `source`, or null, past
+* what only the database settles (a source of another claim, a reference to
+* itself). A personal config's values are bound to its owner: no reference
+* holds one, nor reads one. Making one hands its source's value to whoever
+* reads the holder, whatever its nature becomes: its maker writes the holder,
+* reads the source there, as any direct access, and, for a sensitive one,
+* which nobody reads, uses it there too (R24). A workload refers only to a
+* value it is handed back, a plain one or one it lists (`useOnly`): it
+* would otherwise move a value it uses to a place whose keys it reads.
+*/
+function referenceRefusal(reader, holder, source, environments, nature) {
+	if (environments.get(holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return "personal";
+	const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
+	const at = placeIn(source, environments);
+	return refuses(reader, "secret.write", placeIn(holder, environments), gone(holder)) ?? refuses(reader, "secret.read", at, gone(source)) ?? (nature === "sensitive" ? refuses(reader, "secret.use", at, gone(source)) : null) ?? (nature !== "plain" && useOnly(reader.live, source) ? "use_only" : null);
+}
+//#endregion
 //#region src/store.ts
 /**
 * On Postgres, fail a lock wait in this transaction after `ms`, rather than
@@ -345,8 +477,10 @@ async function natures(db, secretIds) {
 }
 /**
 * For each version a rewrap would bring back into its secret, its nature
-* as stored when it is an old value, not the secret's current one; null
-* for the current one, which a mark wraps again with no value changing.
+* when it is an old value, no looser than it was stored nor than its value
+* was made since (the newest version of its very ciphertext), not the
+* secret's current one; null for the current one, which a mark wraps again
+* with no value changing.
 */
 async function restoredNatures(db, items) {
 	if (items.length === 0) return [];
@@ -356,8 +490,8 @@ async function restoredNatures(db, items) {
 		version: secrets.currentVersionId
 	}).from(secrets).where(inArray(secrets.id, [...new Set(items.map((item) => item.secretId))])), db.select({
 		id: secretVersions.id,
-		sensitive: secretVersions.sensitive,
-		plain: truth(isNotNull(secretVersions.plaintext))
+		sensitive: sql`(${secretVersions.sensitive} OR (${heldAs(secretVersions, sql`same.sensitive`)}))`,
+		plain: sql`(${secretVersions.plaintext} IS NOT NULL AND (${heldAs(secretVersions, sql`same.plaintext IS NOT NULL`)}))`
 	}).from(secretVersions).where(inArray(secretVersions.id, [...new Set(items.map((item) => item.from))]))]);
 	const currentOf = new Map(current.map((row) => [row.id, row.version]));
 	const natureOf = new Map(versions.map((row) => [row.id, Boolean(row.sensitive) ? "sensitive" : Boolean(row.plain) ? "plain" : "secret"]));
@@ -467,7 +601,8 @@ async function versions(db, ids) {
 		currentVersionId: secrets.currentVersionId,
 		sensitive: secretVersions.sensitive,
 		newest: sql`(SELECT max(newest.version) FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId})`,
-		newestSensitive: sql`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`
+		newestSensitive: sql`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`,
+		heldSensitive: sql`(${heldAs(secretVersions, sql`same.sensitive`)})`
 	}).from(secretVersions).innerJoin(secrets, eq(secrets.id, secretVersions.secretId)).innerJoin(environments, eq(environments.id, secrets.environmentId)).innerJoin(projects, eq(projects.id, secrets.projectId)).where(and(inArray(secretVersions.id, [...new Set(ids)]), or(sealed$1(secretVersions.wrappedDek), tombstone(environments.slug), tombstone(projects.slug))))).map((row) => ({
 		id: row.id,
 		deleted: row.deleted,
@@ -486,9 +621,18 @@ async function versions(db, ids) {
 			bytes: row.wrappedDek.toString("base64")
 		},
 		current: row.currentVersionId === row.id && Number(row.newest) === row.version,
-		newestSensitive: Boolean(row.newestSensitive)
+		newestSensitive: Boolean(row.newestSensitive),
+		heldSensitive: Boolean(row.heldSensitive)
 	}));
 }
+/**
+* `column` of the newest version of a version's secret with its very ciphertext: its value, as it is held now. Known
+* by its IV and tag, which under one data key name one ciphertext, and which, unlike the ciphertext, no erasure empties.
+*/
+function heldAs(secretVersions, column) {
+	return sql`SELECT ${column} FROM secret_versions same WHERE same.secret_id = ${secretVersions.secretId}
+    AND same.iv = ${secretVersions.iv} AND same.auth_tag = ${secretVersions.authTag} ORDER BY same.version DESC LIMIT 1`;
+}
 //#endregion
 //#region src/log.ts
 /**
@@ -1723,7 +1867,7 @@ var Outage = class {
 	}
 };
 /** A rewrap that would make a value less sensitive than it is. */
-const LOOSER = "a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more";
+const LOOSER = "a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more; only its current sensitive value is made a secret in place, by an Owner of its project";
 function refusal(code, message) {
 	return {
 		code,
@@ -1741,6 +1885,8 @@ const MESSAGES = {
 	ended: "the reference read through was ended",
 	personal: "a personal config's values are its owner's alone",
 	sensitive: "a sensitive value is never shown to anyone, Owners included: `coffre run` gives your app a placeholder for it through the credential proxy, and a service account reads it",
+	not_owner_issued: "a service account reads a sensitive value only on a token or trust binding an Owner of its project issued",
+	use_only: "a workload uses this value through coffre and never holds it: list it in its binding's reads, where the value is held, if it must",
 	not_allowed: "not allowed to change this",
 	last_owner: "the last Owner of the whole instance stays one: make someone else an Owner first",
 	invalid: "not something the rules allow",
@@ -1751,21 +1897,30 @@ const MESSAGES = {
 };
 /**
 * What the one asking holds through the credential their request came in
-* on: no more than its scope (`allows`). A scope that is not one is a bug
-* of the app's, which fails the call.
+* on: no more than its scope (`allows`), and, a workload's, handed back
+* only what the scope lists (`useOnly`). A scope that is not one, a kind of
+* caller its principal cannot be, or a workload with no scope to list what
+* it reads, is a bug of the app's, which fails the call. None said is an
+* app older than 0.11, which has no workloads (`Through`).
 */
-function through(standing, { credentialScope }) {
-	if (credentialScope == null) return standing;
-	if (!isCredentialScope(credentialScope)) throw new Error("credentialScope must be a list of grants, one a place");
+function through(standing, { credentialScope, caller }) {
+	const { principal } = standing;
+	if (caller !== void 0 && !(caller === "person" ? principal.startsWith("user:") : (caller === "bearer" || caller === "workload") && principal.startsWith("token:"))) throw new Error(`caller must be person for a user: principal, bearer or workload for a token: one, got: ${String(caller)}`);
+	if (caller === "workload" && credentialScope == null) throw new Error("a workload caller comes with its credential scope, which lists what it reads");
+	if (credentialScope != null && !isCredentialScope(credentialScope)) throw new Error("credentialScope must be a list of grants, one a place");
+	const held = {
+		...credentialScope == null ? {} : { credentialScope },
+		...caller === void 0 ? {} : { kind: caller }
+	};
 	return {
 		...standing,
 		live: {
 			...standing.live,
-			credentialScope
+			...held
 		},
 		all: {
 			...standing.all,
-			credentialScope
+			...held
 		}
 	};
 }
@@ -2286,6 +2441,7 @@ var VaultService = class {
 			permission: input.purpose === "use" ? "secret.use" : "secret.read",
 			secrets: items.map((item) => item.secret),
 			places: sealed.map((seal, i) => seal?.holder ?? items[i].secret),
+			viaReference: sealed.map((seal) => seal !== null),
 			references: ends,
 			vet: ends.length === 0 ? void 0 : async (_, reads) => sealed.map((seal) => seal !== null && reads.ended.has(seal.seq) ? "ended" : null),
 			remote,
@@ -2349,13 +2505,19 @@ var VaultService = class {
 			...keyEntry("key.rewrap", principal, source.secret, "deny", "bad_claim", input),
 			secretVersionId: source.id
 		})));
-		if (items.some((item, i) => item.secret.sensitive !== true && (loaded.versions[i].secret.sensitive || loaded.versions[i].newestSensitive))) return this.#refuseVersions(principal, "invalid", loaded.versions.map((source) => ({
+		const loosens = items.map((item, i) => item.secret.sensitive !== true && loaded.versions[i].secret.sensitive === true && loaded.versions[i].current);
+		const strict = (i) => loaded.versions[i].secret.sensitive || loaded.versions[i].heldSensitive || loaded.versions[i].newestSensitive;
+		if (items.some((item, i) => !loosens[i] && item.secret.sensitive !== true && strict(i))) return this.#refuseVersions(principal, "invalid", loaded.versions.map((source) => ({
 			...keyEntry("key.rewrap", principal, source.secret, "deny", "invalid", input),
 			secretVersionId: source.id
 		})), LOOSER);
 		const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
+		const loosened = new Set(items.flatMap((item, i) => loosens[i] ? [item.secret] : []));
 		const entry = (secret, decision, code) => ({
-			...keyEntry("key.rewrap", principal, secret, decision, code, input, { from: sources.get(secret).secret.version }),
+			...keyEntry("key.rewrap", principal, secret, decision, code, input, {
+				from: sources.get(secret).secret.version,
+				...loosened.has(secret) ? { was: "sensitive" } : {}
+			}),
 			secretVersionId: sources.get(secret).id
 		});
 		const remote = this.#remote(this.#config.keks.primary) || items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
@@ -2369,8 +2531,14 @@ var VaultService = class {
 			input,
 			vet: async (db) => {
 				const newest = await newestSensitive(db, items.map(({ secret }) => secret.secretId));
-				return items.map(({ secret }) => secret.sensitive !== true && newest.has(secret.secretId) ? "invalid" : null);
+				const again = new Map((await versions(db, items.map(({ secret }) => sources.get(secret).id))).map((version) => [version.id, version]));
+				return items.map(({ secret }, i) => {
+					const now = again.get(sources.get(secret).id);
+					if (loosens[i]) return now?.current === true ? null : "invalid";
+					return secret.sensitive !== true && (newest.has(secret.secretId) || now?.heldSensitive === true) ? "invalid" : null;
+				});
 			},
+			owns: loosens,
 			needs: async (db) => {
 				return (await restoredNatures(db, items.map(({ secret }) => ({
 					secretId: secret.secretId,
@@ -2471,28 +2639,31 @@ var VaultService = class {
 			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
 			const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
 			const environments = d.reads.environments;
-			const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
 			owners.clear();
 			for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
 			const needs = call.needs === void 0 ? [] : await call.needs(d.tx);
-			const codes = secrets.map((secret, i) => {
-				const personal = personalRefusal(reader, principal, call.permission, secret, at[i], environments);
-				if (personal !== void 0) return personal;
-				const also = needs[i];
-				if (also != null) {
-					const place = placeIn(at[i], environments);
-					const refused = also.map((permission) => refuses(reader, permission, place, gone(secret) || gone(at[i])));
-					if (refused.every((code) => code !== null)) return refused[0];
-				}
-				return refuses(reader, call.permission, placeIn(at[i], environments), gone(secret) || gone(at[i]));
+			let codes = keyRefusals(reader, {
+				principal,
+				permission: call.permission,
+				secrets,
+				at,
+				environments,
+				needs,
+				owns: call.owns
 			});
-			if (call.vet !== void 0 && !codes.some((code) => code !== null)) (await call.vet(d.tx, d.reads)).forEach((code, i) => codes[i] = code);
-			const copying = action === "secret.read" && call.input.purpose === "copy";
-			if (action === "secret.read" && principal.startsWith("user:") && handsBack({
-				purpose: call.input.purpose ?? "",
-				keepsSensitive: call.input.keepsSensitive === true
-			}) || copying && call.input.keepsSensitive !== true) secrets.forEach((secret, i) => {
-				if (codes[i] === null && secret.sensitive === true) codes[i] = "sensitive";
+			if (call.vet !== void 0 && !codes.some((code) => code !== null)) codes = await call.vet(d.tx, d.reads);
+			codes = useOnlyRefusals(codes, reader, {
+				action,
+				purpose: call.input.purpose,
+				secrets
+			});
+			codes = sensitiveRefusals(codes, reader, {
+				action,
+				principal,
+				purpose: call.input.purpose,
+				keepsSensitive: call.input.keepsSensitive,
+				secrets,
+				viaReference: call.viaReference
 			});
 			let first = codes.find((code) => code !== null) ?? null;
 			if (first === null && action === "secret.read" && this.#overBulkLimit(d)) first = "bulk_limit";
@@ -2656,14 +2827,11 @@ var VaultService = class {
 				const source = sources.get(item.source.secretId);
 				return source === void 0 ? [item.holder.environmentId] : [item.holder.environmentId, source.environmentId];
 			}));
-			const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
 			const codes = items.map((item) => {
 				const source = sources.get(item.source.secretId);
 				if (source === void 0 || projectOf.get(item.holder.environmentId) !== item.holder.projectId) return "bad_claim";
 				if (source.secretId === item.holder.secretId) return "invalid";
-				if (environments.get(item.holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return "personal";
-				const at = placeIn(source, environments);
-				return refuses(reader, "secret.write", placeIn(item.holder, environments), gone(item.holder)) ?? refuses(reader, "secret.read", at, gone(source)) ?? (natures$1.get(source.secretId) === "sensitive" ? refuses(reader, "secret.use", at, gone(source)) : null);
+				return referenceRefusal(reader, item.holder, source, environments, natures$1.get(source.secretId) ?? "secret");
 			});
 			const first = codes.find((code) => code !== null) ?? null;
 			if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), items.map((item, i) => entry(item, "deny", codes[i] ?? first)));
@@ -3499,8 +3667,8 @@ var VaultService = class {
 						at: d.at
 					}))].sort((a, b) => a.environmentId < b.environmentId ? -1 : 1);
 				} else {
-					if (!owner) throw refused("not_allowed", "only an Owner of the whole instance unprotects an environment");
-					next.protected = next.protected.filter((place) => !change.environmentIds.includes(place.environmentId));
+					if (!ownsProject(acting.live, change.projectId)) throw refused("not_allowed", "only an Owner of its project, or of the whole instance, unprotects an environment");
+					next.protected = next.protected.filter((place) => place.projectId !== change.projectId || !change.environmentIds.includes(place.environmentId));
 				}
 			} else throw refused("invalid", "a change is to a role, an instance role, or protection");
 			const answer = {
@@ -4505,54 +4673,6 @@ function viaDetail(via, seal) {
 	};
 }
 /**
-* Where a decision checks a permission: an environment, with its slug as
-* the store has it when it was read and is in the project claimed;
-* otherwise none, which no grant on a slug matches.
-*/
-function placeIn(place, environments) {
-	const environment = environments.get(place.environmentId);
-	const slug = environment?.projectId === place.projectId ? environment.slug : null;
-	return {
-		projectId: place.projectId,
-		environmentId: place.environmentId,
-		environmentSlug: slug
-	};
-}
-/**
-* Why `reader` may not do `permission` at `where`, or null if they may. A
-* deleted place is refused before any grant is asked, so no kind of grant,
-* on the project, the environment or every project, can reach into one.
-*/
-/**
-* A key of a personal config is its owner's alone (docs/design/forking.md,
-* section 4): no grant or role opens or wraps it, an Owner's included,
-* only its owner, while they read the environment it is a config of,
-* whatever the call is. Nor does any reference reach into or out of one.
-* Undefined for a key of any other environment, decided as ever.
-*/
-function personalRefusal(reader, principal, permission, secret, at, environments) {
-	const own = environments.get(secret.environmentId);
-	const held = at.environmentId === secret.environmentId ? own : environments.get(at.environmentId);
-	if (own?.owner == null && held?.owner == null) return void 0;
-	if (own !== held || principal !== own?.owner || own.parentId === null) return "personal";
-	const parent = placeIn({
-		projectId: secret.projectId,
-		environmentId: own.parentId
-	}, environments);
-	const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
-	const refused = refuses(reader, "secret.use", parent, gone) === null ? null : refuses(reader, "secret.read", parent, gone);
-	if (refused !== null) return refused;
-	return withinCredential(reader.live, permission === "secret.read" ? "secret.use" : permission, parent) ? null : "no_grant";
-}
-function refuses(reader, permission, where, deleted) {
-	if (reader.status === "tampered") return "tampered";
-	if (reader.status === "removed") return "removed";
-	if (reader.status === "unknown") return "not_a_member";
-	if (deleted) return "deleted";
-	if (allows(reader.live, permission, where)) return null;
-	return allows(reader.all, permission, where) ? "expired" : "no_grant";
-}
-/**
 * An entry about a key. A new secret's row is not committed when its key is
 * wrapped, so a wrap names the secret in its payload; the others name it.
 */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.10.2",
-    "@coffre/db": "0.10.2"
+    "@coffre/core": "0.11.0",
+    "@coffre/db": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/decide.ts

@@ -0,0 +1,198 @@
+import { allows, ownsProject, readsSensitive, useOnly, withinCredential, type HeldKey, type Holdings, type Permission, type Place } from '@coffre/core/access';
+import { handsBack, type Access, type RefusalCode } from '@coffre/core/vault';
+import type { EnvironmentRow } from './store.ts';
+
+/**
+ * How the vault decides each key of one call, and each reference one makes,
+ * as functions of what the decision read and nothing else: the rest of
+ * `#keys` and `reference` reads, locks and logs around them. Pure, so that `formal/lean` holds them to its model
+ * case by case (`pnpm formal:lean`, docs/formal.md).
+ */
+
+/** What a decision reads of someone: whether they are a member, what they hold now, and what they would with their lapsed grants. */
+export type Reader = { status: Access['status']; live: Holdings; all: Holdings };
+
+/** An environment a secret is in, or that holds a reference to one. */
+export type SecretPlace = { projectId: string; environmentId: string };
+
+/**
+ * Where a decision checks a permission: an environment, with its slug as
+ * the store has it when it was read and is in the project claimed;
+ * otherwise none, which no grant on a slug matches.
+ */
+export function placeIn(place: SecretPlace, environments: ReadonlyMap<string, { projectId: string; slug: string }>): Place {
+  const environment = environments.get(place.environmentId);
+  const slug = environment?.projectId === place.projectId ? environment.slug : null;
+  return { projectId: place.projectId, environmentId: place.environmentId, environmentSlug: slug };
+}
+
+/**
+ * A key of a personal config is its owner's alone (docs/design/forking.md,
+ * section 4): no grant or role opens or wraps it, an Owner's included,
+ * only its owner, while they read the environment it is a config of,
+ * whatever the call is. Nor does any reference reach into or out of one.
+ * Undefined for a key of any other environment, decided as ever.
+ */
+export function personalRefusal(
+  reader: Reader,
+  principal: string,
+  permission: Permission,
+  secret: SecretPlace,
+  at: SecretPlace,
+  environments: ReadonlyMap<string, EnvironmentRow>,
+): RefusalCode | null | undefined {
+  const own = environments.get(secret.environmentId);
+  const elsewhere = at.environmentId !== secret.environmentId;
+  const held = elsewhere ? environments.get(at.environmentId) : own;
+  if (own?.owner == null && held?.owner == null) return undefined;
+  // Held elsewhere, a reference into or out of one; or not its owner's.
+  if (elsewhere || own === undefined || principal !== own.owner || own.parentId === null) return 'personal';
+  const parent = placeIn({ projectId: secret.projectId, environmentId: own.parentId }, environments);
+  // Its owner reads what they wrote while they read or use the environment it configures (R8).
+  const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
+  const refused = refuses(reader, 'secret.use', parent, gone) === null ? null : refuses(reader, 'secret.read', parent, gone);
+  if (refused !== null) return refused;
+  // The credential's scope caps the owner still: their viewer token on the parent reads, and wraps no key. Reading their
+  // own values takes use there: a Contributor's handle reads what its owner wrote, and nothing of the parent's.
+  return withinCredential(reader.live, permission === 'secret.read' ? 'secret.use' : permission, parent) ? null : 'no_grant';
+}
+
+/**
+ * Why `reader` may not do `permission` at `where`, or null if they may. A
+ * deleted place is refused before any grant is asked, so no kind of grant,
+ * on the project, the environment or every project, can reach into one.
+ */
+export function refuses(reader: Reader, permission: Permission, where: Place, deleted: boolean): RefusalCode | null {
+  if (reader.status === 'tampered') return 'tampered';
+  if (reader.status === 'removed') return 'removed';
+  if (reader.status === 'unknown') return 'not_a_member';
+  if (deleted) return 'deleted';
+  if (allows(reader.live, permission, where)) return null;
+  // Would a grant that has lapsed have covered it?
+  return allows(reader.all, permission, where) ? 'expired' : 'no_grant';
+}
+
+/**
+ * What refuses each key of a call by where it is, before any `vet`: its
+ * personal config's owner, any one of the permissions it `needs` besides,
+ * `permission` itself, at `at`, its reference's holder or where it is; and
+ * a key it `owns` that its reader does not own the project of.
+ */
+export function keyRefusals(
+  reader: Reader,
+  call: {
+    principal: string;
+    permission: Permission;
+    secrets: readonly SecretPlace[];
+    at: readonly SecretPlace[];
+    environments: ReadonlyMap<string, EnvironmentRow>;
+    needs: readonly (readonly Permission[] | null)[];
+    owns?: readonly boolean[];
+  },
+): (RefusalCode | null)[] {
+  const { principal, permission, secrets, at, environments, needs } = call;
+  const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
+  const refusalOf = (secret: SecretPlace, i: number): RefusalCode | null => {
+    const personal = personalRefusal(reader, principal, permission, secret, at[i]!, environments);
+    if (personal !== undefined) return personal;
+    const also = needs[i];
+    if (also != null) {
+      const place = placeIn(at[i]!, environments);
+      const refused = also.map((need) => refuses(reader, need, place, gone(secret) || gone(at[i]!)));
+      // Any one of none is none held: refused.
+      if (refused.every((code) => code !== null)) return refused[0] ?? 'no_grant';
+    }
+    // Through a reference, the holder's grants decide, its source's never: a reference takes its value and nature
+    // (a sensitive one stays use-only) from its source, and its permissions from where it lives. Its maker held what
+    // the source's nature asks when it was made (`reference`).
+    return refuses(reader, permission, placeIn(at[i]!, environments), gone(secret) || gone(at[i]!));
+  };
+  // A loosening takes its reader owning the project besides, a personal config's owner too, there.
+  return secrets.map((secret, i) => {
+    const code = refusalOf(secret, i);
+    return code === null && call.owns?.[i] === true && !ownsProject(reader.live, secret.projectId) ? 'not_allowed' : code;
+  });
+}
+
+/**
+ * Each key's refusal once its sensitivity is weighed too, after `vet`. A
+ * sensitive value is only ever used for a person, never handed back, by
+ * whatever credential of theirs asks; and handed back to a service account
+ * only on a credential an Owner of its own project issued, a reference's
+ * source's too, whose value it is (`readsSensitive`, R32). And a fork
+ * copies one, for anyone, a service account too, only where its app says
+ * it keeps it sensitive (an app of 0.9, mid-deploy, would write the copy as
+ * a secret its people read), and never one read through a reference.
+ */
+export function sensitiveRefusals(
+  codes: readonly (RefusalCode | null)[],
+  reader: Reader,
+  call: {
+    action: 'secret.read' | 'key.wrap' | 'key.rewrap';
+    principal: string;
+    purpose?: string;
+    keepsSensitive?: boolean;
+    secrets: readonly { projectId: string; sensitive?: boolean }[];
+    /** Each secret read through a reference. */
+    viaReference?: readonly boolean[];
+  },
+): (RefusalCode | null)[] {
+  const copying = call.action === 'secret.read' && call.purpose === 'copy';
+  const handedBack = call.action === 'secret.read' && handsBack({ purpose: call.purpose ?? '', keepsSensitive: call.keepsSensitive === true });
+  const person = call.principal.startsWith('user:');
+  return call.secrets.map((secret, i) => {
+    const code = codes[i] ?? null;
+    if (code !== null || secret.sensitive !== true) return code;
+    // A sensitive value read through a reference is never copied: a fork keeps it a reference to its source, so the
+    // value stays in its own project, where R16/R32 decide who reads it. Copying it would move it to the fork's.
+    if ((copying && call.keepsSensitive !== true) || (copying && call.viaReference?.[i] === true) || (handedBack && person)) return 'sensitive';
+    if (handedBack && !readsSensitive(reader.live, secret.projectId)) return 'not_owner_issued';
+    return null;
+  });
+}
+
+/**
+ * Each key's refusal once a workload's listing is weighed too, after `vet`
+ * and before its sensitivity (docs/design/workload-access.md, section 6.1).
+ * A workload is handed back, for any purpose but the proxy's use, only a
+ * value its credential lists where the value is held (`useOnly`): each
+ * secret is that place, a reference's source, a fork's parent, whatever
+ * place the call checked its permission at. A copy too, kept sensitive or
+ * not: it would land where the workload may read it. The vault opens no
+ * plain value, so every key here is a secret or a sensitive one.
+ */
+export function useOnlyRefusals(
+  codes: readonly (RefusalCode | null)[],
+  reader: Reader,
+  call: { action: 'secret.read' | 'key.wrap' | 'key.rewrap'; purpose?: string; secrets: readonly HeldKey[] },
+): (RefusalCode | null)[] {
+  const handedBack = call.action === 'secret.read' && call.purpose !== 'use';
+  return call.secrets.map((secret, i) => codes[i] ?? (handedBack && useOnly(reader.live, secret) ? 'use_only' : null));
+}
+
+/**
+ * Why `reader` may not make a reference at `holder` to `source`, or null, past
+ * what only the database settles (a source of another claim, a reference to
+ * itself). A personal config's values are bound to its owner: no reference
+ * holds one, nor reads one. Making one hands its source's value to whoever
+ * reads the holder, whatever its nature becomes: its maker writes the holder,
+ * reads the source there, as any direct access, and, for a sensitive one,
+ * which nobody reads, uses it there too (R24). A workload refers only to a
+ * value it is handed back, a plain one or one it lists (`useOnly`): it
+ * would otherwise move a value it uses to a place whose keys it reads.
+ */
+export function referenceRefusal(
+  reader: Reader,
+  holder: SecretPlace,
+  source: HeldKey,
+  environments: ReadonlyMap<string, EnvironmentRow>,
+  nature: 'plain' | 'secret' | 'sensitive',
+): RefusalCode | null {
+  if (environments.get(holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return 'personal';
+  const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
+  const at = placeIn(source, environments);
+  return refuses(reader, 'secret.write', placeIn(holder, environments), gone(holder))
+    ?? refuses(reader, 'secret.read', at, gone(source))
+    ?? (nature === 'sensitive' ? refuses(reader, 'secret.use', at, gone(source)) : null)
+    ?? (nature !== 'plain' && useOnly(reader.live, source) ? 'use_only' : null);
+}

package/src/store.ts

@@ -472,8 +472,10 @@ export async function natures(db: Queryable, secretIds: readonly string[]): Prom
 
 /**
  * For each version a rewrap would bring back into its secret, its nature
- * as stored when it is an old value, not the secret's current one; null
- * for the current one, which a mark wraps again with no value changing.
+ * when it is an old value, no looser than it was stored nor than its value
+ * was made since (the newest version of its very ciphertext), not the
+ * secret's current one; null for the current one, which a mark wraps again
+ * with no value changing.
  */
 export async function restoredNatures(
   db: Queryable,
@@ -483,7 +485,11 @@ export async function restoredNatures(
   const { secrets, secretVersions } = tablesOf(db);
   const [current, versions] = await Promise.all([
     db.select({ id: secrets.id, version: secrets.currentVersionId }).from(secrets).where(inArray(secrets.id, [...new Set(items.map((item) => item.secretId))])),
-    db.select({ id: secretVersions.id, sensitive: secretVersions.sensitive, plain: truth(isNotNull(secretVersions.plaintext)) }).from(secretVersions)
+    db.select({
+      id: secretVersions.id,
+      sensitive: sql<boolean | number>`(${secretVersions.sensitive} OR (${heldAs(secretVersions, sql`same.sensitive`)}))`,
+      plain: sql<boolean | number>`(${secretVersions.plaintext} IS NOT NULL AND (${heldAs(secretVersions, sql`same.plaintext IS NOT NULL`)}))`,
+    }).from(secretVersions)
       .where(inArray(secretVersions.id, [...new Set(items.map((item) => item.from))])),
   ]);
   const currentOf = new Map(current.map((row) => [row.id, row.version]));
@@ -666,6 +672,12 @@ export type SecretVersion = {
   current: boolean;
   /** Whether its secret's newest version is sensitive: what a rewrap of it may not loosen. */
   newestSensitive: boolean;
+  /**
+   * Whether its value was made sensitive since: the newest version of its
+   * secret with its very ciphertext, which a mark in place or a restore wraps
+   * again unchanged, is. What a rewrap of it may not loosen either.
+   */
+  heldSensitive: boolean;
 };
 
 export async function versions(db: Queryable, ids: readonly string[]): Promise<SecretVersion[]> {
@@ -691,6 +703,7 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
       // The newest by the versions' own order: the app may write `current_version_id`, never a version.
       newest: sql<number | string>`(SELECT max(newest.version) FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId})`,
       newestSensitive: sql<boolean | number>`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`,
+      heldSensitive: sql<boolean | number>`(${heldAs(secretVersions, sql`same.sensitive`)})`,
     })
     .from(secretVersions)
     .innerJoin(secrets, eq(secrets.id, secretVersions.secretId))
@@ -717,5 +730,15 @@ export async function versions(db: Queryable, ids: readonly string[]): Promise<S
     current: row.currentVersionId === row.id && Number(row.newest) === row.version,
     // SQLite answers a subquery's boolean as a number.
     newestSensitive: Boolean(row.newestSensitive),
+    heldSensitive: Boolean(row.heldSensitive),
   }));
 }
+
+/**
+ * `column` of the newest version of a version's secret with its very ciphertext: its value, as it is held now. Known
+ * by its IV and tag, which under one data key name one ciphertext, and which, unlike the ciphertext, no erasure empties.
+ */
+function heldAs(secretVersions: ReturnType<typeof tablesOf>['secretVersions'], column: SQL): SQL {
+  return sql`SELECT ${column} FROM secret_versions same WHERE same.secret_id = ${secretVersions.secretId}
+    AND same.iv = ${secretVersions.iv} AND same.auth_tag = ${secretVersions.authTag} ORDER BY same.version DESC LIMIT 1`;
+}

package/src/vault.ts

@@ -23,6 +23,7 @@ import {
   normalScope,
   NOTHING,
   ownsInstance,
+  ownsProject,
   PROJECT_ONLY_PERMISSIONS,
   ROLE_ID,
   ROLES,
@@ -38,7 +39,6 @@ import {
   type RoleDefinition,
   type Scope,
   type ServiceAccount,
-  withinCredential,
 } from '@coffre/core/access';
 import { GENESIS_HASH, verifyEntries, type LogKey, type StoredEntry } from '@coffre/core/audit';
 import { checkContext, ownerKey, type SecretContext } from '@coffre/core/envelope';
@@ -60,7 +60,6 @@ import {
   checkpointMessage,
   checkpointVerifier,
   describeAccessFault,
-  handsBack,
   POLICY_REVISION,
   policyRevision,
   type Access,
@@ -104,6 +103,7 @@ import { everyProjectConversion, newestAccess, reportStands } from '@coffre/db/g
 import { appendEntries, lockLogHead, missingEntry, newestAuthentic, type Appended, type Authenticity, type Newest, type NewEntry } from '@coffre/db/log';
 
 import { signer, type Signer } from './checkpoint.ts';
+import { keyRefusals, placeIn, referenceRefusal, refuses, sensitiveRefusals, useOnlyRefusals, type SecretPlace } from './decide.ts';
 import type { ResolvedVaultConfig } from './config.ts';
 import { carries, further, ownEntries, rehash, relink, START, vaultLogKey, VERIFY_BATCH, withCause, type Position } from './log.ts';
 import { apply, replayFault, type LoggedMember, type Replayed } from './replay.ts';
@@ -318,7 +318,7 @@ class Outage {
 }
 
 /** A rewrap that would make a value less sensitive than it is. */
-const LOOSER = 'a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more';
+const LOOSER = 'a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more; only its current sensitive value is made a secret in place, by an Owner of its project';
 
 function refusal(code: RefusalCode, message: string): Refusal {
   return { code, message };
@@ -335,6 +335,8 @@ const MESSAGES: Record<RefusalCode, string> = {
   ended: 'the reference read through was ended',
   personal: "a personal config's values are its owner's alone",
   sensitive: "a sensitive value is never shown to anyone, Owners included: `coffre run` gives your app a placeholder for it through the credential proxy, and a service account reads it",
+  not_owner_issued: 'a service account reads a sensitive value only on a token or trust binding an Owner of its project issued',
+  use_only: "a workload uses this value through coffre and never holds it: list it in its binding's reads, where the value is held, if it must",
   not_allowed: 'not allowed to change this',
   last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
   invalid: 'not something the rules allow',
@@ -396,13 +398,21 @@ type Correlation = { requestId?: string | null; operationId?: string | null; cre
 
 /**
  * What the one asking holds through the credential their request came in
- * on: no more than its scope (`allows`). A scope that is not one is a bug
- * of the app's, which fails the call.
+ * on: no more than its scope (`allows`), and, a workload's, handed back
+ * only what the scope lists (`useOnly`). A scope that is not one, a kind of
+ * caller its principal cannot be, or a workload with no scope to list what
+ * it reads, is a bug of the app's, which fails the call. None said is an
+ * app older than 0.11, which has no workloads (`Through`).
  */
-function through(standing: Standing, { credentialScope }: Through): Standing {
-  if (credentialScope == null) return standing;
-  if (!isCredentialScope(credentialScope)) throw new Error('credentialScope must be a list of grants, one a place');
-  return { ...standing, live: { ...standing.live, credentialScope }, all: { ...standing.all, credentialScope } };
+function through(standing: Standing, { credentialScope, caller }: Through): Standing {
+  const { principal } = standing;
+  if (caller !== undefined && !(caller === 'person' ? principal.startsWith('user:') : (caller === 'bearer' || caller === 'workload') && principal.startsWith('token:'))) {
+    throw new Error(`caller must be person for a user: principal, bearer or workload for a token: one, got: ${String(caller)}`);
+  }
+  if (caller === 'workload' && credentialScope == null) throw new Error('a workload caller comes with its credential scope, which lists what it reads');
+  if (credentialScope != null && !isCredentialScope(credentialScope)) throw new Error('credentialScope must be a list of grants, one a place');
+  const held = { ...(credentialScope == null ? {} : { credentialScope }), ...(caller === undefined ? {} : { kind: caller }) };
+  return { ...standing, live: { ...standing.live, ...held }, all: { ...standing.all, ...held } };
 }
 
 /** The credential a CI run's request came in on, as its entries record it: copied, never decided on. */
@@ -953,6 +963,8 @@ class VaultService implements Vault {
         secrets: items.map((item) => item.secret),
         // Through a reference, the reader's grants on the holder's environment decide.
         places: sealed.map((seal, i) => seal?.holder ?? items[i]!.secret),
+        // Which items are read through a reference: a sensitive one is never copied, which would move it out of its project.
+        viaReference: sealed.map((seal) => seal !== null),
         references: ends,
         vet: ends.length === 0 ? undefined : async (_, reads) => sealed.map((seal) => (seal !== null && reads.ended.has(seal.seq) ? 'ended' : null)),
         remote,
@@ -1020,16 +1032,22 @@ class VaultService implements Vault {
         ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'bad_claim', input), secretVersionId: source.id,
       })));
     }
-    // A value is made looser only by writing it again: a sensitive version's key, or one of a secret whose newest is,
-    // is never wrapped again as anything but sensitive, so that a person who may not read it never makes it readable.
-    if (items.some((item, i) => item.secret.sensitive !== true && (loaded.versions[i].secret.sensitive || loaded.versions[i].newestSensitive))) {
+    // A value is made looser only by writing it again: a sensitive value's key, or one of a secret whose newest version
+    // is, is never wrapped again as anything but sensitive, so that a person who may not read it never makes it readable.
+    // Nor a version whose value was made sensitive since, in place: the newest version of its very ciphertext. But for one:
+    // a key's current sensitive value made a secret, in place, by an Owner of its project, who reads it anyway through a
+    // service account they give read (R30). Older versions stay as they were held.
+    const loosens = items.map((item, i) => item.secret.sensitive !== true && loaded.versions[i].secret.sensitive === true && loaded.versions[i].current);
+    const strict = (i: number) => loaded.versions[i].secret.sensitive || loaded.versions[i].heldSensitive || loaded.versions[i].newestSensitive;
+    if (items.some((item, i) => !loosens[i] && item.secret.sensitive !== true && strict(i))) {
       return this.#refuseVersions(principal, 'invalid', loaded.versions.map((source) => ({
         ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'invalid', input), secretVersionId: source.id,
       })), LOOSER);
     }
     const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
+    const loosened = new Set(items.flatMap((item, i) => (loosens[i] ? [item.secret] : [])));
     const entry = (secret: SecretRef, decision: 'allow' | 'deny', code: string | null): NewEntry => ({
-      ...keyEntry('key.rewrap', principal, secret, decision, code, input, { from: sources.get(secret)!.secret.version }),
+      ...keyEntry('key.rewrap', principal, secret, decision, code, input, { from: sources.get(secret)!.secret.version, ...(loosened.has(secret) ? { was: 'sensitive' } : {}) }),
       secretVersionId: sources.get(secret)!.id,
     });
     const remote =
@@ -1037,11 +1055,19 @@ class VaultService implements Vault {
     return this.#keys(
       {
         action: 'key.rewrap', principal, permission: 'secret.write', secrets: items.map((item) => item.secret), remote, entry, input,
-        // Again in the decision and under the log's head: a sensitive version written since it was loaded is as newest as any.
+        // Again in the decision and under the log's head: a sensitive version written since it was loaded is as newest as any,
+        // a value made sensitive in place since is so, and a value loosened is still its key's current one.
         vet: async (db) => {
           const newest = await store.newestSensitive(db, items.map(({ secret }) => secret.secretId));
-          return items.map(({ secret }) => (secret.sensitive !== true && newest.has(secret.secretId) ? 'invalid' : null));
+          // Each source again: current as the decision had it, its key's pointer and its newest, and its value as held now.
+          const again = new Map((await store.versions(db, items.map(({ secret }) => sources.get(secret)!.id))).map((version) => [version.id, version]));
+          return items.map(({ secret }, i) => {
+            const now = again.get(sources.get(secret)!.id);
+            if (loosens[i]) return now?.current === true ? null : 'invalid';
+            return secret.sensitive !== true && (newest.has(secret.secretId) || now?.heldSensitive === true) ? 'invalid' : null;
+          });
         },
+        owns: loosens,
         // An old value brought back, not the current one, is made live by whoever could have read it: a secret by its
         // readers, a sensitive one, which nobody reads, by those who use it, a plain one by any writer, as it was shown
         // to them. Whatever reads the key next, a reference to it included, then reads what its restorer could. Typing a
@@ -1153,6 +1179,10 @@ class VaultService implements Vault {
        * is, read in the decision and again under the head; none for null.
        */
       needs?: (db: Queryable) => Promise<(readonly Permission[] | null)[]>;
+      /** Each secret that takes besides its reader being an Owner of its project (`ownsProject`): a sensitive value made a secret. */
+      owns?: readonly boolean[];
+      /** Which secrets are read through a reference, by index: a sensitive one of these is never copied (it would leave its project). */
+      viaReference?: readonly boolean[];
       remote: boolean;
       entry: (secret: SecretRef, decision: 'allow' | 'deny', code: string | null) => NewEntry;
       input: Correlation & Through & { purpose?: string; keepsSensitive?: boolean };
@@ -1183,37 +1213,16 @@ class VaultService implements Vault {
       const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
       // Each a personal config is a config of too, whose read its owner needs (`places`).
       const environments = d.reads.environments;
-      const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
       owners.clear();
       for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
       const needs = call.needs === undefined ? [] : await call.needs(d.tx);
-      const codes: (RefusalCode | null)[] = secrets.map((secret, i) => {
-        const personal = personalRefusal(reader, principal, call.permission, secret, at[i]!, environments);
-        if (personal !== undefined) return personal;
-        const also = needs[i];
-        if (also != null) {
-          const place = placeIn(at[i]!, environments);
-          const refused = also.map((permission) => refuses(reader, permission, place, gone(secret) || gone(at[i]!)));
-          if (refused.every((code) => code !== null)) return refused[0]!;
-        }
-        // Through a reference, the holder's grants decide, its source's never: a reference takes its value and nature
-        // (a sensitive one stays use-only) from its source, and its permissions from where it lives. Its maker held what
-        // the source's nature asks when it was made (`reference`).
-        return refuses(reader, call.permission, placeIn(at[i]!, environments), gone(secret) || gone(at[i]!));
+      let codes = keyRefusals(reader, { principal, permission: call.permission, secrets, at, environments, needs, owns: call.owns });
+      if (call.vet !== undefined && !codes.some((code) => code !== null)) codes = await call.vet(d.tx, d.reads);
+      // Where each value is held, the secret itself, a reference's source or a fork's parent: what a workload lists.
+      codes = useOnlyRefusals(codes, reader, { action, purpose: call.input.purpose, secrets });
+      codes = sensitiveRefusals(codes, reader, {
+        action, principal, purpose: call.input.purpose, keepsSensitive: call.input.keepsSensitive, secrets, viaReference: call.viaReference,
       });
-      if (call.vet !== undefined && !codes.some((code) => code !== null)) {
-        (await call.vet(d.tx, d.reads)).forEach((code, i) => (codes[i] = code));
-      }
-      // A sensitive value is only ever used for a person, never handed back, by whatever credential of theirs asks. And
-      // a fork copies one, for anyone, a service account too, only where its app says it keeps it sensitive: an app of
-      // 0.9, mid-deploy, would write the copy as a secret its people read.
-      const copying = action === 'secret.read' && call.input.purpose === 'copy';
-      const handedBack = action === 'secret.read' && principal.startsWith('user:') && handsBack({ purpose: call.input.purpose ?? '', keepsSensitive: call.input.keepsSensitive === true });
-      if (handedBack || (copying && call.input.keepsSensitive !== true)) {
-        secrets.forEach((secret, i) => {
-          if (codes[i] === null && secret.sensitive === true) codes[i] = 'sensitive';
-        });
-      }
       let first = codes.find((code) => code !== null) ?? null;
       if (first === null && action === 'secret.read' && this.#overBulkLimit(d)) first = 'bulk_limit';
       if (first !== null) {
@@ -1413,19 +1422,11 @@ class VaultService implements Vault {
         const source = sources.get(item.source.secretId);
         return source === undefined ? [item.holder.environmentId] : [item.holder.environmentId, source.environmentId];
       }));
-      const gone = (place: SecretPlace) => environments.get(place.environmentId)?.deleted ?? false;
       const codes = items.map((item): RefusalCode | null => {
         const source = sources.get(item.source.secretId);
         if (source === undefined || projectOf.get(item.holder.environmentId) !== item.holder.projectId) return 'bad_claim';
         if (source.secretId === item.holder.secretId) return 'invalid';
-        // A personal config's values are bound to its owner: no reference holds one, nor reads one.
-        if (environments.get(item.holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return 'personal';
-        // Making one hands its source's value to whoever reads the holder, whatever its nature becomes: its maker reads
-        // it at the source, as any direct access there, and, for a sensitive one, which nobody reads, uses it there too.
-        const at = placeIn(source, environments);
-        return refuses(reader, 'secret.write', placeIn(item.holder, environments), gone(item.holder))
-          ?? refuses(reader, 'secret.read', at, gone(source))
-          ?? (natures.get(source.secretId) === 'sensitive' ? refuses(reader, 'secret.use', at, gone(source)) : null);
+        return referenceRefusal(reader, item.holder, source, environments, natures.get(source.secretId) ?? 'secret');
       });
       const first = codes.find((code) => code !== null) ?? null;
       if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), items.map((item, i) => entry(item, 'deny', codes[i] ?? first)));
@@ -2243,9 +2244,10 @@ class VaultService implements Vault {
           next.protected = [...next.protected, ...change.environmentIds.filter((id) => !known.has(id)).map((environmentId) => ({ projectId: change.projectId, environmentId, at: d.at }))]
             .sort((a, b) => (a.environmentId < b.environmentId ? -1 : 1));
         } else {
-          // Unprotecting widens what people hold there: an Owner of the whole instance's to do (R15).
-          if (!owner) throw refused('not_allowed', 'only an Owner of the whole instance unprotects an environment');
-          next.protected = next.protected.filter((place) => !change.environmentIds.includes(place.environmentId));
+          // Unprotecting widens what people hold there: an Owner of the project's to do, or of the whole instance's (R30).
+          // It takes off only what the project protects: a fork's id, with no row yet, is another project's to unprotect.
+          if (!ownsProject(acting.live, change.projectId)) throw refused('not_allowed', 'only an Owner of its project, or of the whole instance, unprotects an environment');
+          next.protected = next.protected.filter((place) => place.projectId !== change.projectId || !change.environmentIds.includes(place.environmentId));
         }
       } else {
         throw refused('invalid', 'a change is to a role, an instance role, or protection');
@@ -3114,64 +3116,6 @@ function viaDetail(via: Via, seal: Sealed | null): Record<string, unknown> {
   };
 }
 
-/** An environment a secret is in, or that holds a reference to one. */
-type SecretPlace = { projectId: string; environmentId: string };
-
-/**
- * Where a decision checks a permission: an environment, with its slug as
- * the store has it when it was read and is in the project claimed;
- * otherwise none, which no grant on a slug matches.
- */
-function placeIn(place: SecretPlace, environments: ReadonlyMap<string, { projectId: string; slug: string }>): Place {
-  const environment = environments.get(place.environmentId);
-  const slug = environment?.projectId === place.projectId ? environment.slug : null;
-  return { projectId: place.projectId, environmentId: place.environmentId, environmentSlug: slug };
-}
-
-/**
- * Why `reader` may not do `permission` at `where`, or null if they may. A
- * deleted place is refused before any grant is asked, so no kind of grant,
- * on the project, the environment or every project, can reach into one.
- */
-/**
- * A key of a personal config is its owner's alone (docs/design/forking.md,
- * section 4): no grant or role opens or wraps it, an Owner's included,
- * only its owner, while they read the environment it is a config of,
- * whatever the call is. Nor does any reference reach into or out of one.
- * Undefined for a key of any other environment, decided as ever.
- */
-function personalRefusal(
-  reader: Standing,
-  principal: string,
-  permission: Permission,
-  secret: SecretPlace,
-  at: SecretPlace,
-  environments: ReadonlyMap<string, store.EnvironmentRow>,
-): RefusalCode | null | undefined {
-  const own = environments.get(secret.environmentId);
-  const held = at.environmentId === secret.environmentId ? own : environments.get(at.environmentId);
-  if (own?.owner == null && held?.owner == null) return undefined;
-  if (own !== held || principal !== own?.owner || own.parentId === null) return 'personal';
-  const parent = placeIn({ projectId: secret.projectId, environmentId: own.parentId }, environments);
-  // Its owner reads what they wrote while they read or use the environment it configures (R8).
-  const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
-  const refused = refuses(reader, 'secret.use', parent, gone) === null ? null : refuses(reader, 'secret.read', parent, gone);
-  if (refused !== null) return refused;
-  // The credential's scope caps the owner still: their viewer token on the parent reads, and wraps no key. Reading their
-  // own values takes use there: a Contributor's handle reads what its owner wrote, and nothing of the parent's.
-  return withinCredential(reader.live, permission === 'secret.read' ? 'secret.use' : permission, parent) ? null : 'no_grant';
-}
-
-function refuses(reader: Standing, permission: Permission, where: Place, deleted: boolean): RefusalCode | null {
-  if (reader.status === 'tampered') return 'tampered';
-  if (reader.status === 'removed') return 'removed';
-  if (reader.status === 'unknown') return 'not_a_member';
-  if (deleted) return 'deleted';
-  if (allows(reader.live, permission, where)) return null;
-  // Would a grant that has lapsed have covered it?
-  return allows(reader.all, permission, where) ? 'expired' : 'no_grant';
-}
-
 /**
  * An entry about a key. A new secret's row is not committed when its key is
  * wrapped, so a wrap names the secret in its payload; the others name it.