@coffre/db 0.14.4 → 0.15.0

package/src/schema.ts

@@ -9,6 +9,7 @@ import {
   integer,
   pgTable,
   primaryKey,
+  smallint,
   text,
   timestamp,
   unique,
@@ -17,7 +18,8 @@ import {
   type AnyPgColumn,
 } from 'drizzle-orm/pg-core';
 
-import { ACTIVE_SUBJECT, relationsOf } from './relations.ts';
+import { ACTIVE_SUBJECT } from './active-subject.ts';
+import { recorded } from './change-records.ts';
 
 const bytea = customType<{ data: Buffer }>({
   dataType: () => 'bytea',
@@ -74,8 +76,15 @@ export const environments = pgTable(
     // A personal config's owner, `user:<email>`: a fork whose values only they
     // read, the vault binding each to them. Set when it is made and never after.
     owner: text(),
+    // Whether it is protected, on 0.15's environment object (0.14 keeps it in
+    // the policy's entries). Null until 0.15's cutover writes it.
+    protected: boolean(),
+    // 0.15's seal (0022_log_015): the vault's MAC over the object this row is part of, HMAC-SHA256 cut to 16
+    // bytes, the same seal its newest change in `log_changes` records. Null until the row is sealed.
+    seal: bytea(),
   },
   (table) => [
+    check('environments_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     unique('environments_project_id_slug_key').on(table.projectId, table.slug),
     unique('environments_project_scoped').on(table.id, table.projectId),
     check('environments_slug_check', sql`${table.slug} ~ ${PLACE_SLUG}`),
@@ -118,8 +127,12 @@ export const secrets = pgTable(
     archivedAt: timestamp('archived_at', { withTimezone: true }),
     // Within its environment: the same key elsewhere has its own.
     folder: text(),
+    // 0.15's seal (0022_log_015): the vault's MAC over the object this row is part of, HMAC-SHA256 cut to 16
+    // bytes, the same seal its newest change in `log_changes` records. Null until the row is sealed.
+    seal: bytea(),
   },
   (table) => [
+    check('secrets_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     unique('secrets_project_id_environment_id_key_key').on(
       table.projectId,
       table.environmentId,
@@ -143,6 +156,8 @@ export const secrets = pgTable(
       foreignColumns: [environments.id, environments.projectId],
     }),
     index('secrets_lookup_idx').on(table.projectId, table.environmentId, table.key),
+    // The live keys of an environment, which a read by environment alone (the places tree's counts, `liveKeysIn`) walks without the archived ones beside them; the one above leads with the project (T152, 0032).
+    index('secrets_live_idx').on(table.environmentId).where(sql`${table.archivedAt} IS NULL`),
   ],
 );
 
@@ -257,8 +272,12 @@ export const vaultMembers = pgTable(
     // The vault's MAC over the row and the member's grants, lapsed ones too:
     // a grant added, edited or deleted outside the vault fails it.
     mac: bytea().notNull(),
+    // 0.15's seal (0022_log_015): the vault's MAC over the object this row is part of, HMAC-SHA256 cut to 16
+    // bytes, the same seal its newest change in `log_changes` records. Null until the row is sealed.
+    seal: bytea(),
   },
   (table) => [
+    check('vault_members_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     check('vault_members_mac_check', sql`octet_length(${table.mac}) = 32`),
     check('vault_members_principal_check', sql`${table.principal} ~ '^(user|token):[^[:space:]:][^[:space:]]*$'`),
     // A person is their email address, lowercased, as in sign-in.
@@ -330,8 +349,9 @@ export const vaultGrants = pgTable(
  * read them from the entries before (an entry that names none, which only
  * a forged one is, counts as a key of its own, `entry:<seq>`). No login
  * writes it: the vault and the backup read it. A row a window old counts
- * for nothing, so nothing prunes them: there are at most as many as
- * principals times keys, and a count reads one principal's.
+ * for nothing: the vault's checkpoint forgets those a day and an hour old,
+ * longer than any window (`prune_vault_releases`), so a count reads about a
+ * day of keys.
  */
 export const vaultReleases = pgTable(
   'vault_releases',
@@ -377,6 +397,10 @@ export const auditLog = pgTable(
     prevHash: bytea('prev_hash').notNull(),
     mac: bytea().notNull(),
     hash: bytea().notNull(),
+    // Set on every entry a writer under 0.15's log appends, and covered by no MAC: once the cutover is there, an
+    // allowed write without it is 0.14's code, which migration 0047's trigger refuses (docs/design/0.15-plan.md,
+    // "As built: PR 9b"). Gone with 0.14's appends in 0.16.
+    log015: boolean('log015'),
   },
   (table) => [
     check('audit_log_author_check', sql`${table.author} IN ('app', 'vault')`),
@@ -484,6 +508,10 @@ export const secretReferences = pgTable(
     createdSeq: bigint('created_seq', { mode: 'bigint' }).notNull(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
+    // 0.15's end of the reference (0028): when its holder stopped reading its source, broken, replaced or cut, written
+    // with 0.14's `reference.end` in the vault's decision. The holder's object reads its newest row's source only while
+    // this is null. Null on rows 0.14 ended: 0.14's log holds those ends, which the cutover (plan PR 9) writes here.
+    endedAt: timestamp('ended_at', { withTimezone: true }),
   },
   (table) => [
     unique('secret_references_created_seq_key').on(table.createdSeq),
@@ -597,14 +625,21 @@ export const serviceBindings = pgTable(
     scope: text(),
     // What a workload's binding says beyond its claims (`BindingPolicy`), canonical JSON: null on a binding `/api/auth/oidc` takes, never on another (docs/design/workload-access.md, section 11).
     policy: text(),
+    // The instance it was made on, its public URL, which its object's seal covers (0040_binding_origin; PR 3b): null on one
+    // made before, which is named on the instance's public URL.
+    origin: text(),
     label: text(),
     createdAt: createdAt(),
     createdBy: text('created_by').notNull(),
     lastUsedAt: timestamp('last_used_at', { withTimezone: true }),
     revokedAt: timestamp('revoked_at', { withTimezone: true }),
     revokedBy: text('revoked_by'),
+    // 0.15's seal (0022_log_015): the vault's MAC over the object this row is part of, HMAC-SHA256 cut to 16
+    // bytes, the same seal its newest change in `log_changes` records. Null until the row is sealed.
+    seal: bytea(),
   },
   (table) => [
+    check('service_bindings_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     check('service_bindings_principal_check', sql`${table.principal} LIKE 'token:%'`),
     check('service_bindings_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
     check('service_bindings_claims_check', sql`${table.claims}::jsonb IS NOT NULL`),
@@ -716,8 +751,12 @@ export const mcpConnections = pgTable(
     lastUsedIp: text('last_used_ip'),
     revokedAt: timestamp('revoked_at', { withTimezone: true }),
     revokedBy: text('revoked_by'),
+    // 0.15's seal (T147): the vault's MAC over the object this row is part of, HMAC-SHA256 cut to 16 bytes, the same
+    // seal its newest change in `log_changes` records. Null until the row is sealed.
+    seal: bytea(),
   },
   (table) => [
+    check('mcp_connections_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     check('mcp_connections_principal_check', sql`${table.principal} LIKE 'user:%'`),
     check('mcp_connections_registration_check', sql`${table.registration} IN ('cimd', 'dcr')`),
     check('mcp_connections_auth_mac_check', sql`octet_length(${table.authMac}) = 32`),
@@ -861,8 +900,12 @@ export const credentials = pgTable(
     enrollmentId: uuid('enrollment_id'),
     approvedAt: timestamp('approved_at', { withTimezone: true }),
     approvedBy: text('approved_by'),
+    // 0.15's seal (0022_log_015): the vault's MAC over the object this row is part of, HMAC-SHA256 cut to 16
+    // bytes, the same seal its newest change in `log_changes` records. Null until the row is sealed.
+    seal: bytea(),
   },
   (table) => [
+    check('credentials_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
     unique('credentials_token_hash_key').on(table.tokenHash),
     check('credentials_kind_check', sql`${table.kind} IN ('browser', 'cli', 'service', 'personal', 'handle', 'workload')`),
     check('credentials_principal_check', sql`${table.principal} LIKE 'user:%' OR ${table.principal} LIKE 'token:%'`),
@@ -948,8 +991,251 @@ export const deviceAuthorizations = pgTable(
   ],
 );
 
-// For Drizzle's relational queries; see relations.ts.
-export const {
-  environmentsRelations,
-  secretsRelations,
-} = relationsOf({ projects, environments, secrets, secretVersions });
+/**
+ * 0.15's configuration objects (0022_log_015): decision inputs no other row
+ * holds, one row each, sealed as every input is. `policy` holds the bulk
+ * cap's count and window, which a use reads in its own statement; `roles`
+ * the role tables. JSON, as the vault writes it. Written only through
+ * `change_input`.
+ */
+export const logConfig = pgTable(
+  'log_config',
+  {
+    name: text().primaryKey(),
+    value: text().notNull(),
+    seal: bytea(),
+  },
+  (table) => [
+    check('log_config_name_check', sql`${table.name} IN ('policy', 'roles')`),
+    check('log_config_value_check', sql`${table.value}::jsonb IS NOT NULL`),
+    check('log_config_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
+  ],
+);
+
+/**
+ * 0.15's log (0022_log_015, docs/design/hot-path-one.md): two tables numbered
+ * from one sequence, `log_number`, each number taken under the fence's lock
+ * (a credential's issue: under the issue lock, which the barrier waits for;
+ * 0026), so that the number alone orders uses against changes. Nothing reads or
+ * writes them before 0.15's vault; the vault login reads them and writes
+ * them only through the migration's functions.
+ *
+ * A change: any write to a decision input, or to configuration, kept for
+ * good. `object` is the input it changes (`log_object(kind, id)`), `seal`
+ * that object's seal after it, `payload` what it does. The MAC is the
+ * vault's, 16 bytes, its key's tag then HMAC-SHA256 cut to 12 (D162), over everything but the number,
+ * which the vault does not know when it asks. The vault login reads them,
+ * and the app's reads the changes too, for the audit pages: a sign-in
+ * through a trust binding, and the vault's token issues, revokes and
+ * sign-outs, are recorded there alone (D147, T156, T164).
+ */
+export const logChanges = pgTable(
+  'log_changes',
+  {
+    number: bigint({ mode: 'bigint' }).primaryKey(),
+    // Milliseconds since the epoch, the vault's clock when it asked.
+    at: bigint({ mode: 'number' }).notNull(),
+    // A request id names one change: a retry finds its entry.
+    requestId: text('request_id').notNull(),
+    object: uuid().notNull(),
+    actor: text().notNull(),
+    payload: text().notNull(),
+    seal: bytea(),
+    mac: bytea().notNull(),
+  },
+  (table) => [
+    unique('log_changes_request_id_key').on(table.requestId),
+    check('log_changes_seal_check', sql`${table.seal} IS NULL OR octet_length(${table.seal}) = 16`),
+    check('log_changes_mac_check', sql`octet_length(${table.mac}) = 16`),
+    // Each input's newest change, its seal from the index alone (INCLUDE (seal), in the migration's SQL: Drizzle
+    // has no INCLUDE): one probe per input.
+    index('log_changes_object_idx').on(table.object, table.number),
+    // The sign-ins through trust bindings, newest first by when the vault asked (`at`; its number comes later, after
+    // any wait), every service's and one's: what the audit pages list where 0.14's `token.exchange` stood (T156). Only
+    // a sign-in's payload holds a `signIn` object (change-records.ts, which the reads repeat).
+    index('log_changes_sign_in_idx').on(table.at, table.number).where(recorded('postgres', table.payload, 'signIn')),
+    index('log_changes_sign_in_actor_idx').on(table.actor, table.at, table.number).where(recorded('postgres', table.payload, 'signIn')),
+    // The vault's token issues, revokes and sign-outs, ordered as the sign-ins, every member's and one's: what the audit
+    // pages list where 0.14's `token.create`, `token.revoke` and `sign_out` stood, and count while they hide them (T164).
+    // Only an issue's payload, by how it starts, holds an `issue` record, and only a revoke's these reasons
+    // (change-records.ts). A binding's end revokes its credentials with the reason `unbound`, of which 0.14 logged
+    // none: left out.
+    index('log_changes_issue_revoke_idx').on(table.at, table.number).where(recorded('postgres', table.payload, 'issue', 'revoke', 'signOut')),
+    index('log_changes_issue_revoke_actor_idx').on(table.actor, table.at, table.number).where(recorded('postgres', table.payload, 'issue', 'revoke', 'signOut')),
+  ],
+);
+
+/**
+ * A use, the slim row (R53): no principal (the credential's), no
+ * environment (the secret's, or `place`), no kind (the table says it).
+ * Partitioned by the day of `at` (`make_day`), which retention drops whole;
+ * fixed-width columns first, and eight of them, so the row pads to nothing. One index, the
+ * replay's: a retried call repeats its `at` and request id, both under its
+ * MAC, and lands in the same day.
+ */
+export const logUses = pgTable(
+  'log_uses',
+  {
+    number: bigint({ mode: 'bigint' }).notNull(),
+    at: bigint({ mode: 'number' }).notNull(),
+    // Random, unique within its millisecond.
+    requestId: bigint('request_id', { mode: 'bigint' }).notNull(),
+    credential: uuid().notNull(),
+    secret: uuid().notNull(),
+    // What the use was for, as @coffre/vault codes it (a use, a reveal…), plus 256 when it may keep a sensitive value:
+    // one column, so that the row has eight and its null bitmap fits the header's padding (8 B a use, measured).
+    purpose: smallint().notNull(),
+    mac: bytea().notNull(),
+    // The environment it was asked at, when not the secret's own (a fork, a reference).
+    place: uuid(),
+  },
+  (table) => [
+    check('log_uses_mac_check', sql`octet_length(${table.mac}) = 16`),
+    uniqueIndex('log_uses_request_idx').on(table.at, table.requestId),
+  ],
+);
+
+/**
+ * 0.15's reads as the audit pages list them (T166; formal/Reads.tla): a
+ * projection of each use a signed pair seals, written by the vault's
+ * projector apart from the checkpointer, from the sealed objects at the
+ * use's number: its account, its key's place, the fork it was read in,
+ * through a reference the source and its place, the version read; under the
+ * vault's MAC over all of it, the number included. Partitioned by the day of
+ * `at`, as the uses are (`make_reads_day`), and dropped with them.
+ */
+export const logReads = pgTable(
+  'log_reads',
+  {
+    number: bigint({ mode: 'bigint' }).notNull(),
+    at: bigint({ mode: 'number' }).notNull(),
+    credential: uuid().notNull(),
+    purpose: smallint().notNull(),
+    principal: text().notNull(),
+    secret: uuid().notNull(),
+    environment: uuid().notNull(),
+    project: uuid().notNull(),
+    place: uuid(),
+    source: uuid(),
+    sourceEnvironment: uuid('source_environment'),
+    sourceProject: uuid('source_project'),
+    version: uuid(),
+    mac: bytea().notNull(),
+  },
+  (table) => [
+    check('log_reads_mac_check', sql`octet_length(${table.mac}) = 16`),
+    uniqueIndex('log_reads_number_idx').on(table.at, table.number),
+    index('log_reads_principal_idx').on(table.principal, table.at, table.number),
+  ],
+);
+
+/** The days each member's reads are in (`log_reads`), so that a page of theirs reads those days alone: the projector writes them with the reads. */
+export const logReadDays = pgTable(
+  'log_read_days',
+  { principal: text().notNull(), day: integer().notNull() },
+  (table) => [primaryKey({ name: 'log_read_days_pkey', columns: [table.principal, table.day] })],
+);
+
+/** How far the projector has gone: the number every use at or below it is projected, and when. */
+export const logReadsCursor = pgTable(
+  'log_reads_cursor',
+  {
+    onlyRow: boolean('only_row').primaryKey().default(true),
+    through: bigint({ mode: 'bigint' }).notNull(),
+    // The signed pair at or below `through`, whose floor of `at` the next read of uses takes.
+    pair: bigint({ mode: 'bigint' }).notNull(),
+    at: bigint({ mode: 'number' }).notNull(),
+    // The vault's MAC over the three (formal/Reads.tla, CursorMac): a cursor moved ahead would have the pages list reads as
+    // whole that were never projected. Null at the start, before any read is projected.
+    mac: bytea(),
+  },
+  (table) => [
+    check('log_reads_cursor_only_row_check', sql`${table.onlyRow}`),
+    check('log_reads_cursor_mac_check', sql`${table.mac} IS NULL OR octet_length(${table.mac}) = 16`),
+  ],
+);
+
+/**
+ * The bulk cap (R28, R52): each principal's last logged use of each key, as
+ * the start of that use's refresh period, written only by a use that holds
+ * the principal's lock (exclusive to enter a key, shared to move it on:
+ * 0028), at most once per refresh per key. A row older than the window, a
+ * refresh, the deadline and a minute counts for nothing; `prune_bulk`
+ * forgets it an hour after that.
+ */
+export const logBulk = pgTable(
+  'log_bulk',
+  {
+    principal: text().notNull(),
+    secret: uuid().notNull(),
+    last: bigint({ mode: 'number' }).notNull(),
+  },
+  (table) => [primaryKey({ name: 'log_bulk_pkey', columns: [table.principal, table.secret] })],
+);
+
+/**
+ * The fence's one row: the lowest `at` a use may still be written with,
+ * raised by each checkpoint's barrier (`close_one`), never lowered. Made
+ * by the migration; without it every use is refused.
+ */
+export const logFence = pgTable(
+  'log_fence',
+  {
+    onlyRow: boolean('only_row').primaryKey().default(true),
+    atFloor: bigint('at_floor', { mode: 'number' }).notNull(),
+  },
+  (table) => [check('log_fence_only_row_check', sql`${table.onlyRow}`)],
+);
+
+/**
+ * A signed checkpoint: the pair of tree heads (W212), changes and uses, at
+ * one `upto`, every number at or below which is final. One row, so that no
+ * state holds one head without the other. `at_floor` is the floor its
+ * barrier set: the next window's uses have an `at` at or above it.
+ */
+export const logCheckpoints = pgTable(
+  'log_checkpoints',
+  {
+    upto: bigint({ mode: 'bigint' }).primaryKey(),
+    at: bigint({ mode: 'number' }).notNull(),
+    atFloor: bigint('at_floor', { mode: 'number' }).notNull(),
+    changesSize: bigint('changes_size', { mode: 'bigint' }).notNull(),
+    changesRoot: bytea('changes_root').notNull(),
+    // The signed note (C2SP tlog-checkpoint), as witnesses get it.
+    changesNote: text('changes_note').notNull(),
+    usesSize: bigint('uses_size', { mode: 'bigint' }).notNull(),
+    usesRoot: bytea('uses_root').notNull(),
+    usesNote: text('uses_note').notNull(),
+  },
+  (table) => [
+    check('log_checkpoints_changes_root_check', sql`octet_length(${table.changesRoot}) = 32`),
+    check('log_checkpoints_uses_root_check', sql`octet_length(${table.usesRoot}) = 32`),
+    // A day's retention cut, the first checkpoint whose floor is past the day's end (migration 0027).
+    index('log_checkpoints_floor_idx').on(table.atFloor, table.upto),
+  ],
+);
+
+/**
+ * The two trees' tiles (C2SP tlog-tiles: height 8, up to 256 hashes of one
+ * level). Partitioned by tree; the uses tree's leaf tiles (level 0) by
+ * `leaf`, the first leaf a tile covers (`make_tiles`), so that retention
+ * drops a table rather than deleting a day's rows (W212); its levels above,
+ * which span far past their first leaf, in one table (W217).
+ */
+export const logTiles = pgTable(
+  'log_tiles',
+  {
+    tree: text().notNull(),
+    level: smallint().notNull(),
+    // idx · 256^(level + 1): a tile's place, in its tree's leaves.
+    leaf: bigint({ mode: 'bigint' }).notNull(),
+    hashes: bytea().notNull(),
+  },
+  (table) => [
+    primaryKey({ name: 'log_tiles_pkey', columns: [table.tree, table.level, table.leaf] }),
+    check('log_tiles_tree_check', sql`${table.tree} IN ('changes', 'uses')`),
+    check('log_tiles_level_check', sql`${table.level} BETWEEN 0 AND 7`),
+    check('log_tiles_leaf_check', sql`${table.leaf} >= 0 AND ${table.leaf} % (256::numeric ^ (${table.level} + 1)) = 0`),
+    check('log_tiles_hashes_check', sql`octet_length(${table.hashes}) BETWEEN 32 AND 8192 AND octet_length(${table.hashes}) % 32 = 0`),
+  ],
+);

package/src/verify-runtime.ts

@@ -1,7 +1,5 @@
 import assert from 'node:assert/strict';
-import pg from 'pg';
-
-import { postgresConnection } from './postgres.ts';
+import { postgresClient } from './postgres.ts';
 
 function requiredEnvironment(name: string): string {
   const value = process.env[name]?.trim();
@@ -10,19 +8,15 @@ function requiredEnvironment(name: string): string {
 }
 
 const expectedRole = requiredEnvironment('COFFRE_RUNTIME_ROLE');
-const pool = new pg.Pool({
-  application_name: 'coffre-runtime-verification',
-  ...postgresConnection(requiredEnvironment('DATABASE_URL')),
-  max: 1,
-});
+const client = postgresClient(requiredEnvironment('DATABASE_URL'), { application_name: 'coffre-runtime-verification', max: 1 });
 
 try {
-  const identity = await pool.query<{
+  const identity = await client.unsafe<{
     current_user: string;
     memberships: string[];
     safe_membership: boolean;
     unsafe_attributes: boolean;
-  }>(
+  }[]>(
     `SELECT current_user,
             (
               role.rolsuper OR role.rolcreatedb OR role.rolcreaterole
@@ -47,14 +41,14 @@ try {
        FROM pg_roles role
       WHERE role.rolname = current_user`,
   );
-  assert.deepEqual(identity.rows, [{
+  assert.deepEqual([...identity], [{
     current_user: expectedRole,
     memberships: ['coffre_app'],
     safe_membership: true,
     unsafe_attributes: false,
   }]);
 
-  const ownership = await pool.query<{ object_count: number }>(
+  const ownership = await client.unsafe<{ object_count: number }[]>(
     `SELECT count(*)::int AS object_count
        FROM pg_shdepend dependency
        JOIN pg_roles role ON role.oid = dependency.refobjid
@@ -62,9 +56,9 @@ try {
         AND dependency.deptype = 'o'
         AND role.rolname = current_user`,
   );
-  assert.equal(ownership.rows[0]?.object_count, 0, 'runtime role owns database objects');
+  assert.equal(ownership[0]?.object_count, 0, 'runtime role owns database objects');
 
-  const privileges = await pool.query<{
+  const privileges = await client.unsafe<{
     audit_delete: boolean;
     audit_truncate: boolean;
     audit_update: boolean;
@@ -74,7 +68,7 @@ try {
     head_hash_update: boolean;
     migrations_select: boolean;
     schema_create: boolean;
-  }>(
+  }[]>(
     `SELECT has_database_privilege(current_user, current_database(), 'CREATE') AS database_create,
             has_database_privilege(current_user, current_database(), 'TEMPORARY') AS database_temporary,
             has_schema_privilege(current_user, 'public', 'CREATE') AS schema_create,
@@ -91,7 +85,7 @@ try {
               current_user, 'drizzle.__drizzle_migrations', 'SELECT'
             ) AS migrations_select`,
   );
-  assert.deepEqual(privileges.rows, [{
+  assert.deepEqual([...privileges], [{
     audit_delete: false,
     audit_truncate: false,
     audit_update: false,
@@ -103,20 +97,15 @@ try {
     schema_create: false,
   }]);
 
-  const client = await pool.connect();
-  try {
-    await client.query('BEGIN');
-    // What every append does to the log's head, rolled back.
-    const head = await client.query(
-      `UPDATE audit_chain_head SET next_seq = next_seq, head_hash = head_hash WHERE only_row`,
-    );
-    assert.equal(head.rowCount, 1, 'runtime head update did not affect the singleton');
-  } finally {
-    await client.query('ROLLBACK');
-    client.release();
-  }
+  // What every append does to the log's head, rolled back.
+  const rolledBack = new Error('rolled back');
+  await assert.rejects(client.begin(async (tx) => {
+    const head = await tx.unsafe(`UPDATE audit_chain_head SET next_seq = next_seq, head_hash = head_hash WHERE only_row`);
+    assert.equal(head.count, 1, 'runtime head update did not affect the singleton');
+    throw rolledBack;
+  }), (error) => error === rolledBack);
 
   console.log(`runtime database role ${expectedRole} passed privilege verification`);
 } finally {
-  await pool.end();
+  await client.end();
 }

package/LICENSE

@@ -1,21 +0,0 @@
-MIT License
-
-Copyright (c) 2026 Erwin Kuhn
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.

package/dist/database-CFhTnnzM.d.ts

@@ -1,73 +0,0 @@
-import { g as schema_d_exports } from "./schema-z8GcN_Xu.js";
-import { Query, Table } from "drizzle-orm";
-import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import pg from "pg";
-//#region src/prepared.d.ts
-/** The part of a select builder `prepared` reads, once. */
-type Select = PromiseLike<unknown> & {
-  toSQL(): Query;
-  prepare(...name: never[]): unknown;
-};
-/**
- * A select built once per process, or once per isolate on Workers, and run
- * with new values each time. Drizzle rebuilds a query's SQL from its
- * builder at every run, and that was most of a short query's CPU; this
- * builds it from `build` the first time a database of its dialect asks,
- * then hands the SQL and its columns to that call's own session
- * (`session.prepareQuery`), which binds `values` to the placeholders
- * (`sql.placeholder`) and maps the rows as the builder would.
- *
- * `build` must not depend on anything but the database's dialect, and the
- * values go to the driver as they are, not through a column's encoding:
- * strings, numbers, bigints and bytes.
- *
- *   const member = prepared((db) => db.select().from(tablesOf(db).vaultMembers).where(eq(…, sql.placeholder('principal'))));
- *   const [row] = await member(db, { principal });
- */
-declare function prepared<Q extends Select>(build: (db: Queryable) => Q): (db: Queryable, values?: Record<string, unknown>) => Promise<Awaited<Q>>;
-//#endregion
-//#region src/database.d.ts
-/**
- * A database, typed as Postgres whichever it is; see portable.ts for why
- * that holds. connect.ts opens one of each from a URL.
- */
-type Database = NodePgDatabase<typeof schema_d_exports>;
-type Transaction = Parameters<Parameters<Database['transaction']>[0]>[0];
-/** Anything a read can run on: the database, or an open transaction. */
-type Queryable = Database | Transaction;
-/**
- * What Drizzle needs from a connection pool. A `pg.Pool` fits, and so does the
- * per-invocation Hyperdrive pool, whose class name ends in `Pool` for the
- * same reason: that is how Drizzle knows to check out a client for a
- * transaction rather than run BEGIN on a shared connection.
- */
-type PoolLike = pg.Pool | {
-  query: pg.Pool['query'];
-  connect: () => Promise<Pick<pg.PoolClient, 'query'> & {
-    release: () => void;
-  }>;
-};
-/**
- * A query made on the database from inside one of its own transactions,
- * rather than through the transaction. With one connection per call, as on
- * Workers, it would wait for the transaction, which waits for it: a call
- * Cloudflare cancels as hung, and nothing says why. So it is refused at
- * once, with this, wherever the database runs.
- */
-declare class QueryOutsideTransaction extends Error {
-  constructor();
-}
-declare function createDatabase(pool: PoolLike): Database;
-/**
- * The tables of the database's own dialect: the Postgres ones on Postgres,
- * the SQLite ones on SQLite. Every query builds on these.
- */
-declare function tablesOf(db: Queryable): typeof schema_d_exports;
-/**
- * The database's own twin of `table`, which may be another dialect's: the
- * server names tables by importing schema.ts, and the database decides
- * which one that means.
- */
-declare function own<T extends Table>(db: Queryable, table: T): T;
-//#endregion
-export { Transaction as a, tablesOf as c, Queryable as i, prepared as l, PoolLike as n, createDatabase as o, QueryOutsideTransaction as r, own as s, Database as t };

package/dist/postgres-Bmar8y0q.js

@@ -1,29 +0,0 @@
-import { checkServerIdentity } from "node:tls";
-import { parseIntoClientConfig } from "pg-connection-string";
-//#region src/postgres.ts
-/** Keep libpq's system-root shortcut from being read as a certificate filename by pg. */
-function postgresConnection(url) {
-	let parsed;
-	try {
-		parsed = new URL(url);
-	} catch {
-		throw new Error("invalid Postgres URL");
-	}
-	const parameters = parsed.searchParams;
-	if (parameters.getAll("sslrootcert").at(-1) !== "system") return { connectionString: url };
-	const mode = parameters.getAll("sslmode").at(-1);
-	if (mode !== void 0 && mode !== "verify-full") throw new Error("sslrootcert=system requires sslmode=verify-full");
-	parameters.delete("sslrootcert");
-	parameters.set("sslmode", "verify-full");
-	const config = parseIntoClientConfig(parsed.toString());
-	const host = config.host;
-	if (!host) throw new Error("sslrootcert=system requires a Postgres hostname");
-	config.ssl = {
-		...config.ssl,
-		rejectUnauthorized: true,
-		checkServerIdentity: (_hostname, certificate) => checkServerIdentity(host, certificate)
-	};
-	return config;
-}
-//#endregion
-export { postgresConnection as t };