@coffre/vault 0.14.5 → 0.15.0

package/src/cloudflare.ts

@@ -1,38 +1,52 @@
 /**
  * The vault as a Worker, behind an entrypoint the app's `VAULT` service
  * binding calls over RPC. It has no route and no HTTP surface. It decides
- * in the database the app uses, through a Hyperdrive binding of its own,
- * whose login is the vault's:
+ * in the database the app uses, through two Hyperdrive bindings of its
+ * own, the vault's login and its uses' (`coffre_vault_hot`), and seals its
+ * log through the checkpointer's Durable Object:
  *
- *   import { postgres, vault } from '@coffre/vault/cloudflare';
+ *   import { checkpointer, postgres, vault } from '@coffre/vault/cloudflare';
  *
  *   export default vault((env: Env) => ({
- *     database: postgres(env.HYPERDRIVE),
+ *     database: postgres(env.VAULT_HYPERDRIVE),
+ *     hotDatabase: postgres(env.HOT_HYPERDRIVE),
+ *     checkpointer: env.CHECKPOINTER,
  *     kek: { id: env.VAULT_KEY_ID, key: env.VAULT_KEY }, // or awsKms({ keyArn, credentials }), with a signingKey
  *     owners: ['admin@acme.example'],
  *   }));
+ *   export const CoffreCheckpointer = checkpointer();
  *
  * Any number of isolates run it side by side: every decision locks what it
  * is about in the database, so they share one log and one bulk limit.
  */
-import type {
+import type { ChangeBindingsInput, CutoverInput,
   AdmitInput,
   RemoveInput,
+  RevokeCredentialInput,
+  IssueTokenInput,
   ReferenceInput,
   EndReferencesInput,
+  PrepareInput,
   RewrapInput,
   SetAccessInput,
   SetSettingsInput,
+  SignInInput,
   ChangePolicyInput,
   UnwrapInput,
+  NamedUseInput,
+  UseManyInput,
+  UseInput,
   Vault,
   VerifyLogInput,
+  VouchInput,
   WrapInput,
 } from '@coffre/core/vault';
 import { createDatabase } from '@coffre/db';
 import { HyperdrivePool, type PostgresDatabase } from '@coffre/db/hyperdrive';
 import { WorkerEntrypoint } from 'cloudflare:workers';
 
+import type { Witness } from './checkpointer.ts';
+import { checkpointerObject, durableHeldOutside, durableSealing, durableSealThrough, startCheckpointer, startProjector, type ObjectNamespace } from './checkpointer-workers.ts';
 import { resolveVaultConfig, type VaultConfig } from './config.ts';
 import { openVault, prepareVault, type PreparedVault } from './vault.ts';
 
@@ -40,8 +54,29 @@ export type { Vault, VaultConfig };
 export { postgres, type PostgresDatabase } from '@coffre/db/hyperdrive';
 export * from './index.ts';
 
-/** What the vault Worker's `vault(env => …)` returns. */
-export type WorkersVaultConfig = VaultConfig & { database: PostgresDatabase };
+/**
+ * What the vault Worker's `vault(env => …)` returns, for 0.15's log
+ * (docs/design/0.15-plan.md):
+ * - `hotDatabase`: the uses' own Hyperdrive config, whose login is
+ *   `coffre_vault_hot`, and `uses`, how many uses an isolate has in flight
+ *   at most (by default `connections`, the share of that config's pool an
+ *   isolate may hold: T112 measures it), and `uses.batch`, the most keys
+ *   a statement of a request's several makes uses of (100:
+ *   `UseLimits.batch`);
+ * - `checkpointer`: the namespace of the checkpointer's Durable Object,
+ *   `CoffreCheckpointer` (`checkpointer()`, below), bound beside the vault.
+ *   A change answers once that object has sealed it (R51), and the
+ *   verifier holds every check to the pair it remembers;
+ * - `witnesses` (docs/design/audit-tree.md, R40: a deployment opts in).
+ * A configuration without the first two is refused, at the first call.
+ */
+export type WorkersVaultConfig = VaultConfig & {
+  database: PostgresDatabase;
+  hotDatabase: PostgresDatabase;
+  checkpointer: ObjectNamespace;
+  witnesses?: readonly Witness[];
+  uses?: { inFlight?: number; connections?: number; coverMs?: number; names?: number; batch?: number };
+};
 
 /** Set when the Worker's module runs `vault(…)`, before any call comes in. */
 let configure: ((env: never) => WorkersVaultConfig) | null = null;
@@ -51,7 +86,18 @@ let configure: ((env: never) => WorkersVaultConfig) | null = null;
  * isolate keeps: the ready value itself, never the work of making it, which
  * would belong to the call that started it (vault.ts, `PreparedVault`).
  */
-const ready = new WeakMap<object, { database: PostgresDatabase; prepared: PreparedVault }>();
+const ready = new WeakMap<object, Ready>();
+
+/**
+ * One `env`'s vault, ready: its databases, its prepared state, and whether
+ * a call of this isolate started the checkpointer, when a start last
+ * failed, and when a use last started one behind it: settled values, never
+ * the start under way.
+ */
+type Ready = { database: PostgresDatabase; hotDatabase: PostgresDatabase; checkpointer: ObjectNamespace; prepared: PreparedVault; started: boolean; failed: number; kicked: number };
+
+/** How long after a start that failed, the checkpointer's object out of reach, the next call tries again. */
+const START_AGAIN_MS = 10_000;
 
 /**
  * What the app's `VAULT` service binding calls. Each call gets a database of
@@ -60,7 +106,7 @@ const ready = new WeakMap<object, { database: PostgresDatabase; prepared: Prepar
  * call is done.
  */
 export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
-  async #call<T>(run: (vault: Vault) => Promise<T>): Promise<T> {
+  async #call<T>(run: (vault: Required<Vault>) => Promise<T>): Promise<T> {
     const { prepared, database } = await this.#ready();
     const pool = new HyperdrivePool(database.hyperdrive.connectionString);
     try {
@@ -70,15 +116,82 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
     }
   }
 
-  async #ready(): Promise<{ database: PostgresDatabase; prepared: PreparedVault }> {
+  /**
+   * 0.15's use: one connection of the hot path's config, for its one statement. Closed once the call is done, and by
+   * its deadline at the latest, so that a call answered `late` lets go of Hyperdrive by then, as its place in admission
+   * lapses soon after (use.ts, `HELD_PAST_DEADLINE_MS`; T170).
+   */
+  async use(input: UseInput) {
+    const { prepared, hotDatabase } = this.#behind(await this.#prepared());
+    const pool = new HyperdrivePool(hotDatabase.hyperdrive.connectionString);
+    try {
+      const hot = createDatabase(pool);
+      return await openVault(hot, prepared, hot).use!(input);
+    } finally {
+      this.ctx.waitUntil(pool.end(closeBy(input)));
+    }
+  }
+
+  /** A request's several keys (T167): the same one connection, for its one statement, or two. */
+  async useMany(input: UseManyInput) {
+    const { prepared, hotDatabase } = this.#behind(await this.#prepared());
+    if (hotDatabase === undefined) throw new Error("0.15's uses need the hot path's Hyperdrive config: set hotDatabase in vault(…)");
+    const pool = new HyperdrivePool(hotDatabase.hyperdrive.connectionString);
+    try {
+      const hot = createDatabase(pool);
+      return await openVault(hot, prepared, hot).useMany!(input);
+    } finally {
+      this.ctx.waitUntil(pool.end(closeBy(input)));
+    }
+  }
+
+  /** 0.15's use as the request names it: the same one connection, for its read of ids on a miss and its one use. */
+  async useNamed(input: NamedUseInput) {
+    const { prepared, hotDatabase } = this.#behind(await this.#prepared());
+    const pool = new HyperdrivePool(hotDatabase.hyperdrive.connectionString);
+    try {
+      const hot = createDatabase(pool);
+      return await openVault(hot, prepared, hot).useNamed!(input);
+    } finally {
+      this.ctx.waitUntil(pool.end(closeBy(input)));
+    }
+  }
+
+  /** The vault ready, its checkpointer started from this call first, for at most 2 s (`start`). */
+  async #ready(): Promise<Ready> {
+    const entry = await this.#prepared();
+    if (!entry.started && Date.now() - entry.failed >= START_AGAIN_MS) await start(entry);
+    return entry;
+  }
+
+  /**
+   * A use waits on no start (T169, R58): it needs no checkpointer, the days of uses the migrations made and the object
+   * makes ahead of time aside. Its isolate's start goes on behind it, once each START_AGAIN_MS until one answers.
+   */
+  #behind(entry: Ready): Ready {
+    if (!entry.started && Date.now() - entry.kicked >= START_AGAIN_MS) {
+      entry.kicked = Date.now();
+      this.ctx.waitUntil(start(entry));
+    }
+    return entry;
+  }
+
+  async #prepared(): Promise<Ready> {
     const env = this.env as object;
     let entry = ready.get(env);
     if (entry === undefined) {
       if (configure === null) throw new Error('the vault Worker must export default vault(…)');
       const config = configure(env as never);
-      const prepared = await prepareVault(resolveVaultConfig(config));
+      const { checkpointer: namespace, hotDatabase } = checked(config);
+      const prepared = await prepareVault(resolveVaultConfig(config), {
+        ...(config.uses === undefined ? {} : { uses: config.uses }),
+        log: '0.15',
+        sealThrough: durableSealThrough(namespace),
+        heldOutside: durableHeldOutside(namespace),
+        callsEndWithRequest: true,
+      });
       // Calls that raced here each made one; the first kept serves them all from now on.
-      entry = ready.get(env) ?? { database: config.database, prepared };
+      entry = ready.get(env) ?? { database: config.database, hotDatabase, checkpointer: namespace, prepared, started: false, failed: -Infinity, kicked: -Infinity };
       ready.set(env, entry);
     }
     return entry;
@@ -98,9 +211,28 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   async policy() { return this.#call((vault) => vault.policy()); }
   async changePolicy(input: ChangePolicyInput) { return this.#call((vault) => vault.changePolicy(input)); }
   async checkpoint() { return this.#call((vault) => vault.checkpoint()); }
-  async about() { return this.#call((vault) => vault.about()); }
+  /** What the vault says of itself; its uses over the hot path's own config (`use`), which `#call`'s vault has not. */
+  async about() {
+    const about = await this.#call((vault) => vault.about());
+    return about.log === '0.15' ? { ...about, uses: true as const, batchUses: true as const } : about;
+  }
   async keyChecks() { return this.#call((vault) => vault.keyChecks()); }
   async verifyLog(input: VerifyLogInput) { return this.#call((vault) => vault.verifyLog(input)); }
+  async prepare(input: PrepareInput) { return this.#call((vault) => vault.prepare(input)); }
+  async waitSealed(input: { number: string }) { return this.#call((vault) => vault.waitSealed(input)); }
+  async signIn(input: SignInInput) { return this.#call((vault) => vault.signIn(input)); }
+  async revokeCredential(input: RevokeCredentialInput) { return this.#call((vault) => vault.revokeCredential(input)); }
+  async issueToken(input: IssueTokenInput) { return this.#call((vault) => vault.issueToken(input)); }
+  async changeBindings(input: ChangeBindingsInput) { return this.#call((vault) => vault.changeBindings(input)); }
+  async cutover(input?: CutoverInput) { return this.#call((vault) => vault.cutover(input)); }
+  async verifyTrees() { return this.#call((vault) => vault.verifyTrees()); }
+  async verifyReads(input: { from: string }) { return this.#call((vault) => vault.verifyReads(input)); }
+  async vouch(input: VouchInput) { return this.#call((vault) => vault.vouch(input)); }
+  /** Whether the checkpointer seals (T169), asked of its object for at most 2 s; no database, and no start awaited. */
+  async sealing() {
+    const { checkpointer: namespace } = this.#behind(await this.#prepared());
+    return durableSealing(namespace)();
+  }
 
   /** No HTTP surface: only the app's service binding reaches the vault. */
   fetch() {
@@ -108,8 +240,70 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   }
 }
 
+/** When a use's connection closes at the latest: its deadline, if it names one (`checkInput` refuses it otherwise). */
+function closeBy(input: { deadline?: unknown } | undefined): number | undefined {
+  return typeof input?.deadline === 'number' && Number.isSafeInteger(input.deadline) ? input.deadline : undefined;
+}
+
+/**
+ * What 0.15's log needs, configured: a setting left out of `vault(…)` is refused here, by name. A Hyperdrive binding
+ * left out of wrangler.jsonc is refused before, by `postgres()`; a Durable Object's, here.
+ */
+function checked(config: WorkersVaultConfig): { hotDatabase: PostgresDatabase; checkpointer: ObjectNamespace } {
+  if (config.hotDatabase?.hyperdrive?.connectionString === undefined) {
+    throw new Error("the vault's uses run through a Hyperdrive config of their own: set hotDatabase in vault(…), postgres(env.HOT_HYPERDRIVE), its login coffre_vault_hot");
+  }
+  if (typeof config.checkpointer?.idFromName !== 'function') {
+    throw new Error("the vault answers a change once its checkpointer has sealed it: set checkpointer in vault(…), env.CHECKPOINTER, and bind the CoffreCheckpointer Durable Object beside the vault");
+  }
+  return { hotDatabase: config.hotDatabase, checkpointer: config.checkpointer };
+}
+
+/**
+ * The checkpointer's object started, from a call of this isolate, before it
+ * goes on: its alarm set, and it open, so that no call meets a log with no
+ * checkpoint yet. Started again is harmless: until one start has answered,
+ * each call makes its own and waits for it, never for another call's,
+ * which a call may not await on Workers (AGENTS.md).
+ * An object that refuses to open (a log it cannot take: docs/restore.md) is
+ * started all the same, its alarm set, and says why in its alarms; one out
+ * of reach, or that does not answer within 2 s (T169), is tried again by a
+ * call 10 s later. Neither stops this call: a use needs no checkpointer (and
+ * waits on no start: `#behind`), and a change fails on its seal.
+ */
+async function start(entry: Ready): Promise<void> {
+  // The reads' projector beside it (T166), an object of its own, which opens nothing to start: one that fails to is
+  // started by the next isolate's first call, and the audit pages say how far behind their reads are meanwhile.
+  const projecting = startProjector(entry.checkpointer).catch((error: Error) => console.warn(`coffre vault: the reads' projector did not start: ${error.message}`));
+  try {
+    await startCheckpointer(entry.checkpointer);
+    entry.started = true;
+  } catch (error) {
+    if ((error as { status?: number }).status === 503) entry.started = true;
+    else entry.failed = Date.now();
+    console.warn(`coffre vault: ${(error as Error).message}`);
+  }
+  await projecting;
+}
+
 /** The vault Worker's default export, `VaultEntrypoint`, configured from its `env`. */
 export function vault<Env>(configure_: (env: Env) => WorkersVaultConfig): typeof VaultEntrypoint {
   configure = configure_ as (env: never) => WorkersVaultConfig;
   return VaultEntrypoint;
 }
+
+/**
+ * 0.15's checkpointer, the Durable Object class a deployment binds beside
+ * the vault, configured by the same `vault(env => …)`: its Hyperdrive, its
+ * signing key, its witnesses. `export const CoffreCheckpointer = checkpointer()`.
+ */
+export function checkpointer() {
+  return checkpointerObject((env: object) => {
+    if (configure === null) throw new Error('the vault Worker must export default vault(…)');
+    const config = configure(env as never);
+    return { hyperdrive: config.database.hyperdrive, seed: resolveVaultConfig(config).signingKeys[0]!, witnesses: config.witnesses };
+  });
+}
+
+export { checkpointerAlarms, checkpointerStatus, durableHeldOutside, durableSealing, durableSealThrough, startCheckpointer, startProjector, type ObjectNamespace } from './checkpointer-workers.ts';
+export { durableWitness, r2Archive, witnessObject as witness, type WitnessSettings } from './witness-workers.ts';

package/src/config.ts

@@ -187,8 +187,9 @@ function signingKeys(given: string | undefined, keks: { provider: KekProvider; s
 
 
 function checkBulkLimit({ count, windowMinutes }: { count: number; windowMinutes: number }): BulkLimit {
-  if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0) || windowMinutes > MAX_BULK_WINDOW_MINUTES) {
-    throw new Error(`bulkLimit needs a whole count of at least 1 and a window above 0 minutes, a day (${MAX_BULK_WINDOW_MINUTES}) at most`);
+  // A whole number of milliseconds: what the 0.15 log's policy holds (`bulk.limit` in inputs.ts).
+  if (!Number.isInteger(count) || count < 1 || !(windowMinutes > 0) || windowMinutes > MAX_BULK_WINDOW_MINUTES || !Number.isInteger(windowMinutes * 60_000)) {
+    throw new Error(`bulkLimit needs a whole count of at least 1 and a window above 0 minutes, a day (${MAX_BULK_WINDOW_MINUTES}) at most, a whole number of milliseconds`);
   }
   return { count, windowMs: windowMinutes * 60_000 };
 }

package/src/credentials.postgres.ts

@@ -0,0 +1,78 @@
+import { MAX_BINDINGS } from '@coffre/core/identity';
+import type { Queryable } from '@coffre/db';
+import { rowsOf } from '@coffre/db/dialect';
+import { sql } from 'drizzle-orm';
+
+import type { Answer, BindingsCall, IssueCall, RevokeCall, SignInCall } from './credentials.ts';
+
+/** `sign_in` (migration 0037): one statement, its own transaction, its answer one JSON value. */
+export async function signInOnPostgres(db: Queryable, c: SignInCall): Promise<Answer> {
+  const k = c.credential;
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT sign_in(
+    ${c.requestId}::text, ${String(c.at)}::bigint, ${c.actor}::text, ${c.payload}::text, ${c.mac}::bytea, ${c.seal}::bytea,
+    ${c.binding.id}::uuid, ${c.principal}::text, ${c.binding.generation}::integer, ${c.binding.profile}::text, ${c.binding.scope}::text, ${c.binding.policy}::text,
+    ${c.binding.issuer}::text, ${c.binding.jwksUri}::text, ${c.binding.claims}::text, ${c.bindingSeal}::bytea,
+    ${c.spent}::bytea, ${c.validUntil === null ? null : String(c.validUntil)}::bigint, ${c.frozen}::boolean, ${c.rate}::integer, ${String(c.window)}::bigint, ${String(c.longest)}::bigint,
+    ${k.id}::uuid, ${k.kind}::text, ${k.authMacBytes}::bytea, ${k.tokenHashBytes}::bytea, ${k.tokenHint}::text, ${k.label}::text, ${k.createdBy}::text,
+    ${k.scope}::text, ${k.places}::text, ${String(k.expiresAt)}::bigint, ${k.notAfter === null ? null : String(k.notAfter)}::bigint, ${k.jkt}::text, ${c.appKey}::text
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}
+
+/** `revoke_credential` (migration 0034): one statement, its own transaction, its answer one JSON value. */
+export async function revokeOnPostgres(db: Queryable, c: RevokeCall): Promise<Answer> {
+  const { change, policy } = c;
+  const guarded = policy?.protected ?? [];
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT revoke_credential(
+    ${change.requestId}::text, ${String(change.at)}::bigint, ${change.actor}::text, ${change.payload}::text, ${change.mac}::bytea,
+    ${change.sealFrom}::bytea, ${change.seal}::bytea,
+    ${c.ref.id}::uuid, ${c.macFrom}::bytea, ${c.mac}::bytea, ${String(c.revokedAt)}::bigint, ${c.revokedBy}::text,
+    ${policy !== null}::boolean, ${policy?.seq ?? null}::bigint,
+    ${sql.param(guarded.map(({ environmentId }) => environmentId))}::uuid[], ${sql.param(guarded.map(({ slug }) => slug))}::text[]
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}
+
+/** `issue_token` (migration 0036): one statement, its own transaction, its answer one JSON value. */
+export async function issueOnPostgres(db: Queryable, c: IssueCall): Promise<Answer> {
+  const { change, input, read } = c;
+  const k = input.credential;
+  const guarded = read.slugs;
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT issue_token(
+    ${change.requestId}::text, ${String(change.at)}::bigint, ${change.actor}::text, ${change.payload}::text, ${change.mac}::bytea, ${change.seal}::bytea,
+    ${input.principal}::text, ${input.generation}::integer, ${read.principal.accessSeq.toString()}::bigint, ${read.actor.generation}::integer, ${read.actor.accessSeq.toString()}::bigint,
+    ${input.via}::uuid, ${read.via?.seal ?? null}::bytea, ${read.via?.columns.expiresAt == null ? null : String(read.via.columns.expiresAt)}::bigint,
+    ${input.policy.seq}::bigint, ${sql.param(guarded.map(({ environmentId }) => environmentId))}::uuid[], ${sql.param(guarded.map(({ slug }) => slug))}::text[], ${input.appKey}::text,
+    ${k.id}::uuid, ${k.kind}::text, ${c.authMac}::bytea, ${c.tokenHash}::bytea, ${k.tokenHint}::text, ${k.label}::text, ${k.createdBy}::text,
+    ${k.scope}::text, ${k.places}::text, ${String(k.expiresAt)}::bigint
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}
+
+/** `change_bindings` (migrations 0037, 0040): one statement, its own transaction, its answer one JSON value. */
+export async function bindingsOnPostgres(db: Queryable, c: BindingsCall): Promise<Answer> {
+  const m = c.make;
+  const r = m?.read ?? null;
+  const b = m?.row ?? null;
+  const array = <T>(values: T[]) => sql.param(values);
+  const [row] = await rowsOf<{ answer: string }>(db, sql`/* writes */ SELECT change_bindings(
+    ${String(c.at)}::bigint, ${c.actor}::text,
+    ${m !== null}::boolean, ${c.principal}::text, ${b?.generation ?? null}::integer, ${r?.principal.accessSeq.toString() ?? null}::bigint,
+    ${r?.actor.generation ?? null}::integer, ${r?.actor.accessSeq.toString() ?? null}::bigint,
+    ${m?.via ?? null}::uuid, ${r?.via?.seal ?? null}::bytea, ${r?.via?.columns.expiresAt == null ? null : String(r.via.columns.expiresAt)}::bigint,
+    ${m?.connection?.id ?? null}::uuid, ${m?.connection?.generation ?? null}::integer,
+    ${c.policy.seq}::bigint, ${array(c.policy.slugs.map(({ environmentId }) => environmentId))}::uuid[], ${array(c.policy.slugs.map(({ slug }) => slug))}::text[], ${c.appKey}::text,
+    ${MAX_BINDINGS}::integer, ${c.live === null ? null : array(c.live)}::uuid[], ${array(c.reads.map((read) => read.id))}::uuid[], ${array(c.reads.map((read) => read.key))}::text[],
+    ${b?.id ?? null}::uuid, ${m?.authMac ?? null}::bytea, ${b?.profile ?? null}::text, ${b?.issuer ?? null}::text, ${b?.jwksUri ?? null}::text, ${b?.jwks ?? null}::text,
+    ${b?.claims ?? null}::text, ${b?.scope ?? null}::text, ${b?.policy ?? null}::text, ${b?.origin ?? null}::text, ${b?.label ?? null}::text, ${b?.createdBy ?? null}::text,
+    ${b === null ? null : String(b.createdAt)}::bigint, ${m?.seal ?? null}::bytea,
+    ${array(c.ends.map((e) => e.id))}::uuid[], ${array(c.ends.map((e) => e.macFrom))}::bytea[], ${array(c.ends.map((e) => e.sealFrom))}::bytea[],
+    ${array(c.ends.map((e) => e.authMac))}::bytea[], ${array(c.ends.map((e) => e.seal))}::bytea[],
+    ${array(c.credentials.map((x) => x.id))}::uuid[], ${array(c.credentials.map((x) => x.binding))}::uuid[], ${array(c.credentials.map((x) => x.macFrom))}::bytea[],
+    ${array(c.credentials.map((x) => x.sealFrom))}::bytea[], ${array(c.credentials.map((x) => x.authMac))}::bytea[], ${array(c.credentials.map((x) => x.seal))}::bytea[],
+    ${String(c.revokedAt)}::bigint, ${c.revokedBy}::text,
+    ${array(c.changes.map((x) => x.requestId))}::text[], ${array(c.changes.map((x) => x.object))}::uuid[], ${array(c.changes.map((x) => x.payload))}::text[],
+    ${array(c.changes.map((x) => x.seal))}::bytea[], ${array(c.changes.map((x) => x.mac))}::bytea[]
+  )::text AS answer`);
+  return JSON.parse(row!.answer) as Answer;
+}

package/src/credentials.sqlite.ts

@@ -0,0 +1,240 @@
+import { MAX_BINDINGS } from '@coffre/core/identity';
+import { tablesOf, type Queryable } from '@coffre/db';
+import { and, desc, eq, gt, inArray, isNull, sql } from 'drizzle-orm';
+
+import type { Answer, BindingsCall, IssueCall, RevokeCall, SignInCall } from './credentials.ts';
+import { objectKey } from './inputs.ts';
+
+/**
+ * `sign_in` on SQLite, step for step, in one transaction: SQLite runs one
+ * writer at a time, so its locks are implicit, and an entry's number is
+ * one past the log's highest.
+ */
+export async function signInOnSqlite(tx: Queryable, c: SignInCall): Promise<Answer> {
+  const { auditLog, consumedTokens, credentials, logChanges, serviceBindings, vaultMembers } = tablesOf(tx);
+  const target = objectKey({ kind: 'credential', id: c.credential.id });
+  const k = c.credential;
+  const [member] = await tx.select({ status: vaultMembers.status, generation: vaultMembers.generation, seal: vaultMembers.seal }).from(vaultMembers).where(eq(vaultMembers.principal, c.principal));
+  if (member?.status !== 'active' || member.generation !== c.binding.generation) return { state: 'unbound' };
+  // Its row as its newest change sealed it, or 0.14's with neither: a row put back is none.
+  const [sealedAs] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, objectKey({ kind: 'principal', id: c.principal }))).orderBy(desc(logChanges.number)).limit(1);
+  if (!same(member.seal ?? null, sealedAs?.seal ?? null)) return { state: 'unbound' };
+  // The binding as the vault checked its seal, and that seal its object's newest change's (BindingSealed).
+  const [binding] = await tx.select().from(serviceBindings).where(eq(serviceBindings.id, c.binding.id));
+  const [bindingSealedAs] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, objectKey({ kind: 'binding', id: c.binding.id }))).orderBy(desc(logChanges.number)).limit(1);
+  if (binding === undefined || binding.principal !== c.principal || binding.generation !== c.binding.generation || binding.revokedAt !== null || binding.profile !== c.binding.profile
+    || binding.scope !== c.binding.scope || binding.policy !== c.binding.policy || binding.issuer !== c.binding.issuer || binding.jwksUri !== c.binding.jwksUri
+    || binding.claims !== c.binding.claims || !same(binding.seal ?? null, c.bindingSeal) || !same(bindingSealedAs?.seal ?? null, c.bindingSeal)) {
+    return { state: 'unbound' };
+  }
+  const [moved] = await tx.select({ seq: auditLog.seq }).from(auditLog)
+    .where(and(eq(auditLog.author, 'app'), eq(auditLog.subjectPrincipal, c.appKey), inArray(auditLog.action, ['key.reseal', 'key.rotate']))).limit(1);
+  if (moved !== undefined) return { state: 'retired' };
+  const named = (key: string) => sql`json_extract(${auditLog.metadata}, ${`$.${key}`})`;
+  if (c.frozen) {
+    for (const target of ['instance', c.principal, `binding:${c.binding.id}`]) {
+      const [newest] = await tx.select({ action: auditLog.action }).from(auditLog)
+        .where(and(eq(auditLog.author, 'app'), inArray(auditLog.action, ['workload.freeze', 'workload.unfreeze']), eq(auditLog.decision, 'allow'), eq(named('target'), target)))
+        .orderBy(desc(auditLog.seq)).limit(1);
+      if (newest?.action === 'workload.freeze') return { state: 'frozen' };
+    }
+  }
+  const now = Date.now();
+  const recent = await tx.select({ id: credentials.id }).from(credentials)
+    .where(and(eq(credentials.principal, c.principal), eq(credentials.createdBy, k.createdBy), gt(credentials.createdAt, new Date(now - c.window))))
+    .limit(c.rate);
+  if (recent.length >= c.rate) return { state: 'busy' };
+  if ((c.validUntil !== null && c.validUntil <= now) || k.expiresAt <= now || k.expiresAt > now + c.longest + 60_000 || (k.notAfter !== null && (k.notAfter <= now || k.expiresAt > k.notAfter))) return { state: 'expired' };
+  if (c.spent !== null) {
+    const spent = await tx.insert(consumedTokens).values({ hash: c.spent }).onConflictDoNothing().returning({ hash: consumedTokens.hash });
+    if (spent.length === 0) return { state: 'replayed' };
+  }
+  await tx.insert(credentials).values({
+    id: k.id, kind: k.kind, authMac: k.authMacBytes, tokenHash: k.tokenHashBytes, tokenHint: k.tokenHint, generation: c.binding.generation,
+    principal: c.principal, identityId: null, scope: k.scope, places: k.places, label: k.label, createdBy: k.createdBy,
+    expiresAt: new Date(k.expiresAt), revokedAt: null, jkt: k.jkt, notAfter: k.notAfter === null ? null : new Date(k.notAfter), seal: c.seal,
+  });
+  await tx.update(serviceBindings).set({ lastUsedAt: new Date(now) }).where(eq(serviceBindings.id, c.binding.id));
+  const number = await nextNumber(tx);
+  await tx.insert(logChanges).values({ number, at: c.at, requestId: c.requestId, object: target, actor: c.actor, payload: c.payload, seal: c.seal, mac: c.mac });
+  return { number: number.toString() };
+}
+
+/** `revoke_credential` on SQLite, step for step, in one transaction. */
+export async function revokeOnSqlite(tx: Queryable, c: RevokeCall): Promise<Answer> {
+  const { auditLog, credentials, environments, logChanges, projects } = tablesOf(tx);
+  const { change, policy } = c;
+  const [row] = await tx.select({ seal: credentials.seal, authMac: credentials.authMac, revokedAt: credentials.revokedAt }).from(credentials).where(eq(credentials.id, c.ref.id));
+  if (row === undefined || row.revokedAt !== null || !same(row.authMac, c.macFrom) || !same(row.seal ?? null, change.sealFrom)) return { state: 'moved' };
+  const [newest] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, change.object)).orderBy(desc(logChanges.number)).limit(1);
+  if (!same(newest?.seal ?? null, change.sealFrom)) return { state: 'stale' };
+  if (policy !== null) {
+    const [changed] = await tx.select({ seq: auditLog.seq }).from(auditLog)
+      .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, 'policy.change'), eq(auditLog.decision, 'allow'))).orderBy(desc(auditLog.seq)).limit(1);
+    if ((changed === undefined ? null : String(changed.seq)) !== policy.seq) return { state: 'policy' };
+    for (const { environmentId, slug } of policy.protected) {
+      const [place] = await tx.select({ slug: environments.slug, project: projects.slug }).from(environments)
+        .innerJoin(projects, eq(projects.id, environments.projectId)).where(eq(environments.id, environmentId));
+      const standing = place === undefined || place.slug.includes('~') || place.project.includes('~') ? null : place.slug;
+      if (standing !== slug) return { state: 'policy' };
+    }
+  }
+  await tx.update(credentials).set({ revokedAt: new Date(c.revokedAt), revokedBy: c.revokedBy, authMac: c.mac, seal: change.seal })
+    .where(and(eq(credentials.id, c.ref.id), isNull(credentials.revokedAt)));
+  const number = await nextNumber(tx);
+  await tx.insert(logChanges).values({ number, at: change.at, requestId: change.requestId, object: change.object, actor: change.actor, payload: change.payload, seal: change.seal, mac: change.mac });
+  return { number: number.toString() };
+}
+
+/** `issue_token` on SQLite, step for step, in one transaction: its one writer holds every row as read. */
+export async function issueOnSqlite(tx: Queryable, c: IssueCall): Promise<Answer> {
+  const { auditLog, credentials, environments, logChanges, projects, vaultMembers } = tablesOf(tx);
+  const { change, input, read } = c;
+  const k = input.credential;
+  const standing = async (principal: string, generation: number, accessSeq: bigint) => {
+    const [row] = await tx.select({ status: vaultMembers.status, generation: vaultMembers.generation, accessSeq: vaultMembers.accessSeq }).from(vaultMembers).where(eq(vaultMembers.principal, principal));
+    return row?.status === 'active' && row.generation === generation && BigInt(row.accessSeq) === accessSeq;
+  };
+  if (!(await standing(input.actor, read.actor.generation, read.actor.accessSeq)) || !(await standing(input.principal, input.generation, read.principal.accessSeq))) return { state: 'moved' };
+  const now = Date.now();
+  if (input.via !== null) {
+    const [via] = await tx.select({ principal: credentials.principal, revokedAt: credentials.revokedAt, seal: credentials.seal, expiresAt: credentials.expiresAt, notAfter: credentials.notAfter })
+      .from(credentials).where(eq(credentials.id, input.via));
+    const [newest] = await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, objectKey({ kind: 'credential', id: input.via }))).orderBy(desc(logChanges.number)).limit(1);
+    // Its end as the vault authenticated it, still the columns' and still ahead (as `issue_token`).
+    const sealedAs = read.via?.seal ?? null;
+    const end = read.via?.columns.expiresAt ?? null;
+    const ends = via === undefined ? null : Math.min(via.expiresAt.getTime(), via.notAfter?.getTime() ?? Infinity);
+    if (via === undefined || via.principal !== input.actor || via.revokedAt !== null || sealedAs === null || end === null || ends !== end || end <= now
+      || !same(via.seal ?? null, sealedAs) || !same(newest?.seal ?? null, sealedAs)) {
+      return { state: 'ended' };
+    }
+  }
+  const [changed] = await tx.select({ seq: auditLog.seq }).from(auditLog)
+    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, 'policy.change'), eq(auditLog.decision, 'allow'))).orderBy(desc(auditLog.seq)).limit(1);
+  if ((changed === undefined ? null : String(changed.seq)) !== input.policy.seq) return { state: 'policy' };
+  for (const { environmentId, slug } of read.slugs) {
+    const [place] = await tx.select({ slug: environments.slug, project: projects.slug }).from(environments).innerJoin(projects, eq(projects.id, environments.projectId)).where(eq(environments.id, environmentId));
+    if ((place === undefined || place.slug.includes('~') || place.project.includes('~') ? null : place.slug) !== slug) return { state: 'policy' };
+  }
+  const [moved] = await tx.select({ seq: auditLog.seq }).from(auditLog)
+    .where(and(eq(auditLog.author, 'app'), eq(auditLog.subjectPrincipal, input.appKey), inArray(auditLog.action, ['key.reseal', 'key.rotate']))).limit(1);
+  if (moved !== undefined) return { state: 'retired' };
+  if (k.expiresAt <= now) return { state: 'expired' };
+  await tx.insert(credentials).values({
+    id: k.id, kind: k.kind, authMac: c.authMac, tokenHash: c.tokenHash, tokenHint: k.tokenHint, generation: input.generation, principal: input.principal,
+    identityId: null, scope: k.scope, places: k.places, label: k.label, createdBy: k.createdBy, expiresAt: new Date(k.expiresAt), revokedAt: null, seal: change.seal,
+  });
+  const number = await nextNumber(tx);
+  await tx.insert(logChanges).values({ number, at: change.at, requestId: change.requestId, object: change.object, actor: change.actor, payload: change.payload, seal: change.seal, mac: change.mac });
+  return { number: number.toString() };
+}
+
+/** `change_bindings` on SQLite, step for step, in one transaction: SQLite runs one writer at a time. */
+export async function bindingsOnSqlite(tx: Queryable, c: BindingsCall): Promise<Answer> {
+  const { auditLog, credentials, environments, logChanges, mcpConnections, projects, secrets, serviceBindings, vaultMembers } = tablesOf(tx);
+  const now = Date.now();
+  const newest = async (ref: Parameters<typeof objectKey>[0]) =>
+    (await tx.select({ seal: logChanges.seal }).from(logChanges).where(eq(logChanges.object, objectKey(ref))).orderBy(desc(logChanges.number)).limit(1))[0]?.seal ?? null;
+  const m = c.make;
+  if (m !== null) {
+    const standing = async (principal: string, generation: number, accessSeq: bigint) => {
+      const [row] = await tx.select({ status: vaultMembers.status, generation: vaultMembers.generation, accessSeq: vaultMembers.accessSeq }).from(vaultMembers).where(eq(vaultMembers.principal, principal));
+      return row?.status === 'active' && row.generation === generation && BigInt(row.accessSeq) === accessSeq;
+    };
+    if (!(await standing(c.actor, m.read.actor.generation, m.read.actor.accessSeq)) || !(await standing(c.principal, m.row.generation, m.read.principal.accessSeq))) return { state: 'moved' };
+    if (m.via !== null) {
+      const [via] = await tx.select({ principal: credentials.principal, revokedAt: credentials.revokedAt, seal: credentials.seal, expiresAt: credentials.expiresAt, notAfter: credentials.notAfter })
+        .from(credentials).where(eq(credentials.id, m.via));
+      const sealedAs = m.read.via?.seal ?? null;
+      const end = m.read.via?.columns.expiresAt ?? null;
+      const ends = via === undefined ? null : Math.min(via.expiresAt.getTime(), via.notAfter?.getTime() ?? Infinity);
+      if (via === undefined || via.principal !== c.actor || via.revokedAt !== null || sealedAs === null || end === null || ends !== end || end <= now
+        || !same(via.seal ?? null, sealedAs) || !same(await newest({ kind: 'credential', id: m.via }), sealedAs)) {
+        return { state: 'ended' };
+      }
+    }
+    // The MCP connection it came through, still connected; an id the log holds already, no binding to make (review r3).
+    if (m.connection !== null) {
+      const [connection] = await tx.select({ revokedAt: mcpConnections.revokedAt, generation: mcpConnections.generation }).from(mcpConnections).where(eq(mcpConnections.id, m.connection.id));
+      if (connection === undefined || connection.revokedAt !== null || connection.generation !== m.connection.generation) return { state: 'ended' };
+    }
+    const [made] = await tx.select({ number: logChanges.number }).from(logChanges).where(eq(logChanges.object, objectKey({ kind: 'binding', id: m.row.id }))).limit(1);
+    if (made !== undefined) return { state: 'stale' };
+  }
+  // The account's live bindings as the app read them, at most `MAX_BINDINGS` besides those it ends; the keys it reads by their names.
+  if (m !== null) {
+    const live = await tx.select({ id: serviceBindings.id }).from(serviceBindings)
+      .where(and(eq(serviceBindings.principal, c.principal), eq(serviceBindings.generation, m.row.generation), isNull(serviceBindings.revokedAt)));
+    if (live.map(({ id }) => id).sort().join() !== [...(c.live ?? [])].sort().join()) return { state: 'moved' };
+    if (live.filter(({ id }) => !c.ends.some((end) => end.id === id)).length >= MAX_BINDINGS) return { state: 'full' };
+    for (const read of c.reads) {
+      const [row] = await tx.select({ key: secrets.key }).from(secrets).where(eq(secrets.id, read.id));
+      if (row?.key !== read.key) return { state: 'moved' };
+    }
+  }
+  // The bindings it ends, and every live credential they issued, as read.
+  for (const end of c.ends) {
+    const [row] = await tx.select({ principal: serviceBindings.principal, revokedAt: serviceBindings.revokedAt, authMac: serviceBindings.authMac, seal: serviceBindings.seal })
+      .from(serviceBindings).where(eq(serviceBindings.id, end.id));
+    if (row === undefined || row.principal !== c.principal || row.revokedAt !== null || !same(row.authMac, end.macFrom) || !same(row.seal ?? null, end.sealFrom)) return { state: 'moved' };
+    const live = await tx.select({ id: credentials.id }).from(credentials)
+      .where(and(eq(credentials.principal, c.principal), eq(credentials.createdBy, `binding:${end.id}`), isNull(credentials.revokedAt), gt(credentials.expiresAt, new Date(now))));
+    const named = new Set(c.credentials.filter((x) => x.binding === end.id).map((x) => x.id));
+    if (live.some(({ id }) => !named.has(id))) return { state: 'moved' };
+  }
+  for (const x of c.credentials) {
+    const [row] = await tx.select({ createdBy: credentials.createdBy, revokedAt: credentials.revokedAt, authMac: credentials.authMac, seal: credentials.seal })
+      .from(credentials).where(eq(credentials.id, x.id));
+    if (row === undefined || row.createdBy !== `binding:${x.binding}` || !c.ends.some((end) => end.id === x.binding) || row.revokedAt !== null
+      || !same(row.authMac, x.macFrom) || !same(row.seal ?? null, x.sealFrom)) {
+      return { state: 'moved' };
+    }
+  }
+  const [changed] = await tx.select({ seq: auditLog.seq }).from(auditLog)
+    .where(and(eq(auditLog.author, 'vault'), eq(auditLog.action, 'policy.change'), eq(auditLog.decision, 'allow'))).orderBy(desc(auditLog.seq)).limit(1);
+  if ((changed === undefined ? null : String(changed.seq)) !== c.policy.seq) return { state: 'policy' };
+  for (const { environmentId, slug } of c.policy.slugs) {
+    const [place] = await tx.select({ slug: environments.slug, project: projects.slug }).from(environments).innerJoin(projects, eq(projects.id, environments.projectId)).where(eq(environments.id, environmentId));
+    if ((place === undefined || place.slug.includes('~') || place.project.includes('~') ? null : place.slug) !== slug) return { state: 'policy' };
+  }
+  const [moved] = await tx.select({ seq: auditLog.seq }).from(auditLog)
+    .where(and(eq(auditLog.author, 'app'), eq(auditLog.subjectPrincipal, c.appKey), inArray(auditLog.action, ['key.reseal', 'key.rotate']))).limit(1);
+  if (moved !== undefined) return { state: 'retired' };
+  // ChangeChecksSeal: each row it ends its object's newest change's.
+  for (const end of c.ends) if (!same(await newest({ kind: 'binding', id: end.id }), end.sealFrom)) return { state: 'stale' };
+  for (const x of c.credentials) if (!same(await newest({ kind: 'credential', id: x.id }), x.sealFrom)) return { state: 'stale' };
+  if (m !== null) {
+    const b = m.row;
+    await tx.insert(serviceBindings).values({
+      id: b.id, authMac: m.authMac, principal: b.principal, generation: b.generation, profile: b.profile, issuer: b.issuer, jwksUri: b.jwksUri, jwks: b.jwks,
+      claims: b.claims, scope: b.scope, policy: b.policy, origin: b.origin, label: b.label, createdBy: b.createdBy, createdAt: new Date(b.createdAt), seal: m.seal,
+    });
+  }
+  const ended = new Date(c.revokedAt);
+  for (const end of c.ends) {
+    await tx.update(serviceBindings).set({ revokedAt: ended, revokedBy: c.revokedBy, authMac: end.authMac, seal: end.seal }).where(eq(serviceBindings.id, end.id));
+  }
+  for (const x of c.credentials) {
+    await tx.update(credentials).set({ revokedAt: ended, revokedBy: c.revokedBy, authMac: x.authMac, seal: x.seal }).where(eq(credentials.id, x.id));
+  }
+  let number = 0n;
+  for (const x of c.changes) {
+    number = await nextNumber(tx);
+    await tx.insert(logChanges).values({ number, at: c.at, requestId: x.requestId, object: x.object, actor: c.actor, payload: x.payload, seal: x.seal, mac: x.mac });
+  }
+  return { number: number.toString() };
+}
+
+/** One past the log's highest number, both tables' (store.ts's `changeOnSqlite` says why). */
+async function nextNumber(tx: Queryable): Promise<bigint> {
+  const { logChanges, logUses } = tablesOf(tx);
+  const [{ last }] = await tx.select({ last: sql<number | string | null>`max(n)` }).from(
+    sql`(SELECT max(${logChanges.number}) AS n FROM ${logChanges} UNION ALL SELECT max(${logUses.number}) FROM ${logUses})`,
+  );
+  return BigInt(last ?? 0) + 1n;
+}
+
+function same(a: Uint8Array | null, b: Uint8Array | null): boolean {
+  return a === null || b === null ? a === b : Buffer.compare(Buffer.from(a), Buffer.from(b)) === 0;
+}