@coffre/vault 0.1.12 → 0.1.13

package/dist/{vault-DTHHQw9L.js → vault-3O-ynZPg.js}

@@ -1,4 +1,4 @@
-import { ACCESS_ACTIONS, checkpointMessage, describeAccessFault, verifyCheckpoint } from "@coffre/core/vault";
+import { ACCESS_ACTIONS, checkpointMessage, checkpointVerifier, describeAccessFault } from "@coffre/core/vault";
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { tablesOf } from "@coffre/db";
@@ -8,6 +8,164 @@ import { checkContext } from "@coffre/core/envelope";
 import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation } from "@coffre/db/dialect";
 import { appendEntries, lockLogHead } from "@coffre/db/log";
 import { and, asc, count, desc, eq, gt, gte, inArray, isNull, lt, sql } from "drizzle-orm";
+//#region src/accounting.ts
+const KEY_ACTIONS = /* @__PURE__ */ new Set([
+	"secret.read",
+	"key.wrap",
+	"key.rewrap"
+]);
+/**
+* Every key operation's intent and its outcomes, entry by entry, oldest
+* first, as the full check reads the vault's entries (`add`); then what is
+* still open (`result`). The chain can hold while a process died between an
+* intent and its outcomes: only a missed deadline is a fault.
+*/
+var KeyAccounting = class {
+	#intents = /* @__PURE__ */ new Map();
+	#ids = /* @__PURE__ */ new Set();
+	#fault = null;
+	add(entry) {
+		if (this.#fault !== null || entry.author !== "vault") return;
+		const broken = (reason) => {
+			this.#fault = {
+				ok: false,
+				failedAtSeq: Number(entry.seq),
+				reason
+			};
+		};
+		if (entry.action === "key.intent") {
+			const parsed = parseIntent(entry);
+			if (typeof parsed === "string") return broken(parsed);
+			if (this.#ids.has(parsed.intentId)) return broken("key intent repeats an operation identity");
+			this.#ids.add(parsed.intentId);
+			if (parsed.keys.length > 0) this.#intents.set(entry.seq, {
+				...parsed,
+				entry,
+				seen: /* @__PURE__ */ new Set()
+			});
+		} else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
+			const parsed = parseOutcome(entry);
+			if (typeof parsed === "string") return broken(parsed);
+			const intent = this.#intents.get(parsed.relatedSeq);
+			const key = intent?.keys[parsed.item];
+			if (intent === void 0 || key === void 0 || intent.seen.has(parsed.item)) return broken("key outcome does not identify one item of its intent");
+			if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) return broken("key outcome belongs to another operation");
+			if (parsed.secretId !== key.secretId || parsed.version !== key.version || parsed.subject !== key.subject) return broken("key outcome does not match its intended secret");
+			intent.seen.add(parsed.item);
+			if (intent.seen.size === intent.keys.length) this.#intents.delete(intent.entry.seq);
+		}
+	}
+	/** The first fault, or the batches still under way at `at`: live calls can finish after the snapshot. */
+	result(at) {
+		if (this.#fault !== null) return this.#fault;
+		const intents = [...this.#intents.values()];
+		const overdue = intents.filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
+		if (overdue.length === 0) return {
+			ok: true,
+			pending: intents.length
+		};
+		const reason = overdue.map((intent) => {
+			const missing = intent.keys.length - intent.seen.size;
+			return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
+		}).join("; ");
+		return {
+			ok: false,
+			failedAtSeq: Number(overdue[0].entry.seq),
+			reason
+		};
+	}
+};
+function parseIntent(entry) {
+	const detail = payload(entry.metadata);
+	if (detail === null) return "key intent has no valid accounting payload";
+	const { intent, operation, expiresAt } = detail;
+	if (typeof intent !== "string") return "key intent has no operation identity";
+	if (typeof operation !== "string" || !KEY_ACTIONS.has(operation)) return "key intent has an invalid operation";
+	if (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt < entry.occurredAt) return "key intent has no valid deadline";
+	if (!Array.isArray(detail.keys)) return "key intent has no valid item list";
+	const keys = [];
+	for (const [index, value] of detail.keys.entries()) {
+		const key = record(value);
+		if (key === null || key.item !== index) return "key intent items are not numbered in order";
+		const { secretId, version, subject } = key;
+		if (typeof secretId !== "string" || typeof subject !== "string") return "key intent item has no secret identity";
+		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key intent item has no valid version";
+		keys.push({
+			item: index,
+			secretId,
+			version,
+			subject
+		});
+	}
+	return {
+		intentId: intent,
+		operation,
+		expiresAt,
+		keys
+	};
+}
+function parseOutcome(entry) {
+	const detail = payload(entry.metadata);
+	if (detail === null) return "key outcome has no valid accounting payload";
+	const { intent, item, version, subject } = detail;
+	if (typeof intent !== "string" || entry.relatedSeq === null) return "key outcome has no intent identity";
+	if (typeof item !== "number" || !Number.isSafeInteger(item) || item < 0) return "key outcome has no valid item number";
+	const secretId = entry.secretId ?? detail.secretId;
+	if (typeof secretId !== "string" || typeof subject !== "string") return "key outcome has no secret identity";
+	if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key outcome has no valid version";
+	return {
+		intentId: intent,
+		relatedSeq: entry.relatedSeq,
+		item,
+		secretId,
+		version,
+		subject
+	};
+}
+function payload(text) {
+	try {
+		return record(JSON.parse(text));
+	} catch {
+		return null;
+	}
+}
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+//#endregion
+//#region src/checkpoint.ts
+const PKCS8_ED25519 = [
+	48,
+	46,
+	2,
+	1,
+	0,
+	48,
+	5,
+	6,
+	3,
+	43,
+	101,
+	112,
+	4,
+	34,
+	4,
+	32
+];
+/** An Ed25519 signer from a 32-byte seed, over WebCrypto so it runs in Node and in workerd alike. */
+async function signer(seed) {
+	const pkcs8 = new Uint8Array([...PKCS8_ED25519, ...seed]);
+	const privateKey = await crypto.subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
+	const { x } = await crypto.subtle.exportKey("jwk", privateKey);
+	const publicKey = Buffer.from(x, "base64url");
+	const digest = Buffer.from(await crypto.subtle.digest("SHA-256", publicKey));
+	return {
+		publicKey: publicKey.toString("base64"),
+		keyId: digest.toString("hex").slice(0, 16),
+		sign: async (message) => Buffer.from(await crypto.subtle.sign("Ed25519", privateKey, message)).toString("base64")
+	};
+}
+//#endregion
 //#region src/store.ts
 /**
 * On Postgres, fail a lock wait in this transaction after `ms`, rather than
@@ -178,6 +336,26 @@ async function entriesFrom(db, fromSeq, limit) {
 	const { auditLog } = tablesOf(db);
 	return stored(await db.select(entryColumns(db)).from(auditLog).where(gte(auditLog.seq, fromSeq)).orderBy(asc(auditLog.seq)).limit(limit));
 }
+/** Up to `limit` of the vault's entries after `afterSeq`, oldest first: every one, whatever its action or decision. */
+async function vaultEntriesAfter(db, afterSeq, limit) {
+	const { auditLog } = tablesOf(db);
+	return stored(await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), gt(auditLog.seq, afterSeq))).orderBy(asc(auditLog.seq)).limit(limit));
+}
+/** The hash of the entry at each of `seqs` the log holds, by seq. */
+async function hashesAt(db, seqs) {
+	const { auditLog } = tablesOf(db);
+	const hashes = /* @__PURE__ */ new Map();
+	for (let from = 0; from < seqs.length; from += HASHES_AT_ONCE) {
+		const rows = await db.select({
+			seq: auditLog.seq,
+			hash: auditLog.hash
+		}).from(auditLog).where(inArray(auditLog.seq, seqs.slice(from, from + HASHES_AT_ONCE)));
+		for (const { seq, hash } of rows) hashes.set(seq, hash);
+	}
+	return hashes;
+}
+/** How many entries' hashes one query asks for: a checkpoint every five minutes is tens of thousands of a year. */
+const HASHES_AT_ONCE = 5e3;
 /** The entry at `seq`'s hash, or undefined when there is none. */
 async function hashAt(db, seq) {
 	const { auditLog } = tablesOf(db);
@@ -283,7 +461,8 @@ const UNVERIFIED = {
 function further(a, b) {
 	return b.nextSeq > a.nextSeq ? b : a;
 }
-const VERIFY_BATCH = 1e3;
+/** Entries read at once: a few megabytes, well within a Worker's memory, and a fifth of the round trips of 1000. */
+const VERIFY_BATCH = 5e3;
 /**
 * Check the chain, a batch in memory at a time, and return where it is now
 * verified to. Three parts:
@@ -297,9 +476,10 @@ const VERIFY_BATCH = 1e3;
 * So a view rehashes only what is new since the last one. What it leaves
 * out is an entry before the anchor edited in place, not chained again, and
 * not on the page: a full check, which starts from `UNVERIFIED`, finds that,
-* as does the first view after a start, which has no anchor.
+* as does the first view after a start, which has no anchor. `onBatch` sees
+* each batch once it has verified, for checks that read the same entries.
 */
-async function verifyChain(db, logKeys, shown, anchor) {
+async function verifyChain(db, logKeys, shown, anchor, onBatch = () => {}) {
 	const broken = (failedAtSeq, reason) => ({
 		verification: {
 			ok: false,
@@ -333,13 +513,14 @@ async function verifyChain(db, logKeys, shown, anchor) {
 		if (!result.ok) return broken(result.failedAtSeq, result.reason);
 		const moved = forward(batch, verified.vaultKeys, logKeys[0].keyId);
 		if ("failedAtSeq" in moved) return broken(moved.failedAtSeq, moved.reason);
+		onBatch(batch);
 		verified = {
 			nextSeq: result.nextSeq,
 			hash: result.head,
 			vaultEntries: verified.vaultEntries + result.authenticated,
 			vaultKeys: moved.keys
 		};
-		if (batch.length < 1e3) break;
+		if (batch.length < 5e3) break;
 	}
 	return {
 		verification: {
@@ -389,156 +570,7 @@ async function carries(db, head) {
 	return (await hashAt(db, BigInt(head.seq)))?.toString("hex") === head.hash;
 }
 //#endregion
-//#region src/accounting.ts
-const KEY_ACTIONS = /* @__PURE__ */ new Set([
-	"secret.read",
-	"key.wrap",
-	"key.rewrap"
-]);
-/** The chain can hold while a process died between an intent and its outcomes. */
-async function verifyAccounting(db, at) {
-	const intents = /* @__PURE__ */ new Map();
-	const ids = /* @__PURE__ */ new Set();
-	const broken = (entry, reason) => ({
-		ok: false,
-		failedAtSeq: Number(entry.seq),
-		reason
-	});
-	let next = 0n;
-	for (;;) {
-		const batch = await entriesFrom(db, next, VERIFY_BATCH);
-		if (batch.length === 0) break;
-		for (const entry of batch) {
-			if (entry.author !== "vault") continue;
-			if (entry.action === "key.intent") {
-				const parsed = parseIntent(entry);
-				if (typeof parsed === "string") return broken(entry, parsed);
-				if (ids.has(parsed.intentId)) return broken(entry, "key intent repeats an operation identity");
-				ids.add(parsed.intentId);
-				if (parsed.keys.length > 0) intents.set(entry.seq, {
-					...parsed,
-					entry,
-					seen: /* @__PURE__ */ new Set()
-				});
-			} else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
-				const parsed = parseOutcome(entry);
-				if (typeof parsed === "string") return broken(entry, parsed);
-				const intent = intents.get(parsed.relatedSeq);
-				const key = intent?.keys[parsed.item];
-				if (intent === void 0 || key === void 0 || intent.seen.has(parsed.item)) return broken(entry, "key outcome does not identify one item of its intent");
-				if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) return broken(entry, "key outcome belongs to another operation");
-				if (parsed.secretId !== key.secretId || parsed.version !== key.version || parsed.subject !== key.subject) return broken(entry, "key outcome does not match its intended secret");
-				intent.seen.add(parsed.item);
-				if (intent.seen.size === intent.keys.length) intents.delete(intent.entry.seq);
-			}
-		}
-		next = batch[batch.length - 1].seq + 1n;
-		if (batch.length < 1e3) break;
-	}
-	const overdue = [...intents.values()].filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
-	if (overdue.length === 0) return {
-		ok: true,
-		pending: intents.size
-	};
-	const reason = overdue.map((intent) => {
-		const missing = intent.keys.length - intent.seen.size;
-		return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
-	}).join("; ");
-	return broken(overdue[0].entry, reason);
-}
-function parseIntent(entry) {
-	const detail = payload(entry.metadata);
-	if (detail === null) return "key intent has no valid accounting payload";
-	const { intent, operation, expiresAt } = detail;
-	if (typeof intent !== "string") return "key intent has no operation identity";
-	if (typeof operation !== "string" || !KEY_ACTIONS.has(operation)) return "key intent has an invalid operation";
-	if (typeof expiresAt !== "number" || !Number.isSafeInteger(expiresAt) || expiresAt < entry.occurredAt) return "key intent has no valid deadline";
-	if (!Array.isArray(detail.keys)) return "key intent has no valid item list";
-	const keys = [];
-	for (const [index, value] of detail.keys.entries()) {
-		const key = record(value);
-		if (key === null || key.item !== index) return "key intent items are not numbered in order";
-		const { secretId, version, subject } = key;
-		if (typeof secretId !== "string" || typeof subject !== "string") return "key intent item has no secret identity";
-		if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key intent item has no valid version";
-		keys.push({
-			item: index,
-			secretId,
-			version,
-			subject
-		});
-	}
-	return {
-		intentId: intent,
-		operation,
-		expiresAt,
-		keys
-	};
-}
-function parseOutcome(entry) {
-	const detail = payload(entry.metadata);
-	if (detail === null) return "key outcome has no valid accounting payload";
-	const { intent, item, version, subject } = detail;
-	if (typeof intent !== "string" || entry.relatedSeq === null) return "key outcome has no intent identity";
-	if (typeof item !== "number" || !Number.isSafeInteger(item) || item < 0) return "key outcome has no valid item number";
-	const secretId = entry.secretId ?? detail.secretId;
-	if (typeof secretId !== "string" || typeof subject !== "string") return "key outcome has no secret identity";
-	if (typeof version !== "number" || !Number.isSafeInteger(version) || version < 1) return "key outcome has no valid version";
-	return {
-		intentId: intent,
-		relatedSeq: entry.relatedSeq,
-		item,
-		secretId,
-		version,
-		subject
-	};
-}
-function payload(text) {
-	try {
-		return record(JSON.parse(text));
-	} catch {
-		return null;
-	}
-}
-function record(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
-}
-//#endregion
-//#region src/checkpoint.ts
-const PKCS8_ED25519 = [
-	48,
-	46,
-	2,
-	1,
-	0,
-	48,
-	5,
-	6,
-	3,
-	43,
-	101,
-	112,
-	4,
-	34,
-	4,
-	32
-];
-/** An Ed25519 signer from a 32-byte seed, over WebCrypto so it runs in Node and in workerd alike. */
-async function signer(seed) {
-	const pkcs8 = new Uint8Array([...PKCS8_ED25519, ...seed]);
-	const privateKey = await crypto.subtle.importKey("pkcs8", pkcs8, { name: "Ed25519" }, true, ["sign"]);
-	const { x } = await crypto.subtle.exportKey("jwk", privateKey);
-	const publicKey = Buffer.from(x, "base64url");
-	const digest = Buffer.from(await crypto.subtle.digest("SHA-256", publicKey));
-	return {
-		publicKey: publicKey.toString("base64"),
-		keyId: digest.toString("hex").slice(0, 16),
-		sign: async (message) => Buffer.from(await crypto.subtle.sign("Ed25519", privateKey, message)).toString("base64")
-	};
-}
-//#endregion
 //#region src/replay.ts
-const BATCH = 1e3;
 /**
 * Why the members and grants in the database do not follow from the
 * vault's entries, or null when they do; `describeAccessFault` words it.
@@ -548,28 +580,15 @@ const BATCH = 1e3;
 * written around the vault: a grant inserted with the database's own login,
 * a removal undone.
 *
-* Call it after the chain is verified, in the same snapshot, so every entry
-* it replays carries the vault's MAC.
+* `state` is the allowed access entries replayed (`apply`), each after its
+* MAC was checked, in the snapshot `rows` and `stored` were read in.
 *
 * Grants are compared as they are live at `at`. Clearing one that has
 * lapsed changes nothing anyone holds, so it is not logged.
 */
-async function replay(db, at) {
-	const state = {
-		members: /* @__PURE__ */ new Map(),
-		held: /* @__PURE__ */ new Map()
-	};
-	for (let after = -1n;;) {
-		const batch = await vaultEntriesOf(db, ACCESS_ACTIONS, after, BATCH);
-		for (const row of batch) {
-			const fault = apply(state, row);
-			if (fault !== null) return fault;
-		}
-		if (batch.length < BATCH) break;
-		after = batch[batch.length - 1].seq;
-	}
+function replayFault(state, rows, storedGrants, at) {
 	const { members, held } = state;
-	const stored = new Map((await allMembers(db)).map((member) => [member.principal, member]));
+	const stored = new Map(rows.map((member) => [member.principal, member]));
 	for (const principal of [.../* @__PURE__ */ new Set([...stored.keys(), ...members.keys()])].sort()) {
 		const [inStore, inLog] = [stored.get(principal), members.get(principal)];
 		if (inLog === void 0) return {
@@ -589,7 +608,7 @@ async function replay(db, at) {
 	}
 	const live = (grant) => grant.expiresAt === null || grant.expiresAt > at;
 	const logged = new Set([...held.values()].flatMap((grantsOf) => [...grantsOf.values()]).filter(live).map(grantKey));
-	const inStore = new Set((await grants(db)).filter(live).map(grantKey));
+	const inStore = new Set(storedGrants.filter(live).map(grantKey));
 	const extra = [...inStore].sort().find((grant) => !logged.has(grant));
 	if (extra !== void 0) return {
 		kind: "unlogged-grant",
@@ -2072,99 +2091,152 @@ var VaultService = class {
 		};
 	}
 	verifyLog(input) {
-		return this.#verifyAll([], input.upTo ?? null);
-	}
-	/** `shown`, and the chain from `anchor`; the furthest verified is kept for the next check. */
-	async #verify(db, shown, anchor) {
-		const { verification, anchor: reached } = await verifyChain(db, this.#prepared.logKeys, shown, anchor);
-		if (verification.ok) this.#prepared.verified = further(this.#prepared.verified, reached);
-		return verification;
+		return this.#verifyAll(input.upTo ?? null);
 	}
 	/**
-	* `shown`, and the chain from its first entry, in one snapshot: every
-	* link and hash, the vault's MACs; then the heads that must still be
-	* there: the one the app verified up to (`upTo`), so both authors are
-	* checked over the same entries, the one the app last recorded from a
-	* checkpoint (`through`), and the last checkpoint's; and the members and
-	* grants replayed from it.
+	* The whole log, in one snapshot and one pass over the vault's entries:
+	* each by its MAC, the keys it moved through, and what the other checks
+	* need of it, gathered as it goes (`Findings`); then every checkpoint, the
+	* heads that must still be there, the key batches accounted for, and the
+	* members and grants replayed.
+	*
+	* With `upTo`, the head the app verified to, the links and hashes of the
+	* chain are the app's to recompute, as it just has, over its own snapshot,
+	* through that head; `carries(upTo)` ties this snapshot to that one. So
+	* the vault reads only its own entries, each checked against its own hash
+	* and MAC over the link it names. Without `upTo`, nobody else recomputed
+	* the chain: the vault reads it all, and rehashes every link.
 	*/
-	async #verifyAll(shown, upTo) {
+	async #verifyAll(upTo) {
 		await this.#settled();
 		return this.#db.transaction(async (tx) => {
 			const remembered = this.#prepared.verified;
-			const verification = await this.#verify(tx, shown, UNVERIFIED);
-			if (!verification.ok) return verification;
-			if (upTo !== null && !await carries(tx, upTo)) return {
+			const findings = new Findings();
+			const read = upTo === null ? await this.#rehashed(tx, findings) : await this.#ownEntries(tx, findings);
+			if (!read.ok) return read;
+			const heads = [...upTo === null ? [] : [upTo], ...findings.checkpoints.map(({ checkpoint }) => checkpoint)];
+			const rememberedHead = remembered.nextSeq > 0n ? {
+				seq: Number(remembered.nextSeq - 1n),
+				hash: remembered.hash.toString("hex")
+			} : null;
+			if (rememberedHead !== null) heads.push(rememberedHead);
+			const hashes = await hashesAt(tx, [...new Set(heads.map((head) => BigInt(head.seq)))]);
+			const holds = (head) => head.hash === GENESIS_HASH.toString("hex") || hashes.get(BigInt(head.seq))?.toString("hex") === head.hash;
+			if (upTo !== null && !holds(upTo)) return {
 				ok: false,
 				failedAtSeq: upTo.seq,
 				reason: "not the entry the app verified up to: the log changed between the two checks"
 			};
-			const unsigned = await this.#checkpointFault(tx);
+			const unsigned = await this.#checkpointFault(findings, holds);
 			if (unsigned !== null) return unsigned;
-			if (remembered.nextSeq > 0n) {
-				const seq = remembered.nextSeq - 1n;
-				if (!await carries(tx, {
-					seq: Number(seq),
-					hash: remembered.hash.toString("hex")
-				})) return {
-					ok: false,
-					failedAtSeq: Number(seq),
-					reason: "changed since the vault last verified it"
-				};
-			}
+			if (rememberedHead !== null && !holds(rememberedHead)) return {
+				ok: false,
+				failedAtSeq: rememberedHead.seq,
+				reason: "changed since the vault last verified it"
+			};
 			const at = await this.#now(tx);
-			const accounting = await verifyAccounting(tx, at);
+			const accounting = findings.accounting.result(at);
 			if (!accounting.ok) return accounting;
-			const fault = await this.#unsealed(tx) ?? await replay(tx, at);
+			const [rows, held] = await Promise.all([allMembers(tx), grants(tx)]);
+			const fault = this.#unsealed(rows, held, findings.newestAccess) ?? findings.replayFault ?? replayFault(findings.replayed, rows, held, at);
 			if (fault !== null) return {
 				ok: false,
 				failedAtSeq: null,
 				reason: describeAccessFault(fault),
 				fault
 			};
-			return accounting.pending === 0 ? verification : {
-				...verification,
+			const verified = {
+				ok: true,
+				entries: findings.entries
+			};
+			return accounting.pending === 0 ? verified : {
+				...verified,
 				pending: accounting.pending
 			};
 		}, SNAPSHOT);
 	}
 	/**
-	* Every checkpoint, not only the newest: each signed by the key whose log
-	* key wrote its entry, over a prefix the log still holds, entry for entry.
-	* The chain is verified by now, so each checkpoint entry is the vault's,
-	* and one under a key it replaced comes before the rotation.
+	* The vault's own entries, oldest first: each against its own hash, and by
+	* its MAC, over the link it names, which the app checked; and the vault's
+	* keys moving only forward through them.
 	*/
-	async #checkpointFault(db) {
+	async #ownEntries(tx, findings) {
+		const { logKeys } = this.#prepared;
+		let keys = [];
 		for (let after = -1n;;) {
-			const batch = await vaultEntriesOf(db, [CHECKPOINT], after, VERIFY_BATCH);
+			const batch = await vaultEntriesAfter(tx, after, VERIFY_BATCH);
 			for (const entry of batch) {
-				const checkpoint = JSON.parse(entry.metadata);
-				const broken = (reason) => ({
-					ok: false,
-					failedAtSeq: Number(entry.seq),
-					reason
+				const result = verifyEntries([entry], {
+					startSeq: entry.seq,
+					startPrevHash: entry.prevHash,
+					keys: logKeys
 				});
-				const { logKeys, signers } = this.#prepared;
-				const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
-				if (by?.keyId !== checkpoint.keyId) return broken(`a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`);
-				if (!await verifyCheckpoint(checkpoint, by.publicKey)) return broken("a checkpoint the vault did not sign");
-				if (BigInt(checkpoint.seq) >= entry.seq || !await carries(db, checkpoint)) return broken(`the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`);
+				if (!result.ok) return {
+					ok: false,
+					failedAtSeq: Number(result.failedAtSeq),
+					reason: withCause(result.reason)
+				};
 			}
-			if (batch.length < 1e3) return null;
+			const moved = forward(batch, keys, logKeys[0].keyId);
+			if ("failedAtSeq" in moved) return {
+				ok: false,
+				failedAtSeq: Number(moved.failedAtSeq),
+				reason: moved.reason
+			};
+			keys = moved.keys;
+			for (const entry of batch) findings.add(entry);
+			if (batch.length < 5e3) return { ok: true };
 			after = batch[batch.length - 1].seq;
 		}
 	}
+	/** The whole chain from its first entry: every link and hash, the vault's MACs; the furthest verified is kept for checkpoints. */
+	async #rehashed(tx, findings) {
+		const { verification, anchor } = await verifyChain(tx, this.#prepared.logKeys, [], UNVERIFIED, (batch) => {
+			for (const entry of batch) if (entry.author === "vault") findings.add(entry);
+		});
+		if (!verification.ok) return verification;
+		this.#prepared.verified = further(this.#prepared.verified, anchor);
+		return { ok: true };
+	}
+	/**
+	* Every checkpoint, not only the newest: each signed by the key whose log
+	* key wrote its entry, over a prefix the log still holds (`holds`), entry
+	* for entry. Its entry's MAC is checked by now, and one under a key the
+	* vault replaced comes before the rotation.
+	*/
+	async #checkpointFault(findings, holds) {
+		const { logKeys, signers } = this.#prepared;
+		const verifiers = /* @__PURE__ */ new Map();
+		const signed = (checkpoint, by) => {
+			let verifier = verifiers.get(by.keyId);
+			if (verifier === void 0) verifiers.set(by.keyId, verifier = checkpointVerifier(by.publicKey));
+			return verifier.then((verify) => verify(checkpoint));
+		};
+		const { checkpoints } = findings;
+		for (let from = 0; from < checkpoints.length; from += SIGNATURES_AT_ONCE) {
+			const chunk = checkpoints.slice(from, from + SIGNATURES_AT_ONCE);
+			const faults = await Promise.all(chunk.map(async ({ entry, checkpoint }) => {
+				const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
+				if (by?.keyId !== checkpoint.keyId) return `a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`;
+				if (!await signed(checkpoint, by)) return "a checkpoint the vault did not sign";
+				if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint)) return `the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`;
+				return null;
+			}));
+			const at = faults.findIndex((fault) => fault !== null);
+			if (at !== -1) return {
+				ok: false,
+				failedAtSeq: Number(chunk[at].entry.seq),
+				reason: faults[at]
+			};
+		}
+		return null;
+	}
 	/**
 	* The first member whose row fails its MAC, or names an older access
-	* entry than the log's newest about them. The chain is verified by now,
-	* so every entry read here carries the vault's MAC.
+	* entry than the log's newest about them (`newest`, from the full check's
+	* pass, where each entry's MAC was checked).
 	*/
-	async #unsealed(db) {
-		const [rows, held, newest] = await Promise.all([
-			allMembers(db),
-			grants(db),
-			newestAccessEntries(db)
-		]);
+	#unsealed(rows, held, newest) {
 		for (const row of rows) {
 			const grants = held.filter((grant) => grant.principal === row.principal);
 			if (!this.#sealed(row, grants)) return {
@@ -2172,7 +2244,7 @@ var VaultService = class {
 				principal: row.principal,
 				why: "mac"
 			};
-			if (newest.get(row.principal)?.seq !== row.accessSeq) return {
+			if (newest.get(row.principal) !== row.accessSeq) return {
 				kind: "tampered-member",
 				principal: row.principal,
 				why: "stale"
@@ -2181,6 +2253,45 @@ var VaultService = class {
 		return null;
 	}
 };
+/**
+* What one pass over the vault's entries gathers for the other checks of a
+* full verification, so that the log is read once: the key batches, the
+* access entries replayed, each member's newest, and the checkpoints. Each
+* entry comes after its MAC was checked.
+*/
+var Findings = class {
+	accounting = new KeyAccounting();
+	replayed = {
+		members: /* @__PURE__ */ new Map(),
+		held: /* @__PURE__ */ new Map()
+	};
+	/** The first access entry the replay could not apply. */
+	replayFault = null;
+	/** Each member's newest allowed access entry, by seq. */
+	newestAccess = /* @__PURE__ */ new Map();
+	/** Every allowed checkpoint, with its entry's seq and key: tens of thousands a year, so nothing more of it. */
+	checkpoints = [];
+	/** The vault's entries read. */
+	entries = 0;
+	add(entry) {
+		this.entries += 1;
+		this.accounting.add(entry);
+		if (entry.decision !== "allow") return;
+		if (ACCESS.has(entry.action)) {
+			this.replayFault ??= apply(this.replayed, entry);
+			if (entry.subjectPrincipal !== null) this.newestAccess.set(entry.subjectPrincipal, entry.seq);
+		} else if (entry.action === CHECKPOINT) this.checkpoints.push({
+			entry: {
+				seq: entry.seq,
+				keyId: entry.keyId
+			},
+			checkpoint: JSON.parse(entry.metadata)
+		});
+	}
+};
+const ACCESS = new Set(ACCESS_ACTIONS);
+/** Checkpoint signatures checked at once, in a full verification. */
+const SIGNATURES_AT_ONCE = 256;
 /** Settle every operation before releasing the member lock, including cancelled requests. */
 async function settle(operations, budgetMs) {
 	const controller = new AbortController();