@coffre/db 0.14.5 → 0.15.0

package/dist/schema-sqlite.js

@@ -1,5 +1,4 @@
-import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
-import { asPostgres } from "./portable.js";
+import { n as recorded, r as ACTIVE_SUBJECT } from "./change-records-_fKvahvs.js";
 import { sql } from "drizzle-orm";
 import { blob, check, customType, foreignKey, index, integer, primaryKey, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
 //#region src/schema.sqlite.ts
@@ -55,8 +54,11 @@ const environments = sqliteTable("environments", {
 	createdAt: createdAt(),
 	archivedAt: time("archived_at"),
 	parentId: text("parent_id"),
-	owner: text()
+	owner: text(),
+	protected: flag("protected"),
+	seal: bytes("seal")
 }, (table) => [
+	check("environments_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
 	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
 	unique("environments_project_scoped").on(table.id, table.projectId),
 	check("environments_slug_check", isPlaceSlug(table.slug)),
@@ -85,8 +87,10 @@ const secrets = sqliteTable("secrets", {
 	currentVersionId: text("current_version_id").references(() => secretVersions.id, { onDelete: "no action" }),
 	currentVersion: integer("current_version").notNull().default(0),
 	archivedAt: time("archived_at"),
-	folder: text()
+	folder: text(),
+	seal: bytes("seal")
 }, (table) => [
+	check("secrets_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
 	unique("secrets_project_id_environment_id_key_key").on(table.projectId, table.environmentId, table.key),
 	check("secrets_key_check", sql`length(${table.key}) BETWEEN 1 AND 128 AND ${table.key} GLOB '[A-Za-z_]*' AND ${table.key} NOT GLOB '*[^A-Za-z0-9_]*'`),
 	folderCheck("secrets_folder_check", table.folder),
@@ -105,7 +109,8 @@ const secrets = sqliteTable("secrets", {
 		columns: [table.environmentId, table.projectId],
 		foreignColumns: [environments.id, environments.projectId]
 	}),
-	index("secrets_lookup_idx").on(table.projectId, table.environmentId, table.key)
+	index("secrets_lookup_idx").on(table.projectId, table.environmentId, table.key),
+	index("secrets_live_idx").on(table.environmentId).where(sql`${table.archivedAt} IS NULL`)
 ]);
 const secretVersions = sqliteTable("secret_versions", {
 	id: text().primaryKey(),
@@ -169,8 +174,10 @@ const vaultMembers = sqliteTable("vault_members", {
 	statusChangedAt: integer("status_changed_at", { mode: "number" }).notNull(),
 	statusChangedBy: text("status_changed_by").notNull(),
 	accessSeq: int64("access_seq").notNull(),
-	mac: bytes("mac").notNull()
+	mac: bytes("mac").notNull(),
+	seal: bytes("seal")
 }, (table) => [
+	check("vault_members_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
 	check("vault_members_mac_check", sql`octet_length(${table.mac}) = 32`),
 	check("vault_members_principal_check", sql`(${table.principal} GLOB 'user:?*' OR ${table.principal} GLOB 'token:?*')
         AND substr(${table.principal}, instr(${table.principal}, ':') + 1, 1) <> ':'
@@ -255,7 +262,8 @@ const auditLog = sqliteTable("audit_log", {
 	metadata: text().notNull().default("{}"),
 	prevHash: bytes("prev_hash").notNull(),
 	mac: bytes("mac").notNull(),
-	hash: bytes("hash").notNull()
+	hash: bytes("hash").notNull(),
+	log015: flag("log015")
 }, (table) => [
 	check("audit_log_author_check", sql`${table.author} IN ('app', 'vault')`),
 	check("audit_log_actor_check", sql`${table.actor} GLOB 'user:?*' OR ${table.actor} GLOB 'token:?*' OR ${table.actor} GLOB 'system:?*'`),
@@ -317,7 +325,8 @@ const secretReferences = sqliteTable("secret_references", {
 	sourceSecretId: text("source_secret_id").notNull(),
 	createdSeq: int64("created_seq").notNull(),
 	createdAt: createdAt(),
-	createdBy: text("created_by").notNull()
+	createdBy: text("created_by").notNull(),
+	endedAt: time("ended_at")
 }, (table) => [
 	unique("secret_references_created_seq_key").on(table.createdSeq),
 	foreignKey({
@@ -390,13 +399,16 @@ const serviceBindings = sqliteTable("service_bindings", {
 	claims: text().notNull(),
 	scope: text(),
 	policy: text(),
+	origin: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),
 	lastUsedAt: time("last_used_at"),
 	revokedAt: time("revoked_at"),
-	revokedBy: text("revoked_by")
+	revokedBy: text("revoked_by"),
+	seal: bytes("seal")
 }, (table) => [
+	check("service_bindings_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
 	check("service_bindings_principal_check", sql`${table.principal} LIKE 'token:%'`),
 	check("service_bindings_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
 	check("service_bindings_claims_check", sql`json_valid(${table.claims})`),
@@ -462,8 +474,10 @@ const mcpConnections = sqliteTable("mcp_connections", {
 	lastUsedAt: time("last_used_at"),
 	lastUsedIp: text("last_used_ip"),
 	revokedAt: time("revoked_at"),
-	revokedBy: text("revoked_by")
+	revokedBy: text("revoked_by"),
+	seal: bytes("seal")
 }, (table) => [
+	check("mcp_connections_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
 	check("mcp_connections_principal_check", sql`${table.principal} LIKE 'user:%'`),
 	check("mcp_connections_registration_check", sql`${table.registration} IN ('cimd', 'dcr')`),
 	check("mcp_connections_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
@@ -562,8 +576,10 @@ const credentials = sqliteTable("credentials", {
 	constraints: text(),
 	enrollmentId: text("enrollment_id"),
 	approvedAt: time("approved_at"),
-	approvedBy: text("approved_by")
+	approvedBy: text("approved_by"),
+	seal: bytes("seal")
 }, (table) => [
+	check("credentials_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
 	unique("credentials_token_hash_key").on(table.tokenHash),
 	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload')`),
 	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
@@ -629,11 +645,131 @@ const deviceAuthorizations = sqliteTable("device_authorizations", {
 		foreignColumns: [vaultMembers.principal]
 	}).onDelete("restrict")
 ]);
-const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
-	projects,
-	environments,
-	secrets,
-	secretVersions
-}));
+/** 0.15's configuration objects (schema.ts). */
+const logConfig = sqliteTable("log_config", {
+	name: text().primaryKey(),
+	value: text().notNull(),
+	seal: bytes("seal")
+}, (table) => [
+	check("log_config_name_check", sql`${table.name} IN ('policy', 'roles')`),
+	check("log_config_value_check", sql`json_valid(${table.value})`),
+	check("log_config_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`)
+]);
+/**
+* 0.15's log (schema.ts). SQLite has one writer, so the fence is implicit,
+* and nothing is partitioned: uses and tiles are one table each.
+*/
+const logChanges = sqliteTable("log_changes", {
+	number: int64("number").primaryKey(),
+	at: integer({ mode: "number" }).notNull(),
+	requestId: text("request_id").notNull(),
+	object: text().notNull(),
+	actor: text().notNull(),
+	payload: text().notNull(),
+	seal: bytes("seal"),
+	mac: bytes("mac").notNull()
+}, (table) => [
+	unique("log_changes_request_id_key").on(table.requestId),
+	check("log_changes_seal_check", sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
+	check("log_changes_mac_check", sql`octet_length(${table.mac}) = 16`),
+	index("log_changes_object_idx").on(table.object, table.number),
+	index("log_changes_sign_in_idx").on(table.at, table.number).where(recorded("sqlite", table.payload, "signIn")),
+	index("log_changes_sign_in_actor_idx").on(table.actor, table.at, table.number).where(recorded("sqlite", table.payload, "signIn")),
+	index("log_changes_issue_revoke_idx").on(table.at, table.number).where(recorded("sqlite", table.payload, "issue", "revoke", "signOut")),
+	index("log_changes_issue_revoke_actor_idx").on(table.actor, table.at, table.number).where(recorded("sqlite", table.payload, "issue", "revoke", "signOut"))
+]);
+const logUses = sqliteTable("log_uses", {
+	number: int64("number").notNull(),
+	at: integer({ mode: "number" }).notNull(),
+	requestId: int64("request_id").notNull(),
+	credential: text().notNull(),
+	secret: text().notNull(),
+	purpose: integer().notNull(),
+	mac: bytes("mac").notNull(),
+	place: text()
+}, (table) => [check("log_uses_mac_check", sql`octet_length(${table.mac}) = 16`), uniqueIndex("log_uses_request_idx").on(table.at, table.requestId)]);
+/** 0.15's reads as the audit pages list them (schema.ts). */
+const logReads = sqliteTable("log_reads", {
+	number: int64("number").notNull(),
+	at: integer({ mode: "number" }).notNull(),
+	credential: text().notNull(),
+	purpose: integer().notNull(),
+	principal: text().notNull(),
+	secret: text().notNull(),
+	environment: text().notNull(),
+	project: text().notNull(),
+	place: text(),
+	source: text(),
+	sourceEnvironment: text("source_environment"),
+	sourceProject: text("source_project"),
+	version: text(),
+	mac: bytes("mac").notNull()
+}, (table) => [
+	check("log_reads_mac_check", sql`octet_length(${table.mac}) = 16`),
+	uniqueIndex("log_reads_number_idx").on(table.at, table.number),
+	index("log_reads_principal_idx").on(table.principal, table.at, table.number)
+]);
+/** The days each member's reads are in (`log_reads`), so that a page of theirs reads those days alone: the projector writes them with the reads. */
+const logReadDays = sqliteTable("log_read_days", {
+	principal: text().notNull(),
+	day: integer({ mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "log_read_days_pkey",
+	columns: [table.principal, table.day]
+})]);
+/** How far the projector has gone (schema.ts). */
+const logReadsCursor = sqliteTable("log_reads_cursor", {
+	onlyRow: flag("only_row").primaryKey().default(true),
+	through: int64("through").notNull(),
+	pair: int64("pair").notNull(),
+	at: integer({ mode: "number" }).notNull(),
+	mac: bytes("mac")
+}, (table) => [check("log_reads_cursor_only_row_check", sql`${table.onlyRow}`), check("log_reads_cursor_mac_check", sql`${table.mac} IS NULL OR octet_length(${table.mac}) = 16`)]);
+const logBulk = sqliteTable("log_bulk", {
+	principal: text().notNull(),
+	secret: text().notNull(),
+	last: integer({ mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "log_bulk_pkey",
+	columns: [table.principal, table.secret]
+})]);
+const logFence = sqliteTable("log_fence", {
+	onlyRow: flag("only_row").primaryKey().default(true),
+	atFloor: integer("at_floor", { mode: "number" }).notNull()
+}, (table) => [check("log_fence_only_row_check", sql`${table.onlyRow}`)]);
+const logCheckpoints = sqliteTable("log_checkpoints", {
+	upto: int64("upto").primaryKey(),
+	at: integer({ mode: "number" }).notNull(),
+	atFloor: integer("at_floor", { mode: "number" }).notNull(),
+	changesSize: int64("changes_size").notNull(),
+	changesRoot: bytes("changes_root").notNull(),
+	changesNote: text("changes_note").notNull(),
+	usesSize: int64("uses_size").notNull(),
+	usesRoot: bytes("uses_root").notNull(),
+	usesNote: text("uses_note").notNull()
+}, (table) => [
+	check("log_checkpoints_changes_root_check", sql`octet_length(${table.changesRoot}) = 32`),
+	check("log_checkpoints_uses_root_check", sql`octet_length(${table.usesRoot}) = 32`),
+	index("log_checkpoints_floor_idx").on(table.atFloor, table.upto)
+]);
+const logTiles = sqliteTable("log_tiles", {
+	tree: text().notNull(),
+	level: integer().notNull(),
+	leaf: int64("leaf").notNull(),
+	hashes: bytes("hashes").notNull()
+}, (table) => [
+	primaryKey({
+		name: "log_tiles_pkey",
+		columns: [
+			table.tree,
+			table.level,
+			table.leaf
+		]
+	}),
+	check("log_tiles_tree_check", sql`${table.tree} IN ('changes', 'uses')`),
+	check("log_tiles_level_check", sql`${table.level} BETWEEN 0 AND 7`),
+	check("log_tiles_leaf_check", sql`${table.leaf} >= 0 AND ((${table.level} = 7 AND ${table.leaf} = 0) OR (${table.level} < 7 AND ${table.leaf} % (1 << (8 * (${table.level} + 1))) = 0))`),
+	check("log_tiles_hashes_check", sql`octet_length(${table.hashes}) BETWEEN 32 AND 8192 AND octet_length(${table.hashes}) % 32 = 0`)
+]);
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, identities, logBulk, logChanges, logCheckpoints, logConfig, logFence, logReadDays, logReads, logReadsCursor, logTiles, logUses, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-wq1AVRAP.js";
+import { a as Queryable } from "./database-CVteLhp1.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -162,6 +162,188 @@ const KNOWN_MIGRATIONS = {
 			"when": 1793035191911,
 			"tag": "0021_prune_vault_releases",
 			"breakpoints": true
+		},
+		{
+			"idx": 22,
+			"version": "7",
+			"when": 1793068924881,
+			"tag": "0022_log_015",
+			"breakpoints": true
+		},
+		{
+			"idx": 23,
+			"version": "7",
+			"when": 179309e7,
+			"tag": "0023_change_path",
+			"breakpoints": true
+		},
+		{
+			"idx": 24,
+			"version": "7",
+			"when": 1793094000246,
+			"tag": "0024_use_015",
+			"breakpoints": true
+		},
+		{
+			"idx": 25,
+			"version": "7",
+			"when": 17931e8,
+			"tag": "0025_app_change",
+			"breakpoints": true
+		},
+		{
+			"idx": 26,
+			"version": "7",
+			"when": 179311e7,
+			"tag": "0026_issue_lock",
+			"breakpoints": true
+		},
+		{
+			"idx": 27,
+			"version": "7",
+			"when": 179312e7,
+			"tag": "0027_retention",
+			"breakpoints": true
+		},
+		{
+			"idx": 28,
+			"version": "7",
+			"when": 179313e7,
+			"tag": "0028_use_stalls",
+			"breakpoints": true
+		},
+		{
+			"idx": 29,
+			"version": "7",
+			"when": 179314e7,
+			"tag": "0029_use_objects",
+			"breakpoints": true
+		},
+		{
+			"idx": 30,
+			"version": "7",
+			"when": 179315e7,
+			"tag": "0030_unarchive_restores",
+			"breakpoints": true
+		},
+		{
+			"idx": 31,
+			"version": "7",
+			"when": 179316e7,
+			"tag": "0031_app_read",
+			"breakpoints": true
+		},
+		{
+			"idx": 32,
+			"version": "7",
+			"when": 1793180483207,
+			"tag": "0032_secrets_live_index",
+			"breakpoints": true
+		},
+		{
+			"idx": 33,
+			"version": "7",
+			"when": 1793190483207,
+			"tag": "0033_use_generations",
+			"breakpoints": true
+		},
+		{
+			"idx": 34,
+			"version": "7",
+			"when": 1793200483207,
+			"tag": "0034_vault_credentials",
+			"breakpoints": true
+		},
+		{
+			"idx": 35,
+			"version": "7",
+			"when": 1793210483207,
+			"tag": "0035_first_days",
+			"breakpoints": true
+		},
+		{
+			"idx": 36,
+			"version": "7",
+			"when": 1793220483207,
+			"tag": "0036_vault_issues",
+			"breakpoints": true
+		},
+		{
+			"idx": 37,
+			"version": "7",
+			"when": 1793230483207,
+			"tag": "0037_vault_bindings",
+			"breakpoints": true
+		},
+		{
+			"idx": 38,
+			"version": "7",
+			"when": 1793247589162,
+			"tag": "0040_binding_origin",
+			"breakpoints": true
+		},
+		{
+			"idx": 39,
+			"version": "7",
+			"when": 1793270313298,
+			"tag": "0041_cutover",
+			"breakpoints": true
+		},
+		{
+			"idx": 40,
+			"version": "7",
+			"when": 1793302884510,
+			"tag": "0042_sign_in_index",
+			"breakpoints": true
+		},
+		{
+			"idx": 41,
+			"version": "7",
+			"when": 1793306932805,
+			"tag": "0043_issue_revoke_index",
+			"breakpoints": true
+		},
+		{
+			"idx": 42,
+			"version": "7",
+			"when": 1793316932805,
+			"tag": "0044_use_by_name",
+			"breakpoints": true
+		},
+		{
+			"idx": 43,
+			"version": "7",
+			"when": 1793326932805,
+			"tag": "0045_decide_first",
+			"breakpoints": true
+		},
+		{
+			"idx": 44,
+			"version": "7",
+			"when": 1793352372315,
+			"tag": "0046_way_in_uses",
+			"breakpoints": true
+		},
+		{
+			"idx": 45,
+			"version": "7",
+			"when": 1793372629862,
+			"tag": "0047_cutover_finish",
+			"breakpoints": true
+		},
+		{
+			"idx": 46,
+			"version": "7",
+			"when": 179339e7,
+			"tag": "0048_use_batch",
+			"breakpoints": true
+		},
+		{
+			"idx": 47,
+			"version": "7",
+			"when": 1793445614633,
+			"tag": "0049_reads",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -290,6 +472,76 @@ const KNOWN_MIGRATIONS = {
 			"when": 1793017781451,
 			"tag": "0017_vault_releases",
 			"breakpoints": true
+		},
+		{
+			"idx": 18,
+			"version": "6",
+			"when": 1793068925491,
+			"tag": "0018_log_015",
+			"breakpoints": true
+		},
+		{
+			"idx": 19,
+			"version": "6",
+			"when": 179312e7,
+			"tag": "0019_retention",
+			"breakpoints": true
+		},
+		{
+			"idx": 20,
+			"version": "6",
+			"when": 179313e7,
+			"tag": "0020_ended_references",
+			"breakpoints": true
+		},
+		{
+			"idx": 21,
+			"version": "6",
+			"when": 1793180484098,
+			"tag": "0021_secrets_live_index",
+			"breakpoints": true
+		},
+		{
+			"idx": 22,
+			"version": "6",
+			"when": 1793247590011,
+			"tag": "0022_binding_origin",
+			"breakpoints": true
+		},
+		{
+			"idx": 23,
+			"version": "6",
+			"when": 1793268597317,
+			"tag": "0023_sign_in_index",
+			"breakpoints": true
+		},
+		{
+			"idx": 24,
+			"version": "6",
+			"when": 1793306933393,
+			"tag": "0024_issue_revoke_index",
+			"breakpoints": true
+		},
+		{
+			"idx": 25,
+			"version": "6",
+			"when": 1793352372923,
+			"tag": "0025_way_in_uses",
+			"breakpoints": true
+		},
+		{
+			"idx": 26,
+			"version": "6",
+			"when": 1793372630506,
+			"tag": "0026_cutover_finish",
+			"breakpoints": true
+		},
+		{
+			"idx": 27,
+			"version": "6",
+			"when": 1793445615378,
+			"tag": "0027_reads",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };
@@ -306,8 +558,8 @@ async function migrated(db) {
 }
 async function hasLedger(db) {
 	if (engineOf(db) === "postgres") {
-		const { rows } = await db.execute(sql`SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS present`);
-		return rows[0]?.present === true;
+		const [ledger] = await db.execute(sql`SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS present`);
+		return ledger?.present === true;
 	}
 	return (await db.all(sql`SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'`)).length > 0;
 }

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, w as vaultReleases, x as serviceBindings, y as secrets } from "./schema-BfQEBqFv.js";
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
+import { A as vaultGrants, C as oauthClients, D as secretVersions, E as secretReferences, M as vaultReleases, O as secrets, S as mcpConnections, _ as logReads, a as credentials, b as logUses, c as enrollments, d as logBulk, f as logChanges, g as logReadDays, h as logFence, i as consumedTokens, j as vaultMembers, k as serviceBindings, l as environments, m as logConfig, n as auditLog, o as deviceAuthorizations, p as logCheckpoints, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as identities, v as logReadsCursor, w as projects, x as mcpApprovals, y as logTiles } from "./schema-DgoPqqsI.js";
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, identities, logBulk, logChanges, logCheckpoints, logConfig, logFence, logReadDays, logReads, logReadsCursor, logTiles, logUses, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, serviceBindings, vaultGrants, vaultMembers, vaultReleases };