@code-yeongyu/senpi 2026.11.6-2 → 2026.11.6-3

package/dist/core/credential-pool/rotation-slots.d.ts

@@ -1,11 +1,11 @@
 import type { Credential } from "@earendil-works/pi-ai";
 import { type ConfigValue } from "@earendil-works/pi-ai/utils/config-reference";
+import type { PoolState } from "../egress/pool-state.ts";
 import type { RunSlot } from "./failover.ts";
 import type { AccountStrategy } from "./selection-order.ts";
-import { type CredentialSlotRepository } from "./state-store.ts";
 export type RotationLane = "stored" | "env";
 /** Hands a half-open probe lease back, if the slot still holds that exact lease. */
-export declare function releaseProbeLease(repository: CredentialSlotRepository, providerId: string, lane: RotationLane, slotName: string, leaseId: string): Promise<void>;
+export declare function releaseProbeLease(repository: PoolState, providerId: string, lane: RotationLane, slotName: string, leaseId: string): Promise<void>;
 export type RotationSlot = RunSlot & {
     lane: RotationLane;
     /** Env-lane key material for the attempt; never serialized or persisted. */
@@ -25,7 +25,7 @@ export type RotationSources = {
     providerId: string;
     credential: Credential | undefined;
     env: (name: string) => string | undefined;
-    repository: CredentialSlotRepository;
+    repository: PoolState;
     policy?: {
         affinity?: boolean;
         accountStrategy?: AccountStrategy;

package/dist/core/credential-pool/state-store.d.ts

@@ -149,7 +149,7 @@ export type HalfOpenLease = {
  * wins the probe lease; everyone else keeps treating the slot as unavailable
  * until the lease expires or the probe settles the block.
  */
-export declare function acquireHalfOpenLease(repository: CredentialSlotRepository, providerId: string, laneId: string, slotId: string, options?: {
+export declare function acquireHalfOpenLease(repository: Pick<CredentialSlotRepository, "mutateSlotState">, providerId: string, laneId: string, slotId: string, options?: {
     now?: number;
     leaseTtlMs?: number;
 }): Promise<HalfOpenLease | undefined>;

package/dist/core/egress/hpke.d.ts

@@ -0,0 +1,63 @@
+/**
+ * HPKE base mode (RFC 9180): DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-256-GCM, on Web Crypto only so the same code
+ * runs on Bun, Node, compiled binaries, the desktop renderer and Workers. Every wrap is single-shot (sequence 0).
+ *
+ * The recipient side takes a Diffie-Hellman function instead of a private key, so a recipient whose key never leaves
+ * hardware (a KMS key that only performs ECDH) opens wraps through the same code as a device key.
+ *
+ * Base mode authenticates nothing about the sender: anyone holding a recipient public key can produce a wrap that opens.
+ * A successful open proves only that the wrap was made for this key, so origin is established above this layer
+ * (signed wraps documents, per-dekId owners), never by an open.
+ */
+export type SealedFormatErrorCode = "open_failed" | "unsupported_version" | "invalid_public_key" | "invalid_private_key" | "invalid_key" | "invalid_aad" | "empty_secret";
+/** Errors carry a code only: no key material, ciphertext or plaintext is ever echoed. */
+export declare class SealedFormatError extends Error {
+    readonly code: SealedFormatErrorCode;
+    constructor(code: SealedFormatErrorCode);
+}
+/** A P-256 HPKE recipient. `dh` returns the 32-byte x-coordinate of the ECDH shared point with `peer`. */
+export interface HpkeRecipient {
+    /** Uncompressed SEC1 encoding (65 bytes, leading 0x04). */
+    readonly publicKey: Uint8Array;
+    dh(peer: Uint8Array): Promise<Uint8Array>;
+}
+export interface HpkeSealInput {
+    readonly info: Uint8Array;
+    readonly aad: Uint8Array;
+    readonly pt: Uint8Array;
+}
+export interface HpkeOpenInput {
+    readonly enc: Uint8Array;
+    readonly ct: Uint8Array;
+    readonly info: Uint8Array;
+    readonly aad: Uint8Array;
+}
+export interface HpkeSealed {
+    readonly enc: Uint8Array;
+    readonly ct: Uint8Array;
+}
+type Bytes = Uint8Array<ArrayBuffer>;
+/** A recipient whose private scalar is held in this process (device keys, tests). */
+export declare function p256Recipient(privateKey: Uint8Array, publicKey: Uint8Array): Promise<HpkeRecipient>;
+/** RFC 9180 Decap: the shared secret for `enc` addressed to `recipient`. */
+export declare function hpkeDecap(recipient: HpkeRecipient, enc: Uint8Array): Promise<Bytes>;
+/**
+ * RFC 9180 Encap with a caller-supplied ephemeral key pair. KNOWN-ANSWER TESTS ONLY: reusing an ephemeral key
+ * across wraps breaks HPKE's guarantees. Production sealing goes through {@link hpkeSealBase}, which mints one.
+ * @internal
+ */
+export declare function hpkeEncapDeterministic(recipientPublicKey: Uint8Array, ephemeralPrivateKey: Uint8Array, ephemeralPublicKey: Uint8Array): Promise<{
+    readonly enc: Uint8Array;
+    readonly sharedSecret: Uint8Array;
+}>;
+/** RFC 9180 KeySchedule for mode_base (no PSK). The exporter secret is not derived: the format never exports. */
+export declare function hpkeKeySchedule(sharedSecret: Uint8Array, info: Uint8Array): Promise<{
+    readonly key: Bytes;
+    readonly baseNonce: Bytes;
+}>;
+/** Single-shot HPKE seal (sequence 0) to `recipientPublicKey` under a freshly generated ephemeral key. */
+export declare function hpkeSealBase(recipientPublicKey: Uint8Array, input: HpkeSealInput): Promise<HpkeSealed>;
+/** Single-shot HPKE open (sequence 0). Any failure is the one code `open_failed`. */
+export declare function hpkeOpenBase(recipient: HpkeRecipient, input: HpkeOpenInput): Promise<Bytes>;
+export {};
+//# sourceMappingURL=hpke.d.ts.map

package/dist/core/egress/hpke.js

@@ -0,0 +1,188 @@
+/**
+ * HPKE base mode (RFC 9180): DHKEM(P-256, HKDF-SHA256), HKDF-SHA256, AES-256-GCM, on Web Crypto only so the same code
+ * runs on Bun, Node, compiled binaries, the desktop renderer and Workers. Every wrap is single-shot (sequence 0).
+ *
+ * The recipient side takes a Diffie-Hellman function instead of a private key, so a recipient whose key never leaves
+ * hardware (a KMS key that only performs ECDH) opens wraps through the same code as a device key.
+ *
+ * Base mode authenticates nothing about the sender: anyone holding a recipient public key can produce a wrap that opens.
+ * A successful open proves only that the wrap was made for this key, so origin is established above this layer
+ * (signed wraps documents, per-dekId owners), never by an open.
+ */
+const HPKE_V1 = "HPKE-v1";
+const KEM_ID = 0x0010; // DHKEM(P-256, HKDF-SHA256)
+const KDF_ID = 0x0001; // HKDF-SHA256
+const AEAD_ID = 0x0002; // AES-256-GCM
+const MODE_BASE = 0x00;
+const N_SECRET = 32;
+const N_DH = 32;
+const N_K = 32;
+const N_N = 12;
+const N_T = 16;
+const N_PK = 65;
+const HASH_LEN = 32;
+/** Errors carry a code only: no key material, ciphertext or plaintext is ever echoed. */
+export class SealedFormatError extends Error {
+    constructor(code) {
+        super(`sealed format: ${code}`);
+        this.name = "SealedFormatError";
+        this.code = code;
+    }
+}
+const encoder = new TextEncoder();
+const own = (view) => Uint8Array.from(view);
+function i2osp(value, length) {
+    const out = new Uint8Array(length);
+    for (let index = length - 1, rest = value; index >= 0; index--, rest = Math.floor(rest / 256))
+        out[index] = rest & 0xff;
+    return out;
+}
+function concat(...parts) {
+    const out = new Uint8Array(parts.reduce((total, part) => total + part.length, 0));
+    let offset = 0;
+    for (const part of parts) {
+        out.set(part, offset);
+        offset += part.length;
+    }
+    return out;
+}
+const KEM_SUITE_ID = concat(encoder.encode("KEM"), i2osp(KEM_ID, 2));
+const HPKE_SUITE_ID = concat(encoder.encode("HPKE"), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2));
+async function hmacSha256(key, data) {
+    const hmacKey = await crypto.subtle.importKey("raw", key, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    return new Uint8Array(await crypto.subtle.sign("HMAC", hmacKey, data));
+}
+// RFC 5869: an absent salt is HashLen zero bytes.
+async function hkdfExtract(salt, ikm) {
+    return hmacSha256(salt.length === 0 ? new Uint8Array(HASH_LEN) : own(salt), ikm);
+}
+async function hkdfExpand(prk, info, length) {
+    const out = new Uint8Array(length);
+    let previous = new Uint8Array();
+    for (let block = 1, offset = 0; offset < length; block++) {
+        previous = await hmacSha256(prk, concat(previous, info, Uint8Array.of(block)));
+        out.set(previous.subarray(0, Math.min(previous.length, length - offset)), offset);
+        offset += previous.length;
+    }
+    return out;
+}
+function labeledExtract(suiteId, salt, label, ikm) {
+    return hkdfExtract(salt, concat(encoder.encode(HPKE_V1), suiteId, encoder.encode(label), ikm));
+}
+function labeledExpand(suiteId, prk, label, info, length) {
+    return hkdfExpand(prk, concat(i2osp(length, 2), encoder.encode(HPKE_V1), suiteId, encoder.encode(label), info), length);
+}
+async function extractAndExpand(dh, kemContext) {
+    const eaePrk = await labeledExtract(KEM_SUITE_ID, new Uint8Array(), "eae_prk", dh);
+    return labeledExpand(KEM_SUITE_ID, eaePrk, "shared_secret", kemContext, N_SECRET);
+}
+async function importPublicKey(raw) {
+    if (raw.length !== N_PK || raw[0] !== 0x04)
+        throw new SealedFormatError("invalid_public_key");
+    try {
+        return await crypto.subtle.importKey("raw", own(raw), { name: "ECDH", namedCurve: "P-256" }, true, []);
+    }
+    catch {
+        throw new SealedFormatError("invalid_public_key");
+    }
+}
+function base64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+async function importPrivateKey(privateKey, publicKey) {
+    if (privateKey.length !== 32 || publicKey.length !== N_PK || publicKey[0] !== 0x04) {
+        throw new SealedFormatError("invalid_private_key");
+    }
+    try {
+        return await crypto.subtle.importKey("jwk", {
+            kty: "EC",
+            crv: "P-256",
+            d: base64Url(privateKey),
+            x: base64Url(publicKey.subarray(1, 33)),
+            y: base64Url(publicKey.subarray(33, 65)),
+        }, { name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    }
+    catch {
+        throw new SealedFormatError("invalid_private_key");
+    }
+}
+async function ecdh(privateKey, peer) {
+    const peerKey = await importPublicKey(peer);
+    return new Uint8Array(await crypto.subtle.deriveBits({ name: "ECDH", public: peerKey }, privateKey, N_DH * 8));
+}
+/** A recipient whose private scalar is held in this process (device keys, tests). */
+export async function p256Recipient(privateKey, publicKey) {
+    const key = await importPrivateKey(privateKey, publicKey);
+    return { publicKey: Uint8Array.from(publicKey), dh: (peer) => ecdh(key, peer) };
+}
+/** RFC 9180 Decap: the shared secret for `enc` addressed to `recipient`. */
+export async function hpkeDecap(recipient, enc) {
+    await importPublicKey(enc);
+    const dh = await recipient.dh(enc);
+    return extractAndExpand(dh, concat(enc, recipient.publicKey));
+}
+/**
+ * RFC 9180 Encap with a caller-supplied ephemeral key pair. KNOWN-ANSWER TESTS ONLY: reusing an ephemeral key
+ * across wraps breaks HPKE's guarantees. Production sealing goes through {@link hpkeSealBase}, which mints one.
+ * @internal
+ */
+export async function hpkeEncapDeterministic(recipientPublicKey, ephemeralPrivateKey, ephemeralPublicKey) {
+    const ephemeral = await importPrivateKey(ephemeralPrivateKey, ephemeralPublicKey);
+    return encapWith(recipientPublicKey, ephemeral, Uint8Array.from(ephemeralPublicKey));
+}
+async function encapWith(recipientPublicKey, ephemeral, enc) {
+    const dh = await ecdh(ephemeral, recipientPublicKey);
+    return { enc, sharedSecret: await extractAndExpand(dh, concat(enc, recipientPublicKey)) };
+}
+/** RFC 9180 KeySchedule for mode_base (no PSK). The exporter secret is not derived: the format never exports. */
+export async function hpkeKeySchedule(sharedSecret, info) {
+    const empty = new Uint8Array();
+    const pskIdHash = await labeledExtract(HPKE_SUITE_ID, empty, "psk_id_hash", empty);
+    const infoHash = await labeledExtract(HPKE_SUITE_ID, empty, "info_hash", info);
+    const context = concat(Uint8Array.of(MODE_BASE), pskIdHash, infoHash);
+    const secret = await labeledExtract(HPKE_SUITE_ID, sharedSecret, "secret", empty);
+    return {
+        key: await labeledExpand(HPKE_SUITE_ID, secret, "key", context, N_K),
+        baseNonce: await labeledExpand(HPKE_SUITE_ID, secret, "base_nonce", context, N_N),
+    };
+}
+async function aesGcmKey(key, usage) {
+    return crypto.subtle.importKey("raw", key, { name: "AES-GCM", length: N_K * 8 }, false, [usage]);
+}
+/** Single-shot HPKE seal (sequence 0) to `recipientPublicKey` under a freshly generated ephemeral key. */
+export async function hpkeSealBase(recipientPublicKey, input) {
+    await importPublicKey(recipientPublicKey);
+    const ephemeral = await crypto.subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, false, ["deriveBits"]);
+    const enc = new Uint8Array(await crypto.subtle.exportKey("raw", ephemeral.publicKey));
+    const { sharedSecret } = await encapWith(recipientPublicKey, ephemeral.privateKey, enc);
+    const { key, baseNonce } = await hpkeKeySchedule(sharedSecret, input.info);
+    const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv: baseNonce, additionalData: own(input.aad), tagLength: N_T * 8 }, await aesGcmKey(key, "encrypt"), own(input.pt));
+    sharedSecret.fill(0);
+    key.fill(0);
+    return { enc, ct: new Uint8Array(ct) };
+}
+/** Single-shot HPKE open (sequence 0). Any failure is the one code `open_failed`. */
+export async function hpkeOpenBase(recipient, input) {
+    if (input.ct.length < N_T)
+        throw new SealedFormatError("open_failed");
+    let sharedSecret;
+    let key;
+    try {
+        sharedSecret = await hpkeDecap(recipient, input.enc);
+        const schedule = await hpkeKeySchedule(sharedSecret, input.info);
+        key = schedule.key;
+        const pt = await crypto.subtle.decrypt({ name: "AES-GCM", iv: schedule.baseNonce, additionalData: own(input.aad), tagLength: N_T * 8 }, await aesGcmKey(key, "decrypt"), own(input.ct));
+        return new Uint8Array(pt);
+    }
+    catch {
+        throw new SealedFormatError("open_failed");
+    }
+    finally {
+        sharedSecret?.fill(0);
+        key?.fill(0);
+    }
+}
+//# sourceMappingURL=hpke.js.map

package/dist/core/egress/placement-claim.d.ts

@@ -0,0 +1,69 @@
+import { type RosterView, type ServiceSig } from "./roster-entries.ts";
+import { type LocalKeyVerification } from "./verified-keys.ts";
+import type { VerifierRevocation } from "./verifier-revocations.ts";
+export interface PlacementClaim {
+    readonly accountId: string;
+    readonly placementId: string;
+    readonly epoch: number;
+    /** Generation of the placement-registry key that signed this claim (4.6). */
+    readonly registryGeneration: number;
+    readonly issuedAt: number;
+    readonly expiresAt: number;
+}
+export interface SignedPlacementClaim {
+    readonly claim: PlacementClaim;
+    readonly sig: ServiceSig;
+}
+/** A claim may live at most 24 h; the brain renews it at half-life under the same epoch (4.6). */
+export declare const CLAIM_MAX_LIFETIME_MS = 86400000;
+/** Device-side tolerance for a claim's `issuedAt` in the hand's future (15.15 M-1); `MOVE_SKEW_MS` stays server-side. */
+export declare const CLAIM_ISSUE_SKEW_MS = 300000;
+export type ClaimVerdict = "valid" | "invalid" | "malformed" | "expired" | "superseded" | "unknown";
+/** The `provider.call.error` each refusal answers with (4.6, 15.14 M-3, C.P1). */
+export declare const CLAIM_VERDICT_ERRORS: {
+    readonly invalid: {
+        readonly code: "stale_epoch";
+        readonly retryable: false;
+    };
+    readonly malformed: {
+        readonly code: "claim_invalid";
+        readonly retryable: false;
+    };
+    readonly expired: {
+        readonly code: "claim_expired";
+        readonly retryable: true;
+    };
+    readonly superseded: {
+        readonly code: "registry_key_revoked";
+        readonly retryable: true;
+    };
+    readonly unknown: {
+        readonly code: "registry_key_unknown";
+        readonly retryable: true;
+    };
+};
+/** The highest epoch this hand accepted for one (account, registry generation), and the placement that held it. */
+export interface EpochFloor {
+    readonly epoch: number;
+    readonly placementId: string;
+}
+/** What this hand trusts when it checks a claim; supplied by the hand's executor (CK8), read fresh per check. */
+export interface ClaimTrust {
+    readonly accountId: string;
+    readonly records: readonly LocalKeyVerification[];
+    readonly roster: RosterView;
+    readonly revocations: readonly VerifierRevocation[];
+    epochFloor(accountId: string, registryGeneration: number): EpochFloor | undefined;
+}
+export interface ClaimClock {
+    readonly now: number;
+    readonly nowMono: number;
+}
+export interface ClaimVerifier {
+    verify(claim: unknown, clock: ClaimClock): Promise<ClaimVerdict>;
+}
+/** `ASCII(domain) || 0x00 || UTF8(canonicalJson(claim))`: the exact bytes the registry key signs (C.P1). */
+export declare function placementClaimSigningInput(claim: PlacementClaim): Uint8Array<ArrayBuffer>;
+/** The claim's verdict for this hand (custody design 4.6, 15.15, 15.16 and the total order of C.P1). */
+export declare function verifyPlacementClaim(value: unknown, trust: ClaimTrust, clock: ClaimClock): Promise<ClaimVerdict>;
+//# sourceMappingURL=placement-claim.d.ts.map

package/dist/core/egress/placement-claim.js

@@ -0,0 +1,115 @@
+/**
+ * Placement claims for hosted model-key custody (row CK7; custody design 2.2, 4.6, 15.15, 15.16, Appendix C.P1).
+ *
+ * The placement registry signs `{ claim, sig }` for the placement that currently owns a session. A hand executes a
+ * brain's request (provider.call.start/result, ToolHost dispatch, hook.model_request, custody.refresh.request) only
+ * when `verifyPlacementClaim` answers `valid`. The verdict is total and ordered (C.P1): closed envelope, roster
+ * freshness, key selection and local trust, signature/account/epoch/placement, lifetime bounds, expiry. Every input
+ * is untrusted; nothing here throws on bad input, and the hand records a new epoch floor only after `valid`.
+ *
+ * C.P1 checks local supersession before the signature, so a forged claim under a superseded generation also answers
+ * `superseded`. The hand executor (CK8) must audit-log every `superseded` verdict with `sig.keyId` and
+ * `claim.placementId`, as it does for `malformed`, so such a probe stays visible.
+ */
+import { canonicalJson } from "@earendil-works/pi-agent-core";
+import { verifyEcdsaP256Sha256 } from "./ecdsa-p256.js";
+import { rosterViewAt } from "./roster-entries.js";
+import { hasExactKeys, isRecord } from "./signed-statement.js";
+import { serviceEntryValidity } from "./verified-keys.js";
+/** A claim may live at most 24 h; the brain renews it at half-life under the same epoch (4.6). */
+export const CLAIM_MAX_LIFETIME_MS = 86_400_000;
+/** Device-side tolerance for a claim's `issuedAt` in the hand's future (15.15 M-1); `MOVE_SKEW_MS` stays server-side. */
+export const CLAIM_ISSUE_SKEW_MS = 300_000;
+const PLACEMENT_CLAIM_DOMAIN = "omo-custody/placement-claim/v1";
+/** The `provider.call.error` each refusal answers with (4.6, 15.14 M-3, C.P1). */
+export const CLAIM_VERDICT_ERRORS = {
+    invalid: { code: "stale_epoch", retryable: false },
+    malformed: { code: "claim_invalid", retryable: false },
+    expired: { code: "claim_expired", retryable: true },
+    superseded: { code: "registry_key_revoked", retryable: true },
+    unknown: { code: "registry_key_unknown", retryable: true },
+};
+/** `ASCII(domain) || 0x00 || UTF8(canonicalJson(claim))`: the exact bytes the registry key signs (C.P1). */
+export function placementClaimSigningInput(claim) {
+    const { accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt } = claim;
+    const payload = canonicalJson({ accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt });
+    const encoder = new TextEncoder();
+    return new Uint8Array([...encoder.encode(PLACEMENT_CLAIM_DOMAIN), 0, ...encoder.encode(payload)]);
+}
+const CLAIM_KEYS = ["accountId", "placementId", "epoch", "registryGeneration", "issuedAt", "expiresAt"];
+function closedRecord(value, keys) {
+    return isRecord(value) && hasExactKeys(value, keys) ? value : undefined;
+}
+const isText = (value) => typeof value === "string" && value.length > 0;
+/** A nonnegative safe integer, never -0 (C.P1 boundary rules: no fractions, non-finite values or -0 enter `C`). */
+const isCount = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && !Object.is(value, -0);
+/** The closed `{ claim, sig }` envelope, or `undefined` for any other shape (C.P1 canonical input). */
+function parseSignedPlacementClaim(value) {
+    const envelope = closedRecord(value, ["claim", "sig"]);
+    const claim = closedRecord(envelope?.claim, CLAIM_KEYS);
+    const sig = closedRecord(envelope?.sig, ["alg", "keyId", "sig"]);
+    if (!claim || !sig || sig.alg !== "ECDSA-P256-SHA256" || !isText(sig.keyId) || !isText(sig.sig))
+        return undefined;
+    const { accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt } = claim;
+    if (!isText(accountId) || !isText(placementId))
+        return undefined;
+    if (!isCount(epoch) || !isCount(registryGeneration) || !isCount(issuedAt) || !isCount(expiresAt))
+        return undefined;
+    return {
+        claim: { accountId, placementId, epoch, registryGeneration, issuedAt, expiresAt },
+        sig: { alg: "ECDSA-P256-SHA256", keyId: sig.keyId, sig: sig.sig },
+    };
+}
+/**
+ * The one registry entry of the claim's generation this hand may verify under. A roster entry of that generation that
+ * this device's records supersede is `superseded`; a missing, unchecked or ambiguous key is `unknown` (also when a
+ * superseded generation's entry has left the roster); only bad entries left is `invalid`.
+ */
+async function selectRegistryKey(claim, trust, view, clock) {
+    const candidates = view.serviceEntries.filter((entry) => entry.kind === "placement-registry" &&
+        entry.accountId === trust.accountId &&
+        entry.generation === claim.registryGeneration);
+    const context = { revocations: trust.revocations, now: clock.now, nowMono: clock.nowMono };
+    const validities = await Promise.all(candidates.map((entry) => serviceEntryValidity(entry, trust.accountId, trust.records, view, context)));
+    if (validities.includes("superseded"))
+        return { verdict: "superseded" };
+    const valid = candidates.filter((_, index) => validities[index] === "valid");
+    const [first] = valid;
+    if (first && valid.every((entry) => entry.sigKeyId === first.sigKeyId && entry.sigPk === first.sigPk))
+        return { entry: first };
+    const onlyBad = candidates.length > 0 && validities.every((validity) => validity === "invalid");
+    return { verdict: onlyBad ? "invalid" : "unknown" };
+}
+function belowFloor(claim, floor) {
+    if (!floor)
+        return false;
+    return claim.epoch < floor.epoch || (claim.epoch === floor.epoch && claim.placementId !== floor.placementId);
+}
+/** The claim's verdict for this hand (custody design 4.6, 15.15, 15.16 and the total order of C.P1). */
+export async function verifyPlacementClaim(value, trust, clock) {
+    const signed = parseSignedPlacementClaim(value);
+    if (!signed)
+        return "malformed";
+    const view = rosterViewAt(trust.roster, clock.now, clock.nowMono);
+    if (view.state === "unknown")
+        return "unknown";
+    const { claim, sig } = signed;
+    if (claim.accountId !== trust.accountId)
+        return "invalid";
+    const selection = await selectRegistryKey(claim, trust, view, clock);
+    if ("verdict" in selection)
+        return selection.verdict;
+    if (sig.keyId !== selection.entry.sigKeyId)
+        return "invalid";
+    if (!(await verifyEcdsaP256Sha256(selection.entry.sigPk, placementClaimSigningInput(claim), sig.sig)))
+        return "invalid";
+    if (belowFloor(claim, trust.epochFloor(claim.accountId, claim.registryGeneration)))
+        return "invalid";
+    const effectiveNow = Math.max(clock.now, view.rosterIssuedAt);
+    if (claim.expiresAt - claim.issuedAt > CLAIM_MAX_LIFETIME_MS ||
+        claim.issuedAt > effectiveNow + CLAIM_ISSUE_SKEW_MS ||
+        claim.issuedAt > view.rosterIssuedAt + CLAIM_MAX_LIFETIME_MS)
+        return "malformed";
+    return claim.expiresAt > effectiveNow ? "valid" : "expired";
+}
+//# sourceMappingURL=placement-claim.js.map

package/dist/core/egress/pool-state.d.ts

@@ -0,0 +1,18 @@
+import type { CredentialSlotState, StoredSlotRevisions } from "../credential-pool/state-store.ts";
+/**
+ * The credential-pool health that rotation reads and writes (senpi#5835): cooldowns, half-open probe leases and
+ * the revisions they are keyed by. On one machine it is the file-backed `CredentialSlotRepository`; a hosted brain
+ * supplies its own durable state behind the same calls.
+ */
+export interface PoolState {
+    listSlots(providerId: string, laneId: string): Promise<Record<string, CredentialSlotState>>;
+    /** Atomic read-modify-write of one slot; `stateVersion` increments on every write, undefined removes the slot. */
+    mutateSlotState(providerId: string, laneId: string, slotId: string, fn: (current: CredentialSlotState | undefined) => Omit<CredentialSlotState, "stateVersion"> | undefined): Promise<CredentialSlotState | undefined>;
+    storedSlotRevisions(providerId: string, slotName: string, material: {
+        key?: string;
+        access?: string;
+        refresh?: string;
+    }): Promise<StoredSlotRevisions>;
+    envCredentialRevision(envVarName: string, envValue: string): Promise<string>;
+}
+//# sourceMappingURL=pool-state.d.ts.map

package/dist/core/egress/pool-state.js

@@ -0,0 +1,5 @@
+// Compile-time proof that the fused implementation is today's repository, used as is.
+const fusedPoolState = (repository) => repository;
+void fusedPoolState;
+export {};
+//# sourceMappingURL=pool-state.js.map

package/dist/core/egress/sealed-format.d.ts

@@ -0,0 +1,101 @@
+import { type HpkeRecipient } from "./hpke.ts";
+export { SealedFormatError, type SealedFormatErrorCode } from "./hpke.ts";
+export type ProviderId = string;
+export type DeviceId = string;
+export type SecretField = "apiKey" | `credential:${number}` | `header:${string}` | `modelHeader:${string}:${string}` | "urlUserinfo" | `urlPath:${number}` | `urlQuery:${string}`;
+declare const sourceDigestBrand: unique symbol;
+declare const dekIdBrand: unique symbol;
+export type SourceDigest = string & {
+    readonly [sourceDigestBrand]: true;
+};
+export type DekId = string & {
+    readonly [dekIdBrand]: true;
+};
+/** The one boundary parser for a source digest read from an entry; a FieldAad cannot be built without one. */
+export declare function parseSourceDigest(value: string): SourceDigest;
+/** The one boundary parser for a dekId read from an entry; a FieldAad cannot be built without one. */
+export declare function parseDekId(value: string): DekId;
+export interface FieldAad {
+    readonly account: string;
+    readonly provider: ProviderId;
+    readonly owner: DeviceId;
+    readonly sourceDigest: SourceDigest;
+    readonly field: SecretField;
+    readonly dekId: DekId;
+}
+export type WrapKind = "cfg" | "dek" | "proj";
+export interface WrapPosition {
+    readonly account: string;
+    readonly kind: WrapKind;
+    readonly id: string;
+}
+export interface WrapAad extends WrapPosition {
+    readonly recipientKeyId: string;
+}
+export interface ConfigAad {
+    readonly accountId: string;
+    readonly version: number;
+    readonly cfgKeyId: string;
+}
+export declare const HPKE_SUITE = "DHKEM(P-256,HKDF-SHA256)/HKDF-SHA256/AES-256-GCM";
+export interface HpkeWrap {
+    readonly suite: typeof HPKE_SUITE;
+    readonly enc: string;
+    readonly ct: string;
+}
+export interface SealedBlob {
+    readonly nonce: string;
+    readonly ct: string;
+}
+export type FieldSource = "literal" | "env" | "command" | "oauth_access";
+export interface SealedFieldMeta {
+    readonly source: FieldSource;
+    readonly resolvedAt: number;
+    readonly expiresAt?: number;
+    readonly refreshable: boolean;
+}
+export type SealedField = ({
+    readonly v: 1;
+    readonly state: "sealed";
+    readonly meta: SealedFieldMeta;
+} & SealedBlob) | {
+    readonly v: 1;
+    readonly state: "unresolved";
+    readonly meta: {
+        readonly source: "env" | "command" | "oauth_access";
+        readonly attemptedAt: number;
+        readonly refreshable: true;
+    };
+};
+export interface ConfigEnvelope extends ConfigAad {
+    readonly v: 1;
+    readonly cfg: SealedBlob;
+}
+/** A recipient that knows its own key id: the opener's id, never one read from a stored wrap, enters the AAD. */
+export interface KeyedRecipient extends HpkeRecipient {
+    readonly keyId: string;
+}
+type Bytes = Uint8Array<ArrayBuffer>;
+/** @internal Exposed for the encoding vectors. */
+export declare function fieldAadBytes(aad: FieldAad): Bytes;
+/** @internal Exposed for the encoding vectors. */
+export declare function wrapAadBytes(aad: WrapAad): Bytes;
+/** @internal Exposed for the encoding vectors. */
+export declare function configAadBytes(aad: ConfigAad): Bytes;
+/** Strict: no padding, no foreign characters, no non-zero trailing bits, so one byte string has one encoding. */
+export declare function decodeBase64Url(value: string): Bytes;
+/** @internal Raw AES-256-GCM open, exposed for the external known-answer vector. Any failure is `open_failed`. */
+export declare function aes256GcmOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ct: Uint8Array): Promise<Bytes>;
+/** Seals one secret under the provider DEK. Empty secrets are never sealed. */
+export declare function sealField(dek: Uint8Array, aad: FieldAad, secret: string, meta: SealedFieldMeta): Promise<Extract<SealedField, {
+    state: "sealed";
+}>>;
+/** Opens a sealed field under the AAD the opener rebuilt from the entry and the requested position. */
+export declare function openField(dek: Uint8Array, aad: FieldAad, field: SealedField): Promise<Bytes>;
+export declare function sealConfig(kCfg: Uint8Array, aad: ConfigAad, plaintext: Uint8Array): Promise<SealedBlob>;
+/** Opens the config object; its AAD is rebuilt from the envelope's own public fields. */
+export declare function openConfig(kCfg: Uint8Array, envelope: ConfigEnvelope): Promise<Bytes>;
+export declare function wrapKey(recipientPublicKey: Uint8Array, aad: WrapAad, key: Uint8Array): Promise<HpkeWrap>;
+/** Opens a wrap at `position` with the recipient's own key id; nothing read from the wrap enters the AAD. */
+export declare function unwrapKey(recipient: KeyedRecipient, position: WrapPosition, wrap: HpkeWrap): Promise<Bytes>;
+//# sourceMappingURL=sealed-format.d.ts.map