@coffre/db 0.3.0 → 0.4.0

package/dist/schema-sqlite.js

@@ -2,7 +2,7 @@ import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
 import { asPostgres } from "./portable.js";
 import { sql } from "drizzle-orm";
 import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
-import { blob, check, customType, foreignKey, index, integer, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
+import { blob, check, customType, foreignKey, index, integer, primaryKey, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
 //#region src/schema.sqlite.ts
 /**
 * The schema in schema.ts, for SQLite (through libsql). Same tables,
@@ -28,13 +28,26 @@ const createdAt = () => time("created_at").notNull().default(now);
 const flag = (name) => integer(name, { mode: "boolean" });
 /** `^[a-z0-9][a-z0-9-]{0,max-1}$`, in GLOB. */
 const isSlug = (column, max) => sql`length(${column}) BETWEEN 1 AND ${sql.raw(String(max))} AND ${column} GLOB '[a-z0-9]*' AND ${column} NOT GLOB '*[^a-z0-9-]*'`;
+/** A slug, or a tombstone's, `market~deleted-2026-10-05`: schema.ts's `PLACE_SLUG`, in GLOB. */
+const isPlaceSlug = (column) => {
+	const base = sql`substr(${column}, 1, instr(${column}, '~') - 1)`;
+	const suffix = sql`substr(${column}, instr(${column}, '~') + 1)`;
+	return sql`(${isSlug(column, 63)}) OR (instr(${column}, '~') BETWEEN 2 AND 64 AND ${base} GLOB '[a-z0-9]*' AND ${base} NOT GLOB '*[^a-z0-9-]*' AND length(${suffix}) BETWEEN 1 AND 40 AND ${suffix} NOT GLOB '*[^a-z0-9-]*')`;
+};
+/** A folder's name; the app also refuses control characters, which GLOB has no class for. */
+const folderCheck = (name, column) => check(name, sql`${column} IS NULL OR (length(${column}) BETWEEN 1 AND 64 AND ${column} NOT GLOB '*/*' AND ${column} = trim(${column}))`);
 const projects = sqliteTable("projects", {
 	id: text().primaryKey(),
 	slug: text().notNull(),
 	name: text().notNull(),
 	createdAt: createdAt(),
-	archivedAt: time("archived_at")
-}, (table) => [unique("projects_slug_key").on(table.slug), check("projects_slug_check", isSlug(table.slug, 63))]);
+	archivedAt: time("archived_at"),
+	folder: text()
+}, (table) => [
+	unique("projects_slug_key").on(table.slug),
+	check("projects_slug_check", isPlaceSlug(table.slug)),
+	folderCheck("projects_folder_check", table.folder)
+]);
 const environments = sqliteTable("environments", {
 	id: text().primaryKey(),
 	projectId: text("project_id").notNull(),
@@ -45,7 +58,7 @@ const environments = sqliteTable("environments", {
 }, (table) => [
 	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
 	unique("environments_project_scoped").on(table.id, table.projectId),
-	check("environments_slug_check", isSlug(table.slug, 63)),
+	check("environments_slug_check", isPlaceSlug(table.slug)),
 	foreignKey({
 		name: "environments_project_id_fkey",
 		columns: [table.projectId],
@@ -61,10 +74,12 @@ const secrets = sqliteTable("secrets", {
 	updatedAt: time("updated_at").notNull().default(now),
 	currentVersionId: text("current_version_id").references(() => secretVersions.id, { onDelete: "no action" }),
 	currentVersion: integer("current_version").notNull().default(0),
-	archivedAt: time("archived_at")
+	archivedAt: time("archived_at"),
+	folder: text()
 }, (table) => [
 	unique("secrets_project_id_environment_id_key_key").on(table.projectId, table.environmentId, table.key),
 	check("secrets_key_check", sql`length(${table.key}) BETWEEN 1 AND 128 AND ${table.key} GLOB '[A-Za-z_]*' AND ${table.key} NOT GLOB '*[^A-Za-z0-9_]*'`),
+	folderCheck("secrets_folder_check", table.folder),
 	foreignKey({
 		name: "secrets_project_id_fkey",
 		columns: [table.projectId],
@@ -108,6 +123,25 @@ const secretVersions = sqliteTable("secret_versions", {
 	}).onDelete("restrict"),
 	index("secret_versions_secret_idx").on(table.secretId, table.version)
 ]);
+const dismissedKeys = sqliteTable("dismissed_keys", {
+	environmentId: text("environment_id").notNull(),
+	key: text().notNull(),
+	dismissedAt: time("dismissed_at").notNull().default(now),
+	dismissedBy: text("dismissed_by").notNull(),
+	restoredAt: time("restored_at"),
+	restoredBy: text("restored_by")
+}, (table) => [
+	primaryKey({
+		name: "dismissed_keys_pkey",
+		columns: [table.environmentId, table.key]
+	}),
+	check("dismissed_keys_key_check", sql`length(${table.key}) BETWEEN 1 AND 128 AND ${table.key} GLOB '[A-Za-z_]*' AND ${table.key} NOT GLOB '*[^A-Za-z0-9_]*'`),
+	foreignKey({
+		name: "dismissed_keys_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict")
+]);
 const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
 const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
 const vaultMembers = sqliteTable("vault_members", {
@@ -123,7 +157,7 @@ const vaultMembers = sqliteTable("vault_members", {
 	mac: bytes("mac").notNull()
 }, (table) => [
 	check("vault_members_mac_check", sql`octet_length(${table.mac}) = 32`),
-	check("vault_members_principal_check", sql`(${table.principal} GLOB 'user:?*' OR ${table.principal} GLOB 'token:?*' OR ${table.principal} GLOB 'sync:?*')
+	check("vault_members_principal_check", sql`(${table.principal} GLOB 'user:?*' OR ${table.principal} GLOB 'token:?*')
         AND substr(${table.principal}, instr(${table.principal}, ':') + 1, 1) <> ':'
         AND instr(${table.principal}, ' ') = 0 AND instr(${table.principal}, char(9)) = 0
         AND instr(${table.principal}, char(10)) = 0 AND instr(${table.principal}, char(13)) = 0`),
@@ -136,16 +170,20 @@ const vaultGrants = sqliteTable("vault_grants", {
 	principal: text().notNull(),
 	projectId: text("project_id"),
 	environmentId: text("environment_id"),
+	environmentSlug: text("environment_slug"),
 	role: text().notNull(),
 	expiresAt: integer("expires_at", { mode: "number" }),
 	grantedAt: integer("granted_at", { mode: "number" }).notNull(),
 	grantedBy: text("granted_by").notNull()
 }, (table) => [
-	check("vault_grants_one_place", sql`(${table.projectId} IS NULL) <> (${table.environmentId} IS NULL)`),
+	check("vault_grants_one_place", sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`),
+	check("vault_grants_environment_slug_check", sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
 	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
-	check("vault_grants_environment_role_check", sql`${table.environmentId} IS NULL OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	check("vault_grants_environment_role_check", sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
 	unique("vault_grants_on_project").on(table.principal, table.projectId),
 	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
+	unique("vault_grants_on_environment_slug").on(table.principal, table.environmentSlug),
+	uniqueIndex("vault_grants_on_every_project").on(table.principal).where(sql`${table.projectId} IS NULL AND ${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL`),
 	foreignKey({
 		name: "vault_grants_principal_fkey",
 		columns: [table.principal],
@@ -186,7 +224,7 @@ const auditLog = sqliteTable("audit_log", {
 	hash: bytes("hash").notNull()
 }, (table) => [
 	check("audit_log_author_check", sql`${table.author} IN ('app', 'vault')`),
-	check("audit_log_actor_check", sql`${table.actor} GLOB 'user:?*' OR ${table.actor} GLOB 'token:?*' OR ${table.actor} GLOB 'sync:?*' OR ${table.actor} GLOB 'system:?*'`),
+	check("audit_log_actor_check", sql`${table.actor} GLOB 'user:?*' OR ${table.actor} GLOB 'token:?*' OR ${table.actor} GLOB 'system:?*'`),
 	check("audit_log_decision_check", sql`${table.decision} IN ('allow', 'deny')`),
 	check("audit_log_metadata_check", sql`json_valid(${table.metadata})`),
 	check("audit_log_prev_hash_check", sql`octet_length(${table.prevHash}) = 32`),
@@ -226,7 +264,45 @@ const auditLog = sqliteTable("audit_log", {
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`json_extract(${table.metadata}, '$.bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
-	index("audit_log_exchange_idx").on(sql`json_extract(${table.metadata}, '$.credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`)
+	index("audit_log_exchange_idx").on(sql`json_extract(${table.metadata}, '$.credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
+	index("audit_log_also_project_idx").on(sql`json_extract(${table.metadata}, '$.also.projectId')`, table.seq).where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
+	index("audit_log_also_environment_idx").on(sql`json_extract(${table.metadata}, '$.also.environmentId')`, table.seq).where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
+	index("audit_log_also_secret_idx").on(sql`json_extract(${table.metadata}, '$.also.secretId')`, table.seq).where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`)
+]);
+const secretReferences = sqliteTable("secret_references", {
+	id: text().primaryKey(),
+	projectId: text("project_id").notNull(),
+	environmentId: text("environment_id").notNull(),
+	secretId: text("secret_id").notNull(),
+	sourceProjectId: text("source_project_id").notNull(),
+	sourceEnvironmentId: text("source_environment_id").notNull(),
+	sourceSecretId: text("source_secret_id").notNull(),
+	createdSeq: int64("created_seq").notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull()
+}, (table) => [
+	unique("secret_references_created_seq_key").on(table.createdSeq),
+	foreignKey({
+		name: "secret_references_secret_id_fkey",
+		columns: [table.secretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secret_references_source_secret_id_fkey",
+		columns: [table.sourceSecretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secret_references_created_seq_fkey",
+		columns: [table.createdSeq],
+		foreignColumns: [auditLog.seq]
+	}).onDelete("restrict"),
+	index("secret_references_holder_idx").on(table.secretId, table.createdSeq),
+	index("secret_references_source_idx").on(table.sourceSecretId),
+	index("secret_references_project_idx").on(table.projectId),
+	index("secret_references_source_project_idx").on(table.sourceProjectId),
+	index("secret_references_created_by_idx").on(table.createdBy)
 ]);
 const auditChainHead = sqliteTable("audit_chain_head", {
 	onlyRow: flag("only_row").primaryKey().default(true),
@@ -296,6 +372,92 @@ const consumedTokens = sqliteTable("consumed_tokens", {
 	hash: bytes("hash").primaryKey(),
 	consumedAt: time("consumed_at").notNull().default(now)
 }, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
+/**
+* MCP clients that registered themselves (RFC 7591), the fallback to Client
+* ID Metadata Documents, which need no row. The ID is the client's
+* `client_id`. Its redirects are under its MAC: a database writer cannot add
+* one of their own to a client people have approved.
+*/
+const oauthClients = sqliteTable("oauth_clients", {
+	id: text().primaryKey(),
+	authMac: bytes("auth_mac").notNull(),
+	name: text().notNull(),
+	redirectUris: text("redirect_uris").notNull(),
+	createdAt: createdAt(),
+	createdIp: text("created_ip"),
+	revokedAt: time("revoked_at")
+}, (table) => [check("oauth_clients_auth_mac_check", sql`octet_length(${table.authMac}) = 32`), check("oauth_clients_redirect_uris_check", sql`json_valid(${table.redirectUris})`)]);
+/**
+* One MCP client a person connected: one approved authorization, its
+* scopes, its code until the client redeems it, and the refresh token it
+* holds since. Access tokens have no row: each names its connection under a
+* MAC, and every request checks this row. Revoking it ends them all.
+*/
+const mcpConnections = sqliteTable("mcp_connections", {
+	id: text().primaryKey(),
+	authMac: bytes("auth_mac").notNull(),
+	principal: text().notNull(),
+	generation: integer().notNull(),
+	clientId: text("client_id").notNull(),
+	clientName: text("client_name").notNull(),
+	clientHost: text("client_host"),
+	registration: text().notNull(),
+	scopes: text().notNull(),
+	redirectUri: text("redirect_uri").notNull(),
+	codeHash: bytes("code_hash"),
+	codeChallenge: text("code_challenge"),
+	codeExpiresAt: time("code_expires_at"),
+	refreshHash: bytes("refresh_hash"),
+	refreshPreviousHash: bytes("refresh_previous_hash"),
+	expiresAt: time("expires_at").notNull(),
+	createdAt: createdAt(),
+	lastUsedAt: time("last_used_at"),
+	lastUsedIp: text("last_used_ip"),
+	revokedAt: time("revoked_at"),
+	revokedBy: text("revoked_by")
+}, (table) => [
+	check("mcp_connections_principal_check", sql`${table.principal} LIKE 'user:%'`),
+	check("mcp_connections_registration_check", sql`${table.registration} IN ('cimd', 'dcr')`),
+	check("mcp_connections_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("mcp_connections_code_hash_check", sql`${table.codeHash} IS NULL OR octet_length(${table.codeHash}) = 32`),
+	check("mcp_connections_refresh_hash_check", sql`${table.refreshHash} IS NULL OR octet_length(${table.refreshHash}) = 32`),
+	foreignKey({
+		name: "mcp_connections_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	unique("mcp_connections_code_hash_key").on(table.codeHash),
+	unique("mcp_connections_refresh_hash_key").on(table.refreshHash),
+	index("mcp_connections_refresh_previous_idx").on(table.refreshPreviousHash),
+	index("mcp_connections_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`)
+]);
+/**
+* A change an MCP client asked for, waiting for its person on coffre's own
+* page: see schema.ts.
+*/
+const mcpApprovals = sqliteTable("mcp_approvals", {
+	id: text().primaryKey(),
+	connectionId: text("connection_id").notNull(),
+	tool: text().notNull(),
+	arguments: text().notNull(),
+	digest: bytes("digest").notNull(),
+	status: text().notNull().default("pending"),
+	outcome: text(),
+	createdAt: createdAt(),
+	expiresAt: time("expires_at").notNull(),
+	decidedAt: time("decided_at"),
+	reportedAt: time("reported_at")
+}, (table) => [
+	check("mcp_approvals_status_check", sql`${table.status} IN ('pending', 'approved', 'denied', 'cancelled', 'failed')`),
+	check("mcp_approvals_digest_check", sql`octet_length(${table.digest}) = 32`),
+	check("mcp_approvals_arguments_check", sql`json_valid(${table.arguments})`),
+	foreignKey({
+		name: "mcp_approvals_connection_fkey",
+		columns: [table.connectionId],
+		foreignColumns: [mcpConnections.id]
+	}).onDelete("restrict"),
+	index("mcp_approvals_open_idx").on(table.connectionId, table.digest).where(sql`${table.reportedAt} IS NULL`)
+]);
 const credentials = sqliteTable("credentials", {
 	id: text().primaryKey(),
 	kind: text().notNull(),
@@ -379,4 +541,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema-version.d.ts

@@ -1,21 +1,17 @@
-import { i as Queryable } from "./database-Cq_52uUo.js";
+import { i as Queryable } from "./database-edkMkG02.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
-/**
- * Minimum migration prefix required by this application image, per engine:
- * Advance this only when the runtime needs the new schema. The sync-removal
- * migration only drops unused tables: new code works with either prefix,
- * so Workers Builds can deploy before an owner runs the migration.
- * Applied migrations remain immutable (see baseline.ts).
- */
-export declare const REQUIRED_MIGRATIONS: Record<Engine, number>;
-export declare function requiredMigrations(db: Queryable): number;
 /**
  * Every migration this version ships, oldest first, per engine: read from
  * the journals at build time, so a Worker, which has no files, knows them
- * too. A database that has applied fewer is behind this code, whatever
- * `REQUIRED_MIGRATIONS` lets it run on.
+ * too.
  */
 export declare const KNOWN_MIGRATIONS: Record<Engine, readonly string[]>;
-export declare function knownMigrations(db: Queryable): readonly string[];
+/**
+ * Whether the database has applied every migration this version ships:
+ * below that, the app serves nothing but its readiness, which says so
+ * (`coffre migrate` runs before each deploy). A database never loses a
+ * migration, so once true it stays true.
+ */
+export declare function migrated(db: Queryable): Promise<boolean>;
 //#endregion

package/dist/schema-version.js

@@ -1,109 +1,57 @@
-import { engineOf } from "./dialect.js";
-//#region src/migrations/postgres/meta/_journal.json
-var entries$1 = [
-	{
+import { engineOf, migrationLedger } from "./dialect.js";
+import { count, sql } from "drizzle-orm";
+//#endregion
+//#region src/schema-version.ts
+/**
+* Every migration this version ships, oldest first, per engine: read from
+* the journals at build time, so a Worker, which has no files, knows them
+* too.
+*/
+const KNOWN_MIGRATIONS = {
+	postgres: [{
 		"idx": 0,
 		"version": "7",
-		"when": 1790930587507,
+		"when": 1791237720902,
 		"tag": "0000_baseline",
 		"breakpoints": true
-	},
-	{
+	}, {
 		"idx": 1,
 		"version": "7",
-		"when": 1791062292678,
-		"tag": "0001_remove_syncs",
-		"breakpoints": true
-	},
-	{
-		"idx": 2,
-		"version": "7",
-		"when": 1791069304538,
-		"tag": "0002_service_bindings",
+		"when": 1791242674488,
+		"tag": "0001_mcp_approvals",
 		"breakpoints": true
-	},
-	{
-		"idx": 3,
-		"version": "7",
-		"when": 1791072336889,
-		"tag": "0003_exchanges",
-		"breakpoints": true
-	},
-	{
-		"idx": 4,
-		"version": "7",
-		"when": 1791084354462,
-		"tag": "0004_live_indexes",
-		"breakpoints": true
-	}
-];
-//#endregion
-//#region src/migrations/sqlite/meta/_journal.json
-var entries = [
-	{
+	}].map((entry) => entry.tag),
+	sqlite: [{
 		"idx": 0,
 		"version": "6",
-		"when": 1790874462505,
+		"when": 1791237724735,
 		"tag": "0000_baseline",
 		"breakpoints": true
-	},
-	{
+	}, {
 		"idx": 1,
 		"version": "6",
-		"when": 1791062293531,
-		"tag": "0001_remove_syncs",
-		"breakpoints": true
-	},
-	{
-		"idx": 2,
-		"version": "6",
-		"when": 1791069305749,
-		"tag": "0002_service_bindings",
+		"when": 1791242675074,
+		"tag": "0001_mcp_approvals",
 		"breakpoints": true
-	},
-	{
-		"idx": 3,
-		"version": "6",
-		"when": 1791072337548,
-		"tag": "0003_exchanges",
-		"breakpoints": true
-	},
-	{
-		"idx": 4,
-		"version": "6",
-		"when": 1791084355588,
-		"tag": "0004_live_indexes",
-		"breakpoints": true
-	}
-];
-//#endregion
-//#region src/schema-version.ts
-/**
-* Minimum migration prefix required by this application image, per engine:
-* Advance this only when the runtime needs the new schema. The sync-removal
-* migration only drops unused tables: new code works with either prefix,
-* so Workers Builds can deploy before an owner runs the migration.
-* Applied migrations remain immutable (see baseline.ts).
-*/
-const REQUIRED_MIGRATIONS = {
-	postgres: 1,
-	sqlite: 1
+	}].map((entry) => entry.tag)
 };
-function requiredMigrations(db) {
-	return REQUIRED_MIGRATIONS[engineOf(db)];
-}
 /**
-* Every migration this version ships, oldest first, per engine: read from
-* the journals at build time, so a Worker, which has no files, knows them
-* too. A database that has applied fewer is behind this code, whatever
-* `REQUIRED_MIGRATIONS` lets it run on.
+* Whether the database has applied every migration this version ships:
+* below that, the app serves nothing but its readiness, which says so
+* (`coffre migrate` runs before each deploy). A database never loses a
+* migration, so once true it stays true.
 */
-const KNOWN_MIGRATIONS = {
-	postgres: entries$1.map((entry) => entry.tag),
-	sqlite: entries.map((entry) => entry.tag)
-};
-function knownMigrations(db) {
-	return KNOWN_MIGRATIONS[engineOf(db)];
+async function migrated(db) {
+	if (!await hasLedger(db)) return false;
+	const [ledger] = await db.select({ n: count() }).from(migrationLedger(db));
+	return (ledger?.n ?? 0) >= KNOWN_MIGRATIONS[engineOf(db)].length;
+}
+async function hasLedger(db) {
+	if (engineOf(db) === "postgres") {
+		const { rows } = await db.execute(sql`SELECT to_regclass('drizzle.__drizzle_migrations') IS NOT NULL AS present`);
+		return rows[0]?.present === true;
+	}
+	return (await db.all(sql`SELECT 1 AS present FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'`)).length > 0;
 }
 //#endregion
-export { KNOWN_MIGRATIONS, REQUIRED_MIGRATIONS, knownMigrations, requiredMigrations };
+export { KNOWN_MIGRATIONS, migrated };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { a as deviceAuthorizations, c as identities, d as secretVersions, f as secrets, g as vaultMembers, h as vaultGrants, i as credentials, l as projects, m as serviceBindings, n as auditLog, o as environments, p as secretsRelations, r as consumedTokens, s as environmentsRelations, t as auditChainHead } from "./schema-Wt-p8AOh.js";
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-BqCB3XFm.js";
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };