@coffre/vault 0.0.0-stage → 0.1.0

package/dist/vault-DvTsSAOX.js

@@ -0,0 +1,2225 @@
+import { ACCESS_ACTIONS, checkpointMessage, describeAccessFault, verifyCheckpoint } from "@coffre/core/vault";
+import { DEK_BYTES, KekBadClaimError, KekCancelledError, KekRegistry, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
+import { tablesOf } from "@coffre/db";
+import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
+import { allows, assignableToEnvironment, isRole, isSyncPrincipal, mayManageAccess } from "@coffre/core/access";
+import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
+import { checkContext } from "@coffre/core/envelope";
+import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation } from "@coffre/db/dialect";
+import { appendEntries, lockLogHead } from "@coffre/db/log";
+import { and, asc, count, desc, eq, gt, gte, inArray, isNull, sql } from "drizzle-orm";
+//#region src/config.ts
+/**
+* 1000 keys in 15 minutes: twenty `coffre run`s of a 50-key environment
+* back to back, which no person or deploy pipeline does, while a script
+* pulling every secret it can reach stops within a few seconds.
+*/
+const DEFAULT_BULK_LIMIT = {
+	count: 1e3,
+	windowMs: 9e5
+};
+function key32(value, what) {
+	const raw = Buffer.from(value, "base64");
+	if (raw.length !== 32) throw new Error(`${what} must be 32 bytes, base64; got ${raw.length} bytes`);
+	return raw;
+}
+const KEK_ID = /^[A-Za-z0-9._-]{1,64}$/;
+const KEK_PROVIDER = /^[a-z0-9][a-z0-9-]{0,31}$/;
+/** Every row records it, and `provider:keyId` finds the KEK again: visible ASCII, bounded. */
+const KEK_NAME = /^[\x21-\x7e]{1,255}$/;
+function kek(entry) {
+	if (!("wrap" in entry)) {
+		const { id, key } = entry;
+		if (!KEK_ID.test(id)) throw new Error(`KEK id "${id}" must be 1-64 letters, digits, dots, dashes or underscores`);
+		return new LocalKekProvider(key32(key, `KEK ${id}`), id);
+	}
+	const { provider, keyId, keyVersion } = entry;
+	if (typeof provider !== "string" || !KEK_PROVIDER.test(provider)) throw new Error(`a KEK provider's name must be 1-32 lowercase letters, digits or dashes; got "${String(provider)}"`);
+	if (typeof keyId !== "string" || !KEK_NAME.test(keyId) || typeof keyVersion !== "string" || !KEK_NAME.test(keyVersion)) throw new Error(`KEK ${provider}: keyId and keyVersion must be 1-255 visible ASCII characters`);
+	if (typeof entry.wrap !== "function" || typeof entry.unwrap !== "function") throw new Error(`KEK ${provider}:${keyId} needs wrap() and unwrap()`);
+	return entry;
+}
+/** Check a deployment's vault configuration, failing on the first problem. */
+function resolveVaultConfig(config) {
+	const [current, ...previous] = [config.kek, ...config.previousKeks ?? []].map(kek);
+	const refs = [current, ...previous].map(({ provider, keyId }) => `${provider}:${keyId}`);
+	const twice = refs.find((ref, i) => refs.indexOf(ref) !== i);
+	if (twice !== void 0) throw new Error(`two KEKs share an id: ${twice}`);
+	return {
+		keks: new KekRegistry(current, previous),
+		rootAdmins: checkRootAdmins(config.rootAdmins),
+		signingKey: key32(config.signingKey, "the signing key"),
+		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit)
+	};
+}
+function checkBulkLimit({ count, windowMinutes }) {
+	if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) throw new Error("bulkLimit needs a whole count of at least 1 and a window above 0 minutes");
+	return {
+		count,
+		windowMs: windowMinutes * 6e4
+	};
+}
+function isHumanEmail(value) {
+	if (value.length > 254) return false;
+	const parts = value.split("@");
+	if (parts.length !== 2) return false;
+	const [local, domain] = parts;
+	if (local.length === 0 || local.length > 64 || local.startsWith(".") || local.endsWith(".") || local.includes("..") || !/^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+$/.test(local)) return false;
+	const labels = domain.split(".");
+	if (labels.length < 2) return false;
+	return labels.every((label) => label.length > 0 && label.length <= 63 && /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
+}
+/**
+* Root admins, lowercased the way they are compared. At least one, in every
+* mode: they are the only way into a fresh instance, and the only members
+* nobody can remove.
+*/
+function checkRootAdmins(emails) {
+	const rootAdmins = [...new Set(emails.map((entry) => entry.trim()).filter((entry) => entry.length > 0))];
+	if (rootAdmins.length === 0) throw new Error("rootAdmins must name at least one email, or nobody can manage coffre");
+	const invalid = rootAdmins.find((entry) => !isHumanEmail(entry));
+	if (invalid) throw new Error(`rootAdmins must be human email identities; invalid: ${invalid}`);
+	return rootAdmins.map((entry) => entry.toLowerCase());
+}
+//#endregion
+//#region src/store.ts
+/**
+* On Postgres, fail a lock wait in this transaction after `ms`, rather than
+* wait for ever behind a transaction that never ends.
+*/
+async function boundLockWaits(tx, ms) {
+	if (engineOf(tx) === "postgres") await tx.execute(sql.raw(`SET LOCAL lock_timeout = ${Math.trunc(ms)}`));
+}
+/** The database's clock, now. */
+async function now(db) {
+	const { auditChainHead } = tablesOf(db);
+	const [{ at }] = await db.select({ at: clockMillis(db) }).from(auditChainHead);
+	return at;
+}
+function memberColumns(db) {
+	const { vaultMembers } = tablesOf(db);
+	return {
+		principal: vaultMembers.principal,
+		status: vaultMembers.status,
+		owner: vaultMembers.owner,
+		generation: vaultMembers.generation,
+		createdAt: vaultMembers.createdAt,
+		createdBy: vaultMembers.createdBy,
+		statusChangedAt: vaultMembers.statusChangedAt,
+		statusChangedBy: vaultMembers.statusChangedBy,
+		accessSeq: vaultMembers.accessSeq,
+		mac: vaultMembers.mac
+	};
+}
+async function member(db, principal) {
+	const { vaultMembers } = tablesOf(db);
+	const [row] = await db.select(memberColumns(db)).from(vaultMembers).where(eq(vaultMembers.principal, principal));
+	return row;
+}
+async function allMembers(db) {
+	const { vaultMembers } = tablesOf(db);
+	return await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal));
+}
+/**
+* Lock these members' rows for the rest of the transaction, in one order
+* everywhere, and read them: those that have none are not in the map. Every
+* decision about a member takes its row first, so two of them, from any
+* process, never interleave.
+*/
+async function lockMembers(tx, principals) {
+	const { vaultMembers } = tablesOf(tx);
+	const rows = await forUpdate(tx, tx.select(memberColumns(tx)).from(vaultMembers).where(inArray(vaultMembers.principal, [...new Set(principals)])).orderBy(asc(vaultMembers.principal)), "no key update");
+	return new Map(rows.map((row) => [row.principal, row]));
+}
+/**
+* Add `row`. A principal has one row: when two decisions admit the same
+* one at once, the second fails here, and rolls back with its entries.
+*/
+async function insertMember(tx, row) {
+	const { vaultMembers } = tablesOf(tx);
+	await tx.insert(vaultMembers).values(row);
+}
+async function updateMember(tx, principal, change) {
+	const { vaultMembers } = tablesOf(tx);
+	await tx.update(vaultMembers).set(change).where(eq(vaultMembers.principal, principal));
+}
+/** Grants, lapsed ones too, each with its project, which an environment's grant finds through `environments`. */
+async function grants(db, principal) {
+	const { vaultGrants, environments } = tablesOf(db);
+	return db.select({
+		principal: vaultGrants.principal,
+		projectId: sql`coalesce(${vaultGrants.projectId}, ${environments.projectId})`,
+		environmentId: vaultGrants.environmentId,
+		role: vaultGrants.role,
+		expiresAt: vaultGrants.expiresAt,
+		grantedAt: vaultGrants.grantedAt,
+		grantedBy: vaultGrants.grantedBy
+	}).from(vaultGrants).leftJoin(environments, eq(environments.id, vaultGrants.environmentId)).where(principal === void 0 ? void 0 : eq(vaultGrants.principal, principal));
+}
+/** A grant names its environment, or its project when it has none: exactly one. */
+function at(db, place) {
+	const { vaultGrants } = tablesOf(db);
+	return place.environmentId === null ? and(eq(vaultGrants.projectId, place.projectId), isNull(vaultGrants.environmentId)) : eq(vaultGrants.environmentId, place.environmentId);
+}
+async function insertGrant(tx, grant) {
+	const { vaultGrants } = tablesOf(tx);
+	await tx.insert(vaultGrants).values({
+		...grant,
+		projectId: grant.environmentId === null ? grant.projectId : null
+	});
+}
+async function deleteGrant(tx, principal, place) {
+	const { vaultGrants } = tablesOf(tx);
+	await tx.delete(vaultGrants).where(and(eq(vaultGrants.principal, principal), at(tx, place)));
+}
+async function deleteGrants(tx, principal) {
+	const { vaultGrants } = tablesOf(tx);
+	await tx.delete(vaultGrants).where(eq(vaultGrants.principal, principal));
+}
+/**
+* Up to `limit` of the newest stored data keys wrapped under one KEK, each
+* with the secret it opens for: what proves a KEK is the one the data was
+* wrapped with, before the vault records a check value for it.
+*/
+async function wrappedUnder(db, provider, keyId, limit) {
+	const { secretVersions, secrets } = tablesOf(db);
+	return (await db.select({
+		projectId: secrets.projectId,
+		environmentId: secrets.environmentId,
+		secretId: secretVersions.secretId,
+		version: secretVersions.version,
+		kekProvider: secretVersions.kekProvider,
+		kekId: secretVersions.kekId,
+		kekVersion: secretVersions.kekVersion,
+		bytes: secretVersions.wrappedDek
+	}).from(secretVersions).innerJoin(secrets, eq(secrets.id, secretVersions.secretId)).where(and(eq(secretVersions.kekProvider, provider), eq(secretVersions.kekId, keyId))).orderBy(desc(secretVersions.createdAt)).limit(limit)).map((row) => ({
+		...row,
+		bytes: Buffer.from(row.bytes)
+	}));
+}
+/** Of these projects and environments, the ones that exist, each environment with its project. */
+async function places(db, projectIds, environmentIds) {
+	const { projects, environments } = tablesOf(db);
+	const [foundProjects, foundEnvironments] = await Promise.all([projectIds.length === 0 ? [] : db.select({ id: projects.id }).from(projects).where(inArray(projects.id, [...projectIds])), environmentIds.length === 0 ? [] : db.select({
+		id: environments.id,
+		projectId: environments.projectId
+	}).from(environments).where(inArray(environments.id, [...environmentIds]))]);
+	return {
+		projects: new Set(foundProjects.map((row) => row.id)),
+		environments: new Map(foundEnvironments.map((row) => [row.id, row.projectId]))
+	};
+}
+/** The action of an entry that releases a key, which the bulk limit counts. */
+const RELEASE = "secret.read";
+/** How many keys the vault has released to `principal` since `after`. */
+async function releasesSince(db, principal, after) {
+	const { auditLog } = tablesOf(db);
+	const [{ n }] = await db.select({ n: count() }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.actor, principal), eq(auditLog.action, RELEASE), eq(auditLog.decision, "allow"), gt(auditLog.occurredAt, after)));
+	return Number(n);
+}
+function entryColumns(db) {
+	const { auditLog } = tablesOf(db);
+	return {
+		seq: auditLog.seq,
+		author: auditLog.author,
+		keyId: auditLog.keyId,
+		occurredAt: auditLog.occurredAt,
+		actor: auditLog.actor,
+		action: auditLog.action,
+		decision: auditLog.decision,
+		code: auditLog.code,
+		subjectPrincipal: auditLog.subjectPrincipal,
+		projectId: auditLog.projectId,
+		environmentId: auditLog.environmentId,
+		secretId: auditLog.secretId,
+		secretVersionId: auditLog.secretVersionId,
+		operationId: auditLog.operationId,
+		requestId: auditLog.requestId,
+		sourceIp: auditLog.sourceIp,
+		relatedSeq: auditLog.relatedSeq,
+		metadata: auditLog.metadata,
+		prevHash: auditLog.prevHash,
+		mac: auditLog.mac,
+		hash: auditLog.hash
+	};
+}
+/** Rows of the log as the chain's codec reads them: `author` and `decision` are checked by the table. */
+function stored(rows) {
+	return rows;
+}
+/** Up to `limit` entries of either author from `fromSeq`, oldest first: the chain as it runs. */
+async function entriesFrom(db, fromSeq, limit) {
+	const { auditLog } = tablesOf(db);
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(gte(auditLog.seq, fromSeq)).orderBy(asc(auditLog.seq)).limit(limit));
+}
+/** The entry at `seq`'s hash, or undefined when there is none. */
+async function hashAt(db, seq) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select({ hash: auditLog.hash }).from(auditLog).where(eq(auditLog.seq, seq));
+	return row?.hash;
+}
+/** The vault's newest entry of any of these actions, allowed, or undefined. */
+async function latestVaultEntry(db, actions) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...actions]), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(1);
+	return row === void 0 ? void 0 : stored([row])[0];
+}
+/** Up to `limit` of the vault's allowed access entries about `principal`, newest first. */
+async function accessEntriesAbout(db, principal, limit) {
+	const { auditLog } = tablesOf(db);
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.subjectPrincipal, principal), inArray(auditLog.action, [...ACCESS_ACTIONS]), eq(auditLog.decision, "allow"))).orderBy(desc(auditLog.seq)).limit(limit));
+}
+/** The vault's newest allowed access entry about each member who has one. */
+async function newestAccessEntries(db) {
+	const { auditLog } = tablesOf(db);
+	const newest = db.select({ seq: sql`max(${auditLog.seq})` }).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...ACCESS_ACTIONS]), eq(auditLog.decision, "allow"))).groupBy(auditLog.subjectPrincipal);
+	const rows = stored(await db.select(entryColumns(db)).from(auditLog).where(inArray(auditLog.seq, newest)));
+	return new Map(rows.flatMap((row) => row.subjectPrincipal === null ? [] : [[row.subjectPrincipal, row]]));
+}
+/** Up to `limit` of the vault's allowed entries of these actions after `afterSeq`, oldest first. */
+async function vaultEntriesOf(db, actions, afterSeq, limit) {
+	const { auditLog } = tablesOf(db);
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...actions]), eq(auditLog.decision, "allow"), gt(auditLog.seq, afterSeq))).orderBy(asc(auditLog.seq)).limit(limit));
+}
+async function versions(db, ids) {
+	if (ids.length === 0) return [];
+	const { secretVersions, secrets, environments, projects } = tablesOf(db);
+	return (await db.select({
+		id: secretVersions.id,
+		version: secretVersions.version,
+		secretId: secrets.id,
+		projectId: secrets.projectId,
+		environmentId: secrets.environmentId,
+		project: projects.slug,
+		environment: environments.slug,
+		key: secrets.key,
+		kekProvider: secretVersions.kekProvider,
+		kekId: secretVersions.kekId,
+		kekVersion: secretVersions.kekVersion,
+		wrappedDek: secretVersions.wrappedDek
+	}).from(secretVersions).innerJoin(secrets, eq(secrets.id, secretVersions.secretId)).innerJoin(environments, eq(environments.id, secrets.environmentId)).innerJoin(projects, eq(projects.id, secrets.projectId)).where(inArray(secretVersions.id, [...new Set(ids)]))).map((row) => ({
+		id: row.id,
+		secret: {
+			projectId: row.projectId,
+			environmentId: row.environmentId,
+			secretId: row.secretId,
+			version: row.version,
+			path: `${row.project}/${row.environment}/${row.key}`
+		},
+		wrapped: {
+			kekProvider: row.kekProvider,
+			kekId: row.kekId,
+			kekVersion: row.kekVersion,
+			bytes: row.wrappedDek.toString("base64")
+		}
+	}));
+}
+//#endregion
+//#region src/log.ts
+/**
+* The vault's half of the one audit log: its entries are the ones it
+* writes, `author = 'vault'`, each under its MAC, in the chain the app's
+* entries share (@coffre/core/audit says what an entry covers). The app
+* checks its own entries by its key; this checks the vault's by the vault's,
+* and the app's only for their place in the chain.
+*/
+/**
+* The vault's log key, derived from its signing key, so that it is one more
+* secret to hold, not one more to keep. Whoever can write the database but
+* does not hold the vault's configuration cannot write an entry it accepts.
+*/
+function vaultLogKey(signingKey) {
+	return deriveLogKey("vault", signingKey);
+}
+/** Before the first entry: nothing verified yet. */
+const UNVERIFIED = {
+	nextSeq: 0n,
+	hash: GENESIS_HASH,
+	vaultEntries: 0
+};
+/** The further of two anchors, when two calls verified at once. */
+function further(a, b) {
+	return b.nextSeq > a.nextSeq ? b : a;
+}
+const VERIFY_BATCH = 1e3;
+/**
+* Check the chain, a batch in memory at a time, and return where it is now
+* verified to. Three parts:
+*
+* - `shown`, the page a reader is looking at: each entry against its own
+*   hash and MAC;
+* - `anchor`, the head at the last check: still there, unchanged. A rewrite
+*   of anything before it, chained again to hide, changes its hash;
+* - every entry after the anchor, or from the first.
+*
+* So a view rehashes only what is new since the last one. What it leaves
+* out is an entry before the anchor edited in place, not chained again, and
+* not on the page: a full check, which starts from `UNVERIFIED`, finds that,
+* as does the first view after a start, which has no anchor.
+*/
+async function verifyChain(db, key, shown, anchor) {
+	const broken = (failedAtSeq, reason) => ({
+		verification: {
+			ok: false,
+			failedAtSeq: Number(failedAtSeq),
+			reason
+		},
+		anchor
+	});
+	const keys = {
+		keys: [key],
+		chainOnly: ["app"]
+	};
+	for (const row of [...shown].sort((a, b) => a.seq < b.seq ? -1 : 1)) {
+		const result = verifyEntries([row], {
+			...keys,
+			startSeq: row.seq,
+			startPrevHash: row.prevHash
+		});
+		if (!result.ok) return broken(result.failedAtSeq, result.reason);
+	}
+	if (anchor.nextSeq > 0n && !(await hashAt(db, anchor.nextSeq - 1n))?.equals(anchor.hash)) return broken(anchor.nextSeq - 1n, "changed since the vault last verified it");
+	let verified = anchor;
+	for (;;) {
+		const batch = await entriesFrom(db, verified.nextSeq, VERIFY_BATCH);
+		if (batch.length === 0) break;
+		const result = verifyEntries(batch, {
+			...keys,
+			startSeq: verified.nextSeq,
+			startPrevHash: verified.hash
+		});
+		if (!result.ok) return broken(result.failedAtSeq, result.reason);
+		verified = {
+			nextSeq: result.nextSeq,
+			hash: result.head,
+			vaultEntries: verified.vaultEntries + result.authenticated
+		};
+		if (batch.length < 1e3) break;
+	}
+	return {
+		verification: {
+			ok: true,
+			entries: verified.vaultEntries
+		},
+		anchor: verified
+	};
+}
+/**
+* Whether the log still holds `head` where it was: not rewritten, nor cut
+* back before it. A head of 64 zeros is before the first entry, which any
+* log holds.
+*/
+async function carries(db, head) {
+	if (head.hash === GENESIS_HASH.toString("hex")) return true;
+	return (await hashAt(db, BigInt(head.seq)))?.toString("hex") === head.hash;
+}
+//#endregion
+//#region src/accounting.ts
+const KEY_ACTIONS = /* @__PURE__ */ new Set([
+	"secret.read",
+	"key.wrap",
+	"key.rewrap"
+]);
+/** The chain can hold while a process died between an intent and its outcomes. */
+async function verifyAccounting(db, at) {
+	const intents = /* @__PURE__ */ new Map();
+	const ids = /* @__PURE__ */ new Set();
+	const broken = (entry, reason) => ({
+		ok: false,
+		failedAtSeq: Number(entry.seq),
+		reason
+	});
+	let next = 0n;
+	for (;;) {
+		const batch = await entriesFrom(db, next, VERIFY_BATCH);
+		if (batch.length === 0) break;
+		for (const entry of batch) {
+			if (entry.author !== "vault") continue;
+			if (entry.action === "key.intent") {
+				const parsed = parseIntent(entry);
+				if (typeof parsed === "string") return broken(entry, parsed);
+				if (ids.has(parsed.intentId)) return broken(entry, "key intent repeats an operation identity");
+				ids.add(parsed.intentId);
+				if (parsed.keys.length > 0) intents.set(entry.seq, {
+					...parsed,
+					entry,
+					seen: /* @__PURE__ */ new Set()
+				});
+			} else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
+				const parsed = parseOutcome(entry);
+				if (typeof parsed === "string") return broken(entry, parsed);
+				const intent = intents.get(parsed.relatedSeq);
+				const key = intent?.keys[parsed.item];
+				if (intent === void 0 || key === void 0 || intent.seen.has(parsed.item)) return broken(entry, "key outcome does not identify one item of its intent");
+				if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) return broken(entry, "key outcome belongs to another operation");
+				if (parsed.secretId !== key.secretId || parsed.version !== key.version || parsed.subject !== key.subject) return broken(entry, "key outcome does not match its intended secret");
+				intent.seen.add(parsed.item);
+				if (intent.seen.size === intent.keys.length) intents.delete(intent.entry.seq);
+			}
+		}
+		next = batch[batch.length - 1].seq + 1n;
+		if (batch.length < 1e3) break;
+	}
+	const overdue = [...intents.values()].filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
+	if (overdue.length === 0) return {
+		ok: true,
+		pending: intents.size
+	};
+	const reason = overdue.map((intent) => {
+		const missing = intent.keys.length - intent.seen.size;
+		return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
+	}).join("; ");
+	return broken(overdue[0].entry, reason);
+}
+function parseIntent(entry) {
+	const detail = payload(entry.metadata);
+	if (detail === null) return "key intent has no valid accounting payload";
+	const { intent, operation, expiresAt } = detail;
+	if (typeof intent !== "string") return "key intent has no operation identity";
+	if (typeof operation !== "string" || !KEY_ACTIONS.has(operation)) return "key intent has an invalid operation";
+	if (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt < entry.occurredAt) return "key intent has no valid deadline";
+	if (!Array.isArray(detail.keys)) return "key intent has no valid item list";
+	const keys = [];
+	for (const [index, value] of detail.keys.entries()) {
+		const key = record(value);
+		if (key === null || key.item !== index) return "key intent items are not numbered in order";
+		const { secretId, version, subject } = key;
+		if (typeof secretId !== "string" || typeof subject !== "string") return "key intent item has no secret identity";
+		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key intent item has no valid version";
+		keys.push({
+			item: index,
+			secretId,
+			version,
+			subject
+		});
+	}
+	return {
+		intentId: intent,
+		operation,
+		expiresAt,
+		keys
+	};
+}
+function parseOutcome(entry) {
+	const detail = payload(entry.metadata);
+	if (detail === null) return "key outcome has no valid accounting payload";
+	const { intent, item, version, subject } = detail;
+	if (typeof intent !== "string" || entry.relatedSeq === null) return "key outcome has no intent identity";
+	if (typeof item !== "number" || !Number.isSafeInteger(item) || item < 0) return "key outcome has no valid item number";
+	const secretId = entry.secretId ?? detail.secretId;
+	if (typeof secretId !== "string" || typeof subject !== "string") return "key outcome has no secret identity";
+	if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key outcome has no valid version";
+	return {
+		intentId: intent,
+		relatedSeq: entry.relatedSeq,
+		item,
+		secretId,
+		version,
+		subject
+	};
+}
+function payload(text) {
+	try {
+		return record(JSON.parse(text));
+	} catch {
+		return null;
+	}
+}
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+//#endregion
+//#region src/checkpoint.ts
+const PKCS8_ED25519 = [
+	48,
+	46,
+	2,
+	1,
+	0,
+	48,
+	5,
+	6,
+	3,
+	43,
+	101,
+	112,
+	4,
+	34,
+	4,
+	32
+];
+/** An Ed25519 signer from a 32-byte seed, over WebCrypto so it runs in Node and in workerd alike. */
+async function signer(seed) {
+	const pkcs8 = new Uint8Array([...PKCS8_ED25519, ...seed]);
+	const privateKey = await crypto.subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
+	const { x } = await crypto.subtle.exportKey("jwk", privateKey);
+	const publicKey = Buffer.from(x, "base64url");
+	const digest = Buffer.from(await crypto.subtle.digest("SHA-256", publicKey));
+	return {
+		publicKey: publicKey.toString("base64"),
+		keyId: digest.toString("hex").slice(0, 16),
+		sign: async (message) => Buffer.from(await crypto.subtle.sign("Ed25519", privateKey, message)).toString("base64")
+	};
+}
+//#endregion
+//#region src/replay.ts
+const BATCH = 1e3;
+/**
+* Why the members and grants in the database do not follow from the
+* vault's entries, or null when they do; `describeAccessFault` words it.
+* Every change to either is logged in the transaction that makes it, with
+* the row's times taken from its entry, so replaying the allowed ones from
+* the first gives the tables back, and a row the log does not explain was
+* written around the vault: a grant inserted with the database's own login,
+* a removal undone.
+*
+* Call it after the chain is verified, in the same snapshot, so every entry
+* it replays carries the vault's MAC.
+*
+* Grants are compared as they are live at `at`. Clearing one that has
+* lapsed changes nothing anyone holds, so it is not logged.
+*/
+async function replay(db, at) {
+	const state = {
+		members: /* @__PURE__ */ new Map(),
+		held: /* @__PURE__ */ new Map()
+	};
+	for (let after = -1n;;) {
+		const batch = await vaultEntriesOf(db, ACCESS_ACTIONS, after, BATCH);
+		for (const row of batch) {
+			const fault = apply(state, row);
+			if (fault !== null) return fault;
+		}
+		if (batch.length < BATCH) break;
+		after = batch[batch.length - 1].seq;
+	}
+	const { members, held } = state;
+	const stored = new Map((await allMembers(db)).map((member) => [member.principal, member]));
+	for (const principal of [.../* @__PURE__ */ new Set([...stored.keys(), ...members.keys()])].sort()) {
+		const [inStore, inLog] = [stored.get(principal), members.get(principal)];
+		if (inLog === void 0) return {
+			kind: "unlogged-member",
+			principal
+		};
+		if (inStore === void 0) return {
+			kind: "missing-member",
+			principal
+		};
+		const fields = MEMBER_FIELDS.filter(([field]) => inStore[field] !== inLog[field]).map(([, column]) => column);
+		if (fields.length > 0) return {
+			kind: "member-differs",
+			principal,
+			fields
+		};
+	}
+	const live = (grant) => grant.expiresAt === null || grant.expiresAt > at;
+	const logged = new Set([...held.values()].flatMap((grantsOf) => [...grantsOf.values()]).filter(live).map(grantKey));
+	const inStore = new Set((await grants(db)).filter(live).map(grantKey));
+	const extra = [...inStore].sort().find((grant) => !logged.has(grant));
+	if (extra !== void 0) return {
+		kind: "unlogged-grant",
+		grant: faultGrant(extra)
+	};
+	const missing = [...logged].sort().find((grant) => !inStore.has(grant));
+	if (missing !== void 0) return {
+		kind: "missing-grant",
+		grant: faultGrant(missing)
+	};
+	return null;
+}
+/** One access entry, authenticated, applied to `state`; a fault when it changes someone never admitted. */
+function apply(state, row) {
+	const principal = row.subjectPrincipal;
+	const detail = JSON.parse(row.metadata);
+	const place = {
+		projectId: row.projectId,
+		environmentId: row.environmentId
+	};
+	const grantsOf = state.held.get(principal) ?? /* @__PURE__ */ new Map();
+	state.held.set(principal, grantsOf);
+	const before = state.members.get(principal);
+	const changed = {
+		statusChangedAt: row.occurredAt,
+		statusChangedBy: row.actor
+	};
+	switch (row.action) {
+		case "member.add":
+		case "member.restore":
+			state.members.set(principal, {
+				principal,
+				status: "active",
+				owner: detail.owner === true,
+				generation: before?.generation ?? 0,
+				createdAt: before?.createdAt ?? row.occurredAt,
+				createdBy: before?.createdBy ?? row.actor,
+				accessSeq: row.seq,
+				...changed
+			});
+			return null;
+		case "member.owner":
+			if (before === void 0) return {
+				kind: "unadmitted-change",
+				seq: Number(row.seq),
+				principal
+			};
+			state.members.set(principal, {
+				...before,
+				owner: detail.owner === true,
+				accessSeq: row.seq
+			});
+			return null;
+		case "member.remove": {
+			if (before === void 0) return {
+				kind: "unadmitted-change",
+				seq: Number(row.seq),
+				principal
+			};
+			const generation = typeof detail.generation === "number" ? detail.generation : before.generation + 1;
+			state.members.set(principal, {
+				...before,
+				status: "removed",
+				owner: false,
+				generation,
+				accessSeq: row.seq,
+				...changed
+			});
+			grantsOf.clear();
+			return null;
+		}
+		case "access.grant":
+			grantsOf.set(placeKey(place), {
+				principal,
+				...place,
+				role: detail.role,
+				expiresAt: detail.expiresAt === null ? null : Date.parse(detail.expiresAt),
+				grantedAt: row.occurredAt,
+				grantedBy: row.actor
+			});
+			if (before !== void 0) state.members.set(principal, {
+				...before,
+				accessSeq: row.seq
+			});
+			return null;
+		case "access.revoke":
+			grantsOf.delete(placeKey(place));
+			if (before !== void 0) state.members.set(principal, {
+				...before,
+				accessSeq: row.seq
+			});
+			return null;
+	}
+	return null;
+}
+/** A member's fields, and the columns a fault names them by. */
+const MEMBER_FIELDS = [
+	["status", "status"],
+	["owner", "owner"],
+	["generation", "generation"],
+	["createdAt", "created_at"],
+	["createdBy", "created_by"],
+	["statusChangedAt", "status_changed_at"],
+	["statusChangedBy", "status_changed_by"],
+	["accessSeq", "access_seq"]
+];
+/** A grant's place: its environment, or its project when it has none. */
+function placeKey(place) {
+	return place.environmentId ?? place.projectId;
+}
+function grantKey(grant) {
+	return JSON.stringify([
+		grant.principal,
+		grant.projectId,
+		grant.environmentId,
+		grant.role,
+		grant.expiresAt,
+		grant.grantedAt,
+		grant.grantedBy
+	]);
+}
+function faultGrant(key) {
+	const [principal, projectId, environmentId, role] = JSON.parse(key);
+	return {
+		principal,
+		projectId,
+		environmentId,
+		role
+	};
+}
+//#endregion
+//#region src/rows.ts
+/**
+* The MAC over each member's row and grants: what makes a row written
+* around the vault, by anyone who can write the database but does not hold
+* its signing key, one the vault refuses rather than trusts.
+*
+* One MAC per member, over the row and the member's grants as a sorted set,
+* lapsed ones included, rather than one per row: a grant deleted fails it as
+* surely as one added or edited. `access_seq` is in it too, so a genuine row
+* put back from before a later change still names the older entry, which the
+* log has moved past (vault.ts, `#integrity`).
+*
+* A change to what is covered is a new version of the tuple, never an edit.
+*/
+/** The key member rows are sealed under, derived from the signing key: one more secret to hold, not one more to keep. */
+function rowKey(signingKey) {
+	return Buffer.from(hkdfSync("sha256", signingKey, /* @__PURE__ */ new Uint8Array(0), "coffre.vault.rows.v1", 32));
+}
+/** A member's grants as the MAC covers them: each one's place, role, end and grant, as a sorted set. */
+function grantSet(grants) {
+	return grants.map((grant) => [
+		grant.environmentId === null ? "project" : "environment",
+		grant.environmentId ?? grant.projectId,
+		grant.role,
+		grant.expiresAt,
+		grant.grantedAt,
+		grant.grantedBy
+	]).map((tuple) => JSON.stringify(tuple)).sort();
+}
+/** Whether two reads of a member's grants are the same set, as the MAC sees them. */
+function sameGrants(a, b) {
+	const [x, y] = [grantSet(a), grantSet(b)];
+	return x.length === y.length && x.every((tuple, i) => tuple === y[i]);
+}
+function memberMac(key, member, grants) {
+	const held = grantSet(grants);
+	const tuple = [
+		"coffre.vault.member.v1",
+		member.principal,
+		member.status,
+		member.owner,
+		member.generation,
+		member.accessSeq.toString(),
+		member.createdAt,
+		member.createdBy,
+		member.statusChangedAt,
+		member.statusChangedBy,
+		held
+	];
+	return createHmac("sha256", key).update(JSON.stringify(tuple)).digest();
+}
+/** Whether `member`'s MAC is the vault's, over this row and these grants. */
+function sealed(key, member, grants) {
+	const expected = memberMac(key, member, grants);
+	return member.mac.length === expected.length && timingSafeEqual(member.mac, expected);
+}
+//#endregion
+//#region src/vault.ts
+async function prepareVault(config, options = {}) {
+	return {
+		config,
+		signer: await signer(config.signingKey),
+		logKey: vaultLogKey(config.signingKey),
+		options: {
+			keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS,
+			clockOffset: options.clockOffset ?? (() => 0)
+		},
+		verified: UNVERIFIED,
+		rooted: /* @__PURE__ */ new Set(),
+		rowKey: rowKey(config.signingKey),
+		reported: /* @__PURE__ */ new Set(),
+		kekCheck: null,
+		wrongKek: null
+	};
+}
+/** The vault over `db`. Cheap: on Workers, one per call, over that call's connections. */
+function openVault(db, prepared) {
+	return new VaultService(db, prepared);
+}
+/** Every key operation of one call, together: a removal waits at most this long for a read at KMS. */
+const KEY_BUDGET_MS = 5e3;
+/** How long a decision waits for a lock: above the key budget, so a removal outwaits a read in flight. */
+const LOCK_TIMEOUT_MS = 15e3;
+const PRINCIPAL = /^(user|token|sync):[^\s:][^\s]*$/;
+/** Who acts for the vault itself, as when it gives a root admin a member row. */
+const VAULT_ACTOR = "system:vault";
+/**
+* A KEK's check: a known value, the size of a data key, wrapped under it in
+* a context no secret has (the nil UUID), and kept in a `key.check` entry.
+* Opening it again tells the vault its KEK is the one that wrapped the
+* data, without opening any data.
+*/
+const KEY_CHECK = "key.check";
+const KEY_CHECK_VALUE = createHash("sha256").update("coffre.kek.check.v1").digest();
+const NIL = "00000000-0000-0000-0000-000000000000";
+const KEY_CHECK_CONTEXT = {
+	projectId: NIL,
+	environmentId: NIL,
+	secretId: NIL
+};
+/** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
+const KEY_CHECK_SAMPLE = 3;
+/** A new member row, before the decision seals it (`#seal`). */
+const UNSEALED = {
+	accessSeq: 0n,
+	mac: Buffer.alloc(32)
+};
+/** Why a change to a tampered member is refused. */
+const TAMPERED_SUBJECT = "this member's record failed the vault's integrity check: remove them to start over";
+/** The action of the vault's entry that signs a prefix of the log. */
+const CHECKPOINT = "audit.checkpoint";
+/** Who asks for checkpoints: the app's scheduled job. */
+const SCHEDULER = "system:coffre-scheduler";
+/** A refusal and the entries that record it. */
+var Refused = class {
+	refusal;
+	entries;
+	constructor(refusal, entries) {
+		this.refusal = refusal;
+		this.entries = entries;
+	}
+};
+/** A decision that read a member as absent who has been admitted since: it is made again. */
+var Retry = class {};
+/** What each `vault.tampered` entry reports, to mark it logged once committed. */
+const REPORTED = /* @__PURE__ */ new WeakMap();
+/** A key service that did not answer, and the entries that record what it did do. */
+var Outage = class {
+	error;
+	entries;
+	constructor(error, entries) {
+		this.error = error;
+		this.entries = entries;
+	}
+};
+function refusal(code, message) {
+	return {
+		code,
+		message
+	};
+}
+const MESSAGES = {
+	removed: "this member was removed",
+	not_a_member: "not a member",
+	no_grant: "no grant covers this",
+	expired: "the grant that covered this has expired",
+	bulk_limit: "too many secrets read in too short a time",
+	bad_claim: "the key does not belong to this secret",
+	not_allowed: "not allowed to change this",
+	root_admin: "root admins are set in the vault configuration",
+	invalid: "not something the rules allow",
+	log_broken: "the vault log does not hold from the last checkpoint",
+	wrong_kek: "this vault's KEK does not open the data it holds",
+	tampered: "this member's record failed the vault's integrity check"
+};
+/**
+* The one implementation of `Vault`. Every decision is one transaction on
+* the shared database: it locks the rows of the members it is about, reads
+* what it needs, decides, appends its entries under the log's lock, and
+* only then changes members and grants. Locks come in one order
+* everywhere, a member row, then the log's head, then the app's rows, so
+* any number of vault instances and app servers decide side by side
+* without a cycle (docs/design/single-database.md, question 2).
+*
+* Key operations run inside the decision, after the check, for a call the
+* rules allow: a KMS logs each one, and should never show a key opened for
+* a read coffre refused. With a key service, the call's intent is logged
+* first, in its own transaction, so a vault that dies at KMS leaves a
+* record that pairs with what KMS logged; and every key's outcome is
+* logged, a partial outage included.
+*/
+var VaultService = class {
+	#db;
+	#prepared;
+	#config;
+	constructor(db, prepared) {
+		this.#db = db;
+		this.#prepared = prepared;
+		this.#config = prepared.config;
+	}
+	async #now(db) {
+		return await now(db) + this.#prepared.options.clockOffset();
+	}
+	/**
+	* Decide in one transaction, with `principals`' rows locked first. A
+	* `Refused` or an `Outage` rolls back all but its own entries, which
+	* commit on their own: then the refusal is the answer, and the outage
+	* fails the call.
+	*/
+	async #decide(principals, decide) {
+		const reports = [];
+		for (let attempt = 1;; attempt += 1) try {
+			return await this.#decideOnce(principals, decide, reports);
+		} catch (error) {
+			if (attempt < 3 && (error instanceof Retry || isUniqueViolation(error))) continue;
+			throw error;
+		}
+	}
+	async #decideOnce(principals, decide, reports) {
+		try {
+			const result = await this.#db.transaction(async (tx) => {
+				await boundLockWaits(tx, LOCK_TIMEOUT_MS);
+				const d = {
+					tx,
+					members: principals.length === 0 ? /* @__PURE__ */ new Map() : await lockMembers(tx, principals),
+					at: await this.#now(tx),
+					log: [],
+					writes: [],
+					touched: /* @__PURE__ */ new Set(),
+					grants: /* @__PURE__ */ new Map(),
+					reports,
+					after: []
+				};
+				const result = await decide(d);
+				const entries = [...reports, ...d.log];
+				let at = d.at;
+				const accessSeq = /* @__PURE__ */ new Map();
+				if (entries.length > 0) {
+					const appended = await appendEntries(tx, this.#prepared.logKey, entries);
+					at = appended.occurredAt;
+					entries.forEach((entry, i) => {
+						if (isAccessEntry(entry)) accessSeq.set(entry.subjectPrincipal, appended.seqStart + BigInt(i));
+					});
+					const seqs = new Map(entries.map((entry, i) => [entry, Number(appended.seqStart) + i]));
+					for (const then of d.after) then((entry) => seqs.get(entry));
+				}
+				for (const write of d.writes) await write(at);
+				for (const principal of /* @__PURE__ */ new Set([...d.touched, ...accessSeq.keys()])) await this.#seal(d, principal, accessSeq.get(principal));
+				return result;
+			});
+			this.#reported(reports);
+			return {
+				ok: true,
+				...result
+			};
+		} catch (error) {
+			if (!(error instanceof Refused || error instanceof Outage)) throw error;
+			const entries = [...reports, ...error.entries];
+			if (entries.length > 0) await this.#db.transaction(async (tx) => {
+				await boundLockWaits(tx, LOCK_TIMEOUT_MS);
+				await appendEntries(tx, this.#prepared.logKey, entries);
+			});
+			this.#reported(reports);
+			if (error instanceof Outage) throw error.error;
+			return {
+				ok: false,
+				refusal: error.refusal
+			};
+		}
+	}
+	/**
+	* Seal `principal`'s row again over what this decision left them holding,
+	* naming `accessSeq`, their newest access entry, when it wrote one. The
+	* table must hold exactly that: a grant written around the vault while it
+	* decided (its row lock does not stop one) is refused, with the decision,
+	* rather than sealed in.
+	*/
+	async #seal(d, principal, accessSeq) {
+		const row = await member(d.tx, principal);
+		if (row === void 0) return;
+		const decided = d.grants.get(principal);
+		if (decided === void 0) throw new Error(`sealing ${principal} without the grants this decision verified`);
+		if (!sameGrants(await grants(d.tx, principal), decided)) {
+			this.#report(d.reports, principal, "mac", row.mac.toString("hex"));
+			throw new Refused(refusal("tampered", MESSAGES.tampered), []);
+		}
+		const next = {
+			...row,
+			accessSeq: accessSeq ?? row.accessSeq
+		};
+		await updateMember(d.tx, principal, {
+			accessSeq: next.accessSeq,
+			mac: memberMac(this.#prepared.rowKey, next, decided)
+		});
+	}
+	/**
+	* Whether `row`, with these grants, is the row the vault last wrote: its
+	* MAC holds, and it names the newest access entry the log has about the
+	* member. A genuine row put back from before a later change passes the
+	* first and fails the second. Entries in the vault's name that fail their
+	* MAC are passed over, and reported: otherwise whoever can insert a row
+	* could lock any member out.
+	*/
+	async #integrity(db, principal, row, grants, reports) {
+		if (row !== void 0 && !sealed(this.#prepared.rowKey, row, grants)) {
+			this.#report(reports, principal, "mac", row.mac.toString("hex"));
+			return "mac";
+		}
+		const newest = await this.#newestAccessSeq(db, principal, reports);
+		if (row === void 0 ? newest === null : newest === row.accessSeq) return null;
+		if (row === void 0 && await member(db, principal) !== void 0) throw new Retry();
+		this.#report(reports, principal, "stale", `${row?.accessSeq ?? "none"}<${newest}`);
+		return "stale";
+	}
+	/** The seq of the newest access entry about `principal` that carries the vault's MAC, or null. */
+	async #newestAccessSeq(db, principal, reports) {
+		for (const entry of await accessEntriesAbout(db, principal, 32)) {
+			if (this.#authentic(entry)) return entry.seq;
+			this.#report(reports, principal, "forged_entry", String(entry.seq), entry.seq);
+		}
+		return null;
+	}
+	#authentic(entry) {
+		return verifyEntries([entry], {
+			startSeq: entry.seq,
+			startPrevHash: entry.prevHash,
+			keys: [this.#prepared.logKey]
+		}).ok;
+	}
+	/** A `vault.tampered` entry, once per process for each thing found: `#reported` marks it once committed. */
+	#report(reports, principal, code, detail, relatedSeq = null) {
+		const key = `${principal}|${code}|${detail}`;
+		if (this.#prepared.reported.has(key) || reports.some((entry) => REPORTED.get(entry) === key)) return;
+		const entry = {
+			actor: VAULT_ACTOR,
+			action: "vault.tampered",
+			decision: "deny",
+			code,
+			subjectPrincipal: principal,
+			relatedSeq,
+			metadata: "{}"
+		};
+		REPORTED.set(entry, key);
+		reports.push(entry);
+	}
+	/** Mark these reports as logged, once their transaction has committed. */
+	#reported(reports) {
+		for (const entry of reports) {
+			const key = REPORTED.get(entry);
+			if (key !== void 0) this.#prepared.reported.add(key);
+		}
+	}
+	/** Reports found outside a decision, committed on their own. */
+	async #record(reports) {
+		if (reports.length === 0) return;
+		await this.#db.transaction((tx) => appendEntries(tx, this.#prepared.logKey, reports));
+		this.#reported(reports);
+	}
+	async unwrap(input) {
+		const { principal } = input;
+		validateText(input.purpose);
+		const loaded = await this.#versions(input, "secret.read", { purpose: input.purpose });
+		if (!loaded.ok) return loaded;
+		const items = loaded.versions;
+		validateItems(items, "wrapped");
+		const versionIds = new Map(items.map((item) => [item.secret, item.id]));
+		const entry = (secret, decision, code) => ({
+			...keyEntry("secret.read", principal, secret, decision, code, input, { purpose: input.purpose }),
+			secretVersionId: versionIds.get(secret)
+		});
+		const remote = items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
+		return this.#keys({
+			action: "secret.read",
+			principal,
+			permission: "secret.read",
+			secrets: items.map((item) => item.secret),
+			remote,
+			entry,
+			input
+		}, () => items.map(({ secret, wrapped }) => async (operation) => {
+			const key = await this.#open(wrapped, secret, operation);
+			return key && {
+				key,
+				wipe: () => key.fill(0)
+			};
+		}), (opened) => ({ keys: opened.map(({ key }) => {
+			try {
+				return base64(key);
+			} finally {
+				key.fill(0);
+			}
+		}) }));
+	}
+	async wrap(input) {
+		const { principal, items } = input;
+		validateItems(items, "key");
+		validateText(principal);
+		validateCorrelation(input);
+		const entry = (secret, decision, code) => keyEntry("key.wrap", principal, secret, decision, code, input);
+		return this.#keys({
+			action: "key.wrap",
+			principal,
+			permission: "secret.write",
+			secrets: items.map((item) => item.secret),
+			remote: this.#remote(this.#config.keks.primary),
+			entry,
+			input
+		}, () => items.map(({ secret, key }) => async (operation) => {
+			const dek = Buffer.from(key, "base64");
+			try {
+				return {
+					wrapped: serialisable(await this.#config.keks.wrap(dek, context(secret), operation)),
+					wipe: () => {}
+				};
+			} finally {
+				dek.fill(0);
+			}
+		}), (done) => ({
+			wrapped: done.map(({ wrapped }) => wrapped),
+			seqs: []
+		}));
+	}
+	async rewrap(input) {
+		const { principal } = input;
+		const loaded = await this.#versions(input, "key.rewrap");
+		if (!loaded.ok) return loaded;
+		const items = input.items.map((item, i) => ({
+			secret: { ...item.secret },
+			wrapped: loaded.versions[i].wrapped
+		}));
+		validateItems(items, "wrapped");
+		const sameSecret = (secret, source) => secret.projectId === source.projectId && secret.environmentId === source.environmentId && secret.secretId === source.secretId;
+		if (items.some((item, i) => !sameSecret(item.secret, loaded.versions[i].secret))) return this.#badVersions(principal, loaded.versions.map((source) => ({
+			...keyEntry("key.rewrap", principal, source.secret, "deny", "bad_claim", input),
+			secretVersionId: source.id
+		})));
+		const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
+		const entry = (secret, decision, code) => ({
+			...keyEntry("key.rewrap", principal, secret, decision, code, input, { from: sources.get(secret).secret.version }),
+			secretVersionId: sources.get(secret).id
+		});
+		const remote = this.#remote(this.#config.keks.primary) || items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
+		return this.#keys({
+			action: "key.rewrap",
+			principal,
+			permission: "secret.write",
+			secrets: items.map((item) => item.secret),
+			remote,
+			entry,
+			input
+		}, () => items.map(({ secret, wrapped }) => async (operation) => {
+			const key = await this.#open(wrapped, secret, operation);
+			if (key === null) return null;
+			try {
+				return {
+					wrapped: serialisable(await this.#config.keks.wrap(key, context(secret), operation)),
+					wipe: () => {}
+				};
+			} finally {
+				key.fill(0);
+			}
+		}), (done) => ({
+			wrapped: done.map(({ wrapped }) => wrapped),
+			seqs: []
+		}));
+	}
+	/** Immutable versions need no lock; their ids determine the whole batch before any key call. */
+	async #versions(input, action, detail = {}) {
+		validateText(input.principal);
+		validateCorrelation(input);
+		const ids = input.items.map((item) => item.secretVersionId);
+		for (const id of ids) if (typeof id !== "string" || !/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id)) throw new Error("secret version id must be a lowercase UUID");
+		const found = new Map((await versions(this.#db, ids)).map((version) => [version.id, version]));
+		if (ids.some((id) => !found.has(id))) return this.#badVersions(input.principal, ids.map((id) => {
+			const version = found.get(id);
+			if (version === void 0) return {
+				actor: input.principal,
+				action,
+				decision: "deny",
+				code: "bad_claim",
+				operationId: input.operationId,
+				requestId: input.requestId,
+				metadata: JSON.stringify({
+					...detail,
+					secretVersionId: id
+				})
+			};
+			return {
+				...keyEntry(action, input.principal, version.secret, "deny", "bad_claim", input, detail),
+				secretVersionId: id
+			};
+		}));
+		return {
+			ok: true,
+			versions: ids.map((id) => found.get(id))
+		};
+	}
+	async #badVersions(principal, entries) {
+		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
+		return this.#decide([principal], async () => {
+			throw new Refused(refusal("bad_claim", MESSAGES.bad_claim), entries);
+		});
+	}
+	/**
+	* The data key, or null when it does not open as this secret's: a claim
+	* that is not what it says. A key service that cannot answer is an outage,
+	* not a verdict on the claim, and throws.
+	*/
+	async #open(wrapped, secret, operation) {
+		try {
+			return await this.#config.keks.unwrap(unwrappable(wrapped), context(secret), operation);
+		} catch (error) {
+			if (error instanceof KekBadClaimError) return null;
+			throw error;
+		}
+	}
+	/** Whether a key operation under `kek` leaves the process: a key service, not a key in memory. */
+	#remote(kek) {
+		return kek !== void 0 && !(kek instanceof LocalKekProvider);
+	}
+	/**
+	* One call's key operations, decided as one. With a key service, the
+	* intent commits first; then, under the reader's row, the check, every
+	* operation within the budget, and each key's outcome. With a key in
+	* memory there is nothing to pair with outside, and it is all one short
+	* transaction.
+	*/
+	async #keys(call, operations, result) {
+		const { action, principal, secrets, entry } = call;
+		for (const secret of secrets) entry(secret, "allow", null);
+		const wrongKek = await this.#kekMismatch();
+		if (wrongKek !== null) return this.#decide([], async () => {
+			throw new Refused(refusal("wrong_kek", wrongKek), secrets.map((secret) => entry(secret, "deny", "wrong_kek")));
+		});
+		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
+		const check = async (d) => {
+			const reader = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports);
+			const codes = secrets.map((secret) => refuses(reader, call.permission, secret));
+			let first = codes.find((code) => code !== null) ?? null;
+			if (first === null && action === "secret.read" && await this.#overBulkLimit(d, principal, secrets.length)) first = "bulk_limit";
+			if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, i) => entry(secret, "deny", codes[i] ?? first)));
+		};
+		const intentId = call.remote ? randomUUID() : null;
+		let intentSeq = null;
+		const outcomeEntry = (secret, item, decision, code) => {
+			const outcome = entry(secret, decision, code);
+			return intentSeq === null ? outcome : {
+				...outcome,
+				relatedSeq: intentSeq,
+				metadata: JSON.stringify({
+					...JSON.parse(outcome.metadata ?? "{}"),
+					intent: intentId,
+					item,
+					...["key_error", "kms_uncertain"].includes(code ?? "") ? { uncertain: true } : {}
+				})
+			};
+		};
+		if (call.remote) {
+			const intent = await this.#decide([principal], async (d) => {
+				await check(d);
+				await lockLogHead(d.tx);
+				const at = await this.#now(d.tx);
+				return { seq: (await appendEntries(d.tx, this.#prepared.logKey, [{
+					actor: principal,
+					action: "key.intent",
+					decision: "allow",
+					operationId: call.input.operationId ?? null,
+					requestId: call.input.requestId ?? null,
+					metadata: JSON.stringify({
+						intent: intentId,
+						operation: action,
+						expiresAt: at + this.#prepared.options.keyBudgetMs + 2 * LOCK_TIMEOUT_MS,
+						...call.input.purpose === void 0 ? {} : { purpose: call.input.purpose },
+						keys: secrets.map((secret, item) => ({
+							item,
+							subject: secret.path,
+							secretId: secret.secretId,
+							version: secret.version
+						}))
+					})
+				}])).seqStart };
+			});
+			if (!intent.ok) return intent;
+			intentSeq = intent.seq;
+		}
+		return this.#decide([principal], async (d) => {
+			try {
+				await check(d);
+			} catch (error) {
+				if (error instanceof Refused) throw new Refused(error.refusal, secrets.map((secret, item) => outcomeEntry(secret, item, "deny", error.entries[item].code ?? error.refusal.code)));
+				throw error;
+			}
+			const { outcomes, expired } = await settle(operations(), this.#prepared.options.keyBudgetMs);
+			const done = outcomes.flatMap((outcome) => outcome.ok ? [outcome.value] : []);
+			try {
+				const entries = () => secrets.map((secret, i) => outcomeEntry(secret, i, "deny", outcomes[i].ok ? "withheld" : outcomes[i].code));
+				const fault = outcomes.find((outcome) => !outcome.ok && outcome.code === "key_error");
+				if (fault !== void 0 && !fault.ok) throw new Outage(fault.error, entries());
+				const unanswered = outcomes.filter((outcome) => !outcome.ok && outcome.code !== "bad_claim").length;
+				if (unanswered > 0) throw new Outage(new KekUnavailableError(`the key service did not answer for ${unanswered} of ${secrets.length} keys`, outcomes.some((outcome) => !outcome.ok && outcome.code === "kms_uncertain")), entries());
+				if (expired) throw new Outage(new KekUnavailableError("key operation exceeded its deadline"), entries());
+				if (done.length < outcomes.length) throw new Refused(refusal("bad_claim", MESSAGES.bad_claim), entries());
+				const released = secrets.map((secret, i) => outcomeEntry(secret, i, "allow", null));
+				d.log.push(...released);
+				const answer = result(done);
+				if (action !== "secret.read") d.after.push((seqOf) => Object.assign(answer, { seqs: released.map(seqOf) }));
+				return answer;
+			} finally {
+				for (const value of done) value.wipe();
+			}
+		});
+	}
+	/** Whether `n` more keys would take `principal` past the bulk limit; counted under their row's lock, so exactly. */
+	async #overBulkLimit(d, principal, n) {
+		const { count, windowMs } = this.#config.bulkLimit;
+		return await releasesSince(d.tx, principal, d.at - windowMs) + n > count;
+	}
+	#isRootAdmin(principal) {
+		return principal.startsWith("user:") && this.#config.rootAdmins.includes(principal.slice(5));
+	}
+	/**
+	* Give a root admin a member row the first time anyone asks about them:
+	* the app's sign-ins and sessions point at it, and their reads queue on
+	* it like anyone's. Logged, and made in a transaction of its own, under
+	* the log's lock: a decision that held the head and then waited for a
+	* member row would take the locks out of order. The row never makes
+	* anyone a root admin; the configuration does.
+	*/
+	async #rootRow(principal) {
+		if (this.#prepared.rooted.has(principal)) return;
+		await this.#db.transaction(async (tx) => {
+			await lockLogHead(tx);
+			if (await member(tx, principal) !== void 0) return;
+			const { occurredAt: at, seqStart } = await appendEntries(tx, this.#prepared.logKey, [{
+				actor: VAULT_ACTOR,
+				action: "member.add",
+				decision: "allow",
+				subjectPrincipal: principal,
+				metadata: JSON.stringify({
+					owner: false,
+					rootAdmin: true
+				})
+			}]);
+			const row = {
+				principal,
+				status: "active",
+				owner: false,
+				generation: 0,
+				createdAt: at,
+				createdBy: VAULT_ACTOR,
+				statusChangedAt: at,
+				statusChangedBy: VAULT_ACTOR,
+				accessSeq: seqStart
+			};
+			await insertMember(tx, {
+				...row,
+				mac: memberMac(this.#prepared.rowKey, row, [])
+			});
+		});
+		this.#prepared.rooted.add(principal);
+	}
+	/**
+	* What `principal` holds, their row checked first (`#integrity`): a row
+	* that fails holds nothing, and is `tampered`. A root admin's come from the
+	* configuration, which no row can change.
+	*/
+	async #standing(db, principal, row, at, reports) {
+		const none = {
+			isRootAdmin: false,
+			isOwner: false,
+			grants: []
+		};
+		if (this.#isRootAdmin(principal)) {
+			const root = {
+				isRootAdmin: true,
+				isOwner: true,
+				grants: []
+			};
+			return {
+				principal,
+				status: "active",
+				live: root,
+				all: root,
+				fault: null,
+				stored: []
+			};
+		}
+		const grants$1 = row === void 0 ? [] : await grants(db, principal);
+		const fault = await this.#integrity(db, principal, row, grants$1, reports);
+		if (fault !== null) return {
+			principal,
+			status: "tampered",
+			live: none,
+			all: none,
+			fault,
+			stored: grants$1
+		};
+		if (row?.status !== "active") return {
+			principal,
+			status: row?.status ?? "unknown",
+			live: none,
+			all: none,
+			fault,
+			stored: grants$1
+		};
+		const held = grants$1.map((grant) => ({
+			...grant,
+			role: grant.role
+		}));
+		const isOwner = row.owner && principal.startsWith("user:");
+		return {
+			principal,
+			status: "active",
+			live: {
+				isRootAdmin: false,
+				isOwner,
+				grants: held.filter((grant) => live(grant, at))
+			},
+			all: {
+				isRootAdmin: false,
+				isOwner,
+				grants: held
+			},
+			fault,
+			stored: grants$1
+		};
+	}
+	#access(principal, row, held, at, tampered) {
+		if (this.#isRootAdmin(principal)) return {
+			principal,
+			status: "active",
+			generation: row?.generation ?? 0,
+			isRootAdmin: true,
+			isOwner: true,
+			grants: [],
+			since: null,
+			by: null
+		};
+		const active = !tampered && row?.status === "active";
+		return {
+			principal,
+			status: tampered ? "tampered" : row?.status ?? "unknown",
+			generation: row?.generation ?? 0,
+			isRootAdmin: false,
+			isOwner: active && row.owner && principal.startsWith("user:"),
+			grants: active ? held.filter((grant) => live(grant, at)).map(view) : [],
+			since: row ? iso(row.statusChangedAt) : null,
+			by: row?.statusChangedBy ?? null
+		};
+	}
+	/**
+	* What `principal` holds now. Read without locks, the fast way; a row that
+	* seems to fail its check is read again in one snapshot before anyone is
+	* called tampered, since a change committed between two of the reads
+	* looks like one.
+	*/
+	async access(principal) {
+		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
+		const read = async (db, reports) => {
+			const [row, held, at] = await Promise.all([
+				member(db, principal),
+				grants(db, principal),
+				this.#now(db)
+			]);
+			const fault = this.#isRootAdmin(principal) ? null : await this.#integrity(db, principal, row, held, reports);
+			return this.#access(principal, row, held, at, fault !== null);
+		};
+		const found = [];
+		const quick = await read(this.#db, found).catch((error) => {
+			if (error instanceof Retry) return null;
+			throw error;
+		});
+		if (quick !== null && quick.status !== "tampered") {
+			await this.#record(found);
+			return quick;
+		}
+		const reports = [];
+		const access = await this.#db.transaction((tx) => read(tx, reports), SNAPSHOT);
+		await this.#record(reports);
+		return access;
+	}
+	/**
+	* Every member's row checked as `access` checks it, each finding
+	* reported: their newest access entries read in one query, and the slow
+	* way only for a row that does not match. Lists of members read the rows
+	* without the vault, so this is what finds a row changed around it before
+	* its member next asks for anything. The checkpoint runs it in one
+	* snapshot: a change committed between two of its reads, such as a lapsed
+	* grant cleared, would otherwise pair a row with grants it was never
+	* sealed over.
+	*/
+	async #sweep(db, reports) {
+		const rows = await allMembers(db);
+		const held = await grants(db);
+		const newest = await newestAccessEntries(db);
+		for (const row of rows) {
+			if (this.#isRootAdmin(row.principal)) continue;
+			const grants = held.filter((grant) => grant.principal === row.principal);
+			const entry = newest.get(row.principal);
+			if (!(entry !== void 0 && this.#authentic(entry) && sealed(this.#prepared.rowKey, row, grants) && entry.seq === row.accessSeq)) await this.#integrity(db, row.principal, row, grants, reports);
+		}
+	}
+	setAccess(input) {
+		const { actor, principal } = input;
+		const action = input.changes.every((change) => change.role === null) ? "access.revoke" : "access.grant";
+		const [only] = input.changes.length === 1 ? input.changes : [];
+		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [{
+			...accessEntry(actor, action, principal, "deny", input, { changes: input.changes }, code),
+			...only === void 0 || code === "invalid" ? {} : {
+				projectId: only.projectId,
+				environmentId: only.environmentId
+			}
+		}]);
+		return this.#decide([actor, principal], async (d) => {
+			validateCorrelation(input);
+			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a principal: ${principal}`);
+			if (this.#isRootAdmin(principal)) throw refused("root_admin");
+			const places$1 = /* @__PURE__ */ new Set();
+			for (const change of input.changes) {
+				const key = `${change.projectId}/${change.environmentId ?? ""}`;
+				if (places$1.has(key)) throw refused("invalid", "each place may be changed once per call");
+				places$1.add(key);
+				if (change.role !== null && !isRole(change.role)) throw refused("invalid", `no such role: ${change.role}`);
+				if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role)) throw refused("invalid", `${change.role} can only be granted on a project`);
+				const expiresAt = change.expiresAt === null ? null : Date.parse(change.expiresAt);
+				if (Number.isNaN(expiresAt) || expiresAt !== null && expiresAt <= d.at) throw refused("invalid", "an end date must be in the future");
+			}
+			const known = await places(d.tx, input.changes.map((change) => change.projectId), input.changes.flatMap((change) => change.environmentId === null ? [] : [change.environmentId]));
+			for (const { projectId, environmentId } of input.changes) if (!known.projects.has(projectId) || environmentId !== null && known.environments.get(environmentId) !== projectId) throw refused("invalid", `no such place: ${environmentId === null ? projectId : `${projectId}/${environmentId}`}`);
+			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
+			if (acting.status === "tampered") throw refused("tampered");
+			if (!input.changes.every((change) => mayManageAccess(acting.live, principal, change))) throw refused("not_allowed");
+			const row = d.members.get(principal);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
+			if (row?.status === "removed") throw refused("removed");
+			if (row === void 0) {
+				if (!isSyncPrincipal(principal) || input.changes.every((change) => change.role === null)) throw refused("not_a_member");
+				d.log.push(accessEntry(actor, "member.add", principal, "allow", input, { owner: false }));
+				d.writes.push(async (at) => {
+					await insertMember(d.tx, {
+						principal,
+						status: "active",
+						owner: false,
+						generation: 0,
+						createdAt: at,
+						createdBy: actor,
+						statusChangedAt: at,
+						statusChangedBy: actor,
+						...UNSEALED
+					});
+				});
+			}
+			const held = subject.stored;
+			d.grants.set(principal, [...held]);
+			const changes = input.changes.map((change) => this.#apply(d, actor, principal, held, change, input));
+			if (d.writes.length > 0) d.touched.add(principal);
+			return { changes };
+		});
+	}
+	/** One place's change, logged when it changes what is live. */
+	#apply(d, actor, principal, held, change, correlation) {
+		const existing = held.find((grant) => grant.projectId === change.projectId && grant.environmentId === change.environmentId);
+		const current = existing !== void 0 && live(existing, d.at) ? existing : void 0;
+		const expiresAt = change.expiresAt === null ? null : Date.parse(change.expiresAt);
+		const place = {
+			projectId: change.projectId,
+			environmentId: change.environmentId
+		};
+		const entry = (action, role) => d.log.push({
+			...accessEntry(actor, action, principal, "allow", correlation, {
+				role,
+				expiresAt: expiresAt === null ? null : iso(expiresAt),
+				previousRole: current?.role ?? null
+			}),
+			...place
+		});
+		const clear = () => {
+			if (existing === void 0) return;
+			d.writes.push(async () => {
+				await deleteGrant(d.tx, principal, place);
+				d.grants.set(principal, d.grants.get(principal).filter((grant) => grant !== existing));
+			});
+		};
+		if (change.role === null) {
+			clear();
+			if (current === void 0) return "unchanged";
+			entry("access.revoke", null);
+			return "revoked";
+		}
+		if (current !== void 0 && current.role === change.role && current.expiresAt === expiresAt) return "unchanged";
+		const role = change.role;
+		clear();
+		d.writes.push(async (at) => {
+			const grant = {
+				principal,
+				...place,
+				role,
+				expiresAt,
+				grantedAt: at,
+				grantedBy: actor
+			};
+			await insertGrant(d.tx, grant);
+			d.grants.get(principal).push(grant);
+		});
+		entry("access.grant", role);
+		return current === void 0 ? "created" : "updated";
+	}
+	admit(input) {
+		const { actor, principal } = input;
+		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.add", principal, "deny", input, { owner: input.owner ?? null }, code)]);
+		return this.#decide([actor, principal], async (d) => {
+			validateCorrelation(input);
+			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
+			if (acting.status === "tampered") throw refused("tampered");
+			if (!acting.live.isOwner) throw refused("not_allowed", "only owners may add or restore members");
+			if (!PRINCIPAL.test(principal) || isSyncPrincipal(principal)) throw refused("invalid", `not a member: ${principal}`);
+			if (this.#isRootAdmin(principal)) throw refused("root_admin");
+			if (input.owner === true && !principal.startsWith("user:")) throw refused("invalid", "service accounts cannot be owners");
+			const row = d.members.get(principal);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
+			d.touched.add(principal);
+			d.grants.set(principal, [...subject.stored]);
+			const entry = (action, owner) => d.log.push(accessEntry(actor, action, principal, "allow", input, { owner }));
+			if (row === void 0 || row.status === "removed") {
+				const owner = input.owner ?? false;
+				entry(row === void 0 ? "member.add" : "member.restore", owner);
+				d.writes.push(async (at) => {
+					if (row === void 0) await insertMember(d.tx, {
+						principal,
+						status: "active",
+						owner,
+						generation: 0,
+						createdAt: at,
+						createdBy: actor,
+						statusChangedAt: at,
+						statusChangedBy: actor,
+						...UNSEALED
+					});
+					else await updateMember(d.tx, principal, {
+						status: "active",
+						owner,
+						statusChangedAt: at,
+						statusChangedBy: actor
+					});
+				});
+				return {
+					created: true,
+					owner,
+					generation: row?.generation ?? 0
+				};
+			}
+			const owner = input.owner ?? row.owner;
+			if (owner !== row.owner) {
+				entry("member.owner", owner);
+				d.writes.push(() => updateMember(d.tx, principal, { owner }));
+			}
+			return {
+				created: false,
+				owner,
+				generation: row.generation
+			};
+		});
+	}
+	remove(input) {
+		const { actor, principal } = input;
+		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.remove", principal, "deny", input, {}, code)]);
+		return this.#decide([actor, principal], async (d) => {
+			validateCorrelation(input);
+			if (this.#isRootAdmin(principal)) throw refused("root_admin");
+			const row = d.members.get(principal);
+			const acting = await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports);
+			if (acting.status === "tampered") throw refused("tampered");
+			const holder = acting.live;
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const held = subject.stored;
+			if (subject.status === "tampered") {
+				if (!holder.isOwner) throw refused("not_allowed", "only owners may remove a member whose record failed its check");
+				return this.#startOver(d, actor, principal, row, subject.fault, input, refused);
+			}
+			const places = input.source === void 0 ? held : [...held, input.source];
+			if (!(holder.isOwner || isSyncPrincipal(principal) && (held.length === 0 || places.some((place) => mayManageAccess(holder, principal, {
+				...place,
+				role: null
+			}))))) throw refused("not_allowed", "only owners may remove members");
+			if (row?.status !== "active") throw refused(row === void 0 ? "not_a_member" : "removed");
+			const revoked = held.filter((grant) => live(grant, d.at));
+			for (const grant of revoked) d.log.push({
+				...accessEntry(actor, "access.revoke", principal, "allow", input, {
+					role: null,
+					expiresAt: null,
+					previousRole: grant.role
+				}),
+				projectId: grant.projectId,
+				environmentId: grant.environmentId
+			});
+			const generation = row.generation + 1;
+			d.log.push(accessEntry(actor, "member.remove", principal, "allow", input, {
+				revoked: revoked.length,
+				generation
+			}));
+			d.touched.add(principal);
+			d.writes.push(async (at) => {
+				await deleteGrants(d.tx, principal);
+				d.grants.set(principal, []);
+				await updateMember(d.tx, principal, {
+					status: "removed",
+					owner: false,
+					generation,
+					statusChangedAt: at,
+					statusChangedBy: actor
+				});
+			});
+			return {
+				revoked: revoked.map(view),
+				generation
+			};
+		});
+	}
+	/**
+	* Remove a member whose row failed its check, from what the log says of
+	* them rather than what the row does: their grants go, whatever they were,
+	* and their generation moves past both the row's and the log's, so no
+	* session or token from any earlier membership comes back with a row put
+	* back. Admitted again, they start from nothing, as any removed member.
+	*/
+	async #startOver(d, actor, principal, row, fault, correlation, refused) {
+		const logged = await this.#logged(d.tx, principal);
+		if (logged === void 0) throw refused("not_a_member", "the log never admitted them: their row was written around the vault");
+		const generation = Math.max(row?.generation ?? 0, logged.generation) + 1;
+		d.log.push(accessEntry(actor, "member.remove", principal, "allow", correlation, {
+			revoked: 0,
+			generation,
+			tampered: fault
+		}));
+		d.touched.add(principal);
+		d.writes.push(async (at) => {
+			await deleteGrants(d.tx, principal);
+			d.grants.set(principal, []);
+			const fresh = {
+				status: "removed",
+				owner: false,
+				generation,
+				createdAt: logged.createdAt,
+				createdBy: logged.createdBy,
+				statusChangedAt: at,
+				statusChangedBy: actor
+			};
+			if (row === void 0) await insertMember(d.tx, {
+				principal,
+				...fresh,
+				...UNSEALED
+			});
+			else await updateMember(d.tx, principal, fresh);
+		});
+		return {
+			revoked: [],
+			generation
+		};
+	}
+	/** `principal` as the log says they are: their authenticated access entries, replayed. */
+	async #logged(db, principal) {
+		const state = {
+			members: /* @__PURE__ */ new Map(),
+			held: /* @__PURE__ */ new Map()
+		};
+		const entries = (await accessEntriesAbout(db, principal, 1e5)).filter((entry) => this.#authentic(entry));
+		for (const entry of entries.reverse()) apply(state, entry);
+		return state.members.get(principal);
+	}
+	/**
+	* Null when every KEK the vault is given opens what it wrapped; otherwise
+	* why not, naming the KEK, never its key. Decided once per process, before
+	* its first key operation or checkpoint. A key service that cannot answer
+	* leaves it undecided: the error is thrown, and the next call asks again.
+	*/
+	#kekMismatch() {
+		const prepared = this.#prepared;
+		if (prepared.kekCheck === null) {
+			const check = this.#checkKeks();
+			prepared.kekCheck = check;
+			check.then((wrong) => void (prepared.wrongKek = wrong), () => {
+				if (prepared.kekCheck === check) prepared.kekCheck = null;
+			});
+		}
+		return prepared.kekCheck;
+	}
+	/**
+	* Each KEK opens its check value, or, with none recorded yet (a fresh
+	* database, a new KEK, data from before checks), opens one of the newest
+	* keys it wrapped, if there are any; then its check value is recorded.
+	* A KEK that opens neither is not the one that wrapped the data.
+	*/
+	async #checkKeks() {
+		const checks = /* @__PURE__ */ new Map();
+		for (const entry of await vaultEntriesOf(this.#db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
+			if (!this.#authentic(entry)) continue;
+			const wrapped = JSON.parse(entry.metadata);
+			checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
+		}
+		const budget = this.#prepared.options.keyBudgetMs;
+		for (const kek of this.#config.keks.all) {
+			const operation = {
+				deadline: Date.now() + budget,
+				signal: AbortSignal.timeout(budget)
+			};
+			const opens = async (wrapped, context, expected) => {
+				try {
+					const key = await kek.unwrap(wrapped, context, operation);
+					const right = expected === void 0 || key.length === expected.length && timingSafeEqual(key, expected);
+					key.fill(0);
+					return right;
+				} catch (error) {
+					if (error instanceof KekBadClaimError) return false;
+					throw error;
+				}
+			};
+			const mismatch = `this vault's ${kek.provider} KEK ${kek.keyId} does not open the data it holds: it is not the key that wrapped it`;
+			const check = checks.get(`${kek.provider}:${kek.keyId}`);
+			if (check !== void 0) {
+				if (!await opens(check, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE)) return mismatch;
+				continue;
+			}
+			const samples = await wrappedUnder(this.#db, kek.provider, kek.keyId, KEY_CHECK_SAMPLE);
+			let proof = null;
+			for (const { projectId, environmentId, secretId, version, ...wrapped } of samples) if (await opens(wrapped, {
+				projectId,
+				environmentId,
+				secretId
+			})) {
+				proof = {
+					secretId,
+					version
+				};
+				break;
+			}
+			if (samples.length > 0 && proof === null) return mismatch;
+			const wrapped = await kek.wrap(Buffer.from(KEY_CHECK_VALUE), KEY_CHECK_CONTEXT, operation);
+			await this.#db.transaction((tx) => appendEntries(tx, this.#prepared.logKey, [{
+				actor: VAULT_ACTOR,
+				action: KEY_CHECK,
+				decision: "allow",
+				metadata: JSON.stringify({
+					...serialisable(wrapped),
+					proof
+				})
+			}]));
+		}
+		return null;
+	}
+	/** The last checkpoint the vault signed, and the entry that holds it: its newest allowed `audit.checkpoint`. */
+	async #latest(db) {
+		const row = await latestVaultEntry(db, [CHECKPOINT]);
+		return row === void 0 ? null : {
+			checkpoint: JSON.parse(row.metadata),
+			seq: row.seq
+		};
+	}
+	async checkpoint() {
+		const { wrongKek } = this.#prepared;
+		const found = [];
+		const whole = await this.#db.transaction(async (tx) => {
+			await this.#sweep(tx, found);
+			return verifyChain(tx, this.#prepared.logKey, [], UNVERIFIED);
+		}, SNAPSHOT);
+		return this.#decide([], async (d) => {
+			for (const entry of found) if (!d.reports.includes(entry)) d.reports.push(entry);
+			const head = await lockLogHead(d.tx);
+			const latest = await this.#latest(d.tx);
+			const refused = (code, detail, message = MESSAGES[code]) => new Refused(refusal(code, message), [{
+				actor: SCHEDULER,
+				action: CHECKPOINT,
+				decision: "deny",
+				code,
+				metadata: JSON.stringify(detail)
+			}]);
+			if (head.nextSeq === 0n) throw new Refused(refusal("invalid", "the log is empty"), []);
+			if (wrongKek !== null) throw refused("wrong_kek", { reason: wrongKek }, wrongKek);
+			if (!whole.verification.ok) throw refused("log_broken", {
+				failedAtSeq: whole.verification.failedAtSeq,
+				reason: whole.verification.reason
+			});
+			if (latest !== null && latest.seq === head.nextSeq - 1n) return { checkpoint: latest.checkpoint };
+			if (latest !== null && !await carries(d.tx, latest.checkpoint)) throw refused("log_broken", { reason: `the log up to entry ${latest.checkpoint.seq} is not the prefix the last checkpoint signed` });
+			const { verification: held, anchor: verified } = await verifyChain(d.tx, this.#prepared.logKey, [], whole.anchor);
+			if (!held.ok) throw refused("log_broken", {
+				failedAtSeq: held.failedAtSeq,
+				reason: held.reason
+			});
+			if (verified.nextSeq !== head.nextSeq || !verified.hash.equals(head.headHash)) throw refused("log_broken", { reason: "the chain head does not name the last entry" });
+			const signed = {
+				seq: Number(verified.nextSeq - 1n),
+				hash: verified.hash.toString("hex"),
+				signedAt: iso(d.at)
+			};
+			const checkpoint = {
+				...signed,
+				keyId: this.#prepared.signer.keyId,
+				signature: await this.#prepared.signer.sign(checkpointMessage(signed))
+			};
+			d.log.push({
+				actor: SCHEDULER,
+				action: CHECKPOINT,
+				decision: "allow",
+				metadata: JSON.stringify(checkpoint)
+			});
+			return { checkpoint };
+		});
+	}
+	async about() {
+		return {
+			publicKey: this.#prepared.signer.publicKey,
+			rootAdmins: this.#config.rootAdmins.map((email) => `user:${email}`)
+		};
+	}
+	verifyLog(input) {
+		return this.#verifyAll([], input.upTo ?? null);
+	}
+	/** `shown`, and the chain from `anchor`; the furthest verified is kept for the next check. */
+	async #verify(db, shown, anchor) {
+		const { verification, anchor: reached } = await verifyChain(db, this.#prepared.logKey, shown, anchor);
+		if (verification.ok) this.#prepared.verified = further(this.#prepared.verified, reached);
+		return verification;
+	}
+	/**
+	* `shown`, and the chain from its first entry, in one snapshot: every
+	* link and hash, the vault's MACs; then the heads that must still be
+	* there: the one the app verified up to (`upTo`), so both authors are
+	* checked over the same entries, the one the app last recorded from a
+	* checkpoint (`through`), and the last checkpoint's; and the members and
+	* grants replayed from it.
+	*/
+	#verifyAll(shown, upTo) {
+		return this.#db.transaction(async (tx) => {
+			const remembered = this.#prepared.verified;
+			const verification = await this.#verify(tx, shown, UNVERIFIED);
+			if (!verification.ok) return verification;
+			if (upTo !== null && !await carries(tx, upTo)) return {
+				ok: false,
+				failedAtSeq: upTo.seq,
+				reason: "not the entry the app verified up to: the log changed between the two checks"
+			};
+			const unsigned = await this.#checkpointFault(tx);
+			if (unsigned !== null) return unsigned;
+			if (remembered.nextSeq > 0n) {
+				const seq = remembered.nextSeq - 1n;
+				if (!await carries(tx, {
+					seq: Number(seq),
+					hash: remembered.hash.toString("hex")
+				})) return {
+					ok: false,
+					failedAtSeq: Number(seq),
+					reason: "changed since the vault last verified it"
+				};
+			}
+			const at = await this.#now(tx);
+			const accounting = await verifyAccounting(tx, at);
+			if (!accounting.ok) return accounting;
+			const fault = await this.#unsealed(tx) ?? await replay(tx, at);
+			if (fault !== null) return {
+				ok: false,
+				failedAtSeq: null,
+				reason: describeAccessFault(fault),
+				fault
+			};
+			return accounting.pending === 0 ? verification : {
+				...verification,
+				pending: accounting.pending
+			};
+		}, SNAPSHOT);
+	}
+	/**
+	* Every checkpoint, not only the newest: each signed by the vault's key,
+	* over a prefix the log still holds, entry for entry. The chain is
+	* verified by now, so each checkpoint entry is the vault's.
+	*/
+	async #checkpointFault(db) {
+		for (let after = -1n;;) {
+			const batch = await vaultEntriesOf(db, [CHECKPOINT], after, VERIFY_BATCH);
+			for (const entry of batch) {
+				const checkpoint = JSON.parse(entry.metadata);
+				const broken = (reason) => ({
+					ok: false,
+					failedAtSeq: Number(entry.seq),
+					reason
+				});
+				if (!await verifyCheckpoint(checkpoint, this.#prepared.signer.publicKey)) return broken("a checkpoint the vault did not sign");
+				if (BigInt(checkpoint.seq) >= entry.seq || !await carries(db, checkpoint)) return broken(`the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`);
+			}
+			if (batch.length < 1e3) return null;
+			after = batch[batch.length - 1].seq;
+		}
+	}
+	/**
+	* The first member whose row fails its MAC, or names an older access
+	* entry than the log's newest about them. The chain is verified by now,
+	* so every entry read here carries the vault's MAC.
+	*/
+	async #unsealed(db) {
+		const [rows, held, newest] = await Promise.all([
+			allMembers(db),
+			grants(db),
+			newestAccessEntries(db)
+		]);
+		for (const row of rows) {
+			const grants = held.filter((grant) => grant.principal === row.principal);
+			if (!sealed(this.#prepared.rowKey, row, grants)) return {
+				kind: "tampered-member",
+				principal: row.principal,
+				why: "mac"
+			};
+			if (newest.get(row.principal)?.seq !== row.accessSeq) return {
+				kind: "tampered-member",
+				principal: row.principal,
+				why: "stale"
+			};
+		}
+		return null;
+	}
+};
+/** Settle every operation before releasing the member lock, including cancelled requests. */
+async function settle(operations, budgetMs) {
+	const controller = new AbortController();
+	const operation = {
+		deadline: Date.now() + budgetMs,
+		signal: controller.signal
+	};
+	const timer = setTimeout(() => controller.abort(), budgetMs);
+	try {
+		return {
+			outcomes: await Promise.all(operations.map(async (work) => {
+				try {
+					if (operation.signal.aborted || Date.now() >= operation.deadline) throw new KekCancelledError();
+					const value = await work(operation);
+					return value === null ? {
+						ok: false,
+						code: "bad_claim"
+					} : {
+						ok: true,
+						value
+					};
+				} catch (error) {
+					if (error instanceof KekUnavailableError) return {
+						ok: false,
+						code: error.uncertain ? "kms_uncertain" : error instanceof KekCancelledError ? "cancelled" : "kms_unavailable"
+					};
+					return {
+						ok: false,
+						code: "key_error",
+						error
+					};
+				}
+			})),
+			expired: controller.signal.aborted || Date.now() >= operation.deadline
+		};
+	} finally {
+		clearTimeout(timer);
+	}
+}
+function validateText(value) {
+	if (typeof value !== "string" || /[\uD800-\uDFFF]/u.test(value)) throw new Error("key request strings must be well-formed Unicode");
+}
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+/** The caller's ids go into the log as they are: a request id is text, an operation id a lowercase UUID. */
+function validateCorrelation(input) {
+	if (input.requestId != null) validateText(input.requestId);
+	if (input.operationId != null && (typeof input.operationId !== "string" || !UUID.test(input.operationId))) throw new Error(`operationId must be a lowercase UUID, got: ${String(input.operationId)}`);
+}
+/** Validate the entire batch before any provider sees a key. */
+function validateItems(items, field) {
+	for (const { secret, key, wrapped } of items) {
+		if (field === "key" && typeof key !== "string") throw new Error("DEK must be base64");
+		if (field === "wrapped" && (wrapped === void 0 || wrapped === null)) throw new Error("wrapped key is required");
+		checkContext(context(secret));
+		if (!Number.isSafeInteger(secret.version) || secret.version < 1) throw new Error("secret version must be a positive integer");
+		if (typeof secret.path !== "string" || /[\uD800-\uDFFF]/u.test(secret.path)) throw new Error("secret path must be a well-formed string");
+		if (key !== void 0) {
+			const dek = Buffer.from(key, "base64");
+			try {
+				if (dek.length !== DEK_BYTES) throw new Error(`DEK must be ${DEK_BYTES} bytes, got ${dek.length}`);
+				if (base64(dek) !== key) throw new Error("DEK must be canonical base64");
+			} finally {
+				dek.fill(0);
+			}
+		}
+		if (wrapped !== void 0) {
+			for (const field of [
+				wrapped.kekProvider,
+				wrapped.kekId,
+				wrapped.kekVersion
+			]) if (typeof field !== "string" || field.length === 0 || /[\uD800-\uDFFF]/u.test(field)) throw new Error("wrapped key metadata must be nonempty well-formed strings");
+			const bytes = Buffer.from(wrapped.bytes, "base64");
+			if (bytes.length === 0 || base64(bytes) !== wrapped.bytes) throw new Error("wrapped key must be nonempty canonical base64");
+		}
+	}
+}
+/** Why `reader` may not do `permission` on `secret`, or null if they may. */
+function refuses(reader, permission, secret) {
+	if (reader.status === "tampered") return "tampered";
+	if (reader.status === "removed") return "removed";
+	if (reader.status === "unknown") return "not_a_member";
+	const where = {
+		projectId: secret.projectId,
+		environmentId: secret.environmentId
+	};
+	if (allows(reader.live, permission, where)) return null;
+	return allows(reader.all, permission, where) ? "expired" : "no_grant";
+}
+/**
+* An entry about a key. A new secret's row is not committed when its key is
+* wrapped, so a wrap names the secret in its payload; the others name it.
+*/
+function keyEntry(action, principal, secret, decision, code, correlation, detail = {}) {
+	return {
+		actor: principal,
+		action,
+		decision,
+		code,
+		projectId: secret.projectId,
+		environmentId: secret.environmentId,
+		secretId: action === "key.wrap" ? null : secret.secretId,
+		operationId: correlation.operationId ?? null,
+		requestId: correlation.requestId ?? null,
+		metadata: JSON.stringify({
+			subject: secret.path,
+			...action === "key.wrap" ? { secretId: secret.secretId } : {},
+			version: secret.version,
+			...detail
+		})
+	};
+}
+/** Whether `entry` changes a member's access: what their row's `access_seq` names. */
+function isAccessEntry(entry) {
+	return entry.decision === "allow" && entry.subjectPrincipal !== void 0 && entry.subjectPrincipal !== null && ACCESS_ACTIONS.includes(entry.action);
+}
+/** An entry about a member's access. */
+function accessEntry(actor, action, principal, decision, correlation, detail, code = null) {
+	return {
+		actor,
+		action,
+		decision,
+		code,
+		subjectPrincipal: PRINCIPAL.test(principal) ? principal : null,
+		operationId: correlation.operationId ?? null,
+		requestId: correlation.requestId ?? null,
+		metadata: JSON.stringify(PRINCIPAL.test(principal) ? detail : {
+			subject: principal,
+			...detail
+		})
+	};
+}
+function live(grant, at) {
+	return grant.expiresAt === null || grant.expiresAt > at;
+}
+function view(grant) {
+	return {
+		projectId: grant.projectId,
+		environmentId: grant.environmentId,
+		role: grant.role,
+		expiresAt: grant.expiresAt === null ? null : iso(grant.expiresAt),
+		grantedAt: iso(grant.grantedAt),
+		grantedBy: grant.grantedBy
+	};
+}
+function iso(ms) {
+	return new Date(ms).toISOString();
+}
+function context(secret) {
+	return {
+		projectId: secret.projectId,
+		environmentId: secret.environmentId,
+		secretId: secret.secretId
+	};
+}
+function unwrappable(wrapped) {
+	return {
+		...wrapped,
+		bytes: Buffer.from(wrapped.bytes, "base64")
+	};
+}
+function serialisable(wrapped) {
+	return {
+		...wrapped,
+		bytes: base64(wrapped.bytes)
+	};
+}
+/**
+* Bytes as base64. Through `Buffer.from`, a view of the same memory, because
+* Workers' types declare their own `Buffer` and a bare one loses its
+* `toString(encoding)` to them.
+*/
+function base64(bytes) {
+	return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+}
+//#endregion
+export { prepareVault as n, resolveVaultConfig as r, openVault as t };