@coffre/db 0.10.2 → 0.12.0

package/dist/migrations/sqlite/meta/_journal.json

@@ -106,6 +106,20 @@
       "when": 1792345777255,
       "tag": "0014_custom_roles",
       "breakpoints": true
+    },
+    {
+      "idx": 15,
+      "version": "6",
+      "when": 1792803757926,
+      "tag": "0015_workload_access",
+      "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "6",
+      "when": 1792835446455,
+      "tag": "0016_capped_alerts",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
-import { t as Database } from "./database-DBtn3jqp.js";
+import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
+import { t as Database } from "./database-Ds1Y79h6.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-NBVA9q-s.d.ts → schema-DcVkJhCf.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -2293,6 +2293,23 @@ declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    policy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "policy";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     label: import("drizzle-orm/pg-core").PgColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -2447,6 +2464,72 @@ declare const consumedTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * When a service's capped alert was last raised, by kind: the refusal of a
+ * token signed by a key its uploaded keys lack (`unknown_key`) alerts once
+ * an hour, however many isolates see it. One conditional write per refusal
+ * decides (`claimAlert`), so that the many it caps never reach the log's
+ * head. Only a request that a binding of the service on the token's issuer
+ * gets as far as its keys writes here: a row per service, at most, per kind.
+ */
+declare const cappedAlerts: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "capped_alerts";
+  schema: undefined;
+  columns: {
+    service: import("drizzle-orm/pg-core").PgColumn<{
+      name: "service";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    kind: import("drizzle-orm/pg-core").PgColumn<{
+      name: "kind";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    raisedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "raised_at";
+      tableName: "capped_alerts";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * MCP clients that registered themselves (RFC 7591), the fallback to Client
  * ID Metadata Documents, which need no row. The ID is the client's
@@ -3163,6 +3246,195 @@ declare const mcpApprovals: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+ * mints for a platform that signs no identity, and the app exchanges for a
+ * workload's session at `/api/auth/workload`. Never a credential itself, and
+ * only ever added: the log says which code a promote superseded. Its scope,
+ * fixed at minting, is the binding's within what the minter held; the MAC
+ * covers everything but its hint and creation time (auth-rows.ts in the server).
+ */
+declare const enrollments: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "enrollments";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    authMac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "auth_mac";
+      tableName: "enrollments";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    bindingId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "binding_id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    codeHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_hash";
+      tableName: "enrollments";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    codeHint: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_hint";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    scope: import("drizzle-orm/pg-core").PgColumn<{
+      name: "scope";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_by";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdWith: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_with";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "expires_at";
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
  * service tokens.
@@ -3485,6 +3757,125 @@ declare const credentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    jkt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "jkt";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    notAfter: import("drizzle-orm/pg-core").PgColumn<{
+      name: "not_after";
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    ancestors: import("drizzle-orm/pg-core").PgColumn<{
+      name: "ancestors";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    constraints: import("drizzle-orm/pg-core").PgColumn<{
+      name: "constraints";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    enrollmentId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "enrollment_id";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    approvedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "approved_at";
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    approvedBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "approved_by";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -3734,4 +4125,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { secrets as _, deviceAuthorizations as a, vaultGrants as b, environmentsRelations as c, mcpConnections as d, oauthClients as f, secretVersions as g, secretReferences as h, credentials as i, identities as l, schema_d_exports as m, auditLog as n, dismissedKeys as o, projects as p, consumedTokens as r, environments as s, auditChainHead as t, mcpApprovals as u, secretsRelations as v, vaultMembers as x, serviceBindings as y };
+export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, serviceBindings as x, secrets as y };