@coffre/db 0.9.0 → 0.10.1

package/dist/migrations/sqlite/meta/_journal.json

@@ -85,6 +85,27 @@
       "when": 1792317461299,
       "tag": "0011_plain_values",
       "breakpoints": true
+    },
+    {
+      "idx": 12,
+      "version": "6",
+      "when": 1792340920098,
+      "tag": "0012_sensitive_values",
+      "breakpoints": true
+    },
+    {
+      "idx": 13,
+      "version": "6",
+      "when": 1792343374795,
+      "tag": "0013_contributor_role",
+      "breakpoints": true
+    },
+    {
+      "idx": 14,
+      "version": "6",
+      "when": 1792345777255,
+      "tag": "0014_custom_roles",
+      "breakpoints": true
     }
   ]
 }

package/dist/portable.d.ts

@@ -1,5 +1,5 @@
-import { m as schema_d_exports } from "./schema-CCYKTG-E.js";
-import { t as Database } from "./database-hd1hAll-.js";
+import { m as schema_d_exports } from "./schema-NBVA9q-s.js";
+import { t as Database } from "./database-DBtn3jqp.js";
 import { t as schema_sqlite_d_exports } from "./schema-sqlite.js";
 import { LibSQLDatabase } from "drizzle-orm/libsql";
 //#region src/portable.d.ts

package/dist/{schema-CCYKTG-E.d.ts → schema-NBVA9q-s.d.ts}

@@ -731,6 +731,23 @@ declare const secretVersions: import("drizzle-orm/pg-core").PgTableWithColumns<{
       identity: undefined;
       generated: undefined;
     }, {}, {}>;
+    sensitive: import("drizzle-orm/pg-core").PgColumn<{
+      name: "sensitive";
+      tableName: "secret_versions";
+      dataType: "boolean";
+      columnType: "PgBoolean";
+      data: boolean;
+      driverParam: boolean;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "pg";
 }>;

package/dist/schema-sqlite.d.ts

@@ -775,6 +775,23 @@ export declare const secretVersions: import("drizzle-orm/sqlite-core").SQLiteTab
     }, {}, {
       length: undefined;
     }>;
+    sensitive: import("drizzle-orm/sqlite-core").SQLiteColumn<{
+      name: string;
+      tableName: "secret_versions";
+      dataType: "boolean";
+      columnType: "SQLiteBoolean";
+      data: boolean;
+      driverParam: number;
+      notNull: true;
+      hasDefault: true;
+      isPrimaryKey: false;
+      isAutoincrement: false;
+      hasRuntimeDefault: false;
+      enumValues: undefined;
+      baseColumn: never;
+      identity: undefined;
+      generated: undefined;
+    }, {}, {}>;
   };
   dialect: "sqlite";
 }>;

package/dist/schema-sqlite.js

@@ -1,7 +1,6 @@
 import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
 import { asPostgres } from "./portable.js";
 import { sql } from "drizzle-orm";
-import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
 import { blob, check, customType, foreignKey, index, integer, primaryKey, sqliteTable, text, unique, uniqueIndex } from "drizzle-orm/sqlite-core";
 //#region src/schema.sqlite.ts
 /**
@@ -125,7 +124,8 @@ const secretVersions = sqliteTable("secret_versions", {
 	recipe: text(),
 	pairId: text("pair_id"),
 	pairHalf: text("pair_half"),
-	plaintext: text()
+	plaintext: text(),
+	sensitive: flag("sensitive").notNull().default(false)
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -157,8 +157,6 @@ const dismissedKeys = sqliteTable("dismissed_keys", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
 const vaultMembers = sqliteTable("vault_members", {
 	principal: text().primaryKey(),
 	status: text().notNull(),
@@ -195,8 +193,7 @@ const vaultGrants = sqliteTable("vault_grants", {
 }, (table) => [
 	check("vault_grants_one_place", sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`),
 	check("vault_grants_environment_slug_check", sql`${table.environmentSlug} IS NULL OR (${isSlug(table.environmentSlug, 63)})`),
-	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
-	check("vault_grants_environment_role_check", sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	check("vault_grants_role_check", sql`length(${table.role}) BETWEEN 2 AND 32 AND ${table.role} GLOB '[a-z]*' AND ${table.role} NOT GLOB '*[^a-z0-9-]*'`),
 	unique("vault_grants_on_project").on(table.principal, table.projectId),
 	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
 	unique("vault_grants_on_environment_slug").on(table.principal, table.environmentSlug),

package/dist/schema-version.d.ts

@@ -1,4 +1,4 @@
-import { i as Queryable } from "./database-hd1hAll-.js";
+import { i as Queryable } from "./database-DBtn3jqp.js";
 import { Engine } from "./dialect.js";
 //#region src/schema-version.d.ts
 /**

package/dist/schema-version.js

@@ -92,6 +92,27 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792317460399,
 			"tag": "0011_plain_values",
 			"breakpoints": true
+		},
+		{
+			"idx": 12,
+			"version": "7",
+			"when": 1792340919452,
+			"tag": "0012_sensitive_values",
+			"breakpoints": true
+		},
+		{
+			"idx": 13,
+			"version": "7",
+			"when": 1792343374226,
+			"tag": "0013_contributor_role",
+			"breakpoints": true
+		},
+		{
+			"idx": 14,
+			"version": "7",
+			"when": 1792345776262,
+			"tag": "0014_custom_roles",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag),
 	sqlite: [
@@ -178,6 +199,27 @@ const KNOWN_MIGRATIONS = {
 			"when": 1792317461299,
 			"tag": "0011_plain_values",
 			"breakpoints": true
+		},
+		{
+			"idx": 12,
+			"version": "6",
+			"when": 1792340920098,
+			"tag": "0012_sensitive_values",
+			"breakpoints": true
+		},
+		{
+			"idx": 13,
+			"version": "6",
+			"when": 1792343374795,
+			"tag": "0013_contributor_role",
+			"breakpoints": true
+		},
+		{
+			"idx": 14,
+			"version": "6",
+			"when": 1792345777255,
+			"tag": "0014_custom_roles",
+			"breakpoints": true
 		}
 	].map((entry) => entry.tag)
 };

package/dist/schema.d.ts

@@ -1,2 +1,2 @@
-import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-CCYKTG-E.js";
+import { _ as secrets, a as deviceAuthorizations, b as vaultGrants, c as environmentsRelations, d as mcpConnections, f as oauthClients, g as secretVersions, h as secretReferences, i as credentials, l as identities, n as auditLog, o as dismissedKeys, p as projects, r as consumedTokens, s as environments, t as auditChainHead, u as mcpApprovals, v as secretsRelations, x as vaultMembers, y as serviceBindings } from "./schema-NBVA9q-s.js";
 export { auditChainHead, auditLog, consumedTokens, credentials, deviceAuthorizations, dismissedKeys, environments, environmentsRelations, identities, mcpApprovals, mcpConnections, oauthClients, projects, secretReferences, secretVersions, secrets, secretsRelations, serviceBindings, vaultGrants, vaultMembers };

package/dist/schema.js

@@ -1,7 +1,6 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { n as relationsOf, t as ACTIVE_SUBJECT } from "./relations-BfR3JjT1.js";
 import { sql } from "drizzle-orm";
-import { ROLE_NAMES, assignableToEnvironment } from "@coffre/core/access";
 import { bigint, boolean, check, customType, foreignKey, index, integer, pgTable, primaryKey, text, timestamp, unique, uniqueIndex, uuid } from "drizzle-orm/pg-core";
 //#region src/schema.ts
 var schema_exports = /* @__PURE__ */ __exportAll({
@@ -130,7 +129,8 @@ const secretVersions = pgTable("secret_versions", {
 	recipe: text(),
 	pairId: uuid("pair_id"),
 	pairHalf: text("pair_half"),
-	plaintext: text()
+	plaintext: text(),
+	sensitive: boolean().notNull().default(false)
 }, (table) => [
 	unique("secret_versions_secret_id_version_key").on(table.secretId, table.version),
 	check("secret_versions_version_check", sql`${table.version} > 0`),
@@ -169,9 +169,6 @@ const dismissedKeys = pgTable("dismissed_keys", {
 		foreignColumns: [environments.id]
 	}).onDelete("restrict")
 ]);
-/** The role catalogue, as SQL: every role, and those an environment may be granted. */
-const ROLES = sql.raw(ROLE_NAMES.map((role) => `'${role}'`).join(", "));
-const ENVIRONMENT_ROLES = sql.raw(ROLE_NAMES.filter(assignableToEnvironment).map((role) => `'${role}'`).join(", "));
 /**
 * The vault's member directory: everyone it has admitted, written by the
 * vault alone, read by both. A principal with no row is no member.
@@ -220,8 +217,7 @@ const vaultGrants = pgTable("vault_grants", {
 }, (table) => [
 	check("vault_grants_one_place", sql`((${table.projectId} IS NULL) <> (${table.environmentId} IS NULL) AND ${table.environmentSlug} IS NULL) OR (${table.projectId} IS NULL AND ${table.environmentId} IS NULL)`),
 	check("vault_grants_environment_slug_check", sql`${table.environmentSlug} IS NULL OR ${table.environmentSlug} ~ '^[a-z0-9][a-z0-9-]{0,62}$'`),
-	check("vault_grants_role_check", sql`${table.role} IN (${ROLES})`),
-	check("vault_grants_environment_role_check", sql`(${table.environmentId} IS NULL AND ${table.environmentSlug} IS NULL) OR ${table.role} IN (${ENVIRONMENT_ROLES})`),
+	check("vault_grants_role_check", sql`${table.role} ~ '^[a-z][a-z0-9-]{1,31}$'`),
 	unique("vault_grants_on_project").on(table.principal, table.projectId),
 	unique("vault_grants_on_environment").on(table.principal, table.environmentId),
 	unique("vault_grants_on_environment_slug").on(table.principal, table.environmentSlug),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.9.0"
+    "@coffre/core": "0.10.1"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/database.ts

@@ -1,7 +1,16 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 
-import { getTableName, is, Table } from 'drizzle-orm';
-import { drizzle, type NodePgDatabase } from 'drizzle-orm/node-postgres';
+import {
+  createTableRelationsHelpers,
+  extractTablesRelationalConfig,
+  getTableName,
+  is,
+  Table,
+  type ExtractTablesWithRelations,
+  type RelationalSchemaConfig,
+} from 'drizzle-orm';
+import { NodePgDatabase, NodePgDriver } from 'drizzle-orm/node-postgres';
+import { PgDialect } from 'drizzle-orm/pg-core';
 import type pg from 'pg';
 
 import { trackCommits } from './commits.ts';
@@ -74,8 +83,29 @@ function brokenRule(error: unknown): QueryOutsideTransaction | undefined {
   return undefined;
 }
 
+/**
+ * What Drizzle makes of the schema, which `drizzle(pool, { schema })` works
+ * out again from every table at each call: on Workers, a database is made
+ * per call, and this was a fifth of a vault call's CPU. The schema never
+ * changes, so it is worked out once per process or isolate, a settled value.
+ */
+type Relational = RelationalSchemaConfig<ExtractTablesWithRelations<typeof schema>>;
+let relational: Relational | undefined;
+
+function relationalSchema(): Relational {
+  if (relational === undefined) {
+    const { tables, tableNamesMap } = extractTablesRelationalConfig(schema, createTableRelationsHelpers);
+    // Drizzle's own construct passes the same untyped tables on as these.
+    relational = { fullSchema: schema, schema: tables as Relational['schema'], tableNamesMap };
+  }
+  return relational;
+}
+
 export function createDatabase(pool: PoolLike): Database {
-  const db = drizzle(guarded(pool) as pg.Pool, { schema });
+  // What `drizzle(pool, { schema })` builds, but for the schema's config, made once.
+  const dialect = new PgDialect();
+  const config = relationalSchema();
+  const db: Database = new NodePgDatabase(dialect, new NodePgDriver(guarded(pool) as pg.Pool, dialect).createSession(config), config);
   // Each transaction's work runs knowing which one it is in, until that work is done. Not until
   // the COMMIT comes back: the transaction waits on nothing then, so what the work left running
   // may ask for a query, which waits for the transaction to end rather than for itself.
@@ -132,3 +162,5 @@ export function own<T extends Table>(db: Queryable, table: T): T {
   if (found === undefined) throw new Error(`no table ${getTableName(table)} in this database`);
   return found as T;
 }
+
+export { prepared } from './prepared.ts';

package/src/grants.ts

@@ -9,6 +9,7 @@ import {
   type Conversion,
   type ConversionInput,
   type InstanceRole,
+  type BuiltinRole,
   type Role,
   type Scope,
 } from '@coffre/core/access';
@@ -17,8 +18,9 @@ import { ACCESS_ACTIONS } from '@coffre/core/vault';
 import { and, asc, desc, eq, gt, inArray, isNull, like, lt, or, sql, type SQL } from 'drizzle-orm';
 
 import { tablesOf, type Queryable } from './database.ts';
+import { prepared } from './prepared.ts';
 import { tombstone, truth } from './dialect.ts';
-import { entryColumns, LOOK_BACK, newestAuthentic, newestVaultEntries, type Authenticity, type Newest } from './log.ts';
+import { entryColumns, newestAuthentic, newestVaultEntries, type Authenticity, type Newest } from './log.ts';
 
 /**
  * One grant, as `vault_grants` holds it: on a project (`environmentId`
@@ -45,20 +47,24 @@ export async function readGrants(
   db: Queryable,
   filter: { principal?: string; liveAt?: number } = {},
 ): Promise<GrantRow[]> {
+  // A member's grants, which every check reads, built once (`prepared`); any other filter, as asked.
+  const rows = filter.principal !== undefined && filter.liveAt === undefined
+    ? await grantsOf(db, { principal: filter.principal })
+    : await grantRows(db, filter.principal === undefined ? undefined : eq(tablesOf(db).vaultGrants.principal, filter.principal), filter.liveAt);
+  return rows.map(({ grant, environmentProjectId }) => ({ ...grant, projectId: grant.projectId ?? environmentProjectId }));
+}
+
+function grantRows(db: Queryable, principal: SQL | undefined, liveAt?: number) {
   const { vaultGrants, environments } = tablesOf(db);
-  const rows = await db
+  return db
     .select({ grant: vaultGrants, environmentProjectId: environments.projectId })
     .from(vaultGrants)
     .leftJoin(environments, eq(environments.id, vaultGrants.environmentId))
-    .where(
-      and(
-        filter.principal === undefined ? undefined : eq(vaultGrants.principal, filter.principal),
-        filter.liveAt === undefined ? undefined : or(isNull(vaultGrants.expiresAt), gt(vaultGrants.expiresAt, filter.liveAt)),
-      ),
-    );
-  return rows.map(({ grant, environmentProjectId }) => ({ ...grant, projectId: grant.projectId ?? environmentProjectId }));
+    .where(and(principal, liveAt === undefined ? undefined : or(isNull(vaultGrants.expiresAt), gt(vaultGrants.expiresAt, liveAt))));
 }
 
+const grantsOf = prepared((db) => grantRows(db, eq(tablesOf(db).vaultGrants.principal, sql.placeholder('principal'))));
+
 /** Add a grant; an environment's row names only the environment. */
 export async function insertGrant(db: Queryable, grant: GrantRow): Promise<void> {
   const { vaultGrants } = tablesOf(db);
@@ -129,10 +135,10 @@ export function everyProjectConversion(
     role: person ? role : 'member',
     everyProject: live
       .filter((grant) => grant.projectId === null && grant.environmentId === null)
-      .map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
+      .map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as BuiltinRole, expiresAt: grant.expiresAt })),
     grants: live
       .filter((grant) => grant.projectId !== null)
-      .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
+      .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as BuiltinRole, expiresAt: grant.expiresAt })),
     projects,
   });
 }
@@ -288,35 +294,43 @@ export async function reportStands(db: Queryable, principal: string, check: Auth
   const access = await newestAccess(db, principal, check);
   if (access === 'unreached') return true;
   const after = typeof access === 'string' ? -1n : access.seq;
-  const report = await newestAuthentic((before) => tamperReportsAbout(db, principal, LOOK_BACK.page, after, before), check);
+  const report = await newestAuthentic((limit, before) => tamperReportsAbout(db, principal, limit, after, before), check);
   return report === 'unreached' || typeof report !== 'string';
 }
 
 /** The newest access entry about `principal` that `check` finds the vault's own. */
 export function newestAccess(db: Queryable, principal: string, check: Authenticity): Promise<Newest> {
-  return newestAuthentic((before) => accessEntriesAbout(db, principal, LOOK_BACK.page, before), check);
+  return newestAuthentic((limit, before) => accessEntriesAbout(db, principal, limit, before), check);
 }
 
 /** Up to `limit` of the vault's allowed access entries about `principal` before `before` (the newest when undefined), newest first. */
 export async function accessEntriesAbout(db: Queryable, principal: string, limit: number, before?: bigint): Promise<StoredEntry[]> {
+  const rows = before === undefined ? await newestAccessEntries(db, { principal, limit }) : await accessEntriesBefore(db, { principal, limit, before });
+  return rows as StoredEntry[];
+}
+
+function accessEntries(db: Queryable, before?: SQL) {
   const { auditLog } = tablesOf(db);
-  const rows = await db
+  return db
     .select(entryColumns(db))
     .from(auditLog)
     .where(
       and(
         eq(auditLog.author, 'vault'),
-        eq(auditLog.subjectPrincipal, principal),
+        eq(auditLog.subjectPrincipal, sql.placeholder('principal')),
         inArray(auditLog.action, [...ACCESS_ACTIONS]),
         eq(auditLog.decision, 'allow'),
-        before === undefined ? undefined : lt(auditLog.seq, before),
+        before,
       ),
     )
     .orderBy(desc(auditLog.seq))
-    .limit(limit);
-  return rows as StoredEntry[];
+    .limit(sql.placeholder('limit'));
 }
 
+// What every check of a member reads first, built once (`prepared`).
+const newestAccessEntries = prepared((db) => accessEntries(db));
+const accessEntriesBefore = prepared((db) => accessEntries(db, lt(tablesOf(db).auditLog.seq, sql.placeholder('before'))));
+
 /**
  * Up to `limit` of the vault's reports that `principal`'s row was changed
  * around it (`TAMPER_CODES`), after `after` and before `before` (the newest

package/src/log.ts

@@ -1,8 +1,9 @@
 import { GENESIS_HASH, sealEntry, type LogFields, type LogKey, type StoredEntry } from '@coffre/core/audit';
-import { and, asc, desc, eq, lt, sql, type SQL } from 'drizzle-orm';
+import { and, asc, count, desc, eq, gt, gte, lt, lte, sql, type SQL } from 'drizzle-orm';
 
 import { afterCommit } from './commits.ts';
 import { tablesOf, type Queryable, type Transaction } from './database.ts';
+import { prepared } from './prepared.ts';
 import { clockMillis, forUpdate } from './dialect.ts';
 
 /**
@@ -99,18 +100,19 @@ export function forgetLogHeads(): void {
  * again in the same transaction is free.
  */
 export async function lockLogHead(tx: Transaction): Promise<{ nextSeq: bigint; headHash: Buffer }> {
-  const { auditChainHead } = tablesOf(tx);
-  const [head] = await forUpdate(
-    tx,
-    tx
-      .select({ nextSeq: auditChainHead.nextSeq, headHash: auditChainHead.headHash })
-      .from(auditChainHead)
-      .where(eq(auditChainHead.onlyRow, true)),
-  );
+  const [head] = await lockedHead(tx);
   if (head === undefined) throw new Error('audit_chain_head is missing; refusing to write an unchained entry');
   return head;
 }
 
+const lockedHead = prepared((db) => {
+  const { auditChainHead } = tablesOf(db);
+  return forUpdate(
+    db,
+    db.select({ nextSeq: auditChainHead.nextSeq, headHash: auditChainHead.headHash }).from(auditChainHead).where(eq(auditChainHead.onlyRow, true)),
+  );
+});
+
 /**
  * Append `entries` under `key`. `check`, when given, runs once the head is
  * locked and before anything is written: a writer's own condition on the
@@ -129,12 +131,8 @@ export async function appendEntries(
   // Every append queues here, if its transaction has not already.
   const head = await lockLogHead(tx);
   await check?.(tx);
-  const [{ now }] = await tx.select({ now: clockMillis(tx) }).from(auditChainHead);
-  const [last] = await tx
-    .select({ seq: auditLog.seq, hash: auditLog.hash })
-    .from(auditLog)
-    .orderBy(desc(auditLog.seq))
-    .limit(1);
+  const [{ now }] = await clockNow(tx);
+  const [last] = await lastEntry(tx);
 
   const expected = last === undefined ? { nextSeq: 0n, headHash: GENESIS_HASH } : { nextSeq: last.seq + 1n, headHash: last.hash };
   if (head.nextSeq !== expected.nextSeq || !head.headHash.equals(expected.headHash)) {
@@ -188,6 +186,13 @@ export async function appendEntries(
   return { seqStart: head.nextSeq, ...written, occurredAt: now };
 }
 
+const clockNow = prepared((db) => db.select({ now: clockMillis(db) }).from(tablesOf(db).auditChainHead));
+
+const lastEntry = prepared((db) => {
+  const { auditLog } = tablesOf(db);
+  return db.select({ seq: auditLog.seq, hash: auditLog.hash }).from(auditLog).orderBy(desc(auditLog.seq)).limit(1);
+});
+
 // --- reading the vault's entries back ---------------------------------------------
 
 /** An entry's columns, as the chain's codec reads them (`StoredEntry`). */
@@ -257,6 +262,33 @@ export async function withinBytes(
   return { from: sizes[0]!.seq, to: sizes[count - 1]!.seq, cut: count < sizes.length, count };
 }
 
+/**
+ * The first entry missing from the log up to `seq`, and the one found in
+ * its place, or null when every one is there. Seqs are the primary key, so
+ * a stretch is whole exactly when its count is its length: one pass over
+ * the key's index, never the entries. Only a log with a gap pays for more,
+ * a count per halving to find where.
+ *
+ *   entries 0..9, 4 cut:  { expected: 4n, found: 5n }
+ */
+export async function missingEntry(db: Queryable, seq: bigint): Promise<{ expected: bigint; found: bigint | null } | null> {
+  const { auditLog } = tablesOf(db);
+  const whole = async (to: bigint) => {
+    const [{ n }] = await db.select({ n: count() }).from(auditLog).where(and(gte(auditLog.seq, 0n), lte(auditLog.seq, to)));
+    return BigInt(n) === to + 1n;
+  };
+  if (seq < 0n || (await whole(seq))) return null;
+  // The first stretch from 0 that is not whole ends at the missing entry.
+  let [low, high] = [0n, seq];
+  while (low < high) {
+    const middle = (low + high) / 2n;
+    if (await whole(middle)) low = middle + 1n;
+    else high = middle;
+  }
+  const [next] = await db.select({ seq: auditLog.seq }).from(auditLog).where(gt(auditLog.seq, low)).orderBy(asc(auditLog.seq)).limit(1);
+  return { expected: low, found: (next?.seq as bigint | undefined) ?? null };
+}
+
 /**
  * How a reader tells the vault's own entries from those forged in its name:
  * by their MAC, which only the vault holds the key to check. Each it finds
@@ -266,23 +298,43 @@ export type Authenticity = { authentic: (entry: StoredEntry) => boolean; forged:
 
 /** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
 export async function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]> {
+  const rows = before === undefined ? await newestEntries(db, { action, limit }) : await entriesBefore(db, { action, limit, before });
+  return rows as StoredEntry[];
+}
+
+function vaultEntries(db: Queryable, before?: SQL) {
   const { auditLog } = tablesOf(db);
-  const rows = await db
+  return db
     .select(entryColumns(db))
     .from(auditLog)
-    .where(
-      and(
-        eq(auditLog.author, 'vault'),
-        eq(auditLog.action, action),
-        eq(auditLog.decision, 'allow'),
-        before === undefined ? undefined : lt(auditLog.seq, before),
-      ),
-    )
+    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, sql.placeholder('action')), eq(auditLog.decision, 'allow'), before))
     .orderBy(desc(auditLog.seq))
-    .limit(limit);
-  return rows as StoredEntry[];
+    .limit(sql.placeholder('limit'));
+}
+
+const newestEntries = prepared((db) => vaultEntries(db));
+const entriesBefore = prepared((db) => vaultEntries(db, lt(tablesOf(db).auditLog.seq, sql.placeholder('before'))));
+
+/**
+ * The number of the newest entry in the vault's name, allowed, of one
+ * `action`, or null for none: whether one was appended since, and nothing
+ * of what it says, so its MAC is not checked. One indexed read.
+ */
+export async function newestVaultSeq(db: Queryable, action: string): Promise<bigint | null> {
+  const [row] = await newestSeq(db, { action });
+  return (row?.seq as bigint | undefined) ?? null;
 }
 
+const newestSeq = prepared((db) => {
+  const { auditLog } = tablesOf(db);
+  return db
+    .select({ seq: auditLog.seq })
+    .from(auditLog)
+    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, sql.placeholder('action')), eq(auditLog.decision, 'allow')))
+    .orderBy(desc(auditLog.seq))
+    .limit(1);
+});
+
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export const LOOK_BACK = { page: 32, pages: 32 };
 
@@ -291,20 +343,24 @@ export type Newest = StoredEntry | 'none' | 'forged' | 'unreached';
 
 /**
  * The newest of the entries `page` reads, newest first and before a seq,
- * that `check` finds authentic, read back a page at a time: 'none' when
- * there are none at all, 'forged' when every one is in the vault's name but
- * not its own, and 'unreached' once it has read LOOK_BACK such entries
- * (1024), whether or not more are left.
+ * that `check` finds authentic: the newest alone first, which it is unless
+ * entries were forged in the vault's name since, then back a page at a
+ * time. 'none' when there are none at all, 'forged' when every one is in
+ * the vault's name but not its own, and 'unreached' once it has read
+ * LOOK_BACK such entries (1024), whether or not more are left.
  */
-export async function newestAuthentic(page: (before: bigint | undefined) => Promise<StoredEntry[]>, check: Authenticity): Promise<Newest> {
+export async function newestAuthentic(page: (limit: number, before: bigint | undefined) => Promise<StoredEntry[]>, check: Authenticity): Promise<Newest> {
+  const most = LOOK_BACK.page * LOOK_BACK.pages;
+  let read = 0;
   let before: bigint | undefined;
-  for (let read = 0; read < LOOK_BACK.pages; read += 1) {
-    const entries = await page(before);
+  for (let limit = 1; read < most; limit = Math.min(LOOK_BACK.page, most - read)) {
+    const entries = await page(limit, before);
     for (const entry of entries) {
       if (check.authentic(entry)) return entry;
       check.forged(entry);
     }
-    if (entries.length < LOOK_BACK.page) return before === undefined && entries.length === 0 ? 'none' : 'forged';
+    read += entries.length;
+    if (entries.length < limit) return read === 0 ? 'none' : 'forged';
     before = entries.at(-1)!.seq;
   }
   return 'unreached';

package/src/migrations/postgres/0012_sensitive_values.sql

@@ -0,0 +1,18 @@
+-- Sensitive values (0.10): a version never handed back to a person, which the vault's wrap of its data key binds. Defaults to false, so the release before writes on as it did.
+ALTER TABLE "secret_versions" ADD COLUMN "sensitive" boolean DEFAULT false NOT NULL;--> statement-breakpoint
+-- A version is still only ever erased: its sensitivity with the rest of it.
+CREATE OR REPLACE FUNCTION secret_versions_erase_only() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+    IF octet_length(NEW.ciphertext) <> 0 OR octet_length(NEW.wrapped_dek) <> 0 OR NEW.plaintext IS NOT NULL
+       OR (NEW.id, NEW.secret_id, NEW.version, NEW.envelope_version, NEW.iv, NEW.auth_tag,
+           NEW.kek_provider, NEW.kek_id, NEW.kek_version, NEW.created_at, NEW.created_by,
+           NEW.recipe, NEW.pair_id, NEW.pair_half, NEW.sensitive)
+          IS DISTINCT FROM
+          (OLD.id, OLD.secret_id, OLD.version, OLD.envelope_version, OLD.iv, OLD.auth_tag,
+           OLD.kek_provider, OLD.kek_id, OLD.kek_version, OLD.created_at, OLD.created_by,
+           OLD.recipe, OLD.pair_id, OLD.pair_half, OLD.sensitive) THEN
+        RAISE EXCEPTION 'a secret version is only ever erased' USING ERRCODE = 'insufficient_privilege';
+    END IF;
+    RETURN NEW;
+END
+$$;

package/src/migrations/postgres/0013_contributor_role.sql

@@ -0,0 +1,5 @@
+-- The Contributor role (0.10): use and write, never read. The role checks widen to it, which the release before never grants.
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_environment_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'maintainer', 'access-manager', 'auditor', 'owner'));--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_environment_role_check" CHECK (("vault_grants"."environment_id" IS NULL AND "vault_grants"."environment_slug" IS NULL) OR "vault_grants"."role" IN ('viewer', 'contributor', 'developer', 'auditor'));

package/src/migrations/postgres/0014_custom_roles.sql

@@ -0,0 +1,4 @@
+-- Roles an Owner makes (0.10): a grant names a role by its id, which the vault's policy defines; which of them an environment may be granted, the vault decides. The checks widen: the release before grants only the roles it ships.
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_environment_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" DROP CONSTRAINT "vault_grants_role_check";--> statement-breakpoint
+ALTER TABLE "vault_grants" ADD CONSTRAINT "vault_grants_role_check" CHECK ("vault_grants"."role" ~ '^[a-z][a-z0-9-]{1,31}$');