@coffre/vault 0.1.12 → 0.1.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.12",
-    "@coffre/db": "0.1.12"
+    "@coffre/core": "0.1.14",
+    "@coffre/db": "0.1.14"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/accounting.ts

@@ -1,9 +1,5 @@
 import type { StoredEntry } from '@coffre/core/audit';
 import type { LogVerification } from '@coffre/core/vault';
-import type { Queryable } from '@coffre/db';
-
-import { VERIFY_BATCH } from './log.ts';
-import { entriesFrom } from './store.ts';
 
 const KEY_ACTIONS = new Set(['secret.read', 'key.wrap', 'key.rewrap']);
 
@@ -13,54 +9,61 @@ type ParsedOutcome = Item & { intentId: string; relatedSeq: bigint };
 type Intent = ParsedIntent & { entry: StoredEntry; seen: Set<number> };
 type Accounting = { ok: true; pending: number } | Extract<LogVerification, { ok: false }>;
 
-/** The chain can hold while a process died between an intent and its outcomes. */
-export async function verifyAccounting(db: Queryable, at: number): Promise<Accounting> {
-  const intents = new Map<bigint, Intent>();
-  const ids = new Set<string>();
-  const broken = (entry: StoredEntry, reason: string): Accounting => ({ ok: false, failedAtSeq: Number(entry.seq), reason });
-  let next = 0n;
-  for (;;) {
-    const batch = await entriesFrom(db, next, VERIFY_BATCH);
-    if (batch.length === 0) break;
-    for (const entry of batch) {
-      if (entry.author !== 'vault') continue;
-      if (entry.action === 'key.intent') {
-        const parsed = parseIntent(entry);
-        if (typeof parsed === 'string') return broken(entry, parsed);
-        if (ids.has(parsed.intentId)) return broken(entry, 'key intent repeats an operation identity');
-        ids.add(parsed.intentId);
-        if (parsed.keys.length > 0) intents.set(entry.seq, { ...parsed, entry, seen: new Set() });
-      } else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
-        // An outcome names its intent; a key released with no service to call has none.
-        const parsed = parseOutcome(entry);
-        if (typeof parsed === 'string') return broken(entry, parsed);
-        const intent = intents.get(parsed.relatedSeq);
-        const key = intent?.keys[parsed.item];
-        if (intent === undefined || key === undefined || intent.seen.has(parsed.item)) {
-          return broken(entry, 'key outcome does not identify one item of its intent');
-        }
-        if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) {
-          return broken(entry, 'key outcome belongs to another operation');
-        }
-        if (parsed.secretId !== key.secretId || parsed.version !== key.version || parsed.subject !== key.subject) {
-          return broken(entry, 'key outcome does not match its intended secret');
-        }
-        intent.seen.add(parsed.item);
-        // Completed batches need no state, and another outcome for one is a duplicate.
-        if (intent.seen.size === intent.keys.length) intents.delete(intent.entry.seq);
+/**
+ * Every key operation's intent and its outcomes, entry by entry, oldest
+ * first, as the full check reads the vault's entries (`add`); then what is
+ * still open (`result`). The chain can hold while a process died between an
+ * intent and its outcomes: only a missed deadline is a fault.
+ */
+export class KeyAccounting {
+  readonly #intents = new Map<bigint, Intent>();
+  readonly #ids = new Set<string>();
+  #fault: Extract<Accounting, { ok: false }> | null = null;
+
+  add(entry: StoredEntry): void {
+    if (this.#fault !== null || entry.author !== 'vault') return;
+    const broken = (reason: string) => {
+      this.#fault = { ok: false, failedAtSeq: Number(entry.seq), reason };
+    };
+    if (entry.action === 'key.intent') {
+      const parsed = parseIntent(entry);
+      if (typeof parsed === 'string') return broken(parsed);
+      if (this.#ids.has(parsed.intentId)) return broken('key intent repeats an operation identity');
+      this.#ids.add(parsed.intentId);
+      if (parsed.keys.length > 0) this.#intents.set(entry.seq, { ...parsed, entry, seen: new Set() });
+    } else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
+      // An outcome names its intent; a key released with no service to call has none.
+      const parsed = parseOutcome(entry);
+      if (typeof parsed === 'string') return broken(parsed);
+      const intent = this.#intents.get(parsed.relatedSeq);
+      const key = intent?.keys[parsed.item];
+      if (intent === undefined || key === undefined || intent.seen.has(parsed.item)) {
+        return broken('key outcome does not identify one item of its intent');
+      }
+      if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) {
+        return broken('key outcome belongs to another operation');
       }
+      if (parsed.secretId !== key.secretId || parsed.version !== key.version || parsed.subject !== key.subject) {
+        return broken('key outcome does not match its intended secret');
+      }
+      intent.seen.add(parsed.item);
+      // Completed batches need no state, and another outcome for one is a duplicate.
+      if (intent.seen.size === intent.keys.length) this.#intents.delete(intent.entry.seq);
     }
-    next = batch[batch.length - 1].seq + 1n;
-    if (batch.length < VERIFY_BATCH) break;
   }
-  // Live calls can finish after this snapshot. Only a missed deadline is a fault.
-  const overdue = [...intents.values()].filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
-  if (overdue.length === 0) return { ok: true, pending: intents.size };
-  const reason = overdue.map((intent) => {
-    const missing = intent.keys.length - intent.seen.size;
-    return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
-  }).join('; ');
-  return broken(overdue[0].entry, reason);
+
+  /** The first fault, or the batches still under way at `at`: live calls can finish after the snapshot. */
+  result(at: number): Accounting {
+    if (this.#fault !== null) return this.#fault;
+    const intents = [...this.#intents.values()];
+    const overdue = intents.filter((intent) => intent.expiresAt <= at).sort((a, b) => a.expiresAt - b.expiresAt);
+    if (overdue.length === 0) return { ok: true, pending: intents.length };
+    const reason = overdue.map((intent) => {
+      const missing = intent.keys.length - intent.seen.size;
+      return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
+    }).join('; ');
+    return { ok: false, failedAtSeq: Number(overdue[0]!.entry.seq), reason };
+  }
 }
 
 function parseIntent(entry: StoredEntry): ParsedIntent | string {

package/src/log.ts

@@ -38,7 +38,8 @@ export function further(a: Anchor, b: Anchor): Anchor {
   return b.nextSeq > a.nextSeq ? b : a;
 }
 
-export const VERIFY_BATCH = 1000;
+/** Entries read at once: a few megabytes, well within a Worker's memory, and a fifth of the round trips of 1000. */
+export const VERIFY_BATCH = 5000;
 
 type Verified = { verification: LogVerification; anchor: Anchor };
 
@@ -55,13 +56,15 @@ type Verified = { verification: LogVerification; anchor: Anchor };
  * So a view rehashes only what is new since the last one. What it leaves
  * out is an entry before the anchor edited in place, not chained again, and
  * not on the page: a full check, which starts from `UNVERIFIED`, finds that,
- * as does the first view after a start, which has no anchor.
+ * as does the first view after a start, which has no anchor. `onBatch` sees
+ * each batch once it has verified, for checks that read the same entries.
  */
 export async function verifyChain(
   db: Queryable,
   logKeys: readonly LogKey[],
   shown: readonly StoredEntry[],
   anchor: Anchor,
+  onBatch: (batch: readonly StoredEntry[]) => void = () => {},
 ): Promise<Verified> {
   const broken = (failedAtSeq: bigint, reason: string): Verified => ({
     verification: { ok: false, failedAtSeq: Number(failedAtSeq), reason: withCause(reason) },
@@ -86,6 +89,7 @@ export async function verifyChain(
     if (!result.ok) return broken(result.failedAtSeq, result.reason);
     const moved = forward(batch, verified.vaultKeys, logKeys[0].keyId);
     if ('failedAtSeq' in moved) return broken(moved.failedAtSeq, moved.reason);
+    onBatch(batch);
     verified = {
       nextSeq: result.nextSeq,
       hash: result.head,
@@ -104,7 +108,7 @@ export async function verifyChain(
  * even one that leaked, verifies what came before the rotation, and nothing
  * after it.
  */
-function forward(
+export function forward(
   entries: readonly StoredEntry[],
   keys: readonly string[],
   current: string,
@@ -130,7 +134,7 @@ function forward(
  * signing key, or from its KEK when it has none. The second is the one an
  * operator can fix.
  */
-function withCause(reason: string): string {
+export function withCause(reason: string): string {
   if (!/^written under vault:\S+, a key this verifier does not hold$/.test(reason)) return reason;
   return `${reason}: either it is forged, or the vault wrote it under another vault key or signing key, which must stay configured: a vault key that was replaced stays in the vault's config, in previousKeks`;
 }

package/src/replay.ts

@@ -1,13 +1,10 @@
 import type { StoredEntry } from '@coffre/core/audit';
 import type { AccessFault, FaultGrant } from '@coffre/core/vault';
-import type { Queryable } from '@coffre/db';
 
-import { ACCESS_ACTIONS, allMembers, grants, vaultEntriesOf, type GrantRow, type Member, type Place } from './store.ts';
+import { ACCESS_ACTIONS, type GrantRow, type Member, type Place } from './store.ts';
 
 export { ACCESS_ACTIONS };
 
-const BATCH = 1000;
-
 /**
  * Why the members and grants in the database do not follow from the
  * vault's entries, or null when they do; `describeAccessFault` words it.
@@ -17,25 +14,15 @@ const BATCH = 1000;
  * written around the vault: a grant inserted with the database's own login,
  * a removal undone.
  *
- * Call it after the chain is verified, in the same snapshot, so every entry
- * it replays carries the vault's MAC.
+ * `state` is the allowed access entries replayed (`apply`), each after its
+ * MAC was checked, in the snapshot `rows` and `stored` were read in.
  *
  * Grants are compared as they are live at `at`. Clearing one that has
  * lapsed changes nothing anyone holds, so it is not logged.
  */
-export async function replay(db: Queryable, at: number): Promise<AccessFault | null> {
-  const state: Replayed = { members: new Map(), held: new Map() };
-  for (let after = -1n; ; ) {
-    const batch = await vaultEntriesOf(db, ACCESS_ACTIONS, after, BATCH);
-    for (const row of batch) {
-      const fault = apply(state, row);
-      if (fault !== null) return fault;
-    }
-    if (batch.length < BATCH) break;
-    after = batch[batch.length - 1].seq;
-  }
+export function replayFault(state: Replayed, rows: readonly Member[], storedGrants: readonly GrantRow[], at: number): AccessFault | null {
   const { members, held } = state;
-  const stored = new Map((await allMembers(db)).map((member) => [member.principal, member]));
+  const stored = new Map(rows.map((member) => [member.principal, member]));
   for (const principal of [...new Set([...stored.keys(), ...members.keys()])].sort()) {
     const [inStore, inLog] = [stored.get(principal), members.get(principal)];
     if (inLog === undefined) return { kind: 'unlogged-member', principal };
@@ -46,7 +33,7 @@ export async function replay(db: Queryable, at: number): Promise<AccessFault | n
 
   const live = (grant: GrantRow) => grant.expiresAt === null || grant.expiresAt > at;
   const logged = new Set([...held.values()].flatMap((grantsOf) => [...grantsOf.values()]).filter(live).map(grantKey));
-  const inStore = new Set((await grants(db)).filter(live).map(grantKey));
+  const inStore = new Set(storedGrants.filter(live).map(grantKey));
   const extra = [...inStore].sort().find((grant) => !logged.has(grant));
   if (extra !== undefined) return { kind: 'unlogged-grant', grant: faultGrant(extra) };
   const missing = [...logged].sort().find((grant) => !inStore.has(grant));

package/src/store.ts

@@ -287,6 +287,35 @@ export async function entriesFrom(db: Queryable, fromSeq: bigint, limit: number)
   return stored(rows);
 }
 
+/** Up to `limit` of the vault's entries after `afterSeq`, oldest first: every one, whatever its action or decision. */
+export async function vaultEntriesAfter(db: Queryable, afterSeq: bigint, limit: number): Promise<StoredEntry[]> {
+  const { auditLog } = tablesOf(db);
+  const rows = await db
+    .select(entryColumns(db))
+    .from(auditLog)
+    .where(and(eq(auditLog.author, 'vault' satisfies Author), gt(auditLog.seq, afterSeq)))
+    .orderBy(asc(auditLog.seq))
+    .limit(limit);
+  return stored(rows);
+}
+
+/** The hash of the entry at each of `seqs` the log holds, by seq. */
+export async function hashesAt(db: Queryable, seqs: readonly bigint[]): Promise<Map<bigint, Buffer>> {
+  const { auditLog } = tablesOf(db);
+  const hashes = new Map<bigint, Buffer>();
+  for (let from = 0; from < seqs.length; from += HASHES_AT_ONCE) {
+    const rows = await db
+      .select({ seq: auditLog.seq, hash: auditLog.hash })
+      .from(auditLog)
+      .where(inArray(auditLog.seq, seqs.slice(from, from + HASHES_AT_ONCE)));
+    for (const { seq, hash } of rows) hashes.set(seq, hash);
+  }
+  return hashes;
+}
+
+/** How many entries' hashes one query asks for: a checkpoint every five minutes is tens of thousands of a year. */
+const HASHES_AT_ONCE = 5000;
+
 /** The entry at `seq`'s hash, or undefined when there is none. */
 export async function hashAt(db: Queryable, seq: bigint): Promise<Buffer | undefined> {
   const { auditLog } = tablesOf(db);

package/src/vault.ts

@@ -9,7 +9,7 @@ import {
   type Permission,
   type Role,
 } from '@coffre/core/access';
-import { verifyEntries, type LogKey, type StoredEntry } from '@coffre/core/audit';
+import { GENESIS_HASH, verifyEntries, type LogKey, type StoredEntry } from '@coffre/core/audit';
 import { checkContext, type SecretContext } from '@coffre/core/envelope';
 import {
   DEK_BYTES,
@@ -26,7 +26,7 @@ import {
 } from '@coffre/core/kek';
 import {
   checkpointMessage,
-  verifyCheckpoint,
+  checkpointVerifier,
   describeAccessFault,
   type Access,
   type AccessChange,
@@ -56,11 +56,11 @@ import type { Database, Queryable, Transaction } from '@coffre/db';
 import { isUniqueViolation, SNAPSHOT } from '@coffre/db/dialect';
 import { appendEntries, lockLogHead, type Appended, type NewEntry } from '@coffre/db/log';
 
-import { verifyAccounting } from './accounting.ts';
+import { KeyAccounting } from './accounting.ts';
 import { signer, type Signer } from './checkpoint.ts';
 import type { ResolvedVaultConfig } from './config.ts';
-import { carries, further, UNVERIFIED, vaultLogKey, VERIFY_BATCH, verifyChain, type Anchor } from './log.ts';
-import { apply, replay, type LoggedMember, type Replayed } from './replay.ts';
+import { carries, forward, further, UNVERIFIED, vaultLogKey, VERIFY_BATCH, verifyChain, withCause, type Anchor } from './log.ts';
+import { apply, replayFault, type LoggedMember, type Replayed } from './replay.ts';
 import { memberMac, rowKey, sameGrants, sealed } from './rows.ts';
 import * as store from './store.ts';
 import { ACCESS_ACTIONS, type GrantRow, type Member } from './store.ts';
@@ -1456,94 +1456,176 @@ class VaultService implements Vault {
   }
 
   verifyLog(input: VerifyLogInput): Promise<LogVerification> {
-    return this.#verifyAll([], input.upTo ?? null);
-  }
-
-  /** `shown`, and the chain from `anchor`; the furthest verified is kept for the next check. */
-  async #verify(db: Queryable, shown: readonly StoredEntry[], anchor: Anchor): Promise<LogVerification> {
-    const { verification, anchor: reached } = await verifyChain(db, this.#prepared.logKeys, shown, anchor);
-    if (verification.ok) this.#prepared.verified = further(this.#prepared.verified, reached);
-    return verification;
+    return this.#verifyAll(input.upTo ?? null);
   }
 
   /**
-   * `shown`, and the chain from its first entry, in one snapshot: every
-   * link and hash, the vault's MACs; then the heads that must still be
-   * there: the one the app verified up to (`upTo`), so both authors are
-   * checked over the same entries, the one the app last recorded from a
-   * checkpoint (`through`), and the last checkpoint's; and the members and
-   * grants replayed from it.
+   * The whole log, in one snapshot and one pass over the vault's entries:
+   * each by its MAC, the keys it moved through, and what the other checks
+   * need of it, gathered as it goes (`Findings`); then every checkpoint, the
+   * heads that must still be there, the key batches accounted for, and the
+   * members and grants replayed.
+   *
+   * With `upTo`, the head the app verified to, the links and hashes of the
+   * chain are the app's to recompute, as it just has, over its own snapshot,
+   * through that head; `carries(upTo)` ties this snapshot to that one. So
+   * the vault reads only its own entries, each checked against its own hash
+   * and MAC over the link it names. Without `upTo`, nobody else recomputed
+   * the chain: the vault reads it all, and rehashes every link.
    */
-  async #verifyAll(shown: readonly StoredEntry[], upTo: LogHead | null): Promise<LogVerification> {
+  async #verifyAll(upTo: LogHead | null): Promise<LogVerification> {
     await this.#settled();
     return this.#db.transaction(async (tx) => {
       const remembered = this.#prepared.verified;
-      const verification = await this.#verify(tx, shown, UNVERIFIED);
-      if (!verification.ok) return verification;
-      if (upTo !== null && !(await carries(tx, upTo))) {
+      const findings = new Findings();
+      const read = upTo === null ? await this.#rehashed(tx, findings) : await this.#ownEntries(tx, findings);
+      if (!read.ok) return read;
+      // Each head the log must still hold, in one read: the app's, every checkpoint's, and the last this vault rehashed.
+      const heads: LogHead[] = [...(upTo === null ? [] : [upTo]), ...findings.checkpoints.map(({ checkpoint }) => checkpoint)];
+      const rememberedHead = remembered.nextSeq > 0n ? { seq: Number(remembered.nextSeq - 1n), hash: remembered.hash.toString('hex') } : null;
+      if (rememberedHead !== null) heads.push(rememberedHead);
+      const hashes = await store.hashesAt(tx, [...new Set(heads.map((head) => BigInt(head.seq)))]);
+      const holds = (head: LogHead) => head.hash === GENESIS_HASH.toString('hex') || hashes.get(BigInt(head.seq))?.toString('hex') === head.hash;
+      if (upTo !== null && !holds(upTo)) {
         return { ok: false, failedAtSeq: upTo.seq, reason: 'not the entry the app verified up to: the log changed between the two checks' };
       }
-      const unsigned = await this.#checkpointFault(tx);
+      const unsigned = await this.#checkpointFault(findings, holds);
       if (unsigned !== null) return unsigned;
       // What this vault last verified must still be there: whoever holds
       // its key can seal a rewrite, but cannot put back the head it saw. A
       // checkpoint names an earlier break, so it is reported first.
-      if (remembered.nextSeq > 0n) {
-        const seq = remembered.nextSeq - 1n;
-        if (!(await carries(tx, { seq: Number(seq), hash: remembered.hash.toString('hex') }))) {
-          return { ok: false, failedAtSeq: Number(seq), reason: 'changed since the vault last verified it' };
-        }
+      if (rememberedHead !== null && !holds(rememberedHead)) {
+        return { ok: false, failedAtSeq: rememberedHead.seq, reason: 'changed since the vault last verified it' };
       }
       const at = await this.#now(tx);
-      const accounting = await verifyAccounting(tx, at);
+      const accounting = findings.accounting.result(at);
       if (!accounting.ok) return accounting;
-      const fault = (await this.#unsealed(tx)) ?? (await replay(tx, at));
+      const [rows, held] = await Promise.all([store.allMembers(tx), store.grants(tx)]);
+      const fault = this.#unsealed(rows, held, findings.newestAccess) ?? findings.replayFault ?? replayFault(findings.replayed, rows, held, at);
       if (fault !== null) return { ok: false, failedAtSeq: null, reason: describeAccessFault(fault), fault };
-      return accounting.pending === 0 ? verification : { ...verification, pending: accounting.pending };
+      const verified = { ok: true as const, entries: findings.entries };
+      return accounting.pending === 0 ? verified : { ...verified, pending: accounting.pending };
     }, SNAPSHOT);
   }
 
   /**
-   * Every checkpoint, not only the newest: each signed by the key whose log
-   * key wrote its entry, over a prefix the log still holds, entry for entry.
-   * The chain is verified by now, so each checkpoint entry is the vault's,
-   * and one under a key it replaced comes before the rotation.
+   * The vault's own entries, oldest first: each against its own hash, and by
+   * its MAC, over the link it names, which the app checked; and the vault's
+   * keys moving only forward through them.
    */
-  async #checkpointFault(db: Queryable): Promise<Extract<LogVerification, { ok: false }> | null> {
+  async #ownEntries(tx: Queryable, findings: Findings): Promise<{ ok: true } | Extract<LogVerification, { ok: false }>> {
+    const { logKeys } = this.#prepared;
+    let keys: readonly string[] = [];
     for (let after = -1n; ; ) {
-      const batch = await store.vaultEntriesOf(db, [CHECKPOINT], after, VERIFY_BATCH);
+      const batch = await store.vaultEntriesAfter(tx, after, VERIFY_BATCH);
       for (const entry of batch) {
-        const checkpoint = JSON.parse(entry.metadata) as Checkpoint;
-        const broken = (reason: string) => ({ ok: false as const, failedAtSeq: Number(entry.seq), reason });
-        const { logKeys, signers } = this.#prepared;
+        const result = verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: logKeys });
+        if (!result.ok) return { ok: false, failedAtSeq: Number(result.failedAtSeq), reason: withCause(result.reason) };
+      }
+      const moved = forward(batch, keys, logKeys[0]!.keyId);
+      if ('failedAtSeq' in moved) return { ok: false, failedAtSeq: Number(moved.failedAtSeq), reason: moved.reason };
+      keys = moved.keys;
+      for (const entry of batch) findings.add(entry);
+      if (batch.length < VERIFY_BATCH) return { ok: true };
+      after = batch[batch.length - 1]!.seq;
+    }
+  }
+
+  /** The whole chain from its first entry: every link and hash, the vault's MACs; the furthest verified is kept for checkpoints. */
+  async #rehashed(tx: Queryable, findings: Findings): Promise<{ ok: true } | Extract<LogVerification, { ok: false }>> {
+    const { verification, anchor } = await verifyChain(tx, this.#prepared.logKeys, [], UNVERIFIED, (batch) => {
+      for (const entry of batch) if (entry.author === 'vault') findings.add(entry);
+    });
+    if (!verification.ok) return verification;
+    this.#prepared.verified = further(this.#prepared.verified, anchor);
+    return { ok: true };
+  }
+
+  /**
+   * Every checkpoint, not only the newest: each signed by the key whose log
+   * key wrote its entry, over a prefix the log still holds (`holds`), entry
+   * for entry. Its entry's MAC is checked by now, and one under a key the
+   * vault replaced comes before the rotation.
+   */
+  async #checkpointFault(findings: Findings, holds: (head: LogHead) => boolean): Promise<Extract<LogVerification, { ok: false }> | null> {
+    const { logKeys, signers } = this.#prepared;
+    // Each signer's key imported once, for this check only.
+    const verifiers = new Map<string, Promise<(checkpoint: Checkpoint) => Promise<boolean>>>();
+    const signed = (checkpoint: Checkpoint, by: Signer) => {
+      let verifier = verifiers.get(by.keyId);
+      if (verifier === undefined) verifiers.set(by.keyId, (verifier = checkpointVerifier(by.publicKey)));
+      return verifier.then((verify) => verify(checkpoint));
+    };
+    const { checkpoints } = findings;
+    for (let from = 0; from < checkpoints.length; from += SIGNATURES_AT_ONCE) {
+      const chunk = checkpoints.slice(from, from + SIGNATURES_AT_ONCE);
+      // The signatures of a chunk at once, where crypto runs beside the code; the first fault, in the log's order.
+      const faults = await Promise.all(chunk.map(async ({ entry, checkpoint }) => {
         const by = signers[logKeys.findIndex((key) => key.keyId === entry.keyId)];
-        if (by?.keyId !== checkpoint.keyId) return broken(`a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`);
-        if (!(await verifyCheckpoint(checkpoint, by.publicKey))) return broken('a checkpoint the vault did not sign');
-        if (BigInt(checkpoint.seq) >= entry.seq || !(await carries(db, checkpoint))) {
-          return broken(`the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`);
+        if (by?.keyId !== checkpoint.keyId) return `a checkpoint signed under ${checkpoint.keyId}, in an entry written under ${entry.keyId}: each key signs only its own`;
+        if (!(await signed(checkpoint, by))) return 'a checkpoint the vault did not sign';
+        if (BigInt(checkpoint.seq) >= entry.seq || !holds(checkpoint)) {
+          return `the log up to entry ${checkpoint.seq} is not the prefix this checkpoint signed: it was rewritten`;
         }
-      }
-      if (batch.length < VERIFY_BATCH) return null;
-      after = batch[batch.length - 1].seq;
+        return null;
+      }));
+      const at = faults.findIndex((fault) => fault !== null);
+      if (at !== -1) return { ok: false, failedAtSeq: Number(chunk[at]!.entry.seq), reason: faults[at]! };
     }
+    return null;
   }
 
   /**
    * The first member whose row fails its MAC, or names an older access
-   * entry than the log's newest about them. The chain is verified by now,
-   * so every entry read here carries the vault's MAC.
+   * entry than the log's newest about them (`newest`, from the full check's
+   * pass, where each entry's MAC was checked).
    */
-  async #unsealed(db: Queryable): Promise<AccessFault | null> {
-    const [rows, held, newest] = await Promise.all([store.allMembers(db), store.grants(db), store.newestAccessEntries(db)]);
+  #unsealed(rows: readonly Member[], held: readonly GrantRow[], newest: ReadonlyMap<string, bigint>): AccessFault | null {
     for (const row of rows) {
       const grants = held.filter((grant) => grant.principal === row.principal);
       if (!this.#sealed(row, grants)) return { kind: 'tampered-member', principal: row.principal, why: 'mac' };
-      if (newest.get(row.principal)?.seq !== row.accessSeq) return { kind: 'tampered-member', principal: row.principal, why: 'stale' };
+      if (newest.get(row.principal) !== row.accessSeq) return { kind: 'tampered-member', principal: row.principal, why: 'stale' };
     }
     return null;
   }
 }
 
+/**
+ * What one pass over the vault's entries gathers for the other checks of a
+ * full verification, so that the log is read once: the key batches, the
+ * access entries replayed, each member's newest, and the checkpoints. Each
+ * entry comes after its MAC was checked.
+ */
+class Findings {
+  readonly accounting = new KeyAccounting();
+  readonly replayed: Replayed = { members: new Map(), held: new Map() };
+  /** The first access entry the replay could not apply. */
+  replayFault: AccessFault | null = null;
+  /** Each member's newest allowed access entry, by seq. */
+  readonly newestAccess = new Map<string, bigint>();
+  /** Every allowed checkpoint, with its entry's seq and key: tens of thousands a year, so nothing more of it. */
+  readonly checkpoints: { entry: { seq: bigint; keyId: string }; checkpoint: Checkpoint }[] = [];
+  /** The vault's entries read. */
+  entries = 0;
+
+  add(entry: StoredEntry): void {
+    this.entries += 1;
+    this.accounting.add(entry);
+    if (entry.decision !== 'allow') return;
+    if (ACCESS.has(entry.action)) {
+      this.replayFault ??= apply(this.replayed, entry);
+      if (entry.subjectPrincipal !== null) this.newestAccess.set(entry.subjectPrincipal, entry.seq);
+    } else if (entry.action === CHECKPOINT) {
+      this.checkpoints.push({ entry: { seq: entry.seq, keyId: entry.keyId }, checkpoint: JSON.parse(entry.metadata) as Checkpoint });
+    }
+  }
+}
+
+const ACCESS = new Set<string>(ACCESS_ACTIONS);
+
+/** Checkpoint signatures checked at once, in a full verification. */
+const SIGNATURES_AT_ONCE = 256;
+
 /** Settle every operation before releasing the member lock, including cancelled requests. */
 async function settle<T extends { wipe: () => void }>(
   operations: ((operation: KeyOperation) => Promise<T | null>)[],