@coffre/vault 0.14.5 → 0.15.0

package/dist/index.js

@@ -1,2 +1,2 @@
-import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, r as awsKms, s as derivedSigningKey, t as KekBadClaimError } from "./src-Bg0ZeMJW.js";
+import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, r as awsKms, s as derivedSigningKey, t as KekBadClaimError } from "./src-DheG92EM.js";
 export { KekBadClaimError, KekUnavailableError, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };

package/dist/log-entry-BYWqj3O5.d.ts

@@ -0,0 +1,364 @@
+import { Sealing } from "@coffre/core/vault";
+import { Hash, LogEntry, LogReader, Pair, PairNotes, PairProofs, PairSigners, PairVerifiers, StoredPair, Tile, TreeName, WitnessAnswer } from "@coffre/core/merkle";
+//#region src/checkpointer.d.ts
+/**
+ * 0.15's checkpointer (docs/design/audit-tree.md): every tick it seals what
+ * has committed into the two trees, signs both heads as one pair, remembers
+ * the pair outside the database, writes it, and hands it to the witnesses.
+ * The rest of the vault sees one seam: `tick()` (the window in, a signed pair
+ * out), `sealThrough(number)` for a change that waits for its seal (R51), and
+ * `prove(number)`. The trees' shape stays behind it.
+ *
+ * What it stands on, each a protection formal/Seal.tla shows necessary:
+ * - the barrier (`close`): every number at or below the `upto` it returns has
+ *   ended, committed or not, so a window is final once read;
+ * - the signer's memory (`Memory`, core, R54): the last pair it signed, kept
+ *   where a database writer cannot reach, written before the database
+ *   (RememberFirst) and checked at every open, so neither a tail cut nor a
+ *   rollback gets a second history signed;
+ * - each tick compares the database's newest row with the pair it holds
+ *   (RowChecked), so a deleted row shows within a tick, traffic or not;
+ * - nothing is sealed over an entry that fails its MAC (`authentic`), is out
+ *   of its window, or is much older than the pair it holds (a replay).
+ *
+ * And nothing it awaits is unbounded (T169): a tick that runs past
+ * `TICK_BOUND_MS` stalls the checkpointer, closed for good behind its
+ * `Fence`, so that its host opens another while the database still holds
+ * the old one's statement (Seal.tla's Fenced); a change waits at most
+ * `SEAL_WAIT_MS` for its seal, then answers `Unsealed`.
+ */
+/** What the checkpointer needs of the database. Postgres and SQLite implement it; so do the tests. */
+type CheckpointStore = LogReader & {
+  /**
+   * The barrier, then the window: `upto`, such that every number at or below
+   * it has ended; the entries in (after, upto], by number; and the newest
+   * pair, as `newest()` reads it. The window is read after the barrier's lock
+   * is let go, in a snapshot of its own (`close_one`, then one read): a
+   * snapshot from before the lock would miss what committed while it waited.
+   *
+   * The barrier also raises the floor of `at` (`close_one`): `floor.found` is
+   * the floor it found, null if none, and `floor.set` the one it left. The
+   * window's uses are read from `from`, the floor the signer holds, as the
+   * last barrier set it. `floor.ceiling` is the database's clock less the
+   * use deadline, read once the barrier has run: the highest floor any
+   * barrier before it can have left (HotPathOne.tla's BarrierAcceptsLate).
+   *
+   * With `limit` (T169), the window's first `limit` entries by number, and
+   * `more` when there were more: `more.above`, the lowest `at` of the uses
+   * the window holds above the last of them, from `from` on (null: none).
+   * `barrier`, told the barrier's `upto` before the window is read.
+   */
+  close(after: bigint, from: number, limit?: number, barrier?: (upto: bigint) => void): Promise<{
+    upto: bigint;
+    newest: StoredPair | null;
+    entries: LogEntry[];
+    floor: {
+      found: number | null;
+      set: number;
+      ceiling: number;
+    };
+    more?: {
+      above: number | null;
+    } | null;
+  }>;
+  /**
+   * The newest pair: each tree's own newest note, `upto` the larger of theirs
+   * (Seal.tla's PairChecked). Stored as one row a pair, that is the newest
+   * row; stored as a row a tree, never one tree's newest row for both, since
+   * deleting the other tree's newest row would then pass unseen. Notes of two
+   * places then fail every check that wants one pair.
+   */
+  newest(): Promise<StoredPair | null>;
+  /**
+   * One statement: both trees' tiles and both notes (PairWrittenTogether). No
+   * state holds one head without the other.
+   */
+  write(row: StoredPair, tiles: Record<TreeName, Tile[]>): Promise<void>;
+  /**
+   * Entry `number` and its leaf index in its tree, if it is in the log; a
+   * use found at `at` when the caller knows its time, which spares a scan
+   * of its window's time. With `tree`, an entry in the other is refused
+   * (`misplaced`) before its index is sought.
+   */
+  locate(number: bigint, options?: Locating): Promise<{
+    entry: LogEntry;
+    index: number;
+  } | null>;
+};
+/**
+ * The signer's memory: the one record holding the last pair it signed. A
+ * Durable Object's storage on Workers, a synced file beside a Node vault.
+ */
+type Memory = {
+  last(): Promise<string | null>;
+  remember(record: string): Promise<void>;
+};
+/** What a proof asks of `locate`: the use's time, if known, and the tree the entry must be in. */
+type Locating = {
+  at?: number;
+  tree?: TreeName;
+};
+/** Somewhere each signed pair goes that a database writer cannot reach: a witness, an archive (R40's plugin). */
+type Witness = {
+  name: string;
+  /**
+   * Publishes the pair; `proofs(from)` gives each tree's consistency proof
+   * from the sizes the witness holds. A try that outlives its bound (2 s) is
+   * a failure to the pump, and `signal` aborts: an implementation that makes
+   * a request passes it on, so abandoned tries do not pile up.
+   */
+  publish(notes: PairNotes, proofs: (from: Record<TreeName, number>) => Promise<PairProofs>, signal: AbortSignal): Promise<WitnessAnswer>;
+};
+/**
+ * What a checkpointer given up on may still do (T169; Seal.tla's Fenced):
+ * nothing it starts once its fence is closed. Every call it makes to its
+ * store, and every write to its memory, is checked against the fence
+ * first. What it sent before may still land: a database write is refused
+ * where a row holds its place (`write_checkpoint`, one statement), and a
+ * barrier raises the floor no higher than the next one does
+ * (HotPathOne.tla's LateBarrier); the memory writes in flight, `close`
+ * waits for, so that the next checkpointer reads them.
+ */
+declare class Fence {
+  #private;
+  /** Why it was closed; null while it is open. */
+  get closed(): string | null;
+  /** Closed for good; resolves once the memory writes already sent have landed. */
+  close(why: string): Promise<void>;
+  /** The store, each of its calls refused once the fence is closed, and each answer that comes after. */
+  store<T extends object>(store: T): T;
+  /** The memory, its writes refused once the fence is closed, and those in flight kept for `close`. */
+  memory(memory: Memory): Memory;
+}
+type Tick = {
+  /**
+   * Whether a pair landed in the database this tick: a new one, or a pending
+   * one finished. A tick can finish a pending pair and then refuse its own
+   * window: `failures` says so.
+   */
+  signed: boolean;
+  upto: bigint;
+  sizes: Record<TreeName, number>;
+  entries: number;
+  /** Why nothing was signed, when something is wrong: each is an alarm for an operator. */
+  failures: string[];
+  /** Database time: the barrier and window, then the write. */
+  closeMs: number;
+  writeMs: number;
+  /** Whether the window held more than this tick sealed (`WINDOW_MAX`): its host ticks again at once. */
+  more: boolean;
+};
+type Sealed = {
+  pair: Pair;
+  notes: PairNotes;
+  /** null when no witness is set up, so nothing reads "witnessed" there. */
+  witnessed: boolean | null;
+  failures: string[];
+  /**
+   * Each witness's cosignature of the newest pair it took in time: a pair
+   * covering the change, which may be later than `pair` if a tick landed
+   * meanwhile. Each note says its own place. An archive cosigns nothing and
+   * adds none: whether the change was witnessed is `witnessed`, never the
+   * length of this.
+   */
+  cosigned: PairNotes[];
+  /** The change's entry, proved in the pair: what the admin's client checks and can keep. */
+  proof: InclusionProof;
+};
+/**
+ * The change path's seam (plan PR 4): a change, once committed, asks for its
+ * seal and answers with what this gives it (R51). The Node checkpointer's
+ * `sealThrough` is one; on Workers, `durableSealThrough` asks the
+ * checkpointer's Durable Object.
+ */
+type SealThrough = (number: bigint, deadline?: number) => Promise<Sealed>;
+/** An alarm the checkpointer raised, as its host keeps it for whoever watches (R40's plugin, PR 8's surfaces). */
+type Alarm = {
+  at: number;
+  message: string;
+};
+type InclusionProof = {
+  number: bigint;
+  tree: TreeName;
+  index: number;
+  size: number;
+  /** The leaf's data: the whole entry. */
+  leaf: Buffer;
+  proof: Hash[];
+  /** The pair it is proved against. */
+  notes: PairNotes;
+};
+type Options = {
+  memory: Memory;
+  witnesses?: readonly Witness[];
+  /**
+   * Whether an entry's MAC holds: the vault checks it with its key before
+   * anything is sealed. The MAC must cover the entry's tree (Seal.tla's
+   * KindInMac): otherwise a change moved into the uses partition before its
+   * tick would be sealed into the uses tree, and pruned with the uses.
+   */
+  authentic: (entry: LogEntry) => boolean;
+  /** Where alarms go: refused ticks, unwitnessed changes, memory and database out of step. */
+  alert?: (message: string) => void;
+  freshMs?: number;
+  now?: () => number;
+  /**
+   * What closes this checkpointer for good (T169): a host bounding the open
+   * passes its own, to close it if the open stalls. One is made otherwise.
+   */
+  fence?: Fence;
+  /** `TICK_BOUND_MS`, `SEAL_WAIT_MS` and `WINDOW_MAX`, for the tests. */
+  tickBoundMs?: number;
+  sealWaitMs?: number;
+  windowMax?: number;
+};
+declare class Checkpointer {
+  private store;
+  private signers;
+  private options;
+  private fence;
+  private edges;
+  private head;
+  private running;
+  private pumps;
+  /**
+   * A pair signed, perhaps remembered, not known to be written: the memory
+   * may hold it, or the database may (a write that committed, then threw).
+   * It is finished before anything else is signed, never replaced by another
+   * pair for its place.
+   */
+  private pending;
+  /** The last pairs it wrote, newest last, each with what proves a change it sealed (T171). */
+  private signed;
+  /** The tick running now (T171): a change committed before its barrier is sealed by it, and waits for no other. */
+  private flight;
+  /**
+   * The floor of `at` signed into the newest pair: windows are read from it.
+   * It moves only when a pair carrying a new floor is written.
+   */
+  private floor;
+  /**
+   * The floor this process's last barrier set, which the next barrier must
+   * find exactly; null until its first barrier (a restart cannot know what
+   * barriers whose pairs went unsigned raised it to).
+   */
+  private barrier;
+  /** Set once a barrier finds the floor elsewhere: every tick refuses until the checkpointer is reopened. */
+  private floorAlarm;
+  /** The failures the last refused tick alerted: a refusal that stands is alerted once, not every tick. */
+  private refused;
+  /** The log's public keys, which open its pairs. */
+  readonly verifiers: PairVerifiers;
+  private constructor();
+  /**
+   * What stands against it sealing, whichever tick met it, an alarm's or a change's: why it stalled, or the refusal of
+   * its last tick; null when its last tick held. Readiness reads it beside its host's own view (T169, review r5).
+   */
+  get standing(): string | null;
+  /** Why its last tick threw, whichever tick it was, a change's or its host's; null once one ends well (review r6). */
+  private thrown;
+  /** The newest pair the signer signed and the database holds. */
+  get pair(): {
+    pair: Pair;
+    notes: PairNotes;
+  };
+  /** How much older than its pair an entry the signer seals may be (`FRESH_MS`): retention drops a day two of these past its cut. */
+  get freshMs(): number;
+  /**
+   * From the newest checkpoint row, checked against what the signer
+   * remembers, which comes first: nothing is signed or remembered before the
+   * two are compared. The signer remembers a pair before the database has it
+   * (RememberFirst), so the memory may be ahead of the database: after a crash
+   * between the two, or because a writer deleted the newest rows. Either way,
+   * if the entries the database holds give the remembered pair, its row is
+   * written again and nothing was lost; if they do not, the database lost
+   * entries the signer sealed, and it refuses. A database beside the memory,
+   * another pair at the same place, is refused too.
+   */
+  static open(store: CheckpointStore, signers: PairSigners, options: Options): Promise<Checkpointer>;
+  /**
+   * One checkpoint: seal what has committed, sign it, remember it, store it,
+   * publish it. Ticks run one at a time, the regular ones and those a change
+   * asks for.
+   */
+  /**
+   * Stops this checkpointer for good: every tick after, and every change
+   * that would tick, is refused, and its fence refuses whatever its tick in
+   * flight still does. Resolves once that tick has ended or stalled
+   * (`TICK_BOUND_MS`), and its memory writes in flight have landed. A host
+   * that opens another over the same memory closes this one first, so that
+   * two signers never act at once.
+   */
+  close(): Promise<void>;
+  private closed;
+  /** Why it stalled (T169): a tick past its bound. */
+  private stalled;
+  /** When the tick in flight stalls: `TICK_BOUND_MS` after it started, and more for a long window. */
+  private until;
+  /** What the tick in flight awaits, which a stall says, so that an operator sees what stalled. */
+  private phase;
+  /**
+   * A tick: the one queued behind the running one, if there is one yet,
+   * else a new one. Its barrier comes after every commit made before it
+   * starts, so whoever asks before it starts is sealed by it as well as by
+   * one of their own: many changes waiting at once share ticks, rather than
+   * each waiting for a tick per change before it (0.15-plan.md, "As built:
+   * PR 4b", measured).
+   */
+  tick(): Promise<Tick>;
+  private queued;
+  private tickNow;
+  /**
+   * Finishes a pending pair: remembered again (the first try may have failed,
+   * or not), then held by the database, which may hold it already; else it is
+   * written now over the pair the signer holds. A database at neither pair
+   * is refused until the checkpointer is reopened, whose rules then apply.
+   */
+  private finish;
+  private commit;
+  /**
+   * A change answers once its entry is sealed and, where witnesses are set
+   * up, witnessed (R51): seal now unless a pair already covers it, then wait
+   * for every witness to hold a pair that covers it, whichever tick sealed it,
+   * for at most `deadline`. A witness silent that long lets the change answer
+   * unwitnessed, alerted: the change is in force either way, and its entry is
+   * sealed in the database and in the signer's memory. A tick that cannot seal
+   * (an entry failing its MAC) fails the wait rather than spinning.
+   *
+   * A pair covering the number is not enough: the entry must be in it. An
+   * entry deleted before its tick leaves its number a gap the pair calls
+   * final, and nothing could ever show the change again; so the change is
+   * proved in the pair, and refused, alerted, if it is not there.
+   */
+  sealThrough(number: bigint, deadline?: number): Promise<Sealed>;
+  /**
+   * Change `number`'s inclusion proof in a pair this checkpointer signed and wrote, from the tiles its tick wrote, and
+   * checked against that pair's root; null if it kept none holding it (T171).
+   */
+  private proveKept;
+  /**
+   * Entry `number`'s inclusion proof against the newest pair, checked before
+   * it is handed out; null if not sealed. A use's `at`, if known, finds it
+   * in one probe; with `tree`, an entry in the other is refused.
+   */
+  prove(number: bigint, options?: Locating): Promise<InclusionProof | null>;
+  private proveAt;
+  /** Each witness's pump: one publication in flight at a time, always of the newest pair (a witness needs only that). */
+  private pump;
+  private publish;
+  /** Hands a witness the newest pair: sent now if its pump is idle, else next. A checkpointer closed hands none. */
+  private kick;
+  private drain;
+  private publishAll;
+  /** The witnesses that do not hold a pair sealing `upto` within the deadline, each with its last failure. */
+  private witnessed;
+}
+//#endregion
+//#region src/log-entry.d.ts
+/** The key that MACs log entries, and its tag: both from the vault's signing seed, each under a label of its own. */
+type LogMacKey = {
+  tag: Buffer;
+  key: Buffer;
+};
+//#endregion
+export { SealThrough as a, Memory as i, Alarm as n, Tick as o, Checkpointer as r, Witness as s, LogMacKey as t };

package/dist/node.d.ts

@@ -1,11 +1,46 @@
+import { a as SealThrough, i as Memory, n as Alarm, r as Checkpointer, s as Witness } from "./log-entry-BYWqj3O5.js";
 import { a as KekUnavailableError, c as awsKms, d as Kek, f as VaultConfig, i as KekProvider, l as checkpointMessage, n as AwsKmsOptions, o as SecretContext, p as derivedSigningKey, r as KekBadClaimError, s as WrappedDek, t as AwsCredentials, u as verifyCheckpoint } from "./index-DQ-FKVF3.js";
-import { Vault, Vault as Vault$1 } from "@coffre/core/vault";
-import { Database } from "@coffre/db";
+import { NamedUseInput, Sealing, UseCode, Vault, Vault as Vault$1 } from "@coffre/core/vault";
+import { KekRegistry } from "@coffre/core/kek";
+import { Database, Queryable } from "@coffre/db";
+import { PairNotes, PairVerifiers } from "@coffre/core/merkle";
 import "@coffre/core/access";
-import "@coffre/core/audit";
-import "@coffre/db/grants";
 import "@coffre/db/log";
+import "@coffre/db/grants";
+import "drizzle-orm";
+import "@coffre/core/audit";
 export * from "@coffre/core/vault";
+//#region src/log-replay.d.ts
+/**
+ * The log as stored, read whole and replayed with the seal keys of
+ * `signingKeys` (the vault's): each use's decision by its entry number,
+ * and what does not hold, an entry that names no object or no purpose
+ * among `replay`'s faults. The verifier of plan PR 8 walks the log a
+ * stretch at a time; this reads all of it, for the suites that hold every
+ * live answer to it (R53).
+ */
+export declare function replayStored(db: Queryable, signingKeys: readonly Uint8Array[]): Promise<{
+  decided: Map<string, UseCode | null>;
+  faults: string[];
+}>;
+//#endregion
+//#region src/use.d.ts
+/**
+ * The settings of an isolate's uses: how many calls in flight at once, how long a cover holds, and how many requests'
+ * names it maps to ids (`UseCache.names`; 0 maps none, each request then reads its ids: the bench's worst case).
+ */
+type UseLimits = {
+  inFlight: number;
+  coverMs: number;
+  names: number;
+  /**
+   * The most keys a statement of a batch makes uses of (`useMany`): each statement holds the fence for its keys' uses,
+   * about 0.4 ms a key, and a change or the checkpointer's barrier waits behind it, every use queued behind that (R44).
+   * A batch of more is made in statements of this many, in turn (review r2 of #433): 100 hold the fence about 40 ms.
+   */
+  batch: number;
+};
+//#endregion
 //#region src/vault.d.ts
 type VaultOptions = {
   /**
@@ -17,6 +52,50 @@ type VaultOptions = {
   clockOffset?: () => number;
   /** How far one call walks the log (`WALKS`); tests shorten them. */
   walks?: Partial<Walks>;
+  /**
+   * Which log the vault keeps (0.15's plan, "Behind one switch"): 0.15's,
+   * the default since its flip (plan PR 10), where each decision that
+   * changes an input also logs it as a change of 0.15's log (`changes.ts`),
+   * or 0.14's alone, for the suites until 0.16 removes it. Not a
+   * deployment's to set: once cut over, the database refuses 0.14's writes.
+   */
+  log?: '0.14' | '0.15';
+  /**
+   * Under 0.15's log, what a change waits for before it answers: its entry
+   * sealed in a signed checkpoint, and witnessed or past the witnesses'
+   * bound (R51): the checkpointer's `sealThrough` (checkpointer.ts). A
+   * change whose entry it does not seal fails, though committed. Required
+   * under 0.15's log.
+   */
+  sealThrough?: SealThrough;
+  /**
+   * Under 0.15's log, the pairs held where no database writer reaches: the
+   * signer's memory (`durableHeldOutside` on Workers, the Node runner's
+   * `heldOutside`), later a witness's. The verifier holds every walk to
+   * them; without, a database rolled back whole to an earlier pair would
+   * verify until the signer's next tick refuses it (verifier.ts). Required
+   * under 0.15's log, as `sealThrough` is (T151).
+   */
+  heldOutside?: () => Promise<readonly PairNotes[]>;
+  /**
+   * Under 0.15's log, whether the checkpointer seals (T169), bounded: what
+   * `sealing()` answers, and `/readyz` asks. The Node runner's `sealing`;
+   * on Workers the entrypoint asks the object itself. Without, it seals.
+   */
+  sealing?: () => Promise<Sealing> | Sealing;
+  /**
+   * 0.15's uses, per isolate (use.ts): how many calls in flight at once, by
+   * default the hot path's pool, `connections`, and how long a cover holds.
+   */
+  uses?: Partial<UseLimits> & {
+    connections?: number;
+  };
+  /**
+   * Whether a call's I/O ends with its request, as on Workers, where a call whose request has ended may never settle:
+   * then a use's place in admission lapses past its deadline, settled or not (use.ts, `HELD_PAST_DEADLINE_MS`), its
+   * connection closed by then (cloudflare.ts). Not a deployment's to set.
+   */
+  callsEndWithRequest?: boolean;
 };
 /** How far one call walks the log, in entries: a checkpoint's walk from the last, its rehash of the past, and a verification's own walk. */
 type Walks = {
@@ -27,9 +106,84 @@ type Walks = {
 //#endregion
 //#region src/local.d.ts
 type LocalVault = Vault$1 & {
+  use: NonNullable<Vault$1['use']>;
   close(): Promise<void>;
 };
 //#endregion
+//#region src/checkpointer-node.d.ts
+/**
+ * The 0.15 checkpointer on Node (docs/design/audit-tree.md): one process
+ * seals the log every 500 ms, its memory a file beside the vault, synced
+ * before the database has the pair it holds (RememberFirst). The vault's
+ * process runs it (`keepCheckpointer`, node.ts). Nothing it awaits is
+ * unbounded (T169): a tick past its bound stalls the checkpointer, and the
+ * vault's process opens another.
+ */
+/** The signer's memory in a file: written whole, synced, renamed over the last, and the directory synced, so a power loss keeps it. */
+export declare function fileMemory(path: string): Memory;
+type RunningCheckpointer = {
+  checkpointer: Checkpointer;
+  /** For the change path (plan PR 4): seal now, then wait for the witnesses (R51). */
+  sealThrough: SealThrough;
+  /** The alarms raised since `since` (ms), oldest first, from the file beside the memory. */
+  alarms(since?: number): Promise<Alarm[]>;
+  /** The pair the signer remembers, from its file: what the vault's verifier holds its walks to (`VaultOptions.heldOutside`). */
+  heldOutside(): Promise<PairNotes[]>;
+  /** The reads' projection run until it stands at the newest pair (T166): for tests and tools, never on a request's path. */
+  projected(): Promise<void>;
+  /** Whether it seals (`Vault.sealing`): ticking, its last tick ended well, lately. */
+  sealing(): Sealing;
+  stop(): Promise<void>;
+};
+/** A connection of the checkpointer's own (T169), which its runner cuts once it stalls: `openDatabase(url, { max })`. */
+type Session = {
+  db: Database;
+  cut(): Promise<void>;
+};
+/**
+ * Opens the checkpointer over `database` (the vault's login) and ticks it
+ * every `intervalMs`, a tick after the last one ends, each followed by the
+ * log's upkeep (days made ahead, retention past `retainDays`, the bulk
+ * cap's rows pruned). Each alarm is appended to `<memory>.alarms`, one JSON
+ * line each. Given `connect` instead, over a session of its own, cut once
+ * it stalls or stops, so that what it still awaits holds no connection of
+ * the vault's (review r1).
+ */
+export declare function runCheckpointer(options: {
+  /** The vault's database, or `connect`, a session of its own. */
+  database?: Database;
+  connect?: () => Promise<Session>;
+  seed: Uint8Array;
+  /** The memory's file. */
+  memory: string;
+  witnesses?: readonly Witness[];
+  intervalMs?: number;
+  tileRange?: number;
+  /** Full days of uses kept before today's; null keeps every day (retention.ts). */
+  retainDays?: number | null;
+  /** Told once its checkpointer stalls (T169), which ticks no more: `keepCheckpointer` opens another. */
+  stalled?: (why: string) => void;
+  /** `TICK_BOUND_MS`, which bounds the open and the next days too: for the tests. */
+  tickBoundMs?: number;
+  /** The memory over its file, `fileMemory` unless a test holds its writes. */
+  memoryOf?: (path: string) => Memory;
+  /** `UPKEEP_BOUND_MS`, for the tests. */
+  upkeepBoundMs?: number;
+}): Promise<RunningCheckpointer>;
+type KeptCheckpointer = Pick<RunningCheckpointer, 'sealThrough' | 'heldOutside' | 'alarms' | 'sealing' | 'stop'>;
+/**
+ * The checkpointer as the vault's process keeps it: `runCheckpointer`, tried
+ * again every `retryMs` while it cannot open (a log it refuses, as after a
+ * restore, docs/restore.md; the database out of reach), each try making the
+ * next days of uses first, so that uses go on; its failure an alarm, kept
+ * once while it stands. Meanwhile a change's seal fails with why, as on
+ * Workers, and the pair held outside is read from the file as ever. One
+ * that stalls (T169) is stopped, fenced, and another opened a tick later.
+ */
+export declare function keepCheckpointer(options: Parameters<typeof runCheckpointer>[0] & {
+  retryMs?: number;
+}): Promise<KeptCheckpointer>;
+//#endregion
 //#region src/node.d.ts
 export type NodeVaultConfig = VaultConfig & {
   /**
@@ -38,8 +192,29 @@ export type NodeVaultConfig = VaultConfig & {
    * development. Or one already open, which the vault leaves open.
    */
   database: string | Database;
+  /**
+   * 0.15's uses (docs/design/0.15-plan.md, PR 5): the same database as
+   * `coffre_vault_hot`, whose lock and statement timeouts bound a use, or
+   * one already open; on SQLite, the same `file:` URL. Required.
+   */
+  hotDatabase?: string | Database;
+  /**
+   * 0.15's checkpointer, which this process runs: `memory`, the file it
+   * keeps the newest pair it signed in, where no database writer reaches,
+   * such as `/var/lib/coffre/checkpointer-memory`, writable by the vault's
+   * user alone (its alarms go beside it, in `<memory>.alarms`). Required,
+   * unless the caller seals through a checkpointer of its own
+   * (`VaultOptions.sealThrough` and `heldOutside`).
+   */
+  checkpointer?: {
+    memory: string;
+  };
 };
-/** The vault in this process. */
+/**
+ * The vault in this process, and under 0.15's log, the default, its
+ * checkpointer, opened before the vault serves, so that no call meets a log
+ * with no checkpoint yet. A configuration without what 0.15 needs is refused.
+ */
 export declare function localVault(config: NodeVaultConfig, options?: VaultOptions): Promise<LocalVault>;
 export type VaultServer = {
   socket: string;
@@ -56,4 +231,4 @@ export declare function serveVault(config: NodeVaultConfig & {
 /** The vault that `serveVault` runs, from the server's side of its socket. */
 export declare function connectVault(socket: string): Vault;
 //#endregion
-export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type LocalVault, type SecretContext, type Vault, type VaultConfig, type VaultOptions, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };
+export { type AwsCredentials, type AwsKmsOptions, type Kek, KekBadClaimError, type KekProvider, KekUnavailableError, type KeptCheckpointer, type LocalVault, type RunningCheckpointer, type SecretContext, type Vault, type VaultConfig, type VaultOptions, type WrappedDek, awsKms, checkpointMessage, derivedSigningKey, verifyCheckpoint };