@coffre/cli 0.1.1 → 0.1.3

package/dist/connect-BONR52al.js

@@ -0,0 +1,770 @@
+import { d as esm_default$1, m as __toESM, p as require_pg_connection_string } from "./esm-Bts-esAl.js";
+import { n as ROLE_NAMES, r as assignableToEnvironment } from "./access-CO1kGjWW.js";
+import { A as bigint, G as sql, H as SQL, O as customType, T as integer, ct as entityKind, f as primaryKey, g as uuid, it as foreignKey, k as boolean, lt as is, m as pgTable, rt as unique, tt as IndexedColumn, x as text, y as timestamp } from "./relations-CJCGPRst.js";
+import { r as drizzle } from "./node-postgres-_y-EeSHQ.js";
+import { a as trackCommits, i as relationsOf, n as asPostgresDatabase, r as ACTIVE_SUBJECT } from "./portable-CPh2thNN.js";
+import { resolve } from "node:path";
+import { checkServerIdentity } from "node:tls";
+//#region ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20260920.1_@libsql+client@0.18.0_@types+pg@8.20.0_pg@8.16.3/node_modules/drizzle-orm/pg-core/checks.js
+var CheckBuilder = class {
+	constructor(name, value) {
+		this.name = name;
+		this.value = value;
+	}
+	static [entityKind] = "PgCheckBuilder";
+	brand;
+	/** @internal */
+	build(table) {
+		return new Check(table, this);
+	}
+};
+var Check = class {
+	constructor(table, builder) {
+		this.table = table;
+		this.name = builder.name;
+		this.value = builder.value;
+	}
+	static [entityKind] = "PgCheck";
+	name;
+	value;
+};
+function check(name, value) {
+	return new CheckBuilder(name, value);
+}
+//#endregion
+//#region ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20260920.1_@libsql+client@0.18.0_@types+pg@8.20.0_pg@8.16.3/node_modules/drizzle-orm/pg-core/indexes.js
+var IndexBuilderOn = class {
+	constructor(unique, name) {
+		this.unique = unique;
+		this.name = name;
+	}
+	static [entityKind] = "PgIndexBuilderOn";
+	on(...columns) {
+		return new IndexBuilder(columns.map((it) => {
+			if (is(it, SQL)) return it;
+			it = it;
+			const clonedIndexedColumn = new IndexedColumn(it.name, !!it.keyAsName, it.columnType, it.indexConfig);
+			it.indexConfig = JSON.parse(JSON.stringify(it.defaultConfig));
+			return clonedIndexedColumn;
+		}), this.unique, false, this.name);
+	}
+	onOnly(...columns) {
+		return new IndexBuilder(columns.map((it) => {
+			if (is(it, SQL)) return it;
+			it = it;
+			const clonedIndexedColumn = new IndexedColumn(it.name, !!it.keyAsName, it.columnType, it.indexConfig);
+			it.indexConfig = it.defaultConfig;
+			return clonedIndexedColumn;
+		}), this.unique, true, this.name);
+	}
+	/**
+	* Specify what index method to use. Choices are `btree`, `hash`, `gist`, `spgist`, `gin`, `brin`, or user-installed access methods like `bloom`. The default method is `btree.
+	*
+	* If you have the `pg_vector` extension installed in your database, you can use the `hnsw` and `ivfflat` options, which are predefined types.
+	*
+	* **You can always specify any string you want in the method, in case Drizzle doesn't have it natively in its types**
+	*
+	* @param method The name of the index method to be used
+	* @param columns
+	* @returns
+	*/
+	using(method, ...columns) {
+		return new IndexBuilder(columns.map((it) => {
+			if (is(it, SQL)) return it;
+			it = it;
+			const clonedIndexedColumn = new IndexedColumn(it.name, !!it.keyAsName, it.columnType, it.indexConfig);
+			it.indexConfig = JSON.parse(JSON.stringify(it.defaultConfig));
+			return clonedIndexedColumn;
+		}), this.unique, true, this.name, method);
+	}
+};
+var IndexBuilder = class {
+	static [entityKind] = "PgIndexBuilder";
+	/** @internal */
+	config;
+	constructor(columns, unique, only, name, method = "btree") {
+		this.config = {
+			name,
+			columns,
+			unique,
+			only,
+			method
+		};
+	}
+	concurrently() {
+		this.config.concurrently = true;
+		return this;
+	}
+	with(obj) {
+		this.config.with = obj;
+		return this;
+	}
+	where(condition) {
+		this.config.where = condition;
+		return this;
+	}
+	/** @internal */
+	build(table) {
+		return new Index(this.config, table);
+	}
+};
+var Index = class {
+	static [entityKind] = "PgIndex";
+	config;
+	constructor(config, table) {
+		this.config = {
+			...config,
+			table
+		};
+	}
+};
+function index(name) {
+	return new IndexBuilderOn(false, name);
+}
+function uniqueIndex(name) {
+	return new IndexBuilderOn(true, name);
+}
+//#endregion
+//#region ../db/dist/rolldown-runtime-D7D4PA-g.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+//#endregion
+//#region ../db/dist/schema.js
+var schema_exports = /* @__PURE__ */ __exportAll({
+	auditChainHead: () => auditChainHead,
+	auditLog: () => auditLog,
+	credentials: () => credentials,
+	deviceAuthorizations: () => deviceAuthorizations,
+	environments: () => environments,
+	environmentsRelations: () => environmentsRelations,
+	identities: () => identities,
+	projects: () => projects,
+	secretVersions: () => secretVersions,
+	secrets: () => secrets,
+	secretsRelations: () => secretsRelations,
+	syncKeys: () => syncKeys,
+	syncKeysRelations: () => syncKeysRelations,
+	syncs: () => syncs,
+	syncsRelations: () => syncsRelations,
+	vaultGrants: () => vaultGrants,
+	vaultMembers: () => vaultMembers
+});
+const bytea = customType({ dataType: () => "bytea" });
+const createdAt = () => timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
+const projects = pgTable("projects", {
+	id: uuid().primaryKey().defaultRandom(),
+	slug: text().notNull(),
+	name: text().notNull(),
+	createdAt: createdAt(),
+	archivedAt: timestamp("archived_at", { withTimezone: true })
+}, (table) => [unique("projects_slug_key").on(table.slug), check("projects_slug_check", sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`)]);
+const environments = pgTable("environments", {
+	id: uuid().primaryKey().defaultRandom(),
+	projectId: uuid("project_id").notNull(),
+	slug: text().notNull(),
+	name: text().notNull(),
+	createdAt: createdAt(),
+	archivedAt: timestamp("archived_at", { withTimezone: true })
+}, (table) => [
+	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
+	unique("environments_project_scoped").on(table.id, table.projectId),
+	check("environments_slug_check", sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
+	foreignKey({
+		name: "environments_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict")
+]);
+const secrets = pgTable("secrets", {
+	id: uuid().primaryKey().defaultRandom(),
+	projectId: uuid("project_id").notNull(),
+	environmentId: uuid("environment_id").notNull(),
+	key: text().notNull(),
+	createdAt: createdAt(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+	currentVersionId: uuid("current_version_id").references(() => secretVersions.id, { onDelete: "no action" }),
+	currentVersion: integer("current_version").notNull().default(0),
+	archivedAt: timestamp("archived_at", { withTimezone: true })
+}, (table) => [
+	unique("secrets_project_id_environment_id_key_key").on(table.projectId, table.environmentId, table.key),
+	check("secrets_key_check", sql`${table.key} ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$'`),
+	foreignKey({
+		name: "secrets_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secrets_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secrets_environment_in_project",
+		columns: [table.environmentId, table.projectId],
+		foreignColumns: [environments.id, environments.projectId]
+	}),
+	index("secrets_lookup_idx").on(table.projectId, table.environmentId, table.key)
+]);
+const secretVersions = pgTable("secret_versions", {
+	id: uuid().primaryKey().defaultRandom(),
+	secretId: uuid("secret_id").notNull(),
+	version: integer().notNull(),
+	envelopeVersion: integer("envelope_version").notNull(),
+	ciphertext: bytea().notNull(),
+	iv: bytea().notNull(),
+	authTag: bytea("auth_tag").notNull(),
+	wrappedDek: bytea("wrapped_dek").notNull(),
+	kekProvider: text("kek_provider").notNull(),
+	kekId: text("kek_id").notNull(),
+	kekVersion: text("kek_version").notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull()
+}, (table) => [
+	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
+	check("secret_versions_version_check", sql`${table.version} > 0`),
+	check("secret_versions_iv_check", sql`octet_length(${table.iv}) = 12`),
+	check("secret_versions_auth_tag_check", sql`octet_length(${table.authTag}) = 16`),
+	foreignKey({
+		name: "secret_versions_secret_id_fkey",
+		columns: [table.secretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	index("secret_versions_secret_idx").on(table.secretId, table.version.desc())
+]);
+/** The role catalogue, as SQL: every role, and those an environment may be granted. */
+const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
+const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
+/**
+* The vault's member directory: everyone it has admitted, written by the
+* vault alone, read by both. A principal with no row is no member.
+* Principals are the strings coffre uses at its edges: `user:<email>`,
+* `token:<id>`, `sync:<id>`. Times are milliseconds since the epoch, each
+* the time of the vault's log entry that set it, so the log replays to
+* these rows exactly.
+*/
+const vaultMembers = pgTable("vault_members", {
+	principal: text().primaryKey(),
+	status: text().notNull(),
+	owner: boolean().notNull().default(false),
+	generation: integer().notNull().default(0),
+	createdAt: bigint("created_at", { mode: "number" }).notNull(),
+	createdBy: text("created_by").notNull(),
+	statusChangedAt: bigint("status_changed_at", { mode: "number" }).notNull(),
+	statusChangedBy: text("status_changed_by").notNull(),
+	accessSeq: bigint("access_seq", { mode: "bigint" }).notNull(),
+	mac: bytea().notNull()
+}, (table) => [
+	check("vault_members_mac_check", sql`octet_length(${table.mac}) = 32`),
+	check("vault_members_principal_check", sql`${table.principal} ~ '^(user|token|sync):[^[:space:]:][^[:space:]]*$'`),
+	check("vault_members_user_lowercase", sql`${table.principal} NOT LIKE 'user:%' OR ${table.principal} = lower(${table.principal})`),
+	check("vault_members_status_check", sql`${table.status} IN ('active', 'removed')`),
+	check("vault_members_owner_check", sql`NOT ${table.owner} OR (${table.status} = 'active' AND ${table.principal} LIKE 'user:%')`),
+	check("vault_members_generation_check", sql`${table.generation} >= 0`)
+]);
+/**
+* One role per member per place: a project, or one of its environments,
+* never both. A revoked grant is deleted; an expired one stays until its
+* place is granted again, so the members page can say it lapsed.
+*/
+const vaultGrants = pgTable("vault_grants", {
+	principal: text().notNull(),
+	projectId: uuid("project_id"),
+	environmentId: uuid("environment_id"),
+	role: text().notNull(),
+	expiresAt: bigint("expires_at", { mode: "number" }),
+	grantedAt: bigint("granted_at", { mode: "number" }).notNull(),
+	grantedBy: text("granted_by").notNull()
+}, (table) => [
+	check("vault_grants_one_place", sql`(${table.projectId} IS NULL) <> (${table.environmentId} IS NULL)`),
+	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
+	check("vault_grants_environment_role_check", sql`${table.environmentId} IS NULL OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	unique("vault_grants_on_project").on(table.principal, table.projectId),
+	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
+	foreignKey({
+		name: "vault_grants_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "vault_grants_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "vault_grants_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict")
+]);
+const auditLog = pgTable("audit_log", {
+	seq: bigint({ mode: "bigint" }).primaryKey(),
+	author: text().notNull(),
+	keyId: text("key_id").notNull(),
+	occurredAt: bigint("occurred_at", { mode: "number" }).notNull(),
+	actor: text().notNull(),
+	action: text().notNull(),
+	decision: text().notNull(),
+	code: text(),
+	subjectPrincipal: text("subject_principal"),
+	projectId: uuid("project_id"),
+	environmentId: uuid("environment_id"),
+	secretId: uuid("secret_id"),
+	secretVersionId: uuid("secret_version_id"),
+	operationId: uuid("operation_id"),
+	requestId: text("request_id"),
+	sourceIp: text("source_ip"),
+	relatedSeq: bigint("related_seq", { mode: "bigint" }),
+	metadata: text().notNull().default("{}"),
+	prevHash: bytea("prev_hash").notNull(),
+	mac: bytea().notNull(),
+	hash: bytea().notNull()
+}, (table) => [
+	check("audit_log_author_check", sql`${table.author} IN ('app', 'vault')`),
+	check("audit_log_actor_check", sql`${table.actor} ~ '^(user|token|sync|system):.+$'`),
+	check("audit_log_decision_check", sql`${table.decision} IN ('allow', 'deny')`),
+	check("audit_log_metadata_check", sql`${table.metadata}::jsonb IS NOT NULL`),
+	check("audit_log_prev_hash_check", sql`octet_length(${table.prevHash}) = 32`),
+	check("audit_log_mac_check", sql`octet_length(${table.mac}) = 32`),
+	check("audit_log_hash_check", sql`octet_length(${table.hash}) = 32`),
+	foreignKey({
+		name: "audit_log_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_secret_id_fkey",
+		columns: [table.secretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_secret_version_id_fkey",
+		columns: [table.secretVersionId],
+		foreignColumns: [secretVersions.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_related_seq_fkey",
+		columns: [table.relatedSeq],
+		foreignColumns: [table.seq]
+	}).onDelete("restrict"),
+	index("audit_log_project_idx").on(table.projectId, table.seq),
+	index("audit_log_environment_idx").on(table.environmentId, table.seq),
+	index("audit_log_secret_idx").on(table.secretId, table.seq),
+	index("audit_log_actor_idx").on(table.actor, table.seq),
+	index("audit_log_operation_idx").on(table.operationId, table.seq),
+	index("audit_log_action_idx").on(table.author, table.action, table.seq),
+	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
+	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq)
+]);
+const auditChainHead = pgTable("audit_chain_head", {
+	onlyRow: boolean("only_row").primaryKey().default(true),
+	nextSeq: bigint("next_seq", { mode: "bigint" }).notNull().default(sql`0`),
+	headHash: bytea("head_hash").notNull()
+}, (table) => [
+	check("audit_chain_head_only_row_check", sql`${table.onlyRow}`),
+	check("audit_chain_head_next_seq_check", sql`${table.nextSeq} >= 0`),
+	check("audit_chain_head_head_hash_check", sql`octet_length(${table.headHash}) = 32`)
+]);
+/**
+* An account at a sign-in provider, bound to one principal.
+*
+* Looked up by (provider, subject), never by email. An email address is
+* recycled when someone leaves; the provider's subject is not, so binding to
+* it is what stops a new holder of an old address from inheriting its access.
+* The email is kept for display only.
+*/
+const identities = pgTable("identities", {
+	id: uuid().primaryKey().defaultRandom(),
+	provider: text().notNull(),
+	authMac: bytea("auth_mac").notNull(),
+	subject: text().notNull(),
+	issuerHash: text("issuer_hash").notNull(),
+	generation: integer().notNull(),
+	principal: text().notNull(),
+	email: text(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	lastSignInAt: timestamp("last_sign_in_at", { withTimezone: true }),
+	revokedAt: timestamp("revoked_at", { withTimezone: true }),
+	revokedBy: text("revoked_by"),
+	activeSubject: text("active_subject").generatedAlwaysAs(ACTIVE_SUBJECT)
+}, (table) => [
+	check("identities_principal_check", sql`${table.principal} LIKE 'user:%'`),
+	check("identities_provider_check", sql`${table.provider} ~ '^[a-z0-9][a-z0-9-]{0,31}$'`),
+	check("identities_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	unique("identities_member_generation_key").on(table.id, table.principal, table.generation),
+	foreignKey({
+		name: "identities_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	uniqueIndex("identities_active_subject").on(table.provider, table.issuerHash, table.activeSubject),
+	index("identities_principal_idx").on(table.principal, table.generation)
+]);
+/**
+* Bearer credentials coffre issues itself: browser sessions, CLI sessions and
+* service tokens.
+*
+* One table, so that revoking everything a principal holds is one statement.
+* Only a SHA-256 of each token is stored. Tokens carry 256 bits of entropy, so
+* a fast hash is enough; a database leak yields nothing that authenticates.
+*/
+const credentials = pgTable("credentials", {
+	id: uuid().primaryKey().defaultRandom(),
+	kind: text().notNull(),
+	authMac: bytea("auth_mac").notNull(),
+	tokenHash: bytea("token_hash").notNull(),
+	tokenHint: text("token_hint").notNull(),
+	generation: integer().notNull(),
+	principal: text().notNull(),
+	identityId: uuid("identity_id"),
+	label: text(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+	lastUsedIp: text("last_used_ip"),
+	revokedAt: timestamp("revoked_at", { withTimezone: true }),
+	revokedBy: text("revoked_by")
+}, (table) => [
+	unique("credentials_token_hash_key").on(table.tokenHash),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service')`),
+	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
+	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
+	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),
+	check("credentials_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	foreignKey({
+		name: "credentials_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "credentials_identity_id_fkey",
+		columns: [
+			table.identityId,
+			table.principal,
+			table.generation
+		],
+		foreignColumns: [
+			identities.id,
+			identities.principal,
+			identities.generation
+		]
+	}).onDelete("restrict"),
+	index("credentials_principal_idx").on(table.principal, table.generation)
+]);
+/**
+* A CLI asking to be signed in from a browser (RFC 8628, device flow).
+*
+* The CLI holds the device code and polls with it; a signed-in person approves
+* the short user code in their browser. It works the same on a laptop and on
+* a server reached over SSH, which a localhost redirect does not.
+*/
+const deviceAuthorizations = pgTable("device_authorizations", {
+	id: uuid().primaryKey().defaultRandom(),
+	deviceCodeHash: bytea("device_code_hash").notNull(),
+	authMac: bytea("auth_mac").notNull(),
+	userCode: text("user_code").notNull(),
+	clientLabel: text("client_label"),
+	clientIp: text("client_ip"),
+	createdAt: createdAt(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	decidedAt: timestamp("decided_at", { withTimezone: true }),
+	decision: text(),
+	generation: integer().notNull().default(0),
+	principal: text(),
+	consumedAt: timestamp("consumed_at", { withTimezone: true })
+}, (table) => [
+	unique("device_authorizations_device_code_hash_key").on(table.deviceCodeHash),
+	unique("device_authorizations_user_code_key").on(table.userCode),
+	check("device_authorizations_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("device_authorizations_decision_check", sql`${table.decision} IS NULL OR ${table.decision} IN ('approved', 'denied')`),
+	check("device_authorizations_approval_names_principal", sql`(${table.decision} IS NULL AND ${table.decidedAt} IS NULL AND ${table.principal} IS NULL AND ${table.generation} = 0 AND ${table.consumedAt} IS NULL)
+        OR (${table.decision} IS NOT NULL AND ${table.decidedAt} IS NOT NULL AND (
+          (${table.decision} = 'denied' AND ${table.principal} IS NULL AND ${table.generation} = 0 AND ${table.consumedAt} IS NULL)
+          OR (${table.decision} = 'approved' AND ${table.principal} IS NOT NULL AND ${table.principal} LIKE 'user:%')
+        ))`),
+	foreignKey({
+		name: "device_authorizations_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict")
+]);
+/**
+* An environment kept in step with a third-party service: GitHub Actions
+* secrets, Vercel or Railway variables, Worker secrets.
+*
+* The destination's API token is itself a coffre secret, referenced by id, so
+* it is encrypted, versioned and audited like everything else and never sits
+* in this table.
+*/
+const syncs = pgTable("syncs", {
+	id: uuid().primaryKey().defaultRandom(),
+	projectId: uuid("project_id").notNull(),
+	environmentId: uuid("environment_id").notNull(),
+	provider: text().notNull(),
+	config: text().notNull(),
+	credentialSecretId: uuid("credential_secret_id").notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	pausedAt: timestamp("paused_at", { withTimezone: true }),
+	archivedAt: timestamp("archived_at", { withTimezone: true }),
+	leaseUntil: timestamp("lease_until", { withTimezone: true }),
+	lastRunAt: timestamp("last_run_at", { withTimezone: true }),
+	lastStatus: text("last_status"),
+	lastError: text("last_error")
+}, (table) => [
+	check("syncs_config_check", sql`${table.config}::jsonb IS NOT NULL`),
+	check("syncs_last_status_check", sql`${table.lastStatus} IS NULL OR ${table.lastStatus} IN ('ok', 'partial', 'failed')`),
+	foreignKey({
+		name: "syncs_environment_in_project",
+		columns: [table.environmentId, table.projectId],
+		foreignColumns: [environments.id, environments.projectId]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "syncs_credential_secret_id_fkey",
+		columns: [table.credentialSecretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	index("syncs_environment_idx").on(table.environmentId)
+]);
+/**
+* What a sync last pushed, one row per key.
+*
+* Most destinations are write-only, so coffre cannot diff against them. It
+* diffs against this instead: a key is stale when its secret has moved past
+* the version recorded here. It is also the list of keys coffre may delete at
+* the destination; a key it never pushed is never removed.
+*/
+const syncKeys = pgTable("sync_keys", {
+	syncId: uuid("sync_id").notNull(),
+	key: text().notNull(),
+	secretVersionId: uuid("secret_version_id"),
+	pushedAt: timestamp("pushed_at", { withTimezone: true }).notNull().defaultNow(),
+	removedAt: timestamp("removed_at", { withTimezone: true })
+}, (table) => [
+	primaryKey({
+		name: "sync_keys_pkey",
+		columns: [table.syncId, table.key]
+	}),
+	foreignKey({
+		name: "sync_keys_sync_id_fkey",
+		columns: [table.syncId],
+		foreignColumns: [syncs.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "sync_keys_secret_version_id_fkey",
+		columns: [table.secretVersionId],
+		foreignColumns: [secretVersions.id]
+	}).onDelete("restrict")
+]);
+const { environmentsRelations, secretsRelations, syncsRelations, syncKeysRelations } = relationsOf({
+	projects,
+	environments,
+	secrets,
+	secretVersions,
+	syncs,
+	syncKeys
+});
+//#endregion
+//#region ../db/dist/index.js
+function createDatabase(pool) {
+	return trackCommits(drizzle(pool, { schema: schema_exports }));
+}
+//#endregion
+//#region ../../node_modules/.pnpm/pg-connection-string@2.14.0/node_modules/pg-connection-string/esm/index.mjs
+var import_pg_connection_string = /* @__PURE__ */ __toESM(require_pg_connection_string(), 1);
+import_pg_connection_string.default.parse;
+import_pg_connection_string.default.parse;
+import_pg_connection_string.default.toClientConfig;
+const parseIntoClientConfig = import_pg_connection_string.default.parseIntoClientConfig;
+//#endregion
+//#region ../db/dist/postgres-Bmar8y0q.js
+/** Keep libpq's system-root shortcut from being read as a certificate filename by pg. */
+function postgresConnection(url) {
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		throw new Error("invalid Postgres URL");
+	}
+	const parameters = parsed.searchParams;
+	if (parameters.getAll("sslrootcert").at(-1) !== "system") return { connectionString: url };
+	const mode = parameters.getAll("sslmode").at(-1);
+	if (mode !== void 0 && mode !== "verify-full") throw new Error("sslrootcert=system requires sslmode=verify-full");
+	parameters.delete("sslrootcert");
+	parameters.set("sslmode", "verify-full");
+	const config = parseIntoClientConfig(parsed.toString());
+	const host = config.host;
+	if (!host) throw new Error("sslrootcert=system requires a Postgres hostname");
+	config.ssl = {
+		...config.ssl,
+		rejectUnauthorized: true,
+		checkServerIdentity: (_hostname, certificate) => checkServerIdentity(host, certificate)
+	};
+	return config;
+}
+//#endregion
+//#region ../db/dist/connect.js
+/**
+* Open a database from its URL, on a Node server:
+*
+*   postgres://… or postgresql://…   node-postgres
+*   file:… or libsql:…                @libsql/client (SQLite)
+*
+* The SQLite driver loads only when asked for. The Worker does not
+* come through here; it builds its Postgres database from the Hyperdrive
+* pool with createDatabase.
+*/
+async function openDatabase(url) {
+	switch (engineOfUrl(url)) {
+		case "postgres": {
+			const pool = new esm_default$1.Pool(postgresConnection(url));
+			return {
+				engine: "postgres",
+				db: createDatabase(pool),
+				close: () => pool.end()
+			};
+		}
+		case "sqlite": {
+			const [{ createClient }, { drizzle }, schema] = await Promise.all([
+				import("@libsql/client"),
+				import("drizzle-orm/libsql"),
+				import("./schema-sqlite-Byp7B3yI.js")
+			]);
+			const client = createClient({
+				url,
+				timeout: 5e3,
+				intMode: "bigint"
+			});
+			if (url.startsWith("file:")) await client.execute("PRAGMA journal_mode = WAL");
+			const db = drizzle({
+				client: oneTransactionAtATime(client, writeQueueFor(url)),
+				schema
+			});
+			return {
+				engine: "sqlite",
+				db: asPostgresDatabase(db),
+				close: async () => client.close()
+			};
+		}
+	}
+}
+function engineOfUrl(url) {
+	const scheme = url.slice(0, url.indexOf(":"));
+	if (scheme === "postgres" || scheme === "postgresql") return "postgres";
+	if (scheme === "mysql") throw new Error("coffre supports Postgres; MySQL support was removed");
+	if (scheme === "file" || scheme === "libsql") return "sqlite";
+	throw new Error(`unsupported database URL scheme: ${scheme}:`);
+}
+/**
+* SQLite lets one connection write at a time and fails the others at once
+* with SQLITE_BUSY rather than queueing them; 24 concurrent audit appends were
+* enough to see it. So transactions queue here instead, in the order they
+* asked, one open at a time per database file, however many clients or
+* connections reach it. Each begins IMMEDIATE (libsql's default), taking the
+* write lock with its first statement, which is what makes a read inside it
+* as good as a locked one (see forUpdate).
+*/
+var WriteQueue = class {
+	#tail = Promise.resolve();
+	/** Wait for our turn; the returned function ends it. */
+	acquire() {
+		let release;
+		const turn = new Promise((done) => release = done);
+		const ready = this.#tail.then(() => release);
+		this.#tail = this.#tail.then(() => turn);
+		return ready;
+	}
+};
+const queues = /* @__PURE__ */ new Map();
+function writeQueueFor(url) {
+	const key = url.startsWith("file:") ? resolve(url.replace(/^file:(\/\/)?/, "").split("?")[0]) : url;
+	let queue = queues.get(key);
+	if (queue === void 0) queues.set(key, queue = new WriteQueue());
+	return queue;
+}
+function oneTransactionAtATime(client, queue) {
+	return new Proxy(client, { get(target, key) {
+		if (key === "execute") return async (...args) => numbers(await target.execute(...args));
+		if (key === "transaction") return async (mode) => {
+			const release = await queue.acquire();
+			try {
+				return settling(await target.transaction(mode), release);
+			} catch (error) {
+				release();
+				throw error;
+			}
+		};
+		if (key === "batch" || key === "migrate" || key === "executeMultiple") return async (...args) => {
+			const release = await queue.acquire();
+			try {
+				return (await target[key](...args))?.map(numbers);
+			} finally {
+				release();
+			}
+		};
+		const value = Reflect.get(target, key, target);
+		return typeof value === "function" ? value.bind(target) : value;
+	} });
+}
+/** Ends the transaction's turn when it commits, rolls back or closes. */
+function settling(tx, release) {
+	let settled = false;
+	const settle = () => {
+		if (settled) return;
+		settled = true;
+		release();
+	};
+	const { commit, rollback, close, execute, batch } = tx;
+	tx.execute = async (...args) => numbers(await execute.apply(tx, args));
+	tx.batch = async (...args) => (await batch.apply(tx, args)).map(numbers);
+	tx.commit = async () => {
+		try {
+			return await commit.call(tx);
+		} finally {
+			settle();
+		}
+	};
+	tx.rollback = async () => {
+		try {
+			return await rollback.call(tx);
+		} finally {
+			settle();
+		}
+	};
+	tx.close = () => {
+		try {
+			close.call(tx);
+		} finally {
+			settle();
+		}
+	};
+	return tx;
+}
+/** Keep large counters exact; Drizzle's booleans and dates still need safe numbers. */
+function numbers(result) {
+	result.rows = result.rows.map((row) => {
+		const properties = Object.getOwnPropertyDescriptors(row);
+		for (const property of Object.values(properties)) {
+			const value = property.value;
+			if (typeof value === "bigint" && value >= BigInt(Number.MIN_SAFE_INTEGER) && value <= BigInt(Number.MAX_SAFE_INTEGER)) property.value = Number(value);
+		}
+		return Object.create(Object.getPrototypeOf(row), properties);
+	});
+	return result;
+}
+//#endregion
+export { openDatabase as n, postgresConnection as r, engineOfUrl as t };