@trylight/app 0.1.1 → 0.1.3

package/README.md

@@ -21,8 +21,8 @@ through `entity()`. Each request is parsed with the table's own Zod schema
 (drizzle-zod; unknown or platform columns are refused, `field_sources` must be
 `{url, evidence}` per real column), goes through the app's door (members-only:
 a member; public: anyone reads, people signed in write; `write: "agents"`
-tables refuse the app), must come from the app's own pages, and each change is
-written with a `light_changes` row naming the person, in one transaction. An
+tables refuse the app), and must come from the app's own pages; each write
+names its person for the table's change trigger (below). An
 edited value loses its source; sources sent are merged by column. Lists sort
 by the asked column, then id. With no sign-in configured only a non-production
 server asked on loopback answers (as "Local developer"); anything else gets 503.
@@ -46,12 +46,17 @@ sign-in; a stranger to a public app only reads what members kept.
 
 ## Schema sync
 
+`light-db sync` and `migrate` connect with `DATABASE_URL_UNPOOLED`, the
+database's direct address, and refuse to run without it: they serialise on
+Postgres advisory locks, which a transaction pooler (the app's `DATABASE_URL`
+on Neon) keeps on a pooled connection after the process exits.
+
 `plan()` diffs `db/schema` against the newest migration snapshot with
 drizzle-kit's API, removals first and additions second, so drizzle-kit never
 has to ask whether a column was renamed (it can't without a terminal).
 The change is written as a drizzle migration (`db/migrations`,
 drizzle-kit's own layout) and applied, whatever it does to the rows there (a
-removed column's values go with it); one the rows refuse is taken back out,
+removed column's values are archived first, below); one the rows refuse is taken back out,
 so the change stays pending rather than blocking every later migrate. Changed
 indexes and constraints are dropped before the columns they cover and enums
 only after, so the two halves apply in order. Syncs and migrates each hold a Postgres advisory lock (with a
@@ -60,6 +65,22 @@ overlap, and a process that dies releases it. `migrate` applies the journal; in
 asks the platform's migrate socket to run it. `check` (in `pnpm build`)
 fails while `db/schema` has changes no migration holds.
 
+## Recoverable deletes
+
+`src/db/audit.ts`, in Postgres itself. Every entity table has a row trigger
+that records each insert, update, delete and truncate in `light_changes` (the
+new row, `{ column: { from, to } }`, or the old row), whoever wrote it: the
+actor is `light.actor_kind/_id/_name`, which the entities route and Plaza's
+`mii db write` set per transaction, or else the database role. A migration
+that drops a table or column or changes a column's type first copies what it
+destroys into `light_archive` (`light_archive_values`, called at the top of
+the migration, so in its transaction) and the migrate prints "Archived N
+values from table.column". Both tables refuse UPDATE, DELETE and TRUNCATE (a guard against mistakes:
+the owner role can still drop the trigger). DDL an agent runs itself (`drop
+table` through `mii db write`) is not archived.
+`migrate` installs the functions before applying migrations and the triggers
+after; the template's AGENTS.md has the restore SQL.
+
 ## Develop
 
 ```bash

package/dist/db/audit.d.ts

@@ -0,0 +1,36 @@
+import type postgres from "postgres";
+/** Makes light_archive and the functions migrations and triggers call. Runs before migrating. */
+export declare function prepareAudit(sql: postgres.Sql): Promise<void>;
+/**
+ * The entity tables `schema` declares. Read before migrating: the triggers
+ * write into light_changes, so a schema that doesn't export it is refused
+ * before any migration applies.
+ */
+export declare function entityTables(schema: Record<string, unknown>): string[];
+/**
+ * Puts the change trigger on each of `tables` the database has (one a
+ * migration hasn't made yet is tracked on the migrate that makes it), and
+ * makes light_changes append-only. Runs after migrating.
+ */
+export declare function trackTables(sql: postgres.Sql, tables: string[]): Promise<void>;
+/** A table, or a column of one, that a migration destroys: what it archives first. */
+export type Destroyed = {
+    table: string;
+    column: string | null;
+};
+/**
+ * What going from `previous` to `current` (drizzle-kit snapshots' `tables`)
+ * destroys: dropped tables, dropped columns, and columns whose type changes
+ * (Postgres converts the values, which may not survive the trip back).
+ */
+export declare function destroyed(previous: Record<string, unknown>, current: Record<string, unknown>): Destroyed[];
+/** The statements that archive what migration `tag` destroys, to run first in it. */
+export declare function archiveStatements(archive: Destroyed[], tag: string): string[];
+/**
+ * Collects what a migrate archived, to print once its transaction commits
+ * (a migration that fails archives nothing). Other notices are dropped.
+ */
+export declare function archiveNotices(): {
+    onnotice(notice: postgres.Notice): void;
+    print(): void;
+};

package/dist/db/audit.js

@@ -0,0 +1,193 @@
+// Recoverable deletes: change triggers into light_changes, an archive step at
+// the top of destructive migrations, both tables append-only (README,
+// "Recoverable deletes"; the restore is the template AGENTS.md's).
+import { getTableName, is } from "drizzle-orm";
+import { PgTable } from "drizzle-orm/pg-core";
+import { z } from "zod/v4";
+import { isEntity, lightChanges } from "../schema.js";
+/** The SQLSTATE of the notice an archive raises, so the CLI prints just those. */
+const ARCHIVED_NOTICE = "LA001";
+/**
+ * Installed before migrations run (a migration's archive step calls these),
+ * all idempotent. No input reaches this text; the functions quote the
+ * identifiers they are given with format('%I').
+ */
+const PREPARE = `
+create table if not exists light_archive (
+  id uuid primary key default gen_random_uuid(),
+  table_name text not null,
+  -- null when the whole row was archived (its table was dropped)
+  column_name text,
+  -- the row's id; null for a table without a uuid id
+  row_id uuid,
+  value jsonb not null,
+  migration text not null,
+  archived_at timestamptz not null default now()
+);
+create index if not exists light_archive_table_idx on light_archive (table_name, column_name);
+
+create or replace function light_append_only() returns trigger language plpgsql as $$
+begin
+  raise exception '% is append-only: it is the record of what changed and what was removed, so its rows are never changed or deleted.', tg_table_name
+    using errcode = 'insufficient_privilege';
+end $$;
+create or replace trigger light_append_only before update or delete or truncate on light_archive
+  for each statement execute function light_append_only();
+
+create or replace function light_record_change() returns trigger language plpgsql as $$
+declare
+  -- A setting set local reads '' (not null) once its transaction has ended.
+  actor_kind text := coalesce(nullif(current_setting('light.actor_kind', true), ''), 'database');
+  actor_id text := nullif(current_setting('light.actor_id', true), '');
+  actor_name text := coalesce(nullif(current_setting('light.actor_name', true), ''), current_user);
+  row_id uuid;
+  action text;
+  changes jsonb;
+begin
+  if tg_op = 'TRUNCATE' then
+    execute format(
+      'insert into light_changes (table_name, row_id, action, changes, actor_kind, actor_id, actor_name)
+       select $1, t.id, ''delete'', to_jsonb(t), $2, $3, $4 from %I.%I t', tg_table_schema, tg_table_name)
+      using tg_table_name, actor_kind, actor_id, actor_name;
+    return null;
+  elsif tg_op = 'INSERT' then
+    row_id := new.id;
+    action := 'create';
+    changes := to_jsonb(new);
+  elsif tg_op = 'DELETE' then
+    row_id := old.id;
+    action := 'delete';
+    changes := to_jsonb(old);
+  else
+    row_id := new.id;
+    action := 'update';
+    select jsonb_object_agg(o.key, jsonb_build_object('from', o.value, 'to', n.value)) into changes
+      from jsonb_each(to_jsonb(old)) o join jsonb_each(to_jsonb(new)) n on n.key = o.key
+      where o.value is distinct from n.value and o.key <> 'updated_at';
+    -- An update that set every value to what it was changed nothing.
+    if changes is null then return null; end if;
+  end if;
+  insert into light_changes (table_name, row_id, action, changes, actor_kind, actor_id, actor_name)
+    values (tg_table_name, row_id, action, changes, actor_kind, actor_id, actor_name);
+  return null;
+end $$;
+
+create or replace function light_track(tbl text) returns void language plpgsql as $$
+begin
+  execute format('create or replace trigger light_record_change after insert or update or delete on %I
+    for each row execute function light_record_change()', tbl);
+  execute format('create or replace trigger light_record_truncate before truncate on %I
+    for each statement execute function light_record_change()', tbl);
+end $$;
+
+-- col null: every row of tbl, whole (the table is being dropped).
+create or replace function light_archive_values(tbl text, col text, tag text) returns void language plpgsql as $$
+declare
+  id_of_row text := case when exists (
+    select 1 from pg_attribute
+    where attrelid = format('%I', tbl)::regclass and attname = 'id' and atttypid = 'uuid'::regtype and not attisdropped
+  ) then 't.id' else 'null::uuid' end;
+  archived bigint;
+begin
+  if col is null then
+    execute format(
+      'insert into light_archive (table_name, column_name, row_id, value, migration)
+       select $1, null, %s, to_jsonb(t), $2 from %I t', id_of_row, tbl)
+      using tbl, tag;
+  else
+    execute format(
+      'insert into light_archive (table_name, column_name, row_id, value, migration)
+       select $1, $2, %s, to_jsonb(t)->$2, $3 from %I t where %I is not null', id_of_row, tbl, col)
+      using tbl, col, tag;
+  end if;
+  get diagnostics archived = row_count;
+  if archived = 0 then return; end if;
+  raise notice using errcode = '${ARCHIVED_NOTICE}', message = format('Archived %s %s from %s (migration %s).',
+    archived, case when col is null then 'rows' else 'values' end, concat_ws('.', tbl, col), tag);
+end $$;
+`;
+/** light_changes is a drizzle table (db/schema exports it), so it exists only once migrated. */
+const CHANGES_APPEND_ONLY = `
+create or replace trigger light_append_only before update or delete or truncate on light_changes
+  for each statement execute function light_append_only();
+`;
+/** Makes light_archive and the functions migrations and triggers call. Runs before migrating. */
+export async function prepareAudit(sql) {
+    await sql.unsafe(PREPARE);
+}
+/**
+ * The entity tables `schema` declares. Read before migrating: the triggers
+ * write into light_changes, so a schema that doesn't export it is refused
+ * before any migration applies.
+ */
+export function entityTables(schema) {
+    const values = Object.values(schema);
+    if (!values.some((value) => is(value, PgTable) && getTableName(value) === getTableName(lightChanges))) {
+        throw new Error("db/schema/index.ts must export lightChanges (`export { lightChanges } from \"@trylight/app/schema\";`): it records every change to the app's tables.");
+    }
+    return values.filter(isEntity).map((entity) => getTableName(entity));
+}
+/**
+ * Puts the change trigger on each of `tables` the database has (one a
+ * migration hasn't made yet is tracked on the migrate that makes it), and
+ * makes light_changes append-only. Runs after migrating.
+ */
+export async function trackTables(sql, tables) {
+    await sql `select light_track(name) from unnest(${sql.array(tables)}::text[]) as name where to_regclass(quote_ident(name)) is not null`;
+    await sql.unsafe(CHANGES_APPEND_ONLY);
+}
+const snapshotTable = z.looseObject({
+    name: z.string(),
+    columns: z.record(z.string(), z.looseObject({ type: z.string() }))
+});
+/**
+ * What going from `previous` to `current` (drizzle-kit snapshots' `tables`)
+ * destroys: dropped tables, dropped columns, and columns whose type changes
+ * (Postgres converts the values, which may not survive the trip back).
+ */
+export function destroyed(previous, current) {
+    const found = [];
+    for (const [key, entry] of Object.entries(previous)) {
+        const before = snapshotTable.parse(entry);
+        if (!(key in current)) {
+            found.push({ table: before.name, column: null });
+            continue;
+        }
+        const now = snapshotTable.parse(current[key]);
+        for (const [name, column] of Object.entries(before.columns)) {
+            const after = now.columns[name];
+            if (after === undefined || after.type !== column.type)
+                found.push({ table: before.name, column: name });
+        }
+    }
+    return found;
+}
+/** A SQL string literal, for the migration file drizzle's migrator runs. */
+function literal(text) {
+    return `'${text.replaceAll("'", "''")}'`;
+}
+/** The statements that archive what migration `tag` destroys, to run first in it. */
+export function archiveStatements(archive, tag) {
+    return archive.map(({ table, column }) => `SELECT light_archive_values(${literal(table)}, ${column === null ? "NULL" : literal(column)}, ${literal(tag)});`);
+}
+const archivedNotice = z.object({ code: z.literal(ARCHIVED_NOTICE), message: z.string() });
+/**
+ * Collects what a migrate archived, to print once its transaction commits
+ * (a migration that fails archives nothing). Other notices are dropped.
+ */
+export function archiveNotices() {
+    const messages = [];
+    return {
+        onnotice(notice) {
+            const archived = archivedNotice.safeParse(notice);
+            if (archived.success)
+                messages.push(archived.data.message);
+        },
+        print() {
+            if (messages.length === 0)
+                return;
+            console.log(messages.join("\n"));
+            console.log("Archived values stay in light_archive; AGENTS.md, \"Getting deleted data back\", says how to restore them.");
+        }
+    };
+}

package/dist/db/cli.js

@@ -9,6 +9,7 @@ import { drizzle } from "drizzle-orm/postgres-js";
 import { migrate } from "drizzle-orm/postgres-js/migrator";
 import postgres from "postgres";
 import { z } from "zod/v4";
+import { archiveNotices, entityTables, prepareAudit, trackTables } from "./audit.js";
 import { MIGRATIONS_DIR, SCHEMA_ENTRY, plan, unwriteMigration, writeMigration } from "./migrations.js";
 import { env } from "../server/env.js";
 /**
@@ -20,8 +21,12 @@ const PLATFORM_MIGRATE = "/run/mii/migrate.sock";
 /** Postgres advisory locks: one migrate, and one sync, of a database at a time. */
 const MIGRATE_LOCK_KEY = 4_815_162_342;
 const SYNC_LOCK_KEY = 4_815_162_343;
+/** Exit code of a migrate whose migrations committed but whose change triggers didn't go on. */
+const APPLIED_UNTRACKED = 2;
 // pg_advisory_lock waits for the one before it; a process that dies releases it.
-const connect = () => postgres(databaseUrl(), { max: 1, onnotice: () => undefined });
+// Only on a direct connection: behind a transaction pooler the lock stays on a
+// pooled server connection after the process exits, and every later sync waits.
+const connect = (onnotice = () => undefined) => postgres(unpooledDatabaseUrl(), { max: 1, onnotice });
 const root = process.cwd();
 const envFile = join(root, ".env.local");
 if (existsSync(envFile))
@@ -30,11 +35,12 @@ const [command] = process.argv.slice(2);
 async function loadSchema() {
     return import(pathToFileURL(join(root, SCHEMA_ENTRY)).href);
 }
-function databaseUrl() {
-    const { databaseUrl } = env();
-    if (databaseUrl === undefined)
-        throw new Error("DATABASE_URL is not set: there is no database to sync db/schema into.");
-    return databaseUrl;
+function unpooledDatabaseUrl() {
+    const { unpooledDatabaseUrl } = env();
+    if (unpooledDatabaseUrl === undefined) {
+        throw new Error("DATABASE_URL_UNPOOLED is not set: light-db sync and migrate need the database's direct (unpooled) connection.");
+    }
+    return unpooledDatabaseUrl;
 }
 /**
  * Makes the database match `db/schema`, whatever the change does to the rows
@@ -56,7 +62,7 @@ async function sync() {
             console.error(error instanceof Error ? error.message : String(error));
             return 1;
         });
-        if (applied !== 0) {
+        if (applied !== 0 && applied !== APPLIED_UNTRACKED) {
             unwriteMigration(root, tag);
             console.error(`${MIGRATIONS_DIR}/${tag}.sql didn't apply, so it was taken back; change db/schema and save again.`);
         }
@@ -74,17 +80,30 @@ async function check() {
     console.error(`db/schema has changes with no migration yet; run \`pnpm db:sync\`:\n${planned.statements.join("\n")}`);
     return 1;
 }
-/** Applies every migration in db/migrations the database doesn't have. */
+/**
+ * Applies every migration in db/migrations the database doesn't have, with
+ * the audit around them (./audit.ts): its functions first, since a
+ * migration's archive step calls them; its triggers after, on the tables
+ * migrations made.
+ */
 async function applyMigrations() {
     // The agent (not root) in an app's sandbox: the platform migrates for it.
     if (userInfo().uid !== 0 && existsSync(PLATFORM_MIGRATE))
         return migrateThroughPlatform();
-    const client = connect();
+    const archived = archiveNotices();
+    const client = connect(archived.onnotice);
     try {
         await client `select pg_advisory_lock(${MIGRATE_LOCK_KEY})`;
+        const tables = entityTables(await loadSchema());
+        await prepareAudit(client);
         await migrate(drizzle(client), { migrationsFolder: join(root, MIGRATIONS_DIR) });
+        archived.print();
         console.log("Database is up to date with db/migrations.");
-        return 0;
+        // The migrations are committed: a failure here must not take their files back.
+        return await trackTables(client, tables).then(() => 0, (error) => {
+            console.error(`The change triggers didn't go on (${error instanceof Error ? error.message : String(error)}); the next migrate tries again.`);
+            return APPLIED_UNTRACKED;
+        });
     }
     finally {
         await client.end();

package/dist/db/migrations.d.ts

@@ -1,9 +1,12 @@
 import { z } from "zod/v4";
+import { type Destroyed } from "./audit.js";
 export declare const SCHEMA_ENTRY = "db/schema/index.ts";
 export declare const MIGRATIONS_DIR = "db/migrations";
 export type Plan = {
     /** The new migration's statements, in order; empty when nothing changed. */
     statements: string[];
+    /** What the statements destroy, archived first when the migration runs. */
+    archive: Destroyed[];
     snapshot: Snapshot;
 };
 /** The parts of a drizzle-kit snapshot a removal touches; the rest passes through. */
@@ -30,7 +33,7 @@ type Snapshot = z.infer<typeof snapshotSchema>;
  * What `db/schema` needs beyond the last migration, in three diffs that each
  * only remove or only add, so drizzle-kit never has to ask whether something
  * removed was renamed (it can't ask here: there is no terminal). A rename is
- * therefore a drop and an add: the old column's values go. Removed enums go last,
+ * therefore a drop and an add: the old column's values are archived. Removed enums go last,
  * after the columns that used them have changed.
  */
 export declare function plan(root: string, schema: Record<string, unknown>): Promise<Plan>;

package/dist/db/migrations.js

@@ -1,12 +1,13 @@
 // Writing a schema file is the migration: the change from the last
 // migration's snapshot to `db/schema` becomes a new drizzle migration,
 // written and applied at once, whatever it does to the rows there (a removed
-// column's values go with it).
+// column's values are archived first, in light_archive).
 import { existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { isDeepStrictEqual } from "node:util";
 import { join } from "node:path";
 import { generateDrizzleJson, generateMigration } from "drizzle-kit/api";
 import { z } from "zod/v4";
+import { archiveStatements, destroyed } from "./audit.js";
 export const SCHEMA_ENTRY = "db/schema/index.ts";
 export const MIGRATIONS_DIR = "db/migrations";
 const entries = z.record(z.string(), z.unknown());
@@ -33,7 +34,7 @@ const snapshotSchema = z.looseObject({
  * What `db/schema` needs beyond the last migration, in three diffs that each
  * only remove or only add, so drizzle-kit never has to ask whether something
  * removed was renamed (it can't ask here: there is no terminal). A rename is
- * therefore a drop and an add: the old column's values go. Removed enums go last,
+ * therefore a drop and an add: the old column's values are archived. Removed enums go last,
  * after the columns that used them have changed.
  */
 export async function plan(root, schema) {
@@ -47,7 +48,7 @@ export async function plan(root, schema) {
         ...(await generateMigration(kept, withOldEnums)),
         ...(await generateMigration(withOldEnums, snapshot))
     ];
-    return { statements, snapshot };
+    return { statements, archive: destroyed(previous.tables, snapshot.tables), snapshot };
 }
 function only(from, keep) {
     return Object.fromEntries(Object.entries(from).filter(([key]) => key in keep));
@@ -139,7 +140,8 @@ export function writeMigration(root, planned) {
     const idx = journal.entries.length;
     const tag = `${String(idx).padStart(4, "0")}_schema`;
     mkdirSync(join(root, MIGRATIONS_DIR, "meta"), { recursive: true });
-    writeFileSync(join(root, MIGRATIONS_DIR, `${tag}.sql`), planned.statements.join("\n--> statement-breakpoint\n") + "\n");
+    const statements = [...archiveStatements(planned.archive, tag), ...planned.statements];
+    writeFileSync(join(root, MIGRATIONS_DIR, `${tag}.sql`), statements.join("\n--> statement-breakpoint\n") + "\n");
     writeFileSync(snapshotFile(root, idx), JSON.stringify(planned.snapshot, null, 2) + "\n");
     journal.entries.push({ idx, version: "7", when: Date.now(), tag, breakpoints: true });
     writeFileSync(join(root, MIGRATIONS_DIR, "meta", "_journal.json"), JSON.stringify(journal, null, 2) + "\n");

package/dist/schema.d.ts

@@ -75,9 +75,11 @@ export type Entity = PgTable & {
 };
 export declare function isEntity(value: unknown): value is Entity;
 /**
- * Every change a person makes through `app.table(...)`, with who made it, in
- * the same transaction as the change. `changes` is the new row for a create,
- * the old row for a delete, and `{ column: { from, to } }` for an update.
+ * Every change to an entity table, whoever made it, written by the table's
+ * trigger (src/db/audit.ts) in the change's transaction. `changes` is the new
+ * row for a create, the old row for a delete, and `{ column: { from, to } }`
+ * for an update. A `database` actor is a writer that didn't name itself: its
+ * name is the database role.
  */
 export declare const lightChanges: PgTableWithColumns<{
     name: "light_changes";
@@ -175,14 +177,14 @@ export declare const lightChanges: PgTableWithColumns<{
             tableName: "light_changes";
             dataType: "string";
             columnType: "PgText";
-            data: "person" | "agent";
+            data: "person" | "agent" | "database";
             driverParam: string;
             notNull: true;
             hasDefault: false;
             isPrimaryKey: false;
             isAutoincrement: false;
             hasRuntimeDefault: false;
-            enumValues: ["person", "agent"];
+            enumValues: ["person", "agent", "database"];
             baseColumn: never;
             identity: undefined;
             generated: undefined;

package/dist/schema.js

@@ -64,9 +64,11 @@ export function isEntity(value) {
     return is(value, PgTable) && "$access" in value;
 }
 /**
- * Every change a person makes through `app.table(...)`, with who made it, in
- * the same transaction as the change. `changes` is the new row for a create,
- * the old row for a delete, and `{ column: { from, to } }` for an update.
+ * Every change to an entity table, whoever made it, written by the table's
+ * trigger (src/db/audit.ts) in the change's transaction. `changes` is the new
+ * row for a create, the old row for a delete, and `{ column: { from, to } }`
+ * for an update. A `database` actor is a writer that didn't name itself: its
+ * name is the database role.
  */
 export const lightChanges = pgTable("light_changes", {
     id: uuid().primaryKey().defaultRandom(),
@@ -74,7 +76,7 @@ export const lightChanges = pgTable("light_changes", {
     row_id: uuid().notNull(),
     action: text({ enum: ["create", "update", "delete"] }).notNull(),
     changes: jsonb().$type().notNull(),
-    actor_kind: text({ enum: ["person", "agent"] }).notNull(),
+    actor_kind: text({ enum: ["person", "agent", "database"] }).notNull(),
     actor_id: text(),
     actor_name: text().notNull(),
     created_at: timestamp({ withTimezone: true, mode: "string" })

package/dist/server/entities.js

@@ -1,14 +1,14 @@
 // The one route behind `app.table(...)`: list, get, create, update and delete
 // on any entity table, each request checked against the table's own Zod
-// schema and the app's door, and every change recorded in light_changes with
-// who made it, in the same transaction.
-import { and, asc, desc, eq, getTableColumns, getTableName, inArray, isNull } from "drizzle-orm";
+// schema and the app's door. Each write names its person for the table's
+// trigger, which records the change in light_changes (src/db/audit.ts).
+import { and, asc, desc, eq, getTableColumns, getTableName, inArray, isNull, sql } from "drizzle-orm";
 import { isDeepStrictEqual } from "node:util";
 import { createSchemaFactory } from "drizzle-zod";
 import { isSameOrigin } from "@shubh90/app-runtime/chat/server";
 import { z } from "zod/v4";
 import { ENTITIES_PATH, LIST_LIMIT } from "../entities.js";
-import { PLATFORM_COLUMNS, fieldSource, isEntity, lightChanges } from "../schema.js";
+import { PLATFORM_COLUMNS, fieldSource, isEntity } from "../schema.js";
 import { env } from "./env.js";
 /** Who writes when the app runs with no sign-in at all: a bare local dev server. */
 const LOCAL_DEVELOPER = { id: null, name: "Local developer" };
@@ -153,54 +153,39 @@ async function get(db, table, id) {
 }
 async function create(db, table, actor, data) {
     return db.transaction(async (tx) => {
-        const row = exactlyOne(await tx
+        await nameActor(tx, actor);
+        return exactlyOne(await tx
             .insert(table.entity)
             .values({ ...data, created_by: actor.id })
             .returning());
-        await audit(tx, table, rowId(row), "create", row, actor);
-        return row;
     });
 }
 async function update(db, table, actor, id, patch) {
     return db.transaction(async (tx) => {
+        await nameActor(tx, actor);
         const before = atMostOne(await tx.select().from(table.entity).where(eq(table.id, id)).for("update"));
         if (before === null)
             return null;
         const changed = Object.keys(patch).filter((key) => !isDeepStrictEqual(patch[key], before[key]));
         // A value a person sets is no longer what its source said; sources sent are merged in.
         const field_sources = { ...withoutSources(before.field_sources, changed), ...patch.field_sources };
-        const row = exactlyOne(await tx
+        return exactlyOne(await tx
             .update(table.entity)
             .set({ ...patch, field_sources })
             .where(eq(table.id, id))
             .returning());
-        const changes = Object.fromEntries([...changed, "field_sources"]
-            .filter((key) => !isDeepStrictEqual(before[key], row[key]))
-            .map((key) => [key, { from: before[key], to: row[key] }]));
-        if (Object.keys(changes).length > 0)
-            await audit(tx, table, id, "update", changes, actor);
-        return row;
     });
 }
 async function remove(db, table, actor, id) {
     return db.transaction(async (tx) => {
+        await nameActor(tx, actor);
         const row = atMostOne(await tx.delete(table.entity).where(eq(table.id, id)).returning());
-        if (row === null)
-            return null;
-        await audit(tx, table, id, "delete", row, actor);
-        return { id };
+        return row === null ? null : { id };
     });
 }
-function audit(tx, table, rowId, action, changes, actor) {
-    return tx.insert(lightChanges).values({
-        table_name: table.name,
-        row_id: rowId,
-        action,
-        changes,
-        actor_kind: "person",
-        actor_id: actor.id,
-        actor_name: actor.name
-    });
+/** Who the table's trigger records in light_changes for the rest of this transaction. */
+function nameActor(tx, actor) {
+    return tx.execute(sql `select set_config('light.actor_kind', 'person', true), set_config('light.actor_id', coalesce(${actor.id}, ''), true), set_config('light.actor_name', ${actor.name}, true)`);
 }
 /** The row a statement by primary key touched, or null when there is none. */
 function atMostOne(rows) {
@@ -218,10 +203,6 @@ function exactlyOne(rows) {
 }
 // What's stored may come from an agent's own write: read as it is, never refused here.
 const storedSources = z.record(z.string(), z.unknown());
-const storedId = z.object({ id: z.uuid() });
-function rowId(row) {
-    return storedId.parse(row).id;
-}
 function withoutSources(stored, columns) {
     const sources = storedSources.parse(stored);
     return Object.fromEntries(Object.entries(sources).filter(([column]) => !columns.includes(column)));

package/dist/server/env.d.ts

@@ -1,6 +1,7 @@
 /** Read when asked, not at import: a build imports this without a runtime env. */
 export declare function env(): {
     databaseUrl: string | undefined;
+    unpooledDatabaseUrl: string | undefined;
     /** Sign-in needs Plaza, this app's id in it, and a database for sessions. */
     configured: boolean;
     /**

package/dist/server/env.js

@@ -4,12 +4,15 @@ import { z } from "zod/v4";
 const serverEnv = z
     .object({
     DATABASE_URL: z.string().min(1).optional(),
+    /** The same database without a pooler: schema changes and their locks need a session. */
+    DATABASE_URL_UNPOOLED: z.string().min(1).optional(),
     MII_PLAZA_URL: z.url().optional(),
     MII_APP_ID: z.string().min(1).optional(),
     NODE_ENV: z.string().optional()
 })
     .transform((env) => ({
     databaseUrl: env.DATABASE_URL,
+    unpooledDatabaseUrl: env.DATABASE_URL_UNPOOLED,
     /** Sign-in needs Plaza, this app's id in it, and a database for sessions. */
     configured: Boolean(env.MII_PLAZA_URL && env.MII_APP_ID && env.DATABASE_URL),
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trylight/app",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "The Light SDK every v2 org app depends on: entities (Drizzle tables with a typed client), sign-in, contracts and in-app chat.",
   "license": "UNLICENSED",
   "type": "module",