@coffre/db 0.14.3 → 0.14.4

package/dist/migrations/sqlite/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1792835446455,
       "tag": "0016_capped_alerts",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1793017781451,
+      "tag": "0017_vault_releases",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
-import { t as Database } from "./database-Ds1Y79h6.js";
+import { g as schema_d_exports } from "./schema-z8GcN_Xu.js";
+import { t as Database } from "./database-CFhTnnzM.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -1292,6 +1292,80 @@ export declare const vaultGrants: import("drizzle-orm/sqlite-core").SQLiteTableW
   };
   dialect: "sqlite";
 }>;
+/**
+ * Each key the vault released to a principal, and when last: what its bulk
+ * limit counts (R28), the distinct keys released within a window, without
+ * reading the log. The database keeps it from the log itself, in the
+ * transaction of each vault `secret.read` allowed: a trigger on
+ * `audit_log` upserts a row for each key the entry names, as the count
+ * read them from the entries before (an entry that names none, which only
+ * a forged one is, counts as a key of its own, `entry:<seq>`). No login
+ * writes it: the vault and the backup read it. A row a window old counts
+ * for nothing, so nothing prunes them: there are at most as many as
+ * principals times keys, and a count reads one principal's.
+ */
+export declare const vaultReleases: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "vault_releases";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "principal";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "key";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    releasedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "released_at";
+      tableName: "vault_releases";
+      dataType: "number";
+      columnType: "SQLiteInteger";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 export declare const auditLog: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "audit_log";
   schema: undefined;

package/dist/schema-sqlite.js

@@ -214,6 +214,26 @@ const vaultGrants = sqliteTable("vault_grants", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
+/**
+* Each key the vault released to a principal, and when last: what its bulk
+* limit counts (R28), the distinct keys released within a window, without
+* reading the log. The database keeps it from the log itself, in the
+* transaction of each vault `secret.read` allowed: a trigger on
+* `audit_log` upserts a row for each key the entry names, as the count
+* read them from the entries before (an entry that names none, which only
+* a forged one is, counts as a key of its own, `entry:<seq>`). No login
+* writes it: the vault and the backup read it. A row a window old counts
+* for nothing, so nothing prunes them: there are at most as many as
+* principals times keys, and a count reads one principal's.
+*/
+const vaultReleases = sqliteTable("vault_releases", {
+	principal: text().notNull(),
+	key: text().notNull(),
+	releasedAt: integer("released_at", { mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "vault_releases_pkey",
+	columns: [table.principal, table.key]
+})]);
 const auditLog = sqliteTable("audit_log", {
 	seq: int64("seq").primaryKey(),
 	author: text().notNull(),
@@ -616,4 +636,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-Ds1Y79h6.js";
+import { i as Queryable } from "./database-CFhTnnzM.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -148,6 +148,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792937576477,
 			"tag": "0019_backup_role",
 			"breakpoints": true
+		},
+		{
+			"idx": 20,
+			"version": "7",
+			"when": 1793017780802,
+			"tag": "0020_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -269,6 +276,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792835446455,
 			"tag": "0016_capped_alerts",
 			"breakpoints": true
+		},
+		{
+			"idx": 17,
+			"version": "6",
+			"when": 1793017781451,
+			"tag": "0017_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/{schema-DcVkJhCf.d.ts → schema-z8GcN_Xu.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -1238,6 +1238,76 @@ declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * Each key the vault released to a principal, and when last: what its bulk
+ * limit counts (R28), the distinct keys released within a window, without
+ * reading the log. The database keeps it from the log itself, in the
+ * transaction of each vault `secret.read` allowed: a trigger on
+ * `audit_log` upserts a row for each key the entry names, as the count
+ * read them from the entries before (an entry that names none, which only
+ * a forged one is, counts as a key of its own, `entry:<seq>`). No login
+ * writes it: the vault and the backup read it. A row a window old counts
+ * for nothing, so nothing prunes them: there are at most as many as
+ * principals times keys, and a count reads one principal's.
+ */
+declare const vaultReleases: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "vault_releases";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    key: import("drizzle-orm/pg-core").PgColumn<{
+      name: "key";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    releasedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "released_at";
+      tableName: "vault_releases";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "audit_log";
   schema: undefined;
@@ -4125,4 +4195,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, serviceBindings as x, secrets as y };
+export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, vaultReleases as w, serviceBindings as x, secrets as y };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, x as serviceBindings, y as secrets } from "./schema-DcVkJhCf.js";
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, w as vaultReleases, x as serviceBindings, y as secrets } from "./schema-z8GcN_Xu.js";
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema.js

@@ -25,7 +25,8 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	secretsRelations: () => secretsRelations,
 	serviceBindings: () => serviceBindings,
 	vaultGrants: () => vaultGrants,
-	vaultMembers: () => vaultMembers
+	vaultMembers: () => vaultMembers,
+	vaultReleases: () => vaultReleases
 });
 const bytea = customType({ dataType: () => "bytea" });
 const createdAt = () => timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
@@ -240,6 +241,26 @@ const vaultGrants = pgTable("vault_grants", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
+/**
+* Each key the vault released to a principal, and when last: what its bulk
+* limit counts (R28), the distinct keys released within a window, without
+* reading the log. The database keeps it from the log itself, in the
+* transaction of each vault `secret.read` allowed: a trigger on
+* `audit_log` upserts a row for each key the entry names, as the count
+* read them from the entries before (an entry that names none, which only
+* a forged one is, counts as a key of its own, `entry:<seq>`). No login
+* writes it: the vault and the backup read it. A row a window old counts
+* for nothing, so nothing prunes them: there are at most as many as
+* principals times keys, and a count reads one principal's.
+*/
+const vaultReleases = pgTable("vault_releases", {
+	principal: text().notNull(),
+	key: text().notNull(),
+	releasedAt: bigint("released_at", { mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "vault_releases_pkey",
+	columns: [table.principal, table.key]
+})]);
 const auditLog = pgTable("audit_log", {
 	seq: bigint({ mode: "bigint" }).primaryKey(),
 	author: text().notNull(),
@@ -698,4 +719,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers, vaultReleases };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.14.3",
+  "version": "0.14.4",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.14.3"
+    "@coffre/core": "0.14.4"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/migrations/postgres/0020_vault_releases.sql

@@ -0,0 +1,36 @@
+-- Releases (W199): each key the vault released to a principal, and when last, so that its bulk limit counts the keys released within a window from a row per key, not from every read the principal ever made. The database keeps it, from each vault `secret.read` allowed, in the append's own transaction; the release before neither reads it nor knows it is kept, and its appends keep it too.
+CREATE TABLE "vault_releases" (
+	"principal" text NOT NULL,
+	"key" text NOT NULL,
+	"released_at" bigint NOT NULL,
+	CONSTRAINT "vault_releases_pkey" PRIMARY KEY("principal","key")
+);
+--> statement-breakpoint
+-- Room in each page for the next version of its rows: a read moves its keys' times on in place (a HOT update), so the
+-- table and its key stay a row a key, however often each is read: the page prunes the versions before as it is read.
+ALTER TABLE vault_releases SET (fillfactor = 50);--> statement-breakpoint
+-- Each key the entry names, as the count read them before: the secret, or each item of a read's list at one place, or, for an entry that names none, which only a forged one is, the entry itself. As the owner, so that no login may write the table: the vault's appends reach it only through the log.
+CREATE FUNCTION vault_releases_keep() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+BEGIN
+    INSERT INTO public.vault_releases AS kept (principal, key, released_at)
+    SELECT DISTINCT NEW.actor, coalesce(NEW.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || NEW.seq), NEW.occurred_at
+      FROM (SELECT) AS entry
+      LEFT JOIN LATERAL jsonb_path_query(CASE WHEN NEW.secret_id IS NULL THEN NEW.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+    ON CONFLICT (principal, key) DO UPDATE SET released_at = greatest(kept.released_at, excluded.released_at);
+    RETURN NULL;
+END
+$$;--> statement-breakpoint
+-- A trigger runs its function whoever may execute it: no login may call it otherwise.
+REVOKE ALL ON FUNCTION vault_releases_keep() FROM PUBLIC;--> statement-breakpoint
+CREATE TRIGGER audit_log_releases AFTER INSERT ON audit_log FOR EACH ROW
+    WHEN (NEW.author = 'vault' AND NEW.action = 'secret.read' AND NEW.decision = 'allow')
+    EXECUTE FUNCTION vault_releases_keep();--> statement-breakpoint
+-- Then the releases already in the log, in the same transaction: an append waits from the trigger to the commit, and none is missed.
+INSERT INTO vault_releases (principal, key, released_at)
+SELECT e.actor, coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq), max(e.occurred_at)
+  FROM audit_log e
+  LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+ WHERE e.author = 'vault' AND e.action = 'secret.read' AND e.decision = 'allow'
+ GROUP BY 1, 2;--> statement-breakpoint
+GRANT SELECT ON vault_releases TO coffre_vault, coffre_backup;