@coffre/db 0.11.0 → 0.12.1

package/dist/migrations/sqlite/meta/_journal.json

@@ -113,6 +113,13 @@
       "when": 1792803757926,
       "tag": "0015_workload_access",
       "breakpoints": true
+    },
+    {
+      "idx": 16,
+      "version": "6",
+      "when": 1792835446455,
+      "tag": "0016_capped_alerts",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { h as schema_d_exports } from "./schema-DG2t57Kf.js";
-import { t as Database } from "./database-Dh4W2pAj.js";
+import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
+import { t as Database } from "./database-Ds1Y79h6.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-DG2t57Kf.d.ts → schema-DcVkJhCf.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -2464,6 +2464,72 @@ declare const consumedTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * When a service's capped alert was last raised, by kind: the refusal of a
+ * token signed by a key its uploaded keys lack (`unknown_key`) alerts once
+ * an hour, however many isolates see it. One conditional write per refusal
+ * decides (`claimAlert`), so that the many it caps never reach the log's
+ * head. Only a request that a binding of the service on the token's issuer
+ * gets as far as its keys writes here: a row per service, at most, per kind.
+ */
+declare const cappedAlerts: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "capped_alerts";
+  schema: undefined;
+  columns: {
+    service: import("drizzle-orm/pg-core").PgColumn<{
+      name: "service";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    kind: import("drizzle-orm/pg-core").PgColumn<{
+      name: "kind";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    raisedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "raised_at";
+      tableName: "capped_alerts";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * MCP clients that registered themselves (RFC 7591), the fallback to Client
  * ID Metadata Documents, which need no row. The ID is the client's
@@ -4059,4 +4125,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { vaultMembers as S, secretVersions as _, deviceAuthorizations as a, serviceBindings as b, environments as c, mcpApprovals as d, mcpConnections as f, secretReferences as g, schema_d_exports as h, credentials as i, environmentsRelations as l, projects as m, auditLog as n, dismissedKeys as o, oauthClients as p, consumedTokens as r, enrollments as s, auditChainHead as t, identities as u, secrets as v, vaultGrants as x, secretsRelations as y };
+export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, serviceBindings as x, secrets as y };

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -2571,6 +2571,68 @@ export declare const consumedTokens: import("drizzle-orm/sqlite-core").SQLiteTab
   };
   dialect: "sqlite";
 }>;
+export declare const cappedAlerts: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "capped_alerts";
+  schema: undefined;
+  columns: {
+    service: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "service";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    kind: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "kind";
+      tableName: "capped_alerts";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    raisedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "capped_alerts";
+      dataType: "date";
+      columnType: "SQLiteTimestamp";
+      data: Date;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 /**
  * MCP clients that registered themselves (RFC 7591), the fallback to Client
  * ID Metadata Documents, which need no row. The ID is the client's

package/dist/schema-sqlite.js

@@ -392,6 +392,14 @@ const consumedTokens = sqliteTable("consumed_tokens", {
 	hash: bytes("hash").primaryKey(),
 	consumedAt: time("consumed_at").notNull().default(now)
 }, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
+const cappedAlerts = sqliteTable("capped_alerts", {
+	service: text().notNull(),
+	kind: text().notNull(),
+	raisedAt: time("raised_at").notNull()
+}, (table) => [primaryKey({
+	name: "capped_alerts_pkey",
+	columns: [table.service, table.kind]
+})]);
 /**
 * MCP clients that registered themselves (RFC 7591), the fallback to Client
 * ID Metadata Documents, which need no row. The ID is the client's
@@ -608,4 +616,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-Dh4W2pAj.js";
+import { i as Queryable } from "./database-Ds1Y79h6.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -127,6 +127,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792814038307,
 			"tag": "0016_spent_tokens",
 			"breakpoints": true
+		},
+		{
+			"idx": 17,
+			"version": "7",
+			"when": 1792835445795,
+			"tag": "0017_capped_alerts",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -241,6 +248,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792803757926,
 			"tag": "0015_workload_access",
 			"breakpoints": true
+		},
+		{
+			"idx": 16,
+			"version": "6",
+			"when": 1792835446455,
+			"tag": "0016_capped_alerts",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { S as vaultMembers, _ as secretVersions, a as deviceAuthorizations, b as serviceBindings, c as environments, d as mcpApprovals, f as mcpConnections, g as secretReferences, i as credentials, l as environmentsRelations, m as projects, n as auditLog, o as dismissedKeys, p as oauthClients, r as consumedTokens, s as enrollments, t as auditChainHead, u as identities, v as secrets, x as vaultGrants, y as secretsRelations } from "./schema-DG2t57Kf.js";
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, x as serviceBindings, y as secrets } from "./schema-DcVkJhCf.js";
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -6,6 +6,7 @@ import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable
 var schema_exports = /* @__PURE__ */ __exportAll({
 	auditChainHead: () => auditChainHead,
 	auditLog: () => auditLog,
+	cappedAlerts: () => cappedAlerts,
 	consumedTokens: () => consumedTokens,
 	credentials: () => credentials,
 	deviceAuthorizations: () => deviceAuthorizations,
@@ -447,6 +448,22 @@ const consumedTokens = pgTable("consumed_tokens", {
 	consumedAt: timestamp("consumed_at", { withTimezone: true }).notNull().defaultNow()
 }, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
 /**
+* When a service's capped alert was last raised, by kind: the refusal of a
+* token signed by a key its uploaded keys lack (`unknown_key`) alerts once
+* an hour, however many isolates see it. One conditional write per refusal
+* decides (`claimAlert`), so that the many it caps never reach the log's
+* head. Only a request that a binding of the service on the token's issuer
+* gets as far as its keys writes here: a row per service, at most, per kind.
+*/
+const cappedAlerts = pgTable("capped_alerts", {
+	service: text().notNull(),
+	kind: text().notNull(),
+	raisedAt: timestamp("raised_at", { withTimezone: true }).notNull()
+}, (table) => [primaryKey({
+	name: "capped_alerts_pkey",
+	columns: [table.service, table.kind]
+})]);
+/**
 * MCP clients that registered themselves (RFC 7591), the fallback to Client
 * ID Metadata Documents, which need no row. The ID is the client's
 * `client_id`. Its redirects are under its MAC: a database writer cannot add
@@ -681,4 +698,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.11.0"
+    "@coffre/core": "0.12.1"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/migrations/postgres/0017_capped_alerts.sql

@@ -0,0 +1,10 @@
+-- Capped alerts (T98): when a service's sign-in was last refused `unknown_key` with an alert, so that the next alerts an hour later at the soonest, whichever isolate sees it. It only adds: the release before neither reads nor writes it.
+CREATE TABLE "capped_alerts" (
+	"service" text NOT NULL,
+	"kind" text NOT NULL,
+	"raised_at" timestamp with time zone NOT NULL,
+	CONSTRAINT "capped_alerts_pkey" PRIMARY KEY("service","kind")
+);
+--> statement-breakpoint
+-- The app moves a row's time on, and deletes none.
+GRANT SELECT, INSERT, UPDATE (raised_at) ON capped_alerts TO coffre_app;