@coffre/vault 0.10.0 → 0.10.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.10.0",
-    "@coffre/db": "0.10.0"
+    "@coffre/core": "0.10.2",
+    "@coffre/db": "0.10.2"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/accounting.ts

@@ -7,19 +7,48 @@ type Item = { item: number; secretId: string; version: number; subject: string }
 type ParsedIntent = { intentId: string; operation: string; expiresAt: number; keys: Item[] };
 /** An outcome entry: one item of its intent, or several, for a read logged once per place. */
 type ParsedOutcome = { intentId: string; relatedSeq: bigint; items: Item[] };
-type Intent = ParsedIntent & { entry: StoredEntry; seen: Set<number> };
+type Intent = ParsedIntent & { seq: bigint; actor: string; seen: Set<number> };
 type Accounting = { ok: true; pending: number } | Extract<LogVerification, { ok: false }>;
+type Broken = Extract<Accounting, { ok: false }>;
+
+/** A key batch still under way, as a checkpoint keeps it: its intent's entry, and the items whose outcomes are logged. */
+export type OpenIntent = { seq: number; intentId: string; operation: string; expiresAt: number; actor: string; keys: Item[]; seen: number[] };
+
+/** Where the accounting stands, as a checkpoint keeps it: the batches still open, and the first fault, once found. */
+export type AccountingState = { intents: OpenIntent[]; fault: { failedAtSeq: number; reason: string } | null };
 
 /**
  * Every key operation's intent and its outcomes, entry by entry, oldest
- * first, as the full check reads the vault's entries (`add`); then what is
- * still open (`result`). The chain can hold while a process died between an
+ * first, as a walk reads the vault's entries (`add`); then what is still
+ * open (`result`). The chain can hold while a process died between an
  * intent and its outcomes: only a missed deadline is a fault.
+ *
+ * A walk resumes from a checkpoint's `state()`: the batches open there, and
+ * nothing of those that closed. So an intent's identity is checked against
+ * those still open and those since, not every one the log ever held: a
+ * closed batch takes no more outcomes in any case, since each names its
+ * intent's entry.
  */
 export class KeyAccounting {
   readonly #intents = new Map<bigint, Intent>();
   readonly #ids = new Set<string>();
-  #fault: Extract<Accounting, { ok: false }> | null = null;
+  #fault: Broken | null = null;
+
+  constructor(from: AccountingState = { intents: [], fault: null }) {
+    for (const { seq, seen, ...open } of from.intents) {
+      this.#intents.set(BigInt(seq), { ...open, seq: BigInt(seq), seen: new Set(seen) });
+      this.#ids.add(open.intentId);
+    }
+    this.#fault = from.fault === null ? null : { ok: false, ...from.fault };
+  }
+
+  /** Where it stands, to resume from: the batches open, oldest first. */
+  state(): AccountingState {
+    const intents = [...this.#intents.values()]
+      .sort((a, b) => (a.seq < b.seq ? -1 : 1))
+      .map(({ seq, seen, ...open }) => ({ ...open, seq: Number(seq), seen: [...seen].sort((a, b) => a - b) }));
+    return { intents, fault: this.#fault === null ? null : { failedAtSeq: this.#fault.failedAtSeq!, reason: this.#fault.reason } };
+  }
 
   add(entry: StoredEntry): void {
     if (this.#fault !== null || entry.author !== 'vault') return;
@@ -31,7 +60,7 @@ export class KeyAccounting {
       if (typeof parsed === 'string') return broken(parsed);
       if (this.#ids.has(parsed.intentId)) return broken('key intent repeats an operation identity');
       this.#ids.add(parsed.intentId);
-      if (parsed.keys.length > 0) this.#intents.set(entry.seq, { ...parsed, entry, seen: new Set() });
+      if (parsed.keys.length > 0) this.#intents.set(entry.seq, { ...parsed, seq: entry.seq, actor: entry.actor, seen: new Set() });
     } else if (KEY_ACTIONS.has(entry.action) && entry.relatedSeq !== null) {
       // An outcome names its intent; a key released with no service to call has none.
       const parsed = parseOutcome(entry);
@@ -42,7 +71,7 @@ export class KeyAccounting {
         if (intent === undefined || key === undefined || intent.seen.has(outcome.item)) {
           return broken('key outcome does not identify one item of its intent');
         }
-        if (parsed.intentId !== intent.intentId || entry.actor !== intent.entry.actor || entry.action !== intent.operation) {
+        if (parsed.intentId !== intent.intentId || entry.actor !== intent.actor || entry.action !== intent.operation) {
           return broken('key outcome belongs to another operation');
         }
         if (outcome.secretId !== key.secretId || outcome.version !== key.version || outcome.subject !== key.subject) {
@@ -51,7 +80,7 @@ export class KeyAccounting {
         intent.seen.add(outcome.item);
       }
       // Completed batches need no state, and another outcome for one is a duplicate.
-      if (intent !== undefined && intent.seen.size === intent.keys.length) this.#intents.delete(intent.entry.seq);
+      if (intent !== undefined && intent.seen.size === intent.keys.length) this.#intents.delete(intent.seq);
     }
   }
 
@@ -65,7 +94,7 @@ export class KeyAccounting {
       const missing = intent.keys.length - intent.seen.size;
       return `key intent ${intent.intentId} is overdue: ${missing} of ${intent.keys.length} outcomes missing`;
     }).join('; ');
-    return { ok: false, failedAtSeq: Number(overdue[0]!.entry.seq), reason };
+    return { ok: false, failedAtSeq: Number(overdue[0]!.seq), reason };
   }
 }
 

package/src/config.ts

@@ -2,13 +2,14 @@ import { hkdfSync } from 'node:crypto';
 
 import { KekRegistry, LocalKekProvider, type KekProvider } from '@coffre/core/kek';
 
-/** At most `count` data keys unwrapped per principal in any `windowMs`. */
+/** At most `count` distinct data keys unwrapped per principal in any `windowMs`. */
 export type BulkLimit = { count: number; windowMs: number };
 
 /**
- * 1000 keys in 15 minutes: twenty `coffre run`s of a 50-key environment
- * back to back, which no person or deploy pipeline does, while a script
- * pulling every secret it can reach stops within a few seconds.
+ * 1000 different keys in 15 minutes, which no person or deploy pipeline
+ * reads, while a script pulling every secret it can reach stops within a
+ * few seconds. A key read again counts once: a 50-key `coffre run` is 50
+ * however often it runs.
  */
 export const DEFAULT_BULK_LIMIT: BulkLimit = { count: 1000, windowMs: 15 * 60_000 };
 
@@ -62,7 +63,7 @@ export type VaultConfig = {
    * service holds the KEK, as AWS KMS does: the vault never sees that key.
    */
   signingKey?: string;
-  /** At most `count` data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
+  /** At most `count` distinct data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
   bulkLimit?: { count: number; windowMinutes: number };
   /**
    * @deprecated Gone in 0.10, and refused: each key says who sees it now. Mark

package/src/log.ts

@@ -2,7 +2,8 @@ import { deriveLogKey, GENESIS_HASH, verifyEntries, type LogKey, type StoredEntr
 import type { LogHead, LogVerification } from '@coffre/core/vault';
 import type { Queryable } from '@coffre/db';
 
-import { entriesFrom, hashAt } from './store.ts';
+import { entriesFrom, hashAt, vaultEntriesAfter } from './store.ts';
+import type { Walk } from './tally.ts';
 
 /**
  * The vault's half of the one audit log: its entries are the ones it
@@ -21,83 +22,113 @@ export function vaultLogKey(signingKey: Uint8Array): LogKey {
   return deriveLogKey('vault', signingKey);
 }
 
-/**
- * How far this process has verified the chain: every entry before
- * `nextSeq`, the last of which has `hash`, with `vaultEntries` of the
- * vault's among them, written under `vaultKeys`, in the order the log moved
- * through them (`forward`). In memory only: the database cannot vouch for
- * itself.
- */
-export type Anchor = { nextSeq: bigint; hash: Buffer; vaultEntries: number; vaultKeys: readonly string[] };
+/** Where a walk of the log stands: the last entry it covered, -1 before the first, and that entry's hash. */
+export type Position = { seq: bigint; hash: Buffer };
 
-/** Before the first entry: nothing verified yet. */
-export const UNVERIFIED: Anchor = { nextSeq: 0n, hash: GENESIS_HASH, vaultEntries: 0, vaultKeys: [] };
+/** Before the first entry. */
+export const START: Position = { seq: -1n, hash: GENESIS_HASH };
 
-/** The further of two anchors, when two calls verified at once. */
-export function further(a: Anchor, b: Anchor): Anchor {
-  return b.nextSeq > a.nextSeq ? b : a;
+/** The further of two positions, when two calls walked at once. */
+export function further(a: Position, b: Position): Position {
+  return b.seq > a.seq ? b : a;
 }
 
 /** Entries read at once, at most, and no more than `BATCH_BYTES` of what they say: well within a Worker's memory, and a fifth of the round trips of 1000. */
 export const VERIFY_BATCH = 5000;
 
-type Verified = { verification: LogVerification; anchor: Anchor };
+type Broken = Extract<LogVerification, { ok: false }>;
 
 /**
- * Check the chain, a batch in memory at a time, and return where it is now
- * verified to. Three parts:
+ * Walk the chain on from `from`, a batch in memory at a time, through `to`
+ * or the log's last entry, and no more than `limit` entries: every link and
+ * hash recomputed, each of the vault's entries by its MAC, its keys moving
+ * only forward, and each fed to `walk`. Where it got to, and whether that
+ * is as far as it was to go: a walk cut short by `limit` goes on from there
+ * another time.
  *
- * - `shown`, the page a reader is looking at: each entry against its own
- *   hash and MAC;
- * - `anchor`, the head at the last check: still there, unchanged. A rewrite
- *   of anything before it, chained again to hide, changes its hash;
- * - every entry after the anchor, or from the first.
- *
- * So a view rehashes only what is new since the last one. What it leaves
- * out is an entry before the anchor edited in place, not chained again, and
- * not on the page: a full check, which starts from `UNVERIFIED`, finds that,
- * as does the first view after a start, which has no anchor. `onBatch` sees
- * each batch once it has verified, for checks that read the same entries.
+ * It takes `from` as given: whether the log still holds it is the caller's
+ * to check, with the other heads it must hold, in one read.
  */
-export async function verifyChain(
+export async function rehash(
   db: Queryable,
   logKeys: readonly LogKey[],
-  shown: readonly StoredEntry[],
-  anchor: Anchor,
-  onBatch: (batch: readonly StoredEntry[]) => void = () => {},
-): Promise<Verified> {
-  const broken = (failedAtSeq: bigint, reason: string): Verified => ({
-    verification: { ok: false, failedAtSeq: Number(failedAtSeq), reason: withCause(reason) },
-    anchor,
-  });
-  const keys = { keys: logKeys, chainOnly: ['app' as const] };
-
-  for (const row of [...shown].sort((a, b) => (a.seq < b.seq ? -1 : 1))) {
-    const result = verifyEntries([row], { ...keys, startSeq: row.seq, startPrevHash: row.prevHash });
-    if (!result.ok) return broken(result.failedAtSeq, result.reason);
+  from: Position,
+  walk: Walk,
+  { to, limit = Infinity }: { to?: bigint; limit?: number },
+): Promise<{ ok: true; at: Position; done: boolean } | Broken> {
+  let at = from;
+  for (let left = limit; ; ) {
+    if (to !== undefined && at.seq >= to) return { ok: true, at, done: true };
+    // Out of entries to walk, it is done if there are none left to: a walk that ends at its budget's last read one more.
+    if (left <= 0) return { ok: true, at, done: !(await entriesFrom(db, at.seq + 1n, 1)).some((entry) => to === undefined || entry.seq <= to) };
+    let batch = await entriesFrom(db, at.seq + 1n, Math.min(VERIFY_BATCH, left));
+    if (to !== undefined) batch = batch.filter((entry) => entry.seq <= to);
+    if (batch.length === 0) return { ok: true, at, done: to === undefined };
+    const result = verifyEntries(batch, { keys: logKeys, chainOnly: ['app'], startSeq: at.seq + 1n, startPrevHash: at.hash });
+    if (!result.ok) return { ok: false, failedAtSeq: Number(result.failedAtSeq), reason: withCause(result.reason) };
+    for (const entry of batch) {
+      const moved = entry.author === 'vault' ? walk.add(entry, logKeys[0]!.keyId) : null;
+      if (moved !== null) return { ok: false, failedAtSeq: Number(moved.failedAtSeq), reason: moved.reason };
+    }
+    at = { seq: result.nextSeq - 1n, hash: result.head };
+    left -= batch.length;
   }
+}
 
-  if (anchor.nextSeq > 0n && !(await hashAt(db, anchor.nextSeq - 1n))?.equals(anchor.hash)) {
-    return broken(anchor.nextSeq - 1n, 'changed since the vault last verified it');
+/**
+ * The chain again from `from`, through `to` and no more than `limit`
+ * entries: each hash recomputed from its entry and each link checked, and
+ * nothing else, so a stretch costs a hash an entry. What a checkpoint does
+ * in the background to the prefixes signed before (`#scrub` in vault.ts):
+ * each entry's MAC was checked when it was signed over, and its hash pins
+ * it since, so all that can change behind a signed prefix and keep the
+ * chain is an entry edited in place, its stored hash left, which its hash
+ * finds.
+ */
+export async function relink(db: Queryable, from: Position, to: bigint, limit: number): Promise<{ ok: true; at: Position } | Broken> {
+  let at = from;
+  while (at.seq < to && limit > 0) {
+    const batch = (await entriesFrom(db, at.seq + 1n, Math.min(VERIFY_BATCH, limit))).filter((entry) => entry.seq <= to);
+    if (batch.length === 0) break;
+    const result = verifyEntries(batch, { keys: [], chainOnly: ['app', 'vault'], startSeq: at.seq + 1n, startPrevHash: at.hash });
+    if (!result.ok) return { ok: false, failedAtSeq: Number(result.failedAtSeq), reason: result.reason };
+    at = { seq: result.nextSeq - 1n, hash: result.head };
+    limit -= batch.length;
   }
+  return { ok: true, at };
+}
 
-  let verified = anchor;
-  for (;;) {
-    const batch = await entriesFrom(db, verified.nextSeq, VERIFY_BATCH);
-    if (batch.length === 0) break;
-    const result = verifyEntries(batch, { ...keys, startSeq: verified.nextSeq, startPrevHash: verified.hash });
-    if (!result.ok) return broken(result.failedAtSeq, result.reason);
-    const moved = forward(batch, verified.vaultKeys, logKeys[0].keyId);
-    if ('failedAtSeq' in moved) return broken(moved.failedAtSeq, moved.reason);
-    onBatch(batch);
-    verified = {
-      nextSeq: result.nextSeq,
-      hash: result.head,
-      vaultEntries: verified.vaultEntries + result.authenticated,
-      vaultKeys: moved.keys,
-    };
+/**
+ * The vault's own entries after `after`, through `to` or its last, no more
+ * than `limit` of them, oldest first: each against its own hash, and by its
+ * MAC, over the link it names, its keys moving only forward, each fed to
+ * `walk`. The links between entries are the caller's to recompute, as the
+ * app does over the same stretch. The last it read, and whether that is as
+ * far as it was to go.
+ */
+export async function ownEntries(
+  db: Queryable,
+  logKeys: readonly LogKey[],
+  after: bigint,
+  walk: Walk,
+  { to, limit = Infinity }: { to?: bigint; limit?: number },
+): Promise<{ ok: true; at: bigint; done: boolean } | Broken> {
+  for (let left = limit; ; ) {
+    if (left <= 0) return { ok: true, at: after, done: !(await vaultEntriesAfter(db, after, 1)).some((entry) => to === undefined || entry.seq <= to) };
+    let batch = await vaultEntriesAfter(db, after, Math.min(VERIFY_BATCH, left));
+    if (to !== undefined) batch = batch.filter((entry) => entry.seq <= to);
+    if (batch.length === 0) return { ok: true, at: after, done: true };
+    for (const entry of batch) {
+      const result = verifyEntries([entry], { startSeq: entry.seq, startPrevHash: entry.prevHash, keys: logKeys });
+      if (!result.ok) return { ok: false, failedAtSeq: Number(result.failedAtSeq), reason: withCause(result.reason) };
+    }
+    for (const entry of batch) {
+      const moved = walk.add(entry, logKeys[0]!.keyId);
+      if (moved !== null) return { ok: false, failedAtSeq: Number(moved.failedAtSeq), reason: moved.reason };
+    }
+    after = batch[batch.length - 1]!.seq;
+    left -= batch.length;
   }
-  return { verification: { ok: true, entries: verified.vaultEntries }, anchor: verified };
 }
 
 /**

package/src/replay.ts

@@ -141,7 +141,7 @@ function placeOf(row: StoredEntry, detail: Record<string, unknown>): Place {
 }
 
 /** A grant's place: its environment, or its project when it has none, or every project's path. */
-function placeKey(place: Place): string {
+export function placeKey(place: Place): string {
   return place.environmentId ?? place.projectId ?? (place.environmentSlug === null ? '*' : `*/${place.environmentSlug}`);
 }
 

package/src/snapshot.postgres.ts

@@ -0,0 +1,97 @@
+import { TOMBSTONE } from '@coffre/core/schemas';
+import { ACCESS_ACTIONS } from '@coffre/core/vault';
+import { sql, type SQL } from 'drizzle-orm';
+
+import type { Asked } from './snapshot.ts';
+
+/** An entry of `audit_log` aliased `e`, as JSON (`RawEntry`): whole numbers past 2^53 as text, bytes as hex. */
+const ENTRY = sql.raw(`json_build_object(
+  'seq', e.seq::text, 'author', e.author, 'keyId', e.key_id, 'occurredAt', e.occurred_at, 'actor', e.actor, 'action', e.action,
+  'decision', e.decision, 'code', e.code, 'subjectPrincipal', e.subject_principal, 'projectId', e.project_id,
+  'environmentId', e.environment_id, 'secretId', e.secret_id, 'secretVersionId', e.secret_version_id,
+  'operationId', e.operation_id, 'requestId', e.request_id, 'sourceIp', e.source_ip, 'relatedSeq', e.related_seq::text,
+  'metadata', e.metadata, 'prevHash', encode(e.prev_hash, 'hex'), 'mac', encode(e.mac, 'hex'), 'hash', encode(e.hash, 'hex'))`);
+
+const NOW = sql.raw('(extract(epoch from clock_timestamp()) * 1000)::bigint');
+
+/** `snapshot`'s statement on Postgres: one row, one JSON column. Each part reads one index range. */
+export function snapshotQuery(asked: Asked): SQL {
+  const principals = sql`${sql.param([...asked.principals])}::text[]`;
+  const environments = sql`${sql.param([...(asked.environments ?? [])])}::uuid[]`;
+  const references = sql`${sql.param((asked.references ?? []).map(String))}::bigint[]`;
+  const actions = sql`${sql.param([...ACCESS_ACTIONS])}::text[]`;
+  const tomb = `%${TOMBSTONE}%`;
+  const released = asked.released;
+  // The head only if nobody holds it: a statement never waits for it, so all it reads is as of when it took it (`snapshot`).
+  const head = asked.head === true
+    ? sql`, head AS (SELECT next_seq, head_hash FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED)`
+    : sql``;
+  return sql`
+    WITH policy AS (
+      SELECT * FROM audit_log WHERE author = 'vault' AND action = 'policy.change' AND decision = 'allow' ORDER BY seq DESC LIMIT 1
+    )${head}
+    SELECT json_build_object(
+      'at', ${NOW},
+      'head', ${asked.head === true ? sql`(SELECT json_build_object('nextSeq', next_seq::text, 'hash', encode(head_hash, 'hex')) FROM head)` : sql`NULL`},
+      'last', ${asked.head === true ? sql`(SELECT json_build_object('seq', seq::text, 'hash', encode(hash, 'hex')) FROM audit_log ORDER BY seq DESC LIMIT 1)` : sql`NULL`},
+      'rotation', ${asked.head === true
+        ? sql`(SELECT ${ENTRY} FROM audit_log e WHERE author = 'vault' AND action = 'key.rotate' AND decision = 'allow' ORDER BY seq DESC LIMIT 1)`
+        : sql`NULL`},
+      'members', ${asked.members === true
+        ? sql`(SELECT coalesce(json_agg(json_build_object(
+            'principal', principal, 'status', status, 'owner', owner, 'role', role, 'scope', scope, 'generation', generation,
+            'createdAt', created_at, 'createdBy', created_by, 'statusChangedAt', status_changed_at, 'statusChangedBy', status_changed_by,
+            'accessSeq', access_seq::text, 'mac', encode(mac, 'hex'))), '[]') FROM vault_members WHERE principal = ANY(${principals}))`
+        : sql`'[]'::json`},
+      'grants', (
+        SELECT coalesce(json_agg(json_build_object(
+          'principal', g.principal, 'projectId', coalesce(g.project_id, env.project_id), 'environmentId', g.environment_id,
+          'environmentSlug', g.environment_slug, 'role', g.role, 'expiresAt', g.expires_at, 'grantedAt', g.granted_at, 'grantedBy', g.granted_by)), '[]')
+        FROM vault_grants g LEFT JOIN environments env ON env.id = g.environment_id
+        WHERE g.principal = ANY(${principals})
+      ),
+      'access', (
+        SELECT coalesce(json_agg(${ENTRY}), '[]')
+        FROM unnest(${principals}) AS asked (principal)
+        CROSS JOIN LATERAL (
+          SELECT * FROM audit_log
+          WHERE author = 'vault' AND subject_principal = asked.principal AND action = ANY(${actions}) AND decision = 'allow'
+          ORDER BY seq DESC LIMIT 1
+        ) e
+      ),
+      'policy', (SELECT ${ENTRY} FROM policy e),
+      'environments', (
+        SELECT coalesce(json_agg(json_build_object(
+          'id', env.id, 'projectId', env.project_id, 'slug', env.slug, 'owner', env.owner, 'parentId', env.parent_id,
+          'deleted', env.slug LIKE ${tomb} OR project.slug LIKE ${tomb},
+          'archived', env.archived_at IS NOT NULL OR project.archived_at IS NOT NULL)), '[]')
+        FROM environments env JOIN projects project ON project.id = env.project_id
+        -- One list of ids, each found by the primary key.
+        WHERE env.id = ANY(ARRAY(
+          SELECT unnest(${environments})
+          UNION SELECT parent_id FROM environments WHERE id = ANY(${environments}) AND owner IS NOT NULL
+          -- What the newest policy protects, by the ids its JSON names; one that is no UUID names nothing.
+          UNION SELECT (place #>> '{}')::uuid FROM policy, jsonb_path_query(policy.metadata::jsonb, '$.policy.protected[*].environmentId') AS place
+          WHERE (place #>> '{}') ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+        ))
+      ),
+      'ended', (
+        SELECT coalesce(json_agg(related_seq::text), '[]') FROM audit_log
+        WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq = ANY(${references})
+      ),
+      'released', ${released === undefined
+        ? sql`0`
+        : sql`(
+          SELECT count(DISTINCT key) FROM (
+            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
+            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
+            SELECT coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq) FROM audit_log e
+            -- Each item of a list, never what lax paths would make of an object; silent, as strict paths fail on what is missing.
+            LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
+              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
+            UNION ALL SELECT unnest(${sql.param([...released.keys])}::text[])
+          ) AS released (key)
+        )`}
+    ) AS snapshot`;
+}

package/src/snapshot.sqlite.ts

@@ -0,0 +1,103 @@
+import { TOMBSTONE } from '@coffre/core/schemas';
+import { ACCESS_ACTIONS } from '@coffre/core/vault';
+import { sql, type SQL } from 'drizzle-orm';
+
+import type { Asked } from './snapshot.ts';
+
+/**
+ * An entry of `audit_log` aliased `e`, as JSON (`RawEntry`), bytes as hex.
+ * A JSON value loses its type leaving a subquery, so whoever takes one
+ * from a subquery wraps it in `json(…)`.
+ */
+const ENTRY = sql.raw(`json_object(
+  'seq', e.seq, 'author', e.author, 'keyId', e.key_id, 'occurredAt', e.occurred_at, 'actor', e.actor, 'action', e.action,
+  'decision', e.decision, 'code', e.code, 'subjectPrincipal', e.subject_principal, 'projectId', e.project_id,
+  'environmentId', e.environment_id, 'secretId', e.secret_id, 'secretVersionId', e.secret_version_id,
+  'operationId', e.operation_id, 'requestId', e.request_id, 'sourceIp', e.source_ip, 'relatedSeq', e.related_seq,
+  'metadata', e.metadata, 'prevHash', hex(e.prev_hash), 'mac', hex(e.mac), 'hash', hex(e.hash))`);
+
+const NOW = sql.raw(`CAST(unixepoch('subsec') * 1000 AS INTEGER)`);
+
+/**
+ * `snapshot`'s statement on SQLite, the same as on Postgres. Nothing is
+ * locked: one transaction runs at a time (connect.ts), so the head is the
+ * last entry's.
+ */
+export function snapshotQuery(asked: Asked): SQL {
+  const principals = JSON.stringify(asked.principals);
+  const environments = JSON.stringify(asked.environments ?? []);
+  const references = JSON.stringify((asked.references ?? []).map(Number));
+  const actions = JSON.stringify(ACCESS_ACTIONS);
+  const tomb = `%${TOMBSTONE}%`;
+  const released = asked.released;
+  const head = asked.head === true;
+  return sql`
+    WITH policy AS (
+      SELECT * FROM audit_log WHERE author = 'vault' AND action = 'policy.change' AND decision = 'allow' ORDER BY seq DESC LIMIT 1
+    )
+    SELECT json_object(
+      'at', ${NOW},
+      'head', ${head ? sql`json((SELECT json_object('nextSeq', next_seq, 'hash', hex(head_hash)) FROM audit_chain_head WHERE only_row))` : sql`NULL`},
+      'last', ${head ? sql`json((SELECT json_object('seq', seq, 'hash', hex(hash)) FROM audit_log ORDER BY seq DESC LIMIT 1))` : sql`NULL`},
+      'rotation', ${head
+        ? sql`json((SELECT ${ENTRY} FROM audit_log e WHERE author = 'vault' AND action = 'key.rotate' AND decision = 'allow' ORDER BY seq DESC LIMIT 1))`
+        : sql`NULL`},
+      'members', json(${asked.members === true
+        ? sql`(SELECT json_group_array(json_object(
+            'principal', principal, 'status', status, 'owner', owner, 'role', role, 'scope', scope, 'generation', generation,
+            'createdAt', created_at, 'createdBy', created_by, 'statusChangedAt', status_changed_at, 'statusChangedBy', status_changed_by,
+            'accessSeq', access_seq, 'mac', hex(mac))) FROM vault_members WHERE principal IN (SELECT value FROM json_each(${principals})))`
+        : sql`'[]'`}),
+      'grants', json((
+        SELECT json_group_array(json_object(
+          'principal', g.principal, 'projectId', coalesce(g.project_id, env.project_id), 'environmentId', g.environment_id,
+          'environmentSlug', g.environment_slug, 'role', g.role, 'expiresAt', g.expires_at, 'grantedAt', g.granted_at, 'grantedBy', g.granted_by))
+        FROM vault_grants g LEFT JOIN environments env ON env.id = g.environment_id
+        WHERE g.principal IN (SELECT value FROM json_each(${principals}))
+      )),
+      'access', json((
+        SELECT json_group_array(json(newest)) FROM (
+          SELECT (
+            SELECT ${ENTRY} FROM audit_log e
+            WHERE author = 'vault' AND subject_principal = asked.value AND action IN (SELECT value FROM json_each(${actions})) AND decision = 'allow'
+            ORDER BY seq DESC LIMIT 1
+          ) AS newest
+          FROM json_each(${principals}) AS asked
+        ) WHERE newest IS NOT NULL
+      )),
+      'policy', json((SELECT ${ENTRY} FROM policy e)),
+      'environments', json((
+        SELECT json_group_array(json_object(
+          'id', env.id, 'projectId', env.project_id, 'slug', env.slug, 'owner', env.owner, 'parentId', env.parent_id,
+          'deleted', env.slug LIKE ${tomb} OR project.slug LIKE ${tomb},
+          'archived', env.archived_at IS NOT NULL OR project.archived_at IS NOT NULL))
+        FROM environments env JOIN projects project ON project.id = env.project_id
+        WHERE env.id IN (SELECT value FROM json_each(${environments}))
+          OR env.id IN (SELECT parent_id FROM environments WHERE id IN (SELECT value FROM json_each(${environments})) AND owner IS NOT NULL)
+          OR env.id IN (
+            SELECT json_extract(place.value, '$.environmentId')
+            FROM policy, json_each(policy.metadata, '$.policy.protected') AS place
+            -- Of a forged entry's, an element that is no object names nothing: json_extract would fail on a string.
+            WHERE json_valid(policy.metadata) AND json_type(policy.metadata, '$.policy.protected') = 'array' AND place.type = 'object'
+          )
+      )),
+      'ended', json((
+        SELECT json_group_array(related_seq) FROM audit_log
+        WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq IN (SELECT value FROM json_each(${references}))
+      )),
+      'released', ${released === undefined
+        ? sql`0`
+        : sql`(
+          SELECT count(DISTINCT key) FROM (
+            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
+            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
+            SELECT coalesce(e.secret_id, CASE WHEN one.type = 'object' AND json_type(one.value, '$.secretId') = 'text' THEN json_extract(one.value, '$.secretId') END, 'entry:' || e.seq) AS key
+            FROM audit_log e
+            LEFT JOIN json_each(CASE WHEN e.secret_id IS NULL AND json_type(e.metadata, '$.secrets') = 'array' THEN e.metadata END, '$.secrets') AS one
+            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
+              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
+            UNION ALL SELECT value FROM json_each(${JSON.stringify(released.keys)})
+          )
+        )`}
+    ) AS snapshot`;
+}