@coffre/vault 0.7.0 → 0.8.1

package/dist/cloudflare.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CwsWOH6j.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as People, i as KekProvider, l as checkpointMessage, m as derivedSigningKey, n as AwsKmsOptions, o as SecretContext, p as VaultConfig, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-BkHJR9Gt.js";
 import { AdmitInput, EndReferencesInput, ReferenceInput, RemoveInput, RewrapInput, SetAccessInput, SetSettingsInput, UnwrapInput, Vault, VerifyLogInput, WrapInput } from "@coffre/core/vault";
 import { PostgresDatabase, PostgresDatabase as PostgresDatabase$1, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -63,4 +63,4 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
 /** The vault Worker's default export, `VaultEntrypoint`, configured from its `env`. */
 export declare function vault<Env>(configure_: (env: Env) => WorkersVaultConfig): typeof VaultEntrypoint;
 //#endregion
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type PostgresDatabase, type SecretContext, type Vault, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, postgres, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type People, type PostgresDatabase, type SecretContext, type Vault, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, postgres, verifyCheckpoint };

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-CQJS3OZZ.js";
-import { n as prepareVault, t as openVault } from "./vault-jbn0I41Z.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-BcttALFQ.js";
+import { n as prepareVault, t as openVault } from "./vault-lBbyZ3kQ.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/{index-CwsWOH6j.d.ts → index-BkHJR9Gt.d.ts}

@@ -2,6 +2,15 @@ import { checkpointMessage as checkpointMessage$1, verifyCheckpoint } from "@cof
 import { AwsCredentials, AwsKmsOptions, KekBadClaimError as KekBadClaimError$1, KekProvider, KekProvider as KekProvider$1, KekRegistry, KekUnavailableError as KekUnavailableError$1, WrappedDek, awsKms } from "@coffre/core/kek";
 import { SecretContext } from "@coffre/core/envelope";
 //#region src/config.d.ts
+/**
+ * What a person's reads open (docs/design/credential-proxy.md): `values`,
+ * as any member's; or `stand-ins`, where a person, on any credential of
+ * theirs (a session, a personal token, an MCP connection), opens values
+ * only for coffre to use for them, never to be handed back: the credential
+ * proxy injects them, and the deployment's `expose` list names the few it
+ * may pass on. Service accounts read values either way.
+ */
+type People = 'values' | 'stand-ins';
 /**
  * A key-encryption key: 32 random bytes, base64, and the id envelopes record
  * it under; or one a key service holds, such as `awsKms({ keyArn, … })`.
@@ -41,6 +50,8 @@ type VaultConfig = {
     count: number;
     windowMinutes: number;
   };
+  /** What a person's reads open (`People`): `values` unless set. */
+  people?: People;
 } & Owners;
 /**
  * At least one email, each an Owner of the whole instance: made one when
@@ -69,4 +80,4 @@ type Owners = {
 /** The signing key a local KEK stands for, when the vault is given none: HKDF-SHA-256 of the KEK. */
 declare function derivedSigningKey(kek: Uint8Array): Buffer;
 //#endregion
-export { KekUnavailableError$1 as a, awsKms as c, Kek as d, VaultConfig as f, KekProvider$1 as i, checkpointMessage$1 as l, AwsKmsOptions as n, SecretContext as o, derivedSigningKey as p, KekBadClaimError$1 as r, WrappedDek as s, AwsCredentials as t, verifyCheckpoint as u };
+export { KekUnavailableError$1 as a, awsKms as c, Kek as d, People as f, KekProvider$1 as i, checkpointMessage$1 as l, derivedSigningKey as m, AwsKmsOptions as n, SecretContext as o, VaultConfig as p, KekBadClaimError$1 as r, WrappedDek as s, AwsCredentials as t, verifyCheckpoint as u };

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CwsWOH6j.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as People, i as KekProvider, l as checkpointMessage, m as derivedSigningKey, n as AwsKmsOptions, o as SecretContext, p as VaultConfig, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-BkHJR9Gt.js";
 export type * from "@coffre/core/vault";
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type People, type SecretContext, type VaultConfig, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-CQJS3OZZ.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, t as KekBadClaimError } from "./src-BcttALFQ.js";
 export { KekBadClaimError, KekUnavailableError, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.d.ts

@@ -1,4 +1,4 @@
-import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-CwsWOH6j.js";
+import { a as KekUnavailableError, c as awsKms, d as Kek, f as People, i as KekProvider, l as checkpointMessage, m as derivedSigningKey, n as AwsKmsOptions, o as SecretContext, p as VaultConfig, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-BkHJR9Gt.js";
 import { Vault, Vault as Vault$1 } from "@coffre/core/vault";
 import { Database } from "@coffre/db";
 import "@coffre/core/audit";
@@ -45,4 +45,4 @@ export declare function serveVault(config: NodeVaultConfig & {
 /** The vault that `serveVault` runs, from the server's side of its socket. */
 export declare function connectVault(socket: string): Vault;
 //#endregion
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type LocalVault, type SecretContext, type Vault, type VaultConfig, type VaultOptions, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type LocalVault, type People, type SecretContext, type Vault, type VaultConfig, type VaultOptions, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/node.js

@@ -1,5 +1,5 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-CQJS3OZZ.js";
-import { n as prepareVault, t as openVault } from "./vault-jbn0I41Z.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-BcttALFQ.js";
+import { n as prepareVault, t as openVault } from "./vault-lBbyZ3kQ.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{src-CQJS3OZZ.js → src-BcttALFQ.js}

@@ -57,7 +57,8 @@ function resolveVaultConfig(config) {
 		keks: new KekRegistry(current, previous),
 		owners: checkOwners(config.owners ?? config.bootstrapOwners ?? config.rootAdmins ?? []),
 		signingKeys: signingKeys(config.signingKey, keks),
-		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit)
+		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit),
+		people: checkPeople(config.people ?? "values")
 	};
 }
 /**
@@ -80,6 +81,10 @@ function signingKeys(given, keks) {
 	}
 	return [signing, ...derived].filter((key, i, all) => all.findIndex((other) => other.equals(key)) === i);
 }
+function checkPeople(people) {
+	if (people !== "values" && people !== "stand-ins") throw new Error(`people is 'values' or 'stand-ins'; got ${JSON.stringify(people)}`);
+	return people;
+}
 function checkBulkLimit({ count, windowMinutes }) {
 	if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) throw new Error("bulkLimit needs a whole count of at least 1 and a window above 0 minutes");
 	return {

package/dist/{vault-jbn0I41Z.js → vault-lBbyZ3kQ.js}

@@ -1,4 +1,4 @@
-import { ACCESS_ACTIONS, checkpointMessage, checkpointVerifier, describeAccessFault } from "@coffre/core/vault";
+import { ACCESS_ACTIONS, HANDED_BACK, checkpointMessage, checkpointVerifier, describeAccessFault } from "@coffre/core/vault";
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { tablesOf } from "@coffre/db";
@@ -1083,6 +1083,7 @@ const MESSAGES = {
 	deleted: "this project or environment was deleted",
 	ended: "the reference read through was ended",
 	personal: "a personal config's values are its owner's alone",
+	stand_ins: "people use this instance's values through stand-ins, never as values: `coffre run` gives your app them; a service account reads values",
 	not_allowed: "not allowed to change this",
 	last_owner: "the last Owner of the whole instance stays one: make someone else an Owner first",
 	invalid: "not something the rules allow",
@@ -1762,6 +1763,7 @@ var VaultService = class {
 			});
 			if (call.vet !== void 0 && !codes.some((code) => code !== null)) (await call.vet(d.tx)).forEach((code, i) => codes[i] = code);
 			let first = codes.find((code) => code !== null) ?? null;
+			if (first === null && action === "secret.read" && this.#config.people === "stand-ins" && principal.startsWith("user:") && HANDED_BACK.includes(call.input.purpose)) first = "stand_ins";
 			if (first === null && action === "secret.read" && await this.#overBulkLimit(d, principal, secrets.length)) first = "bulk_limit";
 			if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, i) => entry(secret, "deny", codes[i] ?? first)));
 		};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.7.0",
+  "version": "0.8.1",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.7.0",
-    "@coffre/db": "0.7.0"
+    "@coffre/core": "0.8.1",
+    "@coffre/db": "0.8.1"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/config.ts

@@ -28,8 +28,20 @@ export type ResolvedVaultConfig = {
    */
   signingKeys: readonly Uint8Array[];
   bulkLimit: BulkLimit;
+  /** `values` when left out. */
+  people?: People;
 };
 
+/**
+ * What a person's reads open (docs/design/credential-proxy.md): `values`,
+ * as any member's; or `stand-ins`, where a person, on any credential of
+ * theirs (a session, a personal token, an MCP connection), opens values
+ * only for coffre to use for them, never to be handed back: the credential
+ * proxy injects them, and the deployment's `expose` list names the few it
+ * may pass on. Service accounts read values either way.
+ */
+export type People = 'values' | 'stand-ins';
+
 /**
  * A key-encryption key: 32 random bytes, base64, and the id envelopes record
  * it under; or one a key service holds, such as `awsKms({ keyArn, … })`.
@@ -64,6 +76,8 @@ export type VaultConfig = {
   signingKey?: string;
   /** At most `count` data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
   bulkLimit?: { count: number; windowMinutes: number };
+  /** What a person's reads open (`People`): `values` unless set. */
+  people?: People;
 } & Owners;
 
 /**
@@ -142,6 +156,7 @@ export function resolveVaultConfig(config: VaultConfig): ResolvedVaultConfig {
     owners: checkOwners(config.owners ?? config.bootstrapOwners ?? config.rootAdmins ?? []),
     signingKeys: signingKeys(config.signingKey, keks),
     bulkLimit: config.bulkLimit === undefined ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit),
+    people: checkPeople(config.people ?? 'values'),
   };
 }
 
@@ -169,6 +184,11 @@ function signingKeys(given: string | undefined, keks: { provider: KekProvider; s
   return [signing, ...derived].filter((key, i, all) => all.findIndex((other) => other.equals(key)) === i);
 }
 
+function checkPeople(people: People): People {
+  if (people !== 'values' && people !== 'stand-ins') throw new Error(`people is 'values' or 'stand-ins'; got ${JSON.stringify(people)}`);
+  return people;
+}
+
 function checkBulkLimit({ count, windowMinutes }: { count: number; windowMinutes: number }): BulkLimit {
   if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) {
     throw new Error('bulkLimit needs a whole count of at least 1 and a window above 0 minutes');

package/src/index.ts

@@ -3,6 +3,6 @@ export { checkpointMessage, verifyCheckpoint } from '@coffre/core/vault';
 export type { SecretContext } from '@coffre/core/envelope';
 export { awsKms, KekBadClaimError, KekUnavailableError } from '@coffre/core/kek';
 export type { AwsCredentials, AwsKmsOptions, KekProvider, WrappedDek } from '@coffre/core/kek';
-export type { Kek, VaultConfig } from './config.ts';
+export type { Kek, People, VaultConfig } from './config.ts';
 /** The signing key a local KEK stands for, for tools that check the vault's records from outside. */
 export { derivedSigningKey } from './config.ts';

package/src/vault.ts

@@ -46,6 +46,7 @@ import {
   checkpointMessage,
   checkpointVerifier,
   describeAccessFault,
+  HANDED_BACK,
   type Access,
   type AccessChange,
   type AccessFault,
@@ -60,6 +61,7 @@ import {
   type LogHead,
   type LogVerification,
   type Outcome,
+  type Purpose,
   type ReferenceInput,
   type Refusal,
   type RefusalCode,
@@ -281,6 +283,7 @@ const MESSAGES: Record<RefusalCode, string> = {
   deleted: 'this project or environment was deleted',
   ended: 'the reference read through was ended',
   personal: "a personal config's values are its owner's alone",
+  stand_ins: "people use this instance's values through stand-ins, never as values: `coffre run` gives your app them; a service account reads values",
   not_allowed: 'not allowed to change this',
   last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
   invalid: 'not something the rules allow',
@@ -1054,6 +1057,8 @@ class VaultService implements Vault {
         (await call.vet(d.tx)).forEach((code, i) => (codes[i] = code));
       }
       let first = codes.find((code) => code !== null) ?? null;
+      // A person's values are only ever used for them, where people get stand-ins: by whatever credential of theirs asks.
+      if (first === null && action === 'secret.read' && this.#config.people === 'stand-ins' && principal.startsWith('user:') && HANDED_BACK.includes(call.input.purpose as Purpose)) first = 'stand_ins';
       if (first === null && action === 'secret.read' && (await this.#overBulkLimit(d, principal, secrets.length))) first = 'bulk_limit';
       if (first !== null) {
         throw new Refused(