@coffre/db 0.14.2 → 0.14.4

package/dist/migrations/sqlite/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1792835446455,
       "tag": "0016_capped_alerts",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1793017781451,
+      "tag": "0017_vault_releases",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
-import { t as Database } from "./database-Ds1Y79h6.js";
+import { g as schema_d_exports } from "./schema-z8GcN_Xu.js";
+import { t as Database } from "./database-CFhTnnzM.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -1292,6 +1292,80 @@ export declare const vaultGrants: import("drizzle-orm/sqlite-core").SQLiteTableW
   };
   dialect: "sqlite";
 }>;
+/**
+ * Each key the vault released to a principal, and when last: what its bulk
+ * limit counts (R28), the distinct keys released within a window, without
+ * reading the log. The database keeps it from the log itself, in the
+ * transaction of each vault `secret.read` allowed: a trigger on
+ * `audit_log` upserts a row for each key the entry names, as the count
+ * read them from the entries before (an entry that names none, which only
+ * a forged one is, counts as a key of its own, `entry:<seq>`). No login
+ * writes it: the vault and the backup read it. A row a window old counts
+ * for nothing, so nothing prunes them: there are at most as many as
+ * principals times keys, and a count reads one principal's.
+ */
+export declare const vaultReleases: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "vault_releases";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "principal";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "key";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    releasedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "released_at";
+      tableName: "vault_releases";
+      dataType: "number";
+      columnType: "SQLiteInteger";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 export declare const auditLog: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "audit_log";
   schema: undefined;

package/dist/schema-sqlite.js

@@ -214,6 +214,26 @@ const vaultGrants = sqliteTable("vault_grants", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
+/**
+* Each key the vault released to a principal, and when last: what its bulk
+* limit counts (R28), the distinct keys released within a window, without
+* reading the log. The database keeps it from the log itself, in the
+* transaction of each vault `secret.read` allowed: a trigger on
+* `audit_log` upserts a row for each key the entry names, as the count
+* read them from the entries before (an entry that names none, which only
+* a forged one is, counts as a key of its own, `entry:<seq>`). No login
+* writes it: the vault and the backup read it. A row a window old counts
+* for nothing, so nothing prunes them: there are at most as many as
+* principals times keys, and a count reads one principal's.
+*/
+const vaultReleases = sqliteTable("vault_releases", {
+	principal: text().notNull(),
+	key: text().notNull(),
+	releasedAt: integer("released_at", { mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "vault_releases_pkey",
+	columns: [table.principal, table.key]
+})]);
 const auditLog = sqliteTable("audit_log", {
 	seq: int64("seq").primaryKey(),
 	author: text().notNull(),
@@ -616,4 +636,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-Ds1Y79h6.js";
+import { i as Queryable } from "./database-CFhTnnzM.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -141,6 +141,20 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792871149580,
 			"tag": "0018_rotate_app_key",
 			"breakpoints": true
+		},
+		{
+			"idx": 19,
+			"version": "7",
+			"when": 1792937576477,
+			"tag": "0019_backup_role",
+			"breakpoints": true
+		},
+		{
+			"idx": 20,
+			"version": "7",
+			"when": 1793017780802,
+			"tag": "0020_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -262,6 +276,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792835446455,
 			"tag": "0016_capped_alerts",
 			"breakpoints": true
+		},
+		{
+			"idx": 17,
+			"version": "6",
+			"when": 1793017781451,
+			"tag": "0017_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/{schema-DcVkJhCf.d.ts → schema-z8GcN_Xu.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -1238,6 +1238,76 @@ declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * Each key the vault released to a principal, and when last: what its bulk
+ * limit counts (R28), the distinct keys released within a window, without
+ * reading the log. The database keeps it from the log itself, in the
+ * transaction of each vault `secret.read` allowed: a trigger on
+ * `audit_log` upserts a row for each key the entry names, as the count
+ * read them from the entries before (an entry that names none, which only
+ * a forged one is, counts as a key of its own, `entry:<seq>`). No login
+ * writes it: the vault and the backup read it. A row a window old counts
+ * for nothing, so nothing prunes them: there are at most as many as
+ * principals times keys, and a count reads one principal's.
+ */
+declare const vaultReleases: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "vault_releases";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    key: import("drizzle-orm/pg-core").PgColumn<{
+      name: "key";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    releasedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "released_at";
+      tableName: "vault_releases";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "audit_log";
   schema: undefined;
@@ -4125,4 +4195,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, serviceBindings as x, secrets as y };
+export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, vaultReleases as w, serviceBindings as x, secrets as y };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, x as serviceBindings, y as secrets } from "./schema-DcVkJhCf.js";
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, w as vaultReleases, x as serviceBindings, y as secrets } from "./schema-z8GcN_Xu.js";
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema.js

@@ -25,7 +25,8 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	secretsRelations: () => secretsRelations,
 	serviceBindings: () => serviceBindings,
 	vaultGrants: () => vaultGrants,
-	vaultMembers: () => vaultMembers
+	vaultMembers: () => vaultMembers,
+	vaultReleases: () => vaultReleases
 });
 const bytea = customType({ dataType: () => "bytea" });
 const createdAt = () => timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
@@ -240,6 +241,26 @@ const vaultGrants = pgTable("vault_grants", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
+/**
+* Each key the vault released to a principal, and when last: what its bulk
+* limit counts (R28), the distinct keys released within a window, without
+* reading the log. The database keeps it from the log itself, in the
+* transaction of each vault `secret.read` allowed: a trigger on
+* `audit_log` upserts a row for each key the entry names, as the count
+* read them from the entries before (an entry that names none, which only
+* a forged one is, counts as a key of its own, `entry:<seq>`). No login
+* writes it: the vault and the backup read it. A row a window old counts
+* for nothing, so nothing prunes them: there are at most as many as
+* principals times keys, and a count reads one principal's.
+*/
+const vaultReleases = pgTable("vault_releases", {
+	principal: text().notNull(),
+	key: text().notNull(),
+	releasedAt: bigint("released_at", { mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "vault_releases_pkey",
+	columns: [table.principal, table.key]
+})]);
 const auditLog = pgTable("audit_log", {
 	seq: bigint({ mode: "bigint" }).primaryKey(),
 	author: text().notNull(),
@@ -698,4 +719,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers, vaultReleases };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.14.2",
+  "version": "0.14.4",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.14.2"
+    "@coffre/core": "0.14.4"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/dialect.ts

@@ -39,11 +39,12 @@ export function engineOf(db: Queryable): Engine {
  *
  * `no key update` is for rows others reference by foreign key: it keeps out
  * every other writer of the row, but not an insert that points at it.
+ * `share` keeps out every writer, but not another `share`.
  */
-export function forUpdate<Query extends { for: (strength: 'update' | 'no key update') => unknown }>(
+export function forUpdate<Query extends { for: (strength: 'update' | 'no key update' | 'share') => unknown }>(
   db: Queryable,
   query: Query,
-  strength: 'update' | 'no key update' = 'update',
+  strength: 'update' | 'no key update' | 'share' = 'update',
 ): ReturnType<Query['for']> {
   if (engineOf(db) === 'sqlite') return query as ReturnType<Query['for']>;
   return query.for(strength) as ReturnType<Query['for']>;

package/src/migrate-main.ts

@@ -1,8 +1,11 @@
-// `pnpm db:migrate`: the workspace's own migrator, for dev
-// and the tests. A deployment runs `coffre-server migrate`.
+// `pnpm db:migrate [--backup-login <role>]`: the workspace's own migrator,
+// for dev and the tests. A deployment runs `coffre-server migrate`.
+import { parseArgs } from 'node:util';
+
 import { migrateDatabase } from './migrate.ts';
 
 const url = process.env.DATABASE_URL?.trim();
 if (!url) throw new Error('DATABASE_URL is required');
-await migrateDatabase(url);
+const { values } = parseArgs({ options: { 'backup-login': { type: 'string' } }, strict: true });
+await migrateDatabase(url, { backupLogin: values['backup-login'] });
 console.log('database schema is up to date');

package/src/migrate.ts

@@ -24,12 +24,33 @@ const MIGRATION_LOCK_KEY = '7165058122361679213';
 export async function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void> {
   await client.query(`DO $$ BEGIN
     EXECUTE format(
-      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime, coffre_backup',
       current_database()
     );
   END $$`);
 }
 
+/** Why `login` cannot be the backup login, before anything runs, or null when it may. */
+export function backupLoginProblem(login: string): string | null {
+  if (login === '') return 'the backup login is empty: name the role to grant coffre_backup';
+  if (['coffre_backup', 'coffre_app', 'coffre_vault', 'coffre_runtime', 'coffre_vault_runtime'].includes(login)) {
+    return `the backup login is ${login}, one of coffre's own roles: name the login that backs up`;
+  }
+  return null;
+}
+
+/**
+ * The migrations are applied, by this run or an earlier one, and their
+ * ledger checked, but reasserting the privileges after them failed: unlike
+ * a migration's failure, this one may have changed the database.
+ */
+export class AfterMigrations extends Error {
+  constructor(error: unknown) {
+    super(`the database is at the migrated schema, but reasserting its privileges failed: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    this.name = 'AfterMigrations';
+  }
+}
+
 interface JournalEntry {
   idx: number;
   when: number;
@@ -55,8 +76,8 @@ interface Migrator {
   lock(): Promise<void>;
   unlock(): Promise<void>;
   migrate(migrationsFolder: string): Promise<void>;
-  /** Reassert privileges a one-database backup does not carry. */
-  restrict(): Promise<void>;
+  /** Reassert privileges a one-database backup does not carry, and grant `backupLogin` the backup group (0019_backup_role.sql). */
+  restrict(backupLogin: string | undefined): Promise<void>;
   /** Why this login cannot change the objects migrations change, `managed` among them, or null when it can. */
   notOwner(managed: Managed): Promise<NotOwner | null>;
   close(): Promise<void>;
@@ -264,7 +285,15 @@ async function postgresMigrator(url: string): Promise<Migrator> {
       await client.query('SELECT pg_advisory_unlock($1::bigint)', [MIGRATION_LOCK_KEY]);
     },
     migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
-    restrict: () => restrictDatabase(client),
+    async restrict(backupLogin) {
+      await restrictDatabase(client);
+      if (backupLogin !== undefined) {
+        // Compared as text: as a name, Postgres would cut it to 63 bytes, and grant whichever role bears the cut.
+        const { rowCount } = await client.query('SELECT 1 FROM pg_roles WHERE rolname::text = $1', [backupLogin]);
+        if (rowCount === 0) throw new Error(`role ${client.escapeIdentifier(backupLogin)} does not exist: make it, coffre never does`);
+        await client.query(`GRANT coffre_backup TO ${client.escapeIdentifier(backupLogin)} WITH ADMIN FALSE, INHERIT TRUE, SET FALSE`);
+      }
+    },
     async notOwner({ relations, functions }) {
       const { rows } = await client.query<{ owner: string; member: boolean; login: string; grants_inherit: boolean; inherits: boolean }>(FOREIGN_OWNERS, [relations, functions]);
       if (rows.length === 0) return null;
@@ -342,17 +371,23 @@ export async function migrationStatus(url: string): Promise<{ applied: string[];
 }
 
 /**
- * Apply missing migrations, check their history and reassert database
- * privileges, as a login that can change coffre's objects: another is
- * refused, NotOwner, before anything changes. `onPlan` hears what there is to apply before it is, under
+ * Apply missing migrations, check their history, and reassert database
+ * privileges, on every run, even with nothing to apply, as a login that can
+ * change coffre's objects: another is refused, NotOwner, before anything
+ * changes. `onPlan` hears what there is to apply before it is, under
  * the migration lock, and may stop the run by throwing: all of it then goes
- * in one call, with no word of each.
+ * in one call, with no word of each. `backupLogin` names an existing role to
+ * grant the backup group, `coffre_backup`, on Postgres; it is never made, and
+ * never revoked when a later run names none.
  */
 export async function migrateDatabase(
   url: string,
-  onPlan?: (plan: MigrationPlan) => void | Promise<void>,
+  { onPlan, backupLogin }: { onPlan?: (plan: MigrationPlan) => void | Promise<void>; backupLogin?: string } = {},
 ): Promise<void> {
   const engine = engineOfUrl(url);
+  const problem = backupLogin === undefined ? null : backupLoginProblem(backupLogin);
+  if (problem !== null) throw new Error(problem);
+  if (engine === 'sqlite' && backupLogin !== undefined) throw new Error('SQLite has no roles, so no backup login');
   const expected = await expectedMigrations(engine);
   const migrator = await { postgres: postgresMigrator, sqlite: sqliteMigrator }[engine](url);
   let locked = false;
@@ -369,7 +404,11 @@ export async function migrateDatabase(
     await onPlan?.({ applied: done, total: expected.length, pending: expected.slice(done).map((entry) => entry.tag) });
     await migrator.migrate(migrationsFolder(engine));
     verifyHistory(expected, await migrator.applied(), true);
-    await migrator.restrict();
+    try {
+      await migrator.restrict(backupLogin);
+    } catch (error) {
+      throw new AfterMigrations(error);
+    }
   } finally {
     try {
       if (locked) await migrator.unlock();

package/src/migrations/postgres/0019_backup_role.sql

@@ -0,0 +1,63 @@
+-- Backups (W2356): the group coffre_backup reads every row and writes none, so a nightly pg_dump need not hold the owner's password. No login is made or granted here: `coffre migrate --backup-login <role>` grants the group to the role it names. Reading every table is not enough: the audit log's row-level security shows its rows only to the roles a policy names, so pg_dump as a role that reads every table (pg_read_all_data) is refused the log, or with --enable-row-security dumps no entry. It only adds a role, read grants and a read policy: the release before never meets them.
+DO $$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_backup') THEN
+        -- No migration since the baseline made a role: a login that migrates as a member of the owner inherits its privileges, never its CREATEROLE.
+        IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND (rolsuper OR rolcreaterole)) THEN
+            RAISE EXCEPTION '% may not create roles, and this migration makes coffre_backup: migrate as a login with CREATEROLE, or have one run CREATE ROLE coffre_backup NOLOGIN; GRANT coffre_backup TO % WITH ADMIN TRUE, INHERIT FALSE, SET FALSE first', current_user, current_user;
+        END IF;
+        -- Roles are the server's, and the migration lock each database's: another database's 0019 may make it meanwhile.
+        BEGIN
+            CREATE ROLE coffre_backup NOLOGIN INHERIT NOCREATEDB NOCREATEROLE;
+        EXCEPTION WHEN duplicate_object OR unique_violation THEN
+            NULL;
+        END;
+    END IF;
+    -- Managed owners cannot ALTER the superuser-only attributes, even to turn them off.
+    IF EXISTS (
+        SELECT 1 FROM pg_roles WHERE rolname = 'coffre_backup'
+        AND (rolsuper OR rolreplication OR rolbypassrls)
+    ) THEN
+        RAISE EXCEPTION 'coffre_backup has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off';
+    END IF;
+    -- It would pass on what it is a member of to its members.
+    IF EXISTS (SELECT 1 FROM pg_auth_members WHERE member = 'coffre_backup'::regrole) THEN
+        RAISE EXCEPTION 'coffre_backup is a member of another role, whose privileges its members would inherit: revoke its memberships';
+    END IF;
+    -- Revoking cannot take an owner's rights away: its members would write what it owns.
+    IF EXISTS (
+        SELECT 1 FROM pg_shdepend
+         WHERE refclassid = 'pg_authid'::regclass AND refobjid = 'coffre_backup'::regrole AND deptype = 'o'
+    ) THEN
+        RAISE EXCEPTION 'coffre_backup owns database objects, which its members could change: reassign them';
+    END IF;
+    -- Only when it must: altering a role takes CREATEROLE too.
+    IF EXISTS (
+        SELECT 1 FROM pg_roles WHERE rolname = 'coffre_backup'
+        AND (rolcanlogin OR NOT rolinherit OR rolcreatedb OR rolcreaterole)
+    ) THEN
+        ALTER ROLE coffre_backup NOLOGIN INHERIT NOCREATEDB NOCREATEROLE;
+    END IF;
+END
+$$;
+--> statement-breakpoint
+-- coffre's own, by name, as the baseline grants: public may hold a database's other tables (FOREIGN_OWNERS in migrate.ts), which are not coffre's to grant, whichever login migrates, a superuser included. A group made before this keeps no other privilege on them. A later migration that makes a table grants it SELECT too, as it grants coffre_app, rather than default privileges, which would give it every table the login makes, coffre's or not, and none another login makes.
+REVOKE ALL ON SCHEMA public, drizzle FROM coffre_backup;
+--> statement-breakpoint
+GRANT USAGE ON SCHEMA public, drizzle TO coffre_backup;
+--> statement-breakpoint
+REVOKE ALL ON audit_chain_head, audit_log, capped_alerts, consumed_tokens, credentials, device_authorizations, dismissed_keys, enrollments, environments, identities, mcp_approvals, mcp_connections, oauth_clients, projects, secret_references, secret_versions, secrets, service_bindings, vault_grants, vault_members FROM coffre_backup;
+--> statement-breakpoint
+REVOKE ALL ON ALL TABLES IN SCHEMA drizzle FROM coffre_backup;
+--> statement-breakpoint
+REVOKE ALL ON ALL SEQUENCES IN SCHEMA drizzle FROM coffre_backup;
+--> statement-breakpoint
+REVOKE ALL ON FUNCTION audit_log_append_only(), secret_versions_erase_only(), prune_consumed_tokens(integer) FROM coffre_backup;
+--> statement-breakpoint
+GRANT SELECT ON audit_chain_head, audit_log, capped_alerts, consumed_tokens, credentials, device_authorizations, dismissed_keys, enrollments, environments, identities, mcp_approvals, mcp_connections, oauth_clients, projects, secret_references, secret_versions, secrets, service_bindings, vault_grants, vault_members TO coffre_backup;
+--> statement-breakpoint
+GRANT SELECT ON ALL TABLES IN SCHEMA drizzle TO coffre_backup;
+--> statement-breakpoint
+GRANT SELECT ON ALL SEQUENCES IN SCHEMA drizzle TO coffre_backup;
+--> statement-breakpoint
+CREATE POLICY audit_log_backup_read ON audit_log FOR SELECT TO coffre_backup USING (true);

package/src/migrations/postgres/0020_vault_releases.sql

@@ -0,0 +1,36 @@
+-- Releases (W199): each key the vault released to a principal, and when last, so that its bulk limit counts the keys released within a window from a row per key, not from every read the principal ever made. The database keeps it, from each vault `secret.read` allowed, in the append's own transaction; the release before neither reads it nor knows it is kept, and its appends keep it too.
+CREATE TABLE "vault_releases" (
+	"principal" text NOT NULL,
+	"key" text NOT NULL,
+	"released_at" bigint NOT NULL,
+	CONSTRAINT "vault_releases_pkey" PRIMARY KEY("principal","key")
+);
+--> statement-breakpoint
+-- Room in each page for the next version of its rows: a read moves its keys' times on in place (a HOT update), so the
+-- table and its key stay a row a key, however often each is read: the page prunes the versions before as it is read.
+ALTER TABLE vault_releases SET (fillfactor = 50);--> statement-breakpoint
+-- Each key the entry names, as the count read them before: the secret, or each item of a read's list at one place, or, for an entry that names none, which only a forged one is, the entry itself. As the owner, so that no login may write the table: the vault's appends reach it only through the log.
+CREATE FUNCTION vault_releases_keep() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+BEGIN
+    INSERT INTO public.vault_releases AS kept (principal, key, released_at)
+    SELECT DISTINCT NEW.actor, coalesce(NEW.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || NEW.seq), NEW.occurred_at
+      FROM (SELECT) AS entry
+      LEFT JOIN LATERAL jsonb_path_query(CASE WHEN NEW.secret_id IS NULL THEN NEW.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+    ON CONFLICT (principal, key) DO UPDATE SET released_at = greatest(kept.released_at, excluded.released_at);
+    RETURN NULL;
+END
+$$;--> statement-breakpoint
+-- A trigger runs its function whoever may execute it: no login may call it otherwise.
+REVOKE ALL ON FUNCTION vault_releases_keep() FROM PUBLIC;--> statement-breakpoint
+CREATE TRIGGER audit_log_releases AFTER INSERT ON audit_log FOR EACH ROW
+    WHEN (NEW.author = 'vault' AND NEW.action = 'secret.read' AND NEW.decision = 'allow')
+    EXECUTE FUNCTION vault_releases_keep();--> statement-breakpoint
+-- Then the releases already in the log, in the same transaction: an append waits from the trigger to the commit, and none is missed.
+INSERT INTO vault_releases (principal, key, released_at)
+SELECT e.actor, coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq), max(e.occurred_at)
+  FROM audit_log e
+  LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+ WHERE e.author = 'vault' AND e.action = 'secret.read' AND e.decision = 'allow'
+ GROUP BY 1, 2;--> statement-breakpoint
+GRANT SELECT ON vault_releases TO coffre_vault, coffre_backup;