@coffre/db 0.8.1 → 0.9.0

package/dist/migrations/sqlite/meta/_journal.json

@@ -71,6 +71,20 @@
       "when": 1792281880190,
       "tag": "0009_handles",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "6",
+      "when": 1792315000277,
+      "tag": "0010_handle_places",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1792317461299,
+      "tag": "0011_plain_values",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-BZRkBJQZ.js";
-import { t as Database } from "./database-BEnexh-3.js";
+import { m as schema_d_exports } from "./schema-CCYKTG-E.js";
+import { t as Database } from "./database-hd1hAll-.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-BZRkBJQZ.d.ts → schema-CCYKTG-E.d.ts}

@@ -714,6 +714,23 @@ declare const secretVersions: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    plaintext: import("drizzle-orm/pg-core").PgColumn<{
+      name: "plaintext";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;
@@ -3298,6 +3315,23 @@ declare const credentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    places: import("drizzle-orm/pg-core").PgColumn<{
+      name: "places";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     label: import("drizzle-orm/pg-core").PgColumn<{
       name: "label";
       tableName: "credentials";

package/dist/schema-sqlite.d.ts

@@ -756,6 +756,25 @@ export declare const secretVersions: import("drizzle-orm/sqlite-core").SQLiteTab
     }, {}, {
       length: number | undefined;
     }>;
+    plaintext: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "plaintext";
+      tableName: "secret_versions";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
   };
   dialect: "sqlite";
 }>;
@@ -3427,6 +3446,25 @@ export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableW
     }, {}, {
       length: undefined;
     }>;
+    places: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "places";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "label";
       tableName: "credentials";

package/dist/schema-sqlite.js

@@ -124,7 +124,8 @@ const secretVersions = sqliteTable("secret_versions", {
 	createdBy: text("created_by").notNull(),
 	recipe: text(),
 	pairId: text("pair_id"),
-	pairHalf: text("pair_half")
+	pairHalf: text("pair_half"),
+	plaintext: text()
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -487,6 +488,7 @@ const credentials = sqliteTable("credentials", {
 	principal: text().notNull(),
 	identityId: text("identity_id"),
 	scope: text(),
+	places: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-BEnexh-3.js";
+import { i as Queryable } from "./database-hd1hAll-.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -78,6 +78,20 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792281879553,
 			"tag": "0009_handles",
 			"breakpoints": true
+		},
+		{
+			"idx": 10,
+			"version": "7",
+			"when": 1792314999425,
+			"tag": "0010_handle_places",
+			"breakpoints": true
+		},
+		{
+			"idx": 11,
+			"version": "7",
+			"when": 1792317460399,
+			"tag": "0011_plain_values",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -150,6 +164,20 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792281880190,
 			"tag": "0009_handles",
 			"breakpoints": true
+		},
+		{
+			"idx": 10,
+			"version": "6",
+			"when": 1792315000277,
+			"tag": "0010_handle_places",
+			"breakpoints": true
+		},
+		{
+			"idx": 11,
+			"version": "6",
+			"when": 1792317461299,
+			"tag": "0011_plain_values",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-BZRkBJQZ.js";
+import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-CCYKTG-E.js";
 export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -129,7 +129,8 @@ const secretVersions = pgTable("secret_versions", {
 	createdBy: text("created_by").notNull(),
 	recipe: text(),
 	pairId: uuid("pair_id"),
-	pairHalf: text("pair_half")
+	pairHalf: text("pair_half"),
+	plaintext: text()
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -553,6 +554,7 @@ const credentials = pgTable("credentials", {
 	principal: text().notNull(),
 	identityId: uuid("identity_id"),
 	scope: text(),
+	places: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.8.1"
+    "@coffre/core": "0.9.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/migrations/postgres/0010_handle_places.sql

@@ -0,0 +1,2 @@
+-- A handle's places (0.9): the environments it was made for, by id and whether as @me, which the proxy's stable URL resolves to. A nullable column the release before neither reads nor writes; the app sets it when it makes a handle, and never after (no UPDATE grant).
+ALTER TABLE "credentials" ADD COLUMN "places" text;

package/src/migrations/postgres/0011_plain_values.sql

@@ -0,0 +1,19 @@
+-- Plain values (0.9): a version of a key marked not secret holds its value in the clear too. Nullable, so the release before writes on as it did.
+ALTER TABLE "secret_versions" ADD COLUMN "plaintext" text;--> statement-breakpoint
+-- A version is still only ever erased, and an erased one holds no value, in the clear or not.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0 OR NEW.plaintext IS NOT NULL
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;--> statement-breakpoint
+GRANT UPDATE (plaintext) ON secret_versions TO coffre_app;