@coffre/db 0.1.11 → 0.1.13

package/src/migrations/sqlite/meta/_journal.json

@@ -8,6 +8,13 @@
       "when": 1790874462505,
       "tag": "0000_baseline",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1791062293531,
+      "tag": "0001_remove_syncs",
+      "breakpoints": true
     }
   ]
 }

package/src/relations.ts

@@ -6,8 +6,7 @@ import type * as schema from './schema.ts';
  * What both schemas share beyond their columns: the relations and the
  * one generated column.
  *
- * Relations are for Drizzle's relational queries (`db.query.syncs
- * .findMany({ with })`), which read a row and what hangs off it in one
+ * Relations are for Drizzle's relational queries (`db.query.secrets.findMany({ with })`), which read a row and what hangs off it in one
  * statement on every dialect. They add no constraints; the foreign keys in
  * each schema do that. Each schema calls this with its own tables, so a
  * relational query on SQLite joins SQLite tables.
@@ -18,8 +17,6 @@ export function relationsOf(t: Pick<
   | 'environments'
   | 'secrets'
   | 'secretVersions'
-  | 'syncs'
-  | 'syncKeys'
 >) {
   return {
     environmentsRelations: relations(t.environments, ({ one }) => ({
@@ -31,16 +28,6 @@ export function relationsOf(t: Pick<
       environment: one(t.environments, { fields: [t.secrets.environmentId], references: [t.environments.id] }),
     })),
 
-    syncsRelations: relations(t.syncs, ({ one, many }) => ({
-      project: one(t.projects, { fields: [t.syncs.projectId], references: [t.projects.id] }),
-      environment: one(t.environments, { fields: [t.syncs.environmentId], references: [t.environments.id] }),
-      credential: one(t.secrets, { fields: [t.syncs.credentialSecretId], references: [t.secrets.id] }),
-      keys: many(t.syncKeys),
-    })),
-
-    syncKeysRelations: relations(t.syncKeys, ({ one }) => ({
-      sync: one(t.syncs, { fields: [t.syncKeys.syncId], references: [t.syncs.id] }),
-    })),
   };
 }
 

package/src/schema-version.ts

@@ -3,8 +3,10 @@ import { engineOf, type Engine } from './dialect.ts';
 
 /**
  * Minimum migration prefix required by this application image, per engine:
- * each tree has its own history, all ending at the same schema. Until the
- * first deployment, each is its baseline alone (see baseline.ts).
+ * Advance this only when the runtime needs the new schema. The sync-removal
+ * migration only drops unused tables: new code works with either prefix,
+ * so Workers Builds can deploy before an owner runs the migration.
+ * Applied migrations remain immutable (see baseline.ts).
  */
 export const REQUIRED_MIGRATIONS: Record<Engine, number> = { postgres: 1, sqlite: 1 };
 

package/src/schema.sqlite.ts

@@ -439,73 +439,9 @@ export const deviceAuthorizations = sqliteTable(
   ],
 );
 
-export const syncs = sqliteTable(
-  'syncs',
-  {
-    id: text().primaryKey(),
-    projectId: text('project_id').notNull(),
-    environmentId: text('environment_id').notNull(),
-    provider: text().notNull(),
-    config: text().notNull(),
-    credentialSecretId: text('credential_secret_id').notNull(),
-    createdAt: createdAt(),
-    createdBy: text('created_by').notNull(),
-    pausedAt: time('paused_at'),
-    archivedAt: time('archived_at'),
-    leaseUntil: time('lease_until'),
-    lastRunAt: time('last_run_at'),
-    lastStatus: text('last_status'),
-    lastError: text('last_error'),
-  },
-  (table) => [
-    check('syncs_config_check', sql`json_valid(${table.config})`),
-    check(
-      'syncs_last_status_check',
-      sql`${table.lastStatus} IS NULL OR ${table.lastStatus} IN ('ok', 'partial', 'failed')`,
-    ),
-    foreignKey({
-      name: 'syncs_environment_in_project',
-      columns: [table.environmentId, table.projectId],
-      foreignColumns: [environments.id, environments.projectId],
-    }).onDelete('restrict'),
-    foreignKey({
-      name: 'syncs_credential_secret_id_fkey',
-      columns: [table.credentialSecretId],
-      foreignColumns: [secrets.id],
-    }).onDelete('restrict'),
-    index('syncs_environment_idx').on(table.environmentId),
-  ],
-);
-
-export const syncKeys = sqliteTable(
-  'sync_keys',
-  {
-    syncId: text('sync_id').notNull(),
-    key: text().notNull(),
-    secretVersionId: text('secret_version_id'),
-    pushedAt: time('pushed_at').notNull().default(now),
-    removedAt: time('removed_at'),
-  },
-  (table) => [
-    primaryKey({ name: 'sync_keys_pkey', columns: [table.syncId, table.key] }),
-    foreignKey({
-      name: 'sync_keys_sync_id_fkey',
-      columns: [table.syncId],
-      foreignColumns: [syncs.id],
-    }).onDelete('restrict'),
-    foreignKey({
-      name: 'sync_keys_secret_version_id_fkey',
-      columns: [table.secretVersionId],
-      foreignColumns: [secretVersions.id],
-    }).onDelete('restrict'),
-  ],
-);
-
 export const {
   environmentsRelations,
   secretsRelations,
-  syncsRelations,
-  syncKeysRelations,
 } = relationsOf(
-  asPostgres({ projects, environments, secrets, secretVersions, syncs, syncKeys }),
+  asPostgres({ projects, environments, secrets, secretVersions }),
 );

package/src/schema.ts

@@ -461,88 +461,8 @@ export const deviceAuthorizations = pgTable(
   ],
 );
 
-/**
- * An environment kept in step with a third-party service: GitHub Actions
- * secrets, Vercel or Railway variables, Worker secrets.
- *
- * The destination's API token is itself a coffre secret, referenced by id, so
- * it is encrypted, versioned and audited like everything else and never sits
- * in this table.
- */
-export const syncs = pgTable(
-  'syncs',
-  {
-    id: uuid().primaryKey().defaultRandom(),
-    projectId: uuid('project_id').notNull(),
-    environmentId: uuid('environment_id').notNull(),
-    provider: text().notNull(),
-    config: text().notNull(),
-    credentialSecretId: uuid('credential_secret_id').notNull(),
-    createdAt: createdAt(),
-    createdBy: text('created_by').notNull(),
-    pausedAt: timestamp('paused_at', { withTimezone: true }),
-    archivedAt: timestamp('archived_at', { withTimezone: true }),
-    leaseUntil: timestamp('lease_until', { withTimezone: true }),
-    lastRunAt: timestamp('last_run_at', { withTimezone: true }),
-    lastStatus: text('last_status'),
-    lastError: text('last_error'),
-  },
-  (table) => [
-    check('syncs_config_check', sql`${table.config}::jsonb IS NOT NULL`),
-    check(
-      'syncs_last_status_check',
-      sql`${table.lastStatus} IS NULL OR ${table.lastStatus} IN ('ok', 'partial', 'failed')`,
-    ),
-    foreignKey({
-      name: 'syncs_environment_in_project',
-      columns: [table.environmentId, table.projectId],
-      foreignColumns: [environments.id, environments.projectId],
-    }).onDelete('restrict'),
-    foreignKey({
-      name: 'syncs_credential_secret_id_fkey',
-      columns: [table.credentialSecretId],
-      foreignColumns: [secrets.id],
-    }).onDelete('restrict'),
-    index('syncs_environment_idx').on(table.environmentId),
-  ],
-);
-
-/**
- * What a sync last pushed, one row per key.
- *
- * Most destinations are write-only, so coffre cannot diff against them. It
- * diffs against this instead: a key is stale when its secret has moved past
- * the version recorded here. It is also the list of keys coffre may delete at
- * the destination; a key it never pushed is never removed.
- */
-export const syncKeys = pgTable(
-  'sync_keys',
-  {
-    syncId: uuid('sync_id').notNull(),
-    key: text().notNull(),
-    secretVersionId: uuid('secret_version_id'),
-    pushedAt: timestamp('pushed_at', { withTimezone: true }).notNull().defaultNow(),
-    removedAt: timestamp('removed_at', { withTimezone: true }),
-  },
-  (table) => [
-    primaryKey({ name: 'sync_keys_pkey', columns: [table.syncId, table.key] }),
-    foreignKey({
-      name: 'sync_keys_sync_id_fkey',
-      columns: [table.syncId],
-      foreignColumns: [syncs.id],
-    }).onDelete('restrict'),
-    foreignKey({
-      name: 'sync_keys_secret_version_id_fkey',
-      columns: [table.secretVersionId],
-      foreignColumns: [secretVersions.id],
-    }).onDelete('restrict'),
-  ],
-);
-
 // For Drizzle's relational queries; see relations.ts.
 export const {
   environmentsRelations,
   secretsRelations,
-  syncsRelations,
-  syncKeysRelations,
-} = relationsOf({ projects, environments, secrets, secretVersions, syncs, syncKeys });
+} = relationsOf({ projects, environments, secrets, secretVersions });