@kubun/store-credential 0.13.0 → 0.14.0

package/lib/api.d.ts

@@ -155,5 +155,15 @@ export type CredentialStoreAPI = {
      * that is now revoked.
      */
     listHeldSubjects(): Promise<Array<HeldCredentialSubject>>;
+    /**
+     * The entry id currently pointed to by an opaque `(namespace, key)`, or
+     * `null` when unset. Neither argument is interpreted — a caller normalizes
+     * whatever it means by "key" before calling.
+     */
+    getAliasEntryID(namespace: string, key: string): Promise<string | null>;
+    /** Point `(namespace, key)` at `entryID`, replacing any prior target. */
+    setAliasEntryID(namespace: string, key: string, entryID: string): Promise<void>;
+    /** Clear an alias. A no-op, not an error, when none is set. */
+    deleteAliasEntryID(namespace: string, key: string): Promise<void>;
 };
 export declare function createCredentialStore(db: Kysely<CredentialTables>, adapter: Adapter): CredentialStoreAPI;

package/lib/api.js

@@ -409,6 +409,25 @@ export function createCredentialStore(db, adapter) {
                     subjectID: row.subject_id,
                     opHash: row.op_hash
                 }));
+        },
+        async getAliasEntryID (namespace, key) {
+            const row = await db.selectFrom('kubun_credential_aliases').select('entry_id').where('namespace', '=', namespace).where('alias_key', '=', key).executeTakeFirst();
+            return row?.entry_id ?? null;
+        },
+        async setAliasEntryID (namespace, key, entryID) {
+            await db.insertInto('kubun_credential_aliases').values({
+                namespace,
+                alias_key: key,
+                entry_id: entryID
+            }).onConflict((oc)=>oc.columns([
+                    'namespace',
+                    'alias_key'
+                ]).doUpdateSet({
+                    entry_id: entryID
+                })).execute();
+        },
+        async deleteAliasEntryID (namespace, key) {
+            await db.deleteFrom('kubun_credential_aliases').where('namespace', '=', namespace).where('alias_key', '=', key).execute();
         }
     };
 }

package/lib/index.d.ts

@@ -5,4 +5,4 @@ export { createCredentialStore } from './api.js';
 export { credentialStoreDefinition } from './definition.js';
 export declare const CREDENTIAL_STORE: "credential";
 export declare function getCredentialStore(provider: StoreProvider): Promise<CredentialStoreAPI>;
-export type { CredentialEntry, CredentialEntryTable, CredentialEntryWithProvenance, CredentialFactorDescriptor, CredentialKey, CredentialKeyBranch, CredentialKeyBranchTable, CredentialKeyState, CredentialKeyTable, CredentialOp, CredentialOpSubjectKind, CredentialOpTable, CredentialTables, CredentialWrapping, CredentialWrappingTable, CredentialWrappingWithBranch, InsertCredentialEntry, InsertCredentialKey, InsertCredentialOp, InsertCredentialWrapping, } from './tables.js';
+export type { CredentialAlias, CredentialEntry, CredentialEntryTable, CredentialEntryWithProvenance, CredentialFactorDescriptor, CredentialKey, CredentialKeyBranch, CredentialKeyBranchTable, CredentialKeyState, CredentialKeyTable, CredentialOp, CredentialOpSubjectKind, CredentialOpTable, CredentialTables, CredentialWrapping, CredentialWrappingTable, CredentialWrappingWithBranch, InsertCredentialAlias, InsertCredentialEntry, InsertCredentialKey, InsertCredentialOp, InsertCredentialWrapping, KubunCredentialAliasTable, } from './tables.js';

package/lib/migrations.js

@@ -42,8 +42,16 @@ export function getCredentialMigrations(ctx) {
             await db.schema.createIndex('idx_kubun_credential_ops_hlc').ifNotExists().on('kubun_credential_ops').columns([
                 'hlc'
             ]).execute();
+            // A plain local pointer, not an op subject — no hlc, no ops row, no
+            // merkle scan. Devices that resolve the same (namespace, key) converge on
+            // it locally, so it carries nothing to replicate.
+            await db.schema.createTable('kubun_credential_aliases').ifNotExists().addColumn('namespace', t.text, (col)=>col.notNull()).addColumn('alias_key', t.text, (col)=>col.notNull()).addColumn('entry_id', t.text, (col)=>col.notNull()).addColumn('created_at', t.timestamp, (col)=>col.defaultTo(now).notNull()).addPrimaryKeyConstraint('pk_kubun_credential_aliases', [
+                'namespace',
+                'alias_key'
+            ]).execute();
         },
         async down (db) {
+            await db.schema.dropTable('kubun_credential_aliases').ifExists().execute();
             await db.schema.dropTable('kubun_credential_ops').ifExists().execute();
             await db.schema.dropTable('kubun_credential_entries').ifExists().execute();
             await db.schema.dropTable('kubun_credential_wrappings').ifExists().execute();

package/lib/tables.d.ts

@@ -148,11 +148,30 @@ export type CredentialOpTable = {
 };
 export type CredentialOp = Selectable<CredentialOpTable>;
 export type InsertCredentialOp = Insertable<CredentialOpTable>;
+/**
+ * A local pointer from an opaque `(namespace, key)` to the entry id it
+ * currently names. Not an op subject: it carries no `hlc` and never appears in
+ * `kubun_credential_ops` or the merkle scan, because it is a per-device index
+ * rather than a replicated fact — each device that resolves the same
+ * `(namespace, key)` points it at the entry it converges on locally.
+ *
+ * The store does not interpret `namespace`, `alias_key` or `entry_id` — they
+ * are stored and returned verbatim, whatever a caller passes.
+ */
+export type KubunCredentialAliasTable = {
+    namespace: string;
+    alias_key: string;
+    entry_id: string;
+    created_at: CreatedAtColumn;
+};
+export type CredentialAlias = Selectable<KubunCredentialAliasTable>;
+export type InsertCredentialAlias = Insertable<KubunCredentialAliasTable>;
 export type CredentialTables = {
     kubun_credential_keys: CredentialKeyTable;
     kubun_credential_key_branches: CredentialKeyBranchTable;
     kubun_credential_wrappings: CredentialWrappingTable;
     kubun_credential_entries: CredentialEntryTable;
     kubun_credential_ops: CredentialOpTable;
+    kubun_credential_aliases: KubunCredentialAliasTable;
 };
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/store-credential",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -16,14 +16,14 @@
   ],
   "dependencies": {
     "@kokuin/token": "^0.5.0",
-    "kysely": "^0.29.5",
-    "@kubun/db": "^0.13.0",
-    "@kubun/db-adapter": "^0.13.0"
+    "@kubun/db": "^0.14.0",
+    "@kubun/db-adapter": "^0.14.0",
+    "kysely": "^0.29.5"
   },
   "devDependencies": {
-    "@testcontainers/postgresql": "^12.1.0",
-    "@kubun/db-postgres": "^0.13.0",
-    "@kubun/db-better-sqlite": "^0.13.0"
+    "@kubun/db-better-sqlite": "^0.14.0",
+    "@kubun/db-postgres": "^0.14.0",
+    "@testcontainers/postgresql": "^12.1.0"
   },
   "publishConfig": {
     "access": "public"