@coffre/db 0.14.3 → 0.14.5

package/dist/migrations/sqlite/meta/_journal.json

@@ -120,6 +120,13 @@
       "when": 1792835446455,
       "tag": "0016_capped_alerts",
       "breakpoints": true
+    },
+    {
+      "idx": 17,
+      "version": "6",
+      "when": 1793017781451,
+      "tag": "0017_vault_releases",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { g as schema_d_exports } from "./schema-DcVkJhCf.js";
-import { t as Database } from "./database-Ds1Y79h6.js";
+import { g as schema_d_exports } from "./schema-BfQEBqFv.js";
+import { t as Database } from "./database-wq1AVRAP.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-DcVkJhCf.d.ts → schema-BfQEBqFv.d.ts}

@@ -1,5 +1,5 @@
 declare namespace schema_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 declare const projects: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "projects";
@@ -1238,6 +1238,77 @@ declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
   };
   dialect: "pg";
 }>;
+/**
+ * Each key the vault released to a principal, and when last: what its bulk
+ * limit counts (R28), the distinct keys released within a window, without
+ * reading the log. The database keeps it from the log itself, in the
+ * transaction of each vault `secret.read` allowed: a trigger on
+ * `audit_log` upserts a row for each key the entry names, as the count
+ * read them from the entries before (an entry that names none, which only
+ * a forged one is, counts as a key of its own, `entry:<seq>`). No login
+ * writes it: the vault and the backup read it. A row a window old counts
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window (`prune_vault_releases`), so a count reads about a
+ * day of keys.
+ */
+declare const vaultReleases: import("drizzle-orm/pg-core").PgTableWithColumns<{
+  name: "vault_releases";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/pg-core").PgColumn<{
+      name: "principal";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    key: import("drizzle-orm/pg-core").PgColumn<{
+      name: "key";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "PgText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+    releasedAt: import("drizzle-orm/pg-core").PgColumn<{
+      name: "released_at";
+      tableName: "vault_releases";
+      dataType: "number";
+      columnType: "PgBigInt53";
+      data: number;
+      driverParam: string | number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "pg";
+}>;
 declare const auditLog: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "audit_log";
   schema: undefined;
@@ -4125,4 +4196,4 @@ declare const environmentsRelations: import("drizzle-orm").Relations<"environmen
   environment: import("drizzle-orm").One<"environments", true>;
 }>;
 //#endregion
-export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, serviceBindings as x, secrets as y };
+export { vaultMembers as C, vaultGrants as S, secretReferences as _, credentials as a, secretsRelations as b, enrollments as c, identities as d, mcpApprovals as f, schema_d_exports as g, projects as h, consumedTokens as i, environments as l, oauthClients as m, auditLog as n, deviceAuthorizations as o, mcpConnections as p, cappedAlerts as r, dismissedKeys as s, auditChainHead as t, environmentsRelations as u, secretVersions as v, vaultReleases as w, serviceBindings as x, secrets as y };

package/dist/schema-sqlite.d.ts

@@ -1,5 +1,5 @@
 declare namespace schema_sqlite_d_exports {
-  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+  export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };
 }
 export declare const projects: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "projects";
@@ -1292,6 +1292,80 @@ export declare const vaultGrants: import("drizzle-orm/sqlite-core").SQLiteTableW
   };
   dialect: "sqlite";
 }>;
+/**
+ * Each key the vault released to a principal, and when last: what its bulk
+ * limit counts (R28), the distinct keys released within a window, without
+ * reading the log. The database keeps it from the log itself, in the
+ * transaction of each vault `secret.read` allowed: a trigger on
+ * `audit_log` upserts a row for each key the entry names, as the count
+ * read them from the entries before (an entry that names none, which only
+ * a forged one is, counts as a key of its own, `entry:<seq>`). No login
+ * writes it: the vault and the backup read it. A row a window old counts
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window, so a count reads about a day of keys.
+ */
+export declare const vaultReleases: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
+  name: "vault_releases";
+  schema: undefined;
+  columns: {
+    principal: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "principal";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    key: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "key";
+      tableName: "vault_releases";
+      dataType: "string";
+      columnType: "SQLiteText";
+      data: string;
+      driverParam: string;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: [string, ...string[]];
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {
+      length: undefined;
+    }>;
+    releasedAt: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: "released_at";
+      tableName: "vault_releases";
+      dataType: "number";
+      columnType: "SQLiteInteger";
+      data: number;
+      driverParam: number;
+      notNull: true;
+      hasDefault: false;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
+  };
+  dialect: "sqlite";
+}>;
 export declare const auditLog: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "audit_log";
   schema: undefined;

package/dist/schema-sqlite.js

@@ -214,6 +214,26 @@ const vaultGrants = sqliteTable("vault_grants", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
+/**
+* Each key the vault released to a principal, and when last: what its bulk
+* limit counts (R28), the distinct keys released within a window, without
+* reading the log. The database keeps it from the log itself, in the
+* transaction of each vault `secret.read` allowed: a trigger on
+* `audit_log` upserts a row for each key the entry names, as the count
+* read them from the entries before (an entry that names none, which only
+* a forged one is, counts as a key of its own, `entry:<seq>`). No login
+* writes it: the vault and the backup read it. A row a window old counts
+* for nothing: the vault's checkpoint forgets those a day and an hour old,
+* longer than any window, so a count reads about a day of keys.
+*/
+const vaultReleases = sqliteTable("vault_releases", {
+	principal: text().notNull(),
+	key: text().notNull(),
+	releasedAt: integer("released_at", { mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "vault_releases_pkey",
+	columns: [table.principal, table.key]
+})]);
 const auditLog = sqliteTable("audit_log", {
 	seq: int64("seq").primaryKey(),
 	author: text().notNull(),
@@ -616,4 +636,4 @@ const { environmentsRelations, secretsRelations } = relationsOf(asPostgres({
 	secretVersions
 }));
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-Ds1Y79h6.js";
+import { i as Queryable } from "./database-wq1AVRAP.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -148,6 +148,20 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792937576477,
 			"tag": "0019_backup_role",
 			"breakpoints": true
+		},
+		{
+			"idx": 20,
+			"version": "7",
+			"when": 1793017780802,
+			"tag": "0020_vault_releases",
+			"breakpoints": true
+		},
+		{
+			"idx": 21,
+			"version": "7",
+			"when": 1793035191911,
+			"tag": "0021_prune_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -269,6 +283,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792835446455,
 			"tag": "0016_capped_alerts",
 			"breakpoints": true
+		},
+		{
+			"idx": 17,
+			"version": "6",
+			"when": 1793017781451,
+			"tag": "0017_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, x as serviceBindings, y as secrets } from "./schema-DcVkJhCf.js";
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };
+import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, w as vaultReleases, x as serviceBindings, y as secrets } from "./schema-BfQEBqFv.js";
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema.js

@@ -25,7 +25,8 @@ var schema_exports = /* @__PURE__ */ __exportAll({
 	secretsRelations: () => secretsRelations,
 	serviceBindings: () => serviceBindings,
 	vaultGrants: () => vaultGrants,
-	vaultMembers: () => vaultMembers
+	vaultMembers: () => vaultMembers,
+	vaultReleases: () => vaultReleases
 });
 const bytea = customType({ dataType: () => "bytea" });
 const createdAt = () => timestamp("created_at", { withTimezone: true }).notNull().defaultNow();
@@ -240,6 +241,27 @@ const vaultGrants = pgTable("vault_grants", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
+/**
+* Each key the vault released to a principal, and when last: what its bulk
+* limit counts (R28), the distinct keys released within a window, without
+* reading the log. The database keeps it from the log itself, in the
+* transaction of each vault `secret.read` allowed: a trigger on
+* `audit_log` upserts a row for each key the entry names, as the count
+* read them from the entries before (an entry that names none, which only
+* a forged one is, counts as a key of its own, `entry:<seq>`). No login
+* writes it: the vault and the backup read it. A row a window old counts
+* for nothing: the vault's checkpoint forgets those a day and an hour old,
+* longer than any window (`prune_vault_releases`), so a count reads about a
+* day of keys.
+*/
+const vaultReleases = pgTable("vault_releases", {
+	principal: text().notNull(),
+	key: text().notNull(),
+	releasedAt: bigint("released_at", { mode: "number" }).notNull()
+}, (table) => [primaryKey({
+	name: "vault_releases_pkey",
+	columns: [table.principal, table.key]
+})]);
 const auditLog = pgTable("audit_log", {
 	seq: bigint({ mode: "bigint" }).primaryKey(),
 	author: text().notNull(),
@@ -698,4 +720,4 @@ const { environmentsRelations, secretsRelations } = relationsOf({
 	secretVersions
 });
 //#endregion
-export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers };
+export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, schema_exports as t, vaultGrants, vaultMembers, vaultReleases };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.14.3",
+  "version": "0.14.5",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.14.3"
+    "@coffre/core": "0.14.5"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/log.ts

@@ -59,6 +59,20 @@ export class LogHeadMismatch extends Error {
   }
 }
 
+/**
+ * As many transactions as may already wait for the log's head do
+ * (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+ * Its code is Postgres's for a lock not available, so every caller already
+ * answers it as one that gave up waiting: unavailable, ask again shortly.
+ */
+export class HeadBusy extends Error {
+  readonly code = '55P03';
+  constructor() {
+    super("too many requests wait for the audit log's head: ask again shortly");
+    this.name = 'HeadBusy';
+  }
+}
+
 /**
  * The log's head is behind one this process wrote: the database was rolled
  * back, or entries were cut off its end. That cannot be told from a restore,
@@ -155,6 +169,44 @@ export async function lockLogHeadIfFree(tx: Transaction): Promise<boolean> {
   return rows.length > 0;
 }
 
+/**
+ * Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+ * `waiters` other transactions hold one of its places in line; otherwise
+ * refuse at once (`HeadBusy`), having waited for nothing. A place is an
+ * advisory lock, tried, never waited for, and held to the end of the
+ * transaction, which holds the head by then: so at most `waiters`
+ * connections wait for the head, or hold it, through here, and a burst
+ * beyond them answers in one round trip rather than seconds later, holding
+ * a connection all the while. One statement: the place, then, only if one
+ * was free, the head; refused, one more says whether the head is there at
+ * all. SQLite's transactions hold the whole file.
+ */
+export async function lockLogHeadQueued(tx: Transaction, waiters: number): Promise<{ nextSeq: bigint; headHash: Buffer }> {
+  if (engineOf(tx) === 'sqlite') return lockLogHead(tx);
+  const { rows } = await (tx as unknown as { execute(query: SQL): Promise<{ rows: { next_seq: string; head_hash: Buffer }[] }> }).execute(sql`
+    SELECT next_seq, head_hash FROM audit_chain_head
+    WHERE only_row AND (SELECT true FROM generate_series(1, ${waiters}::int) AS place WHERE pg_try_advisory_xact_lock(${HEAD_LINE}, place) LIMIT 1)
+    FOR UPDATE`);
+  const [head] = rows;
+  if (head === undefined) {
+    // No place, or no head at all: the second, which no one may write past, said as lockLogHead says it.
+    const { rows: [found] } = await (tx as unknown as { execute(query: SQL): Promise<{ rows: { found: boolean }[] }> }).execute(
+      sql`SELECT EXISTS (SELECT 1 FROM audit_chain_head WHERE only_row) AS found`,
+    );
+    if (found?.found !== true) throw new Error('audit_chain_head is missing; refusing to write an unchained entry');
+    throw new HeadBusy();
+  }
+  holding.add(tx);
+  return { nextSeq: BigInt(head.next_seq), headHash: head.head_hash };
+}
+
+/**
+ * The first key of the head's places in line, Postgres's advisory locks:
+ * the second is the place. A space apart from the members' queues and the
+ * migrator's key.
+ */
+const HEAD_LINE = 0x636f6668;
+
 const lockedHead = prepared((db) => {
   const { auditChainHead } = tablesOf(db);
   return forUpdate(

package/src/migrations/postgres/0020_vault_releases.sql

@@ -0,0 +1,36 @@
+-- Releases (W199): each key the vault released to a principal, and when last, so that its bulk limit counts the keys released within a window from a row per key, not from every read the principal ever made. The database keeps it, from each vault `secret.read` allowed, in the append's own transaction; the release before neither reads it nor knows it is kept, and its appends keep it too.
+CREATE TABLE "vault_releases" (
+	"principal" text NOT NULL,
+	"key" text NOT NULL,
+	"released_at" bigint NOT NULL,
+	CONSTRAINT "vault_releases_pkey" PRIMARY KEY("principal","key")
+);
+--> statement-breakpoint
+-- Room in each page for the next version of its rows: a read moves its keys' times on in place (a HOT update), so the
+-- table and its key stay a row a key, however often each is read: the page prunes the versions before as it is read.
+ALTER TABLE vault_releases SET (fillfactor = 50);--> statement-breakpoint
+-- Each key the entry names, as the count read them before: the secret, or each item of a read's list at one place, or, for an entry that names none, which only a forged one is, the entry itself. As the owner, so that no login may write the table: the vault's appends reach it only through the log.
+CREATE FUNCTION vault_releases_keep() RETURNS trigger
+    LANGUAGE plpgsql SECURITY DEFINER SET search_path = pg_catalog, pg_temp AS $$
+BEGIN
+    INSERT INTO public.vault_releases AS kept (principal, key, released_at)
+    SELECT DISTINCT NEW.actor, coalesce(NEW.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || NEW.seq), NEW.occurred_at
+      FROM (SELECT) AS entry
+      LEFT JOIN LATERAL jsonb_path_query(CASE WHEN NEW.secret_id IS NULL THEN NEW.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+    ON CONFLICT (principal, key) DO UPDATE SET released_at = greatest(kept.released_at, excluded.released_at);
+    RETURN NULL;
+END
+$$;--> statement-breakpoint
+-- A trigger runs its function whoever may execute it: no login may call it otherwise.
+REVOKE ALL ON FUNCTION vault_releases_keep() FROM PUBLIC;--> statement-breakpoint
+CREATE TRIGGER audit_log_releases AFTER INSERT ON audit_log FOR EACH ROW
+    WHEN (NEW.author = 'vault' AND NEW.action = 'secret.read' AND NEW.decision = 'allow')
+    EXECUTE FUNCTION vault_releases_keep();--> statement-breakpoint
+-- Then the releases already in the log, in the same transaction: an append waits from the trigger to the commit, and none is missed.
+INSERT INTO vault_releases (principal, key, released_at)
+SELECT e.actor, coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq), max(e.occurred_at)
+  FROM audit_log e
+  LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+ WHERE e.author = 'vault' AND e.action = 'secret.read' AND e.decision = 'allow'
+ GROUP BY 1, 2;--> statement-breakpoint
+GRANT SELECT ON vault_releases TO coffre_vault, coffre_backup;

package/src/migrations/postgres/0021_prune_vault_releases.sql

@@ -0,0 +1,19 @@
+-- Releases pruned (W199, T111): the vault's checkpoint forgets the releases no window can count again, those over a day and an hour old by the database's clock, at most at_most a call. A bulk limit's window is a day at most (the vault's config), and the hour is a margin for the clock stepping back: no caller chooses what is kept, so the vault's login, which still deletes no row itself, cannot forget a release a window counts. The release before never calls it.
+CREATE FUNCTION prune_vault_releases(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '3s' AS $$
+    -- The bound in the DELETE's own WHERE too: a row a read moved on since the subquery's snapshot is checked again,
+    -- as it is now, and kept.
+    WITH bound AS (SELECT (extract(epoch from clock_timestamp()) * 1000)::bigint - 25 * 3600000 AS before),
+    pruned AS (
+        DELETE FROM public.vault_releases
+         WHERE released_at < (SELECT before FROM bound)
+           AND ctid IN (
+            -- Any of them, each past every window; a row an append holds is left to the next run, rather than waited for.
+            SELECT ctid FROM public.vault_releases WHERE released_at < (SELECT before FROM bound) LIMIT at_most FOR UPDATE SKIP LOCKED
+           )
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_vault_releases(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_vault_releases(integer) TO coffre_vault;