@coffre/db 0.4.5 → 0.5.0

package/dist/migrations/sqlite/meta/_journal.json

@@ -15,6 +15,20 @@
       "when": 1791242675074,
       "tag": "0001_mcp_approvals",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1791619334012,
+      "tag": "0002_instance_roles",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1791676487593,
+      "tag": "0003_credential_scopes",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-BqCB3XFm.js";
-import { t as Database } from "./database-edkMkG02.js";
+import { m as schema_d_exports } from "./schema-a7PkFgea.js";
+import { t as Database } from "./database-C63WjCrC.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-BqCB3XFm.d.ts → schema-a7PkFgea.d.ts}

@@ -811,6 +811,40 @@ declare const vaultMembers: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    role: import("drizzle-orm/pg-core").PgColumn<{
+      name: "role";
+      tableName: "vault_members";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    scope: import("drizzle-orm/pg-core").PgColumn<{
+      name: "scope";
+      tableName: "vault_members";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     generation: import("drizzle-orm/pg-core").PgColumn<{
       name: "generation";
       tableName: "vault_members";
@@ -2106,6 +2140,23 @@ declare const serviceBindings: import("drizzle-orm/pg-core").PgTableWithColumns<
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    scope: import("drizzle-orm/pg-core").PgColumn<{
+      name: "scope";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     label: import("drizzle-orm/pg-core").PgColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -3128,6 +3179,23 @@ declare const credentials: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    scope: import("drizzle-orm/pg-core").PgColumn<{
+      name: "scope";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
     label: import("drizzle-orm/pg-core").PgColumn<{
       name: "label";
       tableName: "credentials";

package/dist/schema-sqlite.d.ts

@@ -840,6 +840,44 @@ export declare const vaultMembers: import("drizzle-orm/sqlite-core").SQLiteTable
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    role: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "role";
+      tableName: "vault_members";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    scope: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "scope";
+      tableName: "vault_members";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     generation: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "generation";
       tableName: "vault_members";
@@ -2193,6 +2231,25 @@ export declare const serviceBindings: import("drizzle-orm/sqlite-core").SQLiteTa
     }, {}, {
       length: undefined;
     }>;
+    scope: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "scope";
+      tableName: "service_bindings";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "label";
       tableName: "service_bindings";
@@ -3237,6 +3294,25 @@ export declare const credentials: import("drizzle-orm/sqlite-core").SQLiteTableW
     }, {}, {
       length: number | undefined;
     }>;
+    scope: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "scope";
+      tableName: "credentials";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: false;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
     label: import("drizzle-orm/sqlite-core").SQLiteColumn<{
       name: "label";
       tableName: "credentials";

package/dist/schema-sqlite.js

@@ -148,6 +148,8 @@ const vaultMembers = sqliteTable("vault_members", {
 	principal: text().primaryKey(),
 	status: text().notNull(),
 	owner: flag("owner").notNull().default(false),
+	role: text(),
+	scope: text(),
 	generation: integer().notNull().default(0),
 	createdAt: integer("created_at", { mode: "number" }).notNull(),
 	createdBy: text("created_by").notNull(),
@@ -350,6 +352,7 @@ const serviceBindings = sqliteTable("service_bindings", {
 	issuer: text().notNull(),
 	jwksUri: text("jwks_uri").notNull(),
 	claims: text().notNull(),
+	scope: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),
@@ -467,6 +470,7 @@ const credentials = sqliteTable("credentials", {
 	generation: integer().notNull(),
 	principal: text().notNull(),
 	identityId: text("identity_id"),
+	scope: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-edkMkG02.js";
+import { i as Queryable } from "./database-C63WjCrC.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -8,32 +8,66 @@ import { count, sql } from "drizzle-orm";
 * too.
 */
 const KNOWN_MIGRATIONS = {
-	postgres: [{
-		"idx": 0,
-		"version": "7",
-		"when": 1791237720902,
-		"tag": "0000_baseline",
-		"breakpoints": true
-	}, {
-		"idx": 1,
-		"version": "7",
-		"when": 1791242674488,
-		"tag": "0001_mcp_approvals",
-		"breakpoints": true
-	}].map((entry) => entry.tag),
-	sqlite: [{
-		"idx": 0,
-		"version": "6",
-		"when": 1791237724735,
-		"tag": "0000_baseline",
-		"breakpoints": true
-	}, {
-		"idx": 1,
-		"version": "6",
-		"when": 1791242675074,
-		"tag": "0001_mcp_approvals",
-		"breakpoints": true
-	}].map((entry) => entry.tag)
+	postgres: [
+		{
+			"idx": 0,
+			"version": "7",
+			"when": 1791237720902,
+			"tag": "0000_baseline",
+			"breakpoints": true
+		},
+		{
+			"idx": 1,
+			"version": "7",
+			"when": 1791242674488,
+			"tag": "0001_mcp_approvals",
+			"breakpoints": true
+		},
+		{
+			"idx": 2,
+			"version": "7",
+			"when": 1791619333441,
+			"tag": "0002_instance_roles",
+			"breakpoints": true
+		},
+		{
+			"idx": 3,
+			"version": "7",
+			"when": 1791676486914,
+			"tag": "0003_credential_scopes",
+			"breakpoints": true
+		}
+	].map((entry) => entry.tag),
+	sqlite: [
+		{
+			"idx": 0,
+			"version": "6",
+			"when": 1791237724735,
+			"tag": "0000_baseline",
+			"breakpoints": true
+		},
+		{
+			"idx": 1,
+			"version": "6",
+			"when": 1791242675074,
+			"tag": "0001_mcp_approvals",
+			"breakpoints": true
+		},
+		{
+			"idx": 2,
+			"version": "6",
+			"when": 1791619334012,
+			"tag": "0002_instance_roles",
+			"breakpoints": true
+		},
+		{
+			"idx": 3,
+			"version": "6",
+			"when": 1791676487593,
+			"tag": "0003_credential_scopes",
+			"breakpoints": true
+		}
+	].map((entry) => entry.tag)
 };
 /**
 * Whether the database has applied every migration this version ships:

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-BqCB3XFm.js";
+import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-a7PkFgea.js";
 export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -169,6 +169,8 @@ const vaultMembers = pgTable("vault_members", {
 	principal: text().primaryKey(),
 	status: text().notNull(),
 	owner: boolean().notNull().default(false),
+	role: text(),
+	scope: text(),
 	generation: integer().notNull().default(0),
 	createdAt: bigint("created_at", { mode: "number" }).notNull(),
 	createdBy: text("created_by").notNull(),
@@ -398,6 +400,7 @@ const serviceBindings = pgTable("service_bindings", {
 	issuer: text().notNull(),
 	jwksUri: text("jwks_uri").notNull(),
 	claims: text().notNull(),
+	scope: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),
@@ -533,6 +536,7 @@ const credentials = pgTable("credentials", {
 	generation: integer().notNull(),
 	principal: text().notNull(),
 	identityId: uuid("identity_id"),
+	scope: text(),
 	label: text(),
 	createdAt: createdAt(),
 	createdBy: text("created_by").notNull(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.4.5",
+  "version": "0.5.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.4.5"
+    "@coffre/core": "0.5.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/dialect.ts

@@ -156,6 +156,20 @@ export function clockMillis(db: Queryable): SQL<number> {
   }
 }
 
+/**
+ * Whether a timestamp column is still ahead of the database clock as the
+ * statement runs: a condition, for a write that must not land once the
+ * time it names has passed.
+ */
+export function ahead(db: Queryable, column: SQLWrapper): SQL {
+  switch (engineOf(db)) {
+    case 'postgres':
+      return sql`${column} > clock_timestamp()`;
+    case 'sqlite':
+      return sql`${column} > CAST(unixepoch('subsec') * 1000 AS INTEGER)`;
+  }
+}
+
 /**
  * The migrator's own ledger, read by readiness to tell a database that is
  * up but not yet migrated from one that is ready. Drizzle keeps it in a