@coffre/vault 0.1.8 → 0.1.10

package/dist/cloudflare.d.ts

@@ -10,7 +10,9 @@ export type WorkersVaultConfig = VaultConfig & {
 };
 /**
  * What the app's `VAULT` service binding calls. Each call gets a database of
- * its own, since a Worker's connections belong to the call that made them.
+ * its own, one client that its queries take turns on, since a Worker's
+ * connections belong to the call that made them; it is closed once the
+ * call is done.
  */
 export declare class VaultEntrypoint extends WorkerEntrypoint implements Vault {
   #private;

package/dist/cloudflare.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-BV36qTZy.js";
+import { n as prepareVault, t as openVault } from "./vault-DfviNOts.js";
 import { createDatabase } from "@coffre/db";
 import { HyperdrivePool, postgres } from "@coffre/db/hyperdrive";
 import { WorkerEntrypoint } from "cloudflare:workers";
@@ -14,10 +14,21 @@ let configure = null;
 const ready = /* @__PURE__ */ new WeakMap();
 /**
 * What the app's `VAULT` service binding calls. Each call gets a database of
-* its own, since a Worker's connections belong to the call that made them.
+* its own, one client that its queries take turns on, since a Worker's
+* connections belong to the call that made them; it is closed once the
+* call is done.
 */
 var VaultEntrypoint = class extends WorkerEntrypoint {
-	async #vault() {
+	async #call(run) {
+		const { prepared, database } = await this.#ready();
+		const pool = new HyperdrivePool(database.hyperdrive.connectionString);
+		try {
+			return await run(openVault(createDatabase(pool), prepared));
+		} finally {
+			this.ctx.waitUntil(pool.end());
+		}
+	}
+	async #ready() {
 		const env = this.env;
 		let entry = ready.get(env);
 		if (entry === void 0) {
@@ -30,41 +41,40 @@ var VaultEntrypoint = class extends WorkerEntrypoint {
 			};
 			ready.set(env, entry);
 		}
-		const { database, prepared } = entry;
-		return openVault(createDatabase(new HyperdrivePool(database.hyperdrive.connectionString)), prepared);
+		return entry;
 	}
 	async unwrap(input) {
-		return (await this.#vault()).unwrap(input);
+		return this.#call((vault) => vault.unwrap(input));
 	}
 	async wrap(input) {
-		return (await this.#vault()).wrap(input);
+		return this.#call((vault) => vault.wrap(input));
 	}
 	async rewrap(input) {
-		return (await this.#vault()).rewrap(input);
+		return this.#call((vault) => vault.rewrap(input));
 	}
 	async access(principal) {
-		return (await this.#vault()).access(principal);
+		return this.#call((vault) => vault.access(principal));
 	}
 	async setAccess(input) {
-		return (await this.#vault()).setAccess(input);
+		return this.#call((vault) => vault.setAccess(input));
 	}
 	async admit(input) {
-		return (await this.#vault()).admit(input);
+		return this.#call((vault) => vault.admit(input));
 	}
 	async remove(input) {
-		return (await this.#vault()).remove(input);
+		return this.#call((vault) => vault.remove(input));
 	}
 	async checkpoint() {
-		return (await this.#vault()).checkpoint();
+		return this.#call((vault) => vault.checkpoint());
 	}
 	async about() {
-		return (await this.#vault()).about();
+		return this.#call((vault) => vault.about());
 	}
 	async keyChecks() {
-		return (await this.#vault()).keyChecks();
+		return this.#call((vault) => vault.keyChecks());
 	}
 	async verifyLog(input) {
-		return (await this.#vault()).verifyLog(input);
+		return this.#call((vault) => vault.verifyLog(input));
 	}
 	/** No HTTP surface: only the app's service binding reaches the vault. */
 	fetch() {

package/dist/node.js

@@ -1,5 +1,5 @@
 import { a as verifyCheckpoint, i as checkpointMessage, n as KekUnavailableError, o as derivedSigningKey, r as awsKms, s as resolveVaultConfig, t as KekBadClaimError } from "./src-DHuqw-IB.js";
-import { n as prepareVault, t as openVault } from "./vault-BV36qTZy.js";
+import { n as prepareVault, t as openVault } from "./vault-DfviNOts.js";
 import { chmodSync, existsSync, lstatSync, rmSync } from "node:fs";
 import { Agent, createServer, request } from "node:http";
 import { openDatabase } from "@coffre/db/connect";

package/dist/{vault-BV36qTZy.js → vault-DfviNOts.js}

@@ -1441,10 +1441,16 @@ var VaultService = class {
 	* it like anyone's. Logged, and made in a transaction of its own, under
 	* the log's lock: a decision that held the head and then waited for a
 	* member row would take the locks out of order. The row never makes
-	* anyone a root admin; the configuration does.
+	* anyone a root admin; the configuration does. Rows are never deleted, so
+	* one read finds it made already, as on every fresh isolate but the first,
+	* without queueing on the log's lock.
 	*/
 	async #rootRow(principal) {
 		if (this.#prepared.rooted.has(principal) || await this.#settled() !== null) return;
+		if (await member(this.#db, principal) !== void 0) {
+			this.#prepared.rooted.add(principal);
+			return;
+		}
 		await this.#db.transaction(async (tx) => {
 			await lockLogHead(tx);
 			if (await member(tx, principal) !== void 0) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/vault",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "coffre's vault: keys, grants and members, in the database the app uses, as a Cloudflare Worker or on Node.",
   "license": "MIT",
   "repository": {
@@ -36,8 +36,8 @@
   },
   "dependencies": {
     "drizzle-orm": "0.45.2",
-    "@coffre/core": "0.1.8",
-    "@coffre/db": "0.1.8"
+    "@coffre/core": "0.1.10",
+    "@coffre/db": "0.1.10"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/cloudflare.ts

@@ -51,10 +51,22 @@ const ready = new WeakMap<object, { database: PostgresDatabase; prepared: Prepar
 
 /**
  * What the app's `VAULT` service binding calls. Each call gets a database of
- * its own, since a Worker's connections belong to the call that made them.
+ * its own, one client that its queries take turns on, since a Worker's
+ * connections belong to the call that made them; it is closed once the
+ * call is done.
  */
 export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
-  async #vault(): Promise<Vault> {
+  async #call<T>(run: (vault: Vault) => Promise<T>): Promise<T> {
+    const { prepared, database } = await this.#ready();
+    const pool = new HyperdrivePool(database.hyperdrive.connectionString);
+    try {
+      return await run(openVault(createDatabase(pool), prepared));
+    } finally {
+      this.ctx.waitUntil(pool.end());
+    }
+  }
+
+  async #ready(): Promise<{ database: PostgresDatabase; prepared: PreparedVault }> {
     const env = this.env as object;
     let entry = ready.get(env);
     if (entry === undefined) {
@@ -65,21 +77,20 @@ export class VaultEntrypoint extends WorkerEntrypoint implements Vault {
       entry = ready.get(env) ?? { database: config.database, prepared };
       ready.set(env, entry);
     }
-    const { database, prepared } = entry;
-    return openVault(createDatabase(new HyperdrivePool(database.hyperdrive.connectionString)), prepared);
+    return entry;
   }
 
-  async unwrap(input: UnwrapInput) { return (await this.#vault()).unwrap(input); }
-  async wrap(input: WrapInput) { return (await this.#vault()).wrap(input); }
-  async rewrap(input: RewrapInput) { return (await this.#vault()).rewrap(input); }
-  async access(principal: string) { return (await this.#vault()).access(principal); }
-  async setAccess(input: SetAccessInput) { return (await this.#vault()).setAccess(input); }
-  async admit(input: AdmitInput) { return (await this.#vault()).admit(input); }
-  async remove(input: RemoveInput) { return (await this.#vault()).remove(input); }
-  async checkpoint() { return (await this.#vault()).checkpoint(); }
-  async about() { return (await this.#vault()).about(); }
-  async keyChecks() { return (await this.#vault()).keyChecks(); }
-  async verifyLog(input: VerifyLogInput) { return (await this.#vault()).verifyLog(input); }
+  async unwrap(input: UnwrapInput) { return this.#call((vault) => vault.unwrap(input)); }
+  async wrap(input: WrapInput) { return this.#call((vault) => vault.wrap(input)); }
+  async rewrap(input: RewrapInput) { return this.#call((vault) => vault.rewrap(input)); }
+  async access(principal: string) { return this.#call((vault) => vault.access(principal)); }
+  async setAccess(input: SetAccessInput) { return this.#call((vault) => vault.setAccess(input)); }
+  async admit(input: AdmitInput) { return this.#call((vault) => vault.admit(input)); }
+  async remove(input: RemoveInput) { return this.#call((vault) => vault.remove(input)); }
+  async checkpoint() { return this.#call((vault) => vault.checkpoint()); }
+  async about() { return this.#call((vault) => vault.about()); }
+  async keyChecks() { return this.#call((vault) => vault.keyChecks()); }
+  async verifyLog(input: VerifyLogInput) { return this.#call((vault) => vault.verifyLog(input)); }
 
   /** No HTTP surface: only the app's service binding reaches the vault. */
   fetch() {

package/src/vault.ts

@@ -884,10 +884,16 @@ class VaultService implements Vault {
    * it like anyone's. Logged, and made in a transaction of its own, under
    * the log's lock: a decision that held the head and then waited for a
    * member row would take the locks out of order. The row never makes
-   * anyone a root admin; the configuration does.
+   * anyone a root admin; the configuration does. Rows are never deleted, so
+   * one read finds it made already, as on every fresh isolate but the first,
+   * without queueing on the log's lock.
    */
   async #rootRow(principal: string): Promise<void> {
     if (this.#prepared.rooted.has(principal) || (await this.#settled()) !== null) return;
+    if ((await store.member(this.#db, principal)) !== undefined) {
+      this.#prepared.rooted.add(principal);
+      return;
+    }
     await this.#db.transaction(async (tx) => {
       await lockLogHead(tx);
       if ((await store.member(tx, principal)) !== undefined) return;