@coffre/db 0.14.4 → 0.15.0

package/src/log.ts

@@ -1,10 +1,14 @@
+import { createHash } from 'node:crypto';
 import { GENESIS_HASH, sealEntry, type LogFields, type LogKey, type StoredEntry } from '@coffre/core/audit';
-import { and, asc, count, desc, eq, gt, gte, lt, lte, sql, type Placeholder, type SQL } from 'drizzle-orm';
+import type { PreparedChange } from '@coffre/core/vault';
+import { and, asc, count, desc, eq, gt, gte, isNotNull, isNull, lt, lte, sql, type Placeholder, type SQL } from 'drizzle-orm';
 
 import { afterCommit } from './commits.ts';
 import { tablesOf, type Queryable, type Transaction } from './database.ts';
 import { prepared } from './prepared.ts';
-import { clockMillis, engineOf, forUpdate } from './dialect.ts';
+import { changedRows, clockMillis, engineOf, forUpdate, rowsOf } from './dialect.ts';
+
+export { recorded, RECORDS, type ChangeRecord } from './change-records.ts';
 
 /**
  * Appending to the audit log, the one table both the app and the vault
@@ -59,6 +63,20 @@ export class LogHeadMismatch extends Error {
   }
 }
 
+/**
+ * As many transactions as may already wait for the log's head do
+ * (`lockLogHeadQueued`): this one waits for nothing, and holds nothing.
+ * Its code is Postgres's for a lock not available, so every caller already
+ * answers it as one that gave up waiting: unavailable, ask again shortly.
+ */
+export class HeadBusy extends Error {
+  readonly code = '55P03';
+  constructor() {
+    super("too many requests wait for the audit log's head: ask again shortly");
+    this.name = 'HeadBusy';
+  }
+}
+
 /**
  * The log's head is behind one this process wrote: the database was rolled
  * back, or entries were cut off its end. That cannot be told from a restore,
@@ -136,6 +154,37 @@ export async function lockLogHead(tx: Transaction): Promise<{ nextSeq: bigint; h
   return head;
 }
 
+/**
+ * Take the issue lock exclusive (migration 0026's, `1668244070, 1`): every
+ * issue in flight, a sign-in or a token's, ends first, and none starts
+ * until this transaction does. A write that moves what an issue's policy
+ * check compares (`issue_token`: the policy, a protected environment's
+ * slug) takes it, after its own rows and before the fence its append's
+ * trigger takes, as the checkpointer's barrier does: so the issue is
+ * ordered against it, and no use waits behind an issue (formal/Lifecycle.tla's
+ * IssuePolicyHeld, Migration015.tla's PolicyIssueFirst; T149, review r3).
+ * SQLite's transactions hold the whole file.
+ */
+export async function holdIssues(tx: Transaction): Promise<void> {
+  if (engineOf(tx) === 'sqlite') return;
+  await tx.execute(sql`SELECT pg_advisory_xact_lock(1668244070, 1)`);
+}
+
+/**
+ * The issue lock shared, then 0.15's fence exclusive (`1668244070, 0`), as
+ * 0.14's trigger takes them for an entry that changes access: what 0.15's
+ * cutover holds, its member rows and 0.14's head taken first, so that its
+ * own 0.14 entry's trigger waits on nothing (formal/Migration015.tla,
+ * CutoverIssueFirst; T132). Every use and every change waits for its
+ * commit; the checkpointer's barrier, which takes the issue lock exclusive
+ * first, too. SQLite's transactions hold the whole file.
+ */
+export async function holdFence(tx: Transaction): Promise<void> {
+  if (engineOf(tx) === 'sqlite') return;
+  await tx.execute(sql`SELECT pg_advisory_xact_lock_shared(1668244070, 1)`);
+  await tx.execute(sql`SELECT pg_advisory_xact_lock(1668244070, 0)`);
+}
+
 /**
  * Lock the log's head if no one holds it, without waiting: whether it is
  * held now. For work any caller may do, of which one at a time is enough,
@@ -148,13 +197,47 @@ export async function lockLogHeadIfFree(tx: Transaction): Promise<boolean> {
     if (held) holding.add(tx);
     return held;
   }
-  const { rows } = await (tx as unknown as { execute(query: SQL): Promise<{ rows: unknown[] }> }).execute(
-    sql`SELECT next_seq FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED`,
-  );
+  const rows = await rowsOf(tx, sql`SELECT next_seq FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED`);
   if (rows.length > 0) holding.add(tx);
   return rows.length > 0;
 }
 
+/**
+ * Lock the log's head, waiting for it as `lockLogHead` does, if fewer than
+ * `waiters` other transactions hold one of its places in line; otherwise
+ * refuse at once (`HeadBusy`), having waited for nothing. A place is an
+ * advisory lock, tried, never waited for, and held to the end of the
+ * transaction, which holds the head by then: so at most `waiters`
+ * connections wait for the head, or hold it, through here, and a burst
+ * beyond them answers in one round trip rather than seconds later, holding
+ * a connection all the while. One statement: the place, then, only if one
+ * was free, the head; refused, one more says whether the head is there at
+ * all. SQLite's transactions hold the whole file.
+ */
+export async function lockLogHeadQueued(tx: Transaction, waiters: number): Promise<{ nextSeq: bigint; headHash: Buffer }> {
+  if (engineOf(tx) === 'sqlite') return lockLogHead(tx);
+  const rows = await rowsOf<{ next_seq: string; head_hash: Buffer }>(tx, sql`
+    SELECT next_seq, head_hash FROM audit_chain_head
+    WHERE only_row AND (SELECT true FROM generate_series(1, ${waiters}::int) AS place WHERE pg_try_advisory_xact_lock(${HEAD_LINE}, place) LIMIT 1)
+    FOR UPDATE`);
+  const [head] = rows;
+  if (head === undefined) {
+    // No place, or no head at all: the second, which no one may write past, said as lockLogHead says it.
+    const [found] = await rowsOf<{ found: boolean }>(tx, sql`SELECT EXISTS (SELECT 1 FROM audit_chain_head WHERE only_row) AS found`);
+    if (found?.found !== true) throw new Error('audit_chain_head is missing; refusing to write an unchained entry');
+    throw new HeadBusy();
+  }
+  holding.add(tx);
+  return { nextSeq: BigInt(head.next_seq), headHash: head.head_hash };
+}
+
+/**
+ * The first key of the head's places in line, Postgres's advisory locks:
+ * the second is the place. A space apart from the members' queues and the
+ * migrator's key.
+ */
+const HEAD_LINE = 0x636f6668;
+
 const lockedHead = prepared((db) => {
   const { auditChainHead } = tablesOf(db);
   return forUpdate(
@@ -180,7 +263,20 @@ export async function appendEntries(
    * nothing to read again.
    */
   locked?: HeldHead,
-): Promise<Appended> {
+  /**
+   * 0.15's changes of the app's write these entries record (`appChanges`):
+   * on Postgres, made in the append's own statement, one round trip less
+   * under the head, which every sign-in waits for (T123). Their numbers
+   * come back as `changes`.
+   */
+  changes: readonly PreparedChange[] = [],
+  /**
+   * Whether the writer runs under 0.15's log: its entries carry `log015`,
+   * which no MAC covers and 0.14's code never sets. Once the log is cut
+   * over, migration 0047's trigger refuses a write's entry without it.
+   */
+  log015 = false,
+): Promise<Appended & { changes: (bigint | null)[] }> {
   if (entries.length === 0) throw new Error('appendEntries called with no entries');
   const { auditChainHead, auditLog } = tablesOf(tx);
 
@@ -208,7 +304,7 @@ export async function appendEntries(
 
   let seq = head.nextSeq;
   let prevHash = head.headHash;
-  const rows: (typeof auditLog.$inferInsert)[] = [];
+  const rows: (Omit<typeof auditLog.$inferInsert, 'log015'> & { log015?: SQL })[] = [];
   for (const entry of entries) {
     const fields: LogFields = {
       seq,
@@ -231,22 +327,31 @@ export async function appendEntries(
       metadata: entry.metadata ?? '{}',
     };
     const { mac, hash } = sealEntry(key, prevHash, fields);
-    rows.push({ ...fields, prevHash, mac, hash });
+    // A literal, not a parameter: a row's 21 parameters are what `ROWS_AT_ONCE` counts (review r5).
+    rows.push({ ...fields, prevHash, mac, hash, ...(log015 ? { log015: sql`true` } : {}) });
     prevHash = hash;
     seq += 1n;
   }
 
-  if (engineOf(tx) === 'postgres' && rows.length <= ROWS_AT_ONCE) {
+  let numbers: (bigint | null)[] = [];
+  if (engineOf(tx) === 'postgres' && rows.length <= ROWS_AT_ONCE && changes.length > 0) {
+    // The entries, the head that names the last of them, and the changes, in one statement. The changes run in the
+    // select list, in their order; the inserts after it, and their trigger (the fence, for an entry that changes
+    // access) at its end: each takes the issue lock before the fence, so either order is the locks' (migration 0026).
+    numbers = await callChanges(tx, changes, sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()}),
+      moved AS (UPDATE audit_chain_head SET next_seq = ${seq}, head_hash = ${prevHash} WHERE only_row) `);
+  } else if (engineOf(tx) === 'postgres' && rows.length <= ROWS_AT_ONCE) {
     // The entries and the head that names the last of them, in one statement.
     await tx.execute(sql`WITH appended AS (${tx.insert(auditLog).values(rows).getSQL()})
       UPDATE audit_chain_head SET next_seq = ${seq}, head_hash = ${prevHash} WHERE only_row`);
   } else {
     await tx.insert(auditLog).values(rows);
     await tx.update(auditChainHead).set({ nextSeq: seq, headHash: prevHash }).where(eq(auditChainHead.onlyRow, true));
+    numbers = await appChanges(tx, changes);
   }
   const written = { nextSeq: seq, headHash: prevHash };
   afterCommit(tx, () => remember(key, written));
-  return { seqStart: head.nextSeq, ...written, occurredAt: now };
+  return { seqStart: head.nextSeq, ...written, occurredAt: now, changes: numbers };
 }
 
 /** A head locked by a statement of the caller's, and what it read under the lock (`appendEntries`). */
@@ -270,7 +375,7 @@ async function readUnderHead(tx: Transaction, key: LogKey): Promise<HeldHead> {
   };
 }
 
-/** Entries one statement inserts at most, at 21 parameters each: Postgres takes 65,535. */
+/** Entries one statement inserts at most, at 21 parameters each (`log015` a literal): Postgres takes 65,535. */
 const ROWS_AT_ONCE = 3000;
 
 /**
@@ -479,3 +584,131 @@ export async function newestAuthentic(page: (limit: number, before: bigint | und
   }
   return 'unreached';
 }
+
+// --- 0.15's log: the app's changes -------------------------------------------
+
+/**
+ * The app's changes to the objects its rows hold, as the vault sealed them
+ * (`Vault.prepare`), each `app_change` (migrations 0025, 0026 and 0030), in its
+ * transaction, once its rows and 0.14 entries are written: in order, in one
+ * round trip, or in the append's own (`appendEntries`). Each entry's number;
+ * 0 for a row of 0.14's, which logs nothing; null where a row's seal moved
+ * since the app read it, and nothing was done (ChangeCAS: read again). A row
+ * that is not its object's newest change's fails the call (`isStaleChange`),
+ * and its transaction with it.
+ *
+ * On SQLite, which has no functions, the same steps in the transaction,
+ * which holds the database's one write lock: the fence is implicit there
+ * (0.15's plan, "Postgres serves; SQLite is for tests").
+ */
+export async function appChanges(tx: Transaction, calls: readonly PreparedChange[]): Promise<(bigint | null)[]> {
+  if (calls.length === 0) return [];
+  if (engineOf(tx) === 'sqlite') {
+    const numbers: (bigint | null)[] = [];
+    for (const call of calls) numbers.push(await changeOnSqlite(tx, call, bytes));
+    return numbers;
+  }
+  return callChanges(tx, calls, sql``);
+}
+
+const bytes = (b64: string | null) => (b64 === null ? null : Buffer.from(b64, 'base64'));
+
+/** `app_change`, once per call, in order, in one statement: after `before`, a `WITH` of the caller's. */
+async function callChanges(tx: Transaction, calls: readonly PreparedChange[], before: SQL): Promise<(bigint | null)[]> {
+  const rows = sql.join(calls.map((c, i) => sql`(${i}::int, ${c.kind}::text, ${c.id}::text, ${c.requestId}::text, ${c.at}::bigint, ${c.actor}::text, ${c.payload}::text, ${bytes(c.sealFrom)}::bytea, ${bytes(c.seal)}::bytea, ${bytes(c.mac)}::bytea, ${bytes(c.restores)}::bytea)`), sql`, `);
+  // A volatile function in the select list runs after the sort: each call in `ord`'s order, each from the seal the one before leaves.
+  const numbers = await rowsOf<{ ord: number; number: string | number | null }>(tx, sql`${before}
+    SELECT c.ord, app_change(c.kind, c.id, c.request, c.at, c.actor, c.payload, c.seal_from, c.seal, c.mac, c.restores) AS number
+      FROM (VALUES ${rows}) AS c(ord, kind, id, request, at, actor, payload, seal_from, seal, mac, restores)
+     ORDER BY c.ord`);
+  if (numbers.some(({ ord }, i) => Number(ord) !== i)) throw new Error('app_change answered out of order');
+  return numbers.map(({ number }) => (number === null ? null : BigInt(number)));
+}
+
+/**
+ * An object's key in 0.15's log, `log_changes.object`: the first 16 bytes
+ * of SHA-256 over its kind and id, as a uuid (`log_object` in SQL). The
+ * vault's (`objectKey`), and the app's, which finds a credential's sign-in
+ * by it.
+ */
+export function logObject(kind: string, id: string): string {
+  const hex = createHash('sha256').update(`coffre.object.v1\0${kind}\0${id}`).digest('hex');
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+
+/** Whether `error` is `app_change`'s refusal of a row that is not its object's newest change's: Postgres's `data_corrupted`. */
+export function isStaleChange(error: unknown): boolean {
+  for (let cause = error; typeof cause === 'object' && cause !== null; cause = (cause as { cause?: unknown }).cause) {
+    if (cause instanceof StaleRow || (cause as { code?: unknown }).code === 'XX001') return true;
+  }
+  return false;
+}
+
+class StaleRow extends Error {}
+
+const APP_OPS: Record<PreparedChange['kind'], readonly string[]> = {
+  credential: ['credential.issue', 'credential.revoke', 'credential.renew', 'credential.scope'],
+  connection: ['connection.make', 'connection.revoke'],
+  secret: ['secret.write', 'secret.delete'],
+  environment: ['environment.create', 'environment.rename', 'environment.archive', 'project.archive', 'environment.delete'],
+};
+
+/** `app_change` on SQLite. */
+async function changeOnSqlite(tx: Transaction, call: PreparedChange, bytes: (b64: string | null) => Buffer | null): Promise<bigint | null> {
+  const { logChanges, logUses } = tablesOf(tx);
+  const table = appTable(tx, call.kind);
+  const [row] = await tx.select({ seal: table.seal }).from(table).where(eq(table.id, call.id));
+  const held = row?.seal ?? null;
+  const [newest] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, call.object)).orderBy(desc(logChanges.number)).limit(1);
+  if (call.requestId === null) {
+    if (held !== null || newest !== undefined) throw new StaleRow(`the ${call.kind} object's row is not its newest change's: stale`);
+    return 0n;
+  }
+  const seal = bytes(call.seal);
+  const [prior] = await tx.select({ number: logChanges.number, object: logChanges.object, payload: logChanges.payload, seal: logChanges.seal }).from(logChanges).where(eq(logChanges.requestId, call.requestId));
+  if (prior !== undefined) {
+    if (prior.object !== call.object || prior.payload !== call.payload || !sameBytes(prior.seal ?? null, seal)) {
+      throw Object.assign(new Error(`request ${call.requestId} names another change`), { code: 'SQLITE_CONSTRAINT_UNIQUE' });
+    }
+    return BigInt(prior.number);
+  }
+  const payload = JSON.parse(call.payload ?? 'null') as { op?: unknown; ref?: { kind?: unknown; id?: unknown } } | null;
+  if (typeof payload?.op !== 'string' || !(APP_OPS[call.kind] ?? []).includes(payload.op)) throw new Error(`the app makes no change ${String(payload?.op)} to a ${call.kind}`);
+  if (payload.ref?.kind !== call.kind || payload.ref.id !== call.id) throw new Error(`a change names the object it is to: ${call.kind}, ${call.id}`);
+  // ChangeChecksSeal.
+  if (!sameBytes(held, newest?.seal ?? null)) throw new StaleRow(`the ${call.kind} object's row is not its newest change's: stale`);
+  // RestorePinned: an unarchive restores the object its key's log last sealed, still so (0030).
+  const restores = bytes(call.restores);
+  if (restores !== null) {
+    if (call.kind !== 'secret' || payload.op !== 'secret.write' || call.sealFrom !== null) throw new Error("only a key's object made again from none restores one");
+    const [kept] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(and(eq(logChanges.object, call.object), isNotNull(logChanges.seal))).orderBy(desc(logChanges.number)).limit(1);
+    if (!sameBytes(restores, kept?.seal ?? null)) throw new StaleRow('the secret object an unarchive restores is not its newest sealed one: stale');
+  }
+  // ChangeCAS.
+  const from = bytes(call.sealFrom);
+  const done = changedRows(await tx.update(table).set({ seal }).where(and(eq(table.id, call.id), from === null ? isNull(table.seal) : eq(table.seal, from))));
+  if (done === 0) return null;
+  // One sequence for both tables, as `log_number` is on Postgres.
+  const [{ last }] = await tx.select({ last: sql<number | string | null>`max(n)` }).from(
+    sql`(SELECT max(${logChanges.number}) AS n FROM ${logChanges} UNION ALL SELECT max(${logUses.number}) FROM ${logUses})`,
+  );
+  const number = BigInt(last ?? 0) + 1n;
+  await tx.insert(logChanges).values({ number, at: call.at, requestId: call.requestId, object: call.object, actor: call.actor, payload: call.payload!, seal, mac: bytes(call.mac)! });
+  return number;
+}
+
+/** The table whose rows hold an object of this kind, the app's. */
+function appTable(tx: Transaction, kind: PreparedChange['kind']) {
+  const { credentials, mcpConnections, secrets, environments } = tablesOf(tx);
+  switch (kind) {
+    case 'credential': return credentials;
+    case 'connection': return mcpConnections;
+    case 'secret': return secrets;
+    case 'environment': return environments;
+    default: throw new Error(`no object kind ${String(kind)}`);
+  }
+}
+
+function sameBytes(a: Buffer | null, b: Buffer | null): boolean {
+  return a === null || b === null ? a === b : a.equals(b);
+}

package/src/migrate.ts

@@ -1,11 +1,9 @@
 import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
-import type { PoolClient } from 'pg';
-
 import { engineOfUrl } from './connect.ts';
 import type { Engine } from './dialect.ts';
-import { postgresConnection } from './postgres.ts';
+import { postgresSession, quoteIdentifier, type PostgresClient } from './postgres.ts';
 
 /**
  * Bring a database up to date with its engine's migration tree:
@@ -20,20 +18,151 @@ import { postgresConnection } from './postgres.ts';
 
 const MIGRATION_LOCK_KEY = '7165058122361679213';
 
-/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
-export async function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void> {
-  await client.query(`DO $$ BEGIN
+/** The logins that run coffre's own statements: the app's, the vault's, and 0.15's hot path's. */
+const RUNTIME_LOGINS = ['coffre_runtime', 'coffre_vault_runtime', 'coffre_vault_hot'];
+
+/**
+ * Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry, the hot path's login's
+ * group and settings, and the runtime logins' `jit = off`.
+ */
+export async function restrictDatabase(client: Pick<PostgresClient, 'unsafe'>): Promise<void> {
+  await client.unsafe(`DO $$ BEGIN
     EXECUTE format(
-      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime, coffre_backup',
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime, coffre_vault_hot, coffre_backup',
       current_database()
     );
   END $$`);
+  await holdHotLogin(client);
+  await turnJitOff(client, RUNTIME_LOGINS);
+}
+
+/**
+ * What 0022 gives `coffre_vault_hot`, given again when it lacks it: its
+ * membership in coffre_vault, inherited, and its lock and statement
+ * timeouts and generic plans. A role dropped and made again, as `coffre
+ * setup` makes a missing one, has none of them, and 0022 never runs
+ * twice. So whatever 0022 refuses, this refuses too: a role made again
+ * may be anyone's. Unsafe attributes, objects it owns, a membership in
+ * another role, one of any grantor that may set or grant coffre_vault
+ * (which would let it hand the vault's rights to the app's login), and a
+ * setting of its own for this database alone, which would outrank the
+ * server-wide one at login. Then only what differs, and refused, saying
+ * what to run, to a login that may not change the role or grant the group.
+ */
+export async function holdHotLogin(client: Pick<PostgresClient, 'unsafe'>): Promise<void> {
+  await client.unsafe(`DO $$ DECLARE
+    held text[];
+  BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_vault_hot') THEN
+      RAISE EXCEPTION 'coffre_vault_hot does not exist, though 0022 made it: run coffre setup, which makes it a login, or have a login with CREATEROLE run CREATE ROLE coffre_vault_hot NOLOGIN, then migrate again';
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_vault_hot' AND (rolsuper OR rolreplication OR rolbypassrls)) THEN
+      RAISE EXCEPTION 'coffre_vault_hot has unsafe role attributes: SUPERUSER, REPLICATION and BYPASSRLS must be off';
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_shdepend WHERE refclassid = 'pg_authid'::regclass AND refobjid = 'coffre_vault_hot'::regrole AND deptype = 'o') THEN
+      RAISE EXCEPTION 'coffre_vault_hot owns database objects';
+    END IF;
+    IF EXISTS (SELECT 1 FROM pg_auth_members WHERE member = 'coffre_vault_hot'::regrole AND roleid <> 'coffre_vault'::regrole) THEN
+      RAISE EXCEPTION 'coffre_vault_hot is a member of a role other than coffre_vault: revoke its memberships';
+    END IF;
+    IF EXISTS (
+      SELECT 1 FROM pg_auth_members WHERE member = 'coffre_vault_hot'::regrole AND roleid = 'coffre_vault'::regrole AND (set_option OR admin_option)
+    ) THEN
+      RAISE EXCEPTION 'coffre_vault_hot may set or grant coffre_vault: have its grantor run REVOKE coffre_vault FROM coffre_vault_hot, then migrate again';
+    END IF;
+    IF EXISTS (
+      SELECT 1 FROM pg_db_role_setting s, unnest(s.setconfig) AS setting
+       WHERE s.setrole = 'coffre_vault_hot'::regrole AND s.setdatabase = (SELECT oid FROM pg_database WHERE datname = current_database())
+         AND split_part(setting, '=', 1) IN ('lock_timeout', 'statement_timeout', 'plan_cache_mode')
+    ) THEN
+      RAISE EXCEPTION 'coffre_vault_hot has its own lock_timeout, statement_timeout or plan_cache_mode in this database, over the hot path''s: run ALTER ROLE coffre_vault_hot IN DATABASE % RESET ALL, then migrate again', quote_ident(current_database());
+    END IF;
+    -- The role is the server's, as turnJitOff's logins are: a run on another database may be changing it too, and fails the second change.
+    FOR attempt IN 1..5 LOOP
+      BEGIN
+        SELECT setconfig INTO held FROM pg_db_role_setting WHERE setrole = 'coffre_vault_hot'::regrole AND setdatabase = 0;
+        IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'coffre_vault_hot' AND (NOT rolinherit OR rolcreatedb OR rolcreaterole)) THEN
+          ALTER ROLE coffre_vault_hot INHERIT NOCREATEDB NOCREATEROLE;
+        END IF;
+        IF NOT coalesce(held @> ARRAY['lock_timeout=1s'], false) THEN ALTER ROLE coffre_vault_hot SET lock_timeout = '1s'; END IF;
+        IF NOT coalesce(held @> ARRAY['statement_timeout=2s'], false) THEN ALTER ROLE coffre_vault_hot SET statement_timeout = '2s'; END IF;
+        IF NOT coalesce(held @> ARRAY['plan_cache_mode=force_generic_plan'], false) THEN ALTER ROLE coffre_vault_hot SET plan_cache_mode = force_generic_plan; END IF;
+        IF NOT EXISTS (
+          SELECT 1 FROM pg_auth_members WHERE member = 'coffre_vault_hot'::regrole AND roleid = 'coffre_vault'::regrole AND inherit_option
+        ) THEN
+          GRANT coffre_vault TO coffre_vault_hot WITH ADMIN FALSE, INHERIT TRUE, SET FALSE;
+        END IF;
+        EXIT;
+      EXCEPTION
+        WHEN insufficient_privilege THEN
+          RAISE EXCEPTION '% may not make coffre_vault_hot what 0.15 needs (%): have a login with CREATEROLE and ADMIN on both roles run ALTER ROLE coffre_vault_hot INHERIT NOCREATEDB NOCREATEROLE; ALTER ROLE coffre_vault_hot SET lock_timeout = ''1s''; ALTER ROLE coffre_vault_hot SET statement_timeout = ''2s''; ALTER ROLE coffre_vault_hot SET plan_cache_mode = force_generic_plan; GRANT coffre_vault TO coffre_vault_hot WITH ADMIN FALSE, INHERIT TRUE, SET FALSE first', current_user, SQLERRM;
+        WHEN internal_error OR unique_violation THEN
+          IF attempt = 5 THEN RAISE; END IF;
+          PERFORM pg_sleep(0.2);
+      END;
+    END LOOP;
+  END $$`);
+}
+
+/**
+ * Set `jit = off` on `logins`, when they lack it.
+ *
+ * Past `jit_above_cost` (100,000 by default) Postgres compiles a plan's
+ * expressions at every execution of it: 150 ms where a use costs under 2 ms
+ * (0029), and a statement's estimate grows with its tables. The functions that
+ * run as their owner say no JIT themselves (0029); the setting here covers
+ * every other statement of these logins, now and to come. A role's settings
+ * apply to the role that logs in, never through a group, and a pooler such as
+ * Hyperdrive may not pass a startup option on, so it is the login's own, on
+ * the server. It is the server's, not the database's, as the logins are (and
+ * as 0022 sets the hot login's): made once by a login with CREATEROLE and
+ * ADMIN on them, and found set by any other that migrates after.
+ *
+ * Only when it differs, whatever way the boolean is spelled: altering a role
+ * takes CREATEROLE and its ADMIN, which a login that only migrates may lack.
+ * The row is the server's, and the migration lock each database's, so a run
+ * on another database may be changing it too: Postgres fails the second
+ * change (a concurrent update, or a duplicate key), and it looks again once
+ * the first has committed. A setting of the login's for this database alone
+ * outranks the server-wide one at login, so it is refused, as 0022 does.
+ */
+export async function turnJitOff(client: Pick<PostgresClient, 'unsafe'>, logins: readonly string[]): Promise<void> {
+  // Whether the login has a jit setting, in `database` (0 for the server's), that is `value`; the cast is only of a jit row's.
+  const jit = (database: string, value: 'TRUE' | 'FALSE') => `EXISTS (
+        SELECT 1 FROM pg_db_role_setting s, unnest(s.setconfig) AS setting
+         WHERE s.setrole = login::regrole AND s.setdatabase = ${database}
+           AND (CASE WHEN split_part(setting, '=', 1) = 'jit' THEN substr(setting, 5)::boolean END) IS ${value})`;
+  await client.unsafe(
+    `DO $$ DECLARE
+      login text;
+      here oid := (SELECT oid FROM pg_database WHERE datname = current_database());
+    BEGIN
+      FOREACH login IN ARRAY ARRAY[${logins.map((login) => `'${login}'`).join(', ')}] LOOP
+        IF ${jit('here', 'TRUE')} THEN
+          RAISE EXCEPTION '% has its own jit setting in this database, over the server-wide one: run ALTER ROLE % IN DATABASE % RESET jit, then migrate again', login, login, quote_ident(current_database());
+        END IF;
+        FOR attempt IN 1..5 LOOP
+          EXIT WHEN ${jit('0', 'FALSE')};
+          BEGIN
+            EXECUTE format('ALTER ROLE %I SET jit = off', login);
+            EXIT;
+          EXCEPTION
+            WHEN insufficient_privilege THEN
+              RAISE EXCEPTION '% may not set jit = off on %, whose statements Postgres would compile at every run: have a login with CREATEROLE and ADMIN on it run ALTER ROLE % SET jit = off, then migrate again', current_user, login, login;
+            WHEN internal_error OR unique_violation THEN
+              IF attempt = 5 THEN RAISE; END IF;
+              PERFORM pg_sleep(0.2);
+          END;
+        END LOOP;
+      END LOOP;
+    END $$`,
+  );
 }
 
 /** Why `login` cannot be the backup login, before anything runs, or null when it may. */
 export function backupLoginProblem(login: string): string | null {
   if (login === '') return 'the backup login is empty: name the role to grant coffre_backup';
-  if (['coffre_backup', 'coffre_app', 'coffre_vault', 'coffre_runtime', 'coffre_vault_runtime'].includes(login)) {
+  if (['coffre_backup', 'coffre_app', 'coffre_vault', 'coffre_runtime', 'coffre_vault_runtime', 'coffre_vault_hot'].includes(login)) {
     return `the backup login is ${login}, one of coffre's own roles: name the login that backs up`;
   }
   return null;
@@ -259,50 +388,48 @@ function verifyHistory(
 }
 
 async function postgresMigrator(url: string): Promise<Migrator> {
-  const [{ default: pg }, { drizzle }, { migrate }] = await Promise.all([
-    import('pg'),
-    import('drizzle-orm/node-postgres'),
-    import('drizzle-orm/node-postgres/migrator'),
+  const [{ createDatabase }, { migrate }] = await Promise.all([
+    import('./database.ts'),
+    import('drizzle-orm/postgres-js/migrator'),
   ]);
-  const pool = new pg.Pool({ ...postgresConnection(url), application_name: 'coffre-migrations', max: 1 });
-  const client = await pool.connect();
+  // One session: the advisory lock and lock_timeout are the session's, and a statement after it is lost fails.
+  const client = postgresSession(url, { application_name: 'coffre-migrations' });
   return {
     async applied() {
-      const relation = await client.query<{ relation: string | null }>(
+      const [found] = await client.unsafe<{ relation: string | null }[]>(
         "SELECT to_regclass('drizzle.__drizzle_migrations')::text AS relation",
       );
-      if (!relation.rows[0]?.relation) return null;
-      const result = await client.query<AppliedMigration>(
+      if (!found?.relation) return null;
+      return [...await client.unsafe<AppliedMigration[]>(
         'SELECT hash, created_at::text FROM drizzle.__drizzle_migrations ORDER BY created_at, id',
-      );
-      return result.rows;
+      )];
     },
     async lock() {
-      await client.query("SET lock_timeout = '5min'");
-      await client.query('SELECT pg_advisory_lock($1::bigint)', [MIGRATION_LOCK_KEY]);
+      await client.unsafe("SET lock_timeout = '5min'");
+      await client.unsafe('SELECT pg_advisory_lock($1::bigint)', [MIGRATION_LOCK_KEY]);
     },
     async unlock() {
-      await client.query('SELECT pg_advisory_unlock($1::bigint)', [MIGRATION_LOCK_KEY]);
+      await client.unsafe('SELECT pg_advisory_unlock($1::bigint)', [MIGRATION_LOCK_KEY]);
     },
-    migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
+    // The migrator uses the database's dialect and session alone, never its relational config.
+    migrate: (migrationsFolder) => migrate(createDatabase(client) as unknown as Parameters<typeof migrate>[0], { migrationsFolder }),
     async restrict(backupLogin) {
       await restrictDatabase(client);
       if (backupLogin !== undefined) {
         // Compared as text: as a name, Postgres would cut it to 63 bytes, and grant whichever role bears the cut.
-        const { rowCount } = await client.query('SELECT 1 FROM pg_roles WHERE rolname::text = $1', [backupLogin]);
-        if (rowCount === 0) throw new Error(`role ${client.escapeIdentifier(backupLogin)} does not exist: make it, coffre never does`);
-        await client.query(`GRANT coffre_backup TO ${client.escapeIdentifier(backupLogin)} WITH ADMIN FALSE, INHERIT TRUE, SET FALSE`);
+        const found = await client.unsafe('SELECT 1 FROM pg_roles WHERE rolname::text = $1', [backupLogin]);
+        if (found.length === 0) throw new Error(`role ${quoteIdentifier(backupLogin)} does not exist: make it, coffre never does`);
+        await client.unsafe(`GRANT coffre_backup TO ${quoteIdentifier(backupLogin)} WITH ADMIN FALSE, INHERIT TRUE, SET FALSE`);
       }
     },
     async notOwner({ relations, functions }) {
-      const { rows } = await client.query<{ owner: string; member: boolean; login: string; grants_inherit: boolean; inherits: boolean }>(FOREIGN_OWNERS, [relations, functions]);
+      const rows = await client.unsafe<{ owner: string; member: boolean; login: string; grants_inherit: boolean; inherits: boolean }[]>(FOREIGN_OWNERS, [relations, functions]);
       if (rows.length === 0) return null;
-      const [{ login, grants_inherit: grantsInherit, inherits }] = rows as [(typeof rows)[number]];
+      const [{ login, grants_inherit: grantsInherit, inherits }] = rows as unknown as [(typeof rows)[number]];
       return new NotOwner(login, rows.map(({ owner, member }) => ({ name: owner, member })), { grantsInherit, inherits });
     },
     async close() {
-      client.release();
-      await pool.end();
+      await client.end();
     },
   };
 }

package/src/migrations/postgres/0021_prune_vault_releases.sql

@@ -0,0 +1,19 @@
+-- Releases pruned (W199, T111): the vault's checkpoint forgets the releases no window can count again, those over a day and an hour old by the database's clock, at most at_most a call. A bulk limit's window is a day at most (the vault's config), and the hour is a margin for the clock stepping back: no caller chooses what is kept, so the vault's login, which still deletes no row itself, cannot forget a release a window counts. The release before never calls it.
+CREATE FUNCTION prune_vault_releases(at_most integer) RETURNS integer
+    LANGUAGE sql SECURITY DEFINER SET search_path = pg_catalog, pg_temp SET lock_timeout = '3s' AS $$
+    -- The bound in the DELETE's own WHERE too: a row a read moved on since the subquery's snapshot is checked again,
+    -- as it is now, and kept.
+    WITH bound AS (SELECT (extract(epoch from clock_timestamp()) * 1000)::bigint - 25 * 3600000 AS before),
+    pruned AS (
+        DELETE FROM public.vault_releases
+         WHERE released_at < (SELECT before FROM bound)
+           AND ctid IN (
+            -- Any of them, each past every window; a row an append holds is left to the next run, rather than waited for.
+            SELECT ctid FROM public.vault_releases WHERE released_at < (SELECT before FROM bound) LIMIT at_most FOR UPDATE SKIP LOCKED
+           )
+        RETURNING 1
+    )
+    SELECT count(*)::integer FROM pruned;
+$$;--> statement-breakpoint
+REVOKE ALL ON FUNCTION prune_vault_releases(integer) FROM PUBLIC;--> statement-breakpoint
+GRANT EXECUTE ON FUNCTION prune_vault_releases(integer) TO coffre_vault;