@coffre/vault 0.14.0 → 0.14.2

package/dist/cloudflare.d.ts

@@ -18,6 +18,7 @@ export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   #private;
   unwrap(input: UnwrapInput): Promise<import("@coffre/core/vault").Outcome<{
     keys: string[];
+    accessRevision?: string;
   }>>;
   wrap(input: WrapInput): Promise<import("@coffre/core/vault").Outcome<import("@coffre/core/vault").Wrapped>>;
   rewrap(input: RewrapInput): Promise<import("@coffre/core/vault").Outcome<import("@coffre/core/vault").Wrapped>>;

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-B0d-W-SI.js";
-import { n as prepareVault, t as openVault } from "./vault-C5n9wSvj.js";
+import { n as prepareVault, t as openVault } from "./vault-hLffpMy5.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-B0d-W-SI.js";
-import { n as prepareVault, t as openVault } from "./vault-C5n9wSvj.js";
+import { n as prepareVault, t as openVault } from "./vault-hLffpMy5.js";
 import { isUnavailable } from "@coffre/db/dialect";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";

package/dist/{vault-C5n9wSvj.js → vault-hLffpMy5.js}

@@ -1,4 +1,4 @@
-import { ACCESS_ACTIONS, ACCESS_ACTIONS as ACCESS_ACTIONS$1, POLICY_REVISION, checkpointMessage, checkpointVerifier, describeAccessFault, handsBack, policyRevision } from "@coffre/core/vault";
+import { ACCESS_ACTIONS, ACCESS_ACTIONS as ACCESS_ACTIONS$1, POLICY_REVISION, accessRevision, checkpointMessage, checkpointVerifier, describeAccessFault, handsBack, policyRevision } from "@coffre/core/vault";
 import { DEK_BYTES, KEY_CHECK, KEY_CHECK_CONTEXT, KEY_CHECK_VALUE, KekBadClaimError, KekCancelledError, KekUnavailableError, LocalKekProvider } from "@coffre/core/kek";
 import { createHash, createHmac, hkdfSync, randomUUID, timingSafeEqual } from "node:crypto";
 import { prepared, tablesOf } from "@coffre/db";
@@ -1891,6 +1891,7 @@ const MESSAGES = {
 	last_owner: "the last Owner of the whole instance stays one: make someone else an Owner first",
 	invalid: "not something the rules allow",
 	policy_changed: "the instance's roles or protected environments changed while this was asked: try again",
+	access_changed: "what this member holds changed since the read was decided: try again",
 	log_broken: "the vault log does not hold from the last checkpoint",
 	wrong_kek: "this vault's key does not open the data it holds",
 	tampered: "this member's record failed the vault's integrity check"
@@ -2390,6 +2391,7 @@ var VaultService = class {
 		const { principal } = input;
 		validateText(input.purpose);
 		if (input.keepsSensitive !== void 0 && typeof input.keepsSensitive !== "boolean") throw new Error("keepsSensitive is true, false or absent");
+		if (input.accessRevision !== void 0 && typeof input.accessRevision !== "string") throw new Error("accessRevision names an answer of access, or is absent");
 		const vias = input.items.map((item) => validateVia(item.via));
 		const throughs = input.items.map((item) => validateThrough(item.through));
 		const loaded = await this.#versions(input, "secret.read", { purpose: input.purpose });
@@ -2431,8 +2433,8 @@ var VaultService = class {
 				secretVersionId: versionIds.get(secret)
 			};
 		};
-		if (viaOk.includes(false)) return this.#refuseVersions(principal, "bad_claim", items.map((item) => entry(item.secret, "deny", "bad_claim")));
-		if (throughOk.includes(false)) return this.#refuseVersions(principal, "bad_claim", items.map((item) => entry(item.secret, "deny", "bad_claim")));
+		if (viaOk.includes(false)) return this.#refuseVersions(principal, "bad_claim", items.map((item) => entry(item.secret, "deny", "bad_claim")), { asked: input.accessRevision });
+		if (throughOk.includes(false)) return this.#refuseVersions(principal, "bad_claim", items.map((item) => entry(item.secret, "deny", "bad_claim")), { asked: input.accessRevision });
 		const ends = sealed.flatMap((seal) => seal === null ? [] : [seal.seq]);
 		const remote = items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
 		return this.#keys({
@@ -2453,13 +2455,16 @@ var VaultService = class {
 				key,
 				wipe: () => key.fill(0)
 			};
-		}), (opened) => ({ keys: opened.map(({ key }) => {
-			try {
-				return base64(key);
-			} finally {
-				key.fill(0);
-			}
-		}) }));
+		}), (opened) => ({
+			keys: opened.map(({ key }) => {
+				try {
+					return base64(key);
+				} finally {
+					key.fill(0);
+				}
+			}),
+			...input.accessRevision === void 0 ? {} : { accessRevision: input.accessRevision }
+		}));
 	}
 	async wrap(input) {
 		const { principal, items } = input;
@@ -2510,7 +2515,7 @@ var VaultService = class {
 		if (items.some((item, i) => !loosens[i] && item.secret.sensitive !== true && strict(i))) return this.#refuseVersions(principal, "invalid", loaded.versions.map((source) => ({
 			...keyEntry("key.rewrap", principal, source.secret, "deny", "invalid", input),
 			secretVersionId: source.id
-		})), LOOSER);
+		})), { message: LOOSER });
 		const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
 		const loosened = new Set(items.flatMap((item, i) => loosens[i] ? [item.secret] : []));
 		const entry = (secret, decision, code) => ({
@@ -2572,7 +2577,7 @@ var VaultService = class {
 		if ([...found.values()].some((version) => version.deleted)) return this.#refuseVersions(input.principal, "deleted", [...found.values()].map((version) => ({
 			...keyEntry(action, input.principal, version.secret, "deny", "deleted", input, detail),
 			secretVersionId: version.id
-		})));
+		})), { asked: input.accessRevision });
 		if (ids.some((id) => !found.has(id))) return this.#refuseVersions(input.principal, "bad_claim", ids.map((id) => {
 			const version = found.get(id);
 			if (version === void 0) return {
@@ -2592,14 +2597,23 @@ var VaultService = class {
 				...keyEntry(action, input.principal, version.secret, "deny", "bad_claim", input, detail),
 				secretVersionId: id
 			};
-		}));
+		}), { asked: input.accessRevision });
 		return {
 			ok: true,
 			versions: ids.map((id) => found.get(id))
 		};
 	}
-	async #refuseVersions(principal, code, entries, message = MESSAGES[code]) {
-		return this.#decide([principal], async () => {
+	/**
+	* Refuse a call for what its versions are, under the principal's row, as
+	* any decision: and a read on a kept answer no longer theirs as that, not
+	* for its versions, logging no read (`accessRevision`).
+	*/
+	async #refuseVersions(principal, code, entries, { message = MESSAGES[code], asked } = {}) {
+		return this.#decide([principal], async (d) => {
+			if (asked !== void 0) {
+				const standing = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads);
+				if (this.#revisionOf(standing, d) !== asked) throw new Refused(refusal("access_changed", MESSAGES.access_changed), []);
+			}
 			throw new Refused(refusal(code, message), entries);
 		});
 	}
@@ -2636,7 +2650,10 @@ var VaultService = class {
 		});
 		const owners = /* @__PURE__ */ new Map();
 		const check = async (d) => {
-			const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
+			const standing = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads);
+			const asked = call.input.accessRevision;
+			if (asked !== void 0 && this.#revisionOf(standing, d) !== asked) throw new Refused(refusal("access_changed", MESSAGES.access_changed), []);
+			const reader = through(standing, call.input);
 			const at = secrets.map((secret, i) => call.places?.[i] ?? secret);
 			const environments = d.reads.environments;
 			owners.clear();
@@ -2725,7 +2742,7 @@ var VaultService = class {
 			try {
 				await check(d);
 			} catch (error) {
-				if (error instanceof Refused) throw new Refused(error.refusal, secrets.map((secret, item) => outcomeEntry(secret, item, "deny", error.entries[item].code ?? error.refusal.code)));
+				if (error instanceof Refused && !(error.refusal.code === "access_changed" && intentSeq === null)) throw new Refused(error.refusal, secrets.map((secret, item) => outcomeEntry(secret, item, "deny", error.entries[item]?.code ?? error.refusal.code)));
 				throw error;
 			}
 		};
@@ -3110,7 +3127,7 @@ var VaultService = class {
 	}
 	#access(principal, row, held, at, tampered, policy) {
 		const active = PRINCIPAL.test(principal) && !tampered && row?.status === "active";
-		return {
+		const access = {
 			principal,
 			status: tampered ? "tampered" : !PRINCIPAL.test(principal) ? "unknown" : row?.status ?? "unknown",
 			generation: row?.generation ?? 0,
@@ -3123,6 +3140,16 @@ var VaultService = class {
 			by: row?.statusChangedBy ?? null,
 			policy
 		};
+		return {
+			...access,
+			revision: accessRevision(access)
+		};
+	}
+	/** The revision of what `access` would answer about a standing a decision read: none but an active member's matches a kept answer. */
+	#revisionOf(standing, d) {
+		const { policy } = standing.live;
+		if (standing.status !== "active" || policy === void 0) return null;
+		return this.#access(standing.principal, d.members.get(standing.principal), standing.stored, d.at, false, policy).revision;
 	}
 	/**
 	* What `principal` holds now. Read without locks, the fast way; a row that
@@ -3959,15 +3986,16 @@ var VaultService = class {
 	/**
 	* Sign the log up to its last entry, from the newest checkpoint's tally.
 	*
-	* In one snapshot, and without the log's lock, so that no append waits on
-	* it: every member's row checked, since rows changed around the vault
-	* write nothing to the log; the prefix the newest checkpoint signed still
-	* there, its hash where it was, which a rewrite chained again changes, and
-	* every entry of it, which a cut changes; the chain recomputed from there,
-	* every hash from content and every vault entry by its MAC, no further
-	* than one walk (`walks.checkpoint`); and a stretch of the prefixes signed
-	* before rehashed (`#scrub`). Then, under the lock, the entries appended
-	* since the snapshot, so that it signs the head.
+	* Without the log's lock, so that no append waits on it, and in one short
+	* snapshot: every member's row checked, since rows changed around the
+	* vault write nothing to the log; the prefix the newest checkpoint signed
+	* still there, its hash where it was, which a rewrite chained again
+	* changes, and every entry of it, which a cut changes. Then, in no
+	* transaction, a batch a statement, the chain recomputed from there, every
+	* hash from content and every vault entry by its MAC, no further than one
+	* walk (`walks.checkpoint`); and a stretch of the prefixes signed before
+	* rehashed (`#scrub`). Then, under the lock, the entries appended since
+	* the walk, so that it signs the head.
 	*
 	* A walk cut short signs where it got to, behind the head: the log after
 	* an upgrade from 0.10.0, whose checkpoints kept no tally, is signed again
@@ -3980,7 +4008,7 @@ var VaultService = class {
 		const { walks } = this.#prepared.options;
 		const found = [];
 		let seen = null;
-		const walked = await this.#db.transaction(async (tx) => {
+		const resumed = await this.#db.transaction(async (tx) => {
 			seen = (await newestCheckpointEntry(tx))?.seq ?? null;
 			await this.#sweep(tx, found);
 			const from = await this.#resume(tx, "newest");
@@ -3997,20 +4025,9 @@ var VaultService = class {
 				failedAtSeq: Number(gap.found),
 				reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}`
 			};
-			const walk = new Walk(from.tally, from.digest);
-			const chain = await rehash(tx, logKeys, from.at, walk, { limit: walks.checkpoint });
-			if (!chain.ok) return chain;
-			const unsigned = await this.#checkpointFault(tx, walk.checkpoints);
-			if (unsigned !== null) return unsigned;
-			return {
-				ok: true,
-				from,
-				tally: walk.tally(),
-				digest: walk.digest(),
-				at: chain.at,
-				done: chain.done
-			};
+			return from;
 		}, SNAPSHOT);
+		const walked = resumed.ok ? await this.#walkOn(resumed, walks.checkpoint) : resumed;
 		let scrub = {
 			ok: true,
 			next: walked.ok ? walked.from.scrub : null
@@ -4120,6 +4137,31 @@ var VaultService = class {
 		});
 	}
 	/**
+	* The walk on from where a checkpoint resumes, no further than `limit`
+	* entries, outside any transaction: a batch a statement, each linked to
+	* the hash it verified last, so that no connection is held while it
+	* rehashes, seconds for a long walk. Entries are appended in order, under
+	* the head, and never change, so no snapshot keeps them: what it read is
+	* held to the log again under the head, before anything is signed over it
+	* (`carries`).
+	*/
+	async #walkOn(from, limit) {
+		const { logKeys } = this.#prepared;
+		const walk = new Walk(from.tally, from.digest);
+		const chain = await rehash(this.#db, logKeys, from.at, walk, { limit });
+		if (!chain.ok) return chain;
+		const unsigned = await this.#checkpointFault(this.#db, walk.checkpoints);
+		if (unsigned !== null) return unsigned;
+		return {
+			ok: true,
+			from,
+			tally: walk.tally(),
+			digest: walk.digest(),
+			at: chain.at,
+			done: chain.done
+		};
+	}
+	/**
 	* The prefixes signed before, rehashed a stretch at a time, in laps: a lap
 	* runs from the first entry to the prefix the newest checkpoint signed
 	* when it began, which it keeps (`end`), `walks.scrub` entries a call, each

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.14.0",
-    "@coffre/db": "0.14.0"
+    "@coffre/core": "0.14.2",
+    "@coffre/db": "0.14.2"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/vault.ts

@@ -61,6 +61,7 @@ import {
   checkpointVerifier,
   describeAccessFault,
   POLICY_REVISION,
+  accessRevision,
   policyRevision,
   type Access,
   type AccessChange,
@@ -341,6 +342,7 @@ const MESSAGES: Record<RefusalCode, string> = {
   last_owner: 'the last Owner of the whole instance stays one: make someone else an Owner first',
   invalid: 'not something the rules allow',
   policy_changed: "the instance's roles or protected environments changed while this was asked: try again",
+  access_changed: 'what this member holds changed since the read was decided: try again',
   log_broken: 'the vault log does not hold from the last checkpoint',
   wrong_kek: "this vault's key does not open the data it holds",
   tampered: "this member's record failed the vault's integrity check",
@@ -906,10 +908,11 @@ class VaultService implements Vault {
 
   // Raw DEKs are cleared on every path. JSON and base64 leave strings that
   // cannot be wiped, so this is best-effort memory hygiene.
-  async unwrap(input: UnwrapInput): Promise<Outcome<{ keys: string[] }>> {
+  async unwrap(input: UnwrapInput): Promise<Outcome<{ keys: string[]; accessRevision?: string }>> {
     const { principal } = input;
     validateText(input.purpose);
     if (input.keepsSensitive !== undefined && typeof input.keepsSensitive !== 'boolean') throw new Error('keepsSensitive is true, false or absent');
+    if (input.accessRevision !== undefined && typeof input.accessRevision !== 'string') throw new Error('accessRevision names an answer of access, or is absent');
     const vias = input.items.map((item) => validateVia(item.via));
     const throughs = input.items.map((item) => validateThrough(item.through));
     const loaded = await this.#versions(input, 'secret.read', { purpose: input.purpose });
@@ -947,10 +950,10 @@ class VaultService implements Vault {
       };
     };
     if (viaOk.includes(false)) {
-      return this.#refuseVersions(principal, 'bad_claim', items.map((item) => entry(item.secret, 'deny', 'bad_claim')));
+      return this.#refuseVersions(principal, 'bad_claim', items.map((item) => entry(item.secret, 'deny', 'bad_claim')), { asked: input.accessRevision });
     }
     if (throughOk.includes(false)) {
-      return this.#refuseVersions(principal, 'bad_claim', items.map((item) => entry(item.secret, 'deny', 'bad_claim')));
+      return this.#refuseVersions(principal, 'bad_claim', items.map((item) => entry(item.secret, 'deny', 'bad_claim')), { asked: input.accessRevision });
     }
     const ends = sealed.flatMap((seal) => (seal === null ? [] : [seal.seq]));
     const remote = items.some(({ wrapped }) => this.#remote(this.#config.keks.providerOf(wrapped)));
@@ -984,6 +987,8 @@ class VaultService implements Vault {
             key.fill(0);
           }
         }),
+        // Named back: the read was decided on that answer, which this vault checked.
+        ...(input.accessRevision === undefined ? {} : { accessRevision: input.accessRevision }),
       }),
     );
   }
@@ -1042,7 +1047,7 @@ class VaultService implements Vault {
     if (items.some((item, i) => !loosens[i] && item.secret.sensitive !== true && strict(i))) {
       return this.#refuseVersions(principal, 'invalid', loaded.versions.map((source) => ({
         ...keyEntry('key.rewrap', principal, source.secret, 'deny', 'invalid', input), secretVersionId: source.id,
-      })), LOOSER);
+      })), { message: LOOSER });
     }
     const sources = new Map(items.map((item, i) => [item.secret, loaded.versions[i]]));
     const loosened = new Set(items.flatMap((item, i) => (loosens[i] ? [item.secret] : [])));
@@ -1094,7 +1099,7 @@ class VaultService implements Vault {
 
   /** Versions need no lock: they change only by being erased, once their place is archived, and their ids determine the whole batch before any key call. */
   async #versions(
-    input: Correlation & { principal: string; items: { secretVersionId: string }[] },
+    input: Correlation & { principal: string; items: { secretVersionId: string }[]; accessRevision?: string },
     action: KeyAction,
     detail: Record<string, unknown> = {},
   ): Promise<Outcome<{ versions: store.SecretVersion[] }>> {
@@ -1110,7 +1115,7 @@ class VaultService implements Vault {
     if ([...found.values()].some((version) => version.deleted)) {
       return this.#refuseVersions(input.principal, 'deleted', [...found.values()].map((version) => ({
         ...keyEntry(action, input.principal, version.secret, 'deny', 'deleted', input, detail), secretVersionId: version.id,
-      })));
+      })), { asked: input.accessRevision });
     }
     if (ids.some((id) => !found.has(id))) {
       return this.#refuseVersions(input.principal, 'bad_claim', ids.map((id) => {
@@ -1121,13 +1126,27 @@ class VaultService implements Vault {
           metadata: JSON.stringify({ ...detail, secretVersionId: id, ...traced(input) }),
         };
         return { ...keyEntry(action, input.principal, version.secret, 'deny', 'bad_claim', input, detail), secretVersionId: id };
-      }));
+      }), { asked: input.accessRevision });
     }
     return { ok: true, versions: ids.map((id) => found.get(id)!) };
   }
 
-  async #refuseVersions(principal: string, code: 'bad_claim' | 'deleted' | 'invalid', entries: NewEntry[], message = MESSAGES[code]): Promise<Outcome<never>> {
-    return this.#decide([principal], async () => {
+  /**
+   * Refuse a call for what its versions are, under the principal's row, as
+   * any decision: and a read on a kept answer no longer theirs as that, not
+   * for its versions, logging no read (`accessRevision`).
+   */
+  async #refuseVersions(
+    principal: string,
+    code: 'bad_claim' | 'deleted' | 'invalid',
+    entries: NewEntry[],
+    { message = MESSAGES[code], asked }: { message?: string; asked?: string } = {},
+  ): Promise<Outcome<never>> {
+    return this.#decide([principal], async (d) => {
+      if (asked !== undefined) {
+        const standing = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads);
+        if (this.#revisionOf(standing, d) !== asked) throw new Refused(refusal('access_changed', MESSAGES.access_changed), []);
+      }
       throw new Refused(refusal(code, message), entries);
     });
   }
@@ -1185,7 +1204,7 @@ class VaultService implements Vault {
       viaReference?: readonly boolean[];
       remote: boolean;
       entry: (secret: SecretRef, decision: 'allow' | 'deny', code: string | null) => NewEntry;
-      input: Correlation & Through & { purpose?: string; keepsSensitive?: boolean };
+      input: Correlation & Through & { purpose?: string; keepsSensitive?: boolean; accessRevision?: string };
     },
     /**
      * One per secret; null for a bad claim, an error for an outage or an
@@ -1206,7 +1225,11 @@ class VaultService implements Vault {
     // Each personal config's owner, hashed, by environment, as the decision read them: what its keys' contexts bind.
     const owners = new Map<string, string>();
     const check = async (d: Decision) => {
-      const reader = through(await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads), call.input);
+      const standing = await this.#standing(d.tx, principal, d.members.get(principal), d.at, d.reports, d.reads);
+      // A read decided on an earlier answer about its reader, only while that is still the answer: nothing read, nothing logged.
+      const asked = call.input.accessRevision;
+      if (asked !== undefined && this.#revisionOf(standing, d) !== asked) throw new Refused(refusal('access_changed', MESSAGES.access_changed), []);
+      const reader = through(standing, call.input);
       // One read of the environments the decision is about, as the store has them, not as the app sent them:
       // each secret's and, for a read through a reference, its holder's. A grant on one slug in every project
       // matches the slug there, and a place deleted on either side opens for none.
@@ -1290,9 +1313,11 @@ class VaultService implements Vault {
       try {
         await check(d);
       } catch (error) {
-        if (error instanceof Refused) {
+        // A read on a kept answer no longer the vault's logs no read; but a key service's intent, logged already, is
+        // accounted for all the same, each key refused, as after any other refusal.
+        if (error instanceof Refused && !(error.refusal.code === 'access_changed' && intentSeq === null)) {
           throw new Refused(error.refusal, secrets.map((secret, item) =>
-            outcomeEntry(secret, item, 'deny', error.entries[item].code ?? error.refusal.code)));
+            outcomeEntry(secret, item, 'deny', error.entries[item]?.code ?? error.refusal.code)));
         }
         throw error;
       }
@@ -1665,7 +1690,7 @@ class VaultService implements Vault {
 
   #access(principal: string, row: Member | undefined, held: readonly GrantRow[], at: number, tampered: boolean, policy: Policy): Access {
     const active = PRINCIPAL.test(principal) && !tampered && row?.status === 'active';
-    return {
+    const access: Access = {
       principal,
       status: tampered ? 'tampered' : !PRINCIPAL.test(principal) ? 'unknown' : (row?.status ?? 'unknown'),
       generation: row?.generation ?? 0,
@@ -1675,6 +1700,14 @@ class VaultService implements Vault {
       by: row?.statusChangedBy ?? null,
       policy,
     };
+    return { ...access, revision: accessRevision(access) };
+  }
+
+  /** The revision of what `access` would answer about a standing a decision read: none but an active member's matches a kept answer. */
+  #revisionOf(standing: Standing, d: Decision): string | null {
+    const { policy } = standing.live;
+    if (standing.status !== 'active' || policy === undefined) return null;
+    return this.#access(standing.principal, d.members.get(standing.principal), standing.stored, d.at, false, policy).revision!;
   }
 
   /**
@@ -2498,15 +2531,16 @@ class VaultService implements Vault {
   /**
    * Sign the log up to its last entry, from the newest checkpoint's tally.
    *
-   * In one snapshot, and without the log's lock, so that no append waits on
-   * it: every member's row checked, since rows changed around the vault
-   * write nothing to the log; the prefix the newest checkpoint signed still
-   * there, its hash where it was, which a rewrite chained again changes, and
-   * every entry of it, which a cut changes; the chain recomputed from there,
-   * every hash from content and every vault entry by its MAC, no further
-   * than one walk (`walks.checkpoint`); and a stretch of the prefixes signed
-   * before rehashed (`#scrub`). Then, under the lock, the entries appended
-   * since the snapshot, so that it signs the head.
+   * Without the log's lock, so that no append waits on it, and in one short
+   * snapshot: every member's row checked, since rows changed around the
+   * vault write nothing to the log; the prefix the newest checkpoint signed
+   * still there, its hash where it was, which a rewrite chained again
+   * changes, and every entry of it, which a cut changes. Then, in no
+   * transaction, a batch a statement, the chain recomputed from there, every
+   * hash from content and every vault entry by its MAC, no further than one
+   * walk (`walks.checkpoint`); and a stretch of the prefixes signed before
+   * rehashed (`#scrub`). Then, under the lock, the entries appended since
+   * the walk, so that it signs the head.
    *
    * A walk cut short signs where it got to, behind the head: the log after
    * an upgrade from 0.10.0, whose checkpoints kept no tally, is signed again
@@ -2522,7 +2556,7 @@ class VaultService implements Vault {
     const found: NewEntry[] = [];
     // The newest checkpoint entry, signed or refused, as this call's snapshot found it.
     let seen: bigint | null = null;
-    const walked = await this.#db.transaction(async (tx) => {
+    const resumed = await this.#db.transaction(async (tx) => {
       seen = (await store.newestCheckpointEntry(tx))?.seq ?? null;
       await this.#sweep(tx, found);
       const from = await this.#resume(tx, 'newest');
@@ -2533,13 +2567,9 @@ class VaultService implements Vault {
       }
       const gap = await missingEntry(tx, from.at.seq);
       if (gap !== null) return { ok: false as const, failedAtSeq: Number(gap.found), reason: `sequence gap: expected seq ${gap.expected}, found ${gap.found}` };
-      const walk = new Walk(from.tally, from.digest);
-      const chain = await rehash(tx, logKeys, from.at, walk, { limit: walks.checkpoint });
-      if (!chain.ok) return chain;
-      const unsigned = await this.#checkpointFault(tx, walk.checkpoints);
-      if (unsigned !== null) return unsigned;
-      return { ok: true as const, from, tally: walk.tally(), digest: walk.digest(), at: chain.at, done: chain.done };
+      return from;
     }, SNAPSHOT);
+    const walked = resumed.ok ? await this.#walkOn(resumed, walks.checkpoint) : resumed;
     // The past rehashed, in a snapshot of its own. The database failing it leaves the stretch for the
     // next call, where it was, and the checkpoint is signed all the same, saying why (`warning`); a bug
     // throws, as anywhere else.
@@ -2580,7 +2610,7 @@ class VaultService implements Vault {
       // Nothing since the last one, which signed every entry before its own: it is still the newest prefix.
       if (newest !== null && latest!.seq === head.nextSeq - 1n && latest!.relatedSeq === latest!.seq - 1n) return { checkpoint: signedPart(newest) };
       // Under the lock, the rest: the prefix signed last still where it was,
-      // and every entry since the snapshot, unless the walk is catching up,
+      // and every entry since the walk, unless the walk is catching up,
       // when what it walked must still be there. A rewrite is never signed over.
       if (newest !== null && !(await carries(d.tx, newest))) {
         throw refused('log_broken', { reason: `the log up to entry ${newest.seq} is not the prefix the last checkpoint signed` });
@@ -2588,7 +2618,7 @@ class VaultService implements Vault {
       const walk = new Walk(walked.tally, walked.digest);
       let { at } = walked;
       if (walked.done) {
-        // Where the snapshot's walk ended still has the hash it found there: what follows links to it.
+        // Where the walk ended still has the hash it found there: what follows links to it.
         if (!(await carries(d.tx, headOf(at)))) {
           throw refused('log_broken', { failedAtSeq: Number(at.seq), reason: `the log up to entry ${at.seq} changed while the vault walked it` });
         }
@@ -2625,6 +2655,25 @@ class VaultService implements Vault {
     });
   }
 
+  /**
+   * The walk on from where a checkpoint resumes, no further than `limit`
+   * entries, outside any transaction: a batch a statement, each linked to
+   * the hash it verified last, so that no connection is held while it
+   * rehashes, seconds for a long walk. Entries are appended in order, under
+   * the head, and never change, so no snapshot keeps them: what it read is
+   * held to the log again under the head, before anything is signed over it
+   * (`carries`).
+   */
+  async #walkOn(from: Resumed, limit: number) {
+    const { logKeys } = this.#prepared;
+    const walk = new Walk(from.tally, from.digest);
+    const chain = await rehash(this.#db, logKeys, from.at, walk, { limit });
+    if (!chain.ok) return chain;
+    const unsigned = await this.#checkpointFault(this.#db, walk.checkpoints);
+    if (unsigned !== null) return unsigned;
+    return { ok: true as const, from, tally: walk.tally(), digest: walk.digest(), at: chain.at, done: chain.done };
+  }
+
   /**
    * The prefixes signed before, rehashed a stretch at a time, in laps: a lap
    * runs from the first entry to the prefix the newest checkpoint signed