-- Per-script Rhai sandbox overrides. Empty JSONB = use platform defaults.
-- Schema is shape-only: the manager validates field names + value ranges +
-- against the admin-set ceiling at write time. Storing JSONB lets us add
-- new knobs without a migration (and skip them cleanly on read).
--
-- Recognized fields:
--   max_operations     u64
--   max_string_size    u64
--   max_array_size     u64
--   max_map_size       u64
--   max_call_levels    u64
--   max_expr_depth     u64

ALTER TABLE scripts
    ADD COLUMN sandbox JSONB NOT NULL DEFAULT '{}'::jsonb;