@coffre/db 0.4.6 → 0.5.1

package/src/migrations/sqlite/meta/_journal.json

@@ -15,6 +15,20 @@
       "when": 1791242675074,
       "tag": "0001_mcp_approvals",
       "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1791619334012,
+      "tag": "0002_instance_roles",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1791676487593,
+      "tag": "0003_credential_scopes",
+      "breakpoints": true
     }
   ]
 }

package/src/schema.sqlite.ts

@@ -204,6 +204,8 @@ export const vaultMembers = sqliteTable(
     principal: text().primaryKey(),
     status: text().notNull(),
     owner: flag('owner').notNull().default(false),
+    role: text(),
+    scope: text(),
     generation: integer().notNull().default(0),
     createdAt: integer('created_at', { mode: 'number' }).notNull(),
     createdBy: text('created_by').notNull(),
@@ -478,6 +480,8 @@ export const serviceBindings = sqliteTable(
     jwksUri: text('jwks_uri').notNull(),
     // JSON, sorted by claim name.
     claims: text().notNull(),
+    // What the credentials it issues reach (`CredentialScope`), JSON; null on a binding of 0.4 the app has not sealed yet.
+    scope: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
@@ -637,6 +641,8 @@ export const credentials = sqliteTable(
     // The member it acts as, `user:<email>` or `token:<id>`, under the generation it was issued in.
     principal: text().notNull(),
     identityId: text('identity_id'),
+    // What a service token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
+    scope: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),

package/src/schema.ts

@@ -204,9 +204,15 @@ export const vaultMembers = pgTable(
   {
     principal: text().primaryKey(),
     status: text().notNull(),
-    // An instance owner, who manages every project and member. Root admins
+    // An owner of 0.4: an Admin, unless `role` says otherwise. Written as
+    // whether `role` administers, for a vault of 0.4 to read. Root admins
     // come from the vault's configuration, never from a row.
     owner: boolean().notNull().default(false),
+    // A person's instance role (`INSTANCE_ROLES` in @coffre/core/access),
+    // and where it applies, as JSON (`Scope`, projects by id); null on a row
+    // no vault of 0.5 has written, which `owner` says all of.
+    role: text(),
+    scope: text(),
     // Advanced by each removal. A session, token or linked account issued
     // under an older generation is dead, whatever its own row says.
     generation: integer().notNull().default(0),
@@ -519,6 +525,8 @@ export const serviceBindings = pgTable(
     jwksUri: text('jwks_uri').notNull(),
     // JSON, sorted by claim name.
     claims: text().notNull(),
+    // What the credentials it issues reach (`CredentialScope`), JSON; null on a binding of 0.4 the app has not sealed yet.
+    scope: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
@@ -702,6 +710,8 @@ export const credentials = pgTable(
     // The member it acts as, `user:<email>` or `token:<id>`, under the generation it was issued in.
     principal: text().notNull(),
     identityId: uuid('identity_id'),
+    // What a service token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
+    scope: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),