@coffre/db 0.6.2 → 0.7.0

package/dist/migrations/sqlite/meta/_journal.json

@@ -29,6 +29,41 @@
       "when": 1791676487593,
       "tag": "0003_credential_scopes",
       "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1792244020959,
+      "tag": "0004_environment_parents",
+      "breakpoints": true
+    },
+    {
+      "idx": 5,
+      "version": "6",
+      "when": 1792250910230,
+      "tag": "0005_personal_tokens",
+      "breakpoints": true
+    },
+    {
+      "idx": 6,
+      "version": "6",
+      "when": 1792252693912,
+      "tag": "0006_uploaded_keys",
+      "breakpoints": true
+    },
+    {
+      "idx": 7,
+      "version": "6",
+      "when": 1792253795070,
+      "tag": "0007_personal_configs",
+      "breakpoints": true
+    },
+    {
+      "idx": 8,
+      "version": "6",
+      "when": 1792255560312,
+      "tag": "0008_recipes",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-a7PkFgea.js";
-import { t as Database } from "./database-C63WjCrC.js";
+import { m as schema_d_exports } from "./schema-BZRkBJQZ.js";
+import { t as Database } from "./database-BEnexh-3.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-a7PkFgea.d.ts → schema-BZRkBJQZ.d.ts}

@@ -216,6 +216,40 @@ declare const environments: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    parentId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "parent_id";
+      tableName: "environments";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    owner: import("drizzle-orm/pg-core").PgColumn<{
+      name: "owner";
+      tableName: "environments";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -629,6 +663,57 @@ declare const secretVersions: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    recipe: import("drizzle-orm/pg-core").PgColumn<{
+      name: "recipe";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    pairId: import("drizzle-orm/pg-core").PgColumn<{
+      name: "pair_id";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "PgUUID";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    pairHalf: import("drizzle-orm/pg-core").PgColumn<{
+      name: "pair_half";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -2123,6 +2208,23 @@ declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    jwks: import("drizzle-orm/pg-core").PgColumn<{
+      name: "jwks";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     claims: import("drizzle-orm/pg-core").PgColumn<{
       name: "claims";
       tableName: "service_bindings";

package/dist/schema-sqlite.d.ts

@@ -232,6 +232,44 @@ export declare const environments: import("drizzle-orm/sqlite-core").SQLiteTable
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    parentId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "parent_id";
+      tableName: "environments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    owner: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "owner";
+      tableName: "environments";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
   };
   dialect: "sqlite";
 }>;
@@ -661,6 +699,63 @@ export declare const secretVersions: import("drizzle-orm/sqlite-core").SQLiteTab
     }, {}, {
       length: number | undefined;
     }>;
+    recipe: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "recipe";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    pairId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "pair_id";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
+    pairHalf: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "pair_half";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: number | undefined;
+    }>;
   };
   dialect: "sqlite";
 }>;
@@ -2212,6 +2307,25 @@ export declare const serviceBindings: import("drizzle-orm/sqlite-core").SQLiteTa
     }, {}, {
       length: number | undefined;
     }>;
+    jwks: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "jwks";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     claims: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "claims";
       tableName: "service_bindings";

package/dist/schema-sqlite.js

@@ -54,16 +54,27 @@ const environments = sqliteTable("environments", {
 	slug: text().notNull(),
 	name: text().notNull(),
 	createdAt: createdAt(),
-	archivedAt: time("archived_at")
+	archivedAt: time("archived_at"),
+	parentId: text("parent_id"),
+	owner: text()
 }, (table) => [
 	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
 	unique("environments_project_scoped").on(table.id, table.projectId),
 	check("environments_slug_check", isPlaceSlug(table.slug)),
+	check("environments_parent_check", sql`${table.parentId} IS NULL OR ${table.parentId} <> ${table.id}`),
+	check("environments_owner_check", sql`${table.owner} IS NULL OR (${table.parentId} IS NOT NULL AND ${table.owner} LIKE 'user:_%')`),
+	uniqueIndex("environments_parent_id_owner_key").on(table.parentId, table.owner).where(sql`instr(${table.slug}, '~') = 0`),
 	foreignKey({
 		name: "environments_project_id_fkey",
 		columns: [table.projectId],
 		foreignColumns: [projects.id]
-	}).onDelete("restrict")
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "environments_parent_in_project",
+		columns: [table.parentId, table.projectId],
+		foreignColumns: [table.id, table.projectId]
+	}).onDelete("no action"),
+	index("environments_parent_idx").on(table.parentId)
 ]);
 const secrets = sqliteTable("secrets", {
 	id: text().primaryKey(),
@@ -110,7 +121,10 @@ const secretVersions = sqliteTable("secret_versions", {
 	kekId: text("kek_id").notNull(),
 	kekVersion: text("kek_version").notNull(),
 	createdAt: createdAt(),
-	createdBy: text("created_by").notNull()
+	createdBy: text("created_by").notNull(),
+	recipe: text(),
+	pairId: text("pair_id"),
+	pairHalf: text("pair_half")
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -267,6 +281,7 @@ const auditLog = sqliteTable("audit_log", {
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`json_extract(${table.metadata}, '$.bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
 	index("audit_log_exchange_idx").on(sql`json_extract(${table.metadata}, '$.credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+	index("audit_log_token_create_idx").on(sql`json_extract(${table.metadata}, '$.targetCredentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
 	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
 	index("audit_log_also_project_idx").on(sql`json_extract(${table.metadata}, '$.also.projectId')`, table.seq).where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
 	index("audit_log_also_environment_idx").on(sql`json_extract(${table.metadata}, '$.also.environmentId')`, table.seq).where(sql`json_extract(${table.metadata}, '$.also') IS NOT NULL`),
@@ -351,6 +366,7 @@ const serviceBindings = sqliteTable("service_bindings", {
 	profile: text().notNull(),
 	issuer: text().notNull(),
 	jwksUri: text("jwks_uri").notNull(),
+	jwks: text(),
 	claims: text().notNull(),
 	scope: text(),
 	label: text(),
@@ -481,7 +497,7 @@ const credentials = sqliteTable("credentials", {
 	revokedBy: text("revoked_by")
 }, (table) => [
 	unique("credentials_token_hash_key").on(table.tokenHash),
-	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service')`),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal')`),
 	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
 	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
 	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-C63WjCrC.js";
+import { i as Queryable } from "./database-BEnexh-3.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -36,6 +36,41 @@ const KNOWN_MIGRATIONS = {
 			"when": 1791676486914,
 			"tag": "0003_credential_scopes",
 			"breakpoints": true
+		},
+		{
+			"idx": 4,
+			"version": "7",
+			"when": 1792244020330,
+			"tag": "0004_environment_parents",
+			"breakpoints": true
+		},
+		{
+			"idx": 5,
+			"version": "7",
+			"when": 1792250909587,
+			"tag": "0005_personal_tokens",
+			"breakpoints": true
+		},
+		{
+			"idx": 6,
+			"version": "7",
+			"when": 1792252693050,
+			"tag": "0006_uploaded_keys",
+			"breakpoints": true
+		},
+		{
+			"idx": 7,
+			"version": "7",
+			"when": 1792253794481,
+			"tag": "0007_personal_configs",
+			"breakpoints": true
+		},
+		{
+			"idx": 8,
+			"version": "7",
+			"when": 1792255559691,
+			"tag": "0008_recipes",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -66,6 +101,41 @@ const KNOWN_MIGRATIONS = {
 			"when": 1791676487593,
 			"tag": "0003_credential_scopes",
 			"breakpoints": true
+		},
+		{
+			"idx": 4,
+			"version": "6",
+			"when": 1792244020959,
+			"tag": "0004_environment_parents",
+			"breakpoints": true
+		},
+		{
+			"idx": 5,
+			"version": "6",
+			"when": 1792250910230,
+			"tag": "0005_personal_tokens",
+			"breakpoints": true
+		},
+		{
+			"idx": 6,
+			"version": "6",
+			"when": 1792252693912,
+			"tag": "0006_uploaded_keys",
+			"breakpoints": true
+		},
+		{
+			"idx": 7,
+			"version": "6",
+			"when": 1792253795070,
+			"tag": "0007_personal_configs",
+			"breakpoints": true
+		},
+		{
+			"idx": 8,
+			"version": "6",
+			"when": 1792255560312,
+			"tag": "0008_recipes",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-a7PkFgea.js";
+import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-BZRkBJQZ.js";
 export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -59,16 +59,27 @@ const environments = pgTable("environments", {
 	slug: text().notNull(),
 	name: text().notNull(),
 	createdAt: createdAt(),
-	archivedAt: timestamp("archived_at", { withTimezone: true })
+	archivedAt: timestamp("archived_at", { withTimezone: true }),
+	parentId: uuid("parent_id"),
+	owner: text()
 }, (table) => [
 	unique("environments_project_id_slug_key").on(table.projectId, table.slug),
 	unique("environments_project_scoped").on(table.id, table.projectId),
 	check("environments_slug_check", sql`${table.slug} ~ ${PLACE_SLUG}`),
+	check("environments_parent_check", sql`${table.parentId} IS NULL OR ${table.parentId} <> ${table.id}`),
+	check("environments_owner_check", sql`${table.owner} IS NULL OR (${table.parentId} IS NOT NULL AND ${table.owner} LIKE 'user:_%')`),
+	uniqueIndex("environments_parent_id_owner_key").on(table.parentId, table.owner).where(sql`strpos(${table.slug}, '~') = 0`),
 	foreignKey({
 		name: "environments_project_id_fkey",
 		columns: [table.projectId],
 		foreignColumns: [projects.id]
-	}).onDelete("restrict")
+	}).onDelete("restrict"),
+	foreignKey({
+		name: "environments_parent_in_project",
+		columns: [table.parentId, table.projectId],
+		foreignColumns: [table.id, table.projectId]
+	}).onDelete("no action"),
+	index("environments_parent_idx").on(table.parentId)
 ]);
 const secrets = pgTable("secrets", {
 	id: uuid().primaryKey().defaultRandom(),
@@ -115,7 +126,10 @@ const secretVersions = pgTable("secret_versions", {
 	kekId: text("kek_id").notNull(),
 	kekVersion: text("kek_version").notNull(),
 	createdAt: createdAt(),
-	createdBy: text("created_by").notNull()
+	createdBy: text("created_by").notNull(),
+	recipe: text(),
+	pairId: uuid("pair_id"),
+	pairHalf: text("pair_half")
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -292,6 +306,7 @@ const auditLog = pgTable("audit_log", {
 	index("audit_log_subject_idx").on(table.author, table.subjectPrincipal, table.seq),
 	index("audit_log_unbind_idx").on(sql`((${table.metadata})::jsonb ->> 'bindingId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.unbind' AND ${table.decision} = 'allow'`),
 	index("audit_log_exchange_idx").on(sql`((${table.metadata})::jsonb ->> 'credentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.exchange' AND ${table.decision} = 'allow'`),
+	index("audit_log_token_create_idx").on(sql`((${table.metadata})::jsonb ->> 'targetCredentialId')`).where(sql`${table.author} = 'app' AND ${table.action} = 'token.create' AND ${table.decision} = 'allow'`),
 	index("audit_log_reference_end_idx").on(table.relatedSeq).where(sql`${table.author} = 'vault' AND ${table.action} = 'reference.end' AND ${table.decision} = 'allow'`),
 	index("audit_log_also_project_idx").on(sql`(((${table.metadata})::jsonb -> 'also') ->> 'projectId')`, table.seq).where(sql`((${table.metadata})::jsonb -> 'also') IS NOT NULL`),
 	index("audit_log_also_environment_idx").on(sql`(((${table.metadata})::jsonb -> 'also') ->> 'environmentId')`, table.seq).where(sql`((${table.metadata})::jsonb -> 'also') IS NOT NULL`),
@@ -399,6 +414,7 @@ const serviceBindings = pgTable("service_bindings", {
 	profile: text().notNull(),
 	issuer: text().notNull(),
 	jwksUri: text("jwks_uri").notNull(),
+	jwks: text(),
 	claims: text().notNull(),
 	scope: text(),
 	label: text(),
@@ -547,7 +563,7 @@ const credentials = pgTable("credentials", {
 	revokedBy: text("revoked_by")
 }, (table) => [
 	unique("credentials_token_hash_key").on(table.tokenHash),
-	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service')`),
+	check("credentials_kind_check", sql`${table.kind} IN ('browser', 'cli', 'service', 'personal')`),
 	check("credentials_principal_check", sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
 	check("credentials_kind_matches_principal", sql`(${table.kind} = 'service') = (${table.principal} LIKE 'token:%')`),
 	check("credentials_token_hash_check", sql`octet_length(${table.tokenHash}) = 32`),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.6.2",
+  "version": "0.7.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.6.2"
+    "@coffre/core": "0.7.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/log.ts

@@ -1,5 +1,5 @@
 import { GENESIS_HASH, sealEntry, type LogFields, type LogKey, type StoredEntry } from '@coffre/core/audit';
-import { and, desc, eq, lt } from 'drizzle-orm';
+import { and, asc, desc, eq, lt, sql, type SQL } from 'drizzle-orm';
 
 import { afterCommit } from './commits.ts';
 import { tablesOf, type Queryable, type Transaction } from './database.ts';
@@ -218,6 +218,45 @@ export function entryColumns(db: Queryable) {
   };
 }
 
+/**
+ * Metadata a reader of many entries holds at once, at most: an entry about
+ * a read of several secrets lists them, a thousand some 150 kilobytes, so a
+ * count of entries alone does not bound a batch's or a page's memory within
+ * a Worker's 128 megabytes.
+ */
+export const BATCH_BYTES = 8 * 1024 * 1024;
+
+/**
+ * Of the entries `where` matches, in `order` of seq, the first `limit` or
+ * fewer that hold no more than `BATCH_BYTES` of metadata between them, but
+ * always the first: the seqs they run from and to, and whether the bytes
+ * cut the run short of `limit`. Null when none matches. A reader asks this
+ * first, then reads `where` between the two.
+ */
+export async function withinBytes(
+  db: Queryable,
+  where: SQL | undefined,
+  limit: number,
+  order: 'asc' | 'desc' = 'asc',
+): Promise<{ from: bigint; to: bigint; cut: boolean; count: number } | null> {
+  const { auditLog } = tablesOf(db);
+  const sizes = await db
+    .select({ seq: auditLog.seq, bytes: sql<number | string>`length(${auditLog.metadata})` })
+    .from(auditLog)
+    .where(where)
+    .orderBy(order === 'asc' ? asc(auditLog.seq) : desc(auditLog.seq))
+    .limit(limit);
+  let held = 0;
+  let count = 0;
+  for (const { bytes } of sizes) {
+    held += Number(bytes);
+    if (count > 0 && held > BATCH_BYTES) break;
+    count += 1;
+  }
+  if (count === 0) return null;
+  return { from: sizes[0]!.seq, to: sizes[count - 1]!.seq, cut: count < sizes.length, count };
+}
+
 /**
  * How a reader tells the vault's own entries from those forged in its name:
  * by their MAC, which only the vault holds the key to check. Each it finds

package/src/migrations/postgres/0004_environment_parents.sql

@@ -0,0 +1,5 @@
+-- The app sets parent_id when it makes an environment, and never after: it gets no UPDATE grant, so a parent cannot change.
+ALTER TABLE "environments" ADD COLUMN "parent_id" uuid;--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_parent_in_project" FOREIGN KEY ("parent_id","project_id") REFERENCES "public"."environments"("id","project_id") ON DELETE no action ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "environments_parent_idx" ON "environments" USING btree ("parent_id");--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_parent_check" CHECK ("environments"."parent_id" IS NULL OR "environments"."parent_id" <> "environments"."id");

package/src/migrations/postgres/0005_personal_tokens.sql

@@ -0,0 +1,5 @@
+-- Personal tokens (0.7). The check widens to their kind: the release before makes none, and refuses one, whose prefix, coffre_pat_, it does not take for a token.
+ALTER TABLE "credentials" DROP CONSTRAINT "credentials_kind_check";--> statement-breakpoint
+ALTER TABLE "credentials" ADD CONSTRAINT "credentials_kind_check" CHECK ("credentials"."kind" IN ('browser', 'cli', 'service', 'personal'));--> statement-breakpoint
+-- A token's creation, by the credential's ID: the label a personal token's entries are shown with.
+CREATE INDEX "audit_log_token_create_idx" ON "audit_log" USING btree ((("metadata")::jsonb ->> 'targetCredentialId')) WHERE "audit_log"."author" = 'app' AND "audit_log"."action" = 'token.create' AND "audit_log"."decision" = 'allow';

package/src/migrations/postgres/0006_uploaded_keys.sql

@@ -0,0 +1,2 @@
+-- An issuer's keys, uploaded with a binding where coffre fetches none. The app inserts them with the binding, under its table-wide INSERT, and no UPDATE grant names them: they never change in place.
+ALTER TABLE "service_bindings" ADD COLUMN "jwks" text;

package/src/migrations/postgres/0007_personal_configs.sql

@@ -0,0 +1,4 @@
+-- The app sets owner when it makes a personal config, and never after: it gets no UPDATE grant, so an owner cannot change. The vault binds each value to it, so a forged owner opens nothing.
+ALTER TABLE "environments" ADD COLUMN "owner" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "environments_parent_id_owner_key" ON "environments" USING btree ("parent_id","owner") WHERE strpos("environments"."slug", '~') = 0;--> statement-breakpoint
+ALTER TABLE "environments" ADD CONSTRAINT "environments_owner_check" CHECK ("environments"."owner" IS NULL OR ("environments"."parent_id" IS NOT NULL AND "environments"."owner" LIKE 'user:_%'));

package/src/migrations/postgres/0008_recipes.sql

@@ -0,0 +1,19 @@
+ALTER TABLE "secret_versions" ADD COLUMN "recipe" text;--> statement-breakpoint
+ALTER TABLE "secret_versions" ADD COLUMN "pair_id" uuid;--> statement-breakpoint
+ALTER TABLE "secret_versions" ADD COLUMN "pair_half" text;--> statement-breakpoint
+-- A version is still only ever erased: its recipe and its pair with it.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;