@wtfalch/keys 0.1.0 → 0.3.0

package/dist/issued/index.js

@@ -1,10 +1,12 @@
 import { and, eq, inArray, isNull } from 'drizzle-orm';
 import { sql } from 'drizzle-orm';
 import { fromBase64Url, toBase64Url } from './codec.js';
+import { canonicalJson } from './encoding.js';
 import { keyPrefixOf, mintSecret, rotateSecret, secretMatches } from './secret.js';
 import { keysIssuedCredentials } from './tables.js';
 import { verifyIssuedRowSignature } from './verify.js';
 export { ID_PATTERN, SIGNED_PREFIX, } from '../worker-contract.js';
+export { createPostgresRateLimiter, } from './ratelimit.js';
 function rowsOf(result) {
     if (Array.isArray(result))
         return result;
@@ -26,11 +28,11 @@ function toSignableRow(row) {
     };
 }
 export function createCredentialIssuer(options) {
-    const { db, worker, credential, verifyKeys, audit, prefix } = options;
+    const { db, worker, credential, verifyKeys, audit, prefix, rateLimiter } = options;
     const now = options.now ?? (() => Date.now());
     const table = keysIssuedCredentials;
-    async function loadById(id) {
-        const [row] = await db.select().from(table).where(eq(table.id, id)).limit(1);
+    async function loadById(id, handle = db) {
+        const [row] = await handle.select().from(table).where(eq(table.id, id)).limit(1);
         return row;
     }
     async function loadByPrefix(keyPrefix) {
@@ -42,23 +44,29 @@ export function createCredentialIssuer(options) {
         return row;
     }
     /** Every descendant of `id`, `id` itself included. Mirrors valet's `subtreeOf` (`self-service.ts`). */
-    async function subtreeIds(id) {
-        const result = await db.execute(sql `
+    async function subtreeIds(id, handle) {
+        const result = await handle.execute(sql `
       with recursive descendants as (
-        select id from keys_issued_credentials where id = ${id}
+        select id from public.keys_issued_credentials where id = ${id}
         union
         select c.id
-          from keys_issued_credentials c
+          from public.keys_issued_credentials c
           join descendants d on c.issued_by_id = d.id
       )
       select id from descendants
     `);
         return rowsOf(result).map((r) => r.id);
     }
+    // One short database-wide lifecycle lock. Never held across a Worker call.
+    // The cascade snapshot and child publication must share the same lock; row
+    // locks on only the immediate parent miss concurrent ancestor revocations.
+    async function lockLifecycle(tx) {
+        await tx.execute(sql `select pg_advisory_xact_lock(1801812339, 1)`);
+    }
     async function emit(event) {
         await audit?.(event);
     }
-    async function issue(request) {
+    async function issue(request, attempt = 0) {
         if (request.idempotencyKey) {
             const existing = await loadByIdempotencyKey(request.idempotencyKey);
             if (existing) {
@@ -71,6 +79,7 @@ export function createCredentialIssuer(options) {
         if (request.expiresAt <= now()) {
             return { ok: false, reason: 'expires_at_past' };
         }
+        const environment = request.environment ?? 'live';
         let minterAttestation = null;
         if (request.minter !== null) {
             const minterRow = await loadById(request.minter);
@@ -83,6 +92,11 @@ export function createCredentialIssuer(options) {
                 return { ok: false, reason: 'minter_revoked' };
             if (minterRow.expiresAt <= now())
                 return { ok: false, reason: 'minter_expired' };
+            // #47: a test key can only mint a test key, a live key only a live
+            // one -- the pairing the issue asked for, not just a label.
+            if (minterRow.environment !== environment) {
+                return { ok: false, reason: 'environment_mismatch' };
+            }
             minterAttestation = {
                 row: toSignableRow(minterRow),
                 signature: fromBase64Url(minterRow.signature),
@@ -110,17 +124,40 @@ export function createCredentialIssuer(options) {
         if (!result.ok)
             return { ok: false, reason: result.error.code };
         try {
-            await db.insert(table).values({
-                id,
-                issuedById: candidate.issuedById,
-                keyPrefix: candidate.keyPrefix,
-                secretHash: candidate.secretHash,
-                grants: candidate.grants,
-                expiresAt: candidate.expiresAt,
-                signature: toBase64Url(result.signature),
-                signingGenerationId: result.generationId,
-                idempotencyKey: request.idempotencyKey ?? null,
+            const refusal = await db.transaction(async (tx) => {
+                await lockLifecycle(tx);
+                if (request.minter !== null) {
+                    const parent = await loadById(request.minter, tx);
+                    if (!parent)
+                        return 'minter_not_found';
+                    if (parent.revokedAt !== null)
+                        return 'minter_revoked';
+                    if (parent.expiresAt <= now())
+                        return 'minter_expired';
+                    if (parent.environment !== environment)
+                        return 'environment_mismatch';
+                    if (!minterAttestation ||
+                        parent.signature !== toBase64Url(minterAttestation.signature) ||
+                        canonicalJson(toSignableRow(parent)) !== canonicalJson(minterAttestation.row)) {
+                        return 'bad_minter_signature';
+                    }
+                }
+                await tx.insert(table).values({
+                    id,
+                    issuedById: candidate.issuedById,
+                    keyPrefix: candidate.keyPrefix,
+                    secretHash: candidate.secretHash,
+                    grants: candidate.grants,
+                    expiresAt: candidate.expiresAt,
+                    signature: toBase64Url(result.signature),
+                    signingGenerationId: result.generationId,
+                    idempotencyKey: request.idempotencyKey ?? null,
+                    environment,
+                });
+                return null;
             });
+            if (refusal)
+                return { ok: false, reason: refusal };
         }
         catch (err) {
             // A concurrent issue() with the same idempotencyKey won the race: the
@@ -131,6 +168,9 @@ export function createCredentialIssuer(options) {
                     return { ok: true, id: existing.id, keyPrefix: existing.keyPrefix, secret: null };
                 }
             }
+            if (attempt < 3 && isUniqueViolation(err) && (await loadByPrefix(candidate.keyPrefix))) {
+                return issue(request, attempt + 1);
+            }
             throw err;
         }
         await emit({ name: 'credential.minted', credentialId: id, requestId, at: now() });
@@ -143,6 +183,24 @@ export function createCredentialIssuer(options) {
         const row = await loadByPrefix(keyPrefix);
         if (!row)
             return { ok: false, reason: 'not_found' };
+        // #45: spent on every attempt against a known credential, matched
+        // secret or not -- an unlimited number of wrong guesses against an
+        // identified row would otherwise let an attacker brute-force it past
+        // any per-successful-use limit. Before the signature check below, so a
+        // flood of requests against one credential id never reaches the more
+        // expensive Ed25519 verify.
+        // A `rateLimiter.check` failure is NOT caught, unlike #46's usage
+        // write below: rate limiting is a security control the host opted
+        // into, and failing open on it (silently never limiting anything
+        // whenever its store is unreachable) is a worse failure mode than a
+        // loud one a host notices in its own staging environment the first
+        // time the migration is missing or the store is down.
+        if (rateLimiter) {
+            const limit = await rateLimiter.check(row.id, now());
+            if (limit.limited) {
+                return { ok: false, reason: 'rate_limited', retryAfterMs: limit.retryAfterMs };
+            }
+        }
         // Verified before anything else is trusted about the row: a signature
         // check over the row's CURRENT fields refuses a row a raw UPDATE
         // tampered with, whatever that tamper changed.
@@ -154,26 +212,34 @@ export function createCredentialIssuer(options) {
             return { ok: false, reason: 'revoked' };
         if (now() >= row.expiresAt)
             return { ok: false, reason: 'expired' };
-        if (secretMatches(secret, row.secretHash)) {
-            return {
-                ok: true,
-                id: row.id,
-                issuedById: row.issuedById,
-                grants: row.grants,
-            };
+        const matched = secretMatches(secret, row.secretHash) ||
+            (row.previousSecretHash !== null &&
+                row.previousValidUntil !== null &&
+                now() < row.previousValidUntil &&
+                secretMatches(secret, row.previousSecretHash));
+        if (!matched)
+            return { ok: false, reason: 'secret_mismatch' };
+        // #46: last-used/use-count, for an admin UI to read directly off the
+        // row -- best-effort. A write failure here is observability lost, not
+        // an authorization decision, so it must never turn an otherwise-genuine
+        // secret into a refusal; check() stays available for the one thing it
+        // exists to do even if this bookkeeping write cannot land.
+        try {
+            await db
+                .update(table)
+                .set({ lastUsedAt: new Date(now()), useCount: sql `${table.useCount} + 1` })
+                .where(eq(table.id, row.id));
         }
-        if (row.previousSecretHash !== null &&
-            row.previousValidUntil !== null &&
-            now() < row.previousValidUntil &&
-            secretMatches(secret, row.previousSecretHash)) {
-            return {
-                ok: true,
-                id: row.id,
-                issuedById: row.issuedById,
-                grants: row.grants,
-            };
+        catch {
+            // Swallowed by design -- see comment above.
         }
-        return { ok: false, reason: 'secret_mismatch' };
+        return {
+            ok: true,
+            id: row.id,
+            issuedById: row.issuedById,
+            grants: row.grants,
+            environment: row.environment,
+        };
     }
     async function rotate(id, opts) {
         const row = await loadById(id);
@@ -181,6 +247,14 @@ export function createCredentialIssuer(options) {
             return { ok: false, reason: 'not_found' };
         if (row.revokedAt !== null)
             return { ok: false, reason: 'revoked' };
+        if (!(await verifyIssuedRowSignature(toSignableRow(row), fromBase64Url(row.signature), verifyKeys))) {
+            return { ok: false, reason: 'signature_invalid' };
+        }
+        if (!Number.isSafeInteger(opts.graceMs) ||
+            opts.graceMs < 0 ||
+            !Number.isSafeInteger(now() + opts.graceMs)) {
+            return { ok: false, reason: 'bad_request' };
+        }
         const minted = rotateSecret(row.keyPrefix);
         const previousValidUntil = now() + opts.graceMs;
         const candidate = {
@@ -217,30 +291,55 @@ export function createCredentialIssuer(options) {
         });
         if (!result.ok)
             return { ok: false, reason: result.error.code };
-        await db
-            .update(table)
-            .set({
-            secretHash: candidate.secretHash,
-            previousSecretHash: candidate.previousSecretHash,
-            previousValidUntil: candidate.previousValidUntil,
-            signature: toBase64Url(result.signature),
-            signingGenerationId: result.generationId,
-        })
-            .where(eq(table.id, id));
+        const refusal = await db.transaction(async (tx) => {
+            await lockLifecycle(tx);
+            const [current] = await tx.select().from(table).where(eq(table.id, id)).for('update');
+            if (!current)
+                return 'not_found';
+            if (current.revokedAt !== null)
+                return 'revoked';
+            if (current.signature !== row.signature ||
+                canonicalJson(toSignableRow(current)) !== canonicalJson(toSignableRow(row))) {
+                return 'conflict';
+            }
+            if (row.issuedById !== null) {
+                const parent = await loadById(row.issuedById, tx);
+                if (!parent)
+                    return 'minter_not_found';
+                if (parent.revokedAt !== null)
+                    return 'minter_revoked';
+                if (parent.expiresAt <= now())
+                    return 'minter_expired';
+            }
+            await tx
+                .update(table)
+                .set({
+                secretHash: candidate.secretHash,
+                previousSecretHash: candidate.previousSecretHash,
+                previousValidUntil: candidate.previousValidUntil,
+                signature: toBase64Url(result.signature),
+                signingGenerationId: result.generationId,
+            })
+                .where(eq(table.id, id));
+            return null;
+        });
+        if (refusal)
+            return { ok: false, reason: refusal };
         await emit({ name: 'credential.rotated', credentialId: id, requestId, at: now() });
         return { ok: true, secret: minted.secret };
     }
     async function revoke(id, opts = {}) {
-        const cascade = opts.cascade ?? true;
-        const ids = cascade ? await subtreeIds(id) : [id];
-        if (ids.length === 0)
-            return [];
-        const revokedAt = new Date(now());
-        const revokedRows = await db
-            .update(table)
-            .set({ revokedAt })
-            .where(and(inArray(table.id, ids), isNull(table.revokedAt)))
-            .returning({ id: table.id });
+        const revokedRows = await db.transaction(async (tx) => {
+            await lockLifecycle(tx);
+            const ids = (opts.cascade ?? true) ? await subtreeIds(id, tx) : [id];
+            if (ids.length === 0)
+                return [];
+            return tx
+                .update(table)
+                .set({ revokedAt: new Date(now()) })
+                .where(and(inArray(table.id, ids), isNull(table.revokedAt)))
+                .returning({ id: table.id });
+        });
         for (const r of revokedRows) {
             await emit({ name: 'credential.revoked', credentialId: r.id, at: now() });
         }
@@ -261,6 +360,7 @@ export function createCredentialIssuer(options) {
                 grants: row.grants,
                 expiresAt: row.expiresAt,
                 revokedAt: row.revokedAt ? row.revokedAt.getTime() : null,
+                environment: row.environment,
             });
             currentId = row.issuedById;
         }
@@ -269,5 +369,8 @@ export function createCredentialIssuer(options) {
     return { issue, check, rotate, revoke, lineageOf };
 }
 function isUniqueViolation(err) {
-    return err?.code === '23505';
+    if (!err || typeof err !== 'object')
+        return false;
+    const e = err;
+    return e.code === '23505' || (e.cause !== err && isUniqueViolation(e.cause));
 }

package/dist/issued/ratelimit.d.ts

@@ -0,0 +1,34 @@
+import type { Db } from './index.js';
+/**
+ * #45: a per-issued-credential abuse limit. `packages/worker/src/ratelimit.ts`
+ * already limits per `hostId` + the HOST's own service credential; nothing
+ * limited an END USER's individual issued key until this. `check()` consults
+ * `CreateCredentialIssuerOptions.rateLimiter`, when one is given, keyed by
+ * the credential's own `id` -- once the row is found (so a known
+ * credential's budget is spent on every attempt, matched secret or not,
+ * not only on a successful one), before its secret is verified.
+ */
+export interface RateLimitResult {
+    readonly limited: boolean;
+    /** Milliseconds until the current window resets. Meaningful whether or not `limited`. */
+    readonly retryAfterMs: number;
+}
+export interface RateLimiter {
+    /** `now`: Unix milliseconds, the same clock `check()`'s own `now` option gives -- never read internally, so a fake clock in a test reaches this too. */
+    check(credentialId: string, now: number): Promise<RateLimitResult>;
+}
+export interface CreatePostgresRateLimiterOptions {
+    readonly db: Db;
+    /** Requests a single credential may make per window before `limited` is true. */
+    readonly limitPerWindow: number;
+    /** Milliseconds. Default 60_000. */
+    readonly windowMs?: number;
+}
+/**
+ * A fixed-window counter in the host's own Postgres, one bounded row per
+ * credential (`keys_issued_rate_limit_windows`, `0007_keys_rate_limit.sql`),
+ * atomically reset each window by a single upsert -- the same shape
+ * `packages/worker/src/ratelimit.ts`'s D1 `host_rate_limit_windows` uses, a
+ * level down: keyed by the end user's credential id, not the host's.
+ */
+export declare function createPostgresRateLimiter(options: CreatePostgresRateLimiterOptions): RateLimiter;

package/dist/issued/ratelimit.js

@@ -0,0 +1,49 @@
+import { sql } from 'drizzle-orm';
+function rowsOf(result) {
+    if (Array.isArray(result))
+        return result;
+    return (result.rows ?? []);
+}
+/**
+ * A fixed-window counter in the host's own Postgres, one bounded row per
+ * credential (`keys_issued_rate_limit_windows`, `0007_keys_rate_limit.sql`),
+ * atomically reset each window by a single upsert -- the same shape
+ * `packages/worker/src/ratelimit.ts`'s D1 `host_rate_limit_windows` uses, a
+ * level down: keyed by the end user's credential id, not the host's.
+ */
+export function createPostgresRateLimiter(options) {
+    const { db, limitPerWindow } = options;
+    const windowMs = options.windowMs ?? 60_000;
+    return {
+        async check(credentialId, now) {
+            const windowStart = Math.floor(now / windowMs) * windowMs;
+            const result = await db.execute(sql `
+        insert into keys_issued_rate_limit_windows (credential_id, window_start, count)
+        values (${credentialId}, ${windowStart}, 1)
+        on conflict (credential_id) do update set
+          window_start = excluded.window_start,
+          count = case
+            when keys_issued_rate_limit_windows.window_start = excluded.window_start
+            then keys_issued_rate_limit_windows.count + 1
+            else 1
+          end
+        returning window_start, count
+      `);
+            const [row] = rowsOf(result);
+            if (!row)
+                throw new Error('rate limit write returned no row');
+            // `count` is `integer` (int4), always JS-number-safe -- but a raw
+            // (non-query-builder) result is still driver-dependent about handing
+            // it back as a number or a numeric string, so `Number(...)` either
+            // way. `window_start` itself is never re-read from the row: the
+            // upsert always sets it to `excluded.window_start`, never
+            // conditionally kept, so it equals the `windowStart` just computed
+            // above.
+            const count = Number(row.count);
+            return {
+                limited: count > limitPerWindow,
+                retryAfterMs: windowStart + windowMs - now,
+            };
+        },
+    };
+}

package/dist/issued/secret.js

@@ -2,12 +2,12 @@ import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
 /**
  * The split-secret format, carried over from valet's `src/lib/auth/keys.ts`:
  *
- *   <prefix><8-char public id><20-byte secret tail>
+ *   <prefix><8-char public id><32-char tail encoding 20 random bytes>
  *
  * The prefix through the public id is stored in the clear and is what a
  * lookup indexes on; the tail is never stored, only the SHA-256 hash of the
  * whole secret. `prefix` is host-supplied here (valet hardcodes `vk_live_`;
- * a package used by several hosts cannot), everything after it is fixed.
+ * a package used by several hosts cannot), legacy 20-character tails remain accepted during migration.
  *
  * `node:crypto` rather than WebCrypto: this is a Node-side, host-only
  * mechanic (unlike encoding.ts, nothing here runs in the Worker), and
@@ -15,6 +15,8 @@ import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
  */
 const PUBLIC_ID_LEN = 8;
 const SECRET_BYTES = 20;
+const SECRET_CHARS = 32;
+const LEGACY_SECRET_CHARS = 20;
 /** Crockford-ish base32: no padding, no vowels-to-digits confusion in logs. */
 const ALPHABET = '0123456789abcdefghjkmnpqrstvwxyz';
 function encode(bytes) {
@@ -33,7 +35,19 @@ export function mintSecret(prefix) {
 }
 /** A fresh tail under an EXISTING `keyPrefix`: what rotate() calls, so the row keeps its indexed identity. */
 export function rotateSecret(keyPrefix) {
-    const tail = encode(randomBytes(SECRET_BYTES));
+    // Encode all 160 random bits, instead of discarding three bits per byte.
+    const bytes = randomBytes(SECRET_BYTES);
+    let tail = '';
+    let bits = 0;
+    let buffer = 0;
+    for (const byte of bytes) {
+        buffer = (buffer << 8) | byte;
+        bits += 8;
+        while (bits >= 5) {
+            bits -= 5;
+            tail += ALPHABET[(buffer >>> bits) & 31];
+        }
+    }
     const secret = `${keyPrefix}${tail}`;
     return { secret, keyPrefix, secretHash: hashSecret(secret) };
 }
@@ -48,8 +62,8 @@ export function rotateSecret(keyPrefix) {
 export function keyPrefixOf(presented, prefix) {
     if (!presented.startsWith(prefix))
         return null;
-    const expected = prefix.length + PUBLIC_ID_LEN + SECRET_BYTES;
-    if (presented.length !== expected)
+    const tailLength = presented.length - prefix.length - PUBLIC_ID_LEN;
+    if (tailLength !== SECRET_CHARS && tailLength !== LEGACY_SECRET_CHARS)
         return null;
     return presented.slice(0, prefix.length + PUBLIC_ID_LEN);
 }

package/dist/issued/tables.d.ts

@@ -16,6 +16,16 @@
  * a lazily-declared drizzle table needs an `AnyPgColumn` callback and buys
  * nothing this package's own tests check, since the constraint that actually
  * runs is the one in the SQL migration.
+ *
+ * `environment` (#47) is not part of `SignableRow` -- unsigned metadata, same
+ * footing as `idempotencyKey`/`createdAt`. `0005_keys_environment.sql`'s
+ * extended `keys_issued_guard()` trigger is what keeps it trustworthy: set
+ * once at `issue()`, immutable for the row's life.
+ *
+ * `lastUsedAt`/`useCount` (#46, `0006_keys_usage.sql`) are the one pair on
+ * this row that is NOT set-once: `check()` writes both on every successful
+ * verification, so -- unlike `environment` -- `keys_issued_guard()` leaves
+ * them out of its immutable-columns check.
  */
 export declare const keysIssuedCredentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "keys_issued_credentials";
@@ -208,6 +218,23 @@ export declare const keysIssuedCredentials: import("drizzle-orm/pg-core").PgTabl
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        environment: import("drizzle-orm/pg-core").PgColumn<{
+            name: "environment";
+            tableName: "keys_issued_credentials";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "keys_issued_credentials";
@@ -242,6 +269,40 @@ export declare const keysIssuedCredentials: import("drizzle-orm/pg-core").PgTabl
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_used_at";
+            tableName: "keys_issued_credentials";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        useCount: import("drizzle-orm/pg-core").PgColumn<{
+            name: "use_count";
+            tableName: "keys_issued_credentials";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;

package/dist/issued/tables.js

@@ -17,6 +17,16 @@ import { bigint, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
  * a lazily-declared drizzle table needs an `AnyPgColumn` callback and buys
  * nothing this package's own tests check, since the constraint that actually
  * runs is the one in the SQL migration.
+ *
+ * `environment` (#47) is not part of `SignableRow` -- unsigned metadata, same
+ * footing as `idempotencyKey`/`createdAt`. `0005_keys_environment.sql`'s
+ * extended `keys_issued_guard()` trigger is what keeps it trustworthy: set
+ * once at `issue()`, immutable for the row's life.
+ *
+ * `lastUsedAt`/`useCount` (#46, `0006_keys_usage.sql`) are the one pair on
+ * this row that is NOT set-once: `check()` writes both on every successful
+ * verification, so -- unlike `environment` -- `keys_issued_guard()` leaves
+ * them out of its immutable-columns check.
  */
 export const keysIssuedCredentials = pgTable('keys_issued_credentials', {
     id: text('id').primaryKey(),
@@ -30,6 +40,9 @@ export const keysIssuedCredentials = pgTable('keys_issued_credentials', {
     signature: text('signature').notNull(),
     signingGenerationId: text('signing_generation_id').notNull(),
     idempotencyKey: text('idempotency_key'),
+    environment: text('environment').notNull(),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
     revokedAt: timestamp('revoked_at', { withTimezone: true }),
+    lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
+    useCount: bigint('use_count', { mode: 'number' }).notNull().default(0),
 });