makeKeyResolver
@rotorsoft/act-root / act-crypto/src / makeKeyResolver
Function: makeKeyResolver()
makeKeyResolver(
encryption): () =>Promise<Buffer<ArrayBufferLike>>
Defined in: libs/act-crypto/src/envelope.ts:103
Wrap an Encryption config into a memoized key resolver.
The returned function calls encryption.keyProvider once, validates
the result is a 32-byte Buffer, and caches it for the resolver's lifetime.
Every later call hits the cache without re-invoking the provider —
important when the provider is a KMS round-trip.
"Once" includes concurrent callers. The in-flight promise is what is
memoized, not the resolved key: caching the key alone left an await
between the cache miss and the cache write, so every caller arriving
before the first provider call settled missed too and made its own. On a
cold process serving concurrent requests that is one KMS round-trip per
request instead of one per process — rate limits, per-call billing, and
an audit-log entry each, exactly where the memo was supposed to help
(#1675's sibling, #1704).
A rejected attempt is not cached. The next call retries, so a transient KMS failure at startup does not poison the resolver for the life of the adapter.
Operators who need key rotation construct a new adapter (which makes a new resolver) rather than mutating the in-flight one. The resolver's lifecycle matches the adapter's, not the application's.
Parameters
encryption
Returns
() => Promise<Buffer<ArrayBufferLike>>
Throws
Error if keyProvider returns anything other than a
32-byte Buffer.