@coffre/vault 0.10.1 → 0.11.0

package/dist/{vault-B0YiPBgi.js → vault-DEjPmLNt.js}

@@ -1,14 +1,14 @@
-import { ACCESS_ACTIONS, POLICY_REVISION, checkpointMessage, checkpointVerifier, describeAccessFault, handsBack, policyRevision } from "@coffre/core/vault";
+import { ACCESS_ACTIONS, ACCESS_ACTIONS as ACCESS_ACTIONS$1, POLICY_REVISION, checkpointMessage, checkpointVerifier, describeAccessFault, handsBack, policyRevision } from "@coffre/core/vault";
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { prepared, tablesOf } from "@coffre/db";
-import { DEFAULT_POLICY, EVERYWHERE, EVERY_ENVIRONMENT, FIXED_ROLES, INSTANCE_ROLES, NOTHING, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_ID, UNWRITTEN_FORK_MS, allows, assignableToEnvironment, definitionProblem, givesService, grantKind, isBuiltinRole, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalDefinition, normalScope, ownsInstance, runsInstance, setsUpServices, unscoped, withinCredential } from "@coffre/core/access";
+import { DEFAULT_POLICY, EVERYWHERE, EVERY_ENVIRONMENT, FIXED_ROLES, INSTANCE_ROLES, NOTHING, PROJECT_ONLY_PERMISSIONS, ROLES, ROLE_ID, UNWRITTEN_FORK_MS, allows, assignableToEnvironment, definitionProblem, givesService, grantKind, isBuiltinRole, isCredentialScope, isInstanceRole, isRole, isScope, managesService, mayManageAccess, normalDefinition, normalScope, ownsInstance, ownsProject, readsSensitive, runsInstance, setsUpServices, unscoped, useOnly, withinCredential } from "@coffre/core/access";
 import { GENESIS_HASH, deriveLogKey, verifyEntries } from "@coffre/core/audit";
 import { checkContext, ownerKey } from "@coffre/core/envelope";
-import { shownMember } from "@coffre/core/schemas";
-import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation, isUnreachable, tombstone, truth } from "@coffre/db/dialect";
+import { TOMBSTONE, shownMember } from "@coffre/core/schemas";
+import { SNAPSHOT, clockMillis, engineOf, forUpdate, isUniqueViolation, isUnreachable, rowsOf, tombstone, truth } from "@coffre/db/dialect";
 import { accessEntriesAbout, everyProjectConversion, insertGrant, liveProjects, newestAccess, readGrants, reportStands, roleColumns, storedRole } from "@coffre/db/grants";
-import { appendEntries, entryColumns, lockLogHead, missingEntry, newestAuthentic, newestVaultEntries, newestVaultSeq, withinBytes } from "@coffre/db/log";
+import { LogHeadMismatch, appendEntries, entryColumns, lockLogHead, missingEntry, newestAuthentic, newestVaultEntries, withinBytes } from "@coffre/db/log";
 import { and, asc, desc, eq, gt, gte, inArray, isNotNull, isNull, lt, lte, or, sql } from "drizzle-orm";
 //#region src/checkpoint.ts
 const PKCS8_ED25519 = [
@@ -43,6 +43,138 @@ async function signer(seed) {
 	};
 }
 //#endregion
+//#region src/decide.ts
+/**
+* Where a decision checks a permission: an environment, with its slug as
+* the store has it when it was read and is in the project claimed;
+* otherwise none, which no grant on a slug matches.
+*/
+function placeIn(place, environments) {
+	const environment = environments.get(place.environmentId);
+	const slug = environment?.projectId === place.projectId ? environment.slug : null;
+	return {
+		projectId: place.projectId,
+		environmentId: place.environmentId,
+		environmentSlug: slug
+	};
+}
+/**
+* A key of a personal config is its owner's alone (docs/design/forking.md,
+* section 4): no grant or role opens or wraps it, an Owner's included,
+* only its owner, while they read the environment it is a config of,
+* whatever the call is. Nor does any reference reach into or out of one.
+* Undefined for a key of any other environment, decided as ever.
+*/
+function personalRefusal(reader, principal, permission, secret, at, environments) {
+	const own = environments.get(secret.environmentId);
+	const elsewhere = at.environmentId !== secret.environmentId;
+	const held = elsewhere ? environments.get(at.environmentId) : own;
+	if (own?.owner == null && held?.owner == null) return void 0;
+	if (elsewhere || own === void 0 || principal !== own.owner || own.parentId === null) return "personal";
+	const parent = placeIn({
+		projectId: secret.projectId,
+		environmentId: own.parentId
+	}, environments);
+	const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
+	const refused = refuses(reader, "secret.use", parent, gone) === null ? null : refuses(reader, "secret.read", parent, gone);
+	if (refused !== null) return refused;
+	return withinCredential(reader.live, permission === "secret.read" ? "secret.use" : permission, parent) ? null : "no_grant";
+}
+/**
+* Why `reader` may not do `permission` at `where`, or null if they may. A
+* deleted place is refused before any grant is asked, so no kind of grant,
+* on the project, the environment or every project, can reach into one.
+*/
+function refuses(reader, permission, where, deleted) {
+	if (reader.status === "tampered") return "tampered";
+	if (reader.status === "removed") return "removed";
+	if (reader.status === "unknown") return "not_a_member";
+	if (deleted) return "deleted";
+	if (allows(reader.live, permission, where)) return null;
+	return allows(reader.all, permission, where) ? "expired" : "no_grant";
+}
+/**
+* What refuses each key of a call by where it is, before any `vet`: its
+* personal config's owner, any one of the permissions it `needs` besides,
+* `permission` itself, at `at`, its reference's holder or where it is; and
+* a key it `owns` that its reader does not own the project of.
+*/
+function keyRefusals(reader, call) {
+	const { principal, permission, secrets, at, environments, needs } = call;
+	const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
+	const refusalOf = (secret, i) => {
+		const personal = personalRefusal(reader, principal, permission, secret, at[i], environments);
+		if (personal !== void 0) return personal;
+		const also = needs[i];
+		if (also != null) {
+			const place = placeIn(at[i], environments);
+			const refused = also.map((need) => refuses(reader, need, place, gone(secret) || gone(at[i])));
+			if (refused.every((code) => code !== null)) return refused[0] ?? "no_grant";
+		}
+		return refuses(reader, permission, placeIn(at[i], environments), gone(secret) || gone(at[i]));
+	};
+	return secrets.map((secret, i) => {
+		const code = refusalOf(secret, i);
+		return code === null && call.owns?.[i] === true && !ownsProject(reader.live, secret.projectId) ? "not_allowed" : code;
+	});
+}
+/**
+* Each key's refusal once its sensitivity is weighed too, after `vet`. A
+* sensitive value is only ever used for a person, never handed back, by
+* whatever credential of theirs asks; and handed back to a service account
+* only on a credential an Owner of its own project issued, a reference's
+* source's too, whose value it is (`readsSensitive`, R32). And a fork
+* copies one, for anyone, a service account too, only where its app says
+* it keeps it sensitive (an app of 0.9, mid-deploy, would write the copy as
+* a secret its people read), and never one read through a reference.
+*/
+function sensitiveRefusals(codes, reader, call) {
+	const copying = call.action === "secret.read" && call.purpose === "copy";
+	const handedBack = call.action === "secret.read" && handsBack({
+		purpose: call.purpose ?? "",
+		keepsSensitive: call.keepsSensitive === true
+	});
+	const person = call.principal.startsWith("user:");
+	return call.secrets.map((secret, i) => {
+		const code = codes[i] ?? null;
+		if (code !== null || secret.sensitive !== true) return code;
+		if (copying && call.keepsSensitive !== true || copying && call.viaReference?.[i] === true || handedBack && person) return "sensitive";
+		if (handedBack && !readsSensitive(reader.live, secret.projectId)) return "not_owner_issued";
+		return null;
+	});
+}
+/**
+* Each key's refusal once a workload's listing is weighed too, after `vet`
+* and before its sensitivity (docs/design/workload-access.md, section 6.1).
+* A workload is handed back, for any purpose but the proxy's use, only a
+* value its credential lists where the value is held (`useOnly`): each
+* secret is that place, a reference's source, a fork's parent, whatever
+* place the call checked its permission at. A copy too, kept sensitive or
+* not: it would land where the workload may read it. The vault opens no
+* plain value, so every key here is a secret or a sensitive one.
+*/
+function useOnlyRefusals(codes, reader, call) {
+	const handedBack = call.action === "secret.read" && call.purpose !== "use";
+	return call.secrets.map((secret, i) => codes[i] ?? (handedBack && useOnly(reader.live, secret) ? "use_only" : null));
+}
+/**
+* Why `reader` may not make a reference at `holder` to `source`, or null, past
+* what only the database settles (a source of another claim, a reference to
+* itself). A personal config's values are bound to its owner: no reference
+* holds one, nor reads one. Making one hands its source's value to whoever
+* reads the holder, whatever its nature becomes: its maker writes the holder,
+* reads the source there, as any direct access, and, for a sensitive one,
+* which nobody reads, uses it there too (R24). A workload refers only to a
+* value it is handed back, a plain one or one it lists (`useOnly`): it
+* would otherwise move a value it uses to a place whose keys it reads.
+*/
+function referenceRefusal(reader, holder, source, environments, nature) {
+	if (environments.get(holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return "personal";
+	const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
+	const at = placeIn(source, environments);
+	return refuses(reader, "secret.write", placeIn(holder, environments), gone(holder)) ?? refuses(reader, "secret.read", at, gone(source)) ?? (nature === "sensitive" ? refuses(reader, "secret.use", at, gone(source)) : null) ?? (nature !== "plain" && useOnly(reader.live, source) ? "use_only" : null);
+}
+//#endregion
 //#region src/store.ts
 /**
 * On Postgres, fail a lock wait in this transaction after `ms`, rather than
@@ -75,7 +207,7 @@ function memberColumns(db) {
 	};
 }
 /** A member as their row says (`storedRole`). */
-function memberOf({ owner, role, scope, ...row }) {
+function memberOf$1({ owner, role, scope, ...row }) {
 	return {
 		...row,
 		...storedRole({
@@ -95,7 +227,7 @@ function storedChange(change) {
 }
 async function member(db, principal) {
 	const [row] = await memberRow(db, { principal });
-	return row === void 0 ? void 0 : memberOf(row);
+	return row === void 0 ? void 0 : memberOf$1(row);
 }
 const memberRow = prepared((db) => {
 	const { vaultMembers } = tablesOf(db);
@@ -103,7 +235,7 @@ const memberRow = prepared((db) => {
 });
 async function allMembers(db) {
 	const { vaultMembers } = tablesOf(db);
-	return (await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal))).map(memberOf);
+	return (await db.select(memberColumns(db)).from(vaultMembers).orderBy(asc(vaultMembers.principal))).map(memberOf$1);
 }
 /**
 * The rows that say their member is an active Owner of the whole instance
@@ -113,7 +245,7 @@ async function allMembers(db) {
 */
 async function instanceOwners(db) {
 	const { vaultMembers } = tablesOf(db);
-	return (await db.select(memberColumns(db)).from(vaultMembers).where(and(eq(vaultMembers.status, "active"), eq(vaultMembers.role, "owner"))).orderBy(asc(vaultMembers.principal))).map(memberOf).filter(ownsInstance);
+	return (await db.select(memberColumns(db)).from(vaultMembers).where(and(eq(vaultMembers.status, "active"), eq(vaultMembers.role, "owner"))).orderBy(asc(vaultMembers.principal))).map(memberOf$1).filter(ownsInstance);
 }
 /**
 * Lock these members' rows for the rest of the transaction, in one order
@@ -124,7 +256,7 @@ async function instanceOwners(db) {
 async function lockMembers(tx, principals) {
 	const { vaultMembers } = tablesOf(tx);
 	const rows = await forUpdate(tx, tx.select(memberColumns(tx)).from(vaultMembers).where(inArray(vaultMembers.principal, [...new Set(principals)])).orderBy(asc(vaultMembers.principal)), "no key update");
-	return new Map(rows.map((row) => [row.principal, memberOf(row)]));
+	return new Map(rows.map((row) => [row.principal, memberOf$1(row)]));
 }
 /**
 * Add `row`. A principal has one row: when two decisions admit the same
@@ -221,25 +353,6 @@ async function everyProjectHolders(db) {
 	const { vaultGrants } = tablesOf(db);
 	return (await db.selectDistinct({ principal: vaultGrants.principal }).from(vaultGrants).where(and(isNull(vaultGrants.projectId), isNull(vaultGrants.environmentId))).orderBy(asc(vaultGrants.principal))).map((row) => row.principal);
 }
-/** The action of an entry that releases a key, which the bulk limit counts. */
-const RELEASE = "secret.read";
-/**
-* How many keys the vault has released to `principal` since `after`: one
-* for an entry about one secret, and as many as it lists for one about
-* several (`secrets`), a read logged once per place.
-*/
-async function releasesSince(db, principal, after) {
-	const [{ n }] = await released(db, {
-		principal,
-		after
-	});
-	return Number(n ?? 0);
-}
-const released = prepared((db) => {
-	const { auditLog } = tablesOf(db);
-	const listed = engineOf(db) === "postgres" ? sql`jsonb_array_length((${auditLog.metadata})::jsonb -> 'secrets')` : sql`json_array_length(${auditLog.metadata}, '$.secrets')`;
-	return db.select({ n: sql`SUM(COALESCE(${listed}, 1))` }).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.actor, sql.placeholder("principal")), eq(auditLog.action, RELEASE), eq(auditLog.decision, "allow"), gt(auditLog.occurredAt, sql.placeholder("after"))));
-});
 /** Rows of the log as the chain's codec reads them: `author` and `decision` are checked by the table. */
 function stored(rows) {
 	return rows;
@@ -364,8 +477,10 @@ async function natures(db, secretIds) {
 }
 /**
 * For each version a rewrap would bring back into its secret, its nature
-* as stored when it is an old value, not the secret's current one; null
-* for the current one, which a mark wraps again with no value changing.
+* when it is an old value, no looser than it was stored nor than its value
+* was made since (the newest version of its very ciphertext), not the
+* secret's current one; null for the current one, which a mark wraps again
+* with no value changing.
 */
 async function restoredNatures(db, items) {
 	if (items.length === 0) return [];
@@ -375,8 +490,8 @@ async function restoredNatures(db, items) {
 		version: secrets.currentVersionId
 	}).from(secrets).where(inArray(secrets.id, [...new Set(items.map((item) => item.secretId))])), db.select({
 		id: secretVersions.id,
-		sensitive: secretVersions.sensitive,
-		plain: truth(isNotNull(secretVersions.plaintext))
+		sensitive: sql`(${secretVersions.sensitive} OR (${heldAs(secretVersions, sql`same.sensitive`)}))`,
+		plain: sql`(${secretVersions.plaintext} IS NOT NULL AND (${heldAs(secretVersions, sql`same.plaintext IS NOT NULL`)}))`
 	}).from(secretVersions).where(inArray(secretVersions.id, [...new Set(items.map((item) => item.from))]))]);
 	const currentOf = new Map(current.map((row) => [row.id, row.version]));
 	const natureOf = new Map(versions.map((row) => [row.id, Boolean(row.sensitive) ? "sensitive" : Boolean(row.plain) ? "plain" : "secret"]));
@@ -436,7 +551,7 @@ async function talliedAfter(db, after, limit) {
 /** The vault's newest allowed access entry about each member who has one. */
 async function newestAccessEntries(db) {
 	const { auditLog } = tablesOf(db);
-	const newest = db.select({ seq: sql`max(${auditLog.seq})` }).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...ACCESS_ACTIONS]), eq(auditLog.decision, "allow"))).groupBy(auditLog.subjectPrincipal);
+	const newest = db.select({ seq: sql`max(${auditLog.seq})` }).from(auditLog).where(and(eq(auditLog.author, "vault"), inArray(auditLog.action, [...ACCESS_ACTIONS$1]), eq(auditLog.decision, "allow"))).groupBy(auditLog.subjectPrincipal);
 	const rows = stored(await db.select(entryColumns(db)).from(auditLog).where(inArray(auditLog.seq, newest)));
 	return new Map(rows.flatMap((row) => row.subjectPrincipal === null ? [] : [[row.subjectPrincipal, row]]));
 }
@@ -486,7 +601,8 @@ async function versions(db, ids) {
 		currentVersionId: secrets.currentVersionId,
 		sensitive: secretVersions.sensitive,
 		newest: sql`(SELECT max(newest.version) FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId})`,
-		newestSensitive: sql`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`
+		newestSensitive: sql`(SELECT newest.sensitive FROM secret_versions newest WHERE newest.secret_id = ${secretVersions.secretId} ORDER BY newest.version DESC LIMIT 1)`,
+		heldSensitive: sql`(${heldAs(secretVersions, sql`same.sensitive`)})`
 	}).from(secretVersions).innerJoin(secrets, eq(secrets.id, secretVersions.secretId)).innerJoin(environments, eq(environments.id, secrets.environmentId)).innerJoin(projects, eq(projects.id, secrets.projectId)).where(and(inArray(secretVersions.id, [...new Set(ids)]), or(sealed$1(secretVersions.wrappedDek), tombstone(environments.slug), tombstone(projects.slug))))).map((row) => ({
 		id: row.id,
 		deleted: row.deleted,
@@ -505,9 +621,18 @@ async function versions(db, ids) {
 			bytes: row.wrappedDek.toString("base64")
 		},
 		current: row.currentVersionId === row.id && Number(row.newest) === row.version,
-		newestSensitive: Boolean(row.newestSensitive)
+		newestSensitive: Boolean(row.newestSensitive),
+		heldSensitive: Boolean(row.heldSensitive)
 	}));
 }
+/**
+* `column` of the newest version of a version's secret with its very ciphertext: its value, as it is held now. Known
+* by its IV and tag, which under one data key name one ciphertext, and which, unlike the ciphertext, no erasure empties.
+*/
+function heldAs(secretVersions, column) {
+	return sql`SELECT ${column} FROM secret_versions same WHERE same.secret_id = ${secretVersions.secretId}
+    AND same.iv = ${secretVersions.iv} AND same.auth_tag = ${secretVersions.authTag} ORDER BY same.version DESC LIMIT 1`;
+}
 //#endregion
 //#region src/log.ts
 /**
@@ -994,6 +1119,255 @@ function sealed(key, member, grants) {
 	return member.mac.length === expected.length && timingSafeEqual(member.mac, expected);
 }
 //#endregion
+//#region src/snapshot.postgres.ts
+/** An entry of `audit_log` aliased `e`, as JSON (`RawEntry`): whole numbers past 2^53 as text, bytes as hex. */
+const ENTRY$1 = sql.raw(`json_build_object(
+  'seq', e.seq::text, 'author', e.author, 'keyId', e.key_id, 'occurredAt', e.occurred_at, 'actor', e.actor, 'action', e.action,
+  'decision', e.decision, 'code', e.code, 'subjectPrincipal', e.subject_principal, 'projectId', e.project_id,
+  'environmentId', e.environment_id, 'secretId', e.secret_id, 'secretVersionId', e.secret_version_id,
+  'operationId', e.operation_id, 'requestId', e.request_id, 'sourceIp', e.source_ip, 'relatedSeq', e.related_seq::text,
+  'metadata', e.metadata, 'prevHash', encode(e.prev_hash, 'hex'), 'mac', encode(e.mac, 'hex'), 'hash', encode(e.hash, 'hex'))`);
+const NOW$1 = sql.raw("(extract(epoch from clock_timestamp()) * 1000)::bigint");
+/** `snapshot`'s statement on Postgres: one row, one JSON column. Each part reads one index range. */
+function snapshotQuery$1(asked) {
+	const principals = sql`${sql.param([...asked.principals])}::text[]`;
+	const environments = sql`${sql.param([...asked.environments ?? []])}::uuid[]`;
+	const references = sql`${sql.param((asked.references ?? []).map(String))}::bigint[]`;
+	const actions = sql`${sql.param([...ACCESS_ACTIONS])}::text[]`;
+	const tomb = `%${TOMBSTONE}%`;
+	const released = asked.released;
+	const head = asked.head === true ? sql`, head AS (SELECT next_seq, head_hash FROM audit_chain_head WHERE only_row FOR UPDATE SKIP LOCKED)` : sql``;
+	return sql`
+    WITH policy AS (
+      SELECT * FROM audit_log WHERE author = 'vault' AND action = 'policy.change' AND decision = 'allow' ORDER BY seq DESC LIMIT 1
+    )${head}
+    SELECT json_build_object(
+      'at', ${NOW$1},
+      'head', ${asked.head === true ? sql`(SELECT json_build_object('nextSeq', next_seq::text, 'hash', encode(head_hash, 'hex')) FROM head)` : sql`NULL`},
+      'last', ${asked.head === true ? sql`(SELECT json_build_object('seq', seq::text, 'hash', encode(hash, 'hex')) FROM audit_log ORDER BY seq DESC LIMIT 1)` : sql`NULL`},
+      'rotation', ${asked.head === true ? sql`(SELECT ${ENTRY$1} FROM audit_log e WHERE author = 'vault' AND action = 'key.rotate' AND decision = 'allow' ORDER BY seq DESC LIMIT 1)` : sql`NULL`},
+      'members', ${asked.members === true ? sql`(SELECT coalesce(json_agg(json_build_object(
+            'principal', principal, 'status', status, 'owner', owner, 'role', role, 'scope', scope, 'generation', generation,
+            'createdAt', created_at, 'createdBy', created_by, 'statusChangedAt', status_changed_at, 'statusChangedBy', status_changed_by,
+            'accessSeq', access_seq::text, 'mac', encode(mac, 'hex'))), '[]') FROM vault_members WHERE principal = ANY(${principals}))` : sql`'[]'::json`},
+      'grants', (
+        SELECT coalesce(json_agg(json_build_object(
+          'principal', g.principal, 'projectId', coalesce(g.project_id, env.project_id), 'environmentId', g.environment_id,
+          'environmentSlug', g.environment_slug, 'role', g.role, 'expiresAt', g.expires_at, 'grantedAt', g.granted_at, 'grantedBy', g.granted_by)), '[]')
+        FROM vault_grants g LEFT JOIN environments env ON env.id = g.environment_id
+        WHERE g.principal = ANY(${principals})
+      ),
+      'access', (
+        SELECT coalesce(json_agg(${ENTRY$1}), '[]')
+        FROM unnest(${principals}) AS asked (principal)
+        CROSS JOIN LATERAL (
+          SELECT * FROM audit_log
+          WHERE author = 'vault' AND subject_principal = asked.principal AND action = ANY(${actions}) AND decision = 'allow'
+          ORDER BY seq DESC LIMIT 1
+        ) e
+      ),
+      'policy', (SELECT ${ENTRY$1} FROM policy e),
+      'environments', (
+        SELECT coalesce(json_agg(json_build_object(
+          'id', env.id, 'projectId', env.project_id, 'slug', env.slug, 'owner', env.owner, 'parentId', env.parent_id,
+          'deleted', env.slug LIKE ${tomb} OR project.slug LIKE ${tomb},
+          'archived', env.archived_at IS NOT NULL OR project.archived_at IS NOT NULL)), '[]')
+        FROM environments env JOIN projects project ON project.id = env.project_id
+        -- One list of ids, each found by the primary key.
+        WHERE env.id = ANY(ARRAY(
+          SELECT unnest(${environments})
+          UNION SELECT parent_id FROM environments WHERE id = ANY(${environments}) AND owner IS NOT NULL
+          -- What the newest policy protects, by the ids its JSON names; one that is no UUID names nothing.
+          UNION SELECT (place #>> '{}')::uuid FROM policy, jsonb_path_query(policy.metadata::jsonb, '$.policy.protected[*].environmentId') AS place
+          WHERE (place #>> '{}') ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+        ))
+      ),
+      'ended', (
+        SELECT coalesce(json_agg(related_seq::text), '[]') FROM audit_log
+        WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq = ANY(${references})
+      ),
+      'released', ${released === void 0 ? sql`0` : sql`(
+          SELECT count(DISTINCT key) FROM (
+            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
+            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
+            SELECT coalesce(e.secret_id::text, CASE jsonb_typeof(one -> 'secretId') WHEN 'string' THEN one ->> 'secretId' END, 'entry:' || e.seq) FROM audit_log e
+            -- Each item of a list, never what lax paths would make of an object; silent, as strict paths fail on what is missing.
+            LEFT JOIN LATERAL jsonb_path_query(CASE WHEN e.secret_id IS NULL THEN e.metadata::jsonb END, 'strict $.secrets ? (@.type() == "array")[*]', '{}', true) AS one ON true
+            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
+              AND e.occurred_at > ${NOW$1} + ${released.clockOffsetMs} - ${released.windowMs}
+            UNION ALL SELECT unnest(${sql.param([...released.keys])}::text[])
+          ) AS released (key)
+        )`}
+    ) AS snapshot`;
+}
+//#endregion
+//#region src/snapshot.sqlite.ts
+/**
+* An entry of `audit_log` aliased `e`, as JSON (`RawEntry`), bytes as hex.
+* A JSON value loses its type leaving a subquery, so whoever takes one
+* from a subquery wraps it in `json(…)`.
+*/
+const ENTRY = sql.raw(`json_object(
+  'seq', e.seq, 'author', e.author, 'keyId', e.key_id, 'occurredAt', e.occurred_at, 'actor', e.actor, 'action', e.action,
+  'decision', e.decision, 'code', e.code, 'subjectPrincipal', e.subject_principal, 'projectId', e.project_id,
+  'environmentId', e.environment_id, 'secretId', e.secret_id, 'secretVersionId', e.secret_version_id,
+  'operationId', e.operation_id, 'requestId', e.request_id, 'sourceIp', e.source_ip, 'relatedSeq', e.related_seq,
+  'metadata', e.metadata, 'prevHash', hex(e.prev_hash), 'mac', hex(e.mac), 'hash', hex(e.hash))`);
+const NOW = sql.raw(`CAST(unixepoch('subsec') * 1000 AS INTEGER)`);
+/**
+* `snapshot`'s statement on SQLite, the same as on Postgres. Nothing is
+* locked: one transaction runs at a time (connect.ts), so the head is the
+* last entry's.
+*/
+function snapshotQuery(asked) {
+	const principals = JSON.stringify(asked.principals);
+	const environments = JSON.stringify(asked.environments ?? []);
+	const references = JSON.stringify((asked.references ?? []).map(Number));
+	const actions = JSON.stringify(ACCESS_ACTIONS);
+	const tomb = `%${TOMBSTONE}%`;
+	const released = asked.released;
+	const head = asked.head === true;
+	return sql`
+    WITH policy AS (
+      SELECT * FROM audit_log WHERE author = 'vault' AND action = 'policy.change' AND decision = 'allow' ORDER BY seq DESC LIMIT 1
+    )
+    SELECT json_object(
+      'at', ${NOW},
+      'head', ${head ? sql`json((SELECT json_object('nextSeq', next_seq, 'hash', hex(head_hash)) FROM audit_chain_head WHERE only_row))` : sql`NULL`},
+      'last', ${head ? sql`json((SELECT json_object('seq', seq, 'hash', hex(hash)) FROM audit_log ORDER BY seq DESC LIMIT 1))` : sql`NULL`},
+      'rotation', ${head ? sql`json((SELECT ${ENTRY} FROM audit_log e WHERE author = 'vault' AND action = 'key.rotate' AND decision = 'allow' ORDER BY seq DESC LIMIT 1))` : sql`NULL`},
+      'members', json(${asked.members === true ? sql`(SELECT json_group_array(json_object(
+            'principal', principal, 'status', status, 'owner', owner, 'role', role, 'scope', scope, 'generation', generation,
+            'createdAt', created_at, 'createdBy', created_by, 'statusChangedAt', status_changed_at, 'statusChangedBy', status_changed_by,
+            'accessSeq', access_seq, 'mac', hex(mac))) FROM vault_members WHERE principal IN (SELECT value FROM json_each(${principals})))` : sql`'[]'`}),
+      'grants', json((
+        SELECT json_group_array(json_object(
+          'principal', g.principal, 'projectId', coalesce(g.project_id, env.project_id), 'environmentId', g.environment_id,
+          'environmentSlug', g.environment_slug, 'role', g.role, 'expiresAt', g.expires_at, 'grantedAt', g.granted_at, 'grantedBy', g.granted_by))
+        FROM vault_grants g LEFT JOIN environments env ON env.id = g.environment_id
+        WHERE g.principal IN (SELECT value FROM json_each(${principals}))
+      )),
+      'access', json((
+        SELECT json_group_array(json(newest)) FROM (
+          SELECT (
+            SELECT ${ENTRY} FROM audit_log e
+            WHERE author = 'vault' AND subject_principal = asked.value AND action IN (SELECT value FROM json_each(${actions})) AND decision = 'allow'
+            ORDER BY seq DESC LIMIT 1
+          ) AS newest
+          FROM json_each(${principals}) AS asked
+        ) WHERE newest IS NOT NULL
+      )),
+      'policy', json((SELECT ${ENTRY} FROM policy e)),
+      'environments', json((
+        SELECT json_group_array(json_object(
+          'id', env.id, 'projectId', env.project_id, 'slug', env.slug, 'owner', env.owner, 'parentId', env.parent_id,
+          'deleted', env.slug LIKE ${tomb} OR project.slug LIKE ${tomb},
+          'archived', env.archived_at IS NOT NULL OR project.archived_at IS NOT NULL))
+        FROM environments env JOIN projects project ON project.id = env.project_id
+        WHERE env.id IN (SELECT value FROM json_each(${environments}))
+          OR env.id IN (SELECT parent_id FROM environments WHERE id IN (SELECT value FROM json_each(${environments})) AND owner IS NOT NULL)
+          OR env.id IN (
+            SELECT json_extract(place.value, '$.environmentId')
+            FROM policy, json_each(policy.metadata, '$.policy.protected') AS place
+            -- Of a forged entry's, an element that is no object names nothing: json_extract would fail on a string.
+            WHERE json_valid(policy.metadata) AND json_type(policy.metadata, '$.policy.protected') = 'array' AND place.type = 'object'
+          )
+      )),
+      'ended', json((
+        SELECT json_group_array(related_seq) FROM audit_log
+        WHERE author = 'vault' AND action = 'reference.end' AND decision = 'allow' AND related_seq IN (SELECT value FROM json_each(${references}))
+      )),
+      'released', ${released === void 0 ? sql`0` : sql`(
+          SELECT count(DISTINCT key) FROM (
+            -- A read of one key names it; of several at one place, lists them (readsByPlace, vault.ts). An entry, or an
+            -- item of its list, that names no key, which only a forged entry is, counts as one key of its own.
+            SELECT coalesce(e.secret_id, CASE WHEN one.type = 'object' AND json_type(one.value, '$.secretId') = 'text' THEN json_extract(one.value, '$.secretId') END, 'entry:' || e.seq) AS key
+            FROM audit_log e
+            LEFT JOIN json_each(CASE WHEN e.secret_id IS NULL AND json_type(e.metadata, '$.secrets') = 'array' THEN e.metadata END, '$.secrets') AS one
+            WHERE e.author = 'vault' AND e.actor = ${released.principal} AND e.action = 'secret.read' AND e.decision = 'allow'
+              AND e.occurred_at > ${NOW} + ${released.clockOffsetMs} - ${released.windowMs}
+            UNION ALL SELECT value FROM json_each(${JSON.stringify(released.keys)})
+          )
+        )`}
+    ) AS snapshot`;
+}
+//#endregion
+//#region src/snapshot.ts
+async function snapshot(db, asked) {
+	const read = () => readOnce(db, asked);
+	const first = await read();
+	if (asked.head !== true || first.head !== null && current(first.head)) return first;
+	if (first.head === null) await lockLogHead(db);
+	const again = await read();
+	if (again.head === null) throw new Error("the log's head, held by this transaction, was read as held by another");
+	if (!current(again.head)) throw new LogHeadMismatch(`the log's head says entry ${again.head.nextSeq} comes next, but the log ends ${again.head.last === null ? "empty" : `at entry ${again.head.last.seq}`}, or with another hash`);
+	return again;
+}
+/** Whether the head names the last entry the same statement saw: nothing was appended between its snapshot and its lock. */
+function current(head) {
+	if (head.last === null) return head.nextSeq === 0n;
+	return head.nextSeq === head.last.seq + 1n && head.headHash.equals(head.last.hash);
+}
+async function readOnce(db, asked) {
+	const query = (engineOf(db) === "postgres" ? snapshotQuery$1 : snapshotQuery)(asked);
+	const [row] = await rowsOf(db, query);
+	const raw = typeof row.snapshot === "string" ? JSON.parse(row.snapshot) : row.snapshot;
+	return {
+		at: Number(raw.at),
+		members: new Map(raw.members.map((member) => [member.principal, memberOf(member)])),
+		grants: new Map(asked.principals.map((principal) => [principal, raw.grants.filter((grant) => grant.principal === principal).map(grantOf)])),
+		newestAccess: new Map(raw.access.map((entry) => [entry.subjectPrincipal, entryOf(entry)])),
+		newestPolicy: raw.policy === null ? null : entryOf(raw.policy),
+		environments: new Map(raw.environments.map(({ id, ...environment }) => [id, {
+			...environment,
+			deleted: Boolean(environment.deleted),
+			archived: Boolean(environment.archived)
+		}])),
+		ended: new Set(raw.ended.map((seq) => BigInt(seq))),
+		released: Number(raw.released ?? 0),
+		head: raw.head === null ? null : {
+			nextSeq: BigInt(raw.head.nextSeq),
+			headHash: Buffer.from(raw.head.hash, "hex"),
+			last: raw.last === null ? null : {
+				seq: BigInt(raw.last.seq),
+				hash: Buffer.from(raw.last.hash, "hex")
+			},
+			rotation: raw.rotation === null ? null : entryOf(raw.rotation)
+		}
+	};
+}
+/** An entry as the chain's codec reads it, from what `entryJson` wrote. */
+function entryOf(raw) {
+	return {
+		...raw,
+		seq: BigInt(raw.seq),
+		author: raw.author,
+		occurredAt: Number(raw.occurredAt),
+		relatedSeq: raw.relatedSeq === null ? null : BigInt(raw.relatedSeq),
+		prevHash: Buffer.from(raw.prevHash, "hex"),
+		mac: Buffer.from(raw.mac, "hex"),
+		hash: Buffer.from(raw.hash, "hex")
+	};
+}
+function grantOf(raw) {
+	return {
+		...raw,
+		expiresAt: raw.expiresAt === null ? null : Number(raw.expiresAt),
+		grantedAt: Number(raw.grantedAt)
+	};
+}
+function memberOf({ owner, ...raw }) {
+	return memberOf$1({
+		...raw,
+		owner: owner === true || owner === 1,
+		generation: Number(raw.generation),
+		createdAt: Number(raw.createdAt),
+		statusChangedAt: Number(raw.statusChangedAt),
+		accessSeq: BigInt(raw.accessSeq),
+		mac: Buffer.from(raw.mac, "hex")
+	});
+}
+//#endregion
 //#region src/accounting.ts
 const KEY_ACTIONS = /* @__PURE__ */ new Set([
 	"secret.read",
@@ -1358,7 +1732,7 @@ var Walk = class {
 };
 /** The action of the vault's entry that signs a prefix of the log. */
 const CHECKPOINT = "audit.checkpoint";
-const ACCESS = new Set(ACCESS_ACTIONS);
+const ACCESS = new Set(ACCESS_ACTIONS$1);
 /** JSON with every object's keys sorted: one text for one value, however it was built. */
 function canonical(value) {
 	return JSON.stringify(value, (_, inner) => inner !== null && typeof inner === "object" && !Array.isArray(inner) ? Object.fromEntries(Object.entries(inner).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)) : inner);
@@ -1493,7 +1867,7 @@ var Outage = class {
 	}
 };
 /** A rewrap that would make a value less sensitive than it is. */
-const LOOSER = "a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more";
+const LOOSER = "a value is made less sensitive only by writing it again: an old version comes back, and a key is made stricter, as sensitive as its newest version or more; only its current sensitive value is made a secret in place, by an Owner of its project";
 function refusal(code, message) {
 	return {
 		code,
@@ -1511,6 +1885,8 @@ const MESSAGES = {
 	ended: "the reference read through was ended",
 	personal: "a personal config's values are its owner's alone",
 	sensitive: "a sensitive value is never shown to anyone, Owners included: `coffre run` gives your app a placeholder for it through the credential proxy, and a service account reads it",
+	not_owner_issued: "a service account reads a sensitive value only on a token or trust binding an Owner of its project issued",
+	use_only: "a workload uses this value through coffre and never holds it: list it in its binding's reads, where the value is held, if it must",
 	not_allowed: "not allowed to change this",
 	last_owner: "the last Owner of the whole instance stays one: make someone else an Owner first",
 	invalid: "not something the rules allow",
@@ -1521,21 +1897,30 @@ const MESSAGES = {
 };
 /**
 * What the one asking holds through the credential their request came in
-* on: no more than its scope (`allows`). A scope that is not one is a bug
-* of the app's, which fails the call.
+* on: no more than its scope (`allows`), and, a workload's, handed back
+* only what the scope lists (`useOnly`). A scope that is not one, a kind of
+* caller its principal cannot be, or a workload with no scope to list what
+* it reads, is a bug of the app's, which fails the call. None said is an
+* app older than 0.11, which has no workloads (`Through`).
 */
-function through(standing, { credentialScope }) {
-	if (credentialScope == null) return standing;
-	if (!isCredentialScope(credentialScope)) throw new Error("credentialScope must be a list of grants, one a place");
+function through(standing, { credentialScope, caller }) {
+	const { principal } = standing;
+	if (caller !== void 0 && !(caller === "person" ? principal.startsWith("user:") : (caller === "bearer" || caller === "workload") && principal.startsWith("token:"))) throw new Error(`caller must be person for a user: principal, bearer or workload for a token: one, got: ${String(caller)}`);
+	if (caller === "workload" && credentialScope == null) throw new Error("a workload caller comes with its credential scope, which lists what it reads");
+	if (credentialScope != null && !isCredentialScope(credentialScope)) throw new Error("credentialScope must be a list of grants, one a place");
+	const held = {
+		...credentialScope == null ? {} : { credentialScope },
+		...caller === void 0 ? {} : { kind: caller }
+	};
 	return {
 		...standing,
 		live: {
 			...standing.live,
-			credentialScope
+			...held
 		},
 		all: {
 			...standing.all,
-			credentialScope
+			...held
 		}
 	};
 }
@@ -1571,6 +1956,24 @@ var VaultService = class {
 	async #now(db) {
 		return await now(db) + this.#prepared.options.clockOffset();
 	}
+	/** A snapshot's clock, as the vault keeps time (`#now`). */
+	#at(reads) {
+		return reads.at + this.#prepared.options.clockOffset();
+	}
+	/** What a decision about `principals` reads, and `asked` besides, in one statement: under the head when `head` is set. */
+	#snapshot(tx, principals, asked, head) {
+		const { released, ...rest } = asked;
+		return snapshot(tx, {
+			...rest,
+			principals,
+			head,
+			...released === void 0 ? {} : { released: {
+				...released,
+				windowMs: this.#config.bulkLimit.windowMs,
+				clockOffsetMs: this.#prepared.options.clockOffset()
+			} }
+		});
+	}
 	/**
 	* Decide in one transaction, with `principals`' rows locked first, then
 	* the log's head. A `Refused` or an `Outage` rolls back all but its own
@@ -1583,34 +1986,35 @@ var VaultService = class {
 	* alone takes the head later (`late`), once its key service has answered,
 	* which it must not wait on holding it, and decides again then (`#keys`).
 	*/
-	async #decide(principals, decide, late = false) {
+	async #decide(principals, decide, late = false, asked = {}) {
 		const superseded = await this.#settled();
 		if (superseded !== null) return {
 			ok: false,
 			refusal: refusal("wrong_kek", superseded)
 		};
-		return this.#decideNow(principals, decide, late);
+		return this.#decideNow(principals, decide, late, asked);
 	}
 	/** `#decide`, once the vault is settled. */
-	async #decideNow(principals, decide, late = false) {
+	async #decideNow(principals, decide, late = false, asked = {}) {
 		const reports = [];
 		for (let attempt = 1;; attempt += 1) try {
-			return await this.#decideOnce(principals, decide, reports, late);
+			return await this.#decideOnce(principals, decide, reports, late, asked);
 		} catch (error) {
 			if (attempt < 3 && (error instanceof Retry || isUniqueViolation(error))) continue;
 			throw error;
 		}
 	}
-	async #decideOnce(principals, decide, reports, late) {
+	async #decideOnce(principals, decide, reports, late, asked) {
 		try {
 			const result = await this.#db.transaction(async (tx) => {
 				await boundLockWaits(tx, LOCK_TIMEOUT_MS);
 				const members = principals.length === 0 ? /* @__PURE__ */ new Map() : await lockMembers(tx, principals);
-				if (!late) await lockLogHead(tx);
+				const reads = await this.#snapshot(tx, principals, asked, !late);
 				const d = {
 					tx,
 					members,
-					at: await this.#now(tx),
+					at: this.#at(reads),
+					reads,
 					log: [],
 					writes: [],
 					touched: /* @__PURE__ */ new Set(),
@@ -1624,7 +2028,8 @@ var VaultService = class {
 				let at = d.at;
 				const accessSeq = /* @__PURE__ */ new Map();
 				if (entries.length > 0) {
-					const appended = await this.#append(tx, entries, d.underLock);
+					if (d.reads.head === null) throw new Error("a decision appends only under the head it read with");
+					const appended = await this.#append(tx, entries, d.underLock, d.reads);
 					at = appended.occurredAt;
 					entries.forEach((entry, i) => {
 						if (isAccessEntry(entry)) accessSeq.set(entry.subjectPrincipal, appended.seqStart + BigInt(i));
@@ -1689,12 +2094,12 @@ var VaultService = class {
 	* MAC are passed over, and reported: otherwise whoever can insert a row
 	* could lock any member out.
 	*/
-	async #integrity(db, principal, row, grants, reports) {
+	async #integrity(db, principal, row, grants, reports, reads) {
 		if (row !== void 0 && !this.#sealed(row, grants)) {
 			this.#report(reports, principal, "mac", row.mac.toString("hex"));
 			return "mac";
 		}
-		const newest = await this.#newestAccess(db, principal, reports);
+		const newest = await this.#newestAccess(db, principal, reports, reads);
 		const seq = typeof newest !== "string" ? newest.seq : newest === "unreached" ? void 0 : null;
 		if (row === void 0 ? seq === null : seq === row.accessSeq) return null;
 		if (row === void 0 && await member(db, principal) !== void 0) throw new Retry();
@@ -1702,8 +2107,10 @@ var VaultService = class {
 		return "stale";
 	}
 	/** The newest access entry about `principal` that carries the vault's MAC (`newestAccess` in @coffre/db/grants). */
-	#newestAccess(db, principal, reports) {
-		return newestAccess(db, principal, this.#check(reports, principal));
+	#newestAccess(db, principal, reports, reads) {
+		if (reads === void 0 || !reads.grants.has(principal)) return newestAccess(db, principal, this.#check(reports, principal));
+		const newest = reads.newestAccess.get(principal);
+		return newestAuthentic((limit, before) => before === void 0 ? Promise.resolve(newest === void 0 ? [] : [newest]) : accessEntriesAbout(db, principal, limit, before), this.#check(reports, principal));
 	}
 	/** Entries in the vault's name told apart by their MACs, each it did not write reported, about `principal`. */
 	#check(reports, principal) {
@@ -1801,7 +2208,7 @@ var VaultService = class {
 	}
 	async #replaceEveryProject(d, principal) {
 		const row = d.members.get(principal);
-		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 		if (row === void 0 || subject.status !== "active") return;
 		const everyProject = subject.stored.filter((grant) => grant.projectId === null && grant.environmentId === null);
 		if (everyProject.length === 0) return;
@@ -1953,16 +2360,31 @@ var VaultService = class {
 	* that an instance still running with the replaced KEK, as during a
 	* deploy, cannot write after the rotation.
 	*/
-	#append(tx, entries, underLock = []) {
+	async #append(tx, entries, underLock = [], held) {
 		const prepared = this.#prepared;
-		return appendEntries(tx, prepared.logKey, entries, async (locked) => {
-			const rotation = await latestVaultEntry(locked, [KEY_ROTATE]);
+		const head = held?.head ?? void 0;
+		const appended = await appendEntries(tx, prepared.logKey, entries, async (locked) => {
+			const rotation = head === void 0 ? await latestVaultEntry(locked, [KEY_ROTATE]) : head.rotation ?? void 0;
 			if (rotation !== void 0 && !prepared.logKeys.some((key) => key.keyId === rotation.keyId)) {
 				prepared.superseded = `the log moved on to ${rotation.keyId}, a key this vault does not hold: a vault given a newer vault key replaced it, and a replaced key writes nothing more`;
 				throw new Error(prepared.superseded);
 			}
 			for (const check of underLock) await check(locked);
+		}, head === void 0 ? void 0 : {
+			head,
+			last: head.last,
+			at: held.at
 		});
+		if (head !== void 0) held.head = {
+			...head,
+			nextSeq: appended.nextSeq,
+			headHash: appended.headHash,
+			last: {
+				seq: appended.nextSeq - 1n,
+				hash: appended.headHash
+			}
+		};
+		return appended;
 	}
 	async unwrap(input) {
 		const { principal } = input;
@@ -2019,10 +2441,9 @@ var VaultService = class {
 			permission: input.purpose === "use" ? "secret.use" : "secret.read",
 			secrets: items.map((item) => item.secret),
 			places: sealed.map((seal, i) => seal?.holder ?? items[i].secret),
-			vet: ends.length === 0 ? void 0 : async (db) => {
-				const ended = await endedReferences(db, ends);
-				return sealed.map((seal) => seal !== null && ended.has(seal.seq) ? "ended" : null);
-			},
+			viaReference: sealed.map((seal) => seal !== null),
+			references: ends,
+			vet: ends.length === 0 ? void 0 : async (_, reads) => sealed.map((seal) => seal !== null && reads.ended.has(seal.seq) ? "ended" : null),
 			remote,
 			entry,
 			input
@@ -2084,13 +2505,19 @@ var VaultService = class {
 			...keyEntry("key.rewrap", principal, source.secret, "deny", "bad_claim", input),
 			secretVersionId: source.id
 		})));
-		if (items.some((item, i) => item.secret.sensitive !== true && (loaded.versions[i].secret.sensitive || loaded.versions[i].newestSensitive))) return this.#refuseVersions(principal, "invalid", loaded.versions.map((source) => ({
+		const loosens = items.map((item, i) => item.secret.sensitive !== true && loaded.versions[i].secret.sensitive === true && loaded.versions[i].current);
+		const strict = (i) => loaded.versions[i].secret.sensitive || loaded.versions[i].heldSensitive || loaded.versions[i].newestSensitive;
+		if (items.some((item, i) => !loosens[i] && item.secret.sensitive !== true && strict(i))) return this.#refuseVersions(principal, "invalid", loaded.versions.map((source) => ({
 			...keyEntry("key.rewrap", principal, source.secret, "deny", "invalid", input),
 			secretVersionId: source.id
 		})), LOOSER);
 		const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
+		const loosened = new Set(items.flatMap((item, i) => loosens[i] ? [item.secret] : []));
 		const entry = (secret, decision, code) => ({
-			...keyEntry("key.rewrap", principal, secret, decision, code, input, { from: sources.get(secret).secret.version }),
+			...keyEntry("key.rewrap", principal, secret, decision, code, input, {
+				from: sources.get(secret).secret.version,
+				...loosened.has(secret) ? { was: "sensitive" } : {}
+			}),
 			secretVersionId: sources.get(secret).id
 		});
 		const remote = this.#remote(this.#config.keks.primary) || items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
@@ -2104,8 +2531,14 @@ var VaultService = class {
 			input,
 			vet: async (db) => {
 				const newest = await newestSensitive(db, items.map(({ secret }) => secret.secretId));
-				return items.map(({ secret }) => secret.sensitive !== true && newest.has(secret.secretId) ? "invalid" : null);
+				const again = new Map((await versions(db, items.map(({ secret }) => sources.get(secret).id))).map((version) => [version.id, version]));
+				return items.map(({ secret }, i) => {
+					const now = again.get(sources.get(secret).id);
+					if (loosens[i]) return now?.current === true ? null : "invalid";
+					return secret.sensitive !== true && (newest.has(secret.secretId) || now?.heldSensitive === true) ? "invalid" : null;
+				});
 			},
+			owns: loosens,
 			needs: async (db) => {
 				return (await restoredNatures(db, items.map(({ secret }) => ({
 					secretId: secret.secretId,
@@ -2203,38 +2636,47 @@ var VaultService = class {
 		});
 		const owners = /* @__PURE__ */ new Map();
 		const check = async (d) => {
-			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), call.input);
+			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
 			const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
-			const environments = await environmentsById(d.tx, [...secrets, ...at].map((place) => place.environmentId));
-			const parents = [...environments.values()].flatMap((environment) => environment.owner === null || environment.parentId === null ? [] : [environment.parentId]);
-			for (const [id, parent] of await environmentsById(d.tx, parents)) environments.set(id, parent);
-			const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
+			const environments = d.reads.environments;
 			owners.clear();
 			for (const [id, environment] of environments) if (environment.owner !== null) owners.set(id, ownerKey(environment.owner));
 			const needs = call.needs === void 0 ? [] : await call.needs(d.tx);
-			const codes = secrets.map((secret, i) => {
-				const personal = personalRefusal(reader, principal, call.permission, secret, at[i], environments);
-				if (personal !== void 0) return personal;
-				const also = needs[i];
-				if (also != null) {
-					const place = placeIn(at[i], environments);
-					const refused = also.map((permission) => refuses(reader, permission, place, gone(secret) || gone(at[i])));
-					if (refused.every((code) => code !== null)) return refused[0];
-				}
-				return refuses(reader, call.permission, placeIn(at[i], environments), gone(secret) || gone(at[i]));
+			let codes = keyRefusals(reader, {
+				principal,
+				permission: call.permission,
+				secrets,
+				at,
+				environments,
+				needs,
+				owns: call.owns
 			});
-			if (call.vet !== void 0 && !codes.some((code) => code !== null)) (await call.vet(d.tx)).forEach((code, i) => codes[i] = code);
-			const copying = action === "secret.read" && call.input.purpose === "copy";
-			if (action === "secret.read" && principal.startsWith("user:") && handsBack({
-				purpose: call.input.purpose ?? "",
-				keepsSensitive: call.input.keepsSensitive === true
-			}) || copying && call.input.keepsSensitive !== true) secrets.forEach((secret, i) => {
-				if (codes[i] === null && secret.sensitive === true) codes[i] = "sensitive";
+			if (call.vet !== void 0 && !codes.some((code) => code !== null)) codes = await call.vet(d.tx, d.reads);
+			codes = useOnlyRefusals(codes, reader, {
+				action,
+				purpose: call.input.purpose,
+				secrets
+			});
+			codes = sensitiveRefusals(codes, reader, {
+				action,
+				principal,
+				purpose: call.input.purpose,
+				keepsSensitive: call.input.keepsSensitive,
+				secrets,
+				viaReference: call.viaReference
 			});
 			let first = codes.find((code) => code !== null) ?? null;
-			if (first === null && action === "secret.read" && await this.#overBulkLimit(d, principal, secrets.length)) first = "bulk_limit";
+			if (first === null && action === "secret.read" && this.#overBulkLimit(d)) first = "bulk_limit";
 			if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, i) => entry(secret, "deny", codes[i] ?? first)));
 		};
+		const reads = {
+			environments: [...secrets, ...secrets.map((secret, i) => call.places?.[i] ?? secret)].map((place) => place.environmentId),
+			references: call.references ?? [],
+			...action === "secret.read" ? { released: {
+				principal,
+				keys: secrets.map((secret) => secret.secretId)
+			} } : {}
+		};
 		const intentId = call.remote ? randomUUID() : null;
 		let intentSeq = null;
 		const outcomeEntry = (secret, item, decision, code) => {
@@ -2253,7 +2695,7 @@ var VaultService = class {
 		if (call.remote) {
 			const intent = await this.#decide([principal], async (d) => {
 				await check(d);
-				const at = await this.#now(d.tx);
+				const at = d.at;
 				return { seq: (await this.#append(d.tx, [{
 					actor: principal,
 					action: "key.intent",
@@ -2273,8 +2715,8 @@ var VaultService = class {
 							version: secret.version
 						}))
 					})
-				}])).seqStart };
-			});
+				}], [], d.reads)).seqStart };
+			}, false, reads);
 			if (!intent.ok) return intent;
 			intentSeq = intent.seq;
 		}
@@ -2291,7 +2733,7 @@ var VaultService = class {
 			await decided(d);
 			const { vet } = call;
 			if (late && vet !== void 0) d.underLock.push(async (locked) => {
-				const codes = await vet(locked);
+				const codes = await vet(locked, d.reads);
 				const first = codes.find((code) => code !== null);
 				if (first === void 0 || first === null) return;
 				throw new Refused(refusal(first, MESSAGES[first]), secrets.map((secret, item) => outcomeEntry(secret, item, "deny", codes[item] ?? first)));
@@ -2307,11 +2749,10 @@ var VaultService = class {
 				if (expired) throw new Outage(new KekUnavailableError("key operation exceeded its deadline"), entries());
 				if (done.length < outcomes.length) throw new Refused(refusal("bad_claim", MESSAGES.bad_claim), entries());
 				if (late) {
-					await lockLogHead(d.tx);
+					d.reads = await this.#snapshot(d.tx, [principal], reads, true);
+					d.at = this.#at(d.reads);
 					await decided(d);
-					const places = secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]);
-					const now = await environmentsById(d.tx, places.map((place) => place.environmentId));
-					if (places.some((place) => now.get(place.environmentId)?.deleted ?? false)) throw new Refused(refusal("deleted", MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, "deny", "deleted")));
+					if (secrets.flatMap((secret, i) => [secret, call.places?.[i] ?? secret]).some((place) => d.reads.environments.get(place.environmentId)?.deleted ?? false)) throw new Refused(refusal("deleted", MESSAGES.deleted), secrets.map((secret, i) => outcomeEntry(secret, i, "deny", "deleted")));
 				}
 				const released = secrets.map((secret, i) => outcomeEntry(secret, i, "allow", null));
 				d.log.push(...released);
@@ -2321,12 +2762,16 @@ var VaultService = class {
 			} finally {
 				for (const value of done) value.wipe();
 			}
-		}, late);
+		}, late, reads);
 	}
-	/** Whether `n` more keys would take `principal` past the bulk limit; counted under their row's lock, so exactly. */
-	async #overBulkLimit(d, principal, n) {
-		const { count, windowMs } = this.#config.bulkLimit;
-		return await releasesSince(d.tx, principal, d.at - windowMs) + n > count;
+	/**
+	* Whether this read's keys would take the reader past the bulk limit: the
+	* distinct keys released to them in the window, these among them. A key
+	* read again exposes nothing new, so it counts once, whatever its version.
+	* Counted under their row's lock, so exactly (`Reads`).
+	*/
+	#overBulkLimit(d) {
+		return d.reads.released > this.#config.bulkLimit.count;
 	}
 	/**
 	* Make each holder a reference to its source: the actor writes the holder
@@ -2376,20 +2821,17 @@ var VaultService = class {
 			};
 		};
 		return this.#decide([principal], async (d) => {
-			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
 			const natures$1 = await natures(d.tx, [...sources.values()].map((source) => source.secretId));
 			const environments = await environmentsById(d.tx, items.flatMap((item) => {
 				const source = sources.get(item.source.secretId);
 				return source === void 0 ? [item.holder.environmentId] : [item.holder.environmentId, source.environmentId];
 			}));
-			const gone = (place) => environments.get(place.environmentId)?.deleted ?? false;
 			const codes = items.map((item) => {
 				const source = sources.get(item.source.secretId);
 				if (source === void 0 || projectOf.get(item.holder.environmentId) !== item.holder.projectId) return "bad_claim";
 				if (source.secretId === item.holder.secretId) return "invalid";
-				if (environments.get(item.holder.environmentId)?.owner != null || environments.get(source.environmentId)?.owner != null) return "personal";
-				const at = placeIn(source, environments);
-				return refuses(reader, "secret.write", placeIn(item.holder, environments), gone(item.holder)) ?? refuses(reader, "secret.read", at, gone(source)) ?? (natures$1.get(source.secretId) === "sensitive" ? refuses(reader, "secret.use", at, gone(source)) : null);
+				return referenceRefusal(reader, item.holder, source, environments, natures$1.get(source.secretId) ?? "secret");
 			});
 			const first = codes.find((code) => code !== null) ?? null;
 			if (first !== null) throw new Refused(refusal(first, MESSAGES[first]), items.map((item, i) => entry(item, "deny", codes[i] ?? first)));
@@ -2455,7 +2897,7 @@ var VaultService = class {
 			return seals.map((seal) => done.has(seal.seq) ? "ended" : null);
 		};
 		return this.#decide([principal], async (d) => {
-			const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports), input);
+			const actor = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), input);
 			const environments = await environmentsById(d.tx, seals.map((seal) => seal.holder.environmentId));
 			const codes = seals.map((seal) => {
 				const holder = refuses(actor, "secret.write", placeIn(seal.holder, environments), false);
@@ -2556,7 +2998,7 @@ var VaultService = class {
 	*/
 	async #makeOwner(d, principal, reason) {
 		const row = d.members.get(principal);
-		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+		const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 		if (subject.status === "active" && ownsInstance(subject.live)) return false;
 		const tampered = subject.status === "tampered";
 		if (tampered && await this.#logged(d.tx, principal) === void 0) return false;
@@ -2610,10 +3052,10 @@ var VaultService = class {
 	* What `principal` holds, their row checked first (`#integrity`): a row
 	* that fails holds nothing, and is `tampered`.
 	*/
-	async #standing(db, principal, row, at, reports) {
+	async #standing(db, principal, row, at, reports, reads) {
 		const none = NOTHING;
-		const grants$1 = row === void 0 ? [] : await grants(db, principal);
-		const fault = await this.#integrity(db, principal, row, grants$1, reports);
+		const grants$1 = row === void 0 ? [] : reads?.grants.get(principal) ?? await grants(db, principal);
+		const fault = await this.#integrity(db, principal, row, grants$1, reports, reads);
 		if (fault !== null) return {
 			principal,
 			status: "tampered",
@@ -2643,7 +3085,7 @@ var VaultService = class {
 			role: grant.role
 		}));
 		const { role, scope } = roleOf(principal, row);
-		const { policy } = await this.#policyAt(db, reports, at);
+		const { policy } = await this.#policyAt(db, reports, at, reads);
 		const service = !principal.startsWith("user:");
 		return {
 			principal,
@@ -2703,13 +3145,17 @@ var VaultService = class {
 	/** `access`, as the rows are now. */
 	async #read(principal, superseded) {
 		const read = async (db, reports) => {
-			const [row, held, at] = await Promise.all([
-				member(db, principal),
-				grants(db, principal),
-				this.#now(db)
-			]);
-			const fault = await this.#integrity(db, principal, row, held, reports);
-			const { policy } = await this.#policyAt(db, reports, at);
+			const reads = await snapshot(db, {
+				principals: [principal],
+				members: true
+			});
+			const [row, held, at] = [
+				reads.members.get(principal),
+				reads.grants.get(principal),
+				this.#at(reads)
+			];
+			const fault = await this.#integrity(db, principal, row, held, reports, reads);
+			const { policy } = await this.#policyAt(db, reports, at, reads);
 			return this.#access(principal, row, held, at, fault !== null, policy);
 		};
 		const found = [];
@@ -2784,7 +3230,7 @@ var VaultService = class {
 				const expiresAt = change.expiresAt === null ? null : Date.parse(change.expiresAt);
 				if (Number.isNaN(expiresAt) || expiresAt !== null && expiresAt <= d.at) throw refused("invalid", "an end date must be in the future");
 			}
-			const { policy } = await this.#policyAt(d.tx, d.reports, d.at);
+			const { policy } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
 			for (const change of changes) {
 				if (change.role !== null && !isRole(change.role, policy)) throw refused("invalid", `no such role: ${change.role}`);
 				if (change.role !== null && change.environmentId !== null && !assignableToEnvironment(change.role, policy)) throw refused("invalid", `${change.role} can only be granted on a project`);
@@ -2800,13 +3246,13 @@ var VaultService = class {
 					environmentSlug: environment.slug
 				};
 			});
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const manages = where.every((place) => mayManageAccess(acting.live, place));
 			if (!manages && !(SERVICE.test(principal) && PERSON.test(actor))) throw refused("not_allowed");
 			if (actor === principal && changes.some((change) => change.role !== null)) throw refused("not_allowed", "nobody grants themselves a role: ask another admin");
 			const row = d.members.get(principal);
-			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			const admitted = input.admit === true && row?.status !== "active" ? await this.#admitWith(d, acting, principal, row, input) : void 0;
 			if (admitted === void 0 && row?.status === "removed") throw refused("removed");
@@ -2906,7 +3352,7 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [accessEntry(actor, "member.add", principal, "deny", input, asked, code)]);
 		return this.#decide([actor, principal], async (d) => {
 			validateCorrelation(input);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const service = SERVICE.test(principal) && (input.role ?? "member") === "member" && input.scope === void 0;
 			if (!runsInstance(acting.live)) await this.#setsUp(d, acting, service, refused);
@@ -2919,7 +3365,7 @@ var VaultService = class {
 			};
 			if (wanted !== void 0 && wanted.role !== "member" && !principal.startsWith("user:")) throw refused("invalid", "service accounts hold project grants only, never an instance role");
 			const row = d.members.get(principal);
-			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 			if (subject.status === "tampered") throw refused("tampered", TAMPERED_SUBJECT);
 			d.touched.add(principal);
 			d.grants.set(principal, [...subject.stored]);
@@ -3020,10 +3466,10 @@ var VaultService = class {
 			validateCorrelation(input);
 			if (!PRINCIPAL.test(principal)) throw refused("invalid", `not a member: ${shownMember(principal)}`);
 			const row = d.members.get(principal);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			const holder = acting.live;
-			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports);
+			const subject = await this.#standing(d.tx, principal, row, d.at, d.reports, d.reads);
 			const held = subject.stored;
 			if (this.#listed(principal)) throw refused("not_allowed", declaredOwner(principal));
 			if (subject.status === "tampered") {
@@ -3127,20 +3573,21 @@ var VaultService = class {
 	* no role holds anything but Owner, otherwise whoever can insert rows
 	* could unprotect them. Its edits are then unknown, not none.
 	*/
-	async #policyAt(db, reports, at) {
-		const entry = await newestAuthentic((limit, before) => newestVaultEntries(db, POLICY, limit, before), this.#check(reports, null));
+	async #policyAt(db, reports, at, reads) {
+		const entry = await newestAuthentic((limit, before) => reads !== void 0 && before === void 0 ? Promise.resolve(reads.newestPolicy === null ? [] : [reads.newestPolicy]) : newestVaultEntries(db, POLICY, limit, before), this.#check(reports, null));
 		if (entry === "none") return {
 			policy: DEFAULT_POLICY,
 			edits: NO_EDITS,
 			readable: true
 		};
 		const edits = typeof entry === "string" ? null : readEdits(JSON.parse(entry.metadata));
-		return edits === null ? {
+		if (edits === null) return {
 			policy: CLOSED_POLICY,
 			edits: NO_EDITS,
 			readable: false
-		} : {
-			policy: await livePolicy(db, edits, at),
+		};
+		return {
+			policy: livePolicy(entry === reads?.newestPolicy ? reads.environments : await environmentsById(db, edits.protected.map((place) => place.environmentId)), edits, at),
 			edits,
 			readable: true
 		};
@@ -3165,11 +3612,11 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [entry("deny", { change: describeChange(change) }, code)]);
 		return this.#decide([actor], async (d) => {
 			validateCorrelation(input);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			if (acting.status !== "active") throw refused(acting.status === "removed" ? "removed" : "not_a_member");
-			const newest = await newestVaultSeq(d.tx, POLICY);
-			const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at);
+			const newest = d.reads.newestPolicy?.seq ?? null;
+			const { policy: before, edits, readable } = await this.#policyAt(d.tx, d.reports, d.at, d.reads);
 			if (revision !== void 0 && policyRevision(newest, before) !== revision) throw refused("policy_changed");
 			const owner = acting.live.credentialScope == null && ownsInstance(acting.live);
 			if (!readable && !owner) throw refused("not_allowed", "the vault cannot read its own policy: only an Owner of the whole instance writes it again, from the roles as they ship");
@@ -3220,12 +3667,12 @@ var VaultService = class {
 						at: d.at
 					}))].sort((a, b) => a.environmentId < b.environmentId ? -1 : 1);
 				} else {
-					if (!owner) throw refused("not_allowed", "only an Owner of the whole instance unprotects an environment");
-					next.protected = next.protected.filter((place) => !change.environmentIds.includes(place.environmentId));
+					if (!ownsProject(acting.live, change.projectId)) throw refused("not_allowed", "only an Owner of its project, or of the whole instance, unprotects an environment");
+					next.protected = next.protected.filter((place) => place.projectId !== change.projectId || !change.environmentIds.includes(place.environmentId));
 				}
 			} else throw refused("invalid", "a change is to a role, an instance role, or protection");
 			const answer = {
-				policy: await livePolicy(d.tx, next, d.at),
+				policy: livePolicy(await environmentsById(d.tx, next.protected.map((place) => place.environmentId)), next, d.at),
 				seq: newest === null ? null : Number(newest)
 			};
 			if (!readable || JSON.stringify(next) !== JSON.stringify(edits)) {
@@ -3257,7 +3704,7 @@ var VaultService = class {
 		const refused = (code, message = MESSAGES[code]) => new Refused(refusal(code, message), [entry("deny", { serviceAccounts: input.settings?.serviceAccounts ?? null }, code)]);
 		return this.#decide([actor], async (d) => {
 			validateCorrelation(input);
-			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports), input);
+			const acting = through(await this.#standing(d.tx, actor, d.members.get(actor), d.at, d.reports, d.reads), input);
 			if (acting.status === "tampered") throw refused("tampered");
 			if (!runsInstance(acting.live)) throw refused("not_allowed", "only admins and owners of the whole instance change its settings");
 			if (!isScope(input.settings?.serviceAccounts)) throw refused("invalid", "who sets up service accounts is a scope: { projects, environments }, each all, only or except");
@@ -4226,54 +4673,6 @@ function viaDetail(via, seal) {
 	};
 }
 /**
-* Where a decision checks a permission: an environment, with its slug as
-* the store has it when it was read and is in the project claimed;
-* otherwise none, which no grant on a slug matches.
-*/
-function placeIn(place, environments) {
-	const environment = environments.get(place.environmentId);
-	const slug = environment?.projectId === place.projectId ? environment.slug : null;
-	return {
-		projectId: place.projectId,
-		environmentId: place.environmentId,
-		environmentSlug: slug
-	};
-}
-/**
-* Why `reader` may not do `permission` at `where`, or null if they may. A
-* deleted place is refused before any grant is asked, so no kind of grant,
-* on the project, the environment or every project, can reach into one.
-*/
-/**
-* A key of a personal config is its owner's alone (docs/design/forking.md,
-* section 4): no grant or role opens or wraps it, an Owner's included,
-* only its owner, while they read the environment it is a config of,
-* whatever the call is. Nor does any reference reach into or out of one.
-* Undefined for a key of any other environment, decided as ever.
-*/
-function personalRefusal(reader, principal, permission, secret, at, environments) {
-	const own = environments.get(secret.environmentId);
-	const held = at.environmentId === secret.environmentId ? own : environments.get(at.environmentId);
-	if (own?.owner == null && held?.owner == null) return void 0;
-	if (own !== held || principal !== own?.owner || own.parentId === null) return "personal";
-	const parent = placeIn({
-		projectId: secret.projectId,
-		environmentId: own.parentId
-	}, environments);
-	const gone = own.deleted || (environments.get(own.parentId)?.deleted ?? true);
-	const refused = refuses(reader, "secret.use", parent, gone) === null ? null : refuses(reader, "secret.read", parent, gone);
-	if (refused !== null) return refused;
-	return withinCredential(reader.live, permission === "secret.read" ? "secret.use" : permission, parent) ? null : "no_grant";
-}
-function refuses(reader, permission, where, deleted) {
-	if (reader.status === "tampered") return "tampered";
-	if (reader.status === "removed") return "removed";
-	if (reader.status === "unknown") return "not_a_member";
-	if (deleted) return "deleted";
-	if (allows(reader.live, permission, where)) return null;
-	return allows(reader.all, permission, where) ? "expired" : "no_grant";
-}
-/**
 * An entry about a key. A new secret's row is not committed when its key is
 * wrapped, so a wrap names the secret in its payload; the others name it.
 */
@@ -4382,7 +4781,7 @@ function oneRead(group) {
 }
 /** Whether `entry` changes a member's access: what their row's `access_seq` names. */
 function isAccessEntry(entry) {
-	return entry.decision === "allow" && entry.subjectPrincipal !== void 0 && entry.subjectPrincipal !== null && ACCESS_ACTIONS.includes(entry.action);
+	return entry.decision === "allow" && entry.subjectPrincipal !== void 0 && entry.subjectPrincipal !== null && ACCESS_ACTIONS$1.includes(entry.action);
 }
 /** An entry about a member's access. */
 function accessEntry(actor, action, principal, decision, correlation, detail, code = null) {
@@ -4486,8 +4885,7 @@ function readEdits(stored) {
 * keeps its slug, which a scoped instance role's filters read. The edits
 * keep them all: no write is needed.
 */
-async function livePolicy(db, edits, at) {
-	const rows = await environmentsById(db, edits.protected.map((place) => place.environmentId));
+function livePolicy(rows, edits, at) {
 	const live = edits.protected.filter((place) => {
 		const row = rows.get(place.environmentId);
 		return row === void 0 ? at - place.at < UNWRITTEN_FORK_MS : !row.deleted;