@kokuin/records 0.1.0 → 0.2.0

package/lib/apply.d.ts

@@ -59,6 +59,12 @@ export type RecordAuthorizeContext = RecordReceiveContext & {
     record: SignedRecord;
     stored: SignedRecord | null;
     store: RecordStoreAdapter;
+    /**
+     * Another record's decision as the chunk has left it, records stored earlier in the chunk
+     * included. Apply serves it from the chunk's batched reads. Absent outside apply: read
+     * `store` instead.
+     */
+    decision?: (key: RecordKey) => Promise<RecordDecision | null>;
     resolveController: (did: string) => Promise<string | null>;
     verifyCapability: (tokens: ReadonlyArray<string>, owner: string, issuer: string) => Promise<boolean>;
 };
@@ -87,6 +93,9 @@ export type RecordDependency = RecordKey & {
  *   the payload is not checked against its digest until after the merge decision.
  * - `onEqual` must answer the same for (a, b) as for (b, a).
  * - `afterApply` runs inside the chunk's transaction, once the record is stored.
+ *
+ * Apply keeps every decision it reads for the rest of the chunk and updates it with its own
+ * writes. Hooks may write other state through the store, never a record decision.
  */
 export type RecordTypeDefinition = {
     type: string;
@@ -150,6 +159,7 @@ export type ApplyRecordChunkParams = RecordReceiveContext & {
     maxDriftMS: number;
     receiveClock: (stamp: HLCTimestamp) => void;
     methods?: MethodRegistry;
+    /** Called for several DIDs at once before the chunk locks; must accept concurrent calls. */
     resolveController: (did: string) => Promise<string | null>;
     verifyCapability: (tokens: ReadonlyArray<string>, owner: string, issuer: string) => Promise<boolean>;
 };
@@ -167,6 +177,8 @@ export declare class RecordContentRefusalError extends Error {
 }
 /** Whether the store lacks a dependency, or holds an op for it that does not satisfy it. */
 export declare function isDependencyUnsatisfied(dependency: RecordDependency, tx: RecordStoreAdapter, opKind: string, methods?: MethodRegistry): Promise<boolean>;
+/** As {@link isDependencyUnsatisfied}, against a decision already read. */
+export declare function isDependencyUnsatisfiedBy(dependency: RecordDependency, stored: RecordDecision | null, opKind: string, methods?: MethodRegistry): Promise<boolean>;
 /**
  * Apply a chunk of records received from a peer, in one transaction.
  *

package/lib/apply.js

@@ -1,5 +1,6 @@
 import { parseBoundedHLC } from './clock.js';
-import { verifySignedRecord } from './op.js';
+import { settleLimited } from './limit.js';
+import { createRecordVerifier, verifySignedRecord } from './op.js';
 import { compareRecordOps } from './policy.js';
 import { recordClaimDigest, recordPayloadMatches, recordSignerKey } from './record.js';
 import { getRecordDecisions, recordKeyText } from './store.js';
@@ -47,23 +48,72 @@ import { getRecordDecisions, recordKeyText } from './store.js';
     }
     return ranks;
 }
-async function decisionSnapshot(key, ctx) {
-    const id = recordKeyText(key);
-    const cached = ctx.decisions.get(id);
-    if (cached !== undefined) return cached;
-    const decision = await ctx.tx.get(key);
+async function snapshotOf(decision, ctx) {
     const verified = await Promise.all((decision?.copies ?? []).map(async (copy)=>({
             copy,
-            op: await verifySignedRecord(copy, ctx.opKind, ctx.methods)
+            op: await ctx.verify(copy)
         })));
-    const snapshot = {
+    return {
         decision,
         verified,
         checkedPrior: false
     };
+}
+async function decisionSnapshot(key, ctx) {
+    const id = recordKeyText(key);
+    const cached = ctx.decisions.get(id);
+    if (cached !== undefined) return cached;
+    let decision;
+    try {
+        decision = await ctx.tx.get(key);
+    } catch (error) {
+        // After a failed batch, its error is the store's first failure in this transaction. On a
+        // store where a failed statement aborts the transaction, this read only reports that.
+        throw ctx.prefetchError ?? error;
+    }
+    const snapshot = await snapshotOf(decision, ctx);
     ctx.decisions.set(id, snapshot);
     return snapshot;
 }
+/**
+ * Loads the decisions of `keys` the chunk has not read yet, in one batched read. `known` holds
+ * decisions already read in this transaction. A failed batch seeds nothing: each key is then
+ * read on first use, and a failing read there reports the batch's error.
+ */ async function prefetchSnapshots(keys, ctx, known, knownKeys) {
+    const missing = new Map();
+    for (const key of keys){
+        const id = recordKeyText(key);
+        if (!ctx.decisions.has(id) && !knownKeys.has(id)) missing.set(id, key);
+    }
+    let loaded = new Map();
+    try {
+        loaded = await getRecordDecisions(ctx.tx, [
+            ...missing.values()
+        ]);
+    } catch (error) {
+        // Kept, not dropped: a later single read that fails reports this original error.
+        ctx.prefetchError = error;
+        missing.clear();
+    }
+    const ids = [
+        ...new Set([
+            ...knownKeys,
+            ...missing.keys()
+        ])
+    ].filter((id)=>!ctx.decisions.has(id));
+    const snapshots = await Promise.all(ids.map((id)=>snapshotOf((knownKeys.has(id) ? known : loaded).get(id) ?? null, ctx)));
+    for (const [index, id] of ids.entries()){
+        const snapshot = snapshots[index];
+        if (snapshot !== undefined) ctx.decisions.set(id, snapshot);
+    }
+}
+/** The decision a store read would return now: copies follow pruning as well as storing. */ function currentDecision(snapshot) {
+    if (snapshot.decision === null) return null;
+    return {
+        ...snapshot.decision,
+        copies: snapshot.verified.map(({ copy })=>copy)
+    };
+}
 function rememberCopy(snapshot, record, op) {
     const decision = snapshot.decision;
     const signer = recordSignerKey(op.issuer, record.opJWT);
@@ -92,17 +142,22 @@ function rememberCopy(snapshot, record, op) {
     if (decision === null) snapshot.checkedPrior = true;
 }
 /** Whether the store lacks a dependency, or holds an op for it that does not satisfy it. */ export async function isDependencyUnsatisfied(dependency, tx, opKind, methods) {
-    const stored = await tx.get(dependency);
+    return await isDependencyUnsatisfiedBy(dependency, await tx.get(dependency), opKind, methods);
+}
+/** As {@link isDependencyUnsatisfied}, against a decision already read. */ export async function isDependencyUnsatisfiedBy(dependency, stored, opKind, methods) {
     if (stored === null || stored.key.owner !== dependency.owner) return true;
-    for (const copy of stored.copies){
-        const op = await verifySignedRecord(copy, opKind, methods);
-        if (op?.claim.type === dependency.type && op.claim.owner === dependency.owner && op.claim.id === dependency.id && (dependency.satisfiedBy?.(op) ?? true)) return false;
-    }
-    return true;
+    // Verification never throws, so every copy is checked together, then matched in order.
+    const ops = await Promise.all(stored.copies.map((copy)=>verifySignedRecord(copy, opKind, methods)));
+    return !ops.some((op)=>op?.claim.type === dependency.type && op.claim.owner === dependency.owner && op.claim.id === dependency.id && (dependency.satisfiedBy?.(op) ?? true));
 }
-async function isParked(candidate, tx, opKind, methods) {
-    for (const dependency of candidate.definition.dependencies(candidate.record, candidate.op)){
-        if (await isDependencyUnsatisfied(dependency, tx, opKind, methods)) {
+async function isParked(candidate, ctx) {
+    const dependencies = ctx.dependencies.get(candidate) ?? candidate.definition.dependencies(candidate.record, candidate.op);
+    for (const dependency of dependencies){
+        // The chunk's view, as `isDependencyUnsatisfied` would read it from the store now.
+        const snapshot = await decisionSnapshot(dependency, ctx);
+        const stored = currentDecision(snapshot);
+        const satisfied = stored !== null && stored.key.owner === dependency.owner && snapshot.verified.some(({ op })=>op?.claim.type === dependency.type && op.claim.owner === dependency.owner && op.claim.id === dependency.id && (dependency.satisfiedBy?.(op) ?? true));
+        if (!satisfied) {
             return true;
         }
     }
@@ -123,7 +178,7 @@ async function isParked(candidate, tx, opKind, methods) {
             status: 'noop'
         };
     }
-    if (await isParked(candidate, tx, ctx.opKind, ctx.methods)) {
+    if (await isParked(candidate, ctx)) {
         return {
             status: 'parked'
         };
@@ -141,10 +196,14 @@ async function isParked(candidate, tx, opKind, methods) {
             reason: 'owner'
         };
     }
+    const decision = async (dependency)=>{
+        return currentDecision(await decisionSnapshot(dependency, ctx));
+    };
     const authorized = await definition.authorize(op, {
         record,
         stored,
         store: tx,
+        decision,
         transportContext: ctx.transportContext,
         resolveController: ctx.resolveController,
         verifyCapability: ctx.verifyCapability
@@ -175,6 +234,7 @@ async function isParked(candidate, tx, opKind, methods) {
                 record: copy,
                 stored: record,
                 store: tx,
+                decision,
                 transportContext: ctx.transportContext,
                 resolveController: ctx.resolveController,
                 verifyCapability: ctx.verifyCapability
@@ -189,20 +249,20 @@ async function isParked(candidate, tx, opKind, methods) {
             status: 'applied'
         };
     }
-    const decision = compareRecordOps(op, storedOp, definition.policy, definition.onEqual);
-    if (decision.status === 'reject') {
+    const merge = compareRecordOps(op, storedOp, definition.policy, definition.onEqual);
+    if (merge.status === 'reject') {
         return {
             status: 'rejected',
-            reason: decision.reason ?? 'policy'
+            reason: merge.reason ?? 'policy'
         };
     }
-    const conflict = decision.conflict === undefined ? undefined : {
+    const conflict = merge.conflict === undefined ? undefined : {
         record,
-        ...decision.conflict,
-        forked: decision.status === 'fork'
+        ...merge.conflict,
+        forked: merge.status === 'fork'
     };
     // A fork still needs one op in the store, and the same one on every peer.
-    const wins = decision.status === 'apply' || decision.status === 'fork' && storedOp !== null && recordClaimDigest(op.claim) > recordClaimDigest(storedOp.claim);
+    const wins = merge.status === 'apply' || merge.status === 'fork' && storedOp !== null && recordClaimDigest(op.claim) > recordClaimDigest(storedOp.claim);
     if (!wins) {
         return {
             status: 'noop',
@@ -267,12 +327,24 @@ class RefusedCandidate extends Error {
  */ export async function applyRecordChunk(params) {
     const { records, store, types, nowMS, maxDriftMS, receiveClock } = params;
     const ranks = rankTypes(types);
+    const verify = createRecordVerifier(params.opKind, params.methods);
     const rejected = [];
     const candidates = [];
     // Refused records await one batched read of the store, which may show them as replays.
     const refusedReplays = [];
-    for (const record of records){
+    // The clock and type checks run first for every record. Signatures of the records that pass
+    // them are verified together, since verification never throws; the rest runs in record order.
+    const screened = records.map((record)=>{
         const stamp = parseBoundedHLC(record.hlc, nowMS, maxDriftMS);
+        const definition = stamp === null ? undefined : types.get(record.type);
+        return {
+            record,
+            stamp,
+            definition,
+            verifying: definition === undefined ? null : verify(record)
+        };
+    });
+    for (const { record, stamp, definition, verifying } of screened){
         if (stamp === null) {
             rejected.push({
                 record,
@@ -280,15 +352,14 @@ class RefusedCandidate extends Error {
             });
             continue;
         }
-        const definition = types.get(record.type);
-        if (definition === undefined) {
+        if (definition === undefined || verifying === null) {
             rejected.push({
                 record,
                 reason: 'unknown-type'
             });
             continue;
         }
-        const op = await verifySignedRecord(record, params.opKind, params.methods);
+        const op = await verifying;
         if (op === null) {
             rejected.push({
                 record,
@@ -338,25 +409,43 @@ class RefusedCandidate extends Error {
         const allKeys = new Map();
         const controllers = new Map();
         const prefetched = await getRecordDecisions(store, active.map((candidate)=>candidate.record));
-        const verifiedStored = new Set();
+        const verifiedStored = new Map();
         const prefetchController = async (did)=>{
-            if (!controllers.has(did)) controllers.set(did, await params.resolveController(did));
+            let resolving = controllers.get(did);
+            if (resolving === undefined) {
+                resolving = params.resolveController(did);
+                controllers.set(did, resolving);
+            }
+            await resolving;
         };
-        for (const candidate of active){
+        const verifyStored = async (id)=>{
+            await Promise.all((prefetched.get(id)?.copies ?? []).map(async (copy)=>{
+                const op = await verify(copy);
+                if (op !== null && op.issuer !== op.claim.owner) await prefetchController(op.issuer);
+            }));
+        };
+        // Each candidate's controller and stored-copy reads run together, up to `CONCURRENCY_LIMIT`
+        // at once, and shared reads are made once. The lock-key hooks then run one at a time, in
+        // candidate order, as before. Failures are thrown in candidate order: a candidate's reads,
+        // then its hook.
+        const reads = await settleLimited(active, async (candidate)=>{
             if (candidate.op.issuer !== candidate.op.claim.owner) {
                 await prefetchController(candidate.op.issuer);
             }
             const id = recordKeyText(candidate.record);
-            if (!verifiedStored.has(id)) {
-                verifiedStored.add(id);
-                for (const copy of prefetched.get(id)?.copies ?? []){
-                    const op = await verifySignedRecord(copy, params.opKind, params.methods);
-                    if (op !== null && op.issuer !== op.claim.owner) await prefetchController(op.issuer);
-                }
+            let storedChecked = verifiedStored.get(id);
+            if (storedChecked === undefined) {
+                storedChecked = verifyStored(id);
+                verifiedStored.set(id, storedChecked);
             }
-            const stored = prefetched.get(id) ?? null;
+            await storedChecked;
+        });
+        for (const [index, candidate] of active.entries()){
+            const read = reads[index];
+            if (read?.status === 'rejected') throw read.reason;
             const hook = candidate.definition.lockKeys;
             if (hook === undefined) continue;
+            const stored = prefetched.get(recordKeyText(candidate.record)) ?? null;
             const keys = [
                 ...new Map((await hook(candidate.record, stored)).map((key)=>[
                         JSON.stringify([
@@ -406,11 +495,27 @@ class RefusedCandidate extends Error {
                 tx,
                 opKind: params.opKind,
                 transportContext: params.transportContext,
-                resolveController: async (did)=>controllers.has(did) ? controllers.get(did) ?? null : await params.resolveController(did),
+                resolveController: async (did)=>await (controllers.get(did) ?? params.resolveController(did)),
                 verifyCapability: params.verifyCapability,
                 methods: params.methods,
-                decisions: new Map()
+                decisions: new Map(),
+                dependencies: new Map(active.map((candidate)=>[
+                        candidate,
+                        candidate.definition.dependencies(candidate.record, candidate.op)
+                    ])),
+                // A fresh scope per transaction: a resolved issuer's key removed before the locks must
+                // not pass on a verification made before them. Self-certifying issuers still hit the
+                // process-wide memo.
+                verify: createRecordVerifier(params.opKind, params.methods)
             };
+            // One batched read for every decision the chunk will consult: each record's own and its
+            // dependencies'. Writes made by this chunk update these snapshots in place.
+            await prefetchSnapshots(active.flatMap((candidate)=>[
+                    candidate.record,
+                    ...ctx.dependencies.get(candidate) ?? []
+                ]), ctx, checked, new Set([
+                ...expected.keys()
+            ].map((candidate)=>recordKeyText(candidate.record))));
             const applied = [];
             const conflicts = [];
             const refused = [];

package/lib/index.d.ts

@@ -7,7 +7,7 @@
 export { type ApplyRecordChunkParams, type ApplyResult, applyRecordChunk, type RecordAuthorizeContext, type RecordConflict, RecordContentRefusalError, type RecordDependency, type RecordReceiveContext, type RecordRequester, RecordSourceChangedError, type RecordTypeDefinition, RecordTypeGraphError, type VisibilityContext, } from './apply.js';
 export { compareRecordDecisionHLC, parseBoundedHLC, parseCanonicalHLC } from './clock.js';
 export { type RecordDecision, recordDecisionDigest, recordDecisionFromVerifiedCopies, type VerifiedRecordCopy, } from './decision.js';
-export { RecordOpSigningError, signRecordOp, type VerifiedRecordOp, verifyRecordOp, verifySignedRecord, } from './op.js';
+export { createRecordVerifier, RECORD_OP_MEMO_SIZE, RecordOpSigningError, signRecordOp, type VerifiedRecordOp, verifyRecordOp, verifySignedRecord, } from './op.js';
 export { compareRecordOps, type EqualVersionDecision, type MergeDecision, type MergePolicy, } from './policy.js';
 export { assertListedLeaf, fingerprintRange, RANGE_LEAF_THRESHOLD, RANGE_SPLIT, type RangeBounds, type RangeLeaf, type RangeLeafList, type RangeSummary, RecordRangeError, rangeContains, rangeLeaf, rangePosition, splitRange, summarizeRange, } from './range.js';
 export { advanceRecordPull, beginRecordPull, nextRequesterSteps, type RangeAnswer, type RecordPullState, type RequesterStep, } from './reconcile.js';

package/lib/index.js

@@ -6,7 +6,7 @@
  */ export { applyRecordChunk, RecordContentRefusalError, RecordSourceChangedError, RecordTypeGraphError } from './apply.js';
 export { compareRecordDecisionHLC, parseBoundedHLC, parseCanonicalHLC } from './clock.js';
 export { recordDecisionDigest, recordDecisionFromVerifiedCopies } from './decision.js';
-export { RecordOpSigningError, signRecordOp, verifyRecordOp, verifySignedRecord } from './op.js';
+export { createRecordVerifier, RECORD_OP_MEMO_SIZE, RecordOpSigningError, signRecordOp, verifyRecordOp, verifySignedRecord } from './op.js';
 export { compareRecordOps } from './policy.js';
 export { assertListedLeaf, fingerprintRange, RANGE_LEAF_THRESHOLD, RANGE_SPLIT, RecordRangeError, rangeContains, rangeLeaf, rangePosition, splitRange, summarizeRange } from './range.js';
 export { advanceRecordPull, beginRecordPull, nextRequesterSteps } from './reconcile.js';

package/lib/limit.d.ts

@@ -0,0 +1,7 @@
+/** Most tasks a records call runs at once, so a large page cannot fill a connection pool. */
+export declare const CONCURRENCY_LIMIT = 16;
+/**
+ * Runs `task` over `items`, at most `limit` at a time, starting them in item order. Every task
+ * settles; results keep item order.
+ */
+export declare function settleLimited<Item, Result>(items: ReadonlyArray<Item>, task: (item: Item, index: number) => Promise<Result>, limit?: number): Promise<Array<PromiseSettledResult<Result>>>;

package/lib/limit.js

@@ -0,0 +1,29 @@
+/** Most tasks a records call runs at once, so a large page cannot fill a connection pool. */ export const CONCURRENCY_LIMIT = 16;
+/**
+ * Runs `task` over `items`, at most `limit` at a time, starting them in item order. Every task
+ * settles; results keep item order.
+ */ export async function settleLimited(items, task, limit = CONCURRENCY_LIMIT) {
+    const results = new Array(items.length);
+    let next = 0;
+    const worker = async ()=>{
+        while(next < items.length){
+            const index = next;
+            next += 1;
+            try {
+                results[index] = {
+                    status: 'fulfilled',
+                    value: await task(items[index], index)
+                };
+            } catch (reason) {
+                results[index] = {
+                    status: 'rejected',
+                    reason
+                };
+            }
+        }
+    };
+    await Promise.all(Array.from({
+        length: Math.min(limit, items.length)
+    }, worker));
+    return results;
+}

package/lib/op.d.ts

@@ -6,6 +6,10 @@ export type VerifiedRecordOp = {
     claim: RecordClaim;
     opHash: string;
 };
+/** How many verified record ops {@link verifyRecordOp} keeps, least recently used evicted first. */
+export declare const RECORD_OP_MEMO_SIZE = 1024;
+/** Forget every remembered op. Test-only; not exported from the package. */
+export declare function clearRecordOpMemo(): void;
 /** Thrown when an identity signs an envelope that record-op verification cannot accept. */
 export declare class RecordOpSigningError extends Error {
     constructor(message: string);
@@ -14,6 +18,11 @@ export declare class RecordOpSigningError extends Error {
  * Sign a record claim under the caller's required replay domain `opKind`. The token carries the canonical claim bytes rather than the claim
  * as JSON members, so what a verifier reads back is byte-for-byte what was signed.
  *
+ * Calls for one `SigningIdentity` object reach it one at a time, in the order they were made.
+ * The queue is per object: two objects for the same key are not serialised against each other.
+ * `signToken` must settle, since a call that never settles holds every later call for that
+ * object.
+ *
  * @throws RecordClaimError when the claim is malformed.
  * @throws RecordOpSigningError when the identity produces an unverifiable record-op envelope.
  */
@@ -39,3 +48,9 @@ export declare function verifyRecordOp(opJWT: string, opKind: string, methods?:
  * it after the merge decision.
  */
 export declare function verifySignedRecord(record: SignedRecord, opKind: string, methods?: MethodRegistry): Promise<VerifiedRecordOp | null>;
+/**
+ * {@link verifySignedRecord} that verifies each distinct op token once for the verifier's
+ * lifetime, whatever its issuer's DID method. Scope one to a single operation, such as one apply
+ * chunk: a resolved issuer's keys may rotate between operations.
+ */
+export declare function createRecordVerifier(opKind: string, methods?: MethodRegistry): (record: SignedRecord) => Promise<VerifiedRecordOp | null>;

package/lib/op.js

@@ -1,7 +1,31 @@
-import { isVerifiedToken, normalizeDID, stringifyToken, verifyToken } from '@kokuin/token';
+import { findMethodResolver, isVerifiedToken, normalizeDID, stringifyToken, verifyToken } from '@kokuin/token';
 import { blake3 } from '@noble/hashes/blake3.js';
 import { fromB64U, fromUTF, toB64U, toUTF } from '@sozai/codec';
 import { canonicalRecordClaim, isRecordClaim } from './record.js';
+/** How many verified record ops {@link verifyRecordOp} keeps, least recently used evicted first. */ export const RECORD_OP_MEMO_SIZE = 1024;
+// Module-level, so every store, adapter and chunk shares it. Only self-certifying issuers are kept:
+// an op token has no time claims, so verifying it is a pure function of its bytes and the op kind.
+const opMemo = new Map();
+/**
+ * Whether `iss` resolves from the token alone: `did:key` carries its key and a `did:peer:4`
+ * document is fixed by its hash. A registry entry for the method takes over resolution, and its
+ * keys may rotate, so such an issuer is never remembered across calls.
+ */ function selfCertifying(iss, methods) {
+    if (!iss.startsWith('did:key:') && !iss.startsWith('did:peer:4')) return false;
+    return methods == null || findMethodResolver(methods, iss) === undefined;
+}
+/** A caller may change what it gets back. Never hand out the remembered object itself. */ function copyOp(op) {
+    // A claim is decoded from canonical JSON, so a JSON round trip copies it exactly.
+    const claim = JSON.parse(JSON.stringify(op.claim));
+    return {
+        issuer: op.issuer,
+        claim,
+        opHash: op.opHash
+    };
+}
+/** Forget every remembered op. Test-only; not exported from the package. */ export function clearRecordOpMemo() {
+    opMemo.clear();
+}
 /** Thrown when an identity signs an envelope that record-op verification cannot accept. */ export class RecordOpSigningError extends Error {
     constructor(message){
         super(message);
@@ -51,20 +75,35 @@ function hasRecordOpEnvelope(payload, header, opKind) {
     const kid = header.kid;
     return !(header.alg !== 'EdDSA' || header.typ !== 'JWT' || (kid === undefined ? headerKeys.length !== 2 || headerKeys[0] !== 'alg' || headerKeys[1] !== 'typ' : typeof kid !== 'string' || headerKeys.length !== 3 || headerKeys[0] !== 'alg' || headerKeys[1] !== 'kid' || headerKeys[2] !== 'typ') || iss.startsWith('did:key:') && kid !== undefined || (iss.startsWith('did:peer:4') || iss.startsWith('did:kokuin:')) && kid === undefined || iss.startsWith('did:peer:4') && normalizeDID(iss) === iss);
 }
+// The last signing call queued for each identity. A hardware or prompting signer must never
+// see overlapping calls, so each call waits for the one before it, settled either way.
+const signingQueues = new WeakMap();
 /**
  * Sign a record claim under the caller's required replay domain `opKind`. The token carries the canonical claim bytes rather than the claim
  * as JSON members, so what a verifier reads back is byte-for-byte what was signed.
  *
+ * Calls for one `SigningIdentity` object reach it one at a time, in the order they were made.
+ * The queue is per object: two objects for the same key are not serialised against each other.
+ * `signToken` must settle, since a call that never settles holds every later call for that
+ * object.
+ *
  * @throws RecordClaimError when the claim is malformed.
  * @throws RecordOpSigningError when the identity produces an unverifiable record-op envelope.
  */ export async function signRecordOp(identity, claim, opKind) {
     const bytes = canonicalRecordClaim(claim);
-    const signed = await identity.signToken({
-        kind: opKind,
-        claim: toB64U(bytes)
-    }, {
-        embedLongForm: true
+    const previous = signingQueues.get(identity) ?? Promise.resolve();
+    // Queued entries never reject, so a failed call does not stop the next one.
+    const signing = previous.then(()=>{
+        return identity.signToken({
+            kind: opKind,
+            claim: toB64U(bytes)
+        }, {
+            embedLongForm: true
+        });
     });
+    // The queue only orders calls. Each caller sees its own failure.
+    signingQueues.set(identity, signing.catch(()=>{}));
+    const signed = await signing;
     const opJWT = stringifyToken(signed);
     if (!isCanonicalCompactToken(opJWT) || !hasRecordOpEnvelope(signed.payload, signed.header, opKind) || typeof signed.payload.iss !== 'string' || normalizeDID(signed.payload.iss) !== normalizeDID(identity.id) || signed.payload.claim !== toB64U(bytes)) {
         throw new RecordOpSigningError('Identity produced a record op envelope that cannot be verified');
@@ -101,6 +140,19 @@ function decodeClaim(encoded) {
     if (!isCanonicalCompactToken(opJWT)) {
         return null;
     }
+    const opHash = recordOpHash(opJWT);
+    // Keyed on the token's digest: the same bytes under the same kind verify the same way.
+    const memoKey = JSON.stringify([
+        opKind,
+        opHash
+    ]);
+    const known = opMemo.get(memoKey);
+    if (known !== undefined && selfCertifying(known.iss, methods)) {
+        // Refreshed, so the least recently used entry is the one evicted.
+        opMemo.delete(memoKey);
+        opMemo.set(memoKey, known);
+        return copyOp(known.op);
+    }
     let verified;
     try {
         verified = await verifyToken(opJWT, {
@@ -119,11 +171,23 @@ function decodeClaim(encoded) {
     if (decoded === null) {
         return null;
     }
-    return {
+    const op = {
         issuer: normalizeDID(iss),
         claim: decoded,
-        opHash: recordOpHash(opJWT)
+        opHash
     };
+    // Only successes are kept. A refusal is recomputed on every call.
+    if (selfCertifying(iss, methods)) {
+        opMemo.set(memoKey, {
+            iss,
+            op: copyOp(op)
+        });
+        if (opMemo.size > RECORD_OP_MEMO_SIZE) {
+            const oldest = opMemo.keys().next().value;
+            if (oldest !== undefined) opMemo.delete(oldest);
+        }
+    }
+    return op;
 }
 /**
  * Verify a stored or received record's op and check that the record's indexed fields and
@@ -133,7 +197,9 @@ function decodeClaim(encoded) {
  * The payload is not checked here: `recordPayloadMatches` does that, so a caller can order
  * it after the merge decision.
  */ export async function verifySignedRecord(record, opKind, methods) {
-    const verified = await verifyRecordOp(record.opJWT, opKind, methods);
+    return bindRecord(record, await verifyRecordOp(record.opJWT, opKind, methods));
+}
+function bindRecord(record, verified) {
     if (verified === null) {
         return null;
     }
@@ -143,3 +209,19 @@ function decodeClaim(encoded) {
     }
     return verified;
 }
+/**
+ * {@link verifySignedRecord} that verifies each distinct op token once for the verifier's
+ * lifetime, whatever its issuer's DID method. Scope one to a single operation, such as one apply
+ * chunk: a resolved issuer's keys may rotate between operations.
+ */ export function createRecordVerifier(opKind, methods) {
+    const ops = new Map();
+    return async (record)=>{
+        let pending = ops.get(record.opJWT);
+        if (pending === undefined) {
+            pending = verifyRecordOp(record.opJWT, opKind, methods);
+            ops.set(record.opJWT, pending);
+        }
+        const op = await pending;
+        return bindRecord(record, op === null ? null : copyOp(op));
+    };
+}

package/lib/store.d.ts

@@ -27,6 +27,10 @@ export type RecordStoreAdapter = {
     /** True when already bound to a caller-owned transaction; required for inline transaction adapters. */
     isTransaction?: boolean;
     transaction<R>(fn: (tx: RecordStoreAdapter) => Promise<R>): Promise<R>;
+    /**
+     * Must accept concurrent calls on one adapter, including one bound to a transaction:
+     * `getRecordDecisions` and apply issue several at once when `getMany` is absent.
+     */
     get(key: RecordKey): Promise<RecordDecision | null>;
     getMany?(keys: ReadonlyArray<RecordKey>): Promise<RecordDecisionMap>;
     list(types: ReadonlyArray<string>): Promise<Array<RecordDecision>>;
@@ -40,5 +44,10 @@ export type RecordStoreAdapter = {
 };
 /** The address of a record key in a {@link RecordDecisionMap}. */
 export declare function recordKeyText(key: RecordKey): string;
-/** The stored decisions of `keys`, through `getMany` when the store has it, else one `get` each. */
+/**
+ * The stored decisions of `keys`, through `getMany` when the store has it, else concurrent `get`s,
+ * at most `CONCURRENCY_LIMIT` at once.
+ * The fallback waits for every `get`, so none is left running in the caller's transaction, then
+ * throws the first failure in key order.
+ */
 export declare function getRecordDecisions(store: RecordStoreAdapter, keys: ReadonlyArray<RecordKey>): Promise<RecordDecisionMap>;

package/lib/store.js

@@ -1,3 +1,4 @@
+import { settleLimited } from './limit.js';
 /** The address of a record key in a {@link RecordDecisionMap}. */ export function recordKeyText(key) {
     return JSON.stringify([
         key.type,
@@ -5,7 +6,12 @@
         key.id
     ]);
 }
-/** The stored decisions of `keys`, through `getMany` when the store has it, else one `get` each. */ export async function getRecordDecisions(store, keys) {
+/**
+ * The stored decisions of `keys`, through `getMany` when the store has it, else concurrent `get`s,
+ * at most `CONCURRENCY_LIMIT` at once.
+ * The fallback waits for every `get`, so none is left running in the caller's transaction, then
+ * throws the first failure in key order.
+ */ export async function getRecordDecisions(store, keys) {
     const unique = new Map();
     for (const key of keys){
         const text = recordKeyText(key);
@@ -15,10 +21,16 @@
     if (store.getMany !== undefined) return await store.getMany([
         ...unique.values()
     ]);
+    const entries = [
+        ...unique
+    ];
+    const found = await settleLimited(entries, ([, key])=>store.get(key));
     const decisions = new Map();
-    for (const [text, key] of unique){
-        const decision = await store.get(key);
-        if (decision !== null) decisions.set(text, decision);
+    for (const [index, [text]] of entries.entries()){
+        const result = found[index];
+        if (result === undefined) continue;
+        if (result.status === 'rejected') throw result.reason;
+        if (result.value != null) decisions.set(text, result.value);
     }
     return decisions;
 }

package/lib/visibility.d.ts

@@ -55,5 +55,8 @@ export declare function visibilityRules(rules: ReadonlyArray<VisibilityRule>): (
  *
  * A responder runs this over its records before it fingerprints, splits or lists a range and
  * before it answers a fetch, so a hidden record changes none of them.
+ *
+ * Records are checked together: the `visibleTo` hooks, and the context's resolvers and store,
+ * must accept concurrent calls. The first failure in record order is thrown.
  */
 export declare function filterVisibleRecords(records: ReadonlyArray<SignedRecord>, types: ReadonlyMap<string, RecordTypeDefinition>, ctx: VisibilityContext): Promise<Array<SignedRecord>>;

package/lib/visibility.js

@@ -1,8 +1,10 @@
 import { normalizeDID } from '@kokuin/token';
-import { isDependencyUnsatisfied } from './apply.js';
+import { isDependencyUnsatisfiedBy } from './apply.js';
+import { settleLimited } from './limit.js';
 import { verifySignedRecord } from './op.js';
 import { compareRecordOps } from './policy.js';
 import { recordClaimDigest, recordPayloadMatches } from './record.js';
+import { getRecordDecisions, recordKeyText } from './store.js';
 function normalizedOrNull(did) {
     if (typeof did !== 'string') {
         return null;
@@ -23,6 +25,13 @@ function stringsIn(value) {
 /** A key version: a non-negative safe integer, so ordering it against another is exact. */ function isKeyVersion(value) {
     return Number.isSafeInteger(value) && value >= 0;
 }
+const holdingIndexes = new WeakMap();
+function holdingID(owner, keyID) {
+    return JSON.stringify([
+        owner,
+        keyID
+    ]);
+}
 /**
  * Whether the responder's stored row for a proof's record leaves the proof standing: none,
  * one that no longer verifies (apply treats it as absent too), or a live row of the same
@@ -65,12 +74,19 @@ function stringsIn(value) {
         return null;
     }
     // A proof is weighed against the row the responder holds for the same record, so a
-    // revoked, superseded or taken-over wrapping cannot stand in for the live one.
-    const storedDecision = await ctx.store.get({
+    // revoked, superseded or taken-over wrapping cannot stand in for the live one. That row and
+    // the proof's dependencies are read in one batch.
+    const storedKey = {
         type: proof.type,
         owner: op.claim.owner,
         id: proof.id
-    });
+    };
+    const dependencies = definition.dependencies(proof, op);
+    const decisions = await getRecordDecisions(ctx.store, [
+        storedKey,
+        ...dependencies
+    ]);
+    const storedDecision = decisions.get(recordKeyText(storedKey)) ?? null;
     const storedRecord = storedDecision?.copies[0] ?? null;
     const storedOp = storedRecord === null ? null : await verifySignedRecord(storedRecord, ctx.opKind, ctx.methods);
     if (!storedRowAdmits(op, storedOp, definition)) {
@@ -78,10 +94,9 @@ function stringsIn(value) {
     }
     // A proof the responder cannot check for lack of a dependency earns nothing, the same as
     // one that fails, rather than parking as it would in apply.
-    for (const dependency of definition.dependencies(proof, op)){
-        if (await isDependencyUnsatisfied(dependency, ctx.store, ctx.opKind, ctx.methods)) {
-            return null;
-        }
+    const unsatisfied = await Promise.all(dependencies.map((dependency)=>isDependencyUnsatisfiedBy(dependency, decisions.get(recordKeyText(dependency)) ?? null, ctx.opKind, ctx.methods)));
+    if (unsatisfied.includes(true)) {
+        return null;
     }
     const authorized = await ctx.authorizeProof(proof, storedOp === null ? null : storedRecord);
     return authorized ? {
@@ -118,6 +133,36 @@ async function isKeyHolder(claim, ctx) {
     if (typeof keyID !== 'string' || keyVersion !== undefined && !isKeyVersion(keyVersion) || ctx.holderTypes.size === 0) {
         return false;
     }
+    const index = holdingIndexes.get(ctx);
+    if (index !== undefined) {
+        const wanted = holdingID(claim.owner, keyID);
+        if (index.held.has(wanted)) {
+            return true;
+        }
+        index.records ??= ctx.store.list([
+            ...ctx.holderTypes.keys()
+        ]).then((holdings)=>[
+                ...holdings.flatMap((decision)=>decision.copies),
+                ...ctx.proofs
+            ]);
+        const records = await index.records;
+        for (const [position, record] of records.entries()){
+            let check = index.checks[position];
+            if (check === undefined) {
+                check = checkedHolding(record, ctx);
+                index.checks[position] = check;
+            }
+            const holding = await check;
+            if (holding === null) {
+                continue;
+            }
+            index.held.add(holdingID(holding.owner, holding.keyID));
+            if (holding.keyID === keyID && holding.owner === claim.owner) {
+                return true;
+            }
+        }
+        return false;
+    }
     const holdings = await ctx.store.list([
         ...ctx.holderTypes.keys()
     ]);
@@ -202,13 +247,40 @@ async function satisfiesRule(rule, claim, ctx) {
  *
  * A responder runs this over its records before it fingerprints, splits or lists a range and
  * before it answers a fetch, so a hidden record changes none of them.
+ *
+ * Records are checked together: the `visibleTo` hooks, and the context's resolvers and store,
+ * must accept concurrent calls. The first failure in record order is thrown.
  */ export async function filterVisibleRecords(records, types, ctx) {
-    const visible = [];
-    for (const record of records){
-        const hook = types.get(record.type)?.visibleTo;
-        if (hook !== undefined && await hook(record, ctx)) {
-            visible.push(record);
+    // One context for this call: holdings and key versions are read once, then indexed.
+    const versions = new Map();
+    const scoped = {
+        ...ctx,
+        currentKeyVersion: (owner, keyID)=>{
+            const id = holdingID(owner, keyID);
+            let version = versions.get(id);
+            if (version === undefined) {
+                version = ctx.currentKeyVersion(owner, keyID);
+                versions.set(id, version);
+            }
+            return version;
         }
+    };
+    holdingIndexes.set(scoped, {
+        checks: [],
+        held: new Set()
+    });
+    // Records are checked together, up to `CONCURRENCY_LIMIT` at once. They share the holding
+    // index, so each holding is still checked once. The first failure in record order is thrown.
+    const admitted = await settleLimited(records, async (record)=>{
+        const hook = types.get(record.type)?.visibleTo;
+        return hook !== undefined && await hook(record, scoped);
+    });
+    const visible = [];
+    for (const [index, record] of records.entries()){
+        const result = admitted[index];
+        if (result === undefined) continue;
+        if (result.status === 'rejected') throw result.reason;
+        if (result.value) visible.push(record);
     }
     return visible;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kokuin/records",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Signed, owner-authorized replicated records with merge policies and range reconciliation",
   "keywords": [
     "records",
@@ -24,7 +24,7 @@
     "lib/*"
   ],
   "dependencies": {
-    "@kokuin/token": "^0.6.2",
+    "@kokuin/token": "^0.6.3",
     "@noble/hashes": "^2.4.0",
     "@sozai/codec": "^0.4.3",
     "@sozai/hlc": "^0.1.0",