@coffre/db 0.14.4 → 0.15.0

package/dist/log.js

@@ -1,7 +1,9 @@
 import { t as afterCommit } from "./commits-BuW-NL3n.js";
-import { clockMillis, engineOf, forUpdate } from "./dialect.js";
-import { a as prepared, i as tablesOf } from "./database-BadNeeN-.js";
-import { and, asc, count, desc, eq, gt, gte, lt, lte, sql } from "drizzle-orm";
+import { n as recorded, t as RECORDS } from "./change-records-_fKvahvs.js";
+import { changedRows, clockMillis, engineOf, forUpdate, rowsOf } from "./dialect.js";
+import { a as prepared, i as tablesOf } from "./database-D55ENPX-.js";
+import { and, asc, count, desc, eq, gt, gte, isNotNull, isNull, lt, lte, sql } from "drizzle-orm";
+import { createHash } from "node:crypto";
 import { GENESIS_HASH, sealEntry } from "@coffre/core/audit";
 //#region src/log.ts
 /** The log's head does not name its last entry: something moved it, or cut the log behind it. */
@@ -12,6 +14,19 @@ var LogHeadMismatch = class extends Error {
 	}
 };
 /**
+* As many transactions as may already wait for the log's head do
+* (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+* Its code is Postgres's for a lock not available, so every caller already
+* answers it as one that gave up waiting: unavailable, ask again shortly.
+*/
+var HeadBusy = class extends Error {
+	code = "55P03";
+	constructor() {
+		super("too many requests wait for the audit log's head: ask again shortly");
+		this.name = "HeadBusy";
+	}
+};
+/**
 * The log's head is behind one this process wrote: the database was rolled
 * back, or entries were cut off its end. That cannot be told from a restore,
 * so the append refuses and someone has to look.
@@ -84,6 +99,35 @@ async function lockLogHead(tx) {
 	return head;
 }
 /**
+* Take the issue lock exclusive (migration 0026's, `1668244070, 1`): every
+* issue in flight, a sign-in or a token's, ends first, and none starts
+* until this transaction does. A write that moves what an issue's policy
+* check compares (`issue_token`: the policy, a protected environment's
+* slug) takes it, after its own rows and before the fence its append's
+* trigger takes, as the checkpointer's barrier does: so the issue is
+* ordered against it, and no use waits behind an issue (formal/Lifecycle.tla's
+* IssuePolicyHeld, Migration015.tla's PolicyIssueFirst; T149, review r3).
+* SQLite's transactions hold the whole file.
+*/
+async function holdIssues(tx) {
+	if (engineOf(tx) === "sqlite") return;
+	await tx.execute(sql`SELECT pg_advisory_xact_lock(1668244070, 1)`);
+}
+/**
+* The issue lock shared, then 0.15's fence exclusive (`1668244070, 0`), as
+* 0.14's trigger takes them for an entry that changes access: what 0.15's
+* cutover holds, its member rows and 0.14's head taken first, so that its
+* own 0.14 entry's trigger waits on nothing (formal/Migration015.tla,
+* CutoverIssueFirst; T132). Every use and every change waits for its
+* commit; the checkpointer's barrier, which takes the issue lock exclusive
+* first, too. SQLite's transactions hold the whole file.
+*/
+async function holdFence(tx) {
+	if (engineOf(tx) === "sqlite") return;
+	await tx.execute(sql`SELECT pg_advisory_xact_lock_shared(1668244070, 1)`);
+	await tx.execute(sql`SELECT pg_advisory_xact_lock(1668244070, 0)`);
+}
+/**
 * Lock the log's head if no one holds it, without waiting: whether it is
 * held now. For work any caller may do, of which one at a time is enough,
 * which a request that finds the head taken leaves to the one that has it.
@@ -95,10 +139,45 @@ async function lockLogHeadIfFree(tx) {
 		if (held) holding.add(tx);
 		return held;
 	}
-	const { rows } = await tx.execute(sql`SELECT next_seq FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED`);
+	const rows = await rowsOf(tx, sql`SELECT next_seq FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED`);
 	if (rows.length > 0) holding.add(tx);
 	return rows.length > 0;
 }
+/**
+* Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+* `waiters` other transactions hold one of its places in line; otherwise
+* refuse at once (`HeadBusy`), having waited for nothing. A place is an
+* advisory lock, tried, never waited for, and held to the end of the
+* transaction, which holds the head by then: so at most `waiters`
+* connections wait for the head, or hold it, through here, and a burst
+* beyond them answers in one round trip rather than seconds later, holding
+* a connection all the while. One statement: the place, then, only if one
+* was free, the head; refused, one more says whether the head is there at
+* all. SQLite's transactions hold the whole file.
+*/
+async function lockLogHeadQueued(tx, waiters) {
+	if (engineOf(tx) === "sqlite") return lockLogHead(tx);
+	const [head] = await rowsOf(tx, sql`
+    SELECT next_seq, head_hash FROM audit_chain_head
+    WHERE only_row AND (SELECT true FROM generate_series(1, ${waiters}::int) AS place WHERE pg_try_advisory_xact_lock(${HEAD_LINE}, place) LIMIT 1)
+    FOR UPDATE`);
+	if (head === void 0) {
+		const [found] = await rowsOf(tx, sql`SELECT EXISTS (SELECT 1 FROM audit_chain_head WHERE only_row) AS found`);
+		if (found?.found !== true) throw new Error("audit_chain_head is missing; refusing to write an unchained entry");
+		throw new HeadBusy();
+	}
+	holding.add(tx);
+	return {
+		nextSeq: BigInt(head.next_seq),
+		headHash: head.head_hash
+	};
+}
+/**
+* The first key of the head's places in line, Postgres's advisory locks:
+* the second is the place. A space apart from the members' queues and the
+* migrator's key.
+*/
+const HEAD_LINE = 1668245096;
 const lockedHead = prepared((db) => {
 	const { auditChainHead } = tablesOf(db);
 	return forUpdate(db, db.select({
@@ -112,7 +191,7 @@ const lockedHead = prepared((db) => {
 * log as it stands, which no other append can change until this one
 * commits. It throws to refuse.
 */
-async function appendEntries(tx, key, entries, check, locked) {
+async function appendEntries(tx, key, entries, check, locked, changes = [], log015 = false) {
 	if (entries.length === 0) throw new Error("appendEntries called with no entries");
 	const { auditChainHead, auditLog } = tablesOf(tx);
 	if (locked === void 0 && !holding.has(tx)) await lockLogHead(tx);
@@ -159,12 +238,16 @@ async function appendEntries(tx, key, entries, check, locked) {
 			...fields,
 			prevHash,
 			mac,
-			hash
+			hash,
+			...log015 ? { log015: sql`true` } : {}
 		});
 		prevHash = hash;
 		seq += 1n;
 	}
-	if (engineOf(tx) === "postgres" && rows.length <= ROWS_AT_ONCE) await tx.execute(sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()})
+	let numbers = [];
+	if (engineOf(tx) === "postgres" && rows.length <= ROWS_AT_ONCE && changes.length > 0) numbers = await callChanges(tx, changes, sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()}),
+      moved AS (UPDATE audit_chain_head SET next_seq = ${seq}, head_hash = ${prevHash} WHERE only_row) `);
+	else if (engineOf(tx) === "postgres" && rows.length <= ROWS_AT_ONCE) await tx.execute(sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()})
       UPDATE audit_chain_head SET next_seq = ${seq}, head_hash = ${prevHash} WHERE only_row`);
 	else {
 		await tx.insert(auditLog).values(rows);
@@ -172,6 +255,7 @@ async function appendEntries(tx, key, entries, check, locked) {
 			nextSeq: seq,
 			headHash: prevHash
 		}).where(eq(auditChainHead.onlyRow, true));
+		numbers = await appChanges(tx, changes);
 	}
 	const written = {
 		nextSeq: seq,
@@ -181,7 +265,8 @@ async function appendEntries(tx, key, entries, check, locked) {
 	return {
 		seqStart: head.nextSeq,
 		...written,
-		occurredAt: now
+		occurredAt: now,
+		changes: numbers
 	};
 }
 /**
@@ -210,7 +295,7 @@ async function readUnderHead(tx, key) {
 		at: read.now
 	};
 }
-/** Entries one statement inserts at most, at 21 parameters each: Postgres takes 65,535. */
+/** Entries one statement inserts at most, at 21 parameters each (`log015` a literal): Postgres takes 65,535. */
 const ROWS_AT_ONCE = 3e3;
 /**
 * `readUnderHead`'s statement. Its `FOR UPDATE` waits for nothing in a
@@ -387,5 +472,134 @@ async function newestAuthentic(page, check) {
 	}
 	return "unreached";
 }
+/**
+* The app's changes to the objects its rows hold, as the vault sealed them
+* (`Vault.prepare`), each `app_change` (migrations 0025, 0026 and 0030), in its
+* transaction, once its rows and 0.14 entries are written: in order, in one
+* round trip, or in the append's own (`appendEntries`). Each entry's number;
+* 0 for a row of 0.14's, which logs nothing; null where a row's seal moved
+* since the app read it, and nothing was done (ChangeCAS: read again). A row
+* that is not its object's newest change's fails the call (`isStaleChange`),
+* and its transaction with it.
+*
+* On SQLite, which has no functions, the same steps in the transaction,
+* which holds the database's one write lock: the fence is implicit there
+* (0.15's plan, "Postgres serves; SQLite is for tests").
+*/
+async function appChanges(tx, calls) {
+	if (calls.length === 0) return [];
+	if (engineOf(tx) === "sqlite") {
+		const numbers = [];
+		for (const call of calls) numbers.push(await changeOnSqlite(tx, call, bytes));
+		return numbers;
+	}
+	return callChanges(tx, calls, sql``);
+}
+const bytes = (b64) => b64 === null ? null : Buffer.from(b64, "base64");
+/** `app_change`, once per call, in order, in one statement: after `before`, a `WITH` of the caller's. */
+async function callChanges(tx, calls, before) {
+	const rows = sql.join(calls.map((c, i) => sql`(${i}::int, ${c.kind}::text, ${c.id}::text, ${c.requestId}::text, ${c.at}::bigint, ${c.actor}::text, ${c.payload}::text, ${bytes(c.sealFrom)}::bytea, ${bytes(c.seal)}::bytea, ${bytes(c.mac)}::bytea, ${bytes(c.restores)}::bytea)`), sql`, `);
+	const numbers = await rowsOf(tx, sql`${before}
+    SELECT c.ord, app_change(c.kind, c.id, c.request, c.at, c.actor, c.payload, c.seal_from, c.seal, c.mac, c.restores) AS number
+      FROM (VALUES ${rows}) AS c(ord, kind, id, request, at, actor, payload, seal_from, seal, mac, restores)
+     ORDER BY c.ord`);
+	if (numbers.some(({ ord }, i) => Number(ord) !== i)) throw new Error("app_change answered out of order");
+	return numbers.map(({ number }) => number === null ? null : BigInt(number));
+}
+/**
+* An object's key in 0.15's log, `log_changes.object`: the first 16 bytes
+* of SHA-256 over its kind and id, as a uuid (`log_object` in SQL). The
+* vault's (`objectKey`), and the app's, which finds a credential's sign-in
+* by it.
+*/
+function logObject(kind, id) {
+	const hex = createHash("sha256").update(`coffre.object.v1\0${kind}\0${id}`).digest("hex");
+	return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+/** Whether `error` is `app_change`'s refusal of a row that is not its object's newest change's: Postgres's `data_corrupted`. */
+function isStaleChange(error) {
+	for (let cause = error; typeof cause === "object" && cause !== null; cause = cause.cause) if (cause instanceof StaleRow || cause.code === "XX001") return true;
+	return false;
+}
+var StaleRow = class extends Error {};
+const APP_OPS = {
+	credential: [
+		"credential.issue",
+		"credential.revoke",
+		"credential.renew",
+		"credential.scope"
+	],
+	connection: ["connection.make", "connection.revoke"],
+	secret: ["secret.write", "secret.delete"],
+	environment: [
+		"environment.create",
+		"environment.rename",
+		"environment.archive",
+		"project.archive",
+		"environment.delete"
+	]
+};
+/** `app_change` on SQLite. */
+async function changeOnSqlite(tx, call, bytes) {
+	const { logChanges, logUses } = tablesOf(tx);
+	const table = appTable(tx, call.kind);
+	const [row] = await tx.select({ seal: table.seal }).from(table).where(eq(table.id, call.id));
+	const held = row?.seal ?? null;
+	const [newest] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, call.object)).orderBy(desc(logChanges.number)).limit(1);
+	if (call.requestId === null) {
+		if (held !== null || newest !== void 0) throw new StaleRow(`the ${call.kind} object's row is not its newest change's: stale`);
+		return 0n;
+	}
+	const seal = bytes(call.seal);
+	const [prior] = await tx.select({
+		number: logChanges.number,
+		object: logChanges.object,
+		payload: logChanges.payload,
+		seal: logChanges.seal
+	}).from(logChanges).where(eq(logChanges.requestId, call.requestId));
+	if (prior !== void 0) {
+		if (prior.object !== call.object || prior.payload !== call.payload || !sameBytes(prior.seal ?? null, seal)) throw Object.assign(/* @__PURE__ */ new Error(`request ${call.requestId} names another change`), { code: "SQLITE_CONSTRAINT_UNIQUE" });
+		return BigInt(prior.number);
+	}
+	const payload = JSON.parse(call.payload ?? "null");
+	if (typeof payload?.op !== "string" || !(APP_OPS[call.kind] ?? []).includes(payload.op)) throw new Error(`the app makes no change ${String(payload?.op)} to a ${call.kind}`);
+	if (payload.ref?.kind !== call.kind || payload.ref.id !== call.id) throw new Error(`a change names the object it is to: ${call.kind}, ${call.id}`);
+	if (!sameBytes(held, newest?.seal ?? null)) throw new StaleRow(`the ${call.kind} object's row is not its newest change's: stale`);
+	const restores = bytes(call.restores);
+	if (restores !== null) {
+		if (call.kind !== "secret" || payload.op !== "secret.write" || call.sealFrom !== null) throw new Error("only a key's object made again from none restores one");
+		const [kept] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(and(eq(logChanges.object, call.object), isNotNull(logChanges.seal))).orderBy(desc(logChanges.number)).limit(1);
+		if (!sameBytes(restores, kept?.seal ?? null)) throw new StaleRow("the secret object an unarchive restores is not its newest sealed one: stale");
+	}
+	const from = bytes(call.sealFrom);
+	if (changedRows(await tx.update(table).set({ seal }).where(and(eq(table.id, call.id), from === null ? isNull(table.seal) : eq(table.seal, from)))) === 0) return null;
+	const [{ last }] = await tx.select({ last: sql`max(n)` }).from(sql`(SELECT max(${logChanges.number}) AS n FROM ${logChanges} UNION ALL SELECT max(${logUses.number}) FROM ${logUses})`);
+	const number = BigInt(last ?? 0) + 1n;
+	await tx.insert(logChanges).values({
+		number,
+		at: call.at,
+		requestId: call.requestId,
+		object: call.object,
+		actor: call.actor,
+		payload: call.payload,
+		seal,
+		mac: bytes(call.mac)
+	});
+	return number;
+}
+/** The table whose rows hold an object of this kind, the app's. */
+function appTable(tx, kind) {
+	const { credentials, mcpConnections, secrets, environments } = tablesOf(tx);
+	switch (kind) {
+		case "credential": return credentials;
+		case "connection": return mcpConnections;
+		case "secret": return secrets;
+		case "environment": return environments;
+		default: throw new Error(`no object kind ${String(kind)}`);
+	}
+}
+function sameBytes(a, b) {
+	return a === null || b === null ? a === b : a.equals(b);
+}
 //#endregion
-export { BATCH_BYTES, KeyRetired, LOOK_BACK, LogHeadMismatch, LogRewound, MOVES_FROM, appendEntries, entryColumns, forgetLogHeads, lockLogHead, lockLogHeadIfFree, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, withinBytes };
+export { BATCH_BYTES, HeadBusy, KeyRetired, LOOK_BACK, LogHeadMismatch, LogRewound, MOVES_FROM, RECORDS, appChanges, appendEntries, entryColumns, forgetLogHeads, holdFence, holdIssues, isStaleChange, lockLogHead, lockLogHeadIfFree, lockLogHeadQueued, logObject, missingEntry, newestAuthentic, newestSeqQuery, newestVaultEntries, newestVaultSeq, recorded, withinBytes };

package/dist/migrate.d.ts

@@ -1,8 +1,48 @@
+import { f as PostgresClient } from "./database-CVteLhp1.js";
 import { Engine } from "./dialect.js";
-import { PoolClient } from "pg";
 //#region src/migrate.d.ts
-/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
-export declare function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void>;
+/**
+ * Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry, the hot path's login's
+ * group and settings, and the runtime logins' `jit = off`.
+ */
+export declare function restrictDatabase(client: Pick<PostgresClient, 'unsafe'>): Promise<void>;
+/**
+ * What 0022 gives `coffre_vault_hot`, given again when it lacks it: its
+ * membership in coffre_vault, inherited, and its lock and statement
+ * timeouts and generic plans. A role dropped and made again, as `coffre
+ * setup` makes a missing one, has none of them, and 0022 never runs
+ * twice. So whatever 0022 refuses, this refuses too: a role made again
+ * may be anyone's. Unsafe attributes, objects it owns, a membership in
+ * another role, one of any grantor that may set or grant coffre_vault
+ * (which would let it hand the vault's rights to the app's login), and a
+ * setting of its own for this database alone, which would outrank the
+ * server-wide one at login. Then only what differs, and refused, saying
+ * what to run, to a login that may not change the role or grant the group.
+ */
+export declare function holdHotLogin(client: Pick<PostgresClient, 'unsafe'>): Promise<void>;
+/**
+ * Set `jit = off` on `logins`, when they lack it.
+ *
+ * Past `jit_above_cost` (100,000 by default) Postgres compiles a plan's
+ * expressions at every execution of it: 150 ms where a use costs under 2 ms
+ * (0029), and a statement's estimate grows with its tables. The functions that
+ * run as their owner say no JIT themselves (0029); the setting here covers
+ * every other statement of these logins, now and to come. A role's settings
+ * apply to the role that logs in, never through a group, and a pooler such as
+ * Hyperdrive may not pass a startup option on, so it is the login's own, on
+ * the server. It is the server's, not the database's, as the logins are (and
+ * as 0022 sets the hot login's): made once by a login with CREATEROLE and
+ * ADMIN on them, and found set by any other that migrates after.
+ *
+ * Only when it differs, whatever way the boolean is spelled: altering a role
+ * takes CREATEROLE and its ADMIN, which a login that only migrates may lack.
+ * The row is the server's, and the migration lock each database's, so a run
+ * on another database may be changing it too: Postgres fails the second
+ * change (a concurrent update, or a duplicate key), and it looks again once
+ * the first has committed. A setting of the login's for this database alone
+ * outranks the server-wide one at login, so it is refused, as 0022 does.
+ */
+export declare function turnJitOff(client: Pick<PostgresClient, 'unsafe'>, logins: readonly string[]): Promise<void>;
 /** Why `login` cannot be the backup login, before anything runs, or null when it may. */
 export declare function backupLoginProblem(login: string): string | null;
 /**

package/dist/migrate.js

@@ -1,4 +1,4 @@
-import { t as postgresConnection } from "./postgres-Bmar8y0q.js";
+import { a as quoteIdentifier, i as postgresSession } from "./postgres-BI3xTnyw.js";
 import { engineOfUrl } from "./connect.js";
 import { createHash } from "node:crypto";
 import { readFile } from "node:fs/promises";
@@ -15,15 +15,144 @@ import { fileURLToPath } from "node:url";
 * whole run. Restricted runtime roles are Postgres-only (baseline/postgres.sql).
 */
 const MIGRATION_LOCK_KEY = "7165058122361679213";
-/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
+/** The logins that run coffre's own statements: the app's, the vault's, and 0.15's hot path's. */
+const RUNTIME_LOGINS = [
+	"coffre_runtime",
+	"coffre_vault_runtime",
+	"coffre_vault_hot"
+];
+/**
+* Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry, the hot path's login's
+* group and settings, and the runtime logins' `jit = off`.
+*/
 async function restrictDatabase(client) {
-	await client.query(`DO $$ BEGIN
+	await client.unsafe(`DO $$ BEGIN
     EXECUTE format(
-      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime, coffre_backup',
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime, coffre_vault_hot, coffre_backup',
       current_database()
     );
+  END $$`);
+	await holdHotLogin(client);
+	await turnJitOff(client, RUNTIME_LOGINS);
+}
+/**
+* What 0022 gives `coffre_vault_hot`, given again when it lacks it: its
+* membership in coffre_vault, inherited, and its lock and statement
+* timeouts and generic plans. A role dropped and made again, as `coffre
+* setup` makes a missing one, has none of them, and 0022 never runs
+* twice. So whatever 0022 refuses, this refuses too: a role made again
+* may be anyone's. Unsafe attributes, objects it owns, a membership in
+* another role, one of any grantor that may set or grant coffre_vault
+* (which would let it hand the vault's rights to the app's login), and a
+* setting of its own for this database alone, which would outrank the
+* server-wide one at login. Then only what differs, and refused, saying
+* what to run, to a login that may not change the role or grant the group.
+*/
+async function holdHotLogin(client) {
+	await client.unsafe(`DO $$ DECLARE
+    held text[];
+  BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_vault_hot') THEN
+      RAISE EXCEPTION 'coffre_vault_hot does not exist, though 0022 made it: run coffre setup, which makes it a login, or have a login with CREATEROLE run CREATE ROLE coffre_vault_hot NOLOGIN, then migrate again';
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_vault_hot' AND (rolsuper OR rolreplication OR rolbypassrls)) THEN
+      RAISE EXCEPTION 'coffre_vault_hot has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off';
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_shdepend WHERE refclassid = 'pg_authid'::regclass AND refobjid = 'coffre_vault_hot'::regrole AND deptype = 'o') THEN
+      RAISE EXCEPTION 'coffre_vault_hot owns database objects';
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_auth_members WHERE member = 'coffre_vault_hot'::regrole AND roleid <> 'coffre_vault'::regrole) THEN
+      RAISE EXCEPTION 'coffre_vault_hot is a member of a role other than coffre_vault: revoke its memberships';
+    END IF;
+    IF EXISTS (
+      SELECT 1 FROM pg_auth_members WHERE member = 'coffre_vault_hot'::regrole AND roleid = 'coffre_vault'::regrole AND (set_option OR admin_option)
+    ) THEN
+      RAISE EXCEPTION 'coffre_vault_hot may set or grant coffre_vault: have its grantor run REVOKE coffre_vault FROM coffre_vault_hot, then migrate again';
+    END IF;
+    IF EXISTS (
+      SELECT 1 FROM pg_db_role_setting s, unnest(s.setconfig) AS setting
+       WHERE s.setrole = 'coffre_vault_hot'::regrole AND s.setdatabase = (SELECT oid FROM pg_database WHERE datname = current_database())
+         AND split_part(setting, '=', 1) IN ('lock_timeout', 'statement_timeout', 'plan_cache_mode')
+    ) THEN
+      RAISE EXCEPTION 'coffre_vault_hot has its own lock_timeout, statement_timeout or plan_cache_mode in this database, over the hot path''s: run ALTER ROLE coffre_vault_hot IN DATABASE % RESET ALL, then migrate again', quote_ident(current_database());
+    END IF;
+    -- The role is the server's, as turnJitOff's logins are: a run on another database may be changing it too, and fails the second change.
+    FOR attempt IN 1..5 LOOP
+      BEGIN
+        SELECT setconfig INTO held FROM pg_db_role_setting WHERE setrole = 'coffre_vault_hot'::regrole AND setdatabase = 0;
+        IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_vault_hot' AND (NOT rolinherit OR rolcreatedb OR rolcreaterole)) THEN
+          ALTER ROLE coffre_vault_hot INHERIT NOCREATEDB NOCREATEROLE;
+        END IF;
+        IF NOT coalesce(held @> ARRAY['lock_timeout=1s'], false) THEN ALTER ROLE coffre_vault_hot SET lock_timeout = '1s'; END IF;
+        IF NOT coalesce(held @> ARRAY['statement_timeout=2s'], false) THEN ALTER ROLE coffre_vault_hot SET statement_timeout = '2s'; END IF;
+        IF NOT coalesce(held @> ARRAY['plan_cache_mode=force_generic_plan'], false) THEN ALTER ROLE coffre_vault_hot SET plan_cache_mode = force_generic_plan; END IF;
+        IF NOT EXISTS (
+          SELECT 1 FROM pg_auth_members WHERE member = 'coffre_vault_hot'::regrole AND roleid = 'coffre_vault'::regrole AND inherit_option
+        ) THEN
+          GRANT coffre_vault TO coffre_vault_hot WITH ADMIN FALSE, INHERIT TRUE, SET FALSE;
+        END IF;
+        EXIT;
+      EXCEPTION
+        WHEN insufficient_privilege THEN
+          RAISE EXCEPTION '% may not make coffre_vault_hot what 0.15 needs (%): have a login with CREATEROLE and ADMIN on both roles run ALTER ROLE coffre_vault_hot INHERIT NOCREATEDB NOCREATEROLE; ALTER ROLE coffre_vault_hot SET lock_timeout = ''1s''; ALTER ROLE coffre_vault_hot SET statement_timeout = ''2s''; ALTER ROLE coffre_vault_hot SET plan_cache_mode = force_generic_plan; GRANT coffre_vault TO coffre_vault_hot WITH ADMIN FALSE, INHERIT TRUE, SET FALSE first', current_user, SQLERRM;
+        WHEN internal_error OR unique_violation THEN
+          IF attempt = 5 THEN RAISE; END IF;
+          PERFORM pg_sleep(0.2);
+      END;
+    END LOOP;
   END $$`);
 }
+/**
+* Set `jit = off` on `logins`, when they lack it.
+*
+* Past `jit_above_cost` (100,000 by default) Postgres compiles a plan's
+* expressions at every execution of it: 150 ms where a use costs under 2 ms
+* (0029), and a statement's estimate grows with its tables. The functions that
+* run as their owner say no JIT themselves (0029); the setting here covers
+* every other statement of these logins, now and to come. A role's settings
+* apply to the role that logs in, never through a group, and a pooler such as
+* Hyperdrive may not pass a startup option on, so it is the login's own, on
+* the server. It is the server's, not the database's, as the logins are (and
+* as 0022 sets the hot login's): made once by a login with CREATEROLE and
+* ADMIN on them, and found set by any other that migrates after.
+*
+* Only when it differs, whatever way the boolean is spelled: altering a role
+* takes CREATEROLE and its ADMIN, which a login that only migrates may lack.
+* The row is the server's, and the migration lock each database's, so a run
+* on another database may be changing it too: Postgres fails the second
+* change (a concurrent update, or a duplicate key), and it looks again once
+* the first has committed. A setting of the login's for this database alone
+* outranks the server-wide one at login, so it is refused, as 0022 does.
+*/
+async function turnJitOff(client, logins) {
+	const jit = (database, value) => `EXISTS (
+        SELECT 1 FROM pg_db_role_setting s, unnest(s.setconfig) AS setting
+         WHERE s.setrole = login::regrole AND s.setdatabase = ${database}
+           AND (CASE WHEN split_part(setting, '=', 1) = 'jit' THEN substr(setting, 5)::boolean END) IS ${value})`;
+	await client.unsafe(`DO $$ DECLARE
+      login text;
+      here oid := (SELECT oid FROM pg_database WHERE datname = current_database());
+    BEGIN
+      FOREACH login IN ARRAY ARRAY[${logins.map((login) => `'${login}'`).join(", ")}] LOOP
+        IF ${jit("here", "TRUE")} THEN
+          RAISE EXCEPTION '% has its own jit setting in this database, over the server-wide one: run ALTER ROLE % IN DATABASE % RESET jit, then migrate again', login, login, quote_ident(current_database());
+        END IF;
+        FOR attempt IN 1..5 LOOP
+          EXIT WHEN ${jit("0", "FALSE")};
+          BEGIN
+            EXECUTE format('ALTER ROLE %I SET jit = off', login);
+            EXIT;
+          EXCEPTION
+            WHEN insufficient_privilege THEN
+              RAISE EXCEPTION '% may not set jit = off on %, whose statements Postgres would compile at every run: have a login with CREATEROLE and ADMIN on it run ALTER ROLE % SET jit = off, then migrate again', current_user, login, login;
+            WHEN internal_error OR unique_violation THEN
+              IF attempt = 5 THEN RAISE; END IF;
+              PERFORM pg_sleep(0.2);
+          END;
+        END LOOP;
+      END LOOP;
+    END $$`);
+}
 /** Why `login` cannot be the backup login, before anything runs, or null when it may. */
 function backupLoginProblem(login) {
 	if (login === "") return "the backup login is empty: name the role to grant coffre_backup";
@@ -32,7 +161,8 @@ function backupLoginProblem(login) {
 		"coffre_app",
 		"coffre_vault",
 		"coffre_runtime",
-		"coffre_vault_runtime"
+		"coffre_vault_runtime",
+		"coffre_vault_hot"
 	].includes(login)) return `the backup login is ${login}, one of coffre's own roles: name the login that backs up`;
 	return null;
 }
@@ -170,40 +300,31 @@ function verifyHistory(expected, applied, requireComplete) {
 	if (requireComplete && rows.length !== expected.length) throw new Error(`migration history is incomplete: expected ${expected.length}, found ${rows.length}`);
 }
 async function postgresMigrator(url) {
-	const [{ default: pg }, { drizzle }, { migrate }] = await Promise.all([
-		import("pg"),
-		import("drizzle-orm/node-postgres"),
-		import("drizzle-orm/node-postgres/migrator")
-	]);
-	const pool = new pg.Pool({
-		...postgresConnection(url),
-		application_name: "coffre-migrations",
-		max: 1
-	});
-	const client = await pool.connect();
+	const [{ createDatabase }, { migrate }] = await Promise.all([import("./index.js"), import("drizzle-orm/postgres-js/migrator")]);
+	const client = postgresSession(url, { application_name: "coffre-migrations" });
 	return {
 		async applied() {
-			if (!(await client.query("SELECT to_regclass('drizzle.__drizzle_migrations')::text AS relation")).rows[0]?.relation) return null;
-			return (await client.query("SELECT hash, created_at::text FROM drizzle.__drizzle_migrations ORDER BY created_at, id")).rows;
+			const [found] = await client.unsafe("SELECT to_regclass('drizzle.__drizzle_migrations')::text AS relation");
+			if (!found?.relation) return null;
+			return [...await client.unsafe("SELECT hash, created_at::text FROM drizzle.__drizzle_migrations ORDER BY created_at, id")];
 		},
 		async lock() {
-			await client.query("SET lock_timeout = '5min'");
-			await client.query("SELECT pg_advisory_lock($1::bigint)", [MIGRATION_LOCK_KEY]);
+			await client.unsafe("SET lock_timeout = '5min'");
+			await client.unsafe("SELECT pg_advisory_lock($1::bigint)", [MIGRATION_LOCK_KEY]);
 		},
 		async unlock() {
-			await client.query("SELECT pg_advisory_unlock($1::bigint)", [MIGRATION_LOCK_KEY]);
+			await client.unsafe("SELECT pg_advisory_unlock($1::bigint)", [MIGRATION_LOCK_KEY]);
 		},
-		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
+		migrate: (migrationsFolder) => migrate(createDatabase(client), { migrationsFolder }),
 		async restrict(backupLogin) {
 			await restrictDatabase(client);
 			if (backupLogin !== void 0) {
-				const { rowCount } = await client.query("SELECT 1 FROM pg_roles WHERE rolname::text = $1", [backupLogin]);
-				if (rowCount === 0) throw new Error(`role ${client.escapeIdentifier(backupLogin)} does not exist: make it, coffre never does`);
-				await client.query(`GRANT coffre_backup TO ${client.escapeIdentifier(backupLogin)} WITH ADMIN FALSE, INHERIT TRUE, SET FALSE`);
+				if ((await client.unsafe("SELECT 1 FROM pg_roles WHERE rolname::text = $1", [backupLogin])).length === 0) throw new Error(`role ${quoteIdentifier(backupLogin)} does not exist: make it, coffre never does`);
+				await client.unsafe(`GRANT coffre_backup TO ${quoteIdentifier(backupLogin)} WITH ADMIN FALSE, INHERIT TRUE, SET FALSE`);
 			}
 		},
 		async notOwner({ relations, functions }) {
-			const { rows } = await client.query(FOREIGN_OWNERS, [relations, functions]);
+			const rows = await client.unsafe(FOREIGN_OWNERS, [relations, functions]);
 			if (rows.length === 0) return null;
 			const [{ login, grants_inherit: grantsInherit, inherits }] = rows;
 			return new NotOwner(login, rows.map(({ owner, member }) => ({
@@ -215,8 +336,7 @@ async function postgresMigrator(url) {
 			});
 		},
 		async close() {
-			client.release();
-			await pool.end();
+			await client.end();
 		}
 	};
 }
@@ -317,4 +437,4 @@ async function migrateDatabase(url, { onPlan, backupLogin } = {}) {
 	}
 }
 //#endregion
-export { AfterMigrations, DatabaseAhead, NotOwner, backupLoginProblem, managedObjects, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };
+export { AfterMigrations, DatabaseAhead, NotOwner, backupLoginProblem, holdHotLogin, managedObjects, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase, turnJitOff };

package/dist/migrations/postgres/0021_prune_vault_releases.sql

@@ -0,0 +1,19 @@
+-- Releases pruned (W199, T111): the vault's checkpoint forgets the releases no window can count again, those over a day and an hour old by the database's clock, at most at_most a call. A bulk limit's window is a day at most (the vault's config), and the hour is a margin for the clock stepping back: no caller chooses what is kept, so the vault's login, which still deletes no row itself, cannot forget a release a window counts. The release before never calls it.
+CREATE FUNCTION prune_vault_releases(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '3s' AS $$
+    -- The bound in the DELETE's own WHERE too: a row a read moved on since the subquery's snapshot is checked again,
+    -- as it is now, and kept.
+    WITH bound AS (SELECT (extract(epoch from clock_timestamp()) * 1000)::bigint - 25 * 3600000 AS before),
+    pruned AS (
+        DELETE FROM public.vault_releases
+         WHERE released_at < (SELECT before FROM bound)
+           AND ctid IN (
+            -- Any of them, each past every window; a row an append holds is left to the next run, rather than waited for.
+            SELECT ctid FROM public.vault_releases WHERE released_at < (SELECT before FROM bound) LIMIT at_most FOR UPDATE SKIP LOCKED
+           )
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_vault_releases(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_vault_releases(integer) TO coffre_vault;