@coffre/db 0.10.1 → 0.11.0

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-DBtn3jqp.js";
+import { t as Database } from "./database-Dh4W2pAj.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-DBtn3jqp.d.ts → database-Dh4W2pAj.d.ts}

@@ -1,4 +1,4 @@
-import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
+import { h as schema_d_exports } from "./schema-DG2t57Kf.js";
 import { Query, Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-DBtn3jqp.js";
+import { i as Queryable } from "./database-Dh4W2pAj.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts
@@ -32,6 +32,12 @@ export declare function engineOf(db: Queryable): Engine;
 export declare function forUpdate<Query extends {
   for: (strength: 'update' | 'no key update') => unknown;
 }>(db: Queryable, query: Query, strength?: 'update' | 'no key update'): ReturnType<Query['for']>;
+/**
+ * The rows a hand-written query answers, as the driver gives them: what
+ * Postgres's `execute` and SQLite's `all` each call a result. Column names
+ * are the query's own, unmapped.
+ */
+export declare function rowsOf<Row>(db: Queryable, query: SQL): Promise<Row[]>;
 /** Insert the rows whose unique keys are free; returns how many that was. */
 export declare function insertIfAbsent(db: Queryable, table: Table, rows: object[]): Promise<number>;
 /**

package/dist/dialect.js

@@ -20,6 +20,15 @@ function forUpdate(db, query, strength = "update") {
 	if (engineOf(db) === "sqlite") return query;
 	return query.for(strength);
 }
+/**
+* The rows a hand-written query answers, as the driver gives them: what
+* Postgres's `execute` and SQLite's `all` each call a result. Column names
+* are the query's own, unmapped.
+*/
+async function rowsOf(db, query) {
+	if (engineOf(db) === "postgres") return (await db.execute(query)).rows;
+	return db.all(query);
+}
 /** Insert the rows whose unique keys are free; returns how many that was. */
 async function insertIfAbsent(db, table, rows) {
 	return changedRows(await db.insert(table).values(rows).onConflictDoNothing());
@@ -169,4 +178,4 @@ function canonicalTimestamp(raw) {
 	return `${(/* @__PURE__ */ new Date(Date.UTC(+year, +month - 1, +day, +hour, +minute, +second) - offsetMinutes * 6e4)).toISOString().slice(0, 19)}.${fraction.padEnd(6, "0")}Z`;
 }
 //#endregion
-export { SNAPSHOT, ahead, canonicalTimestamp, changedRows, clock, clockMillis, engineOf, forUpdate, insertIfAbsent, isUniqueViolation, isUnreachable, migrationLedger, tombstone, truth, upsert };
+export { SNAPSHOT, ahead, canonicalTimestamp, changedRows, clock, clockMillis, engineOf, forUpdate, insertIfAbsent, isUniqueViolation, isUnreachable, migrationLedger, rowsOf, tombstone, truth, upsert };

package/dist/grants.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-DBtn3jqp.js";
+import { i as Queryable } from "./database-Dh4W2pAj.js";
 import { Authenticity, Newest } from "./log.js";
 import { StoredEntry } from "@coffre/core/audit";
 import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
@@ -92,17 +92,24 @@ export type EveryProjectPreview = {
  * converts is listed.
  */
 export declare function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]>;
-/** A service token or trust binding of 0.4, which carries no scope of its own yet. */
+/**
+ * A service token or trust binding whose scope this release has not sealed
+ * yet: none of its own, as 0.4 made it (`scope` null), or one that does not
+ * say where it reads sensitive values, as a release before 0.11 made it. By
+ * whom it was issued, `createdBy`, a person's email.
+ */
 export type Unsealed = {
   kind: 'token' | 'binding';
   id: string;
   principal: string;
+  createdBy: string;
+  scope: string | null;
 };
 /**
  * The live service tokens and trust bindings of active service accounts
- * that carry no scope yet, as 0.4 made them: what the app seals with each
- * account's grants once a process (`sealScopes`), and what `coffre migrate`
- * says it will. A credential a binding issued carries its binding's.
+ * whose scope is not sealed yet (`Unsealed`): what the app seals once a
+ * process (`sealScopes`), and what `coffre migrate` says it will. A
+ * credential a binding issued carries its binding's.
  */
 export declare function unsealedCredentials(db: Queryable, at: Date): Promise<Unsealed[]>;
 /**

package/dist/grants.js

@@ -1,7 +1,7 @@
 import { tombstone, truth } from "./dialect.js";
 import { a as prepared, i as tablesOf } from "./database-BadNeeN-.js";
 import { entryColumns, newestAuthentic } from "./log.js";
-import { and, asc, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq, gt, inArray, isNull, like, lt, or, sql } from "drizzle-orm";
 import { EVERYWHERE, administers, convertEveryProjectGrants, isInstanceRole, isScope, normalScope, unscoped } from "@coffre/core/access";
 import { ACCESS_ACTIONS } from "@coffre/core/vault";
 //#region src/grants.ts
@@ -170,19 +170,24 @@ async function everyProjectPreview(db, at) {
 }
 /**
 * The live service tokens and trust bindings of active service accounts
-* that carry no scope yet, as 0.4 made them: what the app seals with each
-* account's grants once a process (`sealScopes`), and what `coffre migrate`
-* says it will. A credential a binding issued carries its binding's.
+* whose scope is not sealed yet (`Unsealed`): what the app seals once a
+* process (`sealScopes`), and what `coffre migrate` says it will. A
+* credential a binding issued carries its binding's.
 */
 async function unsealedCredentials(db, at) {
 	const { credentials, serviceBindings, vaultMembers } = tablesOf(db);
+	const unsealed = (scope) => or(isNull(scope), and(like(scope, "%\"projectId\"%"), sql`${scope} NOT LIKE '%"sensitive":%'`));
 	const [tokens, bindings] = await Promise.all([db.select({
 		id: credentials.id,
-		principal: credentials.principal
-	}).from(credentials).innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation))).where(and(eq(credentials.kind, "service"), isNull(credentials.scope), sql`${credentials.createdBy} NOT LIKE 'binding:%'`, isNull(credentials.revokedAt), gt(credentials.expiresAt, at), eq(vaultMembers.status, "active"))), db.select({
+		principal: credentials.principal,
+		createdBy: credentials.createdBy,
+		scope: credentials.scope
+	}).from(credentials).innerJoin(vaultMembers, and(eq(vaultMembers.principal, credentials.principal), eq(vaultMembers.generation, credentials.generation))).where(and(eq(credentials.kind, "service"), unsealed(credentials.scope), sql`${credentials.createdBy} NOT LIKE 'binding:%'`, isNull(credentials.revokedAt), gt(credentials.expiresAt, at), eq(vaultMembers.status, "active"))), db.select({
 		id: serviceBindings.id,
-		principal: serviceBindings.principal
-	}).from(serviceBindings).innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation))).where(and(isNull(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, "active")))]);
+		principal: serviceBindings.principal,
+		createdBy: serviceBindings.createdBy,
+		scope: serviceBindings.scope
+	}).from(serviceBindings).innerJoin(vaultMembers, and(eq(vaultMembers.principal, serviceBindings.principal), eq(vaultMembers.generation, serviceBindings.generation))).where(and(unsealed(serviceBindings.scope), isNull(serviceBindings.revokedAt), eq(vaultMembers.status, "active")))]);
 	return [...tokens.map((row) => ({
 		kind: "token",
 		...row

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-DBtn3jqp.js";
+import { n as PoolLike } from "./database-Dh4W2pAj.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */
@@ -36,7 +36,14 @@ export declare function postgres(hyperdrive: {
  */
 export declare class HyperdrivePool implements Exclude<PoolLike, pg.Pool> {
   #private;
-  constructor(connectionString: string);
+  /**
+   * `closeIdleMs`: for what outlives a call, a Durable Object, which queries
+   * now and then: the client closes once it has been idle that long, and
+   * the next query connects again.
+   */
+  constructor(connectionString: string, options?: {
+    closeIdleMs?: number;
+  });
   readonly query: pg.Pool['query'];
   /** The client, for a transaction: held from now until `release`. */
   connect(): Promise<Pick<pg.PoolClient, 'query'> & {

package/dist/hyperdrive.js

@@ -43,12 +43,22 @@ var HyperdrivePool = class {
 	#busy = 0;
 	/** What waits for the client to be idle: `end`. */
 	#idle = [];
-	constructor(connectionString) {
+	/** How long the client may sit idle before it closes, or null: closed by `end` alone. */
+	#closeIdleMs;
+	#idleTimer;
+	/**
+	* `closeIdleMs`: for what outlives a call, a Durable Object, which queries
+	* now and then: the client closes once it has been idle that long, and
+	* the next query connects again.
+	*/
+	constructor(connectionString, options = {}) {
 		if (connectionString.trim().length === 0) throw new Error("Hyperdrive returned an empty connection string");
 		this.#connectionString = connectionString;
+		this.#closeIdleMs = options.closeIdleMs ?? null;
 	}
 	query = (async (...args) => {
 		this.#busy += 1;
+		clearTimeout(this.#idleTimer);
 		try {
 			const client = await this.#connected();
 			return await new Promise((resolve, reject) => {
@@ -61,6 +71,7 @@ var HyperdrivePool = class {
 	/** The client, for a transaction: held from now until `release`. */
 	async connect() {
 		this.#busy += 1;
+		clearTimeout(this.#idleTimer);
 		let client;
 		try {
 			client = await this.#connected();
@@ -86,6 +97,7 @@ var HyperdrivePool = class {
 	}
 	/** Close the client once nothing waits on it: what a Worker hands `waitUntil` when the call is done. */
 	async end() {
+		clearTimeout(this.#idleTimer);
 		while (this.#busy > 0) await new Promise((resolve) => this.#idle.push(resolve));
 		const client = this.#client;
 		this.#client = null;
@@ -104,7 +116,9 @@ var HyperdrivePool = class {
 	/** One query or transaction done: once none is left, what waits for the client to be idle goes on. */
 	#done() {
 		this.#busy -= 1;
-		if (this.#busy === 0) for (const resolve of this.#idle.splice(0)) resolve();
+		if (this.#busy > 0) return;
+		for (const resolve of this.#idle.splice(0)) resolve();
+		if (this.#closeIdleMs !== null && this.#client !== null) this.#idleTimer = setTimeout(() => void this.end(), this.#closeIdleMs);
 	}
 	/** The call's client, connecting it the first time. One that fails is dropped: the next query connects again. */
 	#connected() {

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
-import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-DBtn3jqp.js";
+import { h as schema_d_exports } from "./schema-DG2t57Kf.js";
+import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-Dh4W2pAj.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, prepared, schema_d_exports as schema, tablesOf };

package/dist/log.d.ts

@@ -1,5 +1,5 @@
-import { a as Transaction, i as Queryable } from "./database-DBtn3jqp.js";
-import { SQL } from "drizzle-orm";
+import { a as Transaction, i as Queryable } from "./database-Dh4W2pAj.js";
+import { Placeholder, SQL } from "drizzle-orm";
 import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
 /**
@@ -75,7 +75,25 @@ export declare function lockLogHead(tx: Transaction): Promise<{
  * log as it stands, which no other append can change until this one
  * commits. It throws to refuse.
  */
-export declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[], check?: (tx: Transaction) => Promise<void>): Promise<Appended>;
+export declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[], check?: (tx: Transaction) => Promise<void>,
+/**
+ * The head as a statement of the caller's locked it, with the log's last
+ * entry and the clock as that statement read them once it held the lock:
+ * nothing to read again.
+ */
+locked?: HeldHead): Promise<Appended>;
+/** A head locked by a statement of the caller's, and what it read under the lock (`appendEntries`). */
+export type HeldHead = {
+  head: {
+    nextSeq: bigint;
+    headHash: Buffer;
+  };
+  last: {
+    seq: bigint;
+    hash: Buffer;
+  } | null;
+  at: number;
+};
 /** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
 export declare function entryColumns(db: Queryable): {
   seq: import("drizzle-orm/pg-core").PgColumn<{
@@ -492,6 +510,50 @@ export declare function newestVaultEntries(db: Queryable, action: string, limit:
  * of what it says, so its MAC is not checked. One indexed read.
  */
 export declare function newestVaultSeq(db: Queryable, action: string): Promise<bigint | null>;
+/**
+ * `newestVaultSeq`'s query, to run or to read inside another, as a
+ * credential's read takes the newest `policy.change` with it: one rule for
+ * what the newest is, wherever it is read.
+ */
+export declare function newestSeqQuery(db: Queryable, action: string | Placeholder): Omit<import("drizzle-orm/pg-core").PgSelectBase<"audit_log", {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+}, "partial", Record<"audit_log", "not-null">, false, "where" | "orderBy" | "limit", {
+  seq: bigint;
+}[], {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+}>, "where" | "orderBy" | "limit">;
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export declare const LOOK_BACK: {
   page: number;

package/dist/log.js

@@ -1,5 +1,5 @@
 import { t as afterCommit } from "./commits-BuW-NL3n.js";
-import { clockMillis, forUpdate } from "./dialect.js";
+import { clockMillis, engineOf, forUpdate } from "./dialect.js";
 import { a as prepared, i as tablesOf } from "./database-BadNeeN-.js";
 import { and, asc, count, desc, eq, gt, gte, lt, lte, sql } from "drizzle-orm";
 import { GENESIS_HASH, sealEntry } from "@coffre/core/audit";
@@ -69,13 +69,13 @@ const lockedHead = prepared((db) => {
 * log as it stands, which no other append can change until this one
 * commits. It throws to refuse.
 */
-async function appendEntries(tx, key, entries, check) {
+async function appendEntries(tx, key, entries, check, locked) {
 	if (entries.length === 0) throw new Error("appendEntries called with no entries");
 	const { auditChainHead, auditLog } = tablesOf(tx);
-	const head = await lockLogHead(tx);
+	const head = locked?.head ?? await lockLogHead(tx);
 	await check?.(tx);
-	const [{ now }] = await clockNow(tx);
-	const [last] = await lastEntry(tx);
+	const now = locked?.at ?? (await clockNow(tx))[0].now;
+	const last = locked === void 0 ? (await lastEntry(tx))[0] : locked.last ?? void 0;
 	const expected = last === void 0 ? {
 		nextSeq: 0n,
 		headHash: GENESIS_HASH
@@ -120,11 +120,15 @@ async function appendEntries(tx, key, entries, check) {
 		prevHash = hash;
 		seq += 1n;
 	}
-	await tx.insert(auditLog).values(rows);
-	await tx.update(auditChainHead).set({
-		nextSeq: seq,
-		headHash: prevHash
-	}).where(eq(auditChainHead.onlyRow, true));
+	if (engineOf(tx) === "postgres" && rows.length <= ROWS_AT_ONCE) await tx.execute(sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()})
+      UPDATE audit_chain_head SET next_seq = ${seq}, head_hash = ${prevHash} WHERE only_row`);
+	else {
+		await tx.insert(auditLog).values(rows);
+		await tx.update(auditChainHead).set({
+			nextSeq: seq,
+			headHash: prevHash
+		}).where(eq(auditChainHead.onlyRow, true));
+	}
 	const written = {
 		nextSeq: seq,
 		headHash: prevHash
@@ -136,6 +140,8 @@ async function appendEntries(tx, key, entries, check) {
 		occurredAt: now
 	};
 }
+/** Entries one statement inserts at most, at 21 parameters each: Postgres takes 65,535. */
+const ROWS_AT_ONCE = 3e3;
 const clockNow = prepared((db) => db.select({ now: clockMillis(db) }).from(tablesOf(db).auditChainHead));
 const lastEntry = prepared((db) => {
 	const { auditLog } = tablesOf(db);
@@ -260,10 +266,16 @@ async function newestVaultSeq(db, action) {
 	const [row] = await newestSeq(db, { action });
 	return row?.seq ?? null;
 }
-const newestSeq = prepared((db) => {
+const newestSeq = prepared((db) => newestSeqQuery(db, sql.placeholder("action")));
+/**
+* `newestVaultSeq`'s query, to run or to read inside another, as a
+* credential's read takes the newest `policy.change` with it: one rule for
+* what the newest is, wherever it is read.
+*/
+function newestSeqQuery(db, action) {
 	const { auditLog } = tablesOf(db);
-	return db.select({ seq: auditLog.seq }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, sql.placeholder("action")), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
-});
+	return db.select({ seq: auditLog.seq }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
+}
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 const LOOK_BACK = {
 	page: 32,
@@ -294,4 +306,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { BATCH_BYTES, LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, missingEntry, newestAuthentic, newestVaultEntries, newestVaultSeq, withinBytes };
+export { BATCH_BYTES, LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, withinBytes };

package/dist/migrations/postgres/0015_workload_access.sql

@@ -0,0 +1,43 @@
+-- Workload access (docs/design/workload-access.md, section 11): key-bound sessions, their enrollment codes, and bindings' policies. It only adds: the release before neither reads nor writes any of it, and every check is only looser for its rows, so it serves on this schema unchanged.
+CREATE TABLE "enrollments" (
+	"id" uuid PRIMARY KEY NOT NULL,
+	"auth_mac" "bytea" NOT NULL,
+	"binding_id" uuid NOT NULL,
+	"code_hash" "bytea" NOT NULL,
+	"code_hint" text NOT NULL,
+	"scope" text NOT NULL,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"created_by" text NOT NULL,
+	"created_with" uuid,
+	"expires_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "enrollments_code_hash_key" UNIQUE("code_hash"),
+	CONSTRAINT "enrollments_auth_mac_check" CHECK (octet_length("enrollments"."auth_mac") = 32),
+	CONSTRAINT "enrollments_code_hash_check" CHECK (octet_length("enrollments"."code_hash") = 32),
+	CONSTRAINT "enrollments_scope_check" CHECK ("enrollments"."scope"::jsonb IS NOT NULL)
+);
+--> statement-breakpoint
+-- The checks widen to a workload's session, a service's credential like a service token; a session carries the key it is bound to.
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_check";--> statement-breakpoint
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_matches_principal";--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "jkt" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "not_after" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "ancestors" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "constraints" text;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "enrollment_id" uuid;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_at" timestamp with time zone;--> statement-breakpoint
+ALTER TABLE "credentials" ADD COLUMN "approved_by" text;--> statement-breakpoint
+-- A binding's policy, inserted with it under the table-wide INSERT, and named by no UPDATE grant: as immutable as the rest of it.
+ALTER TABLE "service_bindings" ADD COLUMN "policy" text;--> statement-breakpoint
+ALTER TABLE "enrollments" ADD CONSTRAINT "enrollments_binding_id_fkey" FOREIGN KEY ("binding_id") REFERENCES "public"."service_bindings"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "enrollments_binding_idx" ON "enrollments" USING btree ("binding_id","created_at" DESC NULLS LAST);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_enrollment_id_fkey" FOREIGN KEY ("enrollment_id") REFERENCES "public"."enrollments"("id") ON DELETE restrict ON UPDATE no action;--> statement-breakpoint
+-- Freezes are the log's: a target's newest allowed freeze or lift, and a code's supersession, its tombstone.
+CREATE INDEX "audit_log_freeze_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'target'),"seq" DESC NULLS LAST) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" IN ('workload.freeze', 'workload.unfreeze') AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "audit_log_supersede_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'enrollmentId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'enrollment.supersede' AND "audit_log"."decision" = 'allow';--> statement-breakpoint
+CREATE INDEX "credentials_enrollment_roots_idx" ON "credentials" USING btree ("enrollment_id","created_at") WHERE "credentials"."kind" = 'workload' AND "credentials"."ancestors" IS NULL;--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_workload_jkt_check" CHECK ("credentials"."kind" <> 'workload' OR "credentials"."jkt" IS NOT NULL);--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload'));--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_matches_principal" CHECK (("credentials"."kind" IN ('service', 'workload')) = ("credentials"."principal" LIKE 'token:%'));--> statement-breakpoint
+-- The app makes codes and never changes one; a session's key, hard end, ancestors, limits and code are set when it is made, and never after: renewal moves its expiry, and an approval is the one other change.
+GRANT SELECT, INSERT ON enrollments TO coffre_app;--> statement-breakpoint
+GRANT UPDATE (expires_at, approved_at, approved_by) ON credentials TO coffre_app;

package/dist/migrations/postgres/0016_spent_tokens.sql

@@ -0,0 +1,12 @@
+-- Spent tokens (W157): a token's record goes once no exchange could take the token again. An exchange refuses one issued over an hour ago (MAX_TOKEN_AGE_SECONDS, 30 s of clock tolerance), so two hours after it was spent its record guards nothing. The runtime login still deletes no row itself: it asks this function, which deletes only such records, at most at_most a call. The release before never calls it.
+CREATE FUNCTION prune_consumed_tokens(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+    WITH pruned AS (
+        DELETE FROM public.consumed_tokens
+         WHERE hash IN (SELECT hash FROM public.consumed_tokens WHERE consumed_at < now() - interval '2 hours' LIMIT at_most)
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_consumed_tokens(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_consumed_tokens(integer) TO coffre_app;