@coffre/db 0.10.2 → 0.12.0

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -2400,6 +2400,25 @@ export declare const serviceBindings: import("drizzle-orm/sqlite-core").SQLiteTa
     }, {}, {
       length: undefined;
     }>;
+    policy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "policy";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -2552,6 +2571,68 @@ export declare const consumedTokens: import("drizzle-orm/sqlite-core").SQLiteTab
   };
   dialect: "sqlite";
 }>;
+export declare const cappedAlerts: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "capped_alerts";
+  schema: undefined;
+  columns: {
+    service: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "service";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    kind: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "kind";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    raisedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "capped_alerts";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 /**
  * MCP clients that registered themselves (RFC 7591), the fallback to Client
  * ID Metadata Documents, which need no row. The ID is the client's
@@ -3294,6 +3375,203 @@ export declare const mcpApprovals: import("drizzle-orm/sqlite-core").SQLiteTable
   };
   dialect: "sqlite";
 }>;
+/**
+ * Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+ * mints for a platform that signs no identity, and the app exchanges for a
+ * workload's session at `/api/auth/workload`. Never a credential itself, and
+ * only ever added: the log says which code a promote superseded. Its scope,
+ * fixed at minting, is the binding's within what the minter held; the MAC
+ * covers everything but its hint and creation time (auth-rows.ts in the server).
+ */
+export declare const enrollments: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "enrollments";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    authMac: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "buffer";
+      columnType: "SQLiteBlobBuffer";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: Buffer<ArrayBufferLike>;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    bindingId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "binding_id";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    codeHash: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "buffer";
+      columnType: "SQLiteBlobBuffer";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: Buffer<ArrayBufferLike>;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    codeHint: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "code_hint";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    scope: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "scope";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "created_by";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    createdWith: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "created_with";
+      tableName: "enrollments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    expiresAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "enrollments";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "credentials";
   schema: undefined;
@@ -3626,6 +3904,135 @@ export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableW
     }, {}, {
       length: number | undefined;
     }>;
+    jkt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "jkt";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    notAfter: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    ancestors: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "ancestors";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    constraints: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "constraints";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    enrollmentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "enrollment_id";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    approvedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "credentials";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    approvedBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "approved_by";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
   };
   dialect: "sqlite";
 }>;

package/dist/schema-sqlite.js

@@ -278,6 +278,8 @@ const auditLog = sqliteTable("audit_log", {
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`json_extract(${table.metadata}, '$.bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
+	index("audit_log_freeze_idx").on(sql`json_extract(${table.metadata}, '$.target')`, table.seq).where(sql`${table.author} = 'app' AND ${table.action} IN ('workload.freeze', 'workload.unfreeze') AND ${table.decision} = 'allow'`),
+	index("audit_log_supersede_idx").on(sql`json_extract(${table.metadata}, '$.enrollmentId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'enrollment.supersede' AND ${table.decision} = 'allow'`),
 	index("audit_log_exchange_idx").on(sql`json_extract(${table.metadata}, '$.credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
 	index("audit_log_token_create_idx").on(sql`json_extract(${table.metadata}, '$.targetCredentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
 	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
@@ -367,6 +369,7 @@ const serviceBindings = sqliteTable("service_bindings", {
 	jwks: text(),
 	claims: text().notNull(),
 	scope: text(),
+	policy: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),
@@ -389,6 +392,14 @@ const consumedTokens = sqliteTable("consumed_tokens", {
 	hash: bytes("hash").primaryKey(),
 	consumedAt: time("consumed_at").notNull().default(now)
 }, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
+const cappedAlerts = sqliteTable("capped_alerts", {
+	service: text().notNull(),
+	kind: text().notNull(),
+	raisedAt: time("raised_at").notNull()
+}, (table) => [primaryKey({
+	name: "capped_alerts_pkey",
+	columns: [table.service, table.kind]
+})]);
 /**
 * MCP clients that registered themselves (RFC 7591), the fallback to Client
 * ID Metadata Documents, which need no row. The ID is the client's
@@ -475,6 +486,37 @@ const mcpApprovals = sqliteTable("mcp_approvals", {
 	}).onDelete("restrict"),
 	index("mcp_approvals_open_idx").on(table.connectionId, table.digest).where(sql`${table.reportedAt} IS NULL`)
 ]);
+/**
+* Enrollment codes (docs/design/workload-access.md, section 4.4): what CI
+* mints for a platform that signs no identity, and the app exchanges for a
+* workload's session at `/api/auth/workload`. Never a credential itself, and
+* only ever added: the log says which code a promote superseded. Its scope,
+* fixed at minting, is the binding's within what the minter held; the MAC
+* covers everything but its hint and creation time (auth-rows.ts in the server).
+*/
+const enrollments = sqliteTable("enrollments", {
+	id: text().primaryKey(),
+	authMac: bytes("auth_mac").notNull(),
+	bindingId: text("binding_id").notNull(),
+	codeHash: bytes("code_hash").notNull(),
+	codeHint: text("code_hint").notNull(),
+	scope: text().notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull(),
+	createdWith: text("created_with"),
+	expiresAt: time("expires_at").notNull()
+}, (table) => [
+	unique("enrollments_code_hash_key").on(table.codeHash),
+	check("enrollments_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("enrollments_code_hash_check", sql`octet_length(${table.codeHash}) = 32`),
+	check("enrollments_scope_check", sql`json_valid(${table.scope})`),
+	foreignKey({
+		name: "enrollments_binding_id_fkey",
+		columns: [table.bindingId],
+		foreignColumns: [serviceBindings.id]
+	}).onDelete("restrict"),
+	index("enrollments_binding_idx").on(table.bindingId, table.createdAt)
+]);
 const credentials = sqliteTable("credentials", {
 	id: text().primaryKey(),
 	kind: text().notNull(),
@@ -493,12 +535,20 @@ const credentials = sqliteTable("credentials", {
 	lastUsedAt: time("last_used_at"),
 	lastUsedIp: text("last_used_ip"),
 	revokedAt: time("revoked_at"),
-	revokedBy: text("revoked_by")
+	revokedBy: text("revoked_by"),
+	jkt: text(),
+	notAfter: time("not_after"),
+	ancestors: text(),
+	constraints: text(),
+	enrollmentId: text("enrollment_id"),
+	approvedAt: time("approved_at"),
+	approvedBy: text("approved_by")
 }, (table) => [
 	unique("credentials_token_hash_key").on(table.tokenHash),
-	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle')`),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload')`),
 	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
-	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
+	check("credentials_kind_matches_principal", sql`(${table.kind} IN ('service', 'workload')) = (${table.principal} LIKE 'token:%')`),
+	check("credentials_workload_jkt_check", sql`${table.kind} <> 'workload' OR ${table.jkt} IS NOT NULL`),
 	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),
 	check("credentials_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
 	foreignKey({
@@ -521,7 +571,13 @@ const credentials = sqliteTable("credentials", {
 	}).onDelete("restrict"),
 	index("credentials_principal_idx").on(table.principal, table.generation),
 	index("credentials_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`),
-	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt)
+	index("credentials_issued_by_idx").on(table.principal, table.createdBy, table.createdAt),
+	foreignKey({
+		name: "credentials_enrollment_id_fkey",
+		columns: [table.enrollmentId],
+		foreignColumns: [enrollments.id]
+	}).onDelete("restrict"),
+	index("credentials_enrollment_roots_idx").on(table.enrollmentId, table.createdAt).where(sql`${table.kind} = 'workload' AND ${table.ancestors} IS NULL`)
 ]);
 const deviceAuthorizations = sqliteTable("device_authorizations", {
 	id: text().primaryKey(),
@@ -560,4 +616,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-DBtn3jqp.js";
+import { i as Queryable } from "./database-Ds1Y79h6.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -113,6 +113,27 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792345776262,
 			"tag": "0014_custom_roles",
 			"breakpoints": true
+		},
+		{
+			"idx": 15,
+			"version": "7",
+			"when": 1792803757287,
+			"tag": "0015_workload_access",
+			"breakpoints": true
+		},
+		{
+			"idx": 16,
+			"version": "7",
+			"when": 1792814038307,
+			"tag": "0016_spent_tokens",
+			"breakpoints": true
+		},
+		{
+			"idx": 17,
+			"version": "7",
+			"when": 1792835445795,
+			"tag": "0017_capped_alerts",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -220,6 +241,20 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792345777255,
 			"tag": "0014_custom_roles",
 			"breakpoints": true
+		},
+		{
+			"idx": 15,
+			"version": "6",
+			"when": 1792803757926,
+			"tag": "0015_workload_access",
+			"breakpoints": true
+		},
+		{
+			"idx": 16,
+			"version": "6",
+			"when": 1792835446455,
+			"tag": "0016_capped_alerts",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-NBVA9q-s.js";
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, x as serviceBindings, y as secrets } from "./schema-DcVkJhCf.js";
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };