@coffre/db 0.14.4 → 0.14.5

package/dist/migrations/postgres/meta/_journal.json

@@ -148,6 +148,13 @@
       "when": 1793017780802,
       "tag": "0020_vault_releases",
       "breakpoints": true
+    },
+    {
+      "idx": 21,
+      "version": "7",
+      "when": 1793035191911,
+      "tag": "0021_prune_vault_releases",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { g as schema_d_exports } from "./schema-z8GcN_Xu.js";
-import { t as Database } from "./database-CFhTnnzM.js";
+import { g as schema_d_exports } from "./schema-BfQEBqFv.js";
+import { t as Database } from "./database-wq1AVRAP.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-z8GcN_Xu.d.ts → schema-BfQEBqFv.d.ts}

@@ -1247,8 +1247,9 @@ declare const vaultGrants: import("drizzle-orm/pg-core").PgTableWithColumns<{
  * read them from the entries before (an entry that names none, which only
  * a forged one is, counts as a key of its own, `entry:<seq>`). No login
  * writes it: the vault and the backup read it. A row a window old counts
- * for nothing, so nothing prunes them: there are at most as many as
- * principals times keys, and a count reads one principal's.
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window (`prune_vault_releases`), so a count reads about a
+ * day of keys.
  */
 declare const vaultReleases: import("drizzle-orm/pg-core").PgTableWithColumns<{
   name: "vault_releases";

package/dist/schema-sqlite.d.ts

@@ -1301,8 +1301,8 @@ export declare const vaultGrants: import("drizzle-orm/sqlite-core").SQLiteTableW
  * read them from the entries before (an entry that names none, which only
  * a forged one is, counts as a key of its own, `entry:<seq>`). No login
  * writes it: the vault and the backup read it. A row a window old counts
- * for nothing, so nothing prunes them: there are at most as many as
- * principals times keys, and a count reads one principal's.
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window, so a count reads about a day of keys.
  */
 export declare const vaultReleases: import("drizzle-orm/sqlite-core").SQLiteTableWithColumns<{
   name: "vault_releases";

package/dist/schema-sqlite.js

@@ -223,8 +223,8 @@ const vaultGrants = sqliteTable("vault_grants", {
 * read them from the entries before (an entry that names none, which only
 * a forged one is, counts as a key of its own, `entry:<seq>`). No login
 * writes it: the vault and the backup read it. A row a window old counts
-* for nothing, so nothing prunes them: there are at most as many as
-* principals times keys, and a count reads one principal's.
+* for nothing: the vault's checkpoint forgets those a day and an hour old,
+* longer than any window, so a count reads about a day of keys.
 */
 const vaultReleases = sqliteTable("vault_releases", {
 	principal: text().notNull(),

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-CFhTnnzM.js";
+import { i as Queryable } from "./database-wq1AVRAP.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -155,6 +155,13 @@ const KNOWN_MIGRATIONS = {
 			"when": 1793017780802,
 			"tag": "0020_vault_releases",
 			"breakpoints": true
+		},
+		{
+			"idx": 21,
+			"version": "7",
+			"when": 1793035191911,
+			"tag": "0021_prune_vault_releases",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, w as vaultReleases, x as serviceBindings, y as secrets } from "./schema-z8GcN_Xu.js";
+import { C as vaultMembers, S as vaultGrants, _ as secretReferences, a as credentials, b as secretsRelations, c as enrollments, d as identities, f as mcpApprovals, h as projects, i as consumedTokens, l as environments, m as oauthClients, n as auditLog, o as deviceAuthorizations, p as mcpConnections, r as cappedAlerts, s as dismissedKeys, t as auditChainHead, u as environmentsRelations, v as secretVersions, w as vaultReleases, x as serviceBindings, y as secrets } from "./schema-BfQEBqFv.js";
 export { auditChainHead, auditLog, cappedAlerts, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, enrollments, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers, vaultReleases };

package/dist/schema.js

@@ -250,8 +250,9 @@ const vaultGrants = pgTable("vault_grants", {
 * read them from the entries before (an entry that names none, which only
 * a forged one is, counts as a key of its own, `entry:<seq>`). No login
 * writes it: the vault and the backup read it. A row a window old counts
-* for nothing, so nothing prunes them: there are at most as many as
-* principals times keys, and a count reads one principal's.
+* for nothing: the vault's checkpoint forgets those a day and an hour old,
+* longer than any window (`prune_vault_releases`), so a count reads about a
+* day of keys.
 */
 const vaultReleases = pgTable("vault_releases", {
 	principal: text().notNull(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.14.4",
+  "version": "0.14.5",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.14.4"
+    "@coffre/core": "0.14.5"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/log.ts

@@ -59,6 +59,20 @@ export class LogHeadMismatch extends Error {
   }
 }
 
+/**
+ * As many transactions as may already wait for the log's head do
+ * (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+ * Its code is Postgres's for a lock not available, so every caller already
+ * answers it as one that gave up waiting: unavailable, ask again shortly.
+ */
+export class HeadBusy extends Error {
+  readonly code = '55P03';
+  constructor() {
+    super("too many requests wait for the audit log's head: ask again shortly");
+    this.name = 'HeadBusy';
+  }
+}
+
 /**
  * The log's head is behind one this process wrote: the database was rolled
  * back, or entries were cut off its end. That cannot be told from a restore,
@@ -155,6 +169,44 @@ export async function lockLogHeadIfFree(tx: Transaction): Promise<boolean> {
   return rows.length > 0;
 }
 
+/**
+ * Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+ * `waiters` other transactions hold one of its places in line; otherwise
+ * refuse at once (`HeadBusy`), having waited for nothing. A place is an
+ * advisory lock, tried, never waited for, and held to the end of the
+ * transaction, which holds the head by then: so at most `waiters`
+ * connections wait for the head, or hold it, through here, and a burst
+ * beyond them answers in one round trip rather than seconds later, holding
+ * a connection all the while. One statement: the place, then, only if one
+ * was free, the head; refused, one more says whether the head is there at
+ * all. SQLite's transactions hold the whole file.
+ */
+export async function lockLogHeadQueued(tx: Transaction, waiters: number): Promise<{ nextSeq: bigint; headHash: Buffer }> {
+  if (engineOf(tx) === 'sqlite') return lockLogHead(tx);
+  const { rows } = await (tx as unknown as { execute(query: SQL): Promise<{ rows: { next_seq: string; head_hash: Buffer }[] }> }).execute(sql`
+    SELECT next_seq, head_hash FROM audit_chain_head
+    WHERE only_row AND (SELECT true FROM generate_series(1, ${waiters}::int) AS place WHERE pg_try_advisory_xact_lock(${HEAD_LINE}, place) LIMIT 1)
+    FOR UPDATE`);
+  const [head] = rows;
+  if (head === undefined) {
+    // No place, or no head at all: the second, which no one may write past, said as lockLogHead says it.
+    const { rows: [found] } = await (tx as unknown as { execute(query: SQL): Promise<{ rows: { found: boolean }[] }> }).execute(
+      sql`SELECT EXISTS (SELECT 1 FROM audit_chain_head WHERE only_row) AS found`,
+    );
+    if (found?.found !== true) throw new Error('audit_chain_head is missing; refusing to write an unchained entry');
+    throw new HeadBusy();
+  }
+  holding.add(tx);
+  return { nextSeq: BigInt(head.next_seq), headHash: head.head_hash };
+}
+
+/**
+ * The first key of the head's places in line, Postgres's advisory locks:
+ * the second is the place. A space apart from the members' queues and the
+ * migrator's key.
+ */
+const HEAD_LINE = 0x636f6668;
+
 const lockedHead = prepared((db) => {
   const { auditChainHead } = tablesOf(db);
   return forUpdate(

package/src/migrations/postgres/0021_prune_vault_releases.sql

@@ -0,0 +1,19 @@
+-- Releases pruned (W199, T111): the vault's checkpoint forgets the releases no window can count again, those over a day and an hour old by the database's clock, at most at_most a call. A bulk limit's window is a day at most (the vault's config), and the hour is a margin for the clock stepping back: no caller chooses what is kept, so the vault's login, which still deletes no row itself, cannot forget a release a window counts. The release before never calls it.
+CREATE FUNCTION prune_vault_releases(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '3s' AS $$
+    -- The bound in the DELETE's own WHERE too: a row a read moved on since the subquery's snapshot is checked again,
+    -- as it is now, and kept.
+    WITH bound AS (SELECT (extract(epoch from clock_timestamp()) * 1000)::bigint - 25 * 3600000 AS before),
+    pruned AS (
+        DELETE FROM public.vault_releases
+         WHERE released_at < (SELECT before FROM bound)
+           AND ctid IN (
+            -- Any of them, each past every window; a row an append holds is left to the next run, rather than waited for.
+            SELECT ctid FROM public.vault_releases WHERE released_at < (SELECT before FROM bound) LIMIT at_most FOR UPDATE SKIP LOCKED
+           )
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_vault_releases(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_vault_releases(integer) TO coffre_vault;