@coffre/cli 0.1.10 → 0.1.12

package/dist/{connect-BZdPYNbZ.js → connect-BXDkiWOL.js}

@@ -1,2 +1,2 @@
-import { n as openDatabase, r as postgresConnection, t as engineOfUrl } from "./connect-BONR52al.js";
+import { n as openDatabase, r as postgresConnection, t as engineOfUrl } from "./connect-tekAM4hC.js";
 export { engineOfUrl, openDatabase, postgresConnection };

package/dist/{connect-BONR52al.js → connect-tekAM4hC.js}

@@ -1,9 +1,10 @@
 import { d as esm_default$1, m as __toESM, p as require_pg_connection_string } from "./esm-Bts-esAl.js";
 import { n as ROLE_NAMES, r as assignableToEnvironment } from "./access-CO1kGjWW.js";
-import { A as bigint, G as sql, H as SQL, O as customType, T as integer, ct as entityKind, f as primaryKey, g as uuid, it as foreignKey, k as boolean, lt as is, m as pgTable, rt as unique, tt as IndexedColumn, x as text, y as timestamp } from "./relations-CJCGPRst.js";
-import { r as drizzle } from "./node-postgres-_y-EeSHQ.js";
-import { a as trackCommits, i as relationsOf, n as asPostgresDatabase, r as ACTIVE_SUBJECT } from "./portable-CPh2thNN.js";
+import { D as customType, O as boolean, V as SQL, W as sql, b as text, ct as is, et as IndexedColumn, h as uuid, k as bigint, nt as unique, p as pgTable, rt as foreignKey, st as entityKind, v as timestamp, w as integer } from "./relations-BuTStNq-.js";
+import { r as drizzle } from "./node-postgres-BHgGDfvg.js";
+import { a as trackCommits, i as relationsOf, n as asPostgresDatabase, r as ACTIVE_SUBJECT } from "./portable-9wWdi5e1.js";
 import { resolve } from "node:path";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { checkServerIdentity } from "node:tls";
 //#region ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20260920.1_@libsql+client@0.18.0_@types+pg@8.20.0_pg@8.16.3/node_modules/drizzle-orm/pg-core/checks.js
 var CheckBuilder = class {
@@ -150,10 +151,6 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	secretVersions: () => secretVersions,
 	secrets: () => secrets,
 	secretsRelations: () => secretsRelations,
-	syncKeys: () => syncKeys,
-	syncKeysRelations: () => syncKeysRelations,
-	syncs: () => syncs,
-	syncsRelations: () => syncsRelations,
 	vaultGrants: () => vaultGrants,
 	vaultMembers: () => vaultMembers
 });
@@ -502,86 +499,67 @@ const deviceAuthorizations = pgTable("device_authorizations", {
 		foreignColumns: [vaultMembers.principal]
 	}).onDelete("restrict")
 ]);
-/**
-* An environment kept in step with a third-party service: GitHub Actions
-* secrets, Vercel or Railway variables, Worker secrets.
-*
-* The destination's API token is itself a coffre secret, referenced by id, so
-* it is encrypted, versioned and audited like everything else and never sits
-* in this table.
-*/
-const syncs = pgTable("syncs", {
-	id: uuid().primaryKey().defaultRandom(),
-	projectId: uuid("project_id").notNull(),
-	environmentId: uuid("environment_id").notNull(),
-	provider: text().notNull(),
-	config: text().notNull(),
-	credentialSecretId: uuid("credential_secret_id").notNull(),
-	createdAt: createdAt(),
-	createdBy: text("created_by").notNull(),
-	pausedAt: timestamp("paused_at", { withTimezone: true }),
-	archivedAt: timestamp("archived_at", { withTimezone: true }),
-	leaseUntil: timestamp("lease_until", { withTimezone: true }),
-	lastRunAt: timestamp("last_run_at", { withTimezone: true }),
-	lastStatus: text("last_status"),
-	lastError: text("last_error")
-}, (table) => [
-	check("syncs_config_check", sql`${table.config}::jsonb IS NOT NULL`),
-	check("syncs_last_status_check", sql`${table.lastStatus} IS NULL OR ${table.lastStatus} IN ('ok', 'partial', 'failed')`),
-	foreignKey({
-		name: "syncs_environment_in_project",
-		columns: [table.environmentId, table.projectId],
-		foreignColumns: [environments.id, environments.projectId]
-	}).onDelete("restrict"),
-	foreignKey({
-		name: "syncs_credential_secret_id_fkey",
-		columns: [table.credentialSecretId],
-		foreignColumns: [secrets.id]
-	}).onDelete("restrict"),
-	index("syncs_environment_idx").on(table.environmentId)
-]);
-/**
-* What a sync last pushed, one row per key.
-*
-* Most destinations are write-only, so coffre cannot diff against them. It
-* diffs against this instead: a key is stale when its secret has moved past
-* the version recorded here. It is also the list of keys coffre may delete at
-* the destination; a key it never pushed is never removed.
-*/
-const syncKeys = pgTable("sync_keys", {
-	syncId: uuid("sync_id").notNull(),
-	key: text().notNull(),
-	secretVersionId: uuid("secret_version_id"),
-	pushedAt: timestamp("pushed_at", { withTimezone: true }).notNull().defaultNow(),
-	removedAt: timestamp("removed_at", { withTimezone: true })
-}, (table) => [
-	primaryKey({
-		name: "sync_keys_pkey",
-		columns: [table.syncId, table.key]
-	}),
-	foreignKey({
-		name: "sync_keys_sync_id_fkey",
-		columns: [table.syncId],
-		foreignColumns: [syncs.id]
-	}).onDelete("restrict"),
-	foreignKey({
-		name: "sync_keys_secret_version_id_fkey",
-		columns: [table.secretVersionId],
-		foreignColumns: [secretVersions.id]
-	}).onDelete("restrict")
-]);
-const { environmentsRelations, secretsRelations, syncsRelations, syncKeysRelations } = relationsOf({
+const { environmentsRelations, secretsRelations } = relationsOf({
 	projects,
 	environments,
 	secrets,
-	secretVersions,
-	syncs,
-	syncKeys
+	secretVersions
 });
 //#endregion
 //#region ../db/dist/index.js
+/**
+* A query made on the database from inside one of its own transactions,
+* rather than through the transaction. With one connection per call, as on
+* Workers, it would wait for the transaction, which waits for it: a call
+* Cloudflare cancels as hung, and nothing says why. So it is refused at
+* once, with this, wherever the database runs.
+*/
+var QueryOutsideTransaction = class extends Error {
+	constructor() {
+		super("query outside its transaction: use tx. A query on the database inside one of its own transactions waits for that transaction, which waits for it");
+		this.name = "QueryOutsideTransaction";
+	}
+};
+/** The transaction a flow of work runs inside, with the pool it holds, while it is open. */
+const inside = new AsyncLocalStorage();
+/**
+* `pool`, refusing a query or a transaction asked from inside a transaction
+* it is already running. Work from any other flow, a concurrent request's,
+* or what the transaction left running after it ended, goes on as before.
+*/
+function guarded(pool) {
+	return new Proxy(pool, { get(target, key) {
+		const value = Reflect.get(target, key, target);
+		if (typeof value !== "function") return value;
+		if (key !== "query" && key !== "connect") return value.bind(target);
+		return (...args) => {
+			const open = inside.getStore();
+			if (open?.open === true && open.pool === target) throw new QueryOutsideTransaction();
+			return value.apply(target, args);
+		};
+	} });
+}
+/** The refusal `error` is, or was caused by. */
+function brokenRule(error) {
+	for (let cause = error; cause instanceof Error; cause = cause.cause) if (cause instanceof QueryOutsideTransaction) return cause;
+}
 function createDatabase(pool) {
-	return trackCommits(drizzle(pool, { schema: schema_exports }));
+	const db = drizzle(guarded(pool), { schema: schema_exports });
+	const run = db.transaction.bind(db);
+	db.transaction = (async (work, config) => {
+		const open = {
+			pool,
+			open: true
+		};
+		try {
+			return await run((tx) => inside.run(open, () => work(tx)), config);
+		} catch (error) {
+			throw brokenRule(error) ?? error;
+		} finally {
+			open.open = false;
+		}
+	});
+	return trackCommits(db);
 }
 //#endregion
 //#region ../../node_modules/.pnpm/pg-connection-string@2.14.0/node_modules/pg-connection-string/esm/index.mjs
@@ -642,7 +620,7 @@ async function openDatabase(url) {
 			const [{ createClient }, { drizzle }, schema] = await Promise.all([
 				import("@libsql/client"),
 				import("drizzle-orm/libsql"),
-				import("./schema-sqlite-Byp7B3yI.js")
+				import("./schema-sqlite-BaFfy9lC.js")
 			]);
 			const client = createClient({
 				url,

package/dist/main.js

@@ -8,30 +8,6 @@ import { homedir, hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes, timingSafeEqual } from "node:crypto";
 //#region ../client/dist/index.js
-/**
-* The config from `name=value` arguments, as the CLI takes them. A field with
-* several options takes them comma-separated, and one left out gets what the
-* form preselects. Text goes as typed, for the server to check.
-*/
-function configFromArguments(provider, assignments) {
-	const config = {};
-	for (const assignment of assignments) {
-		const equals = assignment.indexOf("=");
-		const name = equals === -1 ? assignment : assignment.slice(0, equals);
-		const field = provider.fields.find((candidate) => candidate.name === name);
-		if (equals === -1 || field === void 0) {
-			const names = provider.fields.map((candidate) => candidate.name).join(", ");
-			throw new Error(`${provider.label} takes ${names} as name=value; got ${JSON.stringify(assignment)}`);
-		}
-		if (Object.hasOwn(config, name)) throw new Error(`${name} is given twice`);
-		const value = assignment.slice(equals + 1);
-		if (field.type === "text") config[name] = value;
-		else if (field.multiple) config[name] = value.split(",").map((item) => item.trim()).filter((item) => item !== "");
-		else config[name] = value;
-	}
-	for (const field of provider.fields) if (field.type === "options" && !Object.hasOwn(config, field.name)) config[field.name] = field.multiple ? field.initial : field.initial[0];
-	return config;
-}
 /** The API's error shape, `{ error, message }`, with the HTTP status. */
 const COFFRE_ERROR = Symbol.for("@coffre/client:CoffreError");
 var CoffreError = class extends Error {
@@ -174,15 +150,6 @@ set: (member, access) => call("PATCH /access/:member", { member }, access) },
 			get: (code) => call("GET /device-logins/:code", { code }),
 			decide: (code, approve) => call("POST /device-logins/:code", { code }, { approve })
 		},
-		syncs: {
-			/** Where a sync can push on this instance, and what each asks for. */
-			providers: () => call("GET /syncs/providers", {}),
-			list: (path) => call("GET /syncs/:project/:environment", place(path)),
-			add: (path, input) => call("POST /syncs/:project/:environment", place(path), input),
-			update: (id, patch) => call("PATCH /syncs/by-id/:id", { id }, patch),
-			remove: (id) => call("DELETE /syncs/by-id/:id", { id }),
-			run: (id) => call("POST /syncs/by-id/:id/runs", { id })
-		},
 		audit: {
 			list: (query = {}) => call("GET /audit", {}, query),
 			verify: () => call("GET /audit/verification", {}),
@@ -521,8 +488,6 @@ function getCalls({ places, secrets, members, services }) {
 		"GET /sessions": [{ params: {} }],
 		"GET /identities": [{ params: {} }],
 		"GET /device-logins/:code": [{ params: { code: "BCDF-GHJK" } }],
-		"GET /syncs/providers": [{ params: {} }],
-		"GET /syncs/:project/:environment": places.map((params) => ({ params })),
 		"GET /audit": [{
 			params: {},
 			input: { limit: 500 }
@@ -574,12 +539,6 @@ const EVERY_ROUTE = {
 	"DELETE /identities/:id": true,
 	"GET /device-logins/:code": true,
 	"POST /device-logins/:code": true,
-	"GET /syncs/providers": true,
-	"GET /syncs/:project/:environment": true,
-	"POST /syncs/:project/:environment": true,
-	"PATCH /syncs/by-id/:id": true,
-	"DELETE /syncs/by-id/:id": true,
-	"POST /syncs/by-id/:id/runs": true,
 	"GET /audit": true,
 	"GET /audit/verification": true,
 	"GET /audit/keys": true
@@ -939,8 +898,7 @@ async function tokenScope(api, canary) {
 	for (const path of [...others, nowhere]) {
 		await refused(`the token listed ${path}`, api.secrets.list(path));
 		await refused(`the token revealed ${path}`, api.secrets.reveal(path));
-		await refused(`the token read ${path}'s syncs`, api.syncs.list(path));
-		refusals += 3;
+		refusals += 2;
 	}
 	await refused(`the token read ${nowhere}'s audit`, api.audit.list({
 		path: nowhere,
@@ -2325,13 +2283,6 @@ async function offboard(args) {
 	report.exposed.forEach((entry, index) => {
 		process.stdout.write(`  ${names[index].padEnd(width)}  v${String(entry.version).padEnd(4)} ${entry.how} ${entry.at.slice(0, 10)}\n`);
 	});
-	if (report.syncs.length > 0) {
-		process.stdout.write(`\nSyncs ${they} set up, which keep pushing\n`);
-		for (const entry of report.syncs) {
-			const paused = entry.paused ? " (paused)" : "";
-			process.stdout.write(`  ${entry.project}/${entry.environment} -> ${entry.providerLabel} ${entry.destination}${paused}\n`);
-		}
-	}
 	if (report.issuedTokens.length > 0) {
 		process.stdout.write(`\nService tokens ${they} issued, which still work\n`);
 		for (const token of report.issuedTokens) {
@@ -2421,138 +2372,6 @@ async function verifyLog() {
 	process.stderr.write(`audit log BROKEN${at}, found by the ${result.author}'s check (${through}): ${result.reason}\n`);
 	process.exit(2);
 }
-const SYNC_USAGE = `usage:
-  coffre sync providers
-  coffre sync list   <project>/<environment>
-  coffre sync add    <project>/<environment> <provider> name=value… --credential <project>/<environment>/<KEY>
-  coffre sync run    <project>/<environment> <sync>
-  coffre sync pause  <project>/<environment> <sync>
-  coffre sync resume <project>/<environment> <sync>
-  coffre sync remove <project>/<environment> <sync>
-
-\`coffre sync providers\` lists where this instance can sync to, and what each
-provider takes. <sync> is the start of an id from \`coffre sync list\`, or the
-provider's id when the environment syncs there only once.
-`;
-/** Where this instance can sync to, one provider to a paragraph. */
-function printProviders(providers) {
-	if (providers.length === 0) {
-		process.stdout.write("This instance offers no sync providers.\n");
-		return;
-	}
-	process.stdout.write("What is in brackets can be left out. A choice left out is what comes\nbefore the first |, and several choices go comma-separated.\n");
-	for (const provider of providers) process.stdout.write(`\n${provider.id}  ${provider.label}\n    ${[...provider.fields.map(fieldUsage), `--credential ${provider.credential.placeholder}`].join(" ")}\n${indented(provider.credential.hint)}\n`);
-}
-/** Prose under a usage line, indented and wrapped to a terminal's 80 columns. */
-function indented(text) {
-	const lines = [];
-	for (const word of text.split(/\s+/)) {
-		const last = lines.length - 1;
-		if (last >= 0 && lines[last].length + 1 + word.length <= 76) lines[last] += ` ${word}`;
-		else lines.push(word);
-	}
-	return lines.map((line) => `    ${line}`).join("\n");
-}
-function fieldUsage(field) {
-	if (field.type === "text") return field.optional ? `[${field.name}=…]` : `${field.name}=…`;
-	const others = field.options.map((option) => option.value).filter((value) => !field.initial.includes(value));
-	return `[${field.name}=${[field.initial.join(","), ...others].join("|")}]`;
-}
-/**
-* Push an environment somewhere else and keep it current. The server does
-* the work and checks every field; this names things and reports back.
-*/
-async function sync(args) {
-	const [verb, path, ...rest] = args;
-	if (verb === "providers") {
-		const { providers } = await client().syncs.providers();
-		printProviders(providers);
-		return;
-	}
-	if (verb === void 0 || verb === "--help" || path === void 0) {
-		process.stdout.write(SYNC_USAGE);
-		process.exit(verb === void 0 || verb === "--help" ? 0 : 1);
-	}
-	const { project, environment, key } = parsePath(path);
-	if (key !== void 0) fail(`syncs belong to an environment: use ${project}/${environment}`);
-	const place = `${project}/${environment}`;
-	const coffre = client();
-	if (verb === "list") {
-		const { syncs } = await coffre.syncs.list(place);
-		if (syncs.length === 0) process.stdout.write(`${project}/${environment} is not synced anywhere\n`);
-		for (const entry of syncs) printSync(entry);
-		return;
-	}
-	if (verb === "add") {
-		const { values, positionals } = parseArgs({
-			args: rest,
-			options: { credential: { type: "string" } },
-			allowPositionals: true
-		});
-		const [id, ...assignments] = positionals;
-		const { providers } = await coffre.syncs.providers();
-		const provider = providers.find((candidate) => candidate.id === id);
-		if (provider === void 0) fail(`name a provider this instance offers (${providers.length === 0 ? "none" : providers.map((candidate) => candidate.id).join(", ")}); \`coffre sync providers\` shows what each takes`);
-		if (values.credential === void 0) fail(`--credential names the secret holding the ${provider.label} token, such as ${provider.credential.placeholder}`);
-		const config = attempt(() => configFromArguments(provider, assignments));
-		const created = await coffre.syncs.add(place, {
-			provider: provider.id,
-			config,
-			credential: values.credential
-		});
-		process.stdout.write(`Syncing ${project}/${environment} to ${created.destination} (${created.providerLabel}), id ${created.id.slice(0, 8)}.\nThe first push has started; \`coffre sync list ${project}/${environment}\` shows how it went.\n`);
-		return;
-	}
-	if (![
-		"run",
-		"pause",
-		"resume",
-		"remove"
-	].includes(verb)) fail(`unknown sync command "${verb}"; see \`coffre sync --help\``);
-	const reference = rest[0];
-	if (reference === void 0) fail(`usage: coffre sync ${verb} ${project}/${environment} <sync>`);
-	const { syncs } = await coffre.syncs.list(place);
-	const chosen = attempt(() => pickSync(syncs, reference));
-	if (verb === "run") {
-		if (chosen.paused) fail(`syncing to ${chosen.destination} is paused; resume it first`);
-		const { sync: after, outcome } = await coffre.syncs.run(chosen.id);
-		if (outcome.status === "busy") fail(`a run to ${chosen.destination} is already under way`);
-		for (const failure of outcome.failed) process.stderr.write(`  could not ${failure.operation === "upsert" ? "push" : "remove"} ${failure.key}: ${failure.message}\n`);
-		if (outcome.status === "failed") fail(`could not sync to ${after.destination}: ${outcome.error ?? "the run failed"}`);
-		const changed = outcome.upserted.length + outcome.deleted.length;
-		process.stdout.write(changed === 0 && outcome.failed.length === 0 ? `${after.destination} was already current\n` : `Pushed ${outcome.upserted.length}, removed ${outcome.deleted.length} at ${after.destination}\n`);
-		if (outcome.status === "partial") process.exit(1);
-		return;
-	}
-	if (verb === "remove") {
-		await coffre.syncs.remove(chosen.id);
-		process.stdout.write(`No longer syncing to ${chosen.destination}. Keys coffre pushed there stay; remove them at ${chosen.providerLabel} if they should go too.\n`);
-		return;
-	}
-	const paused = verb === "pause";
-	await coffre.syncs.update(chosen.id, { paused });
-	process.stdout.write(paused ? `Paused syncing to ${chosen.destination}\n` : `Resumed syncing to ${chosen.destination}; changes since the pause go out on the next run\n`);
-}
-/** By id prefix, or by provider when only one sync here goes there. */
-function pickSync(syncs, reference) {
-	const byProvider = syncs.filter((entry) => entry.provider === reference);
-	if (byProvider.length === 1) return byProvider[0];
-	if (byProvider.length > 1) throw new Error(`more than one ${reference} sync here; name it by id (coffre sync list)`);
-	if (reference.length < 4) throw new Error("give at least 4 characters of a sync id, or a provider id");
-	const byId = syncs.filter((entry) => entry.id.startsWith(reference.toLowerCase()));
-	if (byId.length === 1) return byId[0];
-	if (byId.length > 1) throw new Error(`"${reference}" starts more than one sync id; give more of it`);
-	throw new Error(`no sync "${reference}" here; \`coffre sync list\` shows them`);
-}
-function printSync(entry) {
-	const state = entry.running ? "pushing" : entry.paused ? "paused" : entry.lastStatus === "failed" ? "failed" : entry.lastStatus === "partial" ? "partial" : entry.lastRunAt === null ? "not run yet" : entry.pending > 0 ? "behind" : "in sync";
-	const counts = [`${entry.synced} synced`, ...entry.pending > 0 ? [`${entry.pending} pending`] : []];
-	if (entry.lastRunAt !== null) counts.push(`last run ${entry.lastRunAt.slice(0, 16).replace("T", " ")}`);
-	process.stdout.write(`${entry.id.slice(0, 8)}  ${entry.providerLabel.padEnd(18)} ${entry.destination}\n`);
-	process.stdout.write(`          ${state}: ${counts.join(", ")}; token from ${entry.credential}\n`);
-	if (entry.lastError !== null && !entry.running) process.stdout.write(`          ${entry.lastError}\n`);
-	for (const skipped of entry.skipped) process.stdout.write(`          skips ${skipped.key}: ${skipped.reason}\n`);
-}
 /** `coffre init --workers|--node [<dir>]`: a new deployment of coffre. */
 function initProject(args) {
 	const { values, positionals } = parseArgs({
@@ -2609,11 +2428,6 @@ const USAGE = `coffre - secrets, with an audit log
     coffre offboard <principal> [--service] [--apply]
                                             what removing them revokes, and what to rotate
 
-  Syncs (coffre sync providers for where to, and what each takes)
-    coffre sync list   <project>/<environment>
-    coffre sync add    <project>/<environment> <provider> name=value…
-                       --credential <project>/<environment>/<KEY>
-    coffre sync run|pause|resume|remove <project>/<environment> <sync>
 
   Audit
     coffre audit [--limit N] [--actor <id>] [--denied] [--detail]
@@ -2639,7 +2453,7 @@ switch (command) {
 		await keys(rest);
 		break;
 	case "setup":
-		await (await import("./setup-D3SXt_P-.js")).setup(rest);
+		await (await import("./setup-BMmFAR3N.js")).setup(rest);
 		break;
 	case "login":
 		await login(rest);
@@ -2692,9 +2506,6 @@ switch (command) {
 	case "offboard":
 		await offboard(rest);
 		break;
-	case "sync":
-		await sync(rest);
-		break;
 	case "audit":
 		await audit(rest);
 		break;

package/dist/migrations/postgres/0001_remove_syncs.sql

@@ -0,0 +1,13 @@
+-- Stop old app instances before upgrading. Never silently discard a configured
+-- destination, including archived ones. Keep the audit and sealed legacy rows.
+LOCK TABLE syncs, sync_keys IN ACCESS EXCLUSIVE MODE;
+--> statement-breakpoint
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM syncs) OR EXISTS (SELECT 1 FROM sync_keys) THEN
+    RAISE EXCEPTION 'syncs are removed: migrate destinations to service tokens, back up and clear syncs and sync_keys before upgrading';
+  END IF;
+END $$;
+--> statement-breakpoint
+DROP TABLE sync_keys;
+--> statement-breakpoint
+DROP TABLE syncs;