@code-yeongyu/senpi 2026.11.6-2 → 2026.11.9-2

package/dist/core/egress/redact.js

@@ -0,0 +1,134 @@
+export const REDACTED = "<redacted>";
+const MIN_FRAGMENT = 8;
+const NO_NODE = -1;
+function newNode() {
+    return { next: new Map(), fail: 0, pattern: undefined, dictionary: NO_NODE };
+}
+function dedupe(patterns) {
+    const byText = new Map();
+    for (const pattern of patterns) {
+        const seen = byText.get(pattern.text);
+        if (seen === undefined || (seen.wholeToken && !pattern.wholeToken))
+            byText.set(pattern.text, pattern);
+    }
+    return [...byText.values()];
+}
+function isTokenChar(char) {
+    return char !== undefined && /[A-Za-z0-9]/.test(char);
+}
+/**
+ * Base64 characters that depend only on the secret's bytes when the secret starts `offset` bytes into a longer
+ * stream: character i covers bits [6i, 6i + 6), and it is kept only when that range lies inside the secret's bits.
+ */
+function alignedBase64Core(secret, offset, alphabet) {
+    const encoded = Buffer.concat([Buffer.alloc(offset), secret])
+        .toString(alphabet)
+        .replace(/=+$/, "");
+    const firstBit = offset * 8;
+    const lastBit = firstBit + secret.length * 8;
+    let core = "";
+    for (let i = 0; i < encoded.length; i++) {
+        if (i * 6 >= firstBit && i * 6 + 6 <= lastBit)
+            core += encoded[i];
+    }
+    return core;
+}
+function patternsFor(secret, publicPrefixes) {
+    const bytes = Buffer.from(secret, "utf8");
+    const patterns = [{ text: secret, wholeToken: true }];
+    const urlEncoded = encodeURIComponent(secret);
+    if (urlEncoded !== secret)
+        patterns.push({ text: urlEncoded, wholeToken: true });
+    for (const alphabet of ["base64", "base64url"]) {
+        patterns.push({ text: bytes.toString(alphabet), wholeToken: true });
+        for (const offset of [0, 1, 2]) {
+            const core = alignedBase64Core(bytes, offset, alphabet);
+            if (core.length >= MIN_FRAGMENT)
+                patterns.push({ text: core, wholeToken: false });
+        }
+    }
+    for (let i = 0; i + MIN_FRAGMENT <= secret.length; i++) {
+        const gram = secret.slice(i, i + MIN_FRAGMENT);
+        if (!publicPrefixes.some((prefix) => prefix.includes(gram)))
+            patterns.push({ text: gram, wholeToken: false });
+    }
+    return patterns;
+}
+function buildAutomaton(patterns) {
+    const nodes = [newNode()];
+    patterns.forEach((pattern, index) => {
+        let state = 0;
+        for (const char of pattern.text) {
+            let target = nodes[state].next.get(char);
+            if (target === undefined) {
+                target = nodes.length;
+                nodes.push(newNode());
+                nodes[state].next.set(char, target);
+            }
+            state = target;
+        }
+        nodes[state].pattern = index;
+    });
+    const queue = [...nodes[0].next.values()];
+    for (let head = 0; head < queue.length; head++) {
+        const state = queue[head];
+        for (const [char, target] of nodes[state].next) {
+            let fallback = nodes[state].fail;
+            while (fallback !== 0 && !nodes[fallback].next.has(char))
+                fallback = nodes[fallback].fail;
+            const candidate = nodes[fallback].next.get(char);
+            nodes[target].fail = candidate !== undefined && candidate !== target ? candidate : 0;
+            const fail = nodes[nodes[target].fail];
+            nodes[target].dictionary = fail.pattern !== undefined ? nodes[target].fail : fail.dictionary;
+            queue.push(target);
+        }
+    }
+    return nodes;
+}
+export function createRedactor(options) {
+    const patterns = dedupe(options.secrets
+        .filter((secret) => secret.length > 0)
+        .flatMap((secret) => patternsFor(secret, options.publicPrefixes)));
+    if (patterns.length === 0)
+        return { redact: (text) => text };
+    const nodes = buildAutomaton(patterns);
+    const lengths = patterns.map((pattern) => [...pattern.text].length);
+    return {
+        redact(text) {
+            const chars = [...text];
+            const spans = [];
+            let state = 0;
+            for (let end = 0; end < chars.length; end++) {
+                const char = chars[end];
+                while (state !== 0 && !nodes[state].next.has(char))
+                    state = nodes[state].fail;
+                state = nodes[state].next.get(char) ?? 0;
+                for (let match = nodes[state].pattern !== undefined ? state : nodes[state].dictionary; match !== NO_NODE; match = nodes[match].dictionary) {
+                    const index = nodes[match].pattern;
+                    const start = end - lengths[index] + 1;
+                    if (patterns[index].wholeToken && (isTokenChar(chars[start - 1]) || isTokenChar(chars[end + 1])))
+                        continue;
+                    spans.push([start, end + 1]);
+                }
+            }
+            if (spans.length === 0)
+                return text;
+            spans.sort((a, b) => a[0] - b[0]);
+            let out = "";
+            let cursor = 0;
+            let current = spans[0];
+            for (const span of spans.slice(1)) {
+                if (span[0] <= current[1]) {
+                    current = [current[0], Math.max(current[1], span[1])];
+                    continue;
+                }
+                out += chars.slice(cursor, current[0]).join("") + REDACTED;
+                cursor = current[1];
+                current = span;
+            }
+            out += chars.slice(cursor, current[0]).join("") + REDACTED + chars.slice(current[1]).join("");
+            return out;
+        },
+    };
+}
+//# sourceMappingURL=redact.js.map

package/dist/core/egress/sealed-format.d.ts

@@ -0,0 +1,101 @@
+import { type HpkeRecipient } from "./hpke.ts";
+export { SealedFormatError, type SealedFormatErrorCode } from "./hpke.ts";
+export type ProviderId = string;
+export type DeviceId = string;
+export type SecretField = "apiKey" | `credential:${number}` | `header:${string}` | `modelHeader:${string}:${string}` | "urlUserinfo" | `urlPath:${number}` | `urlQuery:${string}`;
+declare const sourceDigestBrand: unique symbol;
+declare const dekIdBrand: unique symbol;
+export type SourceDigest = string & {
+    readonly [sourceDigestBrand]: true;
+};
+export type DekId = string & {
+    readonly [dekIdBrand]: true;
+};
+/** The one boundary parser for a source digest read from an entry; a FieldAad cannot be built without one. */
+export declare function parseSourceDigest(value: string): SourceDigest;
+/** The one boundary parser for a dekId read from an entry; a FieldAad cannot be built without one. */
+export declare function parseDekId(value: string): DekId;
+export interface FieldAad {
+    readonly account: string;
+    readonly provider: ProviderId;
+    readonly owner: DeviceId;
+    readonly sourceDigest: SourceDigest;
+    readonly field: SecretField;
+    readonly dekId: DekId;
+}
+export type WrapKind = "cfg" | "dek" | "proj";
+export interface WrapPosition {
+    readonly account: string;
+    readonly kind: WrapKind;
+    readonly id: string;
+}
+export interface WrapAad extends WrapPosition {
+    readonly recipientKeyId: string;
+}
+export interface ConfigAad {
+    readonly accountId: string;
+    readonly version: number;
+    readonly cfgKeyId: string;
+}
+export declare const HPKE_SUITE = "DHKEM(P-256,HKDF-SHA256)/HKDF-SHA256/AES-256-GCM";
+export interface HpkeWrap {
+    readonly suite: typeof HPKE_SUITE;
+    readonly enc: string;
+    readonly ct: string;
+}
+export interface SealedBlob {
+    readonly nonce: string;
+    readonly ct: string;
+}
+export type FieldSource = "literal" | "env" | "command" | "oauth_access";
+export interface SealedFieldMeta {
+    readonly source: FieldSource;
+    readonly resolvedAt: number;
+    readonly expiresAt?: number;
+    readonly refreshable: boolean;
+}
+export type SealedField = ({
+    readonly v: 1;
+    readonly state: "sealed";
+    readonly meta: SealedFieldMeta;
+} & SealedBlob) | {
+    readonly v: 1;
+    readonly state: "unresolved";
+    readonly meta: {
+        readonly source: "env" | "command" | "oauth_access";
+        readonly attemptedAt: number;
+        readonly refreshable: true;
+    };
+};
+export interface ConfigEnvelope extends ConfigAad {
+    readonly v: 1;
+    readonly cfg: SealedBlob;
+}
+/** A recipient that knows its own key id: the opener's id, never one read from a stored wrap, enters the AAD. */
+export interface KeyedRecipient extends HpkeRecipient {
+    readonly keyId: string;
+}
+type Bytes = Uint8Array<ArrayBuffer>;
+/** @internal Exposed for the encoding vectors. */
+export declare function fieldAadBytes(aad: FieldAad): Bytes;
+/** @internal Exposed for the encoding vectors. */
+export declare function wrapAadBytes(aad: WrapAad): Bytes;
+/** @internal Exposed for the encoding vectors. */
+export declare function configAadBytes(aad: ConfigAad): Bytes;
+/** Strict: no padding, no foreign characters, no non-zero trailing bits, so one byte string has one encoding. */
+export declare function decodeBase64Url(value: string): Bytes;
+/** @internal Raw AES-256-GCM open, exposed for the external known-answer vector. Any failure is `open_failed`. */
+export declare function aes256GcmOpen(key: Uint8Array, nonce: Uint8Array, aad: Uint8Array, ct: Uint8Array): Promise<Bytes>;
+/** Seals one secret under the provider DEK. Empty secrets are never sealed. */
+export declare function sealField(dek: Uint8Array, aad: FieldAad, secret: string, meta: SealedFieldMeta): Promise<Extract<SealedField, {
+    state: "sealed";
+}>>;
+/** Opens a sealed field under the AAD the opener rebuilt from the entry and the requested position. */
+export declare function openField(dek: Uint8Array, aad: FieldAad, field: SealedField): Promise<Bytes>;
+export declare function sealConfig(kCfg: Uint8Array, aad: ConfigAad, plaintext: Uint8Array): Promise<SealedBlob>;
+/** Opens the config object; its AAD is rebuilt from the envelope's own public fields. */
+export declare function openConfig(kCfg: Uint8Array, envelope: ConfigEnvelope): Promise<Bytes>;
+export declare function wrapKey(recipientPublicKey: Uint8Array, aad: WrapAad, key: Uint8Array): Promise<HpkeWrap>;
+/** Opens a wrap at `position` with the recipient's own key id; nothing read from the wrap enters the AAD. */
+export declare function unwrapKey(recipient: KeyedRecipient, position: WrapPosition, wrap: HpkeWrap): Promise<Bytes>;
+//# sourceMappingURL=sealed-format.d.ts.map

package/dist/core/egress/sealed-format.js

@@ -0,0 +1,174 @@
+/**
+ * Sealed custody formats (C6, row CK3): provider fields under the provider DEK, the account config object under K_cfg,
+ * and HPKE key wraps (K_cfg, K_proj, DEK) to device and custody keys.
+ *
+ * Every AAD is rebuilt by the opener from its own context and never stored. Its bytes are a per-kind ASCII label, a NUL
+ * and the canonical JSON of a flat record whose members are all required strings or one safe integer: on that domain
+ * the encoding is injective, so a ciphertext cannot move between accounts, providers, owners, digests, positions, DEK
+ * generations, wrap kinds, recipient keys or format versions. The label names the format version and, for the raw
+ * AES-GCM paths, the exact algorithm: AES-256-GCM, 96-bit nonce, 128-bit tag.
+ *
+ * Nonces come from the CSPRNG only, never a counter: K_cfg is sealed by every enrolled device. NIST SP 800-38D allows
+ * 2^32 random-nonce seals per key; a DEK sees about fields x refreshes and K_cfg one seal per publish per device, both
+ * orders of magnitude below. AES-GCM is not key-committing; that is safe here because every key is 256-bit random and
+ * only a dekId's owner can submit a wrap for it, who could plant any value anyway. AES-GCM-SIV is not in Web Crypto.
+ */
+import { canonicalJson } from "@earendil-works/pi-agent-core";
+import { hpkeOpenBase, hpkeSealBase, SealedFormatError } from "./hpke.js";
+export { SealedFormatError } from "./hpke.js";
+const isSourceDigest = (value) => /^[A-Za-z0-9:_-]{1,256}$/.test(value);
+const isDekId = (value) => /^[A-Za-z0-9_-]{1,128}$/.test(value);
+/** The one boundary parser for a source digest read from an entry; a FieldAad cannot be built without one. */
+export function parseSourceDigest(value) {
+    if (!isSourceDigest(value))
+        throw new SealedFormatError("invalid_aad");
+    return value;
+}
+/** The one boundary parser for a dekId read from an entry; a FieldAad cannot be built without one. */
+export function parseDekId(value) {
+    if (!isDekId(value))
+        throw new SealedFormatError("invalid_aad");
+    return value;
+}
+export const HPKE_SUITE = "DHKEM(P-256,HKDF-SHA256)/HKDF-SHA256/AES-256-GCM";
+const NONCE_BYTES = 12;
+const TAG_BYTES = 16;
+const KEY_BYTES = 32;
+const encoder = new TextEncoder();
+function text(value) {
+    if (typeof value !== "string")
+        throw new SealedFormatError("invalid_aad");
+    return value;
+}
+function counter(value) {
+    if (typeof value !== "number" || !Number.isSafeInteger(value) || value < 0)
+        throw new SealedFormatError("invalid_aad");
+    return value;
+}
+function aadBytes(label, record) {
+    return encoder.encode(`${label}\u0000${canonicalJson(record)}`);
+}
+/** @internal Exposed for the encoding vectors. */
+export function fieldAadBytes(aad) {
+    return aadBytes("omo-custody/field-aad/v1", {
+        account: text(aad.account),
+        provider: text(aad.provider),
+        owner: text(aad.owner),
+        sourceDigest: text(aad.sourceDigest),
+        field: text(aad.field),
+        dekId: text(aad.dekId),
+    });
+}
+/** @internal Exposed for the encoding vectors. */
+export function wrapAadBytes(aad) {
+    return aadBytes("omo-custody/wrap-aad/v1", {
+        account: text(aad.account),
+        kind: text(aad.kind),
+        id: text(aad.id),
+        recipientKeyId: text(aad.recipientKeyId),
+    });
+}
+/** @internal Exposed for the encoding vectors. */
+export function configAadBytes(aad) {
+    return aadBytes("omo-custody/cfg-aad/v1", {
+        accountId: text(aad.accountId),
+        version: counter(aad.version),
+        cfgKeyId: text(aad.cfgKeyId),
+    });
+}
+const wrapInfo = (kind) => encoder.encode(`omo-custody/wrap/v1/${kind}`);
+function encodeBase64Url(bytes) {
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+/** Strict: no padding, no foreign characters, no non-zero trailing bits, so one byte string has one encoding. */
+export function decodeBase64Url(value) {
+    if (!/^[A-Za-z0-9_-]*$/.test(value) || value.length % 4 === 1)
+        throw new SealedFormatError("open_failed");
+    const binary = atob(value.replaceAll("-", "+").replaceAll("_", "/"));
+    const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+    if (encodeBase64Url(bytes) !== value)
+        throw new SealedFormatError("open_failed");
+    return bytes;
+}
+async function aesKey(key, usage) {
+    if (key.length !== KEY_BYTES)
+        throw new SealedFormatError("invalid_key");
+    return crypto.subtle.importKey("raw", Uint8Array.from(key), { name: "AES-GCM" }, false, [usage]);
+}
+async function aes256GcmSeal(key, aad, plaintext) {
+    const nonce = crypto.getRandomValues(new Uint8Array(NONCE_BYTES));
+    const ct = await crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce, additionalData: aad, tagLength: TAG_BYTES * 8 }, await aesKey(key, "encrypt"), plaintext);
+    return { nonce: encodeBase64Url(nonce), ct: encodeBase64Url(new Uint8Array(ct)) };
+}
+/** @internal Raw AES-256-GCM open, exposed for the external known-answer vector. Any failure is `open_failed`. */
+export async function aes256GcmOpen(key, nonce, aad, ct) {
+    const cryptoKey = await aesKey(key, "decrypt");
+    if (nonce.length !== NONCE_BYTES || ct.length < TAG_BYTES)
+        throw new SealedFormatError("open_failed");
+    try {
+        const pt = await crypto.subtle.decrypt({
+            name: "AES-GCM",
+            iv: Uint8Array.from(nonce),
+            additionalData: Uint8Array.from(aad),
+            tagLength: TAG_BYTES * 8,
+        }, cryptoKey, Uint8Array.from(ct));
+        return new Uint8Array(pt);
+    }
+    catch {
+        throw new SealedFormatError("open_failed");
+    }
+}
+const openBlob = (key, aad, blob) => aes256GcmOpen(key, decodeBase64Url(blob.nonce), aad, decodeBase64Url(blob.ct));
+function requireVersion1(v) {
+    if (v !== 1)
+        throw new SealedFormatError("unsupported_version");
+}
+/** Seals one secret under the provider DEK. Empty secrets are never sealed. */
+export async function sealField(dek, aad, secret, meta) {
+    if (secret.length === 0)
+        throw new SealedFormatError("empty_secret");
+    const blob = await aes256GcmSeal(dek, fieldAadBytes(aad), encoder.encode(secret));
+    return { v: 1, state: "sealed", ...blob, meta };
+}
+/** Opens a sealed field under the AAD the opener rebuilt from the entry and the requested position. */
+export async function openField(dek, aad, field) {
+    requireVersion1(field.v);
+    if (field.state !== "sealed")
+        throw new SealedFormatError("open_failed");
+    return openBlob(dek, fieldAadBytes(aad), field);
+}
+export function sealConfig(kCfg, aad, plaintext) {
+    return aes256GcmSeal(kCfg, configAadBytes(aad), Uint8Array.from(plaintext));
+}
+/** Opens the config object; its AAD is rebuilt from the envelope's own public fields. */
+export async function openConfig(kCfg, envelope) {
+    requireVersion1(envelope.v);
+    return openBlob(kCfg, configAadBytes(envelope), envelope.cfg);
+}
+export async function wrapKey(recipientPublicKey, aad, key) {
+    if (key.length === 0)
+        throw new SealedFormatError("invalid_key");
+    const sealed = await hpkeSealBase(recipientPublicKey, { info: wrapInfo(aad.kind), aad: wrapAadBytes(aad), pt: key });
+    return { suite: HPKE_SUITE, enc: encodeBase64Url(sealed.enc), ct: encodeBase64Url(sealed.ct) };
+}
+/** Opens a wrap at `position` with the recipient's own key id; nothing read from the wrap enters the AAD. */
+export async function unwrapKey(recipient, position, wrap) {
+    if (wrap.suite !== HPKE_SUITE)
+        throw new SealedFormatError("unsupported_version");
+    const aad = {
+        account: position.account,
+        kind: position.kind,
+        id: position.id,
+        recipientKeyId: recipient.keyId,
+    };
+    return hpkeOpenBase(recipient, {
+        enc: decodeBase64Url(wrap.enc),
+        ct: decodeBase64Url(wrap.ct),
+        info: wrapInfo(aad.kind),
+        aad: wrapAadBytes(aad),
+    });
+}
+//# sourceMappingURL=sealed-format.js.map

package/dist/core/egress/sealed-source.d.ts

@@ -0,0 +1,35 @@
+import { type CredentialSource, type EpochLeaseToken, type ReleaseScope, type SecretField, type SecretLease, type Unsealer } from "./credentials.ts";
+import type { HpkeWrap, ProviderId } from "./sealed-format.ts";
+export interface ReleasedItemPosition {
+    readonly accountId: string;
+    readonly providerId: ProviderId;
+    readonly entryDigest: string;
+    readonly field: SecretField;
+    /** The lease this release was made under: the opener rebuilds epoch and placementId from it (r11.2 C.5). */
+    readonly lease: EpochLeaseToken;
+}
+export interface SealedSourceDeps {
+    readonly accountId: string;
+    readonly unsealer: Unsealer;
+    readonly lease: () => Promise<EpochLeaseToken>;
+    readonly recipientPk: Uint8Array;
+    readonly reloadEntryDigest: (providerId: ProviderId) => Promise<string>;
+    readonly readHead: () => Promise<string>;
+    /** Rejects with the signal's reason once the step aborts. */
+    readonly sleep: (ms: number, signal: AbortSignal) => Promise<void>;
+    /** The abort signal of the step this release serves; it bounds the churn wait (custody design L844, C.3). */
+    readonly stepSignal: (scope: ReleaseScope) => AbortSignal;
+    /** Called once per step when the step enters the config-churn wait (C.3), so the caller can show one notice. */
+    readonly onChurnNotice: (scope: ReleaseScope) => void;
+    /** Opens one released item with this instance's recipient key; its HPKE info/AAD binding is fixed by r11.1. */
+    readonly openItem: (item: HpkeWrap, position: ReleasedItemPosition) => Promise<Uint8Array>;
+}
+/** Per egress instance (custody design 3.4): its leases live on the instance, never in module scope. */
+export declare class SealedCredentialSource implements CredentialSource {
+    #private;
+    constructor(deps: SealedSourceDeps);
+    resolve(providerId: ProviderId, entryDigest: string, fields: readonly SecretField[], scope: ReleaseScope): Promise<SecretLease>;
+    /** Disposes every live lease, and voids any lease still being resolved when the bump lands. */
+    bumpGeneration(): void;
+}
+//# sourceMappingURL=sealed-source.d.ts.map

package/dist/core/egress/sealed-source.js

@@ -0,0 +1,140 @@
+import { CredentialWait, SecretNotLeased, } from "./credentials.js";
+const RELOADS_PER_STEP = 3;
+const STABLE_HEAD_MS = 5000;
+const REDACTED = "<redacted>";
+const RETRYABLE = [
+    "stale_snapshot",
+    "epoch_mismatch",
+    "unresolved_field",
+    "wrap_missing",
+    "unavailable",
+];
+class SealedLease {
+    #values;
+    #onDispose;
+    constructor(values, onDispose) {
+        this.#values = values;
+        this.#onDispose = onDispose;
+    }
+    value(field) {
+        const bytes = this.#values?.get(field);
+        if (bytes === undefined)
+            throw new SecretNotLeased(field);
+        return new TextDecoder().decode(bytes);
+    }
+    [Symbol.dispose]() {
+        const values = this.#values;
+        if (values === undefined)
+            return;
+        this.#values = undefined;
+        for (const bytes of values.values())
+            bytes.fill(0);
+        this.#onDispose(this);
+    }
+    toJSON() {
+        return REDACTED;
+    }
+    toString() {
+        return REDACTED;
+    }
+    [Symbol.for("nodejs.util.inspect.custom")]() {
+        return REDACTED;
+    }
+}
+/** Per egress instance (custody design 3.4): its leases live on the instance, never in module scope. */
+export class SealedCredentialSource {
+    #deps;
+    #live = new Set();
+    #generation = 0;
+    constructor(deps) {
+        this.#deps = deps;
+    }
+    async resolve(providerId, entryDigest, fields, scope) {
+        if (new Set(fields).size !== fields.length)
+            throw new TypeError("a sealed release names each field at most once");
+        const step = { digest: entryDigest, reloads: 0, noticed: false };
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const generation = this.#generation;
+            const values = await this.#resolveValues(providerId, step, fields, scope);
+            if (generation === this.#generation) {
+                const lease = new SealedLease(values, (disposed) => this.#live.delete(disposed));
+                this.#live.add(lease);
+                return lease;
+            }
+            for (const bytes of values.values())
+                bytes.fill(0);
+        }
+        throw new CredentialWait("config-churn", true);
+    }
+    /** Disposes every live lease, and voids any lease still being resolved when the bump lands. */
+    bumpGeneration() {
+        this.#generation++;
+        for (const lease of [...this.#live])
+            lease[Symbol.dispose]();
+    }
+    /** One release attempt; `step` carries the reload count, notice latch and digest across bump retries (C.3). */
+    async #resolveValues(providerId, step, fields, scope) {
+        const signal = this.#deps.stepSignal(scope);
+        for (;;) {
+            signal.throwIfAborted();
+            const lease = await this.#deps.lease();
+            const result = await this.#release(providerId, step.digest, fields, scope, lease);
+            if (result.ok)
+                return this.#open(providerId, step.digest, fields, result.items, lease);
+            if (result.code !== "stale_snapshot")
+                throw new CredentialWait(result.code, RETRYABLE.some((code) => code === result.code));
+            if (step.reloads < RELOADS_PER_STEP) {
+                step.reloads++;
+            }
+            else {
+                // config-churn (C.3): every further stale retry re-enters the stable-head wait, never the immediate reloads.
+                if (!step.noticed) {
+                    step.noticed = true;
+                    this.#deps.onChurnNotice(scope);
+                }
+                await this.#waitForStableHead(signal);
+            }
+            step.digest = await this.#deps.reloadEntryDigest(providerId);
+        }
+    }
+    async #release(providerId, entryDigest, fields, scope, lease) {
+        return this.#deps.unsealer.release({
+            accountId: this.#deps.accountId,
+            providerId,
+            entryDigest,
+            fields,
+            lease,
+            recipientPk: this.#deps.recipientPk,
+            scope,
+        });
+    }
+    /** Returns once the head held still for STABLE_HEAD_MS; rejects when the step aborts first. */
+    async #waitForStableHead(signal) {
+        let previous = await this.#deps.readHead();
+        for (;;) {
+            await this.#deps.sleep(STABLE_HEAD_MS, signal);
+            const current = await this.#deps.readHead();
+            if (current === previous)
+                return;
+            previous = current;
+        }
+    }
+    async #open(providerId, entryDigest, fields, items, epochLease) {
+        if (items.length !== fields.length)
+            throw new CredentialWait("denied", false);
+        const values = new Map();
+        try {
+            for (const [index, field] of fields.entries()) {
+                const position = { accountId: this.#deps.accountId, providerId, entryDigest, field, lease: epochLease };
+                values.set(field, await this.#deps.openItem(items[index], position));
+            }
+        }
+        catch (error) {
+            for (const bytes of values.values())
+                bytes.fill(0);
+            throw error;
+        }
+        return values;
+    }
+}
+//# sourceMappingURL=sealed-source.js.map

package/dist/core/egress/verified-keys.js

@@ -39,7 +39,7 @@ function parseRecord(value) {
     if (!isRecord(value))
         return undefined;
     const raw = value;
-    if (!Object.keys(raw).every((key) => RECORD_KEYS.includes(key)))
+    if (!Object.keys(raw).every((key) => RECORD_KEYS.some((known) => known === key)))
         return undefined;
     const { kind, accountId, generation, sigKeyId, sigPkSha256, kemKeyId, kemPkSha256, kmsKeyArns, templateVersion, verifierKeyId, vouchedAt, supersedes, checkedAt, } = raw;
     if (kind !== "custody" && kind !== "placement-registry")