@coffre/vault 0.1.3 → 0.1.5

package/dist/cloudflare.js

@@ -1,12 +1,16 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-pexzy7Z-.js";
+import { n as prepareVault, t as openVault } from "./vault-PQvFopA6.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
 //#region src/cloudflare.ts
 /** Set when the Worker's module runs `vault(…)`, before any call comes in. */
 let configure = null;
-/** The configuration, checked and made ready once per `env`, which the isolate keeps. */
+/**
+* The configuration, checked and made ready once per `env`, which the
+* isolate keeps: the ready value itself, never the work of making it, which
+* would belong to the call that started it (vault.ts, `PreparedVault`).
+*/
 const ready = /* @__PURE__ */ new WeakMap();
 /**
 * What the app's `VAULT` service binding calls. Each call gets a database of
@@ -19,14 +23,14 @@ var VaultEntrypoint = class extends WorkerEntrypoint {
 		if (entry === void 0) {
 			if (configure === null) throw new Error("the vault Worker must export default vault(…)");
 			const config = configure(env);
-			entry = prepareVault(resolveVaultConfig(config)).then((prepared) => ({
+			const prepared = await prepareVault(resolveVaultConfig(config));
+			entry = ready.get(env) ?? {
 				database: config.database,
 				prepared
-			}));
+			};
 			ready.set(env, entry);
-			entry.catch(() => ready.delete(env));
 		}
-		const { database, prepared } = await entry;
+		const { database, prepared } = entry;
 		return openVault(createDatabase(new HyperdrivePool(database.hyperdrive.connectionString)), prepared);
 	}
 	async unwrap(input) {

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-pexzy7Z-.js";
+import { n as prepareVault, t as openVault } from "./vault-PQvFopA6.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{vault-pexzy7Z-.js → vault-PQvFopA6.js}

@@ -792,8 +792,7 @@ async function prepareVault(config, options = {}) {
 		reported: /* @__PURE__ */ new Set(),
 		since: null,
 		superseded: null,
-		settling: null,
-		kekCheck: null,
+		kekChecked: false,
 		wrongKek: null
 	};
 }
@@ -1100,12 +1099,7 @@ var VaultService = class {
 	*/
 	async #settled() {
 		const prepared = this.#prepared;
-		if (prepared.since === null && prepared.superseded === null) {
-			prepared.settling ??= this.#settle().finally(() => {
-				prepared.settling = null;
-			});
-			await prepared.settling;
-		}
+		if (prepared.since === null && prepared.superseded === null) await this.#settle();
 		return prepared.superseded;
 	}
 	/**
@@ -1910,19 +1904,21 @@ var VaultService = class {
 	/**
 	* Null when every KEK the vault is given opens what it wrapped; otherwise
 	* why not, naming the KEK, never its key. Decided once per process, before
-	* its first key operation or checkpoint. A key service that cannot answer
-	* leaves it undecided: the error is thrown, and the next call asks again.
+	* its first key operation or checkpoint: until then, each call checks for
+	* itself, over its own database, and the first verdict is kept. A key
+	* service that cannot answer leaves it undecided: the error is thrown,
+	* and the next call asks again.
 	*/
-	#kekMismatch() {
+	async #kekMismatch() {
 		const prepared = this.#prepared;
-		if (prepared.kekCheck === null) {
-			const check = this.#checkKeks();
-			prepared.kekCheck = check;
-			check.then((wrong) => void (prepared.wrongKek = wrong), () => {
-				if (prepared.kekCheck === check) prepared.kekCheck = null;
-			});
+		if (!prepared.kekChecked) {
+			const wrong = await this.#checkKeks();
+			if (!prepared.kekChecked) {
+				prepared.wrongKek = wrong;
+				prepared.kekChecked = true;
+			}
 		}
-		return prepared.kekCheck;
+		return prepared.wrongKek;
 	}
 	/**
 	* Each KEK opens its check value, or, with none recorded yet (a fresh
@@ -1933,12 +1929,7 @@ var VaultService = class {
 	async #checkKeks() {
 		const superseded = await this.#settled();
 		if (superseded !== null) return superseded;
-		const checks = /* @__PURE__ */ new Map();
-		for (const entry of await vaultEntriesOf(this.#db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
-			if (!this.#authentic(entry)) continue;
-			const wrapped = JSON.parse(entry.metadata);
-			checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
-		}
+		const checks = await this.#checkValues(this.#db);
 		const budget = this.#prepared.options.keyBudgetMs;
 		for (const kek of this.#config.keks.all) {
 			const operation = {
@@ -1977,18 +1968,32 @@ var VaultService = class {
 			}
 			if (samples.length > 0 && proof === null) return mismatch;
 			const wrapped = await kek.wrap(Buffer.from(KEY_CHECK_VALUE), KEY_CHECK_CONTEXT, operation);
-			await this.#db.transaction((tx) => this.#append(tx, [{
-				actor: VAULT_ACTOR,
-				action: KEY_CHECK,
-				decision: "allow",
-				metadata: JSON.stringify({
-					...serialisable(wrapped),
-					proof
-				})
-			}]));
+			await this.#db.transaction(async (tx) => {
+				await lockLogHead(tx);
+				if ((await this.#checkValues(tx)).has(`${kek.provider}:${kek.keyId}`)) return;
+				await this.#append(tx, [{
+					actor: VAULT_ACTOR,
+					action: KEY_CHECK,
+					decision: "allow",
+					metadata: JSON.stringify({
+						...serialisable(wrapped),
+						proof
+					})
+				}]);
+			});
 		}
 		return null;
 	}
+	/** Each KEK's recorded check value, by `provider:keyId`. */
+	async #checkValues(db) {
+		const checks = /* @__PURE__ */ new Map();
+		for (const entry of await vaultEntriesOf(db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
+			if (!this.#authentic(entry)) continue;
+			const wrapped = JSON.parse(entry.metadata);
+			checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
+		}
+		return checks;
+	}
 	/** The last checkpoint the vault signed, and the entry that holds it: its newest allowed `audit.checkpoint`. */
 	async #latest(db) {
 		const row = await latestVaultEntry(db, [CHECKPOINT]);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,15 +36,16 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.3",
-    "@coffre/db": "0.1.3"
+    "@coffre/core": "0.1.5",
+    "@coffre/db": "0.1.5"
   },
   "devDependencies": {
     "@types/node": "26.1.1",
     "@types/pg": "8.20.0",
     "pg": "8.16.3",
     "tsdown": "0.23.0",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "wrangler": "4.118.0"
   },
   "scripts": {
     "build": "tsdown",

package/src/cloudflare.ts

@@ -42,8 +42,12 @@ export type WorkersVaultConfig = VaultConfig & { database: PostgresDatabase };
 /** Set when the Worker's module runs `vault(…)`, before any call comes in. */
 let configure: ((env: never) => WorkersVaultConfig) | null = null;
 
-/** The configuration, checked and made ready once per `env`, which the isolate keeps. */
-const ready = new WeakMap<object, Promise<{ database: PostgresDatabase; prepared: PreparedVault }>>();
+/**
+ * The configuration, checked and made ready once per `env`, which the
+ * isolate keeps: the ready value itself, never the work of making it, which
+ * would belong to the call that started it (vault.ts, `PreparedVault`).
+ */
+const ready = new WeakMap<object, { database: PostgresDatabase; prepared: PreparedVault }>();
 
 /**
  * What the app's `VAULT` service binding calls. Each call gets a database of
@@ -56,11 +60,12 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
     if (entry === undefined) {
       if (configure === null) throw new Error('the vault Worker must export default vault(…)');
       const config = configure(env as never);
-      entry = prepareVault(resolveVaultConfig(config)).then((prepared) => ({ database: config.database, prepared }));
+      const prepared = await prepareVault(resolveVaultConfig(config));
+      // Calls that raced here each made one; the first kept serves them all from now on.
+      entry = ready.get(env) ?? { database: config.database, prepared };
       ready.set(env, entry);
-      entry.catch(() => ready.delete(env));
     }
-    const { database, prepared } = await entry;
+    const { database, prepared } = entry;
     return openVault(createDatabase(new HyperdrivePool(database.hyperdrive.connectionString)), prepared);
   }
 

package/src/vault.ts

@@ -75,7 +75,9 @@ export type VaultOptions = {
 /**
  * A vault's configuration made ready to use, once per process, or once per
  * isolate on Workers: its signer, its log key, and how far it has verified
- * the log. Everything else is in the database, so any number of instances
+ * the log. It holds settled values only, never work under way: on Workers,
+ * a call's I/O is that call's, and a call that waited on another's would be
+ * cancelled with it, as hung (isolate.test.ts). Everything else is in the database, so any number of instances
  * share one set of members, one log and one bulk count.
  */
 export type PreparedVault = {
@@ -101,12 +103,10 @@ export type PreparedVault = {
   since: bigint | null;
   /** Why it writes nothing, once settled that it may not. */
   superseded: string | null;
-  /** The settling under way. */
-  settling: Promise<void> | null;
   /** Tampering this process has logged already, so that a forged row is one entry, not one per request. */
   reported: Set<string>;
-  /** Whether its KEKs open what they wrapped, once asked: `#kekMismatch`. */
-  kekCheck: Promise<string | null> | null;
+  /** Whether its KEKs are decided to open what they wrapped, or not: `#kekMismatch`. */
+  kekChecked: boolean;
   /** Why not, once decided that they do not. */
   wrongKek: string | null;
 };
@@ -121,8 +121,7 @@ export async function prepareVault(config: ResolvedVaultConfig, options: VaultOp
     reported: new Set(),
     since: null,
     superseded: null,
-    settling: null,
-    kekCheck: null,
+    kekChecked: false,
     wrongKek: null,
   };
 }
@@ -485,12 +484,10 @@ class VaultService implements Vault {
    */
   async #settled(): Promise<string | null> {
     const prepared = this.#prepared;
-    if (prepared.since === null && prepared.superseded === null) {
-      prepared.settling ??= this.#settle().finally(() => {
-        prepared.settling = null;
-      });
-      await prepared.settling;
-    }
+    // Each call that finds it unsettled reads for itself, over its own
+    // database; calls that race settle it alike, and a rotation they race
+    // to write goes in once (`#rotate`).
+    if (prepared.since === null && prepared.superseded === null) await this.#settle();
     return prepared.superseded;
   }
 
@@ -1310,22 +1307,21 @@ class VaultService implements Vault {
   /**
    * Null when every KEK the vault is given opens what it wrapped; otherwise
    * why not, naming the KEK, never its key. Decided once per process, before
-   * its first key operation or checkpoint. A key service that cannot answer
-   * leaves it undecided: the error is thrown, and the next call asks again.
+   * its first key operation or checkpoint: until then, each call checks for
+   * itself, over its own database, and the first verdict is kept. A key
+   * service that cannot answer leaves it undecided: the error is thrown,
+   * and the next call asks again.
    */
-  #kekMismatch(): Promise<string | null> {
+  async #kekMismatch(): Promise<string | null> {
     const prepared = this.#prepared;
-    if (prepared.kekCheck === null) {
-      const check = this.#checkKeks();
-      prepared.kekCheck = check;
-      check.then(
-        (wrong) => void (prepared.wrongKek = wrong),
-        () => {
-          if (prepared.kekCheck === check) prepared.kekCheck = null;
-        },
-      );
+    if (!prepared.kekChecked) {
+      const wrong = await this.#checkKeks();
+      if (!prepared.kekChecked) {
+        prepared.wrongKek = wrong;
+        prepared.kekChecked = true;
+      }
     }
-    return prepared.kekCheck;
+    return prepared.wrongKek;
   }
 
   /**
@@ -1338,13 +1334,7 @@ class VaultService implements Vault {
     // A vault that may not write cannot record a check either; why it may not is the answer.
     const superseded = await this.#settled();
     if (superseded !== null) return superseded;
-    const checks = new Map<string, WrappedDek>();
-    for (const entry of await store.vaultEntriesOf(this.#db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
-      // A check in the vault's name that the vault did not write proves nothing either way.
-      if (!this.#authentic(entry)) continue;
-      const wrapped = JSON.parse(entry.metadata) as WrappedKey;
-      checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
-    }
+    const checks = await this.#checkValues(this.#db);
     const budget = this.#prepared.options.keyBudgetMs;
     for (const kek of this.#config.keks.all) {
       const operation = { deadline: Date.now() + budget, signal: AbortSignal.timeout(budget) };
@@ -1375,16 +1365,31 @@ class VaultService implements Vault {
       }
       if (samples.length > 0 && proof === null) return mismatch;
       const wrapped = await kek.wrap(Buffer.from(KEY_CHECK_VALUE), KEY_CHECK_CONTEXT, operation);
-      // The key it opened, if any, is in the log, as every key the vault opens is.
-      await this.#db.transaction((tx) =>
-        this.#append(tx, [
+      // The key it opened, if any, is in the log, as every key the vault opens is. Another call that
+      // checked at the same time may have recorded one first: under the log's lock, the first stays.
+      await this.#db.transaction(async (tx) => {
+        await lockLogHead(tx);
+        if ((await this.#checkValues(tx)).has(`${kek.provider}:${kek.keyId}`)) return;
+        await this.#append(tx, [
           { actor: VAULT_ACTOR, action: KEY_CHECK, decision: 'allow', metadata: JSON.stringify({ ...serialisable(wrapped), proof }) },
-        ]),
-      );
+        ]);
+      });
     }
     return null;
   }
 
+  /** Each KEK's recorded check value, by `provider:keyId`. */
+  async #checkValues(db: Queryable): Promise<Map<string, WrappedDek>> {
+    const checks = new Map<string, WrappedDek>();
+    for (const entry of await store.vaultEntriesOf(db, [KEY_CHECK], -1n, VERIFY_BATCH)) {
+      // A check in the vault's name that the vault did not write proves nothing either way.
+      if (!this.#authentic(entry)) continue;
+      const wrapped = JSON.parse(entry.metadata) as WrappedKey;
+      checks.set(`${wrapped.kekProvider}:${wrapped.kekId}`, unwrappable(wrapped));
+    }
+    return checks;
+  }
+
   // --- checkpoints and the log --------------------------------------------------
 
   /** The last checkpoint the vault signed, and the entry that holds it: its newest allowed `audit.checkpoint`. */