@synoikia/core 0.6.0 → 0.8.0

package/dist/db/schema.d.ts

@@ -1,3 +1,150 @@
+export declare const roles: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "roles";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        name: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "name";
+            tableName: "roles";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        builtIn: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "roles";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        canSetOwnLevels: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "roles";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        canManageOwnRules: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "roles";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        canSeeStatus: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "roles";
+            dataType: "boolean";
+            columnType: "SQLiteBoolean";
+            data: boolean;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "roles";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "roles";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
 export declare const users: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
     name: "users";
     schema: undefined;
@@ -218,6 +365,44 @@ export declare const users: import("drizzle-orm/sqlite-core").SQLiteTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        roleId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "role_id";
+            tableName: "users";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        registeredVia: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "registered_via";
+            tableName: "users";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "oidc" | "external" | "signup";
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["oidc", "external", "signup"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
     };
     dialect: "sqlite";
 }>;
@@ -2584,6 +2769,25 @@ export declare const preApprovalRules: import("drizzle-orm/sqlite-core").SQLiteT
         }, {}, {
             length: number | undefined;
         }>;
+        ownerUserId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "owner_user_id";
+            tableName: "pre_approval_rules";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
         createdAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
             name: string;
             tableName: "pre_approval_rules";
@@ -3068,6 +3272,25 @@ export declare const pendingApprovals: import("drizzle-orm/sqlite-core").SQLiteT
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        ownerUserId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "owner_user_id";
+            tableName: "pending_approvals";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
     };
     dialect: "sqlite";
 }>;
@@ -3371,6 +3594,349 @@ export declare const auditLog: import("drizzle-orm/sqlite-core").SQLiteTableWith
     };
     dialect: "sqlite";
 }>;
+/** The endpoints a role has; outside them its users reach nothing. */
+export declare const roleInstances: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "role_instances";
+    schema: undefined;
+    columns: {
+        roleId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "role_id";
+            tableName: "role_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        instanceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "instance_id";
+            tableName: "role_instances";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** A role's maximum level for one group or one operation (exactly one is set); no row means None. */
+export declare const roleLevels: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "role_levels";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        roleId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "role_id";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        instanceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "instance_id";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        groupId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "group_id";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        operationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "operation_id";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        level: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "level";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "none" | "read" | "ask" | "write";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "read", "ask", "write"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        changedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "role_levels";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        changedBy: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "changed_by";
+            tableName: "role_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+    };
+    dialect: "sqlite";
+}>;
+/** A user's own level for one group or one operation, capped by their role's maximum. */
+export declare const userLevels: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+    name: "user_levels";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "id";
+            tableName: "user_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        userId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "user_id";
+            tableName: "user_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        instanceId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "instance_id";
+            tableName: "user_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        groupId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "group_id";
+            tableName: "user_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        operationId: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "operation_id";
+            tableName: "user_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        level: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: "level";
+            tableName: "user_levels";
+            dataType: "string";
+            columnType: "SQLiteText";
+            data: "none" | "read" | "ask" | "write";
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: ["none", "read", "ask", "write"];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: number | undefined;
+        }>;
+        changedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+            name: string;
+            tableName: "user_levels";
+            dataType: "date";
+            columnType: "SQLiteTimestamp";
+            data: Date;
+            driverParam: number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "sqlite";
+}>;
 export declare const mcpTokens: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
     name: "mcp_tokens";
     schema: undefined;

package/dist/db/schema.js

@@ -1,5 +1,6 @@
 import { sql } from 'drizzle-orm';
 import { blob, index, integer, sqliteTable, text, uniqueIndex } from 'drizzle-orm/sqlite-core';
+import { ADMIN_ROLE_ID } from '../gate/access.js';
 /** The SQLite schema (design §7.1): JSON as TEXT, timestamps as epoch ms, secrets as AES-256-GCM blobs. */
 const id = () => text('id').primaryKey();
 const ts = (name) => integer(name, { mode: 'timestamp_ms' });
@@ -9,6 +10,16 @@ const createdAt = () => ts('created_at')
 const flag = (name) => integer(name, { mode: 'boolean' });
 const json = (name) => text(name, { mode: 'json' });
 // ── identity & admin auth ────────────────────────────────────────────────────────────────────────
+export const roles = sqliteTable('roles', {
+    id: id(),
+    name: text('name').notNull().unique(),
+    builtIn: flag('built_in').notNull().default(false),
+    canSetOwnLevels: flag('can_set_own_levels').notNull().default(false),
+    canManageOwnRules: flag('can_manage_own_rules').notNull().default(false),
+    canSeeStatus: flag('can_see_status').notNull().default(false),
+    createdAt: createdAt(),
+    updatedAt: ts('updated_at'),
+});
 export const users = sqliteTable('users', {
     id: id(),
     username: text('username').notNull().unique(),
@@ -23,6 +34,10 @@ export const users = sqliteTable('users', {
     createdAt: createdAt(),
     lastLoginAt: ts('last_login_at'),
     disabled: flag('disabled').notNull().default(false),
+    /** References `roles`; SQLite can't add that constraint to an existing table, so RoleService keeps it. */
+    roleId: text('role_id').notNull().default(ADMIN_ROLE_ID),
+    /** How the user came to exist without an admin (design §6.5); null: an admin or setup made it. */
+    registeredVia: text('registered_via', { enum: ['oidc', 'external', 'signup'] }),
 });
 export const sessions = sqliteTable('sessions', {
     idHash: text('id_hash').primaryKey(),
@@ -217,6 +232,8 @@ export const preApprovalRules = sqliteTable('pre_approval_rules', {
     reason: text('reason').notNull(),
     enabled: flag('enabled').notNull().default(true),
     createdBy: text('created_by').references(() => users.id),
+    /** Null: an admin rule for every caller. Set: applies only to this user's calls (design §6.4). */
+    ownerUserId: text('owner_user_id').references(() => users.id),
     createdAt: createdAt(),
     updatedAt: ts('updated_at'),
     lastTriggeredAt: ts('last_triggered_at'),
@@ -258,6 +275,8 @@ export const pendingApprovals = sqliteTable('pending_approvals', {
     /** `url`: decided by a signed-in human on the approval page; `elicitation`: by the MCP client (opt-in). */
     decidedVia: text('decided_via', { enum: ['elicitation', 'url'] }),
     decidedAt: ts('decided_at'),
+    /** The user who owns the calling credential: the only one who may decide on the page (design §5.3). */
+    ownerUserId: text('owner_user_id').references(() => users.id),
 });
 /** Append-only: no API updates or deletes rows (design §7.3). */
 export const auditLog = sqliteTable('audit_log', {
@@ -278,6 +297,51 @@ export const auditLog = sqliteTable('audit_log', {
     durationMs: integer('duration_ms'),
     detail: json('detail'),
 }, (t) => [index('audit_at_idx').on(t.at), index('audit_instance_at_idx').on(t.instanceId, t.at)]);
+// ── roles (design §6.4) ──────────────────────────────────────────────────────────────────────────
+/** The endpoints a role has; outside them its users reach nothing. */
+export const roleInstances = sqliteTable('role_instances', {
+    roleId: text('role_id')
+        .notNull()
+        .references(() => roles.id, { onDelete: 'cascade' }),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+}, (t) => [uniqueIndex('role_instances_idx').on(t.roleId, t.instanceId)]);
+/** A role's maximum level for one group or one operation (exactly one is set); no row means None. */
+export const roleLevels = sqliteTable('role_levels', {
+    id: id(),
+    roleId: text('role_id')
+        .notNull()
+        .references(() => roles.id, { onDelete: 'cascade' }),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    groupId: text('group_id').references(() => operationGroups.id, { onDelete: 'cascade' }),
+    operationId: text('operation_id').references(() => operations.id, { onDelete: 'cascade' }),
+    level: text('level', { enum: ['none', 'read', 'ask', 'write'] }).notNull(),
+    changedAt: ts('changed_at'),
+    changedBy: text('changed_by').references(() => users.id, { onDelete: 'set null' }),
+}, (t) => [
+    uniqueIndex('role_levels_group_idx').on(t.roleId, t.groupId),
+    uniqueIndex('role_levels_op_idx').on(t.roleId, t.operationId),
+]);
+/** A user's own level for one group or one operation, capped by their role's maximum. */
+export const userLevels = sqliteTable('user_levels', {
+    id: id(),
+    userId: text('user_id')
+        .notNull()
+        .references(() => users.id, { onDelete: 'cascade' }),
+    instanceId: text('instance_id')
+        .notNull()
+        .references(() => pluginInstances.id, { onDelete: 'cascade' }),
+    groupId: text('group_id').references(() => operationGroups.id, { onDelete: 'cascade' }),
+    operationId: text('operation_id').references(() => operations.id, { onDelete: 'cascade' }),
+    level: text('level', { enum: ['none', 'read', 'ask', 'write'] }).notNull(),
+    changedAt: ts('changed_at'),
+}, (t) => [
+    uniqueIndex('user_levels_group_idx').on(t.userId, t.groupId),
+    uniqueIndex('user_levels_op_idx').on(t.userId, t.operationId),
+]);
 // ── MCP client auth ──────────────────────────────────────────────────────────────────────────────
 export const mcpTokens = sqliteTable('mcp_tokens', {
     id: id(),