@coffre/db 0.10.2 → 0.11.0

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -2400,6 +2400,25 @@ export declare const serviceBindings: import("drizzle-orm/sqlite-core").SQLiteTa
     }, {}, {
       length: undefined;
     }>;
+    policy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "policy";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -3294,6 +3313,203 @@ export declare const mcpApprovals: import("drizzle-orm/sqlite-core").SQLiteTable
   };
   dialect: "sqlite";
 }>;
+/**
+ * Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+ * mints for a platform that signs no identity, and the app exchanges for a
+ * workload's session at `/api/auth/workload`. Never a credential itself, and
+ * only ever added: the log says which code a promote superseded. Its scope,
+ * fixed at minting, is the binding's within what the minter held; the MAC
+ * covers everything but its hint and creation time (auth-rows.ts in the server).
+ */
+export declare const enrollments: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "enrollments";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    authMac: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "buffer";
+      columnType: "SQLiteBlobBuffer";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: Buffer<ArrayBufferLike>;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    bindingId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "binding_id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    codeHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "buffer";
+      columnType: "SQLiteBlobBuffer";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: Buffer<ArrayBufferLike>;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    codeHint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "code_hint";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    scope: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "scope";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "created_by";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    createdWith: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "created_with";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "credentials";
   schema: undefined;
@@ -3626,6 +3842,135 @@ export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableW
     }, {}, {
       length: number | undefined;
     }>;
+    jkt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "jkt";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    notAfter: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    ancestors: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "ancestors";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    constraints: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "constraints";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    enrollmentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "enrollment_id";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    approvedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    approvedBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "approved_by";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
   };
   dialect: "sqlite";
 }>;

package/dist/schema-sqlite.js

@@ -278,6 +278,8 @@ const auditLog = sqliteTable("audit_log", {
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`json_extract(${table.metadata}, '$.bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+	index("audit_log_freeze_idx").on(sql`json_extract(${table.metadata}, '$.target')`, table.seq).where(sql`${table.author} = 'app' AND ${table.action} IN ('workload.freeze', 'workload.unfreeze') AND ${table.decision} = 'allow'`),
+	index("audit_log_supersede_idx").on(sql`json_extract(${table.metadata}, '$.enrollmentId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'enrollment.supersede' AND ${table.decision} = 'allow'`),
 	index("audit_log_exchange_idx").on(sql`json_extract(${table.metadata}, '$.credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
 	index("audit_log_token_create_idx").on(sql`json_extract(${table.metadata}, '$.targetCredentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
 	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
@@ -367,6 +369,7 @@ const serviceBindings = sqliteTable("service_bindings", {
 	jwks: text(),
 	claims: text().notNull(),
 	scope: text(),
+	policy: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),
@@ -475,6 +478,37 @@ const mcpApprovals = sqliteTable("mcp_approvals", {
 	}).onDelete("restrict"),
 	index("mcp_approvals_open_idx").on(table.connectionId, table.digest).where(sql`${table.reportedAt} IS NULL`)
 ]);
+/**
+* Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+* mints for a platform that signs no identity, and the app exchanges for a
+* workload's session at `/api/auth/workload`. Never a credential itself, and
+* only ever added: the log says which code a promote superseded. Its scope,
+* fixed at minting, is the binding's within what the minter held; the MAC
+* covers everything but its hint and creation time (auth-rows.ts in the server).
+*/
+const enrollments = sqliteTable("enrollments", {
+	id: text().primaryKey(),
+	authMac: bytes("auth_mac").notNull(),
+	bindingId: text("binding_id").notNull(),
+	codeHash: bytes("code_hash").notNull(),
+	codeHint: text("code_hint").notNull(),
+	scope: text().notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	createdWith: text("created_with"),
+	expiresAt: time("expires_at").notNull()
+}, (table) => [
+	unique("enrollments_code_hash_key").on(table.codeHash),
+	check("enrollments_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("enrollments_code_hash_check", sql`octet_length(${table.codeHash}) = 32`),
+	check("enrollments_scope_check", sql`json_valid(${table.scope})`),
+	foreignKey({
+		name: "enrollments_binding_id_fkey",
+		columns: [table.bindingId],
+		foreignColumns: [serviceBindings.id]
+	}).onDelete("restrict"),
+	index("enrollments_binding_idx").on(table.bindingId, table.createdAt)
+]);
 const credentials = sqliteTable("credentials", {
 	id: text().primaryKey(),
 	kind: text().notNull(),
@@ -493,12 +527,20 @@ const credentials = sqliteTable("credentials", {
 	lastUsedAt: time("last_used_at"),
 	lastUsedIp: text("last_used_ip"),
 	revokedAt: time("revoked_at"),
-	revokedBy: text("revoked_by")
+	revokedBy: text("revoked_by"),
+	jkt: text(),
+	notAfter: time("not_after"),
+	ancestors: text(),
+	constraints: text(),
+	enrollmentId: text("enrollment_id"),
+	approvedAt: time("approved_at"),
+	approvedBy: text("approved_by")
 }, (table) => [
 	unique("credentials_token_hash_key").on(table.tokenHash),
-	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle')`),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload')`),
 	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
-	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
+	check("credentials_kind_matches_principal", sql`(${table.kind} IN ('service', 'workload')) = (${table.principal} LIKE 'token:%')`),
+	check("credentials_workload_jkt_check", sql`${table.kind} <> 'workload' OR ${table.jkt} IS NOT NULL`),
 	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),
 	check("credentials_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
 	foreignKey({
@@ -521,7 +563,13 @@ const credentials = sqliteTable("credentials", {
 	}).onDelete("restrict"),
 	index("credentials_principal_idx").on(table.principal, table.generation),
 	index("credentials_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
-	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt)
+	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt),
+	foreignKey({
+		name: "credentials_enrollment_id_fkey",
+		columns: [table.enrollmentId],
+		foreignColumns: [enrollments.id]
+	}).onDelete("restrict"),
+	index("credentials_enrollment_roots_idx").on(table.enrollmentId, table.createdAt).where(sql`${table.kind} = 'workload' AND ${table.ancestors} IS NULL`)
 ]);
 const deviceAuthorizations = sqliteTable("device_authorizations", {
 	id: text().primaryKey(),
@@ -560,4 +608,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-DBtn3jqp.js";
+import { i as Queryable } from "./database-Dh4W2pAj.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -113,6 +113,20 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792345776262,
 			"tag": "0014_custom_roles",
 			"breakpoints": true
+		},
+		{
+			"idx": 15,
+			"version": "7",
+			"when": 1792803757287,
+			"tag": "0015_workload_access",
+			"breakpoints": true
+		},
+		{
+			"idx": 16,
+			"version": "7",
+			"when": 1792814038307,
+			"tag": "0016_spent_tokens",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -220,6 +234,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792345777255,
 			"tag": "0014_custom_roles",
 			"breakpoints": true
+		},
+		{
+			"idx": 15,
+			"version": "6",
+			"when": 1792803757926,
+			"tag": "0015_workload_access",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-NBVA9q-s.js";
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { S as vaultMembers, _ as secretVersions, a as deviceAuthorizations, b as serviceBindings, c as environments, d as mcpApprovals, f as mcpConnections, g as secretReferences, i as credentials, l as environmentsRelations, m as projects, n as auditLog, o as dismissedKeys, p as oauthClients, r as consumedTokens, s as enrollments, t as auditChainHead, u as identities, v as secrets, x as vaultGrants, y as secretsRelations } from "./schema-DG2t57Kf.js";
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -10,6 +10,7 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	credentials: () => credentials,
 	deviceAuthorizations: () => deviceAuthorizations,
 	dismissedKeys: () => dismissedKeys,
+	enrollments: () => enrollments,
 	environments: () => environments,
 	environmentsRelations: () => environmentsRelations,
 	identities: () => identities,
@@ -302,6 +303,8 @@ const auditLog = pgTable("audit_log", {
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`((${table.metadata})::jsonb ->> 'bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+	index("audit_log_freeze_idx").on(sql`((${table.metadata})::jsonb ->> 'target')`, table.seq.desc()).where(sql`${table.author} = 'app' AND ${table.action} IN ('workload.freeze', 'workload.unfreeze') AND ${table.decision} = 'allow'`),
+	index("audit_log_supersede_idx").on(sql`((${table.metadata})::jsonb ->> 'enrollmentId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'enrollment.supersede' AND ${table.decision} = 'allow'`),
 	index("audit_log_exchange_idx").on(sql`((${table.metadata})::jsonb ->> 'credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
 	index("audit_log_token_create_idx").on(sql`((${table.metadata})::jsonb ->> 'targetCredentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
 	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
@@ -414,6 +417,7 @@ const serviceBindings = pgTable("service_bindings", {
 	jwks: text(),
 	claims: text().notNull(),
 	scope: text(),
+	policy: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),
@@ -533,6 +537,37 @@ const mcpApprovals = pgTable("mcp_approvals", {
 	index("mcp_approvals_open_idx").on(table.connectionId, table.digest).where(sql`${table.reportedAt} IS NULL`)
 ]);
 /**
+* Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+* mints for a platform that signs no identity, and the app exchanges for a
+* workload's session at `/api/auth/workload`. Never a credential itself, and
+* only ever added: the log says which code a promote superseded. Its scope,
+* fixed at minting, is the binding's within what the minter held; the MAC
+* covers everything but its hint and creation time (auth-rows.ts in the server).
+*/
+const enrollments = pgTable("enrollments", {
+	id: uuid().primaryKey(),
+	authMac: bytea("auth_mac").notNull(),
+	bindingId: uuid("binding_id").notNull(),
+	codeHash: bytea("code_hash").notNull(),
+	codeHint: text("code_hint").notNull(),
+	scope: text().notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	createdWith: uuid("created_with"),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+}, (table) => [
+	unique("enrollments_code_hash_key").on(table.codeHash),
+	check("enrollments_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("enrollments_code_hash_check", sql`octet_length(${table.codeHash}) = 32`),
+	check("enrollments_scope_check", sql`${table.scope}::jsonb IS NOT NULL`),
+	foreignKey({
+		name: "enrollments_binding_id_fkey",
+		columns: [table.bindingId],
+		foreignColumns: [serviceBindings.id]
+	}).onDelete("restrict"),
+	index("enrollments_binding_idx").on(table.bindingId, table.createdAt.desc())
+]);
+/**
 * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
 * service tokens.
 *
@@ -558,12 +593,20 @@ const credentials = pgTable("credentials", {
 	lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
 	lastUsedIp: text("last_used_ip"),
 	revokedAt: timestamp("revoked_at", { withTimezone: true }),
-	revokedBy: text("revoked_by")
+	revokedBy: text("revoked_by"),
+	jkt: text(),
+	notAfter: timestamp("not_after", { withTimezone: true }),
+	ancestors: text(),
+	constraints: text(),
+	enrollmentId: uuid("enrollment_id"),
+	approvedAt: timestamp("approved_at", { withTimezone: true }),
+	approvedBy: text("approved_by")
 }, (table) => [
 	unique("credentials_token_hash_key").on(table.tokenHash),
-	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle')`),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload')`),
 	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
-	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
+	check("credentials_kind_matches_principal", sql`(${table.kind} IN ('service', 'workload')) = (${table.principal} LIKE 'token:%')`),
+	check("credentials_workload_jkt_check", sql`${table.kind} <> 'workload' OR ${table.jkt} IS NOT NULL`),
 	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),
 	check("credentials_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
 	foreignKey({
@@ -586,7 +629,13 @@ const credentials = pgTable("credentials", {
 	}).onDelete("restrict"),
 	index("credentials_principal_idx").on(table.principal, table.generation),
 	index("credentials_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
-	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt)
+	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt),
+	foreignKey({
+		name: "credentials_enrollment_id_fkey",
+		columns: [table.enrollmentId],
+		foreignColumns: [enrollments.id]
+	}).onDelete("restrict"),
+	index("credentials_enrollment_roots_idx").on(table.enrollmentId, table.createdAt).where(sql`${table.kind} = 'workload' AND ${table.ancestors} IS NULL`)
 ]);
 /**
 * A CLI asking to be signed in from a browser (RFC 8628, device flow).
@@ -632,4 +681,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.10.2",
+  "version": "0.11.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.10.2"
+    "@coffre/core": "0.11.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",