@coffre/db 0.3.0 → 0.4.1

package/dist/schema.js

@@ -2,7 +2,7 @@ import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
 import { sql } from "drizzle-orm";
 import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
-import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 //#region src/schema.ts
 var schema_exports = /* @__PURE__ */ __exportAll({
 	auditChainHead: () => auditChainHead,
@@ -10,10 +10,15 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	consumedTokens: () => consumedTokens,
 	credentials: () => credentials,
 	deviceAuthorizations: () => deviceAuthorizations,
+	dismissedKeys: () => dismissedKeys,
 	environments: () => environments,
 	environmentsRelations: () => environmentsRelations,
 	identities: () => identities,
+	mcpApprovals: () => mcpApprovals,
+	mcpConnections: () => mcpConnections,
+	oauthClients: () => oauthClients,
 	projects: () => projects,
+	secretReferences: () => secretReferences,
 	secretVersions: () => secretVersions,
 	secrets: () => secrets,
 	secretsRelations: () => secretsRelations,
@@ -23,13 +28,31 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 });
 const bytea = customType({ dataType: () => "bytea" });
 const createdAt = () => timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
+/**
+* A project's or environment's slug: `market`, or once deleted, its
+* tombstone's, `market~deleted-2026-10-05`. No live slug holds a `~`, so a
+* tombstone frees its slug and is never mistaken for what takes it next.
+*/
+const PLACE_SLUG = sql.raw(`'^[a-z0-9][a-z0-9-]{0,62}(~[a-z0-9-]{1,40})?$'`);
+/**
+* The folder a project or a secret is listed in: a folder lists rows
+* together and does nothing else; it grants, hides and renames nothing. A
+* name, not a row of its own: 1 to 64 characters, no `/`, no control
+* character, no space at either end. Null is no folder.
+*/
+const folderCheck = (name, column) => check(name, sql`${column} IS NULL OR (char_length(${column}) BETWEEN 1 AND 64 AND ${column} !~ '[/[:cntrl:]]' AND ${column} = btrim(${column}))`);
 const projects = pgTable("projects", {
 	id: uuid().primaryKey().defaultRandom(),
 	slug: text().notNull(),
 	name: text().notNull(),
 	createdAt: createdAt(),
-	archivedAt: timestamp("archived_at", { withTimezone: true })
-}, (table) => [unique("projects_slug_key").on(table.slug), check("projects_slug_check", sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`)]);
+	archivedAt: timestamp("archived_at", { withTimezone: true }),
+	folder: text()
+}, (table) => [
+	unique("projects_slug_key").on(table.slug),
+	check("projects_slug_check", sql`${table.slug} ~ ${PLACE_SLUG}`),
+	folderCheck("projects_folder_check", table.folder)
+]);
 const environments = pgTable("environments", {
 	id: uuid().primaryKey().defaultRandom(),
 	projectId: uuid("project_id").notNull(),
@@ -40,7 +63,7 @@ const environments = pgTable("environments", {
 }, (table) => [
 	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
 	unique("environments_project_scoped").on(table.id, table.projectId),
-	check("environments_slug_check", sql`${table.slug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
+	check("environments_slug_check", sql`${table.slug} ~ ${PLACE_SLUG}`),
 	foreignKey({
 		name: "environments_project_id_fkey",
 		columns: [table.projectId],
@@ -56,10 +79,12 @@ const secrets = pgTable("secrets", {
 	updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
 	currentVersionId: uuid("current_version_id").references(() => secretVersions.id, { onDelete: "no action" }),
 	currentVersion: integer("current_version").notNull().default(0),
-	archivedAt: timestamp("archived_at", { withTimezone: true })
+	archivedAt: timestamp("archived_at", { withTimezone: true }),
+	folder: text()
 }, (table) => [
 	unique("secrets_project_id_environment_id_key_key").on(table.projectId, table.environmentId, table.key),
 	check("secrets_key_check", sql`${table.key} ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$'`),
+	folderCheck("secrets_folder_check", table.folder),
 	foreignKey({
 		name: "secrets_project_id_fkey",
 		columns: [table.projectId],
@@ -103,6 +128,32 @@ const secretVersions = pgTable("secret_versions", {
 	}).onDelete("restrict"),
 	index("secret_versions_secret_idx").on(table.secretId, table.version.desc())
 ]);
+/**
+* Keys an environment is missing, which its team decided it does not need:
+* the project's other environments have them, and its missing-keys list
+* leaves them out until someone restores them (docs/design/environments.md).
+* One row per environment and key, updated in place: restoring sets
+* `restored_at`, dismissing again clears it.
+*/
+const dismissedKeys = pgTable("dismissed_keys", {
+	environmentId: uuid("environment_id").notNull(),
+	key: text().notNull(),
+	dismissedAt: timestamp("dismissed_at", { withTimezone: true }).notNull().defaultNow(),
+	dismissedBy: text("dismissed_by").notNull(),
+	restoredAt: timestamp("restored_at", { withTimezone: true }),
+	restoredBy: text("restored_by")
+}, (table) => [
+	primaryKey({
+		name: "dismissed_keys_pkey",
+		columns: [table.environmentId, table.key]
+	}),
+	check("dismissed_keys_key_check", sql`${table.key} ~ '^[A-Za-z_][A-Za-z0-9_]{0,127}$'`),
+	foreignKey({
+		name: "dismissed_keys_environment_id_fkey",
+		columns: [table.environmentId],
+		foreignColumns: [environments.id]
+	}).onDelete("restrict")
+]);
 /** The role catalogue, as SQL: every role, and those an environment may be granted. */
 const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
 const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
@@ -110,7 +161,7 @@ const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map
 * The vault's member directory: everyone it has admitted, written by the
 * vault alone, read by both. A principal with no row is no member.
 * Principals are the strings coffre uses at its edges: `user:<email>`,
-* `token:<id>`, `sync:<id>`. Times are milliseconds since the epoch, each
+* `token:<id>`. Times are milliseconds since the epoch, each
 * the time of the vault's log entry that set it, so the log replays to
 * these rows exactly.
 */
@@ -127,31 +178,37 @@ const vaultMembers = pgTable("vault_members", {
 	mac: bytea().notNull()
 }, (table) => [
 	check("vault_members_mac_check", sql`octet_length(${table.mac}) = 32`),
-	check("vault_members_principal_check", sql`${table.principal} ~ '^(user|token|sync):[^[:space:]:][^[:space:]]*$'`),
+	check("vault_members_principal_check", sql`${table.principal} ~ '^(user|token):[^[:space:]:][^[:space:]]*$'`),
 	check("vault_members_user_lowercase", sql`${table.principal} NOT LIKE 'user:%' OR ${table.principal} = lower(${table.principal})`),
 	check("vault_members_status_check", sql`${table.status} IN ('active', 'removed')`),
 	check("vault_members_owner_check", sql`NOT ${table.owner} OR (${table.status} = 'active' AND ${table.principal} LIKE 'user:%')`),
 	check("vault_members_generation_check", sql`${table.generation} >= 0`)
 ]);
 /**
-* One role per member per place: a project, or one of its environments,
-* never both. A revoked grant is deleted; an expired one stays until its
-* place is granted again, so the members page can say it lapsed.
+* One role per member per place: a project, one of its environments, every
+* project (`*`, neither id), or the environment of one slug in every project
+* (neither id, and `environment_slug`). A revoked grant is deleted; an
+* expired one stays until its place is granted again, so the members page
+* can say it lapsed.
 */
 const vaultGrants = pgTable("vault_grants", {
 	principal: text().notNull(),
 	projectId: uuid("project_id"),
 	environmentId: uuid("environment_id"),
+	environmentSlug: text("environment_slug"),
 	role: text().notNull(),
 	expiresAt: bigint("expires_at", { mode: "number" }),
 	grantedAt: bigint("granted_at", { mode: "number" }).notNull(),
 	grantedBy: text("granted_by").notNull()
 }, (table) => [
-	check("vault_grants_one_place", sql`(${table.projectId} IS NULL) <> (${table.environmentId} IS NULL)`),
+	check("vault_grants_one_place", sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`),
+	check("vault_grants_environment_slug_check", sql`${table.environmentSlug} IS NULL OR ${table.environmentSlug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
 	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
-	check("vault_grants_environment_role_check", sql`${table.environmentId} IS NULL OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	check("vault_grants_environment_role_check", sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
 	unique("vault_grants_on_project").on(table.principal, table.projectId),
 	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
+	unique("vault_grants_on_environment_slug").on(table.principal, table.environmentSlug),
+	uniqueIndex("vault_grants_on_every_project").on(table.principal).where(sql`${table.projectId} IS NULL AND ${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL`),
 	foreignKey({
 		name: "vault_grants_principal_fkey",
 		columns: [table.principal],
@@ -192,7 +249,7 @@ const auditLog = pgTable("audit_log", {
 	hash: bytea().notNull()
 }, (table) => [
 	check("audit_log_author_check", sql`${table.author} IN ('app', 'vault')`),
-	check("audit_log_actor_check", sql`${table.actor} ~ '^(user|token|sync|system):.+$'`),
+	check("audit_log_actor_check", sql`${table.actor} ~ '^(user|token|system):.+$'`),
 	check("audit_log_decision_check", sql`${table.decision} IN ('allow', 'deny')`),
 	check("audit_log_metadata_check", sql`${table.metadata}::jsonb IS NOT NULL`),
 	check("audit_log_prev_hash_check", sql`octet_length(${table.prevHash}) = 32`),
@@ -232,7 +289,53 @@ const auditLog = pgTable("audit_log", {
 	index("audit_log_releases_idx").on(table.author, table.actor, table.action, table.decision, table.occurredAt),
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`((${table.metadata})::jsonb ->> 'bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
-	index("audit_log_exchange_idx").on(sql`((${table.metadata})::jsonb ->> 'credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`)
+	index("audit_log_exchange_idx").on(sql`((${table.metadata})::jsonb ->> 'credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
+	index("audit_log_also_project_idx").on(sql`(((${table.metadata})::jsonb -> 'also') ->> 'projectId')`, table.seq).where(sql`((${table.metadata})::jsonb -> 'also') IS NOT NULL`),
+	index("audit_log_also_environment_idx").on(sql`(((${table.metadata})::jsonb -> 'also') ->> 'environmentId')`, table.seq).where(sql`((${table.metadata})::jsonb -> 'also') IS NOT NULL`),
+	index("audit_log_also_secret_idx").on(sql`(((${table.metadata})::jsonb -> 'also') ->> 'secretId')`, table.seq).where(sql`((${table.metadata})::jsonb -> 'also') IS NOT NULL`)
+]);
+/**
+* A reference: a secret whose value is another's, read live through it by
+* whoever reads the holder's environment (docs/design/environments.md).
+* The row only points: the reference is the vault's `reference.create`
+* entry at `created_seq`, which the vault checks at every read, and a
+* `reference.end` naming that entry ends it, whatever this table says. So
+* rows are only ever added.
+*/
+const secretReferences = pgTable("secret_references", {
+	id: uuid().primaryKey(),
+	projectId: uuid("project_id").notNull(),
+	environmentId: uuid("environment_id").notNull(),
+	secretId: uuid("secret_id").notNull(),
+	sourceProjectId: uuid("source_project_id").notNull(),
+	sourceEnvironmentId: uuid("source_environment_id").notNull(),
+	sourceSecretId: uuid("source_secret_id").notNull(),
+	createdSeq: bigint("created_seq", { mode: "bigint" }).notNull(),
+	createdAt: createdAt(),
+	createdBy: text("created_by").notNull()
+}, (table) => [
+	unique("secret_references_created_seq_key").on(table.createdSeq),
+	foreignKey({
+		name: "secret_references_secret_id_fkey",
+		columns: [table.secretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secret_references_source_secret_id_fkey",
+		columns: [table.sourceSecretId],
+		foreignColumns: [secrets.id]
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "secret_references_created_seq_fkey",
+		columns: [table.createdSeq],
+		foreignColumns: [auditLog.seq]
+	}).onDelete("restrict"),
+	index("secret_references_holder_idx").on(table.secretId, table.createdSeq),
+	index("secret_references_source_idx").on(table.sourceSecretId),
+	index("secret_references_project_idx").on(table.projectId),
+	index("secret_references_source_project_idx").on(table.sourceProjectId),
+	index("secret_references_created_by_idx").on(table.createdBy)
 ]);
 const auditChainHead = pgTable("audit_chain_head", {
 	onlyRow: boolean("only_row").primaryKey().default(true),
@@ -324,6 +427,96 @@ const consumedTokens = pgTable("consumed_tokens", {
 	consumedAt: timestamp("consumed_at", { withTimezone: true }).notNull().defaultNow()
 }, (table) => [check("consumed_tokens_hash_check", sql`octet_length(${table.hash}) = 32`)]);
 /**
+* MCP clients that registered themselves (RFC 7591), the fallback to Client
+* ID Metadata Documents, which need no row. The ID is the client's
+* `client_id`. Its redirects are under its MAC: a database writer cannot add
+* one of their own to a client people have approved.
+*/
+const oauthClients = pgTable("oauth_clients", {
+	id: uuid().primaryKey(),
+	authMac: bytea("auth_mac").notNull(),
+	name: text().notNull(),
+	redirectUris: text("redirect_uris").notNull(),
+	createdAt: createdAt(),
+	createdIp: text("created_ip"),
+	revokedAt: timestamp("revoked_at", { withTimezone: true })
+}, (table) => [check("oauth_clients_auth_mac_check", sql`octet_length(${table.authMac}) = 32`), check("oauth_clients_redirect_uris_check", sql`${table.redirectUris}::jsonb IS NOT NULL`)]);
+/**
+* One MCP client a person connected: one approved authorization, its
+* scopes, its code until the client redeems it, and the refresh token it
+* holds since. Access tokens have no row: each names its connection under a
+* MAC, and every request checks this row. Revoking it ends them all.
+*/
+const mcpConnections = pgTable("mcp_connections", {
+	id: uuid().primaryKey(),
+	authMac: bytea("auth_mac").notNull(),
+	principal: text().notNull(),
+	generation: integer().notNull(),
+	clientId: text("client_id").notNull(),
+	clientName: text("client_name").notNull(),
+	clientHost: text("client_host"),
+	registration: text().notNull(),
+	scopes: text().notNull(),
+	redirectUri: text("redirect_uri").notNull(),
+	codeHash: bytea("code_hash"),
+	codeChallenge: text("code_challenge"),
+	codeExpiresAt: timestamp("code_expires_at", { withTimezone: true }),
+	refreshHash: bytea("refresh_hash"),
+	refreshPreviousHash: bytea("refresh_previous_hash"),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	createdAt: createdAt(),
+	lastUsedAt: timestamp("last_used_at", { withTimezone: true }),
+	lastUsedIp: text("last_used_ip"),
+	revokedAt: timestamp("revoked_at", { withTimezone: true }),
+	revokedBy: text("revoked_by")
+}, (table) => [
+	check("mcp_connections_principal_check", sql`${table.principal} LIKE 'user:%'`),
+	check("mcp_connections_registration_check", sql`${table.registration} IN ('cimd', 'dcr')`),
+	check("mcp_connections_auth_mac_check", sql`octet_length(${table.authMac}) = 32`),
+	check("mcp_connections_code_hash_check", sql`${table.codeHash} IS NULL OR octet_length(${table.codeHash}) = 32`),
+	check("mcp_connections_refresh_hash_check", sql`${table.refreshHash} IS NULL OR octet_length(${table.refreshHash}) = 32`),
+	foreignKey({
+		name: "mcp_connections_principal_fkey",
+		columns: [table.principal],
+		foreignColumns: [vaultMembers.principal]
+	}).onDelete("restrict"),
+	unique("mcp_connections_code_hash_key").on(table.codeHash),
+	unique("mcp_connections_refresh_hash_key").on(table.refreshHash),
+	index("mcp_connections_refresh_previous_idx").on(table.refreshPreviousHash),
+	index("mcp_connections_live_idx").on(table.principal, table.expiresAt).where(sql`${table.revokedAt} IS NULL`)
+]);
+/**
+* A change an MCP client asked for, waiting for its person on coffre's own
+* page (docs/design/mcp.md, section 7). It holds the tool and its arguments,
+* never a value: the page shows what they would do and, on Approve, does it,
+* once, as the person, through the connection. Its digest is of the tool
+* and arguments, which the page sends back with the decision, so what runs
+* is what the person read. Not MACed: a row changes nothing by itself.
+*/
+const mcpApprovals = pgTable("mcp_approvals", {
+	id: uuid().primaryKey(),
+	connectionId: uuid("connection_id").notNull(),
+	tool: text().notNull(),
+	arguments: text().notNull(),
+	digest: bytea().notNull(),
+	status: text().notNull().default("pending"),
+	outcome: text(),
+	createdAt: createdAt(),
+	expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+	decidedAt: timestamp("decided_at", { withTimezone: true }),
+	reportedAt: timestamp("reported_at", { withTimezone: true })
+}, (table) => [
+	check("mcp_approvals_status_check", sql`${table.status} IN ('pending', 'approved', 'denied', 'cancelled', 'failed')`),
+	check("mcp_approvals_digest_check", sql`octet_length(${table.digest}) = 32`),
+	check("mcp_approvals_arguments_check", sql`${table.arguments}::jsonb IS NOT NULL`),
+	foreignKey({
+		name: "mcp_approvals_connection_fkey",
+		columns: [table.connectionId],
+		foreignColumns: [mcpConnections.id]
+	}).onDelete("restrict"),
+	index("mcp_approvals_open_idx").on(table.connectionId, table.digest).where(sql`${table.reportedAt} IS NULL`)
+]);
+/**
 * Bearer credentials coffre issues itself: browser sessions, CLI sessions and
 * service tokens.
 *
@@ -421,4 +614,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, environments, environmentsRelations, identities, projects, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -67,6 +67,11 @@
       "types": "./dist/log.d.ts",
       "default": "./dist/log.js"
     },
+    "./grants": {
+      "coffre:source": "./src/grants.ts",
+      "types": "./dist/grants.d.ts",
+      "default": "./dist/grants.js"
+    },
     "./package.json": "./package.json"
   },
   "dependencies": {
@@ -74,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.3.0"
+    "@coffre/core": "0.4.1"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/baseline/postgres.sql

@@ -26,13 +26,35 @@ CREATE TRIGGER audit_log_no_truncate BEFORE TRUNCATE ON audit_log
     FOR EACH STATEMENT EXECUTE FUNCTION audit_log_append_only();
 --> statement-breakpoint
 
+-- A secret version is never rewritten in place, only erased: a deleted
+-- project or environment stays as a tombstone the log's entries name, and
+-- its versions with it, their ciphertext and wrapped data key emptied. That
+-- is the one change a version takes, for every login.
+CREATE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;
+--> statement-breakpoint
+CREATE TRIGGER secret_versions_erase_only BEFORE UPDATE ON secret_versions
+    FOR EACH ROW EXECUTE FUNCTION secret_versions_erase_only();
+--> statement-breakpoint
+
 -- Two logins, provisioned outside coffre (their passwords are never ours),
 -- each with only the rights of its group:
 --
 --   coffre_runtime        the server, through coffre_app: read and insert,
 --                         UPDATE on named columns only, and never DELETE. A
---                         revoked session, a used device code and a removed
---                         sync key are rows that say so, not gaps.
+--                         revoked session, a used device code and a spent
+--                         token are rows that say so, not gaps.
 --   coffre_vault_runtime  the vault, through coffre_vault: its members and
 --                         grants, and reading what it decides on.
 --
@@ -114,6 +136,10 @@ GRANT USAGE ON SCHEMA drizzle TO coffre_app, coffre_vault;
 GRANT SELECT ON drizzle.__drizzle_migrations TO coffre_app, coffre_vault;
 --> statement-breakpoint
 
+-- The app reads and adds; it never deletes. A binding, a registered client
+-- and a connection change only in what their MAC allows to change in place;
+-- a spent token and a reference never change at all, and the vault's log
+-- says which references have ended.
 GRANT SELECT, INSERT ON
     projects,
     environments,
@@ -123,8 +149,12 @@ GRANT SELECT, INSERT ON
     identities,
     credentials,
     device_authorizations,
-    syncs,
-    sync_keys
+    service_bindings,
+    consumed_tokens,
+    secret_references,
+    dismissed_keys,
+    oauth_clients,
+    mcp_connections
 TO coffre_app;
 --> statement-breakpoint
 
@@ -135,11 +165,11 @@ GRANT SELECT ON
 TO coffre_app;
 --> statement-breakpoint
 
-GRANT UPDATE (slug, name, archived_at) ON projects TO coffre_app;
+GRANT UPDATE (slug, name, archived_at, folder) ON projects TO coffre_app;
 --> statement-breakpoint
 GRANT UPDATE (slug, name, archived_at) ON environments TO coffre_app;
 --> statement-breakpoint
-GRANT UPDATE (key, current_version_id, current_version, updated_at, archived_at) ON secrets TO coffre_app;
+GRANT UPDATE (key, current_version_id, current_version, updated_at, archived_at, folder) ON secrets TO coffre_app;
 --> statement-breakpoint
 GRANT UPDATE (next_seq, head_hash) ON audit_chain_head TO coffre_app;
 --> statement-breakpoint
@@ -150,11 +180,14 @@ GRANT UPDATE (last_used_at, last_used_ip, revoked_at, revoked_by, auth_mac) ON c
 GRANT UPDATE (decided_at, decision, generation, principal, consumed_at, auth_mac)
     ON device_authorizations TO coffre_app;
 --> statement-breakpoint
-GRANT UPDATE (config, credential_secret_id, paused_at, archived_at, lease_until,
-              last_run_at, last_status, last_error)
-    ON syncs TO coffre_app;
+GRANT UPDATE (label, last_used_at, revoked_at, revoked_by, auth_mac) ON service_bindings TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (dismissed_at, dismissed_by, restored_at, restored_by) ON dismissed_keys TO coffre_app;
 --> statement-breakpoint
-GRANT UPDATE (secret_version_id, pushed_at, removed_at) ON sync_keys TO coffre_app;
+GRANT UPDATE (revoked_at, auth_mac) ON oauth_clients TO coffre_app;
+--> statement-breakpoint
+GRANT UPDATE (code_challenge, code_expires_at, refresh_hash, refresh_previous_hash, last_used_at, last_used_ip, revoked_at, revoked_by, auth_mac)
+    ON mcp_connections TO coffre_app;
 --> statement-breakpoint
 
 -- The vault reads what it decides on and the log it chains to, and writes
@@ -183,6 +216,9 @@ REVOKE TRUNCATE ON ALL TABLES IN SCHEMA public FROM coffre_vault;
 --> statement-breakpoint
 REVOKE UPDATE ON audit_log, secret_versions FROM coffre_app, coffre_vault;
 --> statement-breakpoint
+-- What erasing a version empties, and nothing else: the trigger above holds every login to it.
+GRANT UPDATE (ciphertext, wrapped_dek) ON secret_versions TO coffre_app;
+--> statement-breakpoint
 REVOKE CREATE ON SCHEMA public FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime;
 --> statement-breakpoint
 

package/src/baseline/sqlite.sql

@@ -25,3 +25,18 @@ CREATE TRIGGER `audit_log_no_delete` BEFORE DELETE ON `audit_log`
 BEGIN
     SELECT RAISE(ABORT, 'audit_log is append-only');
 END;
+--> statement-breakpoint
+
+-- A secret version is never rewritten in place, only erased: a deleted
+-- project or environment stays as a tombstone the log's entries name, and
+-- its versions with it, their ciphertext and wrapped data key emptied. That
+-- is the one change a version takes.
+CREATE TRIGGER `secret_versions_erase_only` BEFORE UPDATE ON `secret_versions`
+WHEN length(NEW.`ciphertext`) <> 0 OR length(NEW.`wrapped_dek`) <> 0
+    OR NEW.`id` IS NOT OLD.`id` OR NEW.`secret_id` IS NOT OLD.`secret_id` OR NEW.`version` IS NOT OLD.`version`
+    OR NEW.`envelope_version` IS NOT OLD.`envelope_version` OR NEW.`iv` IS NOT OLD.`iv` OR NEW.`auth_tag` IS NOT OLD.`auth_tag`
+    OR NEW.`kek_provider` IS NOT OLD.`kek_provider` OR NEW.`kek_id` IS NOT OLD.`kek_id` OR NEW.`kek_version` IS NOT OLD.`kek_version`
+    OR NEW.`created_at` IS NOT OLD.`created_at` OR NEW.`created_by` IS NOT OLD.`created_by`
+BEGIN
+    SELECT RAISE(ABORT, 'a secret version is only ever erased');
+END;

package/src/baseline.ts

@@ -20,8 +20,11 @@ import * as sqlite from './schema.sqlite.ts';
  *
  * A baseline is baseline/<engine>.sql with its `-- @schema` line replaced by
  * the tables drizzle-kit generates from that engine's schema. The template
- * holds what a schema cannot say: the audit chain's first rows, and the
- * Postgres runtime role and its grants.
+ * holds what a schema cannot say: the audit chain's first rows, the audit
+ * log's append-only and the secret versions' erase-only triggers, and the
+ * Postgres runtime roles and their grants. Since 0.4.0, every database starts
+ * from this one baseline; an expression index's SQL is written by hand in it,
+ * as drizzle-kit splits one at its comma on SQLite.
  *
  * `pnpm db:generate` runs this file and appends pending schema changes.
  */
@@ -79,7 +82,8 @@ function generate(engine: Engine): void {
   execFileSync(
     `${packageRoot}node_modules/.bin/drizzle-kit`,
     ['generate', '--config', `drizzle.${engine}.config.ts`, '--name', process.argv[2] ?? 'schema'],
-    { cwd: here, stdio: 'inherit' },
+    // drizzle-kit loads the schema, which imports the workspace's other packages by their sources.
+    { cwd: here, stdio: 'inherit', env: { ...process.env, NODE_OPTIONS: `${process.env.NODE_OPTIONS ?? ''} --conditions=coffre:source`.trim() } },
   );
 }
 

package/src/dialect.ts

@@ -1,4 +1,5 @@
-import { entityKind, getTableColumns, sql, type SQL } from 'drizzle-orm';
+import { TOMBSTONE } from '@coffre/core/schemas';
+import { entityKind, getTableColumns, sql, type SQL, type SQLWrapper } from 'drizzle-orm';
 import type { PgTable } from 'drizzle-orm/pg-core';
 
 import type { Queryable } from './database.ts';
@@ -74,6 +75,11 @@ export async function upsert<T extends Table>(
   });
 }
 
+/** A tombstone's slug, `@coffre/core/schemas`'s `isTombstone` in SQL. No LIKE wildcard is a `~`. */
+export function tombstone(slug: SQLWrapper): SQL {
+  return sql`${slug} LIKE ${`%${TOMBSTONE}%`}`;
+}
+
 /** A condition read as a boolean: Postgres returns true or false, SQLite 1 or 0. */
 export function truth(condition: SQL): SQL<boolean> {
   return condition.mapWith((value) => Number(value) === 1);
@@ -97,6 +103,24 @@ export function isUniqueViolation(error: unknown): boolean {
   return false;
 }
 
+/** The network's codes for a server that is not there, and Postgres's for one that will not take the connection. */
+const UNREACHABLE = new Set(['ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT', 'ENOTFOUND', 'EAI_AGAIN', 'EHOSTUNREACH', 'ENETUNREACH', 'EPIPE', '57P01', '57P02', '57P03']);
+
+/**
+ * Whether a query failed because the database could not be reached or
+ * dropped the connection: an outage, not an answer. Postgres's connection
+ * exceptions are class 08; pg and Workers' sockets say so in words.
+ */
+export function isUnreachable(error: unknown): boolean {
+  for (let cause = error; typeof cause === 'object' && cause !== null; ) {
+    const { code, message } = cause as { code?: unknown; message?: unknown };
+    if (typeof code === 'string' && (UNREACHABLE.has(code) || /^08[0-9A-Z]{3}$/.test(code))) return true;
+    if (typeof message === 'string' && /connection terminated|network connection lost|connect(ion)? timeout/i.test(message)) return true;
+    cause = (cause as { cause?: unknown }).cause;
+  }
+  return false;
+}
+
 /**
  * A consistent read of several statements that cannot write, such as
  * verifying the chain. SQLite ignores it: its transactions already see one

package/src/grants.ts

@@ -0,0 +1,51 @@
+import { and, eq, gt, isNull, or } from 'drizzle-orm';
+
+import { tablesOf, type Queryable } from './database.ts';
+
+/**
+ * One grant, as `vault_grants` holds it: on a project (`environmentId`
+ * null), one of its environments (`projectId` is the environment's
+ * project), every project (both ids null), or one environment slug in every
+ * project (`environmentSlug`). Only the vault writes grants; the app reads
+ * them for its lists.
+ */
+export type GrantRow = {
+  principal: string;
+  projectId: string | null;
+  environmentId: string | null;
+  environmentSlug: string | null;
+  role: string;
+  /** Milliseconds since the epoch, or null for no end. */
+  expiresAt: number | null;
+  grantedAt: number;
+  grantedBy: string;
+};
+
+/**
+ * Grants, lapsed ones too unless `liveAt` says when to judge them: one
+ * member's, or everyone's; `everyProject`, only those on every project.
+ */
+export async function readGrants(
+  db: Queryable,
+  filter: { principal?: string; liveAt?: number; everyProject?: boolean } = {},
+): Promise<GrantRow[]> {
+  const { vaultGrants, environments } = tablesOf(db);
+  const rows = await db
+    .select({ grant: vaultGrants, environmentProjectId: environments.projectId })
+    .from(vaultGrants)
+    .leftJoin(environments, eq(environments.id, vaultGrants.environmentId))
+    .where(
+      and(
+        filter.principal === undefined ? undefined : eq(vaultGrants.principal, filter.principal),
+        filter.liveAt === undefined ? undefined : or(isNull(vaultGrants.expiresAt), gt(vaultGrants.expiresAt, filter.liveAt)),
+        filter.everyProject === true ? and(isNull(vaultGrants.projectId), isNull(vaultGrants.environmentId)) : undefined,
+      ),
+    );
+  return rows.map(({ grant, environmentProjectId }) => ({ ...grant, projectId: grant.projectId ?? environmentProjectId }));
+}
+
+/** Add a grant; an environment's row names only the environment. */
+export async function insertGrant(db: Queryable, grant: GrantRow): Promise<void> {
+  const { vaultGrants } = tablesOf(db);
+  await db.insert(vaultGrants).values({ ...grant, projectId: grant.environmentId === null ? grant.projectId : null });
+}

package/src/migrate.ts

@@ -122,6 +122,9 @@ export class DatabaseAhead extends Error {
   }
 }
 
+/** The release whose baseline every database since was made from. */
+const CLEAN_BREAK = '0.4.0';
+
 function verifyHistory(
   expected: ExpectedMigration[],
   applied: AppliedMigration[] | null,
@@ -131,6 +134,8 @@ function verifyHistory(
   rows.slice(0, expected.length).forEach((row, index) => {
     const local = expected[index]!;
     if (row.created_at !== local.createdAt || row.hash !== local.hash) {
+      // 0.4.0 began again from one baseline: a database from before it is not upgraded, but made afresh.
+      if (index === 0) throw new Error(`the database was made by a coffre before ${CLEAN_BREAK}, which is a clean break: deploy afresh, on a new database (docs/deploy.md)`);
       throw new Error(
         `migration history diverged at ${local.tag}; applied migrations must never be edited`,
       );