@coffre/vault 0.1.1 → 0.1.2

package/dist/{vault-DvTsSAOX.js → vault-D5ZahBN1.js}

@@ -1,87 +1,13 @@
 import { ACCESS_ACTIONS, checkpointMessage, describeAccessFault, verifyCheckpoint } from "@coffre/core/vault";
-import { DEK_BYTES, KekBadClaimError, KekCancelledError, KekRegistry, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
-import { tablesOf } from "@coffre/db";
+import { DEK_BYTES, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
+import { tablesOf } from "@coffre/db";
 import { allows, assignableToEnvironment, isRole, isSyncPrincipal, mayManageAccess } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext } from "@coffre/core/envelope";
 import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation } from "@coffre/db/dialect";
 import { appendEntries, lockLogHead } from "@coffre/db/log";
-import { and, asc, count, desc, eq, gt, gte, inArray, isNull, sql } from "drizzle-orm";
-//#region src/config.ts
-/**
-* 1000 keys in 15 minutes: twenty `coffre run`s of a 50-key environment
-* back to back, which no person or deploy pipeline does, while a script
-* pulling every secret it can reach stops within a few seconds.
-*/
-const DEFAULT_BULK_LIMIT = {
-	count: 1e3,
-	windowMs: 9e5
-};
-function key32(value, what) {
-	const raw = Buffer.from(value, "base64");
-	if (raw.length !== 32) throw new Error(`${what} must be 32 bytes, base64; got ${raw.length} bytes`);
-	return raw;
-}
-const KEK_ID = /^[A-Za-z0-9._-]{1,64}$/;
-const KEK_PROVIDER = /^[a-z0-9][a-z0-9-]{0,31}$/;
-/** Every row records it, and `provider:keyId` finds the KEK again: visible ASCII, bounded. */
-const KEK_NAME = /^[\x21-\x7e]{1,255}$/;
-function kek(entry) {
-	if (!("wrap" in entry)) {
-		const { id, key } = entry;
-		if (!KEK_ID.test(id)) throw new Error(`KEK id "${id}" must be 1-64 letters, digits, dots, dashes or underscores`);
-		return new LocalKekProvider(key32(key, `KEK ${id}`), id);
-	}
-	const { provider, keyId, keyVersion } = entry;
-	if (typeof provider !== "string" || !KEK_PROVIDER.test(provider)) throw new Error(`a KEK provider's name must be 1-32 lowercase letters, digits or dashes; got "${String(provider)}"`);
-	if (typeof keyId !== "string" || !KEK_NAME.test(keyId) || typeof keyVersion !== "string" || !KEK_NAME.test(keyVersion)) throw new Error(`KEK ${provider}: keyId and keyVersion must be 1-255 visible ASCII characters`);
-	if (typeof entry.wrap !== "function" || typeof entry.unwrap !== "function") throw new Error(`KEK ${provider}:${keyId} needs wrap() and unwrap()`);
-	return entry;
-}
-/** Check a deployment's vault configuration, failing on the first problem. */
-function resolveVaultConfig(config) {
-	const [current, ...previous] = [config.kek, ...config.previousKeks ?? []].map(kek);
-	const refs = [current, ...previous].map(({ provider, keyId }) => `${provider}:${keyId}`);
-	const twice = refs.find((ref, i) => refs.indexOf(ref) !== i);
-	if (twice !== void 0) throw new Error(`two KEKs share an id: ${twice}`);
-	return {
-		keks: new KekRegistry(current, previous),
-		rootAdmins: checkRootAdmins(config.rootAdmins),
-		signingKey: key32(config.signingKey, "the signing key"),
-		bulkLimit: config.bulkLimit === void 0 ? DEFAULT_BULK_LIMIT : checkBulkLimit(config.bulkLimit)
-	};
-}
-function checkBulkLimit({ count, windowMinutes }) {
-	if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) throw new Error("bulkLimit needs a whole count of at least 1 and a window above 0 minutes");
-	return {
-		count,
-		windowMs: windowMinutes * 6e4
-	};
-}
-function isHumanEmail(value) {
-	if (value.length > 254) return false;
-	const parts = value.split("@");
-	if (parts.length !== 2) return false;
-	const [local, domain] = parts;
-	if (local.length === 0 || local.length > 64 || local.startsWith(".") || local.endsWith(".") || local.includes("..") || !/^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+$/.test(local)) return false;
-	const labels = domain.split(".");
-	if (labels.length < 2) return false;
-	return labels.every((label) => label.length > 0 && label.length <= 63 && /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/.test(label));
-}
-/**
-* Root admins, lowercased the way they are compared. At least one, in every
-* mode: they are the only way into a fresh instance, and the only members
-* nobody can remove.
-*/
-function checkRootAdmins(emails) {
-	const rootAdmins = [...new Set(emails.map((entry) => entry.trim()).filter((entry) => entry.length > 0))];
-	if (rootAdmins.length === 0) throw new Error("rootAdmins must name at least one email, or nobody can manage coffre");
-	const invalid = rootAdmins.find((entry) => !isHumanEmail(entry));
-	if (invalid) throw new Error(`rootAdmins must be human email identities; invalid: ${invalid}`);
-	return rootAdmins.map((entry) => entry.toLowerCase());
-}
-//#endregion
+import { and, asc, count, desc, eq, gt, gte, inArray, isNull, lt, sql } from "drizzle-orm";
 //#region src/store.ts
 /**
 * On Postgres, fail a lock wait in this transaction after `ms`, rather than
@@ -258,6 +184,21 @@ async function hashAt(db, seq) {
 	const [row] = await db.select({ hash: auditLog.hash }).from(auditLog).where(eq(auditLog.seq, seq));
 	return row?.hash;
 }
+/** Up to `limit` of the vault's entries before `before` (the newest when undefined), newest first. */
+async function vaultPage(db, before, limit) {
+	const { auditLog } = tablesOf(db);
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit));
+}
+/**
+* The seq of the vault's first entry under `keyId`, or undefined. No index
+* serves it: it reads the log from its start up to that entry, which for
+* the key a log began under is among its first.
+*/
+async function firstVaultEntryUnder(db, keyId) {
+	const { auditLog } = tablesOf(db);
+	const [row] = await db.select({ seq: auditLog.seq }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.keyId, keyId))).orderBy(asc(auditLog.seq)).limit(1);
+	return row?.seq;
+}
 /** The vault's newest entry of any of these actions, allowed, or undefined. */
 async function latestVaultEntry(db, actions) {
 	const { auditLog } = tablesOf(db);
@@ -335,7 +276,8 @@ function vaultLogKey(signingKey) {
 const UNVERIFIED = {
 	nextSeq: 0n,
 	hash: GENESIS_HASH,
-	vaultEntries: 0
+	vaultEntries: 0,
+	vaultKeys: []
 };
 /** The further of two anchors, when two calls verified at once. */
 function further(a, b) {
@@ -357,17 +299,17 @@ const VERIFY_BATCH = 1e3;
 * not on the page: a full check, which starts from `UNVERIFIED`, finds that,
 * as does the first view after a start, which has no anchor.
 */
-async function verifyChain(db, key, shown, anchor) {
+async function verifyChain(db, logKeys, shown, anchor) {
 	const broken = (failedAtSeq, reason) => ({
 		verification: {
 			ok: false,
 			failedAtSeq: Number(failedAtSeq),
-			reason
+			reason: withCause(reason)
 		},
 		anchor
 	});
 	const keys = {
-		keys: [key],
+		keys: logKeys,
 		chainOnly: ["app"]
 	};
 	for (const row of [...shown].sort((a, b) => a.seq < b.seq ? -1 : 1)) {
@@ -389,10 +331,13 @@ async function verifyChain(db, key, shown, anchor) {
 			startPrevHash: verified.hash
 		});
 		if (!result.ok) return broken(result.failedAtSeq, result.reason);
+		const moved = forward(batch, verified.vaultKeys, logKeys[0].keyId);
+		if ("failedAtSeq" in moved) return broken(moved.failedAtSeq, moved.reason);
 		verified = {
 			nextSeq: result.nextSeq,
 			hash: result.head,
-			vaultEntries: verified.vaultEntries + result.authenticated
+			vaultEntries: verified.vaultEntries + result.authenticated,
+			vaultKeys: moved.keys
 		};
 		if (batch.length < 1e3) break;
 	}
@@ -405,6 +350,36 @@ async function verifyChain(db, key, shown, anchor) {
 	};
 }
 /**
+* The vault's keys only move forward. Once its entries move from one key to
+* the next, the one before writes no more; once they reach `current`, the
+* key it writes with now, no other key writes again. So a key it replaced,
+* even one that leaked, verifies what came before the rotation, and nothing
+* after it.
+*/
+function forward(entries, keys, current) {
+	let moved = keys;
+	for (const entry of entries) {
+		const last = moved.at(-1);
+		if (entry.author !== "vault" || entry.keyId === last) continue;
+		if (last === current || moved.includes(entry.keyId)) return {
+			failedAtSeq: entry.seq,
+			reason: `written under ${entry.keyId} after the vault moved to ${last}: a key it replaced verifies only what came before`
+		};
+		moved = [...moved, entry.keyId];
+	}
+	return { keys: moved };
+}
+/**
+* A vault entry under a key the vault does not hold is a forgery, or one
+* written under a key it was configured with then: its keys come from its
+* signing key, or from its KEK when it has none. The second is the one an
+* operator can fix.
+*/
+function withCause(reason) {
+	if (!/^written under vault:\S+, a key this verifier does not hold$/.test(reason)) return reason;
+	return `${reason}: either it is forged, or the vault wrote it under another KEK or signing key, which must stay configured: a KEK that was replaced stays in previousKeks`;
+}
+/**
 * Whether the log still holds `head` where it was: not rewritten, nor cut
 * back before it. A head of 64 zeros is before the first entry, which any
 * log holds.
@@ -807,20 +782,35 @@ function sealed(key, member, grants) {
 async function prepareVault(config, options = {}) {
 	return {
 		config,
-		signer: await signer(config.signingKey),
-		logKey: vaultLogKey(config.signingKey),
+		...await keysOf(config.signingKeys),
 		options: {
 			keyBudgetMs: options.keyBudgetMs ?? KEY_BUDGET_MS,
 			clockOffset: options.clockOffset ?? (() => 0)
 		},
 		verified: UNVERIFIED,
 		rooted: /* @__PURE__ */ new Set(),
-		rowKey: rowKey(config.signingKey),
 		reported: /* @__PURE__ */ new Set(),
+		since: null,
+		superseded: null,
+		settling: null,
 		kekCheck: null,
 		wrongKek: null
 	};
 }
+/** The vault's own keys, from each of its signing keys, the one it signs with first. */
+async function keysOf(seeds) {
+	const signers = await Promise.all(seeds.map((seed) => signer(seed)));
+	const logKeys = seeds.map((seed) => vaultLogKey(seed));
+	const rowKeys = seeds.map((seed) => rowKey(seed));
+	return {
+		signer: signers[0],
+		signers,
+		logKey: logKeys[0],
+		logKeys,
+		rowKey: rowKeys[0],
+		rowKeys
+	};
+}
 /** The vault over `db`. Cheap: on Workers, one per call, over that call's connections. */
 function openVault(db, prepared) {
 	return new VaultService(db, prepared);
@@ -848,6 +838,8 @@ const KEY_CHECK_CONTEXT = {
 };
 /** How many stored keys a KEK with no check yet is tried on: one that opens proves it. */
 const KEY_CHECK_SAMPLE = 3;
+/** The vault's first entry under a new key, which the keys it replaced count only before (`#settle`). */
+const KEY_ROTATE = "key.rotate";
 /** A new member row, before the decision seals it (`#seal`). */
 const UNSEALED = {
 	accessSeq: 0n,
@@ -936,6 +928,11 @@ var VaultService = class {
 	* fails the call.
 	*/
 	async #decide(principals, decide) {
+		const superseded = await this.#settled();
+		if (superseded !== null) return {
+			ok: false,
+			refusal: refusal("wrong_kek", superseded)
+		};
 		const reports = [];
 		for (let attempt = 1;; attempt += 1) try {
 			return await this.#decideOnce(principals, decide, reports);
@@ -964,7 +961,7 @@ var VaultService = class {
 				let at = d.at;
 				const accessSeq = /* @__PURE__ */ new Map();
 				if (entries.length > 0) {
-					const appended = await appendEntries(tx, this.#prepared.logKey, entries);
+					const appended = await this.#append(tx, entries);
 					at = appended.occurredAt;
 					entries.forEach((entry, i) => {
 						if (isAccessEntry(entry)) accessSeq.set(entry.subjectPrincipal, appended.seqStart + BigInt(i));
@@ -986,7 +983,7 @@ var VaultService = class {
 			const entries = [...reports, ...error.entries];
 			if (entries.length > 0) await this.#db.transaction(async (tx) => {
 				await boundLockWaits(tx, LOCK_TIMEOUT_MS);
-				await appendEntries(tx, this.#prepared.logKey, entries);
+				await this.#append(tx, entries);
 			});
 			this.#reported(reports);
 			if (error instanceof Outage) throw error.error;
@@ -1030,7 +1027,7 @@ var VaultService = class {
 	* could lock any member out.
 	*/
 	async #integrity(db, principal, row, grants, reports) {
-		if (row !== void 0 && !sealed(this.#prepared.rowKey, row, grants)) {
+		if (row !== void 0 && !this.#sealed(row, grants)) {
 			this.#report(reports, principal, "mac", row.mac.toString("hex"));
 			return "mac";
 		}
@@ -1048,13 +1045,25 @@ var VaultService = class {
 		}
 		return null;
 	}
+	/** Whether `entry` carries the vault's MAC: under any of its keys before `since`, and only its current one from there. */
 	#authentic(entry) {
+		const { logKeys, since } = this.#prepared;
+		const keys = since !== null && entry.seq >= since ? logKeys.slice(0, 1) : logKeys;
 		return verifyEntries([entry], {
 			startSeq: entry.seq,
 			startPrevHash: entry.prevHash,
-			keys: [this.#prepared.logKey]
+			keys
 		}).ok;
 	}
+	/**
+	* Whether `row`, with these grants, carries the MAC of the vault's row
+	* key, or of one it replaced before the rotation sealed every row again
+	* (`#rotate`).
+	*/
+	#sealed(row, grants) {
+		const { rowKeys, since } = this.#prepared;
+		return (since === null ? rowKeys : rowKeys.slice(0, 1)).some((key) => sealed(key, row, grants));
+	}
 	/** A `vault.tampered` entry, once per process for each thing found: `#reported` marks it once committed. */
 	#report(reports, principal, code, detail, relatedSeq = null) {
 		const key = `${principal}|${code}|${detail}`;
@@ -1080,10 +1089,110 @@ var VaultService = class {
 	}
 	/** Reports found outside a decision, committed on their own. */
 	async #record(reports) {
-		if (reports.length === 0) return;
-		await this.#db.transaction((tx) => appendEntries(tx, this.#prepared.logKey, reports));
+		if (reports.length === 0 || await this.#settled() !== null) return;
+		await this.#db.transaction((tx) => this.#append(tx, reports));
 		this.#reported(reports);
 	}
+	/**
+	* Null when the vault may write, once its keys are settled (`#settle`);
+	* otherwise why not. Settled by the first call of a process; one that
+	* fails leaves it to the next.
+	*/
+	async #settled() {
+		const prepared = this.#prepared;
+		if (prepared.since === null && prepared.superseded === null) {
+			prepared.settling ??= this.#settle().finally(() => {
+				prepared.settling = null;
+			});
+			await prepared.settling;
+		}
+		return prepared.superseded;
+	}
+	/**
+	* Which of its keys count where. Those it replaced, from the KEKs in
+	* previousKeks, verify only what came before its first entry under its
+	* current key, `since`, and vouch for no member row after it. The first
+	* call finds that entry, or makes it when every entry of the vault's is
+	* still under a key it replaced (`#rotate`). A vault whose key the log has
+	* moved on from, or that holds no key its newest entries are under,
+	* writes nothing: `superseded` says why.
+	*/
+	async #settle() {
+		const prepared = this.#prepared;
+		const current = prepared.logKey.keyId;
+		for (let attempt = 1;; attempt += 1) {
+			const rotation = await latestVaultEntry(this.#db, [KEY_ROTATE]);
+			if (rotation?.keyId === current && this.#authentic(rotation)) {
+				prepared.since = rotation.seq;
+				return;
+			}
+			const [newest] = await vaultPage(this.#db, void 0, 1);
+			if (newest === void 0) return;
+			const first = await firstVaultEntryUnder(this.#db, current);
+			if (first !== void 0 && newest.keyId === current) {
+				prepared.since = first;
+				return;
+			}
+			if (first === void 0 && prepared.logKeys.some((key) => key.keyId === newest.keyId)) try {
+				prepared.since = await this.#rotate(newest.keyId);
+				return;
+			} catch (error) {
+				if (attempt < 3 && error instanceof Retry) continue;
+				throw error;
+			}
+			prepared.superseded = first === void 0 ? `the vault's entries are under ${newest.keyId}, a key this vault does not hold: it was given the wrong KEK or signing key, or a KEK it replaced is missing from previousKeks` : `the log moved on from this vault's key, ${current}, to ${newest.keyId}: a vault given a newer KEK replaced it, and a replaced key writes nothing more`;
+			return;
+		}
+	}
+	/**
+	* Move the vault to its current key: every member row it can vouch for
+	* sealed again under the current row key, then a `key.rotate` entry, its
+	* first under the key, after which the keys it replaced count for
+	* nothing. One transaction, which locks every row as a decision does,
+	* then the log's head. Another instance that rotated first, or a member
+	* admitted since the rows were read, sends it back to `#settle`.
+	*/
+	async #rotate(from) {
+		const reports = [];
+		const since = await this.#db.transaction(async (tx) => {
+			await boundLockWaits(tx, LOCK_TIMEOUT_MS);
+			const principals = (await allMembers(tx)).map((row) => row.principal);
+			const rows = principals.length === 0 ? /* @__PURE__ */ new Map() : await lockMembers(tx, principals);
+			await lockLogHead(tx);
+			const [newest] = await vaultPage(tx, void 0, 1);
+			if (newest?.keyId !== from || (await allMembers(tx)).length !== rows.size) throw new Retry();
+			const held = await grants(tx);
+			for (const row of rows.values()) {
+				const grants = held.filter((grant) => grant.principal === row.principal);
+				if (await this.#integrity(tx, row.principal, row, grants, reports) === null) await updateMember(tx, row.principal, { mac: memberMac(this.#prepared.rowKey, row, grants) });
+			}
+			const rotated = {
+				actor: VAULT_ACTOR,
+				action: KEY_ROTATE,
+				decision: "allow",
+				metadata: JSON.stringify({ from })
+			};
+			return (await this.#append(tx, [rotated, ...reports])).seqStart;
+		});
+		this.#reported(reports);
+		return since;
+	}
+	/**
+	* Append under the vault's current key, unless the log's newest rotation
+	* is to a key it does not hold: a vault given a newer KEK has replaced
+	* this one, which writes nothing more. Checked under the head's lock, so
+	* that an instance still running with the replaced KEK, as during a
+	* deploy, cannot write after the rotation.
+	*/
+	#append(tx, entries) {
+		const prepared = this.#prepared;
+		return appendEntries(tx, prepared.logKey, entries, async (locked) => {
+			const rotation = await latestVaultEntry(locked, [KEY_ROTATE]);
+			if (rotation === void 0 || prepared.logKeys.some((key) => key.keyId === rotation.keyId)) return;
+			prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer KEK replaced it, and a replaced key writes nothing more`;
+			throw new Error(prepared.superseded);
+		});
+	}
 	async unwrap(input) {
 		const { principal } = input;
 		validateText(input.purpose);
@@ -1288,7 +1397,7 @@ var VaultService = class {
 				await check(d);
 				await lockLogHead(d.tx);
 				const at = await this.#now(d.tx);
-				return { seq: (await appendEntries(d.tx, this.#prepared.logKey, [{
+				return { seq: (await this.#append(d.tx, [{
 					actor: principal,
 					action: "key.intent",
 					decision: "allow",
@@ -1355,11 +1464,11 @@ var VaultService = class {
 	* anyone a root admin; the configuration does.
 	*/
 	async #rootRow(principal) {
-		if (this.#prepared.rooted.has(principal)) return;
+		if (this.#prepared.rooted.has(principal) || await this.#settled() !== null) return;
 		await this.#db.transaction(async (tx) => {
 			await lockLogHead(tx);
 			if (await member(tx, principal) !== void 0) return;
-			const { occurredAt: at, seqStart } = await appendEntries(tx, this.#prepared.logKey, [{
+			const { occurredAt: at, seqStart } = await this.#append(tx, [{
 				actor: VAULT_ACTOR,
 				action: "member.add",
 				decision: "allow",
@@ -1483,6 +1592,7 @@ var VaultService = class {
 	* looks like one.
 	*/
 	async access(principal) {
+		await this.#settled();
 		if (this.#isRootAdmin(principal)) await this.#rootRow(principal);
 		const read = async (db, reports) => {
 			const [row, held, at] = await Promise.all([
@@ -1525,7 +1635,7 @@ var VaultService = class {
 			if (this.#isRootAdmin(row.principal)) continue;
 			const grants = held.filter((grant) => grant.principal === row.principal);
 			const entry = newest.get(row.principal);
-			if (!(entry !== void 0 && this.#authentic(entry) && sealed(this.#prepared.rowKey, row, grants) && entry.seq === row.accessSeq)) await this.#integrity(db, row.principal, row, grants, reports);
+			if (!(entry !== void 0 && this.#authentic(entry) && this.#sealed(row, grants) && entry.seq === row.accessSeq)) await this.#integrity(db, row.principal, row, grants, reports);
 		}
 	}
 	setAccess(input) {
@@ -1821,6 +1931,8 @@ var VaultService = class {
 	* A KEK that opens neither is not the one that wrapped the data.
 	*/
 	async #checkKeks() {
+		const superseded = await this.#settled();
+		if (superseded !== null) return superseded;
 		const checks = /* @__PURE__ */ new Map();
 		for (const entry of await vaultEntriesOf(this.#db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
 			if (!this.#authentic(entry)) continue;
@@ -1865,7 +1977,7 @@ var VaultService = class {
 			}
 			if (samples.length > 0 && proof === null) return mismatch;
 			const wrapped = await kek.wrap(Buffer.from(KEY_CHECK_VALUE), KEY_CHECK_CONTEXT, operation);
-			await this.#db.transaction((tx) => appendEntries(tx, this.#prepared.logKey, [{
+			await this.#db.transaction((tx) => this.#append(tx, [{
 				actor: VAULT_ACTOR,
 				action: KEY_CHECK,
 				decision: "allow",
@@ -1886,11 +1998,12 @@ var VaultService = class {
 		};
 	}
 	async checkpoint() {
+		await this.#settled();
 		const { wrongKek } = this.#prepared;
 		const found = [];
 		const whole = await this.#db.transaction(async (tx) => {
 			await this.#sweep(tx, found);
-			return verifyChain(tx, this.#prepared.logKey, [], UNVERIFIED);
+			return verifyChain(tx, this.#prepared.logKeys, [], UNVERIFIED);
 		}, SNAPSHOT);
 		return this.#decide([], async (d) => {
 			for (const entry of found) if (!d.reports.includes(entry)) d.reports.push(entry);
@@ -1911,7 +2024,7 @@ var VaultService = class {
 			});
 			if (latest !== null && latest.seq === head.nextSeq - 1n) return { checkpoint: latest.checkpoint };
 			if (latest !== null && !await carries(d.tx, latest.checkpoint)) throw refused("log_broken", { reason: `the log up to entry ${latest.checkpoint.seq} is not the prefix the last checkpoint signed` });
-			const { verification: held, anchor: verified } = await verifyChain(d.tx, this.#prepared.logKey, [], whole.anchor);
+			const { verification: held, anchor: verified } = await verifyChain(d.tx, this.#prepared.logKeys, [], whole.anchor);
 			if (!held.ok) throw refused("log_broken", {
 				failedAtSeq: held.failedAtSeq,
 				reason: held.reason
@@ -1937,8 +2050,14 @@ var VaultService = class {
 		});
 	}
 	async about() {
+		await this.#settled();
+		const { signers, since } = this.#prepared;
+		const until = Number(since ?? 0n);
 		return {
-			publicKey: this.#prepared.signer.publicKey,
+			checkpointKeys: Object.fromEntries(signers.map(({ keyId, publicKey }, i) => [keyId, {
+				publicKey,
+				until: i === 0 ? null : until
+			}])),
 			rootAdmins: this.#config.rootAdmins.map((email) => `user:${email}`)
 		};
 	}
@@ -1947,7 +2066,7 @@ var VaultService = class {
 	}
 	/** `shown`, and the chain from `anchor`; the furthest verified is kept for the next check. */
 	async #verify(db, shown, anchor) {
-		const { verification, anchor: reached } = await verifyChain(db, this.#prepared.logKey, shown, anchor);
+		const { verification, anchor: reached } = await verifyChain(db, this.#prepared.logKeys, shown, anchor);
 		if (verification.ok) this.#prepared.verified = further(this.#prepared.verified, reached);
 		return verification;
 	}
@@ -1959,7 +2078,8 @@ var VaultService = class {
 	* checkpoint (`through`), and the last checkpoint's; and the members and
 	* grants replayed from it.
 	*/
-	#verifyAll(shown, upTo) {
+	async #verifyAll(shown, upTo) {
+		await this.#settled();
 		return this.#db.transaction(async (tx) => {
 			const remembered = this.#prepared.verified;
 			const verification = await this.#verify(tx, shown, UNVERIFIED);
@@ -1999,9 +2119,10 @@ var VaultService = class {
 		}, SNAPSHOT);
 	}
 	/**
-	* Every checkpoint, not only the newest: each signed by the vault's key,
-	* over a prefix the log still holds, entry for entry. The chain is
-	* verified by now, so each checkpoint entry is the vault's.
+	* Every checkpoint, not only the newest: each signed by the key whose log
+	* key wrote its entry, over a prefix the log still holds, entry for entry.
+	* The chain is verified by now, so each checkpoint entry is the vault's,
+	* and one under a key it replaced comes before the rotation.
 	*/
 	async #checkpointFault(db) {
 		for (let after = -1n;;) {
@@ -2013,7 +2134,10 @@ var VaultService = class {
 					failedAtSeq: Number(entry.seq),
 					reason
 				});
-				if (!await verifyCheckpoint(checkpoint, this.#prepared.signer.publicKey)) return broken("a checkpoint the vault did not sign");
+				const { logKeys, signers } = this.#prepared;
+				const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
+				if (by?.keyId !== checkpoint.keyId) return broken(`a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`);
+				if (!await verifyCheckpoint(checkpoint, by.publicKey)) return broken("a checkpoint the vault did not sign");
 				if (BigInt(checkpoint.seq) >= entry.seq || !await carries(db, checkpoint)) return broken(`the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`);
 			}
 			if (batch.length < 1e3) return null;
@@ -2033,7 +2157,7 @@ var VaultService = class {
 		]);
 		for (const row of rows) {
 			const grants = held.filter((grant) => grant.principal === row.principal);
-			if (!sealed(this.#prepared.rowKey, row, grants)) return {
+			if (!this.#sealed(row, grants)) return {
 				kind: "tampered-member",
 				principal: row.principal,
 				why: "mac"
@@ -2222,4 +2346,4 @@ function base64(bytes) {
 	return Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
 }
 //#endregion
-export { prepareVault as n, resolveVaultConfig as r, openVault as t };
+export { prepareVault as n, openVault as t };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.1",
-    "@coffre/db": "0.1.1"
+    "@coffre/core": "0.1.2",
+    "@coffre/db": "0.1.2"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/cloudflare.ts

@@ -8,9 +8,8 @@
  *
  *   export default vault((env: Env) => ({
  *     database: postgres(env.HYPERDRIVE),
- *     kek: { id: 'kek-1', key: env.KEK }, // or awsKms({ keyArn, credentials })
+ *     kek: { id: 'kek-1', key: env.KEK }, // or awsKms({ keyArn, credentials }), with a signingKey
  *     rootAdmins: ['admin@acme.example'],
- *     signingKey: env.SIGNING_KEY,
  *   }));
  *
  * Any number of isolates run it side by side: every decision locks what it