@cat-factory/server 0.140.1 → 0.140.2

package/dist/crypto/WebCryptoSecretCipher.d.ts

@@ -1,4 +1,4 @@
-import type { SecretCipher } from '@cat-factory/kernel';
+import { type SecretCipher } from '@cat-factory/kernel';
 export interface WebCryptoSecretCipherOptions {
     /** Service-level master key, base64 (≥32 bytes decoded). */
     masterKeyBase64: string;

package/dist/crypto/WebCryptoSecretCipher.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAmBvD,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,qBAAsB,YAAW,YAAY;IAGxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAMlE;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUhD;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8C/C;IAED,OAAO,CAAC,OAAO;YASD,SAAS;CASxB"}
+{"version":3,"file":"WebCryptoSecretCipher.d.ts","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,YAAY,EAAsB,MAAM,qBAAqB,CAAA;AAmB3E,MAAM,WAAW,4BAA4B;IAC3C,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAA;IACvB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,qBAAa,qBAAsB,YAAW,YAAY;IAGxD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyB;IACnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,OAAO,CAAC,cAAc,CAAC,CAAoB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,EAAE,4BAA4B,EAMlE;IAEK,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAUhD;IAEK,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiD/C;IAED,OAAO,CAAC,OAAO;YASD,SAAS;CASxB"}

package/dist/crypto/WebCryptoSecretCipher.js

@@ -1,3 +1,4 @@
+import { SecretDecryptError } from '@cat-factory/kernel';
 import { base64url, base64urlToBytes } from './encoding.js';
 // Authenticated encryption of credentials at rest, on Web Crypto (AES-256-GCM)
 // — no Node `crypto`, runs in a plain Workers isolate AND under Node (crypto.subtle
@@ -53,7 +54,7 @@ export class WebCryptoSecretCipher {
             ciphertext = base64urlToBytes(parts[3]);
         }
         catch (e) {
-            throw new Error('A stored secret is not a valid encryption envelope: it is truncated or corrupted, ' +
+            throw new SecretDecryptError('corrupt', 'A stored secret is not a valid encryption envelope: it is truncated or corrupted, ' +
                 'or was written by a different encryption scheme/version — most likely a truncated ' +
                 'database column, or a value copied between environments. Re-enter the affected ' +
                 'credential to re-seal it under the current ENCRYPTION_KEY.', { cause: e });
@@ -69,8 +70,9 @@ export class WebCryptoSecretCipher {
             // credential sealed under the previous key is now unrecoverable. The raw Web Crypto
             // failure is the opaque DOMException "The operation failed for an operation-specific
             // reason", which surfaced verbatim as a run/request failure with no clue to the cause.
-            // Rethrow an actionable message (preserving the original as `cause`).
-            throw new Error('A stored secret could not be decrypted: the encryption key (ENCRYPTION_KEY) does not ' +
+            // Rethrow an actionable, TYPED message (preserving the original as `cause`) so the
+            // D6.2 drift sweep can bucket this as `key-mismatch` without parsing the text.
+            throw new SecretDecryptError('key-mismatch', 'A stored secret could not be decrypted: the encryption key (ENCRYPTION_KEY) does not ' +
                 'match the one it was sealed under — it was most likely rotated or regenerated. ' +
                 'Restore the original key, or re-enter the affected credential to re-seal it under the current key.', { cause: e });
         }

package/dist/crypto/WebCryptoSecretCipher.js.map

@@ -1 +1 @@
-{"version":3,"file":"WebCryptoSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,+EAA+E;AAC/E,oFAAoF;AACpF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,kFAAkF;AAClF,qDAAqD;AACrD,EAAE;AACF,+FAA+F;AAE/F,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,iFAAiF;AACjF,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAc/C,MAAM,OAAO,qBAAqB;IAChC,8EAA8E;IAC9E,iEAAiE;IAChD,SAAS,CAAyB;IAClC,IAAI,CAAyB;IACtC,cAAc,CAAqB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAA;QACpF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAA4B,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,iFAAiF;QACjF,uFAAuF;QACvF,uFAAuF;QACvF,yFAAyF;QACzF,2FAA2F;QAC3F,yEAAyE;QACzE,IAAI,IAA6B,CAAA;QACjC,IAAI,EAA2B,CAAA;QAC/B,IAAI,UAAmC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,MAAM,YAAY,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC7D,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC3D,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CACb,oFAAoF;gBAClF,oFAAoF;gBACpF,iFAAiF;gBACjF,4DAA4D,EAC9D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,KAAkB,CAAA;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qFAAqF;YACrF,mFAAmF;YACnF,oFAAoF;YACpF,qFAAqF;YACrF,uFAAuF;YACvF,sEAAsE;YACtE,MAAM,IAAI,KAAK,CACb,uFAAuF;gBACrF,iFAAiF;gBACjF,oGAAoG,EACtG,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClF,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACxD,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;IACH,CAAC;CACF"}
+{"version":3,"file":"WebCryptoSecretCipher.js","sourceRoot":"","sources":["../../src/crypto/WebCryptoSecretCipher.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,+EAA+E;AAC/E,oFAAoF;AACpF,yEAAyE;AACzE,8EAA8E;AAC9E,8EAA8E;AAC9E,kFAAkF;AAClF,qDAAqD;AACrD,EAAE;AACF,+FAA+F;AAE/F,MAAM,OAAO,GAAG,IAAI,CAAA;AACpB,MAAM,UAAU,GAAG,EAAE,CAAA;AACrB,MAAM,QAAQ,GAAG,EAAE,CAAA;AACnB,iFAAiF;AACjF,MAAM,YAAY,GAAG,0BAA0B,CAAA;AAc/C,MAAM,OAAO,qBAAqB;IAChC,8EAA8E;IAC9E,iEAAiE;IAChD,SAAS,CAAyB;IAClC,IAAI,CAAyB;IACtC,cAAc,CAAqB;IAE3C,YAAY,EAAE,eAAe,EAAE,IAAI,EAAgC;QACjE,IAAI,CAAC,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAA;QACpF,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,YAAY,CAA4B,CAAA;IACvF,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,SAAiB;QAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC3D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACxC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EACvB,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CACpC,CAAA;QACD,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC/F,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,iFAAiF;QACjF,uFAAuF;QACvF,uFAAuF;QACvF,yFAAyF;QACzF,2FAA2F;QAC3F,yEAAyE;QACzE,IAAI,IAA6B,CAAA;QACjC,IAAI,EAA2B,CAAA;QAC/B,IAAI,UAAmC,CAAA;QACvC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;gBAC/C,MAAM,IAAI,KAAK,CAAC,kCAAkC,KAAK,CAAC,MAAM,YAAY,CAAC,CAAA;YAC7E,CAAC;YACD,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC7D,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;YAC3D,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAE,CAA4B,CAAA;QACrE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,kBAAkB,CAC1B,SAAS,EACT,oFAAoF;gBAClF,oFAAoF;gBACpF,iFAAiF;gBACjF,4DAA4D,EAC9D,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QACtC,IAAI,KAAkB,CAAA;QACtB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAA;QAC/E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,qFAAqF;YACrF,mFAAmF;YACnF,oFAAoF;YACpF,qFAAqF;YACrF,uFAAuF;YACvF,mFAAmF;YACnF,+EAA+E;YAC/E,MAAM,IAAI,kBAAkB,CAC1B,cAAc,EACd,uFAAuF;gBACrF,iFAAiF;gBACjF,oGAAoG,EACtG,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAA;QACH,CAAC;QACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxC,CAAC;IAEO,OAAO;QACb,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;gBAClF,WAAW;aACZ,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAA6B;QACnD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EACxD,MAAM,IAAI,CAAC,OAAO,EAAE,EACpB,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,EAChC,KAAK,EACL,CAAC,SAAS,EAAE,SAAS,CAAC,CACvB,CAAA;IACH,CAAC;CACF"}

package/dist/crypto/keyDriftSweep.d.ts

@@ -0,0 +1,30 @@
+import { type SealedSecretInventory, type SealedSecretRef, type SecretCipher } from '@cat-factory/kernel';
+import type { KeyFingerprintLogger } from './keyFingerprint.js';
+export interface KeyDriftReport {
+    /** Refs that decrypted cleanly — no drift for these. */
+    ok: SealedSecretRef[];
+    /**
+     * Refs whose AES-GCM authentication failed: the ENCRYPTION_KEY does not match the one they
+     * were sealed under. UNRECOVERABLE without the original key — the drift case D6.3 remediates.
+     */
+    keyMismatch: SealedSecretRef[];
+    /**
+     * Refs whose envelope is malformed/truncated or from a different scheme/version. A separate
+     * fault (not key drift), surfaced distinctly so it isn't misattributed to a key change.
+     */
+    corrupt: SealedSecretRef[];
+}
+/** Whether a report found anything actionable (either failure bucket non-empty). */
+export declare function hasKeyDrift(report: KeyDriftReport): boolean;
+/**
+ * Attempt to decrypt every sealed secret and bucket the outcome. Ciphers are memoised per HKDF
+ * `info` tag (one cipher serves every secret sealed under that tag). A decrypt that throws an
+ * unexpected (non-{@link SecretDecryptError}) error is bucketed as `corrupt` and logged — the
+ * sweep never throws, so one unreadable row can't abort the whole scan.
+ */
+export declare function sweepKeyDrift(deps: {
+    inventory: SealedSecretInventory;
+    cipherFor: (info: string) => SecretCipher;
+    logger?: KeyFingerprintLogger;
+}): Promise<KeyDriftReport>;
+//# sourceMappingURL=keyDriftSweep.d.ts.map

package/dist/crypto/keyDriftSweep.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyDriftSweep.d.ts","sourceRoot":"","sources":["../../src/crypto/keyDriftSweep.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,eAAe,EACpB,KAAK,YAAY,EAElB,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAa/D,MAAM,WAAW,cAAc;IAC7B,wDAAwD;IACxD,EAAE,EAAE,eAAe,EAAE,CAAA;IACrB;;;OAGG;IACH,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B;;;OAGG;IACH,OAAO,EAAE,eAAe,EAAE,CAAA;CAC3B;AAED,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAE3D;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,SAAS,EAAE,qBAAqB,CAAA;IAChC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,CAAA;IACzC,MAAM,CAAC,EAAE,oBAAoB,CAAA;CAC9B,GAAG,OAAO,CAAC,cAAc,CAAC,CA8C1B"}

package/dist/crypto/keyDriftSweep.js

@@ -0,0 +1,61 @@
+import { isSecretDecryptError, } from '@cat-factory/kernel';
+/** Whether a report found anything actionable (either failure bucket non-empty). */
+export function hasKeyDrift(report) {
+    return report.keyMismatch.length > 0 || report.corrupt.length > 0;
+}
+/**
+ * Attempt to decrypt every sealed secret and bucket the outcome. Ciphers are memoised per HKDF
+ * `info` tag (one cipher serves every secret sealed under that tag). A decrypt that throws an
+ * unexpected (non-{@link SecretDecryptError}) error is bucketed as `corrupt` and logged — the
+ * sweep never throws, so one unreadable row can't abort the whole scan.
+ */
+export async function sweepKeyDrift(deps) {
+    const { inventory, cipherFor, logger } = deps;
+    const ciphers = new Map();
+    const cipher = (info) => {
+        let c = ciphers.get(info);
+        if (!c) {
+            c = cipherFor(info);
+            ciphers.set(info, c);
+        }
+        return c;
+    };
+    const report = { ok: [], keyMismatch: [], corrupt: [] };
+    const refs = await inventory.listSealed();
+    for (const ref of refs) {
+        try {
+            await cipher(ref.info).decrypt(ref.envelope);
+            report.ok.push(ref);
+        }
+        catch (error) {
+            if (isSecretDecryptError(error, 'key-mismatch')) {
+                report.keyMismatch.push(ref);
+            }
+            else if (isSecretDecryptError(error, 'corrupt')) {
+                report.corrupt.push(ref);
+            }
+            else {
+                // An unexpected decrypt error (not one of the cipher's typed failures): treat it as
+                // corruption (conservative — it isn't a confirmed key mismatch) and keep scanning.
+                report.corrupt.push(ref);
+                logger?.warn('key drift sweep: unexpected decrypt error', {
+                    source: ref.source,
+                    id: ref.id,
+                    error: String(error),
+                });
+            }
+        }
+    }
+    if (hasKeyDrift(report)) {
+        logger?.warn('key drift sweep found affected secrets', {
+            keyMismatch: report.keyMismatch.length,
+            corrupt: report.corrupt.length,
+            ok: report.ok.length,
+        });
+    }
+    else {
+        logger?.info('key drift sweep: all stored secrets decrypt cleanly', { ok: report.ok.length });
+    }
+    return report;
+}
+//# sourceMappingURL=keyDriftSweep.js.map

package/dist/crypto/keyDriftSweep.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyDriftSweep.js","sourceRoot":"","sources":["../../src/crypto/keyDriftSweep.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AA6B5B,oFAAoF;AACpF,MAAM,UAAU,WAAW,CAAC,MAAsB;IAChD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAA;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC7C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;IAC/C,MAAM,MAAM,GAAG,CAAC,IAAY,EAAgB,EAAE;QAC5C,IAAI,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,IAAI,CAAC,CAAC,EAAE,CAAC;YACP,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;QACtB,CAAC;QACD,OAAO,CAAC,CAAA;IACV,CAAC,CAAA;IAED,MAAM,MAAM,GAAmB,EAAE,EAAE,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;IACvE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,CAAA;IACzC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;YAC5C,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,oBAAoB,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC;gBAChD,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC9B,CAAC;iBAAM,IAAI,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;gBAClD,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC1B,CAAC;iBAAM,CAAC;gBACN,oFAAoF;gBACpF,mFAAmF;gBACnF,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACxB,MAAM,EAAE,IAAI,CAAC,2CAA2C,EAAE;oBACxD,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;iBACrB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,IAAI,CAAC,wCAAwC,EAAE;YACrD,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM;YACtC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM;YAC9B,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM;SACrB,CAAC,CAAA;IACJ,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,IAAI,CAAC,qDAAqD,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/crypto/keyFingerprint.d.ts

@@ -0,0 +1,47 @@
+import type { KeyFingerprintStore } from '@cat-factory/kernel';
+/**
+ * Compute the base64url fingerprint of a base64-encoded master key. Uses HKDF-SHA256
+ * `deriveBits` with a fixed domain-separation `info` and an empty salt (the salt adds
+ * nothing here — the key IS the secret and there is only one derivation per key), mirroring
+ * the {@link WebCryptoSecretCipher} HKDF style. Throws on an under-length key, exactly like
+ * the cipher, so a misconfigured key fails the same way in both places.
+ */
+export declare function computeKeyFingerprint(masterKeyBase64: string): Promise<string>;
+/**
+ * The outcome of a boot-time drift check:
+ * - `first-seen` — no fingerprint was stored yet; the current one was just persisted.
+ * - `match` — the stored fingerprint equals the current key's; no drift.
+ * - `drift` — the stored fingerprint differs; the ENCRYPTION_KEY changed since secrets were
+ *   last sealed, so any secret sealed under the old key is now unrecoverable without it.
+ */
+export type KeyFingerprintCheck = {
+    status: 'first-seen';
+    fingerprint: string;
+} | {
+    status: 'match';
+    fingerprint: string;
+} | {
+    status: 'drift';
+    current: string;
+    stored: string;
+};
+/** A minimal logger surface (matches both the server and runtime facades' loggers). */
+export interface KeyFingerprintLogger {
+    info(message: string, fields?: Record<string, unknown>): void;
+    warn(message: string, fields?: Record<string, unknown>): void;
+    error(message: string, fields?: Record<string, unknown>): void;
+}
+/**
+ * Run the boot-time drift check: compute the current key's fingerprint, compare it to the
+ * persisted one, and NEVER overwrite a mismatching value (that would erase the drift signal —
+ * the operator restores the old key or runs remediation, then the fingerprint is re-seeded
+ * deliberately). Logs the outcome and returns it so the caller can act (e.g. trigger the
+ * D6.2 sweep). Best-effort persistence: a store write failure is logged, not fatal, so a
+ * transient DB hiccup never blocks boot.
+ */
+export declare function checkKeyFingerprint(deps: {
+    store: KeyFingerprintStore;
+    masterKeyBase64: string;
+    logger: KeyFingerprintLogger;
+}): Promise<KeyFingerprintCheck>;
+//# sourceMappingURL=keyFingerprint.d.ts.map

package/dist/crypto/keyFingerprint.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyFingerprint.d.ts","sourceRoot":"","sources":["../../src/crypto/keyFingerprint.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AAe9D;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBpF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACxC;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAExD,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC7D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC7D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAC/D;AAED;;;;;;;GAOG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,KAAK,EAAE,mBAAmB,CAAA;IAC1B,eAAe,EAAE,MAAM,CAAA;IACvB,MAAM,EAAE,oBAAoB,CAAA;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAwB/B"}

package/dist/crypto/keyFingerprint.js

@@ -0,0 +1,65 @@
+import { base64url, base64urlToBytes } from './encoding.js';
+// ADR 0026 D6.1 — a non-secret fingerprint of the master ENCRYPTION_KEY and the boot-time
+// drift check built on it. The fingerprint is `HKDF(masterKey, info="cat-factory:key-
+// fingerprint")` truncated to 8 bytes, base64url. It is a one-way function of the key that
+// leaks nothing usable (8 bytes of HKDF output can't be inverted to a 32-byte key), so it is
+// safe to persist in plaintext. Persisted once on first boot; every boot recomputes and
+// compares — an O(1), definitive "the key changed since secrets were last sealed" signal
+// available before any request touches a stale secret.
+const FINGERPRINT_INFO = 'cat-factory:key-fingerprint';
+/** 8 bytes: enough that a collision is not a practical concern, few enough to leak nothing. */
+const FINGERPRINT_BYTES = 8;
+/**
+ * Compute the base64url fingerprint of a base64-encoded master key. Uses HKDF-SHA256
+ * `deriveBits` with a fixed domain-separation `info` and an empty salt (the salt adds
+ * nothing here — the key IS the secret and there is only one derivation per key), mirroring
+ * the {@link WebCryptoSecretCipher} HKDF style. Throws on an under-length key, exactly like
+ * the cipher, so a misconfigured key fails the same way in both places.
+ */
+export async function computeKeyFingerprint(masterKeyBase64) {
+    const masterKey = base64urlToBytes(masterKeyBase64.trim());
+    if (masterKey.length < 32) {
+        throw new Error('encryption key must decode to at least 32 bytes');
+    }
+    const baseKey = await crypto.subtle.importKey('raw', masterKey, 'HKDF', false, ['deriveBits']);
+    const bits = await crypto.subtle.deriveBits({
+        name: 'HKDF',
+        hash: 'SHA-256',
+        salt: new Uint8Array(0),
+        info: new TextEncoder().encode(FINGERPRINT_INFO),
+    }, baseKey, FINGERPRINT_BYTES * 8);
+    return base64url(new Uint8Array(bits));
+}
+/**
+ * Run the boot-time drift check: compute the current key's fingerprint, compare it to the
+ * persisted one, and NEVER overwrite a mismatching value (that would erase the drift signal —
+ * the operator restores the old key or runs remediation, then the fingerprint is re-seeded
+ * deliberately). Logs the outcome and returns it so the caller can act (e.g. trigger the
+ * D6.2 sweep). Best-effort persistence: a store write failure is logged, not fatal, so a
+ * transient DB hiccup never blocks boot.
+ */
+export async function checkKeyFingerprint(deps) {
+    const { store, masterKeyBase64, logger } = deps;
+    const current = await computeKeyFingerprint(masterKeyBase64);
+    const stored = await store.get();
+    if (stored === null) {
+        await store.set(current).catch((error) => {
+            logger.warn('key fingerprint could not be persisted on first boot', {
+                error: String(error),
+            });
+        });
+        logger.info('key fingerprint recorded (first boot)', { fingerprint: current });
+        return { status: 'first-seen', fingerprint: current };
+    }
+    if (stored === current) {
+        return { status: 'match', fingerprint: current };
+    }
+    logger.error('ENCRYPTION_KEY drift detected: the key changed since secrets were last sealed', {
+        storedFingerprint: stored,
+        currentFingerprint: current,
+        hint: 'Secrets sealed under the previous key are unrecoverable without it. Restore the ' +
+            'original ENCRYPTION_KEY, or re-enter the affected credentials to re-seal them.',
+    });
+    return { status: 'drift', current, stored };
+}
+//# sourceMappingURL=keyFingerprint.js.map

package/dist/crypto/keyFingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyFingerprint.js","sourceRoot":"","sources":["../../src/crypto/keyFingerprint.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAE3D,0FAA0F;AAC1F,sFAAsF;AACtF,2FAA2F;AAC3F,6FAA6F;AAC7F,wFAAwF;AACxF,yFAAyF;AACzF,uDAAuD;AAEvD,MAAM,gBAAgB,GAAG,6BAA6B,CAAA;AACtD,+FAA+F;AAC/F,MAAM,iBAAiB,GAAG,CAAC,CAAA;AAE3B;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,eAAuB;IACjE,MAAM,SAAS,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,EAAE,CAA4B,CAAA;IACrF,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAA;IAC9F,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC;QACvB,IAAI,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAA4B;KAC5E,EACD,OAAO,EACP,iBAAiB,GAAG,CAAC,CACtB,CAAA;IACD,OAAO,SAAS,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AACxC,CAAC;AAqBD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAIzC;IACC,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IAC/C,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,eAAe,CAAC,CAAA;IAC5D,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAChD,MAAM,CAAC,IAAI,CAAC,sDAAsD,EAAE;gBAClE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC;aACrB,CAAC,CAAA;QACJ,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,IAAI,CAAC,uCAAuC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAA;QAC9E,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IACvD,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IAClD,CAAC;IACD,MAAM,CAAC,KAAK,CAAC,+EAA+E,EAAE;QAC5F,iBAAiB,EAAE,MAAM;QACzB,kBAAkB,EAAE,OAAO;QAC3B,IAAI,EACF,kFAAkF;YAClF,gFAAgF;KACnF,CAAC,CAAA;IACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAA;AAC7C,CAAC"}

package/dist/http/env.d.ts

@@ -1,4 +1,4 @@
-import type { AgentRunRepository, ExecutionRepository, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, UserRepoAccessRepository, VcsIdentityRegistry, VcsProviderRegistry, VcsWebhookSink, WorkspacePermission, WorkspaceRole } from '@cat-factory/kernel';
+import type { AgentRunRepository, ExecutionRepository, ResolveBinaryArtifactStore, ConsensusSessionRepository, ResolveRunRepoContext, SealedSecretInventory, UserRepoAccessRepository, VcsIdentityRegistry, VcsProviderRegistry, VcsWebhookSink, WorkspacePermission, WorkspaceRole } from '@cat-factory/kernel';
 import type { ApiKeyService, EnvironmentBackendRegistry, LocalModelEndpointService, LocalSettingsService, OpenRouterCatalogService, PersonalSubscriptionService, ProviderSubscriptionService, PublicApiKeyService, RunnerBackendRegistry, TestSecretsService, UserSecretService } from '@cat-factory/integrations';
 import type { Core } from '@cat-factory/orchestration';
 import type { AgentKindRegistry } from '@cat-factory/agents';
@@ -142,6 +142,14 @@ export interface ServerContainer extends Core {
      * (needs ENCRYPTION_KEY). Drives the user-secret controller and `ResolveUserGitHubToken`.
      */
     userSecrets?: UserSecretService;
+    /**
+     * The deployment's sealed-secret inventory (ADR 0026 D6.2/D6.3): enumerates every
+     * sealed-at-rest credential so the boot drift sweep can attempt to decrypt each, and drops a
+     * specific unrecoverable one on the operator's request. Present only when the facade wired it
+     * (needs ENCRYPTION_KEY-backed stores); absent ⇒ the drift sweep is skipped and the
+     * `key_drift` card's drop action no-ops.
+     */
+    sealedSecretInventory?: SealedSecretInventory;
     /**
      * The per-USER "repos my personal access token can reach" projection. Present only when the
      * facade wired GitHub (needs an installation-backed projection). Drives (a) the fail-closed

package/dist/http/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;OAMG;IACH,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;KACzC,CAAA;CACF,CAAA"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/http/env.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,aAAa,EACd,MAAM,qBAAqB,CAAA;AAC5B,OAAO,KAAK,EACV,aAAa,EACb,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACpB,wBAAwB,EACxB,2BAA2B,EAC3B,2BAA2B,EAC3B,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,iBAAiB,EAClB,MAAM,2BAA2B,CAAA;AAClC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,4BAA4B,CAAA;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAA;AACnE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAA;AAC5E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAA;AACnE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAQhF,MAAM,WAAW,eAAgB,SAAQ,IAAI;IAC3C,MAAM,EAAE,SAAS,CAAA;IACjB,8EAA8E;IAC9E,kBAAkB,EAAE,kBAAkB,CAAA;IACtC;;;;OAIG;IACH,mBAAmB,EAAE,mBAAmB,CAAA;IACxC;;;;OAIG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD,mFAAmF;IACnF,QAAQ,EAAE,eAAe,CAAA;IACzB;;;;;;;OAOG;IACH,wBAAwB,CAAC,EAAE,iBAAiB,CAAA;IAC5C;;;;OAIG;IACH,UAAU,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvC;;;;;OAKG;IACH,0BAA0B,EAAE,0BAA0B,CAAA;IACtD,qBAAqB,EAAE,qBAAqB,CAAA;IAC5C;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAA;IACpC;;;;;;OAMG;IACH,wBAAwB,EAAE,wBAAwB,CAAA;IAClD;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;OAGG;IACH,aAAa,CAAC,EAAE,2BAA2B,CAAA;IAC3C;;;;;OAKG;IACH,WAAW,CAAC,EAAE,kBAAkB,CAAA;IAChC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,2BAA2B,CAAA;IACnD;;;;;OAKG;IACH,OAAO,CAAC,EAAE,aAAa,CAAA;IACvB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAA;IACnC;;;;;OAKG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAA;IACjC;;;;;OAKG;IACH,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;IAC5D;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,yBAAyB,CAAA;IAC/C;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAA;IAC/B;;;;;;OAMG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,wBAAwB,CAAA;IACzC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,wBAAwB,CAAA;IAC5C;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE;QAAE,OAAO,EAAE,oBAAoB,CAAA;KAAE,CAAA;IACjD;;;;;;;OAOG;IACH,0BAA0B,CAAC,EAAE,0BAA0B,CAAA;IACvD;;;;;;;OAOG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAA;IACzC;;;;;;;;;OASG;IACH,oCAAoC,CAAC,EAAE,OAAO,CAAA;IAC9C;;;;;OAKG;IACH,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B;;;;;;OAMG;IACH,WAAW,EAAE,mBAAmB,CAAA;IAChC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,mBAAmB,CAAA;IACjC;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,mBAAmB,CAAA;IAClC;;;;;;;OAOG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAA;IAC7C;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,CACf,cAAc,EAAE,MAAM,EACtB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAC;QAAC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,GAC1D,OAAO,CAAC,MAAM,CAAC,CAAA;CACnB;AAED,+FAA+F;AAC/F,MAAM,WAAW,mBAAmB;IAClC,OAAO,CACL,OAAO,EAAE,MAAM,GACd,OAAO,CACN;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,WAAW,CAAA;KAAE,GAClE;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CACjD,CAAA;CACF;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,aAAa,CAAA;IACnB,WAAW,EAAE,WAAW,CAAC,mBAAmB,CAAC,CAAA;CAC9C;AAED,4FAA4F;AAC5F,MAAM,MAAM,MAAM,GAAG;IACnB,SAAS,EAAE;QACT,SAAS,EAAE,eAAe,CAAA;QAC1B,yEAAyE;QACzE,IAAI,CAAC,EAAE,cAAc,CAAA;QACrB,oGAAoG;QACpG,eAAe,CAAC,EAAE,sBAAsB,CAAA;KACzC,CAAA;CACF,CAAA"}

package/dist/index.d.ts

@@ -4,6 +4,7 @@ export { type GitHubBackfillScheduler, type GitHubWebhookIngest, type LlmInProce
 export { BraveWebSearchUpstream, SearxngWebSearchUpstream, createWebSearchUpstream, createDefaultWebSearchUpstream, DEFAULT_WEB_SEARCH_COUNT, } from './modules/webSearch/upstreams.js';
 export { escalateStaleNotifications } from './runtime/escalateNotifications.js';
 export { sweepPlatformHealth, type PlatformHealthSweepLogger } from './runtime/platformHealth.js';
+export { sweepKeyDriftAndRaise } from './runtime/keyDrift.js';
 export { noRunnerBackendAvailableError } from './runtime/runnerBackendError.js';
 export { GITHUB_RECONCILE_STALE_MS, reconcileStaleRepos, type GitHubReconcileDeps, } from './runtime/reconcileStaleRepos.js';
 export { StateSigner, type InstallState } from './github/state.js';
@@ -41,6 +42,8 @@ export { parseNumericEnv, describeRejectedNumericEnv } from './config/numeric.js
 export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './crypto/encoding.js';
 export { WebCryptoSecretCipher, type WebCryptoSecretCipherOptions, } from './crypto/WebCryptoSecretCipher.js';
 export { WebCryptoPersonalSecretCipher } from './crypto/WebCryptoPersonalSecretCipher.js';
+export { computeKeyFingerprint, checkKeyFingerprint, type KeyFingerprintCheck, type KeyFingerprintLogger, } from './crypto/keyFingerprint.js';
+export { sweepKeyDrift, hasKeyDrift, type KeyDriftReport } from './crypto/keyDriftSweep.js';
 export { GitHubAppAuth, type GitHubAppAuthDependencies, explainInstallationTokenMintFailure, } from './github/GitHubAppAuth.js';
 export { GitHubAppRegistry, type GitHubAppRegistryDependencies, type RegisteredApp, type AppTokenSource, } from './github/GitHubAppRegistry.js';
 export { PatPreferringAppRegistry } from './github/PatPreferringAppRegistry.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EACL,KAAK,MAAM,EACX,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,iBAAiB,GACvB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAE,KAAK,yBAAyB,EAAE,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,KAAK,mBAAmB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,EACX,KAAK,uBAAuB,EAC5B,KAAK,cAAc,GACpB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,KAAK,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,KAAK,gBAAgB,EACrB,KAAK,SAAS,GACf,MAAM,yCAAyC,CAAA;AAIhD,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,EACvC,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,sBAAsB,GAC5B,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAAE,KAAK,qBAAqB,EAAE,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAAE,KAAK,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,EACvB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,EAC5B,KAAK,kBAAkB,GACxB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,EACzB,KAAK,qCAAqC,GAC3C,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,EAC1B,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,EACvB,KAAK,6BAA6B,EAClC,KAAK,8BAA8B,EACnC,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,EACrB,KAAK,6BAA6B,GACnC,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,EACpB,KAAK,gCAAgC,GACtC,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,EACR,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAIlG,OAAO,EACL,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AAEzF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,4BAA4B,CAAA;AAEnC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,KAAK,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EACb,KAAK,yBAAyB,EAC9B,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,EACjB,KAAK,6BAA6B,EAClC,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAKpF,OAAO,EACL,iBAAiB,EACjB,cAAc,EACd,KAAK,6BAA6B,GACnC,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,EACtB,KAAK,6BAA6B,GACnC,MAAM,oCAAoC,CAAA;AAG3C,OAAO,EACL,6BAA6B,EAC7B,KAAK,yCAAyC,GAC/C,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,EACtB,KAAK,kCAAkC,GACxC,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,EACxB,KAAK,oCAAoC,GAC1C,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,EAC/B,KAAK,2CAA2C,GACjD,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,KAAK,sCAAsC,GAC5C,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,EACnB,KAAK,+BAA+B,GACrC,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,EACvB,KAAK,mCAAmC,GACzC,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,aAAa,GACnB,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,EACZ,KAAK,QAAQ,EACb,KAAK,aAAa,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EACV,YAAY,EACZ,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,eAAe,EACf,qBAAqB,EACrB,YAAY,EACZ,YAAY,EACZ,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACX,WAAW,GACZ,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,EAC1B,KAAK,qBAAqB,GAC3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,EACzB,KAAK,0BAA0B,GAChC,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAInC,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAGhD,cAAc,yBAAyB,CAAA;AAMvC,OAAO,EACL,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EACL,KAAK,oBAAoB,EACzB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAK5C,OAAO,EACL,uBAAuB,EACvB,KAAK,6BAA6B,GACnC,MAAM,qCAAqC,CAAA;AAI5C,OAAO,EACL,8BAA8B,EAC9B,KAAK,kCAAkC,EACvC,KAAK,gBAAgB,EACrB,KAAK,uBAAuB,EAC5B,KAAK,8BAA8B,GACpC,MAAM,sCAAsC,CAAA"}

package/dist/index.js

@@ -8,6 +8,7 @@ export {} from './runtime/gateways.js';
 export { BraveWebSearchUpstream, SearxngWebSearchUpstream, createWebSearchUpstream, createDefaultWebSearchUpstream, DEFAULT_WEB_SEARCH_COUNT, } from './modules/webSearch/upstreams.js';
 export { escalateStaleNotifications } from './runtime/escalateNotifications.js';
 export { sweepPlatformHealth } from './runtime/platformHealth.js';
+export { sweepKeyDriftAndRaise } from './runtime/keyDrift.js';
 export { noRunnerBackendAvailableError } from './runtime/runnerBackendError.js';
 export { GITHUB_RECONCILE_STALE_MS, reconcileStaleRepos, } from './runtime/reconcileStaleRepos.js';
 export { StateSigner } from './github/state.js';
@@ -53,6 +54,10 @@ export { base64url, base64urlToBytes, pkcs8PemToDer, timingSafeEqual } from './c
 // encrypt runner-pool secrets at rest exactly as the Worker does.
 export { WebCryptoSecretCipher, } from './crypto/WebCryptoSecretCipher.js';
 export { WebCryptoPersonalSecretCipher } from './crypto/WebCryptoPersonalSecretCipher.js';
+// ADR 0026 D6.1 — master-key fingerprint + the boot-time drift check built on it.
+export { computeKeyFingerprint, checkKeyFingerprint, } from './crypto/keyFingerprint.js';
+// ADR 0026 D6.2 — the runtime-neutral drift sweep over the sealed-secret inventory.
+export { sweepKeyDrift, hasKeyDrift } from './crypto/keyDriftSweep.js';
 export { GitHubAppAuth, explainInstallationTokenMintFailure, } from './github/GitHubAppAuth.js';
 export { GitHubAppRegistry, } from './github/GitHubAppRegistry.js';
 export { PatPreferringAppRegistry } from './github/PatPreferringAppRegistry.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAkC,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GAExB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAwB3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kFAAkF;AAClF,gFAAgF;AAChF,8EAA8E;AAC9E,qEAAqE;AACrE,OAAO,EAAE,MAAM,EAAe,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAKN,MAAM,eAAe,CAAA;AACtB,OAAO,EAYN,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,uBAAuB,EACvB,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,oCAAoC,CAAA;AAC/E,OAAO,EAAE,mBAAmB,EAAkC,MAAM,6BAA6B,CAAA;AACjG,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAC7D,OAAO,EAAE,6BAA6B,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,WAAW,EAAqB,MAAM,mBAAmB,CAAA;AAClE,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,WAAW,GAGZ,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAgC,MAAM,uBAAuB,CAAA;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAA;AAC7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,kCAAkC,CAAA;AACxF,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAA;AAC7E,OAAO,EACL,uBAAuB,EACvB,sBAAsB,GAGvB,MAAM,yCAAyC,CAAA;AAChD,mFAAmF;AACnF,kFAAkF;AAClF,oFAAoF;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAA;AAC3E,OAAO,EACL,sBAAsB,GASvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EAAE,uBAAuB,EAA8B,MAAM,8BAA8B,CAAA;AAClG,OAAO,EAAE,eAAe,EAA+B,MAAM,6BAA6B,CAAA;AAC1F,OAAO,EACL,iCAAiC,EACjC,uBAAuB,GAExB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,4BAA4B,GAE7B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EACL,yBAAyB,GAE1B,MAAM,uCAAuC,CAAA;AAC9C,OAAO,EACL,0BAA0B,GAE3B,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,sBAAsB,EACtB,uBAAuB,GAMxB,MAAM,+BAA+B,CAAA;AACtC,qFAAqF;AACrF,4FAA4F;AAC5F,OAAO,EACL,aAAa,EACb,4BAA4B,EAC5B,oBAAoB,EACpB,6BAA6B,EAC7B,yBAAyB,EACzB,UAAU,GACX,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,qBAAqB,GAEtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAA;AAClD,OAAO,EACL,oBAAoB,GAErB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAIL,sBAAsB,GACvB,MAAM,2BAA2B,CAAA;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EACL,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,UAAU,EACV,oBAAoB,EACpB,0BAA0B,EAC1B,wBAAwB,EACxB,QAAQ,GAET,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,sBAAsB,EAAE,0BAA0B,EAAE,MAAM,8BAA8B,CAAA;AACjG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AACrE,OAAO,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AACjF,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAClG,kFAAkF;AAClF,8EAA8E;AAC9E,kEAAkE;AAClE,OAAO,EACL,qBAAqB,GAEtB,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EAAE,6BAA6B,EAAE,MAAM,2CAA2C,CAAA;AACzF,kFAAkF;AAClF,OAAO,EACL,qBAAqB,EACrB,mBAAmB,GAGpB,MAAM,4BAA4B,CAAA;AACnC,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAE,WAAW,EAAuB,MAAM,2BAA2B,CAAA;AAC3F,OAAO,EACL,aAAa,EAEb,mCAAmC,GACpC,MAAM,2BAA2B,CAAA;AAClC,OAAO,EACL,iBAAiB,GAIlB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AACpF,gFAAgF;AAChF,kFAAkF;AAClF,qFAAqF;AACrF,6BAA6B;AAC7B,OAAO,EACL,iBAAiB,EACjB,cAAc,GAEf,MAAM,+BAA+B,CAAA;AACtC,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,oFAAoF;AACpF,qEAAqE;AACrE,OAAO,EACL,6BAA6B,GAE9B,MAAM,2CAA2C,CAAA;AAClD,OAAO,EAAE,wBAAwB,EAAE,MAAM,sCAAsC,CAAA;AAC/E,OAAO,EACL,sBAAsB,GAEvB,MAAM,oCAAoC,CAAA;AAC3C,OAAO,EACL,wBAAwB,GAEzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,+BAA+B,GAEhC,MAAM,6CAA6C,CAAA;AACpD,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,GAErB,MAAM,wCAAwC,CAAA;AAC/C,OAAO,EACL,mBAAmB,GAEpB,MAAM,iCAAiC,CAAA;AACxC,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAC5C,OAAO,EACL,UAAU,EACV,cAAc,GAKf,MAAM,mBAAmB,CAAA;AAC1B,OAAO,EACL,4BAA4B,EAC5B,gBAAgB,EAChB,wBAAwB,GACzB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,YAAY,GAGb,MAAM,oBAAoB,CAAA;AAwB3B,OAAO,EACL,gCAAgC,EAChC,0BAA0B,GAE3B,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EACL,yBAAyB,GAE1B,MAAM,mCAAmC,CAAA;AAC1C,OAAO,EACL,+BAA+B,EAC/B,2BAA2B,GAC5B,MAAM,4BAA4B,CAAA;AAEnC,mFAAmF;AACnF,iEAAiE;AACjE,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA;AAChD,4FAA4F;AAC5F,6FAA6F;AAC7F,cAAc,yBAAyB,CAAA;AAEvC,6FAA6F;AAC7F,wFAAwF;AACxF,6FAA6F;AAC7F,0EAA0E;AAC1E,OAAO,EAWL,0BAA0B,EAC1B,uBAAuB,EACvB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,GACzB,MAAM,qCAAqC,CAAA;AAC5C,yFAAyF;AACzF,wFAAwF;AACxF,2FAA2F;AAC3F,uFAAuF;AACvF,OAAO,EACL,uBAAuB,GAExB,MAAM,qCAAqC,CAAA;AAE5C,2FAA2F;AAC3F,sEAAsE;AACtE,OAAO,EACL,8BAA8B,GAK/B,MAAM,sCAAsC,CAAA"}

package/dist/modules/notifications/notificationActions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notificationActions.d.ts","sourceRoot":"","sources":["../../../src/modules/notifications/notificationActions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,EAAE,WAAW,CAAC,gBAAgB,CAK/E,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAmB/C"}
+{"version":3,"file":"notificationActions.d.ts","sourceRoot":"","sources":["../../../src/modules/notifications/notificationActions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAE5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,sCAAsC,EAAE,WAAW,CAAC,gBAAgB,CAK/E,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,eAAe,EAC1B,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAChC,CAAC,YAAY,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CA8B/C"}

package/dist/modules/notifications/notificationActions.js

@@ -45,6 +45,17 @@ export function notificationActEffect(container, workspaceId, userId) {
                     await container.executionService.retry(workspaceId, notification.executionId);
                 }
                 break;
+            case 'key_drift':
+                // ADR 0026 D6.3: acting on a key-drift card drops EVERY unrecoverable credential it
+                // lists (the "drop all stale" batch), flipping each owning connection to needs-re-entry.
+                // A single credential is dropped from the operator CLI instead. Explicit + confirmed on
+                // the card — the values are gone under the old key, so this never runs automatically.
+                if (container.sealedSecretInventory) {
+                    for (const ref of notification.payload?.driftAffected ?? []) {
+                        await container.sealedSecretInventory.drop({ source: ref.source, id: ref.id });
+                    }
+                }
+                break;
         }
     };
 }

package/dist/modules/notifications/notificationActions.js.map

@@ -1 +1 @@
-{"version":3,"file":"notificationActions.js","sourceRoot":"","sources":["../../../src/modules/notifications/notificationActions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAGtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAkC,IAAI,GAAG,CAAC;IAC3F,cAAc;IACd,mBAAmB;IACnB,WAAW;IACX,aAAa;CACd,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,WAAmB,EACnB,MAAiC;IAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,EAAE;QAC5B,QAAQ,YAAY,CAAC,IAAI,EAAE,CAAC;YAC1B,KAAK,cAAc,CAAC;YACpB,KAAK,mBAAmB;gBACtB,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;oBACzB,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAClC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,OAAQ,CAAC,CACvE,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,WAAW,CAAC;YACjB,KAAK,aAAa;gBAChB,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,MAAM,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC/E,CAAC;gBACD,MAAK;QACT,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}
+{"version":3,"file":"notificationActions.js","sourceRoot":"","sources":["../../../src/modules/notifications/notificationActions.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,qCAAqC,CAAA;AAGtE;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAkC,IAAI,GAAG,CAAC;IAC3F,cAAc;IACd,mBAAmB;IACnB,WAAW;IACX,aAAa;CACd,CAAC,CAAA;AAEF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAA0B,EAC1B,WAAmB,EACnB,MAAiC;IAEjC,OAAO,KAAK,EAAE,YAAY,EAAE,EAAE;QAC5B,QAAQ,YAAY,CAAC,IAAI,EAAE,CAAC;YAC1B,KAAK,cAAc,CAAC;YACpB,KAAK,mBAAmB;gBACtB,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;oBACzB,MAAM,gBAAgB,CAAC,MAAM,EAAE,GAAG,EAAE,CAClC,SAAS,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,YAAY,CAAC,OAAQ,CAAC,CACvE,CAAA;gBACH,CAAC;gBACD,MAAK;YACP,KAAK,WAAW,CAAC;YACjB,KAAK,aAAa;gBAChB,IAAI,YAAY,CAAC,WAAW,EAAE,CAAC;oBAC7B,MAAM,SAAS,CAAC,gBAAgB,CAAC,KAAK,CAAC,WAAW,EAAE,YAAY,CAAC,WAAW,CAAC,CAAA;gBAC/E,CAAC;gBACD,MAAK;YACP,KAAK,WAAW;gBACd,oFAAoF;gBACpF,yFAAyF;gBACzF,wFAAwF;gBACxF,sFAAsF;gBACtF,IAAI,SAAS,CAAC,qBAAqB,EAAE,CAAC;oBACpC,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;wBAC5D,MAAM,SAAS,CAAC,qBAAqB,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;oBAChF,CAAC;gBACH,CAAC;gBACD,MAAK;QACT,CAAC;IACH,CAAC,CAAA;AACH,CAAC"}

package/dist/runtime/keyDrift.d.ts

@@ -0,0 +1,14 @@
+import type { SecretCipher } from '@cat-factory/kernel';
+import type { KeyFingerprintLogger } from '../crypto/keyFingerprint.js';
+import type { ServerContainer } from '../http/env.js';
+/**
+ * Run the drift sweep and reconcile the per-workspace `key_drift` cards. `cipherFor` builds a
+ * cipher for an HKDF info tag (the facade supplies it from its ENCRYPTION_KEY). Returns counts
+ * for logging. Safe to call when unwired — it returns zeros.
+ */
+export declare function sweepKeyDriftAndRaise(container: ServerContainer, cipherFor: (info: string) => SecretCipher, logger?: KeyFingerprintLogger): Promise<{
+    raised: number;
+    cleared: number;
+    affected: number;
+}>;
+//# sourceMappingURL=keyDrift.d.ts.map

package/dist/runtime/keyDrift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyDrift.d.ts","sourceRoot":"","sources":["../../src/runtime/keyDrift.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAmB,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAExE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AACvE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAA;AA2CrD;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,eAAe,EAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,YAAY,EACzC,MAAM,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CA+DhE"}

package/dist/runtime/keyDrift.js

@@ -0,0 +1,105 @@
+import { sweepKeyDrift } from '../crypto/keyDriftSweep.js';
+// ADR 0026 D6.2 — the runtime-neutral driver that turns the drift sweep into ONE surfaced issue,
+// shared by both facades (the Node boot one-shot + the Worker cron), mirroring
+// `sweepPlatformHealth`. It attempts to decrypt every sealed secret the inventory reports and,
+// per workspace:
+//   - raises ONE `key_drift` notification listing that workspace's undecryptable credentials
+//     (by source / id / label / reason / seal time — NEVER the value), or
+//   - clears the open card once the workspace has none (the operator dropped + re-entered them).
+// The card de-dupes on (workspace, type) and its content is a pure function of the affected set,
+// so a persistently-drifted deployment re-notifies only when that set changes, not every sweep.
+//
+// A no-op unless BOTH the sealed-secret inventory and the notifications module are wired (tests /
+// no ENCRYPTION_KEY). Best-effort: a failure is logged and swallowed, never blocking boot/cron.
+/** Map an undecryptable ref + its reason to the wire shape carried on the card (no value). */
+function toAffected(ref, reason) {
+    return { source: ref.source, id: ref.id, label: ref.label, reason, sealedAt: ref.sealedAt };
+}
+/**
+ * Card copy for a workspace's affected credentials (title + one-line body). The count is a FLOOR,
+ * not a total: the sweep currently scans only the sources the inventory enumerates (environment +
+ * observability connections), so it deliberately reads "at least N" and warns that other credential
+ * types may be affected by the same key change — see the deferred-sources note in ADR 0026 D6.2. The
+ * D6.1 boot fingerprint still detects the key change globally, so nothing goes fully unnoticed.
+ */
+function cardContent(affected) {
+    const mismatched = affected.filter((a) => a.reason === 'key-mismatch').length;
+    const corrupt = affected.length - mismatched;
+    const parts = [];
+    if (mismatched > 0)
+        parts.push(`${mismatched} sealed under a different ENCRYPTION_KEY`);
+    if (corrupt > 0)
+        parts.push(`${corrupt} with a corrupt/foreign envelope`);
+    return {
+        title: 'Stored credentials could not be decrypted',
+        body: `At least ${affected.length} stored credential(s) could not be decrypted (${parts.join(', ')}). ` +
+            'They are unrecoverable unless the original ENCRYPTION_KEY is restored, and other credential ' +
+            'types may be affected by the same key change. Review the listed ones, then drop the stale ones ' +
+            'to re-enter — restoring the previous key instead recovers them all.',
+    };
+}
+/**
+ * Run the drift sweep and reconcile the per-workspace `key_drift` cards. `cipherFor` builds a
+ * cipher for an HKDF info tag (the facade supplies it from its ENCRYPTION_KEY). Returns counts
+ * for logging. Safe to call when unwired — it returns zeros.
+ */
+export async function sweepKeyDriftAndRaise(container, cipherFor, logger) {
+    const inventory = container.sealedSecretInventory;
+    const notifications = container.notifications;
+    if (!inventory || !notifications)
+        return { raised: 0, cleared: 0, affected: 0 };
+    const report = await sweepKeyDrift({ inventory, cipherFor, logger });
+    const affected = [
+        ...report.keyMismatch.map((ref) => ({ ref, reason: 'key-mismatch' })),
+        ...report.corrupt.map((ref) => ({ ref, reason: 'corrupt' })),
+    ];
+    // Group affected credentials by workspace (a null-workspace ref can't get a per-workspace card;
+    // both current sources always carry one, so a null is logged and skipped rather than dropped
+    // into a sentinel workspace).
+    const affectedByWs = new Map();
+    for (const { ref, reason } of affected) {
+        if (!ref.workspaceId) {
+            logger?.warn('key drift: affected secret has no workspace; not surfaced', {
+                source: ref.source,
+                id: ref.id,
+            });
+            continue;
+        }
+        const list = affectedByWs.get(ref.workspaceId) ?? [];
+        list.push(toAffected(ref, reason));
+        affectedByWs.set(ref.workspaceId, list);
+    }
+    // Every workspace that owns ANY scanned secret — so a workspace that just recovered (its
+    // secrets now all decrypt) has its stale card cleared.
+    const allWorkspaceIds = new Set();
+    for (const ref of [...report.ok, ...report.keyMismatch, ...report.corrupt]) {
+        if (ref.workspaceId)
+            allWorkspaceIds.add(ref.workspaceId);
+    }
+    const withOpenCard = new Set((await notifications.service.listOpenByType([...allWorkspaceIds], 'key_drift')).keys());
+    let raised = 0;
+    let cleared = 0;
+    for (const workspaceId of allWorkspaceIds) {
+        const list = affectedByWs.get(workspaceId);
+        if (list && list.length > 0) {
+            // Stable ordering so the card's dedup identity doesn't churn across sweeps.
+            list.sort((a, b) => a.source.localeCompare(b.source) || a.id.localeCompare(b.id));
+            const { title, body } = cardContent(list);
+            await notifications.service.raise(workspaceId, {
+                type: 'key_drift',
+                blockId: null,
+                executionId: null,
+                title,
+                body,
+                payload: { driftAffected: list },
+            });
+            raised += 1;
+        }
+        else if (withOpenCard.has(workspaceId) &&
+            (await notifications.service.clearByType(workspaceId, 'key_drift'))) {
+            cleared += 1;
+        }
+    }
+    return { raised, cleared, affected: affected.length };
+}
+//# sourceMappingURL=keyDrift.js.map

package/dist/runtime/keyDrift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyDrift.js","sourceRoot":"","sources":["../../src/runtime/keyDrift.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAI1D,iGAAiG;AACjG,+EAA+E;AAC/E,+FAA+F;AAC/F,iBAAiB;AACjB,6FAA6F;AAC7F,0EAA0E;AAC1E,iGAAiG;AACjG,iGAAiG;AACjG,gGAAgG;AAChG,EAAE;AACF,kGAAkG;AAClG,gGAAgG;AAEhG,8FAA8F;AAC9F,SAAS,UAAU,CAAC,GAAoB,EAAE,MAAkC;IAC1E,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAA;AAC7F,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,QAA4B;IAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,cAAc,CAAC,CAAC,MAAM,CAAA;IAC7E,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAA;IAC5C,MAAM,KAAK,GAAa,EAAE,CAAA;IAC1B,IAAI,UAAU,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,UAAU,0CAA0C,CAAC,CAAA;IACvF,IAAI,OAAO,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,kCAAkC,CAAC,CAAA;IACzE,OAAO;QACL,KAAK,EAAE,2CAA2C;QAClD,IAAI,EACF,YAAY,QAAQ,CAAC,MAAM,iDAAiD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YACjG,8FAA8F;YAC9F,iGAAiG;YACjG,qEAAqE;KACxE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAA0B,EAC1B,SAAyC,EACzC,MAA6B;IAE7B,MAAM,SAAS,GAAG,SAAS,CAAC,qBAAqB,CAAA;IACjD,MAAM,aAAa,GAAG,SAAS,CAAC,aAAa,CAAA;IAC7C,IAAI,CAAC,SAAS,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAA;IAE/E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;IACpE,MAAM,QAAQ,GAAwE;QACpF,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,cAAuB,EAAE,CAAC,CAAC;QAC9E,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC;KACtE,CAAA;IAED,gGAAgG;IAChG,6FAA6F;IAC7F,8BAA8B;IAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8B,CAAA;IAC1D,KAAK,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,QAAQ,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,MAAM,EAAE,IAAI,CAAC,2DAA2D,EAAE;gBACxE,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,EAAE,EAAE,GAAG,CAAC,EAAE;aACX,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAA;QAClC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,CAAA;IACzC,CAAC;IAED,yFAAyF;IACzF,uDAAuD;IACvD,MAAM,eAAe,GAAG,IAAI,GAAG,EAAU,CAAA;IACzC,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,WAAW;YAAE,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;IAC3D,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,GAAG,CAC1B,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,GAAG,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CACvF,CAAA;IAED,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,KAAK,MAAM,WAAW,IAAI,eAAe,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;QAC1C,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,4EAA4E;YAC5E,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;YACjF,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,CAAA;YACzC,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE;gBAC7C,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,IAAI;gBACb,WAAW,EAAE,IAAI;gBACjB,KAAK;gBACL,IAAI;gBACJ,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE;aACjC,CAAC,CAAA;YACF,MAAM,IAAI,CAAC,CAAA;QACb,CAAC;aAAM,IACL,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC;YAC7B,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,EACnE,CAAC;YACD,OAAO,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAA;AACvD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/server",
-  "version": "0.140.1",
+  "version": "0.140.2",
   "description": "Runtime-neutral HTTP layer for the Agent Architecture Board: the Hono controllers, middleware (auth/authz/CORS/error), request helpers and the gateway seams shared by every deployment facade (Cloudflare Worker, Node service).",
   "repository": {
     "type": "git",
@@ -31,13 +31,13 @@
     "p-map": "^7.0.5",
     "pino": "^10.3.1",
     "valibot": "^1.4.2",
-    "@cat-factory/agents": "0.67.0",
-    "@cat-factory/integrations": "0.88.13",
-    "@cat-factory/contracts": "0.154.0",
-    "@cat-factory/orchestration": "0.131.1",
-    "@cat-factory/kernel": "0.148.1",
-    "@cat-factory/spend": "0.12.67",
-    "@cat-factory/prompt-fragments": "0.13.47"
+    "@cat-factory/agents": "0.67.1",
+    "@cat-factory/contracts": "0.154.1",
+    "@cat-factory/integrations": "0.88.14",
+    "@cat-factory/kernel": "0.148.2",
+    "@cat-factory/orchestration": "0.131.2",
+    "@cat-factory/spend": "0.12.68",
+    "@cat-factory/prompt-fragments": "0.13.48"
   },
   "devDependencies": {
     "@types/node": "^26.1.1",