@coffre/db 0.8.1 → 0.9.0

package/src/migrations/sqlite/meta/_journal.json

@@ -71,6 +71,20 @@
       "when": 1792281880190,
       "tag": "0009_handles",
       "breakpoints": true
+    },
+    {
+      "idx": 10,
+      "version": "6",
+      "when": 1792315000277,
+      "tag": "0010_handle_places",
+      "breakpoints": true
+    },
+    {
+      "idx": 11,
+      "version": "6",
+      "when": 1792317461299,
+      "tag": "0011_plain_values",
+      "breakpoints": true
     }
   ]
 }

package/src/schema.sqlite.ts

@@ -177,6 +177,11 @@ export const secretVersions = sqliteTable(
     // and each says which half it holds: 'private' or 'public'.
     pairId: text('pair_id'),
     pairHalf: text('pair_half'),
+    // The value itself, for a plain one: a key marked not secret, an account's
+    // id, which whoever lists the environment sees and a read serves without
+    // the vault. Null for a secret. Its ciphertext is kept as any version's,
+    // for what opens values through the vault (a reference, a fork's copy).
+    plaintext: text(),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -671,6 +676,8 @@ export const credentials = sqliteTable(
     identityId: text('identity_id'),
     // What a service or personal token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
     scope: text(),
+    // The environments a handle was made for, by id, each with whether it was asked for as `@me`, JSON: null for any other credential, or a handle of 0.8.
+    places: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),

package/src/schema.ts

@@ -171,6 +171,11 @@ export const secretVersions = pgTable(
     // and each says which half it holds: 'private' or 'public'.
     pairId: uuid('pair_id'),
     pairHalf: text('pair_half'),
+    // The value itself, for a plain one: a key marked not secret, an account's
+    // id, which whoever lists the environment sees and a read serves without
+    // the vault. Null for a secret. Its ciphertext is kept as any version's,
+    // for what opens values through the vault (a reference, a fork's copy).
+    plaintext: text(),
   },
   (table) => [
     unique('secret_versions_secret_id_version_key').on(table.secretId, table.version),
@@ -745,6 +750,8 @@ export const credentials = pgTable(
     identityId: uuid('identity_id'),
     // What a service or personal token reaches (`CredentialScope`), JSON: null for a session, one a binding issued (its binding's), or one of 0.4 the app has not sealed yet.
     scope: text(),
+    // The environments a handle was made for, by id, each with whether it was asked for as `@me`, JSON: null for any other credential, or a handle of 0.8.
+    places: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),