makeKeyResolver
@rotorsoft/act-root / act-crypto/src / makeKeyResolver
Function: makeKeyResolver()
makeKeyResolver(
encryption): () =>Promise<Buffer<ArrayBufferLike>>
Defined in: libs/act-crypto/src/envelope.ts:102
Wrap an Encryption config into a memoized key resolver.
The returned function calls encryption.keyProvider once, validates
the result is a 32-byte Buffer, and caches it for the resolver's lifetime.
Every later call hits the cache without re-invoking the provider —
important when the provider is a KMS round-trip.
"Once" includes concurrent callers. The in-flight promise is what is
memoized, not the resolved key: caching the key alone would leave an
await between the cache miss and the cache write, so every caller
arriving before the first provider call settled would miss too and make
its own. On a cold process serving concurrent requests that is one KMS
round-trip per request instead of one per process — rate limits, per-call
billing, and an audit-log entry each, exactly where the memo should help.
A rejected attempt is not cached. The next call retries, so a transient KMS failure at startup does not poison the resolver for the life of the adapter.
Operators who need key rotation construct a new adapter (which makes a new resolver) rather than mutating the in-flight one. The resolver's lifecycle matches the adapter's, not the application's.
Parameters
encryption
Returns
() => Promise<Buffer<ArrayBufferLike>>
Throws
Error if keyProvider returns anything other than a
32-byte Buffer.