@coffre/db 0.3.0 → 0.4.0

package/dist/{schema-Wt-p8AOh.d.ts → schema-BqCB3XFm.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -90,6 +90,23 @@ declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    folder: import("drizzle-orm/pg-core").PgColumn<{
+      name: "folder";
+      tableName: "projects";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -359,6 +376,23 @@ declare const secrets: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    folder: import("drizzle-orm/pg-core").PgColumn<{
+      name: "folder";
+      tableName: "secrets";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -598,11 +632,127 @@ declare const secretVersions: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * Keys an environment is missing, which its team decided it does not need:
+ * the project's other environments have them, and its missing-keys list
+ * leaves them out until someone restores them (docs/design/environments.md).
+ * One row per environment and key, updated in place: restoring sets
+ * `restored_at`, dismissing again clears it.
+ */
+declare const dismissedKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "dismissed_keys";
+  schema: undefined;
+  columns: {
+    environmentId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "environment_id";
+      tableName: "dismissed_keys";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    key: import("drizzle-orm/pg-core").PgColumn<{
+      name: "key";
+      tableName: "dismissed_keys";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    dismissedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "dismissed_at";
+      tableName: "dismissed_keys";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    dismissedBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "dismissed_by";
+      tableName: "dismissed_keys";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    restoredAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "restored_at";
+      tableName: "dismissed_keys";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    restoredBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "restored_by";
+      tableName: "dismissed_keys";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * The vault's member directory: everyone it has admitted, written by the
  * vault alone, read by both. A principal with no row is no member.
  * Principals are the strings coffre uses at its edges: `user:<email>`,
- * `token:<id>`, `sync:<id>`. Times are milliseconds since the epoch, each
+ * `token:<id>`. Times are milliseconds since the epoch, each
  * the time of the vault's log entry that set it, so the log replays to
  * these rows exactly.
  */
@@ -786,9 +936,11 @@ declare const vaultMembers: import("drizzle-orm/pg-core").PgTableWithColumns<{
   dialect: "pg";
 }>;
 /**
- * One role per member per place: a project, or one of its environments,
- * never both. A revoked grant is deleted; an expired one stays until its
- * place is granted again, so the members page can say it lapsed.
+ * One role per member per place: a project, one of its environments, every
+ * project (`*`, neither id), or the environment of one slug in every project
+ * (neither id, and `environment_slug`). A revoked grant is deleted; an
+ * expired one stays until its place is granted again, so the members page
+ * can say it lapsed.
  */
 declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "vault_grants";
@@ -845,6 +997,23 @@ declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    environmentSlug: import("drizzle-orm/pg-core").PgColumn<{
+      name: "environment_slug";
+      tableName: "vault_grants";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     role: import("drizzle-orm/pg-core").PgColumn<{
       name: "role";
       tableName: "vault_grants";
@@ -1286,19 +1455,27 @@ declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
-declare const auditChainHead: import("drizzle-orm/pg-core").PgTableWithColumns<{
-  name: "audit_chain_head";
+/**
+ * A reference: a secret whose value is another's, read live through it by
+ * whoever reads the holder's environment (docs/design/environments.md).
+ * The row only points: the reference is the vault's `reference.create`
+ * entry at `created_seq`, which the vault checks at every read, and a
+ * `reference.end` naming that entry ends it, whatever this table says. So
+ * rows are only ever added.
+ */
+declare const secretReferences: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "secret_references";
   schema: undefined;
   columns: {
-    onlyRow: import("drizzle-orm/pg-core").PgColumn<{
-      name: "only_row";
-      tableName: "audit_chain_head";
-      dataType: "boolean";
-      columnType: "PgBoolean";
-      data: boolean;
-      driverParam: boolean;
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "secret_references";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
       notNull: true;
-      hasDefault: true;
+      hasDefault: false;
       isPrimaryKey: true;
       isAutoincrement: false;
       hasRuntimeDefault: false;
@@ -1307,15 +1484,15 @@ declare const auditChainHead: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    nextSeq: import("drizzle-orm/pg-core").PgColumn<{
-      name: "next_seq";
-      tableName: "audit_chain_head";
-      dataType: "bigint";
-      columnType: "PgBigInt64";
-      data: bigint;
+    projectId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "project_id";
+      tableName: "secret_references";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
       driverParam: string;
       notNull: true;
-      hasDefault: true;
+      hasDefault: false;
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
@@ -1324,13 +1501,13 @@ declare const auditChainHead: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    headHash: import("drizzle-orm/pg-core").PgColumn<{
-      name: "head_hash";
-      tableName: "audit_chain_head";
-      dataType: "custom";
-      columnType: "PgCustomColumn";
-      data: Buffer<ArrayBufferLike>;
-      driverParam: unknown;
+    environmentId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "environment_id";
+      tableName: "secret_references";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
       notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
@@ -1340,34 +1517,17 @@ declare const auditChainHead: import("drizzle-orm/pg-core").PgTableWithColumns<{
       baseColumn: never;
       identity: undefined;
       generated: undefined;
-    }, {}, {
-      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
-    }>;
-  };
-  dialect: "pg";
-}>;
-/**
- * An account at a sign-in provider, bound to one principal.
- *
- * Looked up by (provider, subject), never by email. An email address is
- * recycled when someone leaves; the provider's subject is not, so binding to
- * it is what stops a new holder of an old address from inheriting its access.
- * The email is kept for display only.
- */
-declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
-  name: "identities";
-  schema: undefined;
-  columns: {
-    id: import("drizzle-orm/pg-core").PgColumn<{
-      name: "id";
-      tableName: "identities";
+    }, {}, {}>;
+    secretId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "secret_id";
+      tableName: "secret_references";
       dataType: "string";
       columnType: "PgUUID";
       data: string;
       driverParam: string;
       notNull: true;
-      hasDefault: true;
-      isPrimaryKey: true;
+      hasDefault: false;
+      isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
       enumValues: undefined;
@@ -1375,11 +1535,11 @@ declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    provider: import("drizzle-orm/pg-core").PgColumn<{
-      name: "provider";
-      tableName: "identities";
+    sourceProjectId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "source_project_id";
+      tableName: "secret_references";
       dataType: "string";
-      columnType: "PgText";
+      columnType: "PgUUID";
       data: string;
       driverParam: string;
       notNull: true;
@@ -1387,18 +1547,18 @@ declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
+      enumValues: undefined;
       baseColumn: never;
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    authMac: import("drizzle-orm/pg-core").PgColumn<{
-      name: "auth_mac";
-      tableName: "identities";
-      dataType: "custom";
-      columnType: "PgCustomColumn";
-      data: Buffer<ArrayBufferLike>;
-      driverParam: unknown;
+    sourceEnvironmentId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "source_environment_id";
+      tableName: "secret_references";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
       notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
@@ -1408,14 +1568,12 @@ declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
       baseColumn: never;
       identity: undefined;
       generated: undefined;
-    }, {}, {
-      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
-    }>;
-    subject: import("drizzle-orm/pg-core").PgColumn<{
-      name: "subject";
-      tableName: "identities";
+    }, {}, {}>;
+    sourceSecretId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "source_secret_id";
+      tableName: "secret_references";
       dataType: "string";
-      columnType: "PgText";
+      columnType: "PgUUID";
       data: string;
       driverParam: string;
       notNull: true;
@@ -1423,31 +1581,227 @@ declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
+      enumValues: undefined;
       baseColumn: never;
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    issuerHash: import("drizzle-orm/pg-core").PgColumn<{
-      name: "issuer_hash";
-      tableName: "identities";
-      dataType: "string";
-      columnType: "PgText";
-      data: string;
+    createdSeq: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_seq";
+      tableName: "secret_references";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
       driverParam: string;
       notNull: true;
       hasDefault: false;
       isPrimaryKey: false;
       isAutoincrement: false;
       hasRuntimeDefault: false;
-      enumValues: [string, ...string[]];
+      enumValues: undefined;
       baseColumn: never;
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
-    generation: import("drizzle-orm/pg-core").PgColumn<{
-      name: "generation";
-      tableName: "identities";
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "secret_references";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_by";
+      tableName: "secret_references";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+declare const auditChainHead: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "audit_chain_head";
+  schema: undefined;
+  columns: {
+    onlyRow: import("drizzle-orm/pg-core").PgColumn<{
+      name: "only_row";
+      tableName: "audit_chain_head";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    nextSeq: import("drizzle-orm/pg-core").PgColumn<{
+      name: "next_seq";
+      tableName: "audit_chain_head";
+      dataType: "bigint";
+      columnType: "PgBigInt64";
+      data: bigint;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    headHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "head_hash";
+      tableName: "audit_chain_head";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * An account at a sign-in provider, bound to one principal.
+ *
+ * Looked up by (provider, subject), never by email. An email address is
+ * recycled when someone leaves; the provider's subject is not, so binding to
+ * it is what stops a new holder of an old address from inheriting its access.
+ * The email is kept for display only.
+ */
+declare const identities: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "identities";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "identities";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    provider: import("drizzle-orm/pg-core").PgColumn<{
+      name: "provider";
+      tableName: "identities";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    authMac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "auth_mac";
+      tableName: "identities";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    subject: import("drizzle-orm/pg-core").PgColumn<{
+      name: "subject";
+      tableName: "identities";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    issuerHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "issuer_hash";
+      tableName: "identities";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    generation: import("drizzle-orm/pg-core").PgColumn<{
+      name: "generation";
+      tableName: "identities";
       dataType: "number";
       columnType: "PgInteger";
       data: number;
@@ -1906,6 +2260,722 @@ declare const consumedTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * MCP clients that registered themselves (RFC 7591), the fallback to Client
+ * ID Metadata Documents, which need no row. The ID is the client's
+ * `client_id`. Its redirects are under its MAC: a database writer cannot add
+ * one of their own to a client people have approved.
+ */
+declare const oauthClients: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "oauth_clients";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "oauth_clients";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    authMac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "auth_mac";
+      tableName: "oauth_clients";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    name: import("drizzle-orm/pg-core").PgColumn<{
+      name: "name";
+      tableName: "oauth_clients";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    redirectUris: import("drizzle-orm/pg-core").PgColumn<{
+      name: "redirect_uris";
+      tableName: "oauth_clients";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "oauth_clients";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdIp: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_ip";
+      tableName: "oauth_clients";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "revoked_at";
+      tableName: "oauth_clients";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * One MCP client a person connected: one approved authorization, its
+ * scopes, its code until the client redeems it, and the refresh token it
+ * holds since. Access tokens have no row: each names its connection under a
+ * MAC, and every request checks this row. Revoking it ends them all.
+ */
+declare const mcpConnections: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "mcp_connections";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    authMac: import("drizzle-orm/pg-core").PgColumn<{
+      name: "auth_mac";
+      tableName: "mcp_connections";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    generation: import("drizzle-orm/pg-core").PgColumn<{
+      name: "generation";
+      tableName: "mcp_connections";
+      dataType: "number";
+      columnType: "PgInteger";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    clientId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "client_id";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    clientName: import("drizzle-orm/pg-core").PgColumn<{
+      name: "client_name";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    clientHost: import("drizzle-orm/pg-core").PgColumn<{
+      name: "client_host";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    registration: import("drizzle-orm/pg-core").PgColumn<{
+      name: "registration";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    scopes: import("drizzle-orm/pg-core").PgColumn<{
+      name: "scopes";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    redirectUri: import("drizzle-orm/pg-core").PgColumn<{
+      name: "redirect_uri";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    codeHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_hash";
+      tableName: "mcp_connections";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    codeChallenge: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_challenge";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    codeExpiresAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "code_expires_at";
+      tableName: "mcp_connections";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    refreshHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "refresh_hash";
+      tableName: "mcp_connections";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    refreshPreviousHash: import("drizzle-orm/pg-core").PgColumn<{
+      name: "refresh_previous_hash";
+      tableName: "mcp_connections";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "expires_at";
+      tableName: "mcp_connections";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "mcp_connections";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "last_used_at";
+      tableName: "mcp_connections";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    lastUsedIp: import("drizzle-orm/pg-core").PgColumn<{
+      name: "last_used_ip";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "revoked_at";
+      tableName: "mcp_connections";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    revokedBy: import("drizzle-orm/pg-core").PgColumn<{
+      name: "revoked_by";
+      tableName: "mcp_connections";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
+/**
+ * A change an MCP client asked for, waiting for its person on coffre's own
+ * page (docs/design/mcp.md, section 7). It holds the tool and its arguments,
+ * never a value: the page shows what they would do and, on Approve, does it,
+ * once, as the person, through the connection. Its digest is of the tool
+ * and arguments, which the page sends back with the decision, so what runs
+ * is what the person read. Not MACed: a row changes nothing by itself.
+ */
+declare const mcpApprovals: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "mcp_approvals";
+  schema: undefined;
+  columns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+      name: "id";
+      tableName: "mcp_approvals";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: true;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    connectionId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "connection_id";
+      tableName: "mcp_approvals";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    tool: import("drizzle-orm/pg-core").PgColumn<{
+      name: "tool";
+      tableName: "mcp_approvals";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    arguments: import("drizzle-orm/pg-core").PgColumn<{
+      name: "arguments";
+      tableName: "mcp_approvals";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    digest: import("drizzle-orm/pg-core").PgColumn<{
+      name: "digest";
+      tableName: "mcp_approvals";
+      dataType: "custom";
+      columnType: "PgCustomColumn";
+      data: Buffer<ArrayBufferLike>;
+      driverParam: unknown;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+    }>;
+    status: import("drizzle-orm/pg-core").PgColumn<{
+      name: "status";
+      tableName: "mcp_approvals";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    outcome: import("drizzle-orm/pg-core").PgColumn<{
+      name: "outcome";
+      tableName: "mcp_approvals";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "created_at";
+      tableName: "mcp_approvals";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "expires_at";
+      tableName: "mcp_approvals";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    decidedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "decided_at";
+      tableName: "mcp_approvals";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    reportedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "reported_at";
+      tableName: "mcp_approvals";
+      dataType: "date";
+      columnType: "PgTimestamp";
+      data: Date;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 /**
  * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
  * service tokens.
@@ -2443,4 +3513,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { deviceAuthorizations as a, identities as c, secretVersions as d, secrets as f, vaultMembers as g, vaultGrants as h, credentials as i, projects as l, serviceBindings as m, auditLog as n, environments as o, secretsRelations as p, consumedTokens as r, environmentsRelations as s, auditChainHead as t, schema_d_exports as u };
+export { secrets as _, deviceAuthorizations as a, vaultGrants as b, environmentsRelations as c, mcpConnections as d, oauthClients as f, secretVersions as g, secretReferences as h, credentials as i, identities as l, schema_d_exports as m, auditLog as n, dismissedKeys as o, projects as p, consumedTokens as r, environments as s, auditChainHead as t, mcpApprovals as u, secretsRelations as v, vaultMembers as x, serviceBindings as y };