@coffre/db 0.0.0 → 0.1.1

package/dist/schema.js

@@ -0,0 +1,448 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-DqgxtlKu.js";
+import { sql } from "drizzle-orm";
+import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
+import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+//#region src/schema.ts
+var schema_exports = /* @__PURE__ */ __exportAll({
+	auditChainHead: () => auditChainHead,
+	auditLog: () => auditLog,
+	credentials: () => credentials,
+	deviceAuthorizations: () => deviceAuthorizations,
+	environments: () => environments,
+	environmentsRelations: () => environmentsRelations,
+	identities: () => identities,
+	projects: () => projects,
+	secretVersions: () => secretVersions,
+	secrets: () => secrets,
+	secretsRelations: () => secretsRelations,
+	syncKeys: () => syncKeys,
+	syncKeysRelations: () => syncKeysRelations,
+	syncs: () => syncs,
+	syncsRelations: () => syncsRelations,
+	vaultGrants: () => vaultGrants,
+	vaultMembers: () => vaultMembers
+});
+const bytea = customType({ dataType: () => "bytea" });
+const createdAt = () => timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
+const projects = pgTable("projects", {
+	id: uuid().primaryKey().defaultRandom(),
+	slug: text().notNull(),
+	name: text().notNull(),
+	createdAt: createdAt(),
+	archivedAt: timestamp("archived_at", { withTimezone: true })
+}, (table) => [unique("projects_slug_key").on(table.slug), check("projects_slug_check", sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`)]);
+const environments = pgTable("environments", {
+	id: uuid().primaryKey().defaultRandom(),
+	projectId: uuid("project_id").notNull(),
+	slug: text().notNull(),
+	name: text().notNull(),
+	createdAt: createdAt(),
+	archivedAt: timestamp("archived_at", { withTimezone: true })
+}, (table) => [
+	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
+	unique("environments_project_scoped").on(table.id, table.projectId),
+	check("environments_slug_check", sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
+	foreignKey({
+		name: "environments_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict")
+]);
+const secrets = pgTable("secrets", {
+	id: uuid().primaryKey().defaultRandom(),
+	projectId: uuid("project_id").notNull(),
+	environmentId: uuid("environment_id").notNull(),
+	key: text().notNull(),
+	createdAt: createdAt(),
+	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+	currentVersionId: uuid("current_version_id").references(() => secretVersions.id, { onDelete: "no action" }),
+	currentVersion: integer("current_version").notNull().default(0),
+	archivedAt: timestamp("archived_at", { withTimezone: true })
+}, (table) => [
+	unique("secrets_project_id_environment_id_key_key").on(table.projectId, table.environmentId, table.key),
+	check("secrets_key_check", sql`${table.key} ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$'`),
+	foreignKey({
+		name: "secrets_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secrets_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secrets_environment_in_project",
+		columns: [table.environmentId, table.projectId],
+		foreignColumns: [environments.id, environments.projectId]
+	}),
+	index("secrets_lookup_idx").on(table.projectId, table.environmentId, table.key)
+]);
+const secretVersions = pgTable("secret_versions", {
+	id: uuid().primaryKey().defaultRandom(),
+	secretId: uuid("secret_id").notNull(),
+	version: integer().notNull(),
+	envelopeVersion: integer("envelope_version").notNull(),
+	ciphertext: bytea().notNull(),
+	iv: bytea().notNull(),
+	authTag: bytea("auth_tag").notNull(),
+	wrappedDek: bytea("wrapped_dek").notNull(),
+	kekProvider: text("kek_provider").notNull(),
+	kekId: text("kek_id").notNull(),
+	kekVersion: text("kek_version").notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull()
+}, (table) => [
+	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
+	check("secret_versions_version_check", sql`${table.version} > 0`),
+	check("secret_versions_iv_check", sql`octet_length(${table.iv}) = 12`),
+	check("secret_versions_auth_tag_check", sql`octet_length(${table.authTag}) = 16`),
+	foreignKey({
+		name: "secret_versions_secret_id_fkey",
+		columns: [table.secretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	index("secret_versions_secret_idx").on(table.secretId, table.version.desc())
+]);
+/** The role catalogue, as SQL: every role, and those an environment may be granted. */
+const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
+const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
+/**
+* The vault's member directory: everyone it has admitted, written by the
+* vault alone, read by both. A principal with no row is no member.
+* Principals are the strings coffre uses at its edges: `user:<email>`,
+* `token:<id>`, `sync:<id>`. Times are milliseconds since the epoch, each
+* the time of the vault's log entry that set it, so the log replays to
+* these rows exactly.
+*/
+const vaultMembers = pgTable("vault_members", {
+	principal: text().primaryKey(),
+	status: text().notNull(),
+	owner: boolean().notNull().default(false),
+	generation: integer().notNull().default(0),
+	createdAt: bigint("created_at", { mode: "number" }).notNull(),
+	createdBy: text("created_by").notNull(),
+	statusChangedAt: bigint("status_changed_at", { mode: "number" }).notNull(),
+	statusChangedBy: text("status_changed_by").notNull(),
+	accessSeq: bigint("access_seq", { mode: "bigint" }).notNull(),
+	mac: bytea().notNull()
+}, (table) => [
+	check("vault_members_mac_check", sql`octet_length(${table.mac}) = 32`),
+	check("vault_members_principal_check", sql`${table.principal} ~ '^(user|token|sync):[^[:space:]:][^[:space:]]*$'`),
+	check("vault_members_user_lowercase", sql`${table.principal} NOT LIKE 'user:%' OR ${table.principal} = lower(${table.principal})`),
+	check("vault_members_status_check", sql`${table.status} IN ('active', 'removed')`),
+	check("vault_members_owner_check", sql`NOT ${table.owner} OR (${table.status} = 'active' AND ${table.principal} LIKE 'user:%')`),
+	check("vault_members_generation_check", sql`${table.generation} >= 0`)
+]);
+/**
+* One role per member per place: a project, or one of its environments,
+* never both. A revoked grant is deleted; an expired one stays until its
+* place is granted again, so the members page can say it lapsed.
+*/
+const vaultGrants = pgTable("vault_grants", {
+	principal: text().notNull(),
+	projectId: uuid("project_id"),
+	environmentId: uuid("environment_id"),
+	role: text().notNull(),
+	expiresAt: bigint("expires_at", { mode: "number" }),
+	grantedAt: bigint("granted_at", { mode: "number" }).notNull(),
+	grantedBy: text("granted_by").notNull()
+}, (table) => [
+	check("vault_grants_one_place", sql`(${table.projectId} IS NULL) <> (${table.environmentId} IS NULL)`),
+	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
+	check("vault_grants_environment_role_check", sql`${table.environmentId} IS NULL OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	unique("vault_grants_on_project").on(table.principal, table.projectId),
+	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
+	foreignKey({
+		name: "vault_grants_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "vault_grants_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "vault_grants_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict")
+]);
+const auditLog = pgTable("audit_log", {
+	seq: bigint({ mode: "bigint" }).primaryKey(),
+	author: text().notNull(),
+	keyId: text("key_id").notNull(),
+	occurredAt: bigint("occurred_at", { mode: "number" }).notNull(),
+	actor: text().notNull(),
+	action: text().notNull(),
+	decision: text().notNull(),
+	code: text(),
+	subjectPrincipal: text("subject_principal"),
+	projectId: uuid("project_id"),
+	environmentId: uuid("environment_id"),
+	secretId: uuid("secret_id"),
+	secretVersionId: uuid("secret_version_id"),
+	operationId: uuid("operation_id"),
+	requestId: text("request_id"),
+	sourceIp: text("source_ip"),
+	relatedSeq: bigint("related_seq", { mode: "bigint" }),
+	metadata: text().notNull().default("{}"),
+	prevHash: bytea("prev_hash").notNull(),
+	mac: bytea().notNull(),
+	hash: bytea().notNull()
+}, (table) => [
+	check("audit_log_author_check", sql`${table.author} IN ('app', 'vault')`),
+	check("audit_log_actor_check", sql`${table.actor} ~ '^(user|token|sync|system):.+$'`),
+	check("audit_log_decision_check", sql`${table.decision} IN ('allow', 'deny')`),
+	check("audit_log_metadata_check", sql`${table.metadata}::jsonb IS NOT NULL`),
+	check("audit_log_prev_hash_check", sql`octet_length(${table.prevHash}) = 32`),
+	check("audit_log_mac_check", sql`octet_length(${table.mac}) = 32`),
+	check("audit_log_hash_check", sql`octet_length(${table.hash}) = 32`),
+	foreignKey({
+		name: "audit_log_project_id_fkey",
+		columns: [table.projectId],
+		foreignColumns: [projects.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_secret_id_fkey",
+		columns: [table.secretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_secret_version_id_fkey",
+		columns: [table.secretVersionId],
+		foreignColumns: [secretVersions.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "audit_log_related_seq_fkey",
+		columns: [table.relatedSeq],
+		foreignColumns: [table.seq]
+	}).onDelete("restrict"),
+	index("audit_log_project_idx").on(table.projectId, table.seq),
+	index("audit_log_environment_idx").on(table.environmentId, table.seq),
+	index("audit_log_secret_idx").on(table.secretId, table.seq),
+	index("audit_log_actor_idx").on(table.actor, table.seq),
+	index("audit_log_operation_idx").on(table.operationId, table.seq),
+	index("audit_log_action_idx").on(table.author, table.action, table.seq),
+	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
+	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq)
+]);
+const auditChainHead = pgTable("audit_chain_head", {
+	onlyRow: boolean("only_row").primaryKey().default(true),
+	nextSeq: bigint("next_seq", { mode: "bigint" }).notNull().default(sql`0`),
+	headHash: bytea("head_hash").notNull()
+}, (table) => [
+	check("audit_chain_head_only_row_check", sql`${table.onlyRow}`),
+	check("audit_chain_head_next_seq_check", sql`${table.nextSeq} >= 0`),
+	check("audit_chain_head_head_hash_check", sql`octet_length(${table.headHash}) = 32`)
+]);
+/**
+* An account at a sign-in provider, bound to one principal.
+*
+* Looked up by (provider, subject), never by email. An email address is
+* recycled when someone leaves; the provider's subject is not, so binding to
+* it is what stops a new holder of an old address from inheriting its access.
+* The email is kept for display only.
+*/
+const identities = pgTable("identities", {
+	id: uuid().primaryKey().defaultRandom(),
+	provider: text().notNull(),
+	authMac: bytea("auth_mac").notNull(),
+	subject: text().notNull(),
+	issuerHash: text("issuer_hash").notNull(),
+	generation: integer().notNull(),
+	principal: text().notNull(),
+	email: text(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	lastSignInAt: timestamp("last_sign_in_at", { withTimezone: true }),
+	revokedAt: timestamp("revoked_at", { withTimezone: true }),
+	revokedBy: text("revoked_by"),
+	activeSubject: text("active_subject").generatedAlwaysAs(ACTIVE_SUBJECT)
+}, (table) => [
+	check("identities_principal_check", sql`${table.principal} LIKE 'user:%'`),
+	check("identities_provider_check", sql`${table.provider} ~ '^[a-z0-9][a-z0-9-]{0,31}$'`),
+	check("identities_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	unique("identities_member_generation_key").on(table.id, table.principal, table.generation),
+	foreignKey({
+		name: "identities_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	uniqueIndex("identities_active_subject").on(table.provider, table.issuerHash, table.activeSubject),
+	index("identities_principal_idx").on(table.principal, table.generation)
+]);
+/**
+* Bearer credentials coffre issues itself: browser sessions, CLI sessions and
+* service tokens.
+*
+* One table, so that revoking everything a principal holds is one statement.
+* Only a SHA-256 of each token is stored. Tokens carry 256 bits of entropy, so
+* a fast hash is enough; a database leak yields nothing that authenticates.
+*/
+const credentials = pgTable("credentials", {
+	id: uuid().primaryKey().defaultRandom(),
+	kind: text().notNull(),
+	authMac: bytea("auth_mac").notNull(),
+	tokenHash: bytea("token_hash").notNull(),
+	tokenHint: text("token_hint").notNull(),
+	generation: integer().notNull(),
+	principal: text().notNull(),
+	identityId: uuid("identity_id"),
+	label: text(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+	lastUsedIp: text("last_used_ip"),
+	revokedAt: timestamp("revoked_at", { withTimezone: true }),
+	revokedBy: text("revoked_by")
+}, (table) => [
+	unique("credentials_token_hash_key").on(table.tokenHash),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service')`),
+	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
+	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
+	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),
+	check("credentials_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	foreignKey({
+		name: "credentials_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "credentials_identity_id_fkey",
+		columns: [
+			table.identityId,
+			table.principal,
+			table.generation
+		],
+		foreignColumns: [
+			identities.id,
+			identities.principal,
+			identities.generation
+		]
+	}).onDelete("restrict"),
+	index("credentials_principal_idx").on(table.principal, table.generation)
+]);
+/**
+* A CLI asking to be signed in from a browser (RFC 8628, device flow).
+*
+* The CLI holds the device code and polls with it; a signed-in person approves
+* the short user code in their browser. It works the same on a laptop and on
+* a server reached over SSH, which a localhost redirect does not.
+*/
+const deviceAuthorizations = pgTable("device_authorizations", {
+	id: uuid().primaryKey().defaultRandom(),
+	deviceCodeHash: bytea("device_code_hash").notNull(),
+	authMac: bytea("auth_mac").notNull(),
+	userCode: text("user_code").notNull(),
+	clientLabel: text("client_label"),
+	clientIp: text("client_ip"),
+	createdAt: createdAt(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	decidedAt: timestamp("decided_at", { withTimezone: true }),
+	decision: text(),
+	generation: integer().notNull().default(0),
+	principal: text(),
+	consumedAt: timestamp("consumed_at", { withTimezone: true })
+}, (table) => [
+	unique("device_authorizations_device_code_hash_key").on(table.deviceCodeHash),
+	unique("device_authorizations_user_code_key").on(table.userCode),
+	check("device_authorizations_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("device_authorizations_decision_check", sql`${table.decision} IS NULL OR ${table.decision} IN ('approved', 'denied')`),
+	check("device_authorizations_approval_names_principal", sql`(${table.decision} IS NULL AND ${table.decidedAt} IS NULL AND ${table.principal} IS NULL AND ${table.generation} = 0 AND ${table.consumedAt} IS NULL)
+        OR (${table.decision} IS NOT NULL AND ${table.decidedAt} IS NOT NULL AND (
+          (${table.decision} = 'denied' AND ${table.principal} IS NULL AND ${table.generation} = 0 AND ${table.consumedAt} IS NULL)
+          OR (${table.decision} = 'approved' AND ${table.principal} IS NOT NULL AND ${table.principal} LIKE 'user:%')
+        ))`),
+	foreignKey({
+		name: "device_authorizations_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict")
+]);
+/**
+* An environment kept in step with a third-party service: GitHub Actions
+* secrets, Vercel or Railway variables, Worker secrets.
+*
+* The destination's API token is itself a coffre secret, referenced by id, so
+* it is encrypted, versioned and audited like everything else and never sits
+* in this table.
+*/
+const syncs = pgTable("syncs", {
+	id: uuid().primaryKey().defaultRandom(),
+	projectId: uuid("project_id").notNull(),
+	environmentId: uuid("environment_id").notNull(),
+	provider: text().notNull(),
+	config: text().notNull(),
+	credentialSecretId: uuid("credential_secret_id").notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	pausedAt: timestamp("paused_at", { withTimezone: true }),
+	archivedAt: timestamp("archived_at", { withTimezone: true }),
+	leaseUntil: timestamp("lease_until", { withTimezone: true }),
+	lastRunAt: timestamp("last_run_at", { withTimezone: true }),
+	lastStatus: text("last_status"),
+	lastError: text("last_error")
+}, (table) => [
+	check("syncs_config_check", sql`${table.config}::jsonb IS NOT NULL`),
+	check("syncs_last_status_check", sql`${table.lastStatus} IS NULL OR ${table.lastStatus} IN ('ok', 'partial', 'failed')`),
+	foreignKey({
+		name: "syncs_environment_in_project",
+		columns: [table.environmentId, table.projectId],
+		foreignColumns: [environments.id, environments.projectId]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "syncs_credential_secret_id_fkey",
+		columns: [table.credentialSecretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	index("syncs_environment_idx").on(table.environmentId)
+]);
+/**
+* What a sync last pushed, one row per key.
+*
+* Most destinations are write-only, so coffre cannot diff against them. It
+* diffs against this instead: a key is stale when its secret has moved past
+* the version recorded here. It is also the list of keys coffre may delete at
+* the destination; a key it never pushed is never removed.
+*/
+const syncKeys = pgTable("sync_keys", {
+	syncId: uuid("sync_id").notNull(),
+	key: text().notNull(),
+	secretVersionId: uuid("secret_version_id"),
+	pushedAt: timestamp("pushed_at", { withTimezone: true }).notNull().defaultNow(),
+	removedAt: timestamp("removed_at", { withTimezone: true })
+}, (table) => [
+	primaryKey({
+		name: "sync_keys_pkey",
+		columns: [table.syncId, table.key]
+	}),
+	foreignKey({
+		name: "sync_keys_sync_id_fkey",
+		columns: [table.syncId],
+		foreignColumns: [syncs.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "sync_keys_secret_version_id_fkey",
+		columns: [table.secretVersionId],
+		foreignColumns: [secretVersions.id]
+	}).onDelete("restrict")
+]);
+const { environmentsRelations, secretsRelations, syncsRelations, syncKeysRelations } = relationsOf({
+	projects,
+	environments,
+	secrets,
+	secretVersions,
+	syncs,
+	syncKeys
+});
+//#endregion
+export { auditChainHead, auditLog, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, syncKeys, syncKeysRelations, syncs, syncsRelations, schema_exports as t, vaultGrants, vaultMembers };

package/package.json

@@ -1,8 +1,95 @@
 {
   "name": "@coffre/db",
-  "version": "0.0.0",
-  "description": "Reserved for coffre, a self-hosted secrets manager. The first release replaces this placeholder.",
+  "version": "0.1.1",
+  "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
-  "homepage": "https://github.com/erwinkn/coffre",
-  "repository": { "type": "git", "url": "git+https://github.com/erwinkn/coffre.git", "directory": "packages/db" }
-}
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/erwinkn/coffre.git",
+    "directory": "packages/db"
+  },
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "exports": {
+    ".": {
+      "coffre:source": "./src/database.ts",
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./schema": {
+      "coffre:source": "./src/schema.ts",
+      "types": "./dist/schema.d.ts",
+      "default": "./dist/schema.js"
+    },
+    "./schema-sqlite": {
+      "coffre:source": "./src/schema.sqlite.ts",
+      "types": "./dist/schema-sqlite.d.ts",
+      "default": "./dist/schema-sqlite.js"
+    },
+    "./dialect": {
+      "coffre:source": "./src/dialect.ts",
+      "types": "./dist/dialect.d.ts",
+      "default": "./dist/dialect.js"
+    },
+    "./portable": {
+      "coffre:source": "./src/portable.ts",
+      "types": "./dist/portable.d.ts",
+      "default": "./dist/portable.js"
+    },
+    "./schema-version": {
+      "coffre:source": "./src/schema-version.ts",
+      "types": "./dist/schema-version.d.ts",
+      "default": "./dist/schema-version.js"
+    },
+    "./hyperdrive": {
+      "coffre:source": "./src/hyperdrive.ts",
+      "types": "./dist/hyperdrive.d.ts",
+      "default": "./dist/hyperdrive.js"
+    },
+    "./connect": {
+      "coffre:source": "./src/connect.ts",
+      "types": "./dist/connect.d.ts",
+      "default": "./dist/connect.js"
+    },
+    "./migrate": {
+      "coffre:source": "./src/migrate.ts",
+      "types": "./dist/migrate.d.ts",
+      "default": "./dist/migrate.js"
+    },
+    "./log": {
+      "coffre:source": "./src/log.ts",
+      "types": "./dist/log.d.ts",
+      "default": "./dist/log.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "dependencies": {
+    "@libsql/client": "0.18.0",
+    "drizzle-orm": "0.45.2",
+    "pg": "8.16.3",
+    "pg-connection-string": "2.14.0",
+    "@coffre/core": "0.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "26.1.1",
+    "@types/pg": "8.20.0",
+    "drizzle-kit": "0.31.10",
+    "tsdown": "0.23.0",
+    "typescript": "5.9.3"
+  },
+  "scripts": {
+    "build": "tsdown && cp -r src/migrations dist/migrations",
+    "typecheck": "tsc --noEmit",
+    "test": "node --conditions=coffre:source --test",
+    "db:generate": "node --conditions=coffre:source src/baseline.ts",
+    "db:migrate": "node --conditions=coffre:source src/migrate-main.ts",
+    "db:check": "cd src && for engine in postgres sqlite; do drizzle-kit check --config drizzle.$engine.config.ts || exit 1; done",
+    "db:verify:runtime": "node --conditions=coffre:source src/verify-runtime.ts"
+  }
+}