@timqi/pier 0.0.4 → 0.0.5

package/README.md

@@ -156,13 +156,15 @@ time to finish, whatever the deadline still had to cut off written to the chat
 it belonged to — and only then hand over. The automatic path additionally waits
 for an idle instance: no turn streaming, no task run in flight.
 
-Either way the updater writes `~/.pier/db/pier.db.release.bak` before npm
-touches the package, updates the npm installation recorded when the service was
-installed, and starts Pier again.
-
-`main` is the only development line. `npm version patch` writes the tag, the
-tag builds and publishes a GitHub Release, and the version in the web footer is
-the one from `package.json` — so the number on screen always names a commit.
+Either way the updater writes `~/.pier/db/backups/pier.db.release-<version>.bak`
+before npm touches the package — named for the release being replaced, which is
+the one to reinstall beside it; the three newest are kept. Then it updates the
+npm installation recorded when the service was installed, and starts Pier again.
+
+`main` is the only development line. `just release [patch|minor|major]` runs the
+checks, writes the tag and pushes it; the tag builds and publishes to npm and as
+a GitHub Release. The version in the web footer is the one from `package.json`
+— so the number on screen always names a commit.
 Schema upgrades are one-way: a database migrated by a newer Pier is refused by
 an older one. The release backup above is the way back; `docs/deploy.md` has the
 restore procedure and the additional snapshots taken before schema migrations.

package/dist/cli.js

@@ -178,7 +178,9 @@ async function signalService(command) {
 }
 async function backup() {
     const [{ backupDb }, { PIER_DB }] = await Promise.all([import("./db.js"), import("./paths.js")]);
-    const path = backupDb(PIER_DB);
+    // This tree's version: the updater runs `backup` before npm replaces it, so
+    // it is the release the copy pairs with.
+    const path = backupDb(version, PIER_DB);
     process.stdout.write(path ? `backed up ${path}\n` : `no database yet — nothing to back up.\n`);
 }
 function commandPath(name) {

package/dist/db.js

@@ -11,15 +11,16 @@
 // So: one connection, one ordered list of migrations, applied in one
 // transaction before any store exists. A store receives the handle and owns
 // only its queries.
-import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync, statSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
 import { DatabaseSync } from "node:sqlite";
 import { logger } from "./log.js";
 import { PIER_DB } from "./paths.js";
 const log = logger("db");
-/** Pre-migration snapshots to keep. Three is two upgrades of regret plus one:
+/** Snapshots to keep *of each kind*. Three is two upgrades of regret plus one:
  *  they are full copies of the database, and the one that matters is the
- *  newest. */
+ *  newest. Counted per kind because the two kinds answer different questions —
+ *  a run of releases must not evict the pre-migration copies. */
 const KEEP_BACKUPS = 3;
 /** How long a second process may wait for the write lock before failing. Two
  *  Pier processes on one PIER_HOME contend exactly once — at boot, when both
@@ -147,14 +148,25 @@ let shared;
  */
 export const pierDb = () => (shared ??= openDb(PIER_DB));
 /** A release-level restore point, taken while the service is stopped even when
- * the release has no schema migration. The previous complete copy stays put if
- * writing its replacement fails. */
-export function backupDb(path = PIER_DB) {
+ * the release has no schema migration. The previous complete copies stay put if
+ * writing this one fails.
+ *
+ * `version` is the Pier that produced this database, not the one being
+ * installed: the updater runs this from the tree it is about to replace, and
+ * restoring a database means reinstalling the code that speaks its schema
+ * (`migrate` refuses one from a newer Pier). So the name carries the other half
+ * of the pair. Backing up twice at one version replaces that version's copy —
+ * the pairing is identical, so a second name for it would say nothing. */
+export function backupDb(version, path = PIER_DB) {
     if (!existsSync(path))
         return undefined;
-    const bak = `${path}.release.bak`;
+    // In a filename, so it may not carry a separator or a traversal; a version
+    // this malformed is a broken install, not something to guess at.
+    const safe = version.replaceAll(/[^0-9A-Za-z.+-]/g, "_") || "unknown";
+    const bak = join(backupsDir(path, true), `${basename(path)}.release-${safe}.bak`);
     copyDatabase(path, bak);
     log.info(`pre-update backup: ${bak}`);
+    prune(releases(path));
     return bak;
 }
 /** Open a database, bring it to the current schema, and lock down its files.
@@ -186,9 +198,9 @@ function migrate(db, path, migrations) {
     if (at > target) {
         // Name the snapshot that exists rather than a pattern: the operator is
         // reading this because the service will not start.
-        const newest = path === ":memory:" ? undefined : backups(path)[0]?.file;
+        const newest = path === ":memory:" ? undefined : snapshots(path)[0]?.file;
         throw new Error(`${path} is at schema ${at}, this Pier speaks ${target}: a database is ` +
-            `never downgraded. Restore ${newest ?? `${path}.v*.bak`}, or run the newer Pier.`);
+            `never downgraded. Restore ${newest ?? `a copy from ${backupsDir(path)}`}, or run the newer Pier.`);
     }
     // Version 0 with tables is a database from before versioning existed.
     // Migration 1 assumes an empty file, so the collision it would hit says
@@ -244,7 +256,7 @@ function migrate(db, path, migrations) {
     }
     log.info(locked === 0 ? `schema created at version ${target}` : `schema ${locked} → ${target}`);
     if (path !== ":memory:")
-        prune(path);
+        prune(snapshots(path).map(({ file }) => file));
 }
 /**
  * The copy that exists because `user_version` only counts up: the transaction
@@ -259,7 +271,7 @@ function migrate(db, path, migrations) {
  * ever refers to a finished copy.
  */
 function snapshot(path, at) {
-    const bak = `${path}.v${at}.bak`;
+    const bak = join(backupsDir(path, true), `${basename(path)}.v${at}.bak`);
     copyDatabase(path, bak);
     log.info(`pre-migration backup: ${bak}`);
 }
@@ -276,22 +288,64 @@ function copyDatabase(path, bak) {
     chmodSync(tmp, 0o600); // it holds everything the 0600 database holds
     renameSync(tmp, bak);
 }
-/** Snapshots beside the database, newest schema first. */
-function backups(path) {
+/**
+ * One directory for every copy of this database, `db/backups/`. Beside the
+ * database was fine while there was one snapshot per schema; a restore point
+ * per release turns that into a listing where the live file and its sidecars
+ * are hard to pick out, and "which of these do I not delete" is the wrong
+ * question to make an operator answer under pressure.
+ *
+ * `create` also adopts what an older Pier wrote next to the database, so the
+ * restore procedure names one location instead of two forever.
+ */
+function backupsDir(path, create = false) {
+    const dir = join(dirname(path), "backups");
+    if (!create)
+        return dir;
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const prefix = `${basename(path)}.`;
+    for (const name of readdirSync(dirname(path))) {
+        if (!name.startsWith(prefix) || !name.endsWith(".bak"))
+            continue;
+        renameSync(join(dirname(path), name), join(dir, name));
+        log.info(`moved ${name} into ${dir}`);
+    }
+    return dir;
+}
+/** The copies of one kind: `v<schema>` or `release-<version>`. Disjoint
+ *  prefixes, so each kind is counted and pruned on its own. */
+function listBackups(path, kind) {
+    const dir = backupsDir(path);
+    if (!existsSync(dir))
+        return [];
+    const prefix = `${basename(path)}.${kind}`;
+    return readdirSync(dir).filter((name) => name.startsWith(prefix) && name.endsWith(".bak"));
+}
+/** Pre-migration snapshots, newest schema first — the number in the name is an
+ *  ordinal, so it orders them without asking the filesystem. */
+function snapshots(path) {
     const prefix = `${basename(path)}.v`;
-    return readdirSync(dirname(path))
-        .filter((name) => name.startsWith(prefix) && name.endsWith(".bak"))
+    return listBackups(path, "v")
         .map((name) => ({
         version: Number(name.slice(prefix.length, -".bak".length)),
-        file: join(dirname(path), name),
+        file: join(backupsDir(path), name),
     }))
         .filter(({ version }) => Number.isInteger(version))
         .sort((a, b) => b.version - a.version);
 }
-/** Keep the newest few. Nobody restores a database from four upgrades ago, and
- *  every one of these is the size of the whole database. */
-function prune(path) {
-    for (const { file } of backups(path).slice(KEEP_BACKUPS)) {
+/** Release restore points, newest copy first. Ordered by mtime: the name holds
+ *  a Pier version, and comparing those means reimplementing semver here — while
+ *  two updates of one instance are never in flight at the same moment. Legacy
+ *  `pier.db.release.bak` shares the prefix, so it ages out like the rest. */
+function releases(path) {
+    return listBackups(path, "release")
+        .map((name) => join(backupsDir(path), name))
+        .sort((a, b) => statSync(b).mtimeMs - statSync(a).mtimeMs);
+}
+/** Keep the newest few, oldest first out. Nobody restores a database from four
+ *  upgrades ago, and every one of these is the size of the whole database. */
+function prune(newestFirst) {
+    for (const file of newestFirst.slice(KEEP_BACKUPS)) {
         rmSync(file, { force: true });
         log.info(`removed superseded backup: ${file}`);
     }
@@ -311,4 +365,7 @@ function restrict(path) {
             chmodSync(file, 0o600);
     }
     chmodSync(dirname(path), 0o700);
+    // Full copies of the same secrets, one directory down.
+    if (existsSync(backupsDir(path)))
+        chmodSync(backupsDir(path), 0o700);
 }

package/dist/service.js

@@ -300,7 +300,7 @@ export function startUpdate(options) {
     if (!run(["systemctl", "--user", "start", "--no-block", UPDATE_UNIT_NAME]))
         return "failed";
     say(`updating in the background — follow it with: journalctl --user -u ${UPDATE_UNIT_NAME} -f`);
-    say(`Pier stops, snapshots pier.db.release.bak, installs, then starts again.`);
+    say(`Pier stops, snapshots the database into db/backups/, installs, then starts again.`);
     return "started";
 }
 export function uninstall(home = homedir(), say = console.log, exec) {