@coffre/db 0.14.4 → 0.14.6

package/dist/connect.d.ts

@@ -1,4 +1,4 @@
-import { t as Database } from "./database-CFhTnnzM.js";
+import { t as Database } from "./database-wq1AVRAP.js";
 import { Engine } from "./dialect.js";
 import { ClientConfig } from "pg";
 //#region src/postgres.d.ts

package/dist/{database-CFhTnnzM.d.ts → database-wq1AVRAP.d.ts}

@@ -1,4 +1,4 @@
-import { g as schema_d_exports } from "./schema-z8GcN_Xu.js";
+import { g as schema_d_exports } from "./schema-BfQEBqFv.js";
 import { Query, Table } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import pg from "pg";

package/dist/dialect.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-CFhTnnzM.js";
+import { i as Queryable } from "./database-wq1AVRAP.js";
 import { SQL, SQLWrapper } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 //#region src/dialect.d.ts

package/dist/grants.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-CFhTnnzM.js";
+import { i as Queryable } from "./database-wq1AVRAP.js";
 import { Authenticity, Newest } from "./log.js";
 import { StoredEntry } from "@coffre/core/audit";
 import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";

package/dist/hyperdrive.d.ts

@@ -1,4 +1,4 @@
-import { n as PoolLike } from "./database-CFhTnnzM.js";
+import { n as PoolLike } from "./database-wq1AVRAP.js";
 import pg from "pg";
 //#region src/hyperdrive.d.ts
 /** Postgres through a Hyperdrive binding: `postgres(env.HYPERDRIVE)`. */

package/dist/index.d.ts

@@ -1,3 +1,3 @@
-import { g as schema_d_exports } from "./schema-z8GcN_Xu.js";
-import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-CFhTnnzM.js";
+import { g as schema_d_exports } from "./schema-BfQEBqFv.js";
+import { a as Transaction, c as tablesOf, i as Queryable, l as prepared, n as PoolLike, o as createDatabase, r as QueryOutsideTransaction, s as own, t as Database } from "./database-wq1AVRAP.js";
 export { Database, PoolLike, QueryOutsideTransaction, Queryable, Transaction, createDatabase, own, prepared, schema_d_exports as schema, tablesOf };

package/dist/log.d.ts

@@ -1,4 +1,4 @@
-import { a as Transaction, i as Queryable } from "./database-CFhTnnzM.js";
+import { a as Transaction, i as Queryable } from "./database-wq1AVRAP.js";
 import { Placeholder, SQL } from "drizzle-orm";
 import { LogKey, StoredEntry } from "@coffre/core/audit";
 //#region src/log.d.ts
@@ -48,6 +48,16 @@ export type Appended = {
 export declare class LogHeadMismatch extends Error {
   constructor(message: string);
 }
+/**
+ * As many transactions as may already wait for the log's head do
+ * (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+ * Its code is Postgres's for a lock not available, so every caller already
+ * answers it as one that gave up waiting: unavailable, ask again shortly.
+ */
+export declare class HeadBusy extends Error {
+  readonly code = "55P03";
+  constructor();
+}
 /**
  * The log's head is behind one this process wrote: the database was rolled
  * back, or entries were cut off its end. That cannot be told from a restore,
@@ -92,6 +102,22 @@ export declare function lockLogHead(tx: Transaction): Promise<{
  * SQLite's transactions hold the whole file, so the head is always free.
  */
 export declare function lockLogHeadIfFree(tx: Transaction): Promise<boolean>;
+/**
+ * Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+ * `waiters` other transactions hold one of its places in line; otherwise
+ * refuse at once (`HeadBusy`), having waited for nothing. A place is an
+ * advisory lock, tried, never waited for, and held to the end of the
+ * transaction, which holds the head by then: so at most `waiters`
+ * connections wait for the head, or hold it, through here, and a burst
+ * beyond them answers in one round trip rather than seconds later, holding
+ * a connection all the while. One statement: the place, then, only if one
+ * was free, the head; refused, one more says whether the head is there at
+ * all. SQLite's transactions hold the whole file.
+ */
+export declare function lockLogHeadQueued(tx: Transaction, waiters: number): Promise<{
+  nextSeq: bigint;
+  headHash: Buffer;
+}>;
 /**
  * Append `entries` under `key`. `check`, when given, runs once the head is
  * locked and before anything is written: a writer's own condition on the

package/dist/log.js

@@ -12,6 +12,19 @@ var LogHeadMismatch = class extends Error {
 	}
 };
 /**
+* As many transactions as may already wait for the log's head do
+* (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+* Its code is Postgres's for a lock not available, so every caller already
+* answers it as one that gave up waiting: unavailable, ask again shortly.
+*/
+var HeadBusy = class extends Error {
+	code = "55P03";
+	constructor() {
+		super("too many requests wait for the audit log's head: ask again shortly");
+		this.name = "HeadBusy";
+	}
+};
+/**
 * The log's head is behind one this process wrote: the database was rolled
 * back, or entries were cut off its end. That cannot be told from a restore,
 * so the append refuses and someone has to look.
@@ -99,6 +112,42 @@ async function lockLogHeadIfFree(tx) {
 	if (rows.length > 0) holding.add(tx);
 	return rows.length > 0;
 }
+/**
+* Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+* `waiters` other transactions hold one of its places in line; otherwise
+* refuse at once (`HeadBusy`), having waited for nothing. A place is an
+* advisory lock, tried, never waited for, and held to the end of the
+* transaction, which holds the head by then: so at most `waiters`
+* connections wait for the head, or hold it, through here, and a burst
+* beyond them answers in one round trip rather than seconds later, holding
+* a connection all the while. One statement: the place, then, only if one
+* was free, the head; refused, one more says whether the head is there at
+* all. SQLite's transactions hold the whole file.
+*/
+async function lockLogHeadQueued(tx, waiters) {
+	if (engineOf(tx) === "sqlite") return lockLogHead(tx);
+	const { rows } = await tx.execute(sql`
+    SELECT next_seq, head_hash FROM audit_chain_head
+    WHERE only_row AND (SELECT true FROM generate_series(1, ${waiters}::int) AS place WHERE pg_try_advisory_xact_lock(${HEAD_LINE}, place) LIMIT 1)
+    FOR UPDATE`);
+	const [head] = rows;
+	if (head === void 0) {
+		const { rows: [found] } = await tx.execute(sql`SELECT EXISTS (SELECT 1 FROM audit_chain_head WHERE only_row) AS found`);
+		if (found?.found !== true) throw new Error("audit_chain_head is missing; refusing to write an unchained entry");
+		throw new HeadBusy();
+	}
+	holding.add(tx);
+	return {
+		nextSeq: BigInt(head.next_seq),
+		headHash: head.head_hash
+	};
+}
+/**
+* The first key of the head's places in line, Postgres's advisory locks:
+* the second is the place. A space apart from the members' queues and the
+* migrator's key.
+*/
+const HEAD_LINE = 1668245096;
 const lockedHead = prepared((db) => {
 	const { auditChainHead } = tablesOf(db);
 	return forUpdate(db, db.select({
@@ -388,4 +437,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { BATCH_BYTES, KeyRetired, LOOK_BACK, LogHeadMismatch, LogRewound, MOVES_FROM, appendEntries, entryColumns, forgetLogHeads, lockLogHead, lockLogHeadIfFree, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, withinBytes };
+export { BATCH_BYTES, HeadBusy, KeyRetired, LOOK_BACK, LogHeadMismatch, LogRewound, MOVES_FROM, appendEntries, entryColumns, forgetLogHeads, lockLogHead, lockLogHeadIfFree, lockLogHeadQueued, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, withinBytes };

package/dist/migrations/postgres/0021_prune_vault_releases.sql

@@ -0,0 +1,19 @@
+-- Releases pruned (W199, T111): the vault's checkpoint forgets the releases no window can count again, those over a day and an hour old by the database's clock, at most at_most a call. A bulk limit's window is a day at most (the vault's config), and the hour is a margin for the clock stepping back: no caller chooses what is kept, so the vault's login, which still deletes no row itself, cannot forget a release a window counts. The release before never calls it.
+CREATE FUNCTION prune_vault_releases(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '3s' AS $$
+    -- The bound in the DELETE's own WHERE too: a row a read moved on since the subquery's snapshot is checked again,
+    -- as it is now, and kept.
+    WITH bound AS (SELECT (extract(epoch from clock_timestamp()) * 1000)::bigint - 25 * 3600000 AS before),
+    pruned AS (
+        DELETE FROM public.vault_releases
+         WHERE released_at < (SELECT before FROM bound)
+           AND ctid IN (
+            -- Any of them, each past every window; a row an append holds is left to the next run, rather than waited for.
+            SELECT ctid FROM public.vault_releases WHERE released_at < (SELECT before FROM bound) LIMIT at_most FOR UPDATE SKIP LOCKED
+           )
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_vault_releases(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_vault_releases(integer) TO coffre_vault;