@coffre/vault 0.14.4 → 0.15.0

package/src/cloudflare.ts

@@ -1,38 +1,52 @@
 /**
  * The vault as a Worker, behind an entrypoint the app's `VAULT` service
  * binding calls over RPC. It has no route and no HTTP surface. It decides
- * in the database the app uses, through a Hyperdrive binding of its own,
- * whose login is the vault's:
+ * in the database the app uses, through two Hyperdrive bindings of its
+ * own, the vault's login and its uses' (`coffre_vault_hot`), and seals its
+ * log through the checkpointer's Durable Object:
  *
- *   import { postgres, vault } from '@coffre/vault/cloudflare';
+ *   import { checkpointer, postgres, vault } from '@coffre/vault/cloudflare';
  *
  *   export default vault((env: Env) => ({
- *     database: postgres(env.HYPERDRIVE),
+ *     database: postgres(env.VAULT_HYPERDRIVE),
+ *     hotDatabase: postgres(env.HOT_HYPERDRIVE),
+ *     checkpointer: env.CHECKPOINTER,
  *     kek: { id: env.VAULT_KEY_ID, key: env.VAULT_KEY }, // or awsKms({ keyArn, credentials }), with a signingKey
  *     owners: ['admin@acme.example'],
  *   }));
+ *   export const CoffreCheckpointer = checkpointer();
  *
  * Any number of isolates run it side by side: every decision locks what it
  * is about in the database, so they share one log and one bulk limit.
  */
-import type {
+import type { ChangeBindingsInput, CutoverInput,
   AdmitInput,
   RemoveInput,
+  RevokeCredentialInput,
+  IssueTokenInput,
   ReferenceInput,
   EndReferencesInput,
+  PrepareInput,
   RewrapInput,
   SetAccessInput,
   SetSettingsInput,
+  SignInInput,
   ChangePolicyInput,
   UnwrapInput,
+  NamedUseInput,
+  UseManyInput,
+  UseInput,
   Vault,
   VerifyLogInput,
+  VouchInput,
   WrapInput,
 } from '@coffre/core/vault';
 import { createDatabase } from '@coffre/db';
 import { HyperdrivePool, type PostgresDatabase } from '@coffre/db/hyperdrive';
 import { WorkerEntrypoint } from 'cloudflare:workers';
 
+import type { Witness } from './checkpointer.ts';
+import { checkpointerObject, durableHeldOutside, durableSealing, durableSealThrough, startCheckpointer, startProjector, type ObjectNamespace } from './checkpointer-workers.ts';
 import { resolveVaultConfig, type VaultConfig } from './config.ts';
 import { openVault, prepareVault, type PreparedVault } from './vault.ts';
 
@@ -40,8 +54,29 @@ export type { Vault, VaultConfig };
 export { postgres, type PostgresDatabase } from '@coffre/db/hyperdrive';
 export * from './index.ts';
 
-/** What the vault Worker's `vault(env => …)` returns. */
-export type WorkersVaultConfig = VaultConfig & { database: PostgresDatabase };
+/**
+ * What the vault Worker's `vault(env => …)` returns, for 0.15's log
+ * (docs/design/0.15-plan.md):
+ * - `hotDatabase`: the uses' own Hyperdrive config, whose login is
+ *   `coffre_vault_hot`, and `uses`, how many uses an isolate has in flight
+ *   at most (by default `connections`, the share of that config's pool an
+ *   isolate may hold: T112 measures it), and `uses.batch`, the most keys
+ *   a statement of a request's several makes uses of (100:
+ *   `UseLimits.batch`);
+ * - `checkpointer`: the namespace of the checkpointer's Durable Object,
+ *   `CoffreCheckpointer` (`checkpointer()`, below), bound beside the vault.
+ *   A change answers once that object has sealed it (R51), and the
+ *   verifier holds every check to the pair it remembers;
+ * - `witnesses` (docs/design/audit-tree.md, R40: a deployment opts in).
+ * A configuration without the first two is refused, at the first call.
+ */
+export type WorkersVaultConfig = VaultConfig & {
+  database: PostgresDatabase;
+  hotDatabase: PostgresDatabase;
+  checkpointer: ObjectNamespace;
+  witnesses?: readonly Witness[];
+  uses?: { inFlight?: number; connections?: number; coverMs?: number; names?: number; batch?: number };
+};
 
 /** Set when the Worker's module runs `vault(…)`, before any call comes in. */
 let configure: ((env: never) => WorkersVaultConfig) | null = null;
@@ -51,7 +86,18 @@ let configure: ((env: never) => WorkersVaultConfig) | null = null;
  * isolate keeps: the ready value itself, never the work of making it, which
  * would belong to the call that started it (vault.ts, `PreparedVault`).
  */
-const ready = new WeakMap<object, { database: PostgresDatabase; prepared: PreparedVault }>();
+const ready = new WeakMap<object, Ready>();
+
+/**
+ * One `env`'s vault, ready: its databases, its prepared state, and whether
+ * a call of this isolate started the checkpointer, when a start last
+ * failed, and when a use last started one behind it: settled values, never
+ * the start under way.
+ */
+type Ready = { database: PostgresDatabase; hotDatabase: PostgresDatabase; checkpointer: ObjectNamespace; prepared: PreparedVault; started: boolean; failed: number; kicked: number };
+
+/** How long after a start that failed, the checkpointer's object out of reach, the next call tries again. */
+const START_AGAIN_MS = 10_000;
 
 /**
  * What the app's `VAULT` service binding calls. Each call gets a database of
@@ -60,7 +106,7 @@ const ready = new WeakMap<object, { database: PostgresDatabase; prepared: Prepar
  * call is done.
  */
 export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
-  async #call<T>(run: (vault: Vault) => Promise<T>): Promise<T> {
+  async #call<T>(run: (vault: Required<Vault>) => Promise<T>): Promise<T> {
     const { prepared, database } = await this.#ready();
     const pool = new HyperdrivePool(database.hyperdrive.connectionString);
     try {
@@ -70,15 +116,82 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
     }
   }
 
-  async #ready(): Promise<{ database: PostgresDatabase; prepared: PreparedVault }> {
+  /**
+   * 0.15's use: one connection of the hot path's config, for its one statement. Closed once the call is done, and by
+   * its deadline at the latest, so that a call answered `late` lets go of Hyperdrive by then, as its place in admission
+   * lapses soon after (use.ts, `HELD_PAST_DEADLINE_MS`; T170).
+   */
+  async use(input: UseInput) {
+    const { prepared, hotDatabase } = this.#behind(await this.#prepared());
+    const pool = new HyperdrivePool(hotDatabase.hyperdrive.connectionString);
+    try {
+      const hot = createDatabase(pool);
+      return await openVault(hot, prepared, hot).use!(input);
+    } finally {
+      this.ctx.waitUntil(pool.end(closeBy(input)));
+    }
+  }
+
+  /** A request's several keys (T167): the same one connection, for its one statement, or two. */
+  async useMany(input: UseManyInput) {
+    const { prepared, hotDatabase } = this.#behind(await this.#prepared());
+    if (hotDatabase === undefined) throw new Error("0.15's uses need the hot path's Hyperdrive config: set hotDatabase in vault(…)");
+    const pool = new HyperdrivePool(hotDatabase.hyperdrive.connectionString);
+    try {
+      const hot = createDatabase(pool);
+      return await openVault(hot, prepared, hot).useMany!(input);
+    } finally {
+      this.ctx.waitUntil(pool.end(closeBy(input)));
+    }
+  }
+
+  /** 0.15's use as the request names it: the same one connection, for its read of ids on a miss and its one use. */
+  async useNamed(input: NamedUseInput) {
+    const { prepared, hotDatabase } = this.#behind(await this.#prepared());
+    const pool = new HyperdrivePool(hotDatabase.hyperdrive.connectionString);
+    try {
+      const hot = createDatabase(pool);
+      return await openVault(hot, prepared, hot).useNamed!(input);
+    } finally {
+      this.ctx.waitUntil(pool.end(closeBy(input)));
+    }
+  }
+
+  /** The vault ready, its checkpointer started from this call first, for at most 2 s (`start`). */
+  async #ready(): Promise<Ready> {
+    const entry = await this.#prepared();
+    if (!entry.started && Date.now() - entry.failed >= START_AGAIN_MS) await start(entry);
+    return entry;
+  }
+
+  /**
+   * A use waits on no start (T169, R58): it needs no checkpointer, the days of uses the migrations made and the object
+   * makes ahead of time aside. Its isolate's start goes on behind it, once each START_AGAIN_MS until one answers.
+   */
+  #behind(entry: Ready): Ready {
+    if (!entry.started && Date.now() - entry.kicked >= START_AGAIN_MS) {
+      entry.kicked = Date.now();
+      this.ctx.waitUntil(start(entry));
+    }
+    return entry;
+  }
+
+  async #prepared(): Promise<Ready> {
     const env = this.env as object;
     let entry = ready.get(env);
     if (entry === undefined) {
       if (configure === null) throw new Error('the vault Worker must export default vault(…)');
       const config = configure(env as never);
-      const prepared = await prepareVault(resolveVaultConfig(config));
+      const { checkpointer: namespace, hotDatabase } = checked(config);
+      const prepared = await prepareVault(resolveVaultConfig(config), {
+        ...(config.uses === undefined ? {} : { uses: config.uses }),
+        log: '0.15',
+        sealThrough: durableSealThrough(namespace),
+        heldOutside: durableHeldOutside(namespace),
+        callsEndWithRequest: true,
+      });
       // Calls that raced here each made one; the first kept serves them all from now on.
-      entry = ready.get(env) ?? { database: config.database, prepared };
+      entry = ready.get(env) ?? { database: config.database, hotDatabase, checkpointer: namespace, prepared, started: false, failed: -Infinity, kicked: -Infinity };
       ready.set(env, entry);
     }
     return entry;
@@ -98,9 +211,28 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   async policy() { return this.#call((vault) => vault.policy()); }
   async changePolicy(input: ChangePolicyInput) { return this.#call((vault) => vault.changePolicy(input)); }
   async checkpoint() { return this.#call((vault) => vault.checkpoint()); }
-  async about() { return this.#call((vault) => vault.about()); }
+  /** What the vault says of itself; its uses over the hot path's own config (`use`), which `#call`'s vault has not. */
+  async about() {
+    const about = await this.#call((vault) => vault.about());
+    return about.log === '0.15' ? { ...about, uses: true as const, batchUses: true as const } : about;
+  }
   async keyChecks() { return this.#call((vault) => vault.keyChecks()); }
   async verifyLog(input: VerifyLogInput) { return this.#call((vault) => vault.verifyLog(input)); }
+  async prepare(input: PrepareInput) { return this.#call((vault) => vault.prepare(input)); }
+  async waitSealed(input: { number: string }) { return this.#call((vault) => vault.waitSealed(input)); }
+  async signIn(input: SignInInput) { return this.#call((vault) => vault.signIn(input)); }
+  async revokeCredential(input: RevokeCredentialInput) { return this.#call((vault) => vault.revokeCredential(input)); }
+  async issueToken(input: IssueTokenInput) { return this.#call((vault) => vault.issueToken(input)); }
+  async changeBindings(input: ChangeBindingsInput) { return this.#call((vault) => vault.changeBindings(input)); }
+  async cutover(input?: CutoverInput) { return this.#call((vault) => vault.cutover(input)); }
+  async verifyTrees() { return this.#call((vault) => vault.verifyTrees()); }
+  async verifyReads(input: { from: string }) { return this.#call((vault) => vault.verifyReads(input)); }
+  async vouch(input: VouchInput) { return this.#call((vault) => vault.vouch(input)); }
+  /** Whether the checkpointer seals (T169), asked of its object for at most 2 s; no database, and no start awaited. */
+  async sealing() {
+    const { checkpointer: namespace } = this.#behind(await this.#prepared());
+    return durableSealing(namespace)();
+  }
 
   /** No HTTP surface: only the app's service binding reaches the vault. */
   fetch() {
@@ -108,8 +240,70 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   }
 }
 
+/** When a use's connection closes at the latest: its deadline, if it names one (`checkInput` refuses it otherwise). */
+function closeBy(input: { deadline?: unknown } | undefined): number | undefined {
+  return typeof input?.deadline === 'number' && Number.isSafeInteger(input.deadline) ? input.deadline : undefined;
+}
+
+/**
+ * What 0.15's log needs, configured: a setting left out of `vault(…)` is refused here, by name. A Hyperdrive binding
+ * left out of wrangler.jsonc is refused before, by `postgres()`; a Durable Object's, here.
+ */
+function checked(config: WorkersVaultConfig): { hotDatabase: PostgresDatabase; checkpointer: ObjectNamespace } {
+  if (config.hotDatabase?.hyperdrive?.connectionString === undefined) {
+    throw new Error("the vault's uses run through a Hyperdrive config of their own: set hotDatabase in vault(…), postgres(env.HOT_HYPERDRIVE), its login coffre_vault_hot");
+  }
+  if (typeof config.checkpointer?.idFromName !== 'function') {
+    throw new Error("the vault answers a change once its checkpointer has sealed it: set checkpointer in vault(…), env.CHECKPOINTER, and bind the CoffreCheckpointer Durable Object beside the vault");
+  }
+  return { hotDatabase: config.hotDatabase, checkpointer: config.checkpointer };
+}
+
+/**
+ * The checkpointer's object started, from a call of this isolate, before it
+ * goes on: its alarm set, and it open, so that no call meets a log with no
+ * checkpoint yet. Started again is harmless: until one start has answered,
+ * each call makes its own and waits for it, never for another call's,
+ * which a call may not await on Workers (AGENTS.md).
+ * An object that refuses to open (a log it cannot take: docs/restore.md) is
+ * started all the same, its alarm set, and says why in its alarms; one out
+ * of reach, or that does not answer within 2 s (T169), is tried again by a
+ * call 10 s later. Neither stops this call: a use needs no checkpointer (and
+ * waits on no start: `#behind`), and a change fails on its seal.
+ */
+async function start(entry: Ready): Promise<void> {
+  // The reads' projector beside it (T166), an object of its own, which opens nothing to start: one that fails to is
+  // started by the next isolate's first call, and the audit pages say how far behind their reads are meanwhile.
+  const projecting = startProjector(entry.checkpointer).catch((error: Error) => console.warn(`coffre vault: the reads' projector did not start: ${error.message}`));
+  try {
+    await startCheckpointer(entry.checkpointer);
+    entry.started = true;
+  } catch (error) {
+    if ((error as { status?: number }).status === 503) entry.started = true;
+    else entry.failed = Date.now();
+    console.warn(`coffre vault: ${(error as Error).message}`);
+  }
+  await projecting;
+}
+
 /** The vault Worker's default export, `VaultEntrypoint`, configured from its `env`. */
 export function vault<Env>(configure_: (env: Env) => WorkersVaultConfig): typeof VaultEntrypoint {
   configure = configure_ as (env: never) => WorkersVaultConfig;
   return VaultEntrypoint;
 }
+
+/**
+ * 0.15's checkpointer, the Durable Object class a deployment binds beside
+ * the vault, configured by the same `vault(env => …)`: its Hyperdrive, its
+ * signing key, its witnesses. `export const CoffreCheckpointer = checkpointer()`.
+ */
+export function checkpointer() {
+  return checkpointerObject((env: object) => {
+    if (configure === null) throw new Error('the vault Worker must export default vault(…)');
+    const config = configure(env as never);
+    return { hyperdrive: config.database.hyperdrive, seed: resolveVaultConfig(config).signingKeys[0]!, witnesses: config.witnesses };
+  });
+}
+
+export { checkpointerAlarms, checkpointerStatus, durableHeldOutside, durableSealing, durableSealThrough, startCheckpointer, startProjector, type ObjectNamespace } from './checkpointer-workers.ts';
+export { durableWitness, r2Archive, witnessObject as witness, type WitnessSettings } from './witness-workers.ts';

package/src/config.ts

@@ -11,6 +11,14 @@ export type BulkLimit = { count: number; windowMs: number };
  */
 export const DEFAULT_BULK_LIMIT: BulkLimit = { count: 1000, windowMs: 15 * 60_000 };
 
+/**
+ * The longest bulk limit window: a day. The releases a window counts are
+ * kept a day and an hour (migration 0021's `prune_vault_releases`, and on
+ * SQLite `RELEASES_KEPT_MS`), so every window up to it, and one widened
+ * since, counts exactly.
+ */
+export const MAX_BULK_WINDOW_MINUTES = 24 * 60;
+
 /** The vault as it runs: keys decoded, emails checked. */
 export type ResolvedVaultConfig = {
   keks: KekRegistry;
@@ -61,7 +69,10 @@ export type VaultConfig = {
    * service holds the KEK, as AWS KMS does: the vault never sees that key.
    */
   signingKey?: string;
-  /** At most `count` distinct data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. */
+  /**
+   * At most `count` distinct data keys unwrapped per principal in any `windowMinutes`; 1000 in 15 unless set. The
+   * window is a day at most: the releases it counts are kept a day and an hour (`prune_vault_releases`).
+   */
   bulkLimit?: { count: number; windowMinutes: number };
   /**
    * @deprecated Gone in 0.10, and refused: each key says who sees it now. Mark
@@ -176,8 +187,9 @@ function signingKeys(given: string | undefined, keks: { provider: KekProvider; s
 
 
 function checkBulkLimit({ count, windowMinutes }: { count: number; windowMinutes: number }): BulkLimit {
-  if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0)) {
-    throw new Error('bulkLimit needs a whole count of at least 1 and a window above 0 minutes');
+  // A whole number of milliseconds: what the 0.15 log's policy holds (`bulk.limit` in inputs.ts).
+  if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0) || windowMinutes > MAX_BULK_WINDOW_MINUTES || !Number.isInteger(windowMinutes * 60_000)) {
+    throw new Error(`bulkLimit needs a whole count of at least 1 and a window above 0 minutes, a day (${MAX_BULK_WINDOW_MINUTES}) at most, a whole number of milliseconds`);
   }
   return { count, windowMs: windowMinutes * 60_000 };
 }

package/src/credentials.postgres.ts

@@ -0,0 +1,78 @@
+import { MAX_BINDINGS } from '@coffre/core/identity';
+import type { Queryable } from '@coffre/db';
+import { rowsOf } from '@coffre/db/dialect';
+import { sql } from 'drizzle-orm';
+
+import type { Answer, BindingsCall, IssueCall, RevokeCall, SignInCall } from './credentials.ts';
+
+/** `sign_in` (migration 0037): one statement, its own transaction, its answer one JSON value. */
+export async function signInOnPostgres(db: Queryable, c: SignInCall): Promise<Answer> {
+  const k = c.credential;
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT sign_in(
+    ${c.requestId}::text, ${String(c.at)}::bigint, ${c.actor}::text, ${c.payload}::text, ${c.mac}::bytea, ${c.seal}::bytea,
+    ${c.binding.id}::uuid, ${c.principal}::text, ${c.binding.generation}::integer, ${c.binding.profile}::text, ${c.binding.scope}::text, ${c.binding.policy}::text,
+    ${c.binding.issuer}::text, ${c.binding.jwksUri}::text, ${c.binding.claims}::text, ${c.bindingSeal}::bytea,
+    ${c.spent}::bytea, ${c.validUntil === null ? null : String(c.validUntil)}::bigint, ${c.frozen}::boolean, ${c.rate}::integer, ${String(c.window)}::bigint, ${String(c.longest)}::bigint,
+    ${k.id}::uuid, ${k.kind}::text, ${k.authMacBytes}::bytea, ${k.tokenHashBytes}::bytea, ${k.tokenHint}::text, ${k.label}::text, ${k.createdBy}::text,
+    ${k.scope}::text, ${k.places}::text, ${String(k.expiresAt)}::bigint, ${k.notAfter === null ? null : String(k.notAfter)}::bigint, ${k.jkt}::text, ${c.appKey}::text
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}
+
+/** `revoke_credential` (migration 0034): one statement, its own transaction, its answer one JSON value. */
+export async function revokeOnPostgres(db: Queryable, c: RevokeCall): Promise<Answer> {
+  const { change, policy } = c;
+  const guarded = policy?.protected ?? [];
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT revoke_credential(
+    ${change.requestId}::text, ${String(change.at)}::bigint, ${change.actor}::text, ${change.payload}::text, ${change.mac}::bytea,
+    ${change.sealFrom}::bytea, ${change.seal}::bytea,
+    ${c.ref.id}::uuid, ${c.macFrom}::bytea, ${c.mac}::bytea, ${String(c.revokedAt)}::bigint, ${c.revokedBy}::text,
+    ${policy !== null}::boolean, ${policy?.seq ?? null}::bigint,
+    ${sql.param(guarded.map(({ environmentId }) => environmentId))}::uuid[], ${sql.param(guarded.map(({ slug }) => slug))}::text[]
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}
+
+/** `issue_token` (migration 0036): one statement, its own transaction, its answer one JSON value. */
+export async function issueOnPostgres(db: Queryable, c: IssueCall): Promise<Answer> {
+  const { change, input, read } = c;
+  const k = input.credential;
+  const guarded = read.slugs;
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT issue_token(
+    ${change.requestId}::text, ${String(change.at)}::bigint, ${change.actor}::text, ${change.payload}::text, ${change.mac}::bytea, ${change.seal}::bytea,
+    ${input.principal}::text, ${input.generation}::integer, ${read.principal.accessSeq.toString()}::bigint, ${read.actor.generation}::integer, ${read.actor.accessSeq.toString()}::bigint,
+    ${input.via}::uuid, ${read.via?.seal ?? null}::bytea, ${read.via?.columns.expiresAt == null ? null : String(read.via.columns.expiresAt)}::bigint,
+    ${input.policy.seq}::bigint, ${sql.param(guarded.map(({ environmentId }) => environmentId))}::uuid[], ${sql.param(guarded.map(({ slug }) => slug))}::text[], ${input.appKey}::text,
+    ${k.id}::uuid, ${k.kind}::text, ${c.authMac}::bytea, ${c.tokenHash}::bytea, ${k.tokenHint}::text, ${k.label}::text, ${k.createdBy}::text,
+    ${k.scope}::text, ${k.places}::text, ${String(k.expiresAt)}::bigint
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}
+
+/** `change_bindings` (migrations 0037, 0040): one statement, its own transaction, its answer one JSON value. */
+export async function bindingsOnPostgres(db: Queryable, c: BindingsCall): Promise<Answer> {
+  const m = c.make;
+  const r = m?.read ?? null;
+  const b = m?.row ?? null;
+  const array = <T>(values: T[]) => sql.param(values);
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT change_bindings(
+    ${String(c.at)}::bigint, ${c.actor}::text,
+    ${m !== null}::boolean, ${c.principal}::text, ${b?.generation ?? null}::integer, ${r?.principal.accessSeq.toString() ?? null}::bigint,
+    ${r?.actor.generation ?? null}::integer, ${r?.actor.accessSeq.toString() ?? null}::bigint,
+    ${m?.via ?? null}::uuid, ${r?.via?.seal ?? null}::bytea, ${r?.via?.columns.expiresAt == null ? null : String(r.via.columns.expiresAt)}::bigint,
+    ${m?.connection?.id ?? null}::uuid, ${m?.connection?.generation ?? null}::integer,
+    ${c.policy.seq}::bigint, ${array(c.policy.slugs.map(({ environmentId }) => environmentId))}::uuid[], ${array(c.policy.slugs.map(({ slug }) => slug))}::text[], ${c.appKey}::text,
+    ${MAX_BINDINGS}::integer, ${c.live === null ? null : array(c.live)}::uuid[], ${array(c.reads.map((read) => read.id))}::uuid[], ${array(c.reads.map((read) => read.key))}::text[],
+    ${b?.id ?? null}::uuid, ${m?.authMac ?? null}::bytea, ${b?.profile ?? null}::text, ${b?.issuer ?? null}::text, ${b?.jwksUri ?? null}::text, ${b?.jwks ?? null}::text,
+    ${b?.claims ?? null}::text, ${b?.scope ?? null}::text, ${b?.policy ?? null}::text, ${b?.origin ?? null}::text, ${b?.label ?? null}::text, ${b?.createdBy ?? null}::text,
+    ${b === null ? null : String(b.createdAt)}::bigint, ${m?.seal ?? null}::bytea,
+    ${array(c.ends.map((e) => e.id))}::uuid[], ${array(c.ends.map((e) => e.macFrom))}::bytea[], ${array(c.ends.map((e) => e.sealFrom))}::bytea[],
+    ${array(c.ends.map((e) => e.authMac))}::bytea[], ${array(c.ends.map((e) => e.seal))}::bytea[],
+    ${array(c.credentials.map((x) => x.id))}::uuid[], ${array(c.credentials.map((x) => x.binding))}::uuid[], ${array(c.credentials.map((x) => x.macFrom))}::bytea[],
+    ${array(c.credentials.map((x) => x.sealFrom))}::bytea[], ${array(c.credentials.map((x) => x.authMac))}::bytea[], ${array(c.credentials.map((x) => x.seal))}::bytea[],
+    ${String(c.revokedAt)}::bigint, ${c.revokedBy}::text,
+    ${array(c.changes.map((x) => x.requestId))}::text[], ${array(c.changes.map((x) => x.object))}::uuid[], ${array(c.changes.map((x) => x.payload))}::text[],
+    ${array(c.changes.map((x) => x.seal))}::bytea[], ${array(c.changes.map((x) => x.mac))}::bytea[]
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}