@dnsid-ai/sdk 0.27.0 → 0.28.0

package/dist/index.d.cts

@@ -28,7 +28,8 @@ interface RotateManagedOperationalKeyOptions {
     idempotencyKey: string;
     /** Durably persists exact bytes and every subsequent reconciliation state. */
     persistRotation: (rotation: ManagedKeyRotationResult) => Promise<void>;
-    /** Pauses application signing before submission and resumes it only after durable activation. */
+    /** Blocks new application signing and drains in-flight request/directory signing before resolving;
+     * resumes signing only after durable activation. */
     setApplicationSigningPaused: (paused: boolean) => Promise<void>;
 }
 interface ManagedKeyRotationResult {

package/dist/index.d.ts

@@ -28,7 +28,8 @@ interface RotateManagedOperationalKeyOptions {
     idempotencyKey: string;
     /** Durably persists exact bytes and every subsequent reconciliation state. */
     persistRotation: (rotation: ManagedKeyRotationResult) => Promise<void>;
-    /** Pauses application signing before submission and resumes it only after durable activation. */
+    /** Blocks new application signing and drains in-flight request/directory signing before resolving;
+     * resumes signing only after durable activation. */
     setApplicationSigningPaused: (paused: boolean) => Promise<void>;
 }
 interface ManagedKeyRotationResult {

package/dist/node.cjs

@@ -66,6 +66,8 @@ async function readJson(filePath) {
 // src/local-key-provider.ts
 var LocalKeyProvider = class _LocalKeyProvider {
   store;
+  signing = /* @__PURE__ */ new Set();
+  activating = false;
   filePath;
   // ponytail: per-instance queue; use a cross-process lock and reload before writes if shared writers are needed.
   mutations = Promise.resolve();
@@ -144,6 +146,16 @@ var LocalKeyProvider = class _LocalKeyProvider {
     return this.signKey(this.store.active.kid, payload);
   }
   async signKey(kid, payload) {
+    if (this.activating) throw new import_protocol.ArgumentError("key activation is in progress");
+    const operation = this.signWithKey(kid, payload);
+    this.signing.add(operation);
+    try {
+      return await operation;
+    } finally {
+      this.signing.delete(operation);
+    }
+  }
+  async signWithKey(kid, payload) {
     const key = kid === this.store.active.kid ? this.store.active : this.store.pending.find((candidate) => candidate.kid === kid);
     if (!key) throw new import_protocol.ArgumentError(`key is not active or pending for signing: ${kid}`);
     const cryptoKey = await importPrivateKey(key);
@@ -158,13 +170,20 @@ var LocalKeyProvider = class _LocalKeyProvider {
     });
   }
   async activate(kid) {
-    await this.mutate((next) => {
-      const idx = next.pending.findIndex((k) => k.kid === kid);
-      if (idx === -1) throw new import_protocol.ArgumentError(`no pending key with kid "${kid}"`);
-      const [incoming] = next.pending.splice(idx, 1);
-      next.retained.push(next.active);
-      next.active = incoming;
-    });
+    if (this.activating) throw new import_protocol.ArgumentError("key activation is already in progress");
+    this.activating = true;
+    try {
+      await Promise.allSettled(this.signing);
+      await this.mutate((next) => {
+        const idx = next.pending.findIndex((k) => k.kid === kid);
+        if (idx === -1) throw new import_protocol.ArgumentError(`no pending key with kid "${kid}"`);
+        const [incoming] = next.pending.splice(idx, 1);
+        next.retained.push(next.active);
+        next.active = incoming;
+      });
+    } finally {
+      this.activating = false;
+    }
   }
   async supersede(kid) {
     await this.mutate((next) => {

package/dist/node.d.cts

@@ -19,6 +19,8 @@ type LocalKeyAlgorithm = 'EdDSA' | 'ES256';
  */
 declare class LocalKeyProvider implements KeyProvider {
     private store;
+    private readonly signing;
+    private activating;
     private readonly filePath;
     private mutations;
     private constructor();
@@ -33,6 +35,7 @@ declare class LocalKeyProvider implements KeyProvider {
     listKeyIds(): Promise<string[]>;
     sign(payload: Uint8Array): Promise<Uint8Array>;
     signKey(kid: string, payload: Uint8Array): Promise<Uint8Array>;
+    private signWithKey;
     generateKey(): Promise<string>;
     activate(kid: string): Promise<void>;
     supersede(kid: string): Promise<void>;

package/dist/node.d.ts

@@ -19,6 +19,8 @@ type LocalKeyAlgorithm = 'EdDSA' | 'ES256';
  */
 declare class LocalKeyProvider implements KeyProvider {
     private store;
+    private readonly signing;
+    private activating;
     private readonly filePath;
     private mutations;
     private constructor();
@@ -33,6 +35,7 @@ declare class LocalKeyProvider implements KeyProvider {
     listKeyIds(): Promise<string[]>;
     sign(payload: Uint8Array): Promise<Uint8Array>;
     signKey(kid: string, payload: Uint8Array): Promise<Uint8Array>;
+    private signWithKey;
     generateKey(): Promise<string>;
     activate(kid: string): Promise<void>;
     supersede(kid: string): Promise<void>;

package/dist/node.js

@@ -19,6 +19,8 @@ async function readJson(filePath) {
 // src/local-key-provider.ts
 var LocalKeyProvider = class _LocalKeyProvider {
   store;
+  signing = /* @__PURE__ */ new Set();
+  activating = false;
   filePath;
   // ponytail: per-instance queue; use a cross-process lock and reload before writes if shared writers are needed.
   mutations = Promise.resolve();
@@ -97,6 +99,16 @@ var LocalKeyProvider = class _LocalKeyProvider {
     return this.signKey(this.store.active.kid, payload);
   }
   async signKey(kid, payload) {
+    if (this.activating) throw new ArgumentError("key activation is in progress");
+    const operation = this.signWithKey(kid, payload);
+    this.signing.add(operation);
+    try {
+      return await operation;
+    } finally {
+      this.signing.delete(operation);
+    }
+  }
+  async signWithKey(kid, payload) {
     const key = kid === this.store.active.kid ? this.store.active : this.store.pending.find((candidate) => candidate.kid === kid);
     if (!key) throw new ArgumentError(`key is not active or pending for signing: ${kid}`);
     const cryptoKey = await importPrivateKey(key);
@@ -111,13 +123,20 @@ var LocalKeyProvider = class _LocalKeyProvider {
     });
   }
   async activate(kid) {
-    await this.mutate((next) => {
-      const idx = next.pending.findIndex((k) => k.kid === kid);
-      if (idx === -1) throw new ArgumentError(`no pending key with kid "${kid}"`);
-      const [incoming] = next.pending.splice(idx, 1);
-      next.retained.push(next.active);
-      next.active = incoming;
-    });
+    if (this.activating) throw new ArgumentError("key activation is already in progress");
+    this.activating = true;
+    try {
+      await Promise.allSettled(this.signing);
+      await this.mutate((next) => {
+        const idx = next.pending.findIndex((k) => k.kid === kid);
+        if (idx === -1) throw new ArgumentError(`no pending key with kid "${kid}"`);
+        const [incoming] = next.pending.splice(idx, 1);
+        next.retained.push(next.active);
+        next.active = incoming;
+      });
+    } finally {
+      this.activating = false;
+    }
   }
   async supersede(kid) {
     await this.mutate((next) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dnsid-ai/sdk",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "Runtime-neutral DNSid SDK entrypoint with optional Node.js convenience helpers.",
   "type": "module",
   "types": "./dist/index.d.ts",
@@ -39,16 +39,16 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@dnsid-ai/protocol": "^0.27.0",
-    "@dnsid-ai/http-signatures": "^0.27.0",
-    "@dnsid-ai/jose": "^0.27.0",
-    "@dnsid-ai/log-c2sp-tlog": "^0.27.0",
-    "@dnsid-ai/registry": "^0.27.0",
-    "@dnsid-ai/web-bot-auth": "^0.27.0"
+    "@dnsid-ai/protocol": "^0.28.0",
+    "@dnsid-ai/http-signatures": "^0.28.0",
+    "@dnsid-ai/jose": "^0.28.0",
+    "@dnsid-ai/log-c2sp-tlog": "^0.28.0",
+    "@dnsid-ai/registry": "^0.28.0",
+    "@dnsid-ai/web-bot-auth": "^0.28.0"
   },
   "peerDependencies": {
-    "@dnsid-ai/key-aws": "^0.27.0",
-    "@dnsid-ai/transport": "^0.27.0"
+    "@dnsid-ai/key-aws": "^0.28.0",
+    "@dnsid-ai/transport": "^0.28.0"
   },
   "peerDependenciesMeta": {
     "@dnsid-ai/key-aws": {