@coffre/vault 0.4.6 → 0.5.0

package/dist/{vault-CeKwkzSV.js → vault-CP8yU8xq.js}

@@ -2,13 +2,13 @@ import { ACCESS_ACTIONS, checkpointMessage, checkpointVerifier, describeAccessFa
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { tablesOf } from "@coffre/db";
-import { allows, assignableToEnvironment, everyProjectPath, grantKind, isRole, mayManageAccess } from "@coffre/core/access";
+import { EVERYWHERE, NOTHING, allows, assignableToEnvironment, convertEveryProjectGrants, givesService, grantKind, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalScope, runsInstance, setsUpServices, unscoped } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext } from "@coffre/core/envelope";
 import { shownMember } from "@coffre/core/schemas";
 import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation, tombstone, truth } from "@coffre/db/dialect";
-import { appendEntries, lockLogHead } from "@coffre/db/log";
-import { insertGrant, readGrants } from "@coffre/db/grants";
+import { accessEntriesAbout, insertGrant, newestAccess, readGrants, reportStands, roleColumns, storedRole } from "@coffre/db/grants";
+import { LOOK_BACK, appendEntries, entryColumns, lockLogHead, newestAuthentic } from "@coffre/db/log";
 import { and, asc, count, desc, eq, gt, gte, inArray, isNull, lt, lte, or, sql } from "drizzle-orm";
 //#region src/accounting.ts
 const KEY_ACTIONS = /* @__PURE__ */ new Set([
@@ -188,6 +188,8 @@ function memberColumns(db) {
 		principal: vaultMembers.principal,
 		status: vaultMembers.status,
 		owner: vaultMembers.owner,
+		role: vaultMembers.role,
+		scope: vaultMembers.scope,
 		generation: vaultMembers.generation,
 		createdAt: vaultMembers.createdAt,
 		createdBy: vaultMembers.createdBy,
@@ -197,14 +199,33 @@ function memberColumns(db) {
 		mac: vaultMembers.mac
 	};
 }
+/** A member as their row says (`storedRole`). */
+function memberOf({ owner, role, scope, ...row }) {
+	return {
+		...row,
+		...storedRole({
+			owner,
+			role,
+			scope
+		})
+	};
+}
+function storedChange(change) {
+	const { role, scope, ...rest } = change;
+	if (role === void 0) return rest;
+	return {
+		...rest,
+		...roleColumns(role, scope ?? EVERYWHERE)
+	};
+}
 async function member(db, principal) {
 	const { vaultMembers } = tablesOf(db);
 	const [row] = await db.select(memberColumns(db)).from(vaultMembers).where(eq(vaultMembers.principal, principal));
-	return row;
+	return row === void 0 ? void 0 : memberOf(row);
 }
 async function allMembers(db) {
 	const { vaultMembers } = tablesOf(db);
-	return await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal));
+	return (await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal))).map(memberOf);
 }
 /**
 * Lock these members' rows for the rest of the transaction, in one order
@@ -215,7 +236,7 @@ async function allMembers(db) {
 async function lockMembers(tx, principals) {
 	const { vaultMembers } = tablesOf(tx);
 	const rows = await forUpdate(tx, tx.select(memberColumns(tx)).from(vaultMembers).where(inArray(vaultMembers.principal, [...new Set(principals)])).orderBy(asc(vaultMembers.principal)), "no key update");
-	return new Map(rows.map((row) => [row.principal, row]));
+	return new Map(rows.map((row) => [row.principal, memberOf(row)]));
 }
 /**
 * Add `row`. A principal has one row: when two decisions admit the same
@@ -223,11 +244,11 @@ async function lockMembers(tx, principals) {
 */
 async function insertMember(tx, row) {
 	const { vaultMembers } = tablesOf(tx);
-	await tx.insert(vaultMembers).values(row);
+	await tx.insert(vaultMembers).values(storedChange(row));
 }
 async function updateMember(tx, principal, change) {
 	const { vaultMembers } = tablesOf(tx);
-	await tx.update(vaultMembers).set(change).where(eq(vaultMembers.principal, principal));
+	await tx.update(vaultMembers).set(storedChange(change)).where(eq(vaultMembers.principal, principal));
 }
 /** Grants, lapsed ones too, each with its project, which an environment's grant finds through `environments`. */
 function grants(db, principal) {
@@ -289,7 +310,7 @@ async function wrappedUnder(db, provider, keyId, limit) {
 		bytes: Buffer.from(row.bytes)
 	}));
 }
-/** Of these projects and environments, the ones that exist, each environment with its project. */
+/** Of these projects and environments, the ones that exist, each environment with its project and slug. */
 async function places(db, projectIds, environmentIds) {
 	const { projects, environments } = tablesOf(db);
 	const [foundProjects, foundEnvironments] = await Promise.all([projectIds.length === 0 ? [] : db.select({
@@ -298,14 +319,43 @@ async function places(db, projectIds, environmentIds) {
 	}).from(projects).where(inArray(projects.id, [...projectIds])), environmentIds.length === 0 ? [] : db.select({
 		id: environments.id,
 		projectId: environments.projectId,
+		slug: environments.slug,
 		deleted: truth(or(tombstone(environments.slug), tombstone(projects.slug)))
 	}).from(environments).innerJoin(projects, eq(projects.id, environments.projectId)).where(inArray(environments.id, [...environmentIds]))]);
 	return {
 		projects: new Set(foundProjects.map((row) => row.id)),
-		environments: new Map(foundEnvironments.map((row) => [row.id, row.projectId])),
+		environments: new Map(foundEnvironments.map((row) => [row.id, {
+			projectId: row.projectId,
+			slug: row.slug
+		}])),
 		deleted: new Set([...foundProjects, ...foundEnvironments].filter((row) => row.deleted).map((row) => row.id))
 	};
 }
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+async function liveProjects(db) {
+	const { projects, environments } = tablesOf(db);
+	const [found, inside] = await Promise.all([db.select({
+		id: projects.id,
+		deleted: truth(tombstone(projects.slug))
+	}).from(projects).orderBy(asc(projects.id)), db.select({
+		id: environments.id,
+		projectId: environments.projectId,
+		slug: environments.slug,
+		deleted: truth(tombstone(environments.slug))
+	}).from(environments).orderBy(asc(environments.id))]);
+	return found.filter((project) => !project.deleted).map((project) => ({
+		id: project.id,
+		environments: inside.filter((environment) => environment.projectId === project.id && !environment.deleted).map(({ id, slug }) => ({
+			id,
+			slug
+		}))
+	}));
+}
+/** Who holds a grant on every project of 0.4, lapsed or not, which the vault replaces (`#convert`). */
+async function everyProjectHolders(db) {
+	const { vaultGrants } = tablesOf(db);
+	return (await db.selectDistinct({ principal: vaultGrants.principal }).from(vaultGrants).where(and(isNull(vaultGrants.projectId), isNull(vaultGrants.environmentId))).orderBy(asc(vaultGrants.principal))).map((row) => row.principal);
+}
 /** The action of an entry that releases a key, which the bulk limit counts. */
 const RELEASE = "secret.read";
 /** How many keys the vault has released to `principal` since `after`. */
@@ -314,32 +364,6 @@ async function releasesSince(db, principal, after) {
 	const [{ n }] = await db.select({ n: count() }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.actor, principal), eq(auditLog.action, RELEASE), eq(auditLog.decision, "allow"), gt(auditLog.occurredAt, after)));
 	return Number(n);
 }
-function entryColumns(db) {
-	const { auditLog } = tablesOf(db);
-	return {
-		seq: auditLog.seq,
-		author: auditLog.author,
-		keyId: auditLog.keyId,
-		occurredAt: auditLog.occurredAt,
-		actor: auditLog.actor,
-		action: auditLog.action,
-		decision: auditLog.decision,
-		code: auditLog.code,
-		subjectPrincipal: auditLog.subjectPrincipal,
-		projectId: auditLog.projectId,
-		environmentId: auditLog.environmentId,
-		secretId: auditLog.secretId,
-		secretVersionId: auditLog.secretVersionId,
-		operationId: auditLog.operationId,
-		requestId: auditLog.requestId,
-		sourceIp: auditLog.sourceIp,
-		relatedSeq: auditLog.relatedSeq,
-		metadata: auditLog.metadata,
-		prevHash: auditLog.prevHash,
-		mac: auditLog.mac,
-		hash: auditLog.hash
-	};
-}
 /** Rows of the log as the chain's codec reads them: `author` and `decision` are checked by the table. */
 function stored(rows) {
 	return rows;
@@ -452,10 +476,10 @@ async function latestVaultEntry(db, actions) {
 	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...actions]), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
 	return row === void 0 ? void 0 : stored([row])[0];
 }
-/** Up to `limit` of the vault's allowed access entries about `principal`, newest first. */
-async function accessEntriesAbout(db, principal, limit) {
+/** Up to `limit` of the vault's allowed entries of `action` before `before` (the newest when undefined), newest first. */
+async function newestVaultEntries(db, action, limit, before) {
 	const { auditLog } = tablesOf(db);
-	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.subjectPrincipal, principal), inArray(auditLog.action, [...ACCESS_ACTIONS]), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(limit));
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit));
 }
 /** The vault's newest allowed access entry about each member who has one. */
 async function newestAccessEntries(db) {
@@ -681,7 +705,8 @@ function replayFault(state, rows, storedGrants, at) {
 			kind: "missing-member",
 			principal
 		};
-		const fields = MEMBER_FIELDS.filter(([field]) => inStore[field] !== inLog[field]).map(([, column]) => column);
+		const same = (field) => field === "scope" ? JSON.stringify(inStore.scope) === JSON.stringify(inLog.scope) : inStore[field] === inLog[field];
+		const fields = MEMBER_FIELDS.filter(([field]) => !same(field)).map(([, column]) => column);
 		if (fields.length > 0) return {
 			kind: "member-differs",
 			principal,
@@ -721,7 +746,7 @@ function apply(state, row) {
 			state.members.set(principal, {
 				principal,
 				status: "active",
-				owner: detail.owner === true,
+				...standingIn(detail),
 				generation: before?.generation ?? 0,
 				createdAt: before?.createdAt ?? row.occurredAt,
 				createdBy: before?.createdBy ?? row.actor,
@@ -730,6 +755,7 @@ function apply(state, row) {
 			});
 			return null;
 		case "member.owner":
+		case "member.role":
 			if (before === void 0) return {
 				kind: "unadmitted-change",
 				seq: Number(row.seq),
@@ -737,7 +763,7 @@ function apply(state, row) {
 			};
 			state.members.set(principal, {
 				...before,
-				owner: detail.owner === true,
+				...standingIn(detail),
 				accessSeq: row.seq
 			});
 			return null;
@@ -751,7 +777,8 @@ function apply(state, row) {
 			state.members.set(principal, {
 				...before,
 				status: "removed",
-				owner: false,
+				role: "member",
+				scope: EVERYWHERE,
 				generation,
 				accessSeq: row.seq,
 				...changed
@@ -783,10 +810,26 @@ function apply(state, row) {
 	}
 	return null;
 }
+/**
+* The instance role an entry gives: its `role` and `scope`, or, in one
+* 0.4 wrote, whether it made them an owner, an Admin everywhere.
+*/
+function standingIn(detail) {
+	if (typeof detail.role !== "string") return {
+		role: detail.owner === true ? "admin" : "member",
+		scope: EVERYWHERE
+	};
+	const role = isInstanceRole(detail.role) ? detail.role : "member";
+	return {
+		role,
+		scope: role !== "member" && isScope(detail.scope) ? normalScope(detail.scope) : EVERYWHERE
+	};
+}
 /** A member's fields, and the columns a fault names them by. */
 const MEMBER_FIELDS = [
 	["status", "status"],
-	["owner", "owner"],
+	["role", "role"],
+	["scope", "scope"],
 	["generation", "generation"],
 	["createdAt", "created_at"],
 	["createdBy", "created_by"],
@@ -812,7 +855,7 @@ function placeOf(row, detail) {
 }
 /** A grant's place: its environment, or its project when it has none, or every project's path. */
 function placeKey$1(place) {
-	return place.environmentId ?? place.projectId ?? everyProjectPath(place.environmentSlug);
+	return place.environmentId ?? place.projectId ?? (place.environmentSlug === null ? "*" : `*/${place.environmentSlug}`);
 }
 function grantKey(grant) {
 	return JSON.stringify([
@@ -858,8 +901,8 @@ function rowKey(signingKey) {
 /**
 * A member's grants as the MAC covers them: each one's place, role, end and
 * grant, as a sorted set. A grant is kept by what its row names first: its
-* environment, its project, or neither, which is a grant on every project,
-* with the slug it covers, or null. A member who holds none of those has the
+* environment, its project, or neither, which is a grant on every project
+* of 0.4, with the slug it covers, or null, until the vault replaces it. A member who holds none of those has the
 * set, and so the MAC, they had before there were any.
 */
 function grantSet(grants) {
@@ -877,13 +920,24 @@ function sameGrants(a, b) {
 	const [x, y] = [grantSet(a), grantSet(b)];
 	return x.length === y.length && x.every((tuple, i) => tuple === y[i]);
 }
+/**
+* A member's instance role and its scope, as the MAC covers them: as 0.4
+* did, whether they are an owner, for a Member or an Admin everywhere, so
+* that every row 0.4 sealed holds as it is; otherwise the role and the
+* scope, which no row of 0.4 can match.
+*/
+function standing(member) {
+	const scope = normalScope(member.scope);
+	if (unscoped(scope) && (member.role === "member" || member.role === "admin")) return member.role === "admin";
+	return [member.role, scope];
+}
 function memberMac(key, member, grants) {
 	const held = grantSet(grants);
 	const tuple = [
 		"coffre.vault.member.v1",
 		member.principal,
 		member.status,
-		member.owner,
+		standing(member),
 		member.generation,
 		member.accessSeq.toString(),
 		member.createdAt,
@@ -915,7 +969,8 @@ async function prepareVault(config, options = {}) {
 		since: null,
 		superseded: null,
 		kekChecked: false,
-		wrongKek: null
+		wrongKek: null,
+		converted: false
 	};
 }
 /** The vault's own keys, from each of its signing keys, the one it signs with first. */
@@ -942,6 +997,9 @@ const KEY_BUDGET_MS = 5e3;
 const LOCK_TIMEOUT_MS = 15e3;
 /** A member: `user:<email>` or `token:<name>`. */
 const PRINCIPAL = /^(user|token):[^\s:][^\s]*$/;
+/** A person, and a service account: only a person sets one up (`givesService`). */
+const PERSON = /^user:/;
+const SERVICE = /^token:/;
 /** Who acts for the vault itself, as when it gives a root admin a member row. */
 const VAULT_ACTOR = "system:vault";
 /** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
@@ -957,6 +1015,17 @@ const UNSEALED = {
 const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
 /** The action of the vault's entry that signs a prefix of the log. */
 const CHECKPOINT = "audit.checkpoint";
+/** The action of the vault's entry that holds the instance's settings, and changes them (`settings`). */
+const SETTINGS = "settings.change";
+/** The settings before anyone changed them: people set up service accounts anywhere they hold access. */
+const DEFAULT_SETTINGS = { serviceAccounts: EVERYWHERE };
+/** The settings when the log has some, but none the vault wrote within reach: people set up no service accounts. */
+const CLOSED_SETTINGS = { serviceAccounts: {
+	projects: { only: [] },
+	environments: "all"
+} };
+/** Why a person's change to a service account is refused. */
+const NOT_THEIRS = "a person gives a service account at most what they hold, where the instance lets them set one up, and only to one whose every grant they hold";
 /** Who asks for checkpoints: the app's scheduled job. */
 const SCHEDULER = "system:coffre-scheduler";
 /**
@@ -1009,6 +1078,26 @@ const MESSAGES = {
 	wrong_kek: "this vault's key does not open the data it holds",
 	tampered: "this member's record failed the vault's integrity check"
 };
+/**
+* What the one asking holds through the credential their request came in
+* on: no more than its scope (`allows`). A scope that is not one is a bug
+* of the app's, which fails the call.
+*/
+function through(standing, { credentialScope }) {
+	if (credentialScope == null) return standing;
+	if (!isCredentialScope(credentialScope)) throw new Error("credentialScope must be a list of grants, one a place");
+	return {
+		...standing,
+		live: {
+			...standing.live,
+			credentialScope
+		},
+		all: {
+			...standing.all,
+			credentialScope
+		}
+	};
+}
 /** The credential a CI run's request came in on, as its entries record it: copied, never decided on. */
 function traced(correlation) {
 	return correlation.credentialId == null ? {} : { credentialId: correlation.credentialId };
@@ -1053,6 +1142,10 @@ var VaultService = class {
 			ok: false,
 			refusal: refusal("wrong_kek", superseded)
 		};
+		return this.#decideNow(principals, decide);
+	}
+	/** `#decide`, once the vault is settled. */
+	async #decideNow(principals, decide) {
 		const reports = [];
 		for (let attempt = 1;; attempt += 1) try {
 			return await this.#decideOnce(principals, decide, reports);
@@ -1152,19 +1245,23 @@ var VaultService = class {
 			this.#report(reports, principal, "mac", row.mac.toString("hex"));
 			return "mac";
 		}
-		const newest = await this.#newestAccessSeq(db, principal, reports);
-		if (row === void 0 ? newest === null : newest === row.accessSeq) return null;
+		const newest = await this.#newestAccess(db, principal, reports);
+		const seq = typeof newest !== "string" ? newest.seq : newest === "unreached" ? void 0 : null;
+		if (row === void 0 ? seq === null : seq === row.accessSeq) return null;
 		if (row === void 0 && await member(db, principal) !== void 0) throw new Retry();
-		this.#report(reports, principal, "stale", `${row?.accessSeq ?? "none"}<${newest}`);
+		this.#report(reports, principal, "stale", `${row?.accessSeq ?? "none"}<${seq ?? newest}`);
 		return "stale";
 	}
-	/** The seq of the newest access entry about `principal` that carries the vault's MAC, or null. */
-	async #newestAccessSeq(db, principal, reports) {
-		for (const entry of await accessEntriesAbout(db, principal, 32)) {
-			if (this.#authentic(entry)) return entry.seq;
-			this.#report(reports, principal, "forged_entry", String(entry.seq), entry.seq);
-		}
-		return null;
+	/** The newest access entry about `principal` that carries the vault's MAC (`newestAccess` in @coffre/db/grants). */
+	#newestAccess(db, principal, reports) {
+		return newestAccess(db, principal, this.#check(reports, principal));
+	}
+	/** Entries in the vault's name told apart by their MACs, each it did not write reported, about `principal`. */
+	#check(reports, principal) {
+		return {
+			authentic: (entry) => this.#authentic(entry),
+			forged: (entry) => this.#report(reports, principal, "forged_entry", String(entry.seq), entry.seq)
+		};
 	}
 	/** Whether `entry` carries the vault's MAC: under any of its keys before `since`, and only its current one from there. */
 	#authentic(entry) {
@@ -1222,9 +1319,127 @@ var VaultService = class {
 	async #settled() {
 		const prepared = this.#prepared;
 		if (prepared.since === null && prepared.superseded === null) await this.#settle();
+		if (prepared.superseded === null && !prepared.converted) await this.#convert();
 		return prepared.superseded;
 	}
 	/**
+	* Replace every grant on every project of 0.4 with what 0.5 has instead
+	* (`convertEveryProjectGrants` in @coffre/core/access): a person's
+	* instance role and its scope, and project grants on the projects there
+	* are now. Once per process, before its first call does anything else:
+	* one decision per member who holds any, as `system:vault`, each grant it
+	* replaces an `access.revoke` that says what became of it. Another
+	* process that converts the same member at once finds nothing left under
+	* their lock. A member whose row fails its check is left as they are, and
+	* so is one the vault has reported changed around it since the last
+	* change to what they hold, even if their row checks out again now (a
+	* genuine row put back). `reportStands` is the rule, which `coffre
+	* migrate` applies too, holding no key, to every entry in the vault's
+	* name: it lists and marks a member so reported, forged or not.
+	* Removing them clears both.
+	*/
+	async #convert() {
+		for (const principal of await everyProjectHolders(this.#db)) {
+			if (this.#isRootAdmin(principal)) continue;
+			await this.#decideNow([principal], (d) => this.#replaceEveryProject(d, principal));
+		}
+		this.#prepared.converted = true;
+	}
+	async #replaceEveryProject(d, principal) {
+		const row = d.members.get(principal);
+		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+		if (row === void 0 || subject.status !== "active") return;
+		const everyProject = subject.stored.filter((grant) => grant.projectId === null && grant.environmentId === null);
+		if (everyProject.length === 0) return;
+		if (await reportStands(d.tx, principal, this.#check(d.reports, principal))) return;
+		await lockLogHead(d.tx);
+		const before = roleOf(principal, row);
+		const conversion = convertEveryProjectGrants({
+			person: principal.startsWith("user:"),
+			role: before.role,
+			everyProject: everyProject.filter((grant) => live(grant, d.at)).map((grant) => ({
+				environmentSlug: grant.environmentSlug,
+				role: grant.role,
+				expiresAt: grant.expiresAt
+			})),
+			grants: subject.stored.filter((grant) => grantKind(grant) !== null && live(grant, d.at)).map((grant) => ({
+				projectId: grant.projectId,
+				environmentId: grant.environmentId,
+				role: grant.role,
+				expiresAt: grant.expiresAt
+			})),
+			projects: await liveProjects(d.tx)
+		});
+		const after = {
+			role: conversion.role,
+			scope: conversion.scope
+		};
+		const replacedBy = {
+			role: after.role,
+			scope: after.scope,
+			grants: conversion.grants.length
+		};
+		d.grants.set(principal, [...subject.stored]);
+		d.touched.add(principal);
+		const correlation = { operationId: randomUUID() };
+		const drop = (grant) => d.writes.push(async () => {
+			await deleteGrant(d.tx, principal, grant);
+			d.grants.set(principal, d.grants.get(principal).filter((held) => held !== grant));
+		});
+		for (const grant of everyProject) {
+			drop(grant);
+			if (!live(grant, d.at)) continue;
+			const narrowed = conversion.narrowed.filter((loss) => loss.grant.environmentSlug === grant.environmentSlug);
+			d.log.push(accessEntry(VAULT_ACTOR, "access.revoke", principal, "allow", correlation, {
+				role: null,
+				expiresAt: null,
+				previousRole: grant.role,
+				...located(grant).detail,
+				replacedBy,
+				...narrowed.length === 0 ? {} : { narrowed: narrowed.map(({ grant: _, ...loss }) => loss) }
+			}));
+		}
+		if (JSON.stringify(standing(after)) !== JSON.stringify(standing(before))) {
+			d.log.push(accessEntry(VAULT_ACTOR, "member.role", principal, "allow", correlation, {
+				...after,
+				previousRole: before.role,
+				previousScope: before.scope,
+				reason: "every-project"
+			}));
+			d.writes.push(() => updateMember(d.tx, principal, after));
+		}
+		for (const given of conversion.grants) {
+			const place = {
+				projectId: given.projectId,
+				environmentId: given.environmentId,
+				environmentSlug: null
+			};
+			const there = subject.stored.find((grant) => grantKind(grant) !== null && placeKey(grant) === placeKey(place));
+			if (there !== void 0) drop(there);
+			d.writes.push(async (at) => {
+				const grant = {
+					principal,
+					...place,
+					role: given.role,
+					expiresAt: given.expiresAt,
+					grantedAt: at,
+					grantedBy: VAULT_ACTOR
+				};
+				await insertGrant(d.tx, grant);
+				d.grants.get(principal).push(grant);
+			});
+			d.log.push({
+				...accessEntry(VAULT_ACTOR, "access.grant", principal, "allow", correlation, {
+					role: given.role,
+					expiresAt: given.expiresAt === null ? null : iso(given.expiresAt),
+					previousRole: given.replaces,
+					reason: "every-project"
+				}),
+				...located(place).ids
+			});
+		}
+	}
+	/**
 	* Which of its keys count where. Those it replaced, from the KEKs in
 	* previousKeks, verify only what came before its first entry under its
 	* current key, `since`, and vouch for no member row after it. The first
@@ -1516,7 +1731,7 @@ var VaultService = class {
 		});
 		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		const check = async (d) => {
-			const reader = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports);
+			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
 			const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
 			const environments = await environmentsById(d.tx, [...secrets, ...at].map((place) => place.environmentId));
 			const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
@@ -1662,7 +1877,7 @@ var VaultService = class {
 		};
 		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		return this.#decide([principal], async (d) => {
-			const reader = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports);
+			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
 			const environments = await environmentsById(d.tx, items.flatMap((item) => {
 				const source = sources.get(item.source.secretId);
 				return source === void 0 ? [item.holder.environmentId] : [item.holder.environmentId, source.environmentId];
@@ -1743,7 +1958,7 @@ var VaultService = class {
 			return seals.map((seal) => done.has(seal.seq) ? "ended" : null);
 		};
 		return this.#decide([principal], async (d) => {
-			const actor = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports);
+			const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
 			const environments = await environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
 			const codes = seals.map((seal) => {
 				const holder = refuses(actor, "secret.write", placeIn(seal.holder, environments), false);
@@ -1809,14 +2024,15 @@ var VaultService = class {
 				decision: "allow",
 				subjectPrincipal: principal,
 				metadata: JSON.stringify({
-					owner: false,
+					role: "member",
 					rootAdmin: true
 				})
 			}]);
 			const row = {
 				principal,
 				status: "active",
-				owner: false,
+				role: "member",
+				scope: EVERYWHERE,
 				generation: 0,
 				createdAt: at,
 				createdBy: VAULT_ACTOR,
@@ -1837,15 +2053,12 @@ var VaultService = class {
 	* configuration, which no row can change.
 	*/
 	async #standing(db, principal, row, at, reports) {
-		const none = {
-			isRootAdmin: false,
-			isOwner: false,
-			grants: []
-		};
+		const none = NOTHING;
 		if (this.#isRootAdmin(principal)) {
 			const root = {
 				isRootAdmin: true,
-				isOwner: true,
+				role: "owner",
+				scope: EVERYWHERE,
 				grants: []
 			};
 			return {
@@ -1887,18 +2100,20 @@ var VaultService = class {
 			...grant,
 			role: grant.role
 		}));
-		const isOwner = row.owner && principal.startsWith("user:");
+		const { role, scope } = roleOf(principal, row);
 		return {
 			principal,
 			status: "active",
 			live: {
 				isRootAdmin: false,
-				isOwner,
+				role,
+				scope,
 				grants: held.filter((grant) => live(grant, at))
 			},
 			all: {
 				isRootAdmin: false,
-				isOwner,
+				role,
+				scope,
 				grants: held
 			},
 			fault,
@@ -1911,7 +2126,8 @@ var VaultService = class {
 			status: "active",
 			generation: row?.generation ?? 0,
 			isRootAdmin: true,
-			isOwner: true,
+			role: "owner",
+			scope: EVERYWHERE,
 			grants: [],
 			since: null,
 			by: null
@@ -1922,8 +2138,11 @@ var VaultService = class {
 			status: tampered ? "tampered" : !PRINCIPAL.test(principal) ? "unknown" : row?.status ?? "unknown",
 			generation: row?.generation ?? 0,
 			isRootAdmin: false,
-			isOwner: active && row.owner && principal.startsWith("user:"),
-			grants: active ? held.filter((grant) => live(grant, at)).map(view) : [],
+			...active ? roleOf(principal, row) : {
+				role: "member",
+				scope: EVERYWHERE
+			},
+			grants: active ? held.filter((grant) => live(grant, at) && grantKind(grant) !== null).map(view) : [],
 			since: row ? iso(row.statusChangedAt) : null,
 			by: row?.statusChangedBy ?? null
 		};
@@ -1983,9 +2202,12 @@ var VaultService = class {
 	}
 	setAccess(input) {
 		const { actor, principal } = input;
-		const changes = input.changes.map((change) => ({
-			...change,
-			environmentSlug: change.environmentSlug ?? null
+		const changes = input.changes.map(({ projectId, environmentId, role, expiresAt }) => ({
+			projectId,
+			environmentId,
+			environmentSlug: null,
+			role,
+			expiresAt
 		}));
 		const action = changes.every((change) => change.role === null) ? "access.revoke" : "access.grant";
 		const [only] = changes.length === 1 ? changes : [];
@@ -2002,41 +2224,54 @@ var VaultService = class {
 				...where.ids
 			}]);
 		};
-		const onProjects = changes.flatMap(({ projectId, environmentId, role }) => projectId === null ? [] : [{
-			projectId,
-			environmentId,
-			role
-		}]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a principal: ${principal}`);
 			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			const places$1 = /* @__PURE__ */ new Set();
 			for (const change of changes) {
-				const shape = placeShape(change);
-				if (shape !== null) throw refused("invalid", shape);
+				if (grantKind(change) === null) throw refused("invalid", change.projectId === null && change.environmentId === null ? "grants are on a project or an environment: a person reaches every project by their instance role" : "an environment is named in its project");
 				const key = placeKey(change);
 				if (places$1.has(key)) throw refused("invalid", "each place may be changed once per call");
 				places$1.add(key);
 				if (change.role !== null && !isRole(change.role)) throw refused("invalid", `no such role: ${change.role}`);
-				if (change.role !== null && (change.environmentId !== null || change.environmentSlug !== null) && !assignableToEnvironment(change.role)) throw refused("invalid", `${change.role} can only be granted on a project, or on every project`);
+				if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role)) throw refused("invalid", `${change.role} can only be granted on a project`);
 				const expiresAt = change.expiresAt === null ? null : Date.parse(change.expiresAt);
 				if (Number.isNaN(expiresAt) || expiresAt !== null && expiresAt <= d.at) throw refused("invalid", "an end date must be in the future");
 			}
-			if (onProjects.length > 0) await lockLogHead(d.tx);
-			const known = await places(d.tx, onProjects.map((change) => change.projectId), onProjects.flatMap((change) => change.environmentId === null ? [] : [change.environmentId]));
-			for (const { projectId, environmentId, role } of onProjects) {
-				if (!known.projects.has(projectId) || environmentId !== null && known.environments.get(environmentId) !== projectId) throw refused("invalid", `no such place: ${environmentId === null ? projectId : `${projectId}/${environmentId}`}`);
+			await lockLogHead(d.tx);
+			const known = await places(d.tx, changes.map((change) => change.projectId), changes.flatMap((change) => change.environmentId === null ? [] : [change.environmentId]));
+			const where = changes.map(({ projectId, environmentId, role }) => {
+				const environment = environmentId === null ? void 0 : known.environments.get(environmentId);
+				if (!known.projects.has(projectId) || environmentId !== null && environment?.projectId !== projectId) throw refused("invalid", `no such place: ${environmentId === null ? projectId : `${projectId}/${environmentId}`}`);
 				if (role !== null && (known.deleted.has(projectId) || environmentId !== null && known.deleted.has(environmentId))) throw refused("deleted");
-			}
-			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
+				return environmentId === null ? { projectId } : {
+					projectId,
+					environmentId,
+					environmentSlug: environment.slug
+				};
+			});
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
 			if (acting.status === "tampered") throw refused("tampered");
-			if (!changes.every((change) => mayManageAccess(acting.live, change))) throw refused("not_allowed");
+			const manages = where.every((place) => mayManageAccess(acting.live, place));
+			if (!manages && !(SERVICE.test(principal) && PERSON.test(actor))) throw refused("not_allowed");
+			if (actor === principal && !acting.live.isRootAdmin && changes.some((change) => change.role !== null)) throw refused("not_allowed", "nobody grants themselves a role: ask another admin");
 			const row = d.members.get(principal);
 			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			if (row?.status === "removed") throw refused("removed");
 			if (row === void 0) throw refused("not_a_member");
+			if (!manages) {
+				const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
+				const account = await this.#account(d.tx, subject, row);
+				if (!changes.every((change, i) => {
+					const before = subject.live.grants.find((grant) => placeKey({
+						...grant,
+						environmentSlug: null
+					}) === placeKey(change));
+					return [change.role, before?.role].every((role) => role == null || givesService(acting.live, setting, role, where[i]));
+				}) || !managesService(acting.live, setting, actor, account)) throw refused("not_allowed", NOT_THEIRS);
+			}
 			const held = subject.stored;
 			d.grants.set(principal, [...held]);
 			const outcomes = changes.map((change) => this.#apply(d, actor, principal, held, change, input));
@@ -2097,29 +2332,52 @@ var VaultService = class {
 	}
 	admit(input) {
 		const { actor, principal } = input;
-		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.add", principal, "deny", input, { owner: input.owner ?? null }, code)]);
+		const asked = input.role === void 0 ? {} : {
+			role: input.role,
+			scope: input.scope ?? EVERYWHERE
+		};
+		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.add", principal, "deny", input, asked, code)]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
-			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
 			if (acting.status === "tampered") throw refused("tampered");
-			if (!acting.live.isOwner) throw refused("not_allowed", "only owners may add or restore members");
+			if (!runsInstance(acting.live)) {
+				const service = SERVICE.test(principal) && (input.role ?? "member") === "member" && input.scope === void 0;
+				const setting = (await this.#settingsAt(d.tx, d.reports)).serviceAccounts;
+				if (!service || !PERSON.test(actor) || !setsUpServices(acting.live, setting, placesOf(await liveProjects(d.tx)))) throw refused("not_allowed", "only admins and owners of the whole instance may add people or set their roles, and a service account takes access somewhere the instance lets people set one up");
+				const removed = d.members.get(principal);
+				if (removed?.status === "removed" && removed.statusChangedBy !== actor) throw refused("not_allowed", `${shownMember(removed.statusChangedBy)} removed this service account: only they, or someone who runs the whole instance, may bring it back`);
+			}
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${shownMember(principal)}`);
 			if (this.#isRootAdmin(principal)) throw refused("root_admin");
-			if (input.owner === true && !principal.startsWith("user:")) throw refused("invalid", "service accounts cannot be owners");
+			if (input.role !== void 0 && !isInstanceRole(input.role)) throw refused("invalid", `no such instance role: ${input.role}`);
+			if (input.scope !== void 0 && (input.role === void 0 || !isScope(input.scope))) throw refused("invalid", "a scope is a role's: { projects, environments }, each all, only or except");
+			const wanted = input.role === void 0 ? void 0 : {
+				role: input.role,
+				scope: input.role === "member" ? EVERYWHERE : normalScope(input.scope ?? EVERYWHERE)
+			};
+			if (wanted !== void 0 && wanted.role !== "member" && !principal.startsWith("user:")) throw refused("invalid", "service accounts hold project grants only, never an instance role");
 			const row = d.members.get(principal);
 			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			d.touched.add(principal);
 			d.grants.set(principal, [...subject.stored]);
-			const entry = (action, owner) => d.log.push(accessEntry(actor, action, principal, "allow", input, { owner }));
+			const entry = (action, detail) => d.log.push(accessEntry(actor, action, principal, "allow", input, detail));
 			if (row === void 0 || row.status === "removed") {
-				const owner = input.owner ?? false;
-				entry(row === void 0 ? "member.add" : "member.restore", owner);
+				const { role, scope } = wanted ?? {
+					role: "member",
+					scope: EVERYWHERE
+				};
+				entry(row === void 0 ? "member.add" : "member.restore", {
+					role,
+					scope
+				});
 				d.writes.push(async (at) => {
 					if (row === void 0) await insertMember(d.tx, {
 						principal,
 						status: "active",
-						owner,
+						role,
+						scope,
 						generation: 0,
 						createdAt: at,
 						createdBy: actor,
@@ -2129,25 +2387,42 @@ var VaultService = class {
 					});
 					else await updateMember(d.tx, principal, {
 						status: "active",
-						owner,
+						role,
+						scope,
 						statusChangedAt: at,
 						statusChangedBy: actor
 					});
 				});
 				return {
 					created: true,
-					owner,
+					role,
+					scope,
 					generation: row?.generation ?? 0
 				};
 			}
-			const owner = input.owner ?? row.owner;
-			if (owner !== row.owner) {
-				entry("member.owner", owner);
-				d.writes.push(() => updateMember(d.tx, principal, { owner }));
+			const changed = wanted !== void 0 && JSON.stringify(standing(wanted)) !== JSON.stringify(standing(row));
+			if (changed && actor === principal) throw refused("not_allowed", "nobody changes their own instance role: ask another admin");
+			if (changed) {
+				entry("member.role", {
+					role: wanted.role,
+					scope: wanted.scope,
+					previousRole: row.role,
+					previousScope: row.scope
+				});
+				d.writes.push(() => updateMember(d.tx, principal, {
+					role: wanted.role,
+					scope: wanted.scope
+				}));
+				return {
+					created: false,
+					...wanted,
+					generation: row.generation
+				};
 			}
 			return {
 				created: false,
-				owner,
+				role: row.role,
+				scope: row.scope,
 				generation: row.generation
 			};
 		});
@@ -2160,16 +2435,18 @@ var VaultService = class {
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${shownMember(principal)}`);
 			if (this.#isRootAdmin(principal)) throw refused("root_admin");
 			const row = d.members.get(principal);
-			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const holder = acting.live;
 			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
 			const held = subject.stored;
 			if (subject.status === "tampered") {
-				if (!holder.isOwner) throw refused("not_allowed", "only owners may remove a member whose record failed its check");
+				if (!runsInstance(holder)) throw refused("not_allowed", "only admins and owners of the whole instance may remove a member whose record failed its check");
 				return this.#startOver(d, actor, principal, row, subject.fault, input, refused);
 			}
-			if (!holder.isOwner) throw refused("not_allowed", "only owners may remove members");
+			if (!runsInstance(holder)) {
+				if (!(SERVICE.test(principal) && PERSON.test(actor) && row?.status === "active" && managesService(holder, (await this.#settingsAt(d.tx, d.reports)).serviceAccounts, actor, await this.#account(d.tx, subject, row)))) throw refused("not_allowed", "only admins and owners of the whole instance may remove members, and a service account whoever manages it");
+			}
 			if (row?.status !== "active") throw refused(row === void 0 ? "not_a_member" : "removed");
 			const revoked = held.filter((grant) => live(grant, d.at));
 			for (const grant of revoked) {
@@ -2195,7 +2472,8 @@ var VaultService = class {
 				d.grants.set(principal, []);
 				await updateMember(d.tx, principal, {
 					status: "removed",
-					owner: false,
+					role: "member",
+					scope: EVERYWHERE,
 					generation,
 					statusChangedAt: at,
 					statusChangedBy: actor
@@ -2208,6 +2486,76 @@ var VaultService = class {
 		});
 	}
 	/**
+	* A service account as `managesService` weighs it: its live grants, each
+	* environment by its slug, which the setting's scope matches, and who
+	* admitted it, as its row says.
+	*/
+	async #account(db, subject, row) {
+		const slugs = await environmentsById(db, subject.live.grants.flatMap((grant) => grant.environmentId === null ? [] : [grant.environmentId]));
+		return {
+			grants: subject.live.grants.map((grant) => ({
+				role: grant.role,
+				place: grant.environmentId === null ? { projectId: grant.projectId } : {
+					projectId: grant.projectId,
+					environmentId: grant.environmentId,
+					environmentSlug: slugs.get(grant.environmentId)?.slug ?? null
+				}
+			})),
+			admittedBy: row.statusChangedBy
+		};
+	}
+	async settings() {
+		await this.#settled();
+		const reports = [];
+		const settings = await this.#settingsAt(this.#db, reports);
+		await this.#record(reports);
+		return settings;
+	}
+	/**
+	* The settings the vault's newest `settings.change` says, by its MAC: one
+	* in its name it did not write is passed over, and reported. With such
+	* entries and none of its own within reach, the setting is closed, never
+	* the default: otherwise whoever can insert rows could open it again.
+	*/
+	async #settingsAt(db, reports) {
+		const entry = await newestAuthentic((before) => newestVaultEntries(db, SETTINGS, LOOK_BACK.page, before), this.#check(reports, null));
+		if (entry === "none") return DEFAULT_SETTINGS;
+		if (typeof entry === "string") return CLOSED_SETTINGS;
+		const { serviceAccounts } = JSON.parse(entry.metadata);
+		return isScope(serviceAccounts) ? { serviceAccounts } : CLOSED_SETTINGS;
+	}
+	setSettings(input) {
+		const { actor } = input;
+		const entry = (decision, detail, code = null) => ({
+			actor,
+			action: SETTINGS,
+			decision,
+			code,
+			operationId: input.operationId ?? null,
+			requestId: input.requestId ?? null,
+			metadata: JSON.stringify({
+				...detail,
+				...traced(input)
+			})
+		});
+		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [entry("deny", { serviceAccounts: input.settings?.serviceAccounts ?? null }, code)]);
+		return this.#decide([actor], async (d) => {
+			validateCorrelation(input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			if (acting.status === "tampered") throw refused("tampered");
+			if (!runsInstance(acting.live)) throw refused("not_allowed", "only admins and owners of the whole instance change its settings");
+			if (!isScope(input.settings?.serviceAccounts)) throw refused("invalid", "who sets up service accounts is a scope: { projects, environments }, each all, only or except");
+			await lockLogHead(d.tx);
+			const previous = await this.#settingsAt(d.tx, d.reports);
+			const settings = { serviceAccounts: normalScope(input.settings.serviceAccounts) };
+			if (JSON.stringify(settings) !== JSON.stringify(previous)) d.log.push(entry("allow", {
+				...settings,
+				previous
+			}));
+			return { settings };
+		});
+	}
+	/**
 	* Remove a member whose row failed its check, from what the log says of
 	* them rather than what the row does: their grants go, whatever they were,
 	* and their generation moves past both the row's and the log's, so no
@@ -2229,7 +2577,8 @@ var VaultService = class {
 			d.grants.set(principal, []);
 			const fresh = {
 				status: "removed",
-				owner: false,
+				role: "member",
+				scope: EVERYWHERE,
 				generation,
 				createdAt: logged.createdAt,
 				createdBy: logged.createdBy,
@@ -2908,13 +3257,13 @@ function live(grant, at) {
 }
 /**
 * Where an entry about a grant says it is: its project and environment; or,
-* on every project, neither, and the place as a path in its payload. Only a
-* grant that names no place at all is on every project (`grantKind`).
+* for a grant on every project of 0.4, neither, and the place as a path in
+* its payload, `*`, or `*` and the slug, as 0.4 wrote it.
 */
 function located(place) {
-	return grantKind(place) === "every-project" ? {
+	return place.projectId === null && place.environmentId === null ? {
 		ids: {},
-		detail: { place: everyProjectPath(place.environmentSlug) }
+		detail: { place: place.environmentSlug === null ? "*" : `*/${place.environmentSlug}` }
 	} : {
 		ids: {
 			projectId: place.projectId,
@@ -2923,25 +3272,33 @@ function located(place) {
 		detail: {}
 	};
 }
-/** One key per place a member can hold a grant at, by what the grant names first: its environment, its project, or neither. */
+/** One key per place a member can hold a grant at, by what the grant names first: its environment, its project, or neither, on every project of 0.4. */
+/** Every project there is now and each of its environments, as a permission check names them. */
+function placesOf(projects) {
+	return projects.flatMap((project) => [{ projectId: project.id }, ...project.environments.map((environment) => ({
+		projectId: project.id,
+		environmentId: environment.id,
+		environmentSlug: environment.slug
+	}))]);
+}
 function placeKey(place) {
 	if (place.environmentId !== null) return `environment:${place.environmentId}`;
-	return place.projectId !== null ? `project:${place.projectId}` : everyProjectPath(place.environmentSlug);
+	return place.projectId !== null ? `project:${place.projectId}` : `every-project:${place.environmentSlug ?? ""}`;
 }
-/** Why a change's place is not one a grant can be at, or null when it is. */
-function placeShape(place) {
-	const kind = grantKind(place);
-	if (kind === null) return place.projectId === null ? "an environment is named in its project" : "a slug names environments on every project, not in one";
-	if (kind === "every-project" && place.environmentSlug !== null && !SLUG.test(place.environmentSlug)) return `not an environment slug: ${place.environmentSlug}`;
-	return null;
+/** A member's instance role, as their row has it: service accounts are members, whatever a row says. */
+function roleOf(principal, row) {
+	return principal.startsWith("user:") ? {
+		role: row.role,
+		scope: row.scope
+	} : {
+		role: "member",
+		scope: EVERYWHERE
+	};
 }
-/** An environment's slug, as the schema has it. */
-const SLUG = /^[a-z0-9][a-z0-9-]{0,62}$/;
 function view(grant) {
 	return {
 		projectId: grant.projectId,
 		environmentId: grant.environmentId,
-		environmentSlug: grant.environmentSlug,
 		role: grant.role,
 		expiresAt: grant.expiresAt === null ? null : iso(grant.expiresAt),
 		grantedAt: iso(grant.grantedAt),