@coffre/db 0.14.4 → 0.15.0

package/dist/{schema-z8GcN_Xu.d.ts → schema-DgoPqqsI.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, identities, logBulk, logChanges, logCheckpoints, logConfig, logFence, logReadDays, logReads, logReadsCursor, logTiles, logUses, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -250,6 +250,42 @@ declare const environments: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    protected: import("drizzle-orm/pg-core").PgColumn<{
+      name: "protected";
+      tableName: "environments";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "environments";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
   };
   dialect: "pg";
 }>;
@@ -427,6 +463,25 @@ declare const secrets: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "secrets";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
   };
   dialect: "pg";
 }>;
@@ -1085,6 +1140,25 @@ declare const vaultMembers: import("drizzle-orm/pg-core").PgTableWithColumns<{
     }, {}, {
       pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
     }>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "vault_members";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
   };
   dialect: "pg";
 }>;
@@ -1247,8 +1321,9 @@ declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
  * read them from the entries before (an entry that names none, which only
  * a forged one is, counts as a key of its own, `entry:<seq>`). No login
  * writes it: the vault and the backup read it. A row a window old counts
- * for nothing, so nothing prunes them: there are at most as many as
- * principals times keys, and a count reads one principal's.
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window (`prune_vault_releases`), so a count reads about a
+ * day of keys.
  */
 declare const vaultReleases: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "vault_releases";
@@ -1675,6 +1750,23 @@ declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
     }, {}, {
       pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
     }>;
+    log015: import("drizzle-orm/pg-core").PgColumn<{
+      name: "log015";
+      tableName: "audit_log";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -1860,6 +1952,23 @@ declare const secretReferences: import("drizzle-orm/pg-core").PgTableWithColumns
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    endedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "ended_at";
+      tableName: "secret_references";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -2380,6 +2489,23 @@ declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    origin: import("drizzle-orm/pg-core").PgColumn<{
+      name: "origin";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     label: import("drizzle-orm/pg-core").PgColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -2482,6 +2608,25 @@ declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "service_bindings";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
   };
   dialect: "pg";
 }>;
@@ -3109,6 +3254,25 @@ declare const mcpConnections: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "mcp_connections";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
   };
   dialect: "pg";
 }>;
@@ -3946,6 +4110,25 @@ declare const credentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "credentials";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
   };
   dialect: "pg";
 }>;
@@ -4188,11 +4371,1148 @@ declare const deviceAuthorizations: import("drizzle-orm/pg-core").PgTableWithCol
   };
   dialect: "pg";
 }>;
-declare const environmentsRelations: import("drizzle-orm").Relations<"environments", {
-  project: import("drizzle-orm").One<"projects", true>;
-}>, secretsRelations: import("drizzle-orm").Relations<"secrets", {
-  project: import("drizzle-orm").One<"projects", true>;
-  environment: import("drizzle-orm").One<"environments", true>;
+/**
+ * 0.15's configuration objects (0022_log_015): decision inputs no other row
+ * holds, one row each, sealed as every input is. `policy` holds the bulk
+ * cap's count and window, which a use reads in its own statement; `roles`
+ * the role tables. JSON, as the vault writes it. Written only through
+ * `change_input`.
+ */
+declare const logConfig: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_config";
+  schema: undefined;
+  columns: {
+    name: import("drizzle-orm/pg-core").PgColumn<{
+      name: "name";
+      tableName: "log_config";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    value: import("drizzle-orm/pg-core").PgColumn<{
+      name: "value";
+      tableName: "log_config";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "log_config";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * 0.15's log (0022_log_015, docs/design/hot-path-one.md): two tables numbered
+ * from one sequence, `log_number`, each number taken under the fence's lock
+ * (a credential's issue: under the issue lock, which the barrier waits for;
+ * 0026), so that the number alone orders uses against changes. Nothing reads or
+ * writes them before 0.15's vault; the vault login reads them and writes
+ * them only through the migration's functions.
+ *
+ * A change: any write to a decision input, or to configuration, kept for
+ * good. `object` is the input it changes (`log_object(kind, id)`), `seal`
+ * that object's seal after it, `payload` what it does. The MAC is the
+ * vault's, 16 bytes, its key's tag then HMAC-SHA256 cut to 12 (D162), over everything but the number,
+ * which the vault does not know when it asks. The vault login reads them,
+ * and the app's reads the changes too, for the audit pages: a sign-in
+ * through a trust binding, and the vault's token issues, revokes and
+ * sign-outs, are recorded there alone (D147, T156, T164).
+ */
+declare const logChanges: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_changes";
+  schema: undefined;
+  columns: {
+    number: import("drizzle-orm/pg-core").PgColumn<{
+      name: "number";
+      tableName: "log_changes";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    at: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at";
+      tableName: "log_changes";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    requestId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "request_id";
+      tableName: "log_changes";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    object: import("drizzle-orm/pg-core").PgColumn<{
+      name: "object";
+      tableName: "log_changes";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    actor: import("drizzle-orm/pg-core").PgColumn<{
+      name: "actor";
+      tableName: "log_changes";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    payload: import("drizzle-orm/pg-core").PgColumn<{
+      name: "payload";
+      tableName: "log_changes";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    seal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "seal";
+      tableName: "log_changes";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    mac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "mac";
+      tableName: "log_changes";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * A use, the slim row (R53): no principal (the credential's), no
+ * environment (the secret's, or `place`), no kind (the table says it).
+ * Partitioned by the day of `at` (`make_day`), which retention drops whole;
+ * fixed-width columns first, and eight of them, so the row pads to nothing. One index, the
+ * replay's: a retried call repeats its `at` and request id, both under its
+ * MAC, and lands in the same day.
+ */
+declare const logUses: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_uses";
+  schema: undefined;
+  columns: {
+    number: import("drizzle-orm/pg-core").PgColumn<{
+      name: "number";
+      tableName: "log_uses";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    at: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at";
+      tableName: "log_uses";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    requestId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "request_id";
+      tableName: "log_uses";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    credential: import("drizzle-orm/pg-core").PgColumn<{
+      name: "credential";
+      tableName: "log_uses";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    secret: import("drizzle-orm/pg-core").PgColumn<{
+      name: "secret";
+      tableName: "log_uses";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    purpose: import("drizzle-orm/pg-core").PgColumn<{
+      name: "purpose";
+      tableName: "log_uses";
+      dataType: "number";
+      columnType: "PgSmallInt";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    mac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "mac";
+      tableName: "log_uses";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    place: import("drizzle-orm/pg-core").PgColumn<{
+      name: "place";
+      tableName: "log_uses";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * 0.15's reads as the audit pages list them (T166; formal/Reads.tla): a
+ * projection of each use a signed pair seals, written by the vault's
+ * projector apart from the checkpointer, from the sealed objects at the
+ * use's number: its account, its key's place, the fork it was read in,
+ * through a reference the source and its place, the version read; under the
+ * vault's MAC over all of it, the number included. Partitioned by the day of
+ * `at`, as the uses are (`make_reads_day`), and dropped with them.
+ */
+declare const logReads: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_reads";
+  schema: undefined;
+  columns: {
+    number: import("drizzle-orm/pg-core").PgColumn<{
+      name: "number";
+      tableName: "log_reads";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    at: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at";
+      tableName: "log_reads";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    credential: import("drizzle-orm/pg-core").PgColumn<{
+      name: "credential";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    purpose: import("drizzle-orm/pg-core").PgColumn<{
+      name: "purpose";
+      tableName: "log_reads";
+      dataType: "number";
+      columnType: "PgSmallInt";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    secret: import("drizzle-orm/pg-core").PgColumn<{
+      name: "secret";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    environment: import("drizzle-orm/pg-core").PgColumn<{
+      name: "environment";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    project: import("drizzle-orm/pg-core").PgColumn<{
+      name: "project";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    place: import("drizzle-orm/pg-core").PgColumn<{
+      name: "place";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    source: import("drizzle-orm/pg-core").PgColumn<{
+      name: "source";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    sourceEnvironment: import("drizzle-orm/pg-core").PgColumn<{
+      name: "source_environment";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    sourceProject: import("drizzle-orm/pg-core").PgColumn<{
+      name: "source_project";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    version: import("drizzle-orm/pg-core").PgColumn<{
+      name: "version";
+      tableName: "log_reads";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    mac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "mac";
+      tableName: "log_reads";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+  };
+  dialect: "pg";
+}>;
+/** The days each member's reads are in (`log_reads`), so that a page of theirs reads those days alone: the projector writes them with the reads. */
+declare const logReadDays: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_read_days";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "log_read_days";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    day: import("drizzle-orm/pg-core").PgColumn<{
+      name: "day";
+      tableName: "log_read_days";
+      dataType: "number";
+      columnType: "PgInteger";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/** How far the projector has gone: the number every use at or below it is projected, and when. */
+declare const logReadsCursor: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_reads_cursor";
+  schema: undefined;
+  columns: {
+    onlyRow: import("drizzle-orm/pg-core").PgColumn<{
+      name: "only_row";
+      tableName: "log_reads_cursor";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    through: import("drizzle-orm/pg-core").PgColumn<{
+      name: "through";
+      tableName: "log_reads_cursor";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    pair: import("drizzle-orm/pg-core").PgColumn<{
+      name: "pair";
+      tableName: "log_reads_cursor";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    at: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at";
+      tableName: "log_reads_cursor";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    mac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "mac";
+      tableName: "log_reads_cursor";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * The bulk cap (R28, R52): each principal's last logged use of each key, as
+ * the start of that use's refresh period, written only by a use that holds
+ * the principal's lock (exclusive to enter a key, shared to move it on:
+ * 0028), at most once per refresh per key. A row older than the window, a
+ * refresh, the deadline and a minute counts for nothing; `prune_bulk`
+ * forgets it an hour after that.
+ */
+declare const logBulk: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_bulk";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "log_bulk";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    secret: import("drizzle-orm/pg-core").PgColumn<{
+      name: "secret";
+      tableName: "log_bulk";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    last: import("drizzle-orm/pg-core").PgColumn<{
+      name: "last";
+      tableName: "log_bulk";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * The fence's one row: the lowest `at` a use may still be written with,
+ * raised by each checkpoint's barrier (`close_one`), never lowered. Made
+ * by the migration; without it every use is refused.
+ */
+declare const logFence: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_fence";
+  schema: undefined;
+  columns: {
+    onlyRow: import("drizzle-orm/pg-core").PgColumn<{
+      name: "only_row";
+      tableName: "log_fence";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    atFloor: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at_floor";
+      tableName: "log_fence";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * A signed checkpoint: the pair of tree heads (W212), changes and uses, at
+ * one `upto`, every number at or below which is final. One row, so that no
+ * state holds one head without the other. `at_floor` is the floor its
+ * barrier set: the next window's uses have an `at` at or above it.
+ */
+declare const logCheckpoints: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_checkpoints";
+  schema: undefined;
+  columns: {
+    upto: import("drizzle-orm/pg-core").PgColumn<{
+      name: "upto";
+      tableName: "log_checkpoints";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    at: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at";
+      tableName: "log_checkpoints";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    atFloor: import("drizzle-orm/pg-core").PgColumn<{
+      name: "at_floor";
+      tableName: "log_checkpoints";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    changesSize: import("drizzle-orm/pg-core").PgColumn<{
+      name: "changes_size";
+      tableName: "log_checkpoints";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    changesRoot: import("drizzle-orm/pg-core").PgColumn<{
+      name: "changes_root";
+      tableName: "log_checkpoints";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    changesNote: import("drizzle-orm/pg-core").PgColumn<{
+      name: "changes_note";
+      tableName: "log_checkpoints";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    usesSize: import("drizzle-orm/pg-core").PgColumn<{
+      name: "uses_size";
+      tableName: "log_checkpoints";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    usesRoot: import("drizzle-orm/pg-core").PgColumn<{
+      name: "uses_root";
+      tableName: "log_checkpoints";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    usesNote: import("drizzle-orm/pg-core").PgColumn<{
+      name: "uses_note";
+      tableName: "log_checkpoints";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * The two trees' tiles (C2SP tlog-tiles: height 8, up to 256 hashes of one
+ * level). Partitioned by tree; the uses tree's leaf tiles (level 0) by
+ * `leaf`, the first leaf a tile covers (`make_tiles`), so that retention
+ * drops a table rather than deleting a day's rows (W212); its levels above,
+ * which span far past their first leaf, in one table (W217).
+ */
+declare const logTiles: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "log_tiles";
+  schema: undefined;
+  columns: {
+    tree: import("drizzle-orm/pg-core").PgColumn<{
+      name: "tree";
+      tableName: "log_tiles";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    level: import("drizzle-orm/pg-core").PgColumn<{
+      name: "level";
+      tableName: "log_tiles";
+      dataType: "number";
+      columnType: "PgSmallInt";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    leaf: import("drizzle-orm/pg-core").PgColumn<{
+      name: "leaf";
+      tableName: "log_tiles";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    hashes: import("drizzle-orm/pg-core").PgColumn<{
+      name: "hashes";
+      tableName: "log_tiles";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+  };
+  dialect: "pg";
 }>;
 //#endregion
-export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, vaultReleases as w, serviceBindings as x, secrets as y };
+export { vaultGrants as A, oauthClients as C, secretVersions as D, secretReferences as E, vaultReleases as M, secrets as O, mcpConnections as S, schema_d_exports as T, logReads as _, credentials as a, logUses as b, enrollments as c, logBulk as d, logChanges as f, logReadDays as g, logFence as h, consumedTokens as i, vaultMembers as j, serviceBindings as k, environments as l, logConfig as m, auditLog as n, deviceAuthorizations as o, logCheckpoints as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, identities as u, logReadsCursor as v, projects as w, mcpApprovals as x, logTiles as y };