@coffre/db 0.1.14 → 0.1.16

package/dist/migrations/sqlite/meta/_journal.json

@@ -15,6 +15,27 @@
       "when": 1791062293531,
       "tag": "0001_remove_syncs",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1791069305749,
+      "tag": "0002_service_bindings",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1791072337548,
+      "tag": "0003_exchanges",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1791084355588,
+      "tag": "0004_live_indexes",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { l as schema_d_exports } from "./schema-AmvM6w0D.js";
-import { t as Database } from "./database-CNMfHZwF.js";
+import { u as schema_d_exports } from "./schema-Wt-p8AOh.js";
+import { t as Database } from "./database-Cq_52uUo.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-AmvM6w0D.d.ts → schema-Wt-p8AOh.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -1603,6 +1603,309 @@ declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * A trust binding: which CI runs may sign in as a service, by the ID token
+ * their platform signs (`@coffre/core/identity`'s workloads.ts). Immutable
+ * but for its label, last use and revocation: a change is a new binding, and
+ * the old one's `token.unbind` entry is its tombstone, which outlives any
+ * row put back. The MAC covers what decides (auth-rows.ts in the server).
+ */
+declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "service_bindings";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    authMac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "auth_mac";
+      tableName: "service_bindings";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    generation: import("drizzle-orm/pg-core").PgColumn<{
+      name: "generation";
+      tableName: "service_bindings";
+      dataType: "number";
+      columnType: "PgInteger";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    profile: import("drizzle-orm/pg-core").PgColumn<{
+      name: "profile";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    issuer: import("drizzle-orm/pg-core").PgColumn<{
+      name: "issuer";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    jwksUri: import("drizzle-orm/pg-core").PgColumn<{
+      name: "jwks_uri";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    claims: import("drizzle-orm/pg-core").PgColumn<{
+      name: "claims";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    label: import("drizzle-orm/pg-core").PgColumn<{
+      name: "label";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "service_bindings";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_by";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "last_used_at";
+      tableName: "service_bindings";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "revoked_at";
+      tableName: "service_bindings";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "revoked_by";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * ID tokens exchanged for a credential, each once: the SHA-256 of what its
+ * signature covers, `header.payload` as received, so that no other
+ * spelling of the same token counts as another. Kept whatever becomes of
+ * the credential it bought; the primary key decides a race.
+ */
+declare const consumedTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "consumed_tokens";
+  schema: undefined;
+  columns: {
+    hash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "hash";
+      tableName: "consumed_tokens";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    consumedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "consumed_at";
+      tableName: "consumed_tokens";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
  * service tokens.
@@ -2140,4 +2443,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { environments as a, projects as c, secrets as d, secretsRelations as f, deviceAuthorizations as i, schema_d_exports as l, vaultMembers as m, auditLog as n, environmentsRelations as o, vaultGrants as p, credentials as r, identities as s, auditChainHead as t, secretVersions as u };
+export { deviceAuthorizations as a, identities as c, secretVersions as d, secrets as f, vaultMembers as g, vaultGrants as h, credentials as i, projects as l, serviceBindings as m, auditLog as n, environments as o, secretsRelations as p, consumedTokens as r, environmentsRelations as s, auditChainHead as t, schema_d_exports as u };

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -1672,6 +1672,310 @@ export declare const identities: import("drizzle-orm/sqlite-core").SQLiteTableWi
   };
   dialect: "sqlite";
 }>;
+export declare const serviceBindings: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "service_bindings";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "id";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    authMac: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "service_bindings";
+      dataType: "buffer";
+      columnType: "SQLiteBlobBuffer";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: Buffer<ArrayBufferLike>;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    principal: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "principal";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    generation: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "generation";
+      tableName: "service_bindings";
+      dataType: "number";
+      columnType: "SQLiteInteger";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    profile: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "profile";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    issuer: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "issuer";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    jwksUri: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "jwks_uri";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    claims: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "claims";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "label";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "service_bindings";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "created_by";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    lastUsedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "service_bindings";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "service_bindings";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "revoked_by";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+  };
+  dialect: "sqlite";
+}>;
+export declare const consumedTokens: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "consumed_tokens";
+  schema: undefined;
+  columns: {
+    hash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "consumed_tokens";
+      dataType: "buffer";
+      columnType: "SQLiteBlobBuffer";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: Buffer<ArrayBufferLike>;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    consumedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "consumed_tokens";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "credentials";
   schema: undefined;