@coffre/db 0.4.6 → 0.5.1

package/dist/log.d.ts

@@ -1,5 +1,5 @@
-import { a as Transaction } from "./database-edkMkG02.js";
-import { LogKey } from "@coffre/core/audit";
+import { a as Transaction, i as Queryable } from "./database-C63WjCrC.js";
+import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
 /**
  * Appending to the audit log, the one table both the app and the vault
@@ -75,4 +75,394 @@ export declare function lockLogHead(tx: Transaction): Promise<{
  * commits. It throws to refuse.
  */
 export declare function appendEntries(tx: Transaction, key: LogKey, entries: readonly NewEntry[], check?: (tx: Transaction) => Promise<void>): Promise<Appended>;
+/** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
+export declare function entryColumns(db: Queryable): {
+  seq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: true;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  author: import("drizzle-orm/pg-core").PgColumn<{
+    name: "author";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  keyId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "key_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  occurredAt: import("drizzle-orm/pg-core").PgColumn<{
+    name: "occurred_at";
+    tableName: "audit_log";
+    dataType: "number";
+    columnType: "PgBigInt53";
+    data: number;
+    driverParam: string | number;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  actor: import("drizzle-orm/pg-core").PgColumn<{
+    name: "actor";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  action: import("drizzle-orm/pg-core").PgColumn<{
+    name: "action";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  decision: import("drizzle-orm/pg-core").PgColumn<{
+    name: "decision";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  code: import("drizzle-orm/pg-core").PgColumn<{
+    name: "code";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  subjectPrincipal: import("drizzle-orm/pg-core").PgColumn<{
+    name: "subject_principal";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  projectId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "project_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  environmentId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "environment_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  secretId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "secret_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  secretVersionId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "secret_version_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  operationId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "operation_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgUUID";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  requestId: import("drizzle-orm/pg-core").PgColumn<{
+    name: "request_id";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  sourceIp: import("drizzle-orm/pg-core").PgColumn<{
+    name: "source_ip";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  relatedSeq: import("drizzle-orm/pg-core").PgColumn<{
+    name: "related_seq";
+    tableName: "audit_log";
+    dataType: "bigint";
+    columnType: "PgBigInt64";
+    data: bigint;
+    driverParam: string;
+    notNull: false;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  metadata: import("drizzle-orm/pg-core").PgColumn<{
+    name: "metadata";
+    tableName: "audit_log";
+    dataType: "string";
+    columnType: "PgText";
+    data: string;
+    driverParam: string;
+    notNull: true;
+    hasDefault: true;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: [string, ...string[]];
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {}>;
+  prevHash: import("drizzle-orm/pg-core").PgColumn<{
+    name: "prev_hash";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+  mac: import("drizzle-orm/pg-core").PgColumn<{
+    name: "mac";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+  hash: import("drizzle-orm/pg-core").PgColumn<{
+    name: "hash";
+    tableName: "audit_log";
+    dataType: "custom";
+    columnType: "PgCustomColumn";
+    data: Buffer<ArrayBufferLike>;
+    driverParam: unknown;
+    notNull: true;
+    hasDefault: false;
+    isPrimaryKey: false;
+    isAutoincrement: false;
+    hasRuntimeDefault: false;
+    enumValues: undefined;
+    baseColumn: never;
+    identity: undefined;
+    generated: undefined;
+  }, {}, {
+    pgColumnBuilderBrand: "PgCustomColumnBuilderBrand";
+  }>;
+};
+/**
+ * How a reader tells the vault's own entries from those forged in its name:
+ * by their MAC, which only the vault holds the key to check. Each it finds
+ * forged goes to `forged`.
+ */
+export type Authenticity = {
+  authentic: (entry: StoredEntry) => boolean;
+  forged: (entry: StoredEntry) => void;
+};
+/** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
+export declare const LOOK_BACK: {
+  page: number;
+  pages: number;
+};
+/** What `newestAuthentic` finds: the entry, or why there is none. */
+export type Newest = StoredEntry | 'none' | 'forged' | 'unreached';
+/**
+ * The newest of the entries `page` reads, newest first and before a seq,
+ * that `check` finds authentic, read back a page at a time: 'none' when
+ * there are none at all, 'forged' when every one is in the vault's name but
+ * not its own, and 'unreached' once it has read LOOK_BACK such entries
+ * (1024), whether or not more are left.
+ */
+export declare function newestAuthentic(page: (before: bigint | undefined) => Promise<StoredEntry[]>, check: Authenticity): Promise<Newest>;
 //#endregion

package/dist/log.js

@@ -136,5 +136,57 @@ async function appendEntries(tx, key, entries, check) {
 		occurredAt: now
 	};
 }
+/** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
+function entryColumns(db) {
+	const { auditLog } = tablesOf(db);
+	return {
+		seq: auditLog.seq,
+		author: auditLog.author,
+		keyId: auditLog.keyId,
+		occurredAt: auditLog.occurredAt,
+		actor: auditLog.actor,
+		action: auditLog.action,
+		decision: auditLog.decision,
+		code: auditLog.code,
+		subjectPrincipal: auditLog.subjectPrincipal,
+		projectId: auditLog.projectId,
+		environmentId: auditLog.environmentId,
+		secretId: auditLog.secretId,
+		secretVersionId: auditLog.secretVersionId,
+		operationId: auditLog.operationId,
+		requestId: auditLog.requestId,
+		sourceIp: auditLog.sourceIp,
+		relatedSeq: auditLog.relatedSeq,
+		metadata: auditLog.metadata,
+		prevHash: auditLog.prevHash,
+		mac: auditLog.mac,
+		hash: auditLog.hash
+	};
+}
+/** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
+const LOOK_BACK = {
+	page: 32,
+	pages: 32
+};
+/**
+* The newest of the entries `page` reads, newest first and before a seq,
+* that `check` finds authentic, read back a page at a time: 'none' when
+* there are none at all, 'forged' when every one is in the vault's name but
+* not its own, and 'unreached' once it has read LOOK_BACK such entries
+* (1024), whether or not more are left.
+*/
+async function newestAuthentic(page, check) {
+	let before;
+	for (let read = 0; read < LOOK_BACK.pages; read += 1) {
+		const entries = await page(before);
+		for (const entry of entries) {
+			if (check.authentic(entry)) return entry;
+			check.forged(entry);
+		}
+		if (entries.length < LOOK_BACK.page) return before === void 0 && entries.length === 0 ? "none" : "forged";
+		before = entries.at(-1).seq;
+	}
+	return "unreached";
+}
 //#endregion
-export { LogHeadMismatch, LogRewound, appendEntries, forgetLogHeads, lockLogHead };
+export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic };

package/dist/migrate.d.ts

@@ -3,6 +3,40 @@ import { PoolClient } from "pg";
 //#region src/migrate.d.ts
 /** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
 export declare function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void>;
+/** An owner of coffre's objects whose privileges the login lacks: not a member of it, or one that does not inherit them. */
+export type ForeignOwner = {
+  name: string;
+  member: boolean;
+};
+/**
+ * The login cannot change coffre's objects, the ledger's schema, the tables
+ * and the functions: their owners are roles whose privileges it does not
+ * have, as neither one of them nor a member of one that inherits them.
+ * Postgres would refuse the first migration that touches one, "permission
+ * denied for schema drizzle"; this says whose login migrates, or what makes
+ * this one able to: on Postgres 16 and later, a membership that inherits,
+ * which each one's GRANT says; before, a membership, and a login that
+ * inherits (`ALTER ROLE … INHERIT`).
+ */
+export declare class NotOwner extends Error {
+  readonly login: string;
+  readonly owners: ForeignOwner[];
+  constructor(login: string, owners: ForeignOwner[], { grantsInherit, inherits }: {
+    grantsInherit: boolean;
+    inherits: boolean;
+  });
+}
+/** What coffre's migrations make and so change later: relations and functions, by name, in public. */
+type Managed = {
+  relations: string[];
+  functions: string[];
+};
+/**
+ * The names a migration's SQL makes: CREATE TABLE, VIEW, MATERIALIZED VIEW
+ * and SEQUENCE, and CREATE FUNCTION, in public. Unquoted, a name is folded
+ * to lower case, as Postgres folds it.
+ */
+export declare function managedObjects(sqlTexts: readonly string[]): Managed;
 /**
  * Beside this module: src/migrations in the workspace, and dist/migrations
  * in the built package, where the build copies them.
@@ -35,17 +69,20 @@ export type MigrationPlan = {
 };
 /**
  * Which of this version's migrations a database has applied, and which it
- * has not, without changing it or waiting on a migration under way. A
- * history that is not a prefix of this version's is refused, as
- * `migrateDatabase` refuses it.
+ * has not, without changing it or waiting on a migration under way; and
+ * whether this login could apply them (`notOwner`), as `migrateDatabase`
+ * requires: thrown, when it cannot read which. A history that is not a
+ * prefix of this version's is refused, as `migrateDatabase` refuses it.
  */
 export declare function migrationStatus(url: string): Promise<{
   applied: string[];
   pending: string[];
+  notOwner: NotOwner | null;
 }>;
 /**
  * Apply missing migrations, check their history and reassert database
- * privileges. `onPlan` hears what there is to apply before it is, under
+ * privileges, as a login that can change coffre's objects: another is
+ * refused, NotOwner, before anything changes. `onPlan` hears what there is to apply before it is, under
  * the migration lock, and may stop the run by throwing: all of it then goes
  * in one call, with no word of each.
  */

package/dist/migrate.js

@@ -25,6 +25,71 @@ async function restrictDatabase(client) {
   END $$`);
 }
 /**
+* The login cannot change coffre's objects, the ledger's schema, the tables
+* and the functions: their owners are roles whose privileges it does not
+* have, as neither one of them nor a member of one that inherits them.
+* Postgres would refuse the first migration that touches one, "permission
+* denied for schema drizzle"; this says whose login migrates, or what makes
+* this one able to: on Postgres 16 and later, a membership that inherits,
+* which each one's GRANT says; before, a membership, and a login that
+* inherits (`ALTER ROLE … INHERIT`).
+*/
+var NotOwner = class extends Error {
+	login;
+	owners;
+	constructor(login, owners, { grantsInherit, inherits }) {
+		const one = owners.length === 1;
+		const members = owners.every((owner) => owner.member);
+		const fixes = [...owners.filter((owner) => grantsInherit || !owner.member).map((owner) => `GRANT ${identifier(owner.name)} TO ${identifier(login)}${grantsInherit ? " WITH INHERIT TRUE" : ""}`), ...grantsInherit || inherits ? [] : [`ALTER ROLE ${identifier(login)} INHERIT`]];
+		super(`coffre's tables are owned by ${owners.map((owner) => owner.name).join(" and ")}, and this login, ${login}, ` + (members ? `is a member of ${one ? "it" : "them"} but does not inherit ${one ? "its" : "their"} privileges: ` : `is neither ${one ? "it nor a member of it" : "one nor a member of one"}: `) + `migrate with ${one ? `${owners[0].name}'s` : "their"} connection string, or, as a role that administers ${one ? "it" : "them"}, run ${fixes.join("; ")}`);
+		this.name = "NotOwner";
+		this.login = login;
+		this.owners = owners;
+	}
+};
+/** A role's name as SQL takes it: always quoted, as a keyword such as `user` must be. */
+function identifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/**
+* The names a migration's SQL makes: CREATE TABLE, VIEW, MATERIALIZED VIEW
+* and SEQUENCE, and CREATE FUNCTION, in public. Unquoted, a name is folded
+* to lower case, as Postgres folds it.
+*/
+function managedObjects(sqlTexts) {
+	const name = String.raw`(?:"?public"?\.)?(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))`;
+	const relation = new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:UNLOGGED\s+)?(?:TABLE|VIEW|MATERIALIZED\s+VIEW|SEQUENCE)\s+(?:IF\s+NOT\s+EXISTS\s+)?${name}`, "gi");
+	const fn = new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+${name}\s*\(`, "gi");
+	const names = (pattern) => [...new Set(sqlTexts.flatMap((text) => [...text.matchAll(pattern)].map(([, quoted, bare]) => quoted !== void 0 ? quoted.replace(/""/g, "\"") : bare.toLowerCase())))];
+	return {
+		relations: names(relation),
+		functions: names(fn)
+	};
+}
+/**
+* The owners of what migrations change, whose privileges the login lacks:
+* the drizzle schema and everything in it, and in public the relations and
+* functions coffre's migrations make ($1, $2), and nothing else of public,
+* which may hold a database's other tables. A superuser has every role's.
+*/
+const FOREIGN_OWNERS = `
+  WITH owned AS (
+    SELECT nspowner AS owner FROM pg_namespace WHERE nspname = 'drizzle'
+    UNION ALL
+    SELECT c.relowner FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
+        AND (n.nspname = 'drizzle' OR (n.nspname = 'public' AND c.relname = ANY($1::text[])))
+    UNION ALL
+    SELECT p.proowner FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = 'public' AND p.proname = ANY($2::text[])
+  )
+  SELECT DISTINCT r.rolname AS owner, pg_has_role(owned.owner, 'MEMBER') AS member, current_user AS login,
+    current_setting('server_version_num')::int >= 160000 AS grants_inherit,
+    (SELECT rolinherit FROM pg_roles WHERE rolname = current_user) AS inherits
+  FROM owned JOIN pg_roles r ON r.oid = owned.owner
+  WHERE NOT pg_has_role(owned.owner, 'USAGE')
+  ORDER BY r.rolname`;
+/**
 * Beside this module: src/migrations in the workspace, and dist/migrations
 * in the built package, where the build copies them.
 */
@@ -41,7 +106,8 @@ async function expectedMigrations(engine) {
 		return {
 			createdAt: String(entry.when),
 			hash: createHash("sha256").update(sqlText).digest("hex"),
-			tag: entry.tag
+			tag: entry.tag,
+			sql: sqlText
 		};
 	}));
 	for (let index = 1; index < expected.length; index += 1) if (BigInt(expected[index - 1].createdAt) >= BigInt(expected[index].createdAt)) throw new Error("Drizzle migration journal timestamps must be strictly increasing");
@@ -106,6 +172,18 @@ async function postgresMigrator(url) {
 		},
 		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
 		restrict: () => restrictDatabase(client),
+		async notOwner({ relations, functions }) {
+			const { rows } = await client.query(FOREIGN_OWNERS, [relations, functions]);
+			if (rows.length === 0) return null;
+			const [{ login, grants_inherit: grantsInherit, inherits }] = rows;
+			return new NotOwner(login, rows.map(({ owner, member }) => ({
+				name: owner,
+				member
+			})), {
+				grantsInherit,
+				inherits
+			});
+		},
 		async close() {
 			client.release();
 			await pool.end();
@@ -125,14 +203,16 @@ async function sqliteMigrator(url) {
 		async unlock() {},
 		migrate: (migrationsFolder) => migrate(sqlite, { migrationsFolder }),
 		async restrict() {},
+		notOwner: async () => null,
 		close
 	};
 }
 /**
 * Which of this version's migrations a database has applied, and which it
-* has not, without changing it or waiting on a migration under way. A
-* history that is not a prefix of this version's is refused, as
-* `migrateDatabase` refuses it.
+* has not, without changing it or waiting on a migration under way; and
+* whether this login could apply them (`notOwner`), as `migrateDatabase`
+* requires: thrown, when it cannot read which. A history that is not a
+* prefix of this version's is refused, as `migrateDatabase` refuses it.
 */
 async function migrationStatus(url) {
 	const engine = engineOfUrl(url);
@@ -142,12 +222,16 @@ async function migrationStatus(url) {
 		sqlite: sqliteMigrator
 	}[engine](url);
 	try {
-		const history = await migrator.applied();
+		const notOwner = await migrator.notOwner(managedObjects(expected.map((entry) => entry.sql)));
+		const history = await migrator.applied().catch((error) => {
+			throw notOwner ?? error;
+		});
 		verifyHistory(expected, history, false);
 		const applied = history?.length ?? 0;
 		return {
 			applied: expected.slice(0, applied).map((entry) => entry.tag),
-			pending: expected.slice(applied).map((entry) => entry.tag)
+			pending: expected.slice(applied).map((entry) => entry.tag),
+			notOwner
 		};
 	} finally {
 		await migrator.close();
@@ -155,7 +239,8 @@ async function migrationStatus(url) {
 }
 /**
 * Apply missing migrations, check their history and reassert database
-* privileges. `onPlan` hears what there is to apply before it is, under
+* privileges, as a login that can change coffre's objects: another is
+* refused, NotOwner, before anything changes. `onPlan` hears what there is to apply before it is, under
 * the migration lock, and may stop the run by throwing: all of it then goes
 * in one call, with no word of each.
 */
@@ -170,6 +255,8 @@ async function migrateDatabase(url, onPlan) {
 	try {
 		await migrator.lock();
 		locked = true;
+		const notOwner = await migrator.notOwner(managedObjects(expected.map((entry) => entry.sql)));
+		if (notOwner !== null) throw notOwner;
 		const applied = await migrator.applied();
 		verifyHistory(expected, applied, false);
 		const done = applied?.length ?? 0;
@@ -190,4 +277,4 @@ async function migrateDatabase(url, onPlan) {
 	}
 }
 //#endregion
-export { DatabaseAhead, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };
+export { DatabaseAhead, NotOwner, managedObjects, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };

package/dist/migrations/postgres/0002_instance_roles.sql

@@ -0,0 +1,4 @@
+ALTER TABLE "vault_members" ADD COLUMN "role" text;--> statement-breakpoint
+ALTER TABLE "vault_members" ADD COLUMN "scope" text;--> statement-breakpoint
+-- The vault sets a person's instance role and its scope, as it sets the rest of their row.
+GRANT UPDATE (role, scope) ON vault_members TO coffre_vault;