@coffre/cli 0.1.13 → 0.1.15

package/README.md

@@ -2,6 +2,9 @@
 
 The `coffre` command: secrets in your shell, and a new deployment.
 
+The published CLI runs on Node 20 or newer. Developing coffre from its
+TypeScript sources and running a deployment require Node 24.
+
 ```sh
 npx @coffre/cli init --workers my-coffre   # or --node
 npx @coffre/cli setup                      # its database, keys and, on Workers, Cloudflare

package/dist/{connect-BXDkiWOL.js → connect-k2qEwjqZ.js}

@@ -1,2 +1,2 @@
-import { n as openDatabase, r as postgresConnection, t as engineOfUrl } from "./connect-tekAM4hC.js";
+import { n as openDatabase, r as postgresConnection, t as engineOfUrl } from "./connect-C4wevMJ5.js";
 export { engineOfUrl, openDatabase, postgresConnection };

package/dist/database-url-CJ9yqoi_.js

@@ -0,0 +1,213 @@
+import { r as hiddenLine } from "./tty-BDa14JX2.js";
+import { r as postgresConnection, t as engineOfUrl } from "./connect-C4wevMJ5.js";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+//#region ../db/dist/migrate.js
+/**
+* Bring a database up to date with its engine's migration tree:
+* migrations/postgres or migrations/sqlite. Both trees
+* describe one schema; see schema-parity.test.ts.
+*
+* Applied history must be a prefix of the local journal, byte for byte,
+* before and after. Only one migrator runs at a time: Postgres takes an
+* advisory lock, and SQLite's own write lock covers the
+* whole run. Restricted runtime roles are Postgres-only (baseline/postgres.sql).
+*/
+const MIGRATION_LOCK_KEY = "7165058122361679213";
+/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
+async function restrictDatabase(client) {
+	await client.query(`DO $$ BEGIN
+    EXECUTE format(
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
+      current_database()
+    );
+  END $$`);
+}
+/**
+* Beside this module: src/migrations in the workspace, and dist/migrations
+* in the built package, where the build copies them.
+*/
+function migrationsFolder(engine) {
+	return fileURLToPath(new URL(`./migrations/${engine}`, import.meta.url));
+}
+async function expectedMigrations(engine) {
+	const folder = migrationsFolder(engine);
+	const journal = JSON.parse(await readFile(`${folder}/meta/_journal.json`, "utf8"));
+	if (!Array.isArray(journal.entries)) throw new Error("invalid Drizzle migration journal");
+	const expected = await Promise.all(journal.entries.map(async (entry, position) => {
+		if (entry.idx !== position || !Number.isSafeInteger(entry.when) || typeof entry.tag !== "string" || !/^[a-zA-Z0-9_-]+$/.test(entry.tag)) throw new Error(`invalid Drizzle migration journal entry at index ${position}`);
+		const sqlText = await readFile(`${folder}/${entry.tag}.sql`, "utf8");
+		return {
+			createdAt: String(entry.when),
+			hash: createHash("sha256").update(sqlText).digest("hex"),
+			tag: entry.tag
+		};
+	}));
+	for (let index = 1; index < expected.length; index += 1) if (BigInt(expected[index - 1].createdAt) >= BigInt(expected[index].createdAt)) throw new Error("Drizzle migration journal timestamps must be strictly increasing");
+	return expected;
+}
+function verifyHistory(expected, applied, requireComplete) {
+	const rows = applied ?? [];
+	if (rows.length > expected.length) throw new Error("database contains migrations that are absent from this image");
+	if (requireComplete && rows.length !== expected.length) throw new Error(`migration history is incomplete: expected ${expected.length}, found ${rows.length}`);
+	rows.forEach((row, index) => {
+		const local = expected[index];
+		if (row.created_at !== local.createdAt || row.hash !== local.hash) throw new Error(`migration history diverged at ${local.tag}; applied migrations must never be edited`);
+	});
+}
+async function postgresMigrator(url) {
+	const [{ default: pg }, { drizzle }, { migrate }] = await Promise.all([
+		import("./esm-B69mMLcR.js"),
+		import("./node-postgres-BWEOOdc6.js"),
+		import("./migrator-W1a-ooWi.js")
+	]);
+	const pool = new pg.Pool({
+		...postgresConnection(url),
+		application_name: "coffre-migrations",
+		max: 1
+	});
+	const client = await pool.connect();
+	return {
+		async applied() {
+			if (!(await client.query("SELECT to_regclass('drizzle.__drizzle_migrations')::text AS relation")).rows[0]?.relation) return null;
+			return (await client.query("SELECT hash, created_at::text FROM drizzle.__drizzle_migrations ORDER BY created_at, id")).rows;
+		},
+		async lock() {
+			await client.query("SET lock_timeout = '5min'");
+			await client.query("SELECT pg_advisory_lock($1::bigint)", [MIGRATION_LOCK_KEY]);
+		},
+		async unlock() {
+			await client.query("SELECT pg_advisory_unlock($1::bigint)", [MIGRATION_LOCK_KEY]);
+		},
+		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
+		restrict: () => restrictDatabase(client),
+		async close() {
+			client.release();
+			await pool.end();
+		}
+	};
+}
+async function sqliteMigrator(url) {
+	const [{ openDatabase }, { migrate }] = await Promise.all([import("./connect-k2qEwjqZ.js"), import("drizzle-orm/libsql/migrator")]);
+	const { db, close } = await openDatabase(url);
+	const sqlite = db;
+	return {
+		async applied() {
+			if ((await sqlite.all("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = '__drizzle_migrations'")).length === 0) return null;
+			return sqlite.all("SELECT hash, CAST(created_at AS TEXT) AS created_at FROM __drizzle_migrations ORDER BY created_at, id");
+		},
+		async lock() {},
+		async unlock() {},
+		migrate: (migrationsFolder) => migrate(sqlite, { migrationsFolder }),
+		async restrict() {},
+		close
+	};
+}
+/**
+* Which of this version's migrations a database has applied, and which it
+* has not, without changing it or waiting on a migration under way. A
+* history that is not a prefix of this version's is refused, as
+* `migrateDatabase` refuses it.
+*/
+async function migrationStatus(url) {
+	const engine = engineOfUrl(url);
+	const expected = await expectedMigrations(engine);
+	const migrator = await {
+		postgres: postgresMigrator,
+		sqlite: sqliteMigrator
+	}[engine](url);
+	try {
+		const history = await migrator.applied();
+		verifyHistory(expected, history, false);
+		const applied = history?.length ?? 0;
+		return {
+			applied: expected.slice(0, applied).map((entry) => entry.tag),
+			pending: expected.slice(applied).map((entry) => entry.tag)
+		};
+	} finally {
+		await migrator.close();
+	}
+}
+/**
+* Apply missing migrations, check their history and reassert database
+* privileges. `onPlan` hears what there is to apply before it is, under
+* the migration lock, and may stop the run by throwing: all of it then goes
+* in one call, with no word of each.
+*/
+async function migrateDatabase(url, onPlan) {
+	const engine = engineOfUrl(url);
+	const expected = await expectedMigrations(engine);
+	const migrator = await {
+		postgres: postgresMigrator,
+		sqlite: sqliteMigrator
+	}[engine](url);
+	let locked = false;
+	try {
+		await migrator.lock();
+		locked = true;
+		const applied = await migrator.applied();
+		verifyHistory(expected, applied, false);
+		const done = applied?.length ?? 0;
+		await onPlan?.({
+			applied: done,
+			total: expected.length,
+			pending: expected.slice(done).map((entry) => entry.tag)
+		});
+		await migrator.migrate(migrationsFolder(engine));
+		verifyHistory(expected, await migrator.applied(), true);
+		await migrator.restrict();
+	} finally {
+		try {
+			if (locked) await migrator.unlock();
+		} finally {
+			await migrator.close();
+		}
+	}
+}
+//#endregion
+//#region src/database-url.ts
+/** Why there is no usable URL, said as it is. */
+var DatabaseUrlError = class extends Error {};
+/**
+* The connection string: from `variable`, from stdin when it is piped, or
+* typed at a hidden prompt. With it, every form of its secrets, as typed and
+* decoded, for the caller to keep out of anything it shows.
+*/
+async function readDatabaseUrl(out, s, asking) {
+	const given = process.env[asking.variable];
+	delete process.env[asking.variable];
+	let text;
+	if (given !== void 0 && given.trim() !== "") text = given.trim();
+	else if (!process.stdin.isTTY) {
+		const line = readFileSync(0, "utf8").split("\n").find((candidate) => candidate.trim() !== "");
+		if (line === void 0) throw new DatabaseUrlError(`no connection string: pipe it to stdin, or set ${asking.variable}`);
+		text = line.trim();
+	} else {
+		text = await hiddenLine(process.stdin, out, s, asking.question, asking.hint);
+		if (text === "") throw new DatabaseUrlError("no connection string given");
+	}
+	const url = databaseUrl(text, asking.command);
+	return {
+		url,
+		secrets: url.password === "" ? [text] : [
+			text,
+			url.password,
+			decodeURIComponent(url.password)
+		]
+	};
+}
+function databaseUrl(text, command) {
+	let url;
+	try {
+		url = new URL(text);
+	} catch {
+		throw new DatabaseUrlError("that is not a connection string, such as postgresql://user:password@host:5432/database");
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") throw new DatabaseUrlError(`${command} needs a Postgres connection string, postgresql://…`);
+	if (url.username === "" || url.hostname === "" || url.pathname.length <= 1) throw new DatabaseUrlError("the connection string must name a user, a host and a database");
+	return url;
+}
+//#endregion
+export { migrateDatabase as n, migrationStatus as r, readDatabaseUrl as t };