@foldrun/core 5.0.0 → 7.0.0

package/dist/src/evals.js

@@ -30,7 +30,7 @@
 // Deterministic checks run first and cost nothing. The judge only runs if
 // they pass — no point paying a model to grade output already known to be
 // wrong.
-import { accountModelEnv, withModelEnv } from "./model-env.js";
+import { accountModelEnv, withModelEnv, ModelKeyError } from "./model-env.js";
 import { sdkEnv } from "./step-exec.js";
 import { platformModelEnv } from "./runner.js";
 import fs from "node:fs";
@@ -582,7 +582,16 @@ export async function checkAssertion(assertion, output, agentDir, model, effort,
             catch (err) {
                 return { assertion, passed: false, detail: `judge not run — ${err instanceof Error ? err.message : String(err)}` };
             }
-            const said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            let said;
+            try {
+                said = await withModelEnv(m, (env) => judgeCall(assertion.value, output, model, effort, env));
+            }
+            catch (err) {
+                // The provider's URL refused on the host (FOL-95), like a missing key above.
+                if (!(err instanceof ModelKeyError))
+                    throw err;
+                return { assertion, passed: false, detail: `judge not run — ${err.message}` };
+            }
             const { passed, detail } = judgeVerdict(said.text);
             return { assertion, passed, detail, costUsd: said.costUsd };
         }

package/dist/src/model-env.d.ts

@@ -19,11 +19,20 @@ export declare function accountModelEnv(tenant: string, workspace: string, platf
     translator: TranslatorSpec | null;
 };
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export declare function withModelEnv<T>(m: {
     env: Record<string, string | undefined>;
     translator?: TranslatorSpec | null;
+    supply?: "provider" | "platform";
 }, fn: (env: Record<string, string | undefined>) => Promise<T>): Promise<T>;
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export declare function anthropicPassthrough(env: Record<string, string | undefined>): TranslatorSpec | null;

package/dist/src/model-env.js

@@ -8,7 +8,7 @@
 import { accountDir, workspaceDir, parseProvider, providerEnvFor } from "./store.js";
 import { readAgentsMd } from "./runner.js";
 import { getSecret } from "./secrets.js";
-import { platform } from "./platform.js";
+import { platform, hostUrlProblem } from "./platform.js";
 import { accountModelBlock, isClaudeLoginToken } from "./model-credential.js";
 import { providerPreset } from "./providers.js";
 import { startTranslator, translatorSpecFor } from "./translator.js";
@@ -39,6 +39,13 @@ export function accountModelEnv(tenant, workspace, platformEnv) {
             throw new ModelKeyError(NO_MODEL_KEY);
         return { env: platformEnv(), supply: "platform", format: "anthropic", translator: null };
     }
+    // A host-side call to a URL the tenant wrote: on a platform, https only
+    // (platform.ts hostUrlProblem); withModelEnv asks the platform's own check
+    // too, and the guard sees every byte (FOL-95). A step resolves its
+    // provider elsewhere (runner.ts) and is not touched by this.
+    const refused = hostUrlProblem(spec.baseUrl);
+    if (refused)
+        throw new ModelKeyError(`provider base_url refused: ${refused}`, 422);
     const sub = (text) => text.replace(/\$\{([A-Z][A-Z0-9_]*)\}/g, (whole, name) => getSecret(tenant, name, workspace)?.value ?? whole);
     const token = sub(spec.token);
     if (token.includes("${"))
@@ -65,14 +72,22 @@ export function accountModelEnv(tenant, workspace, platformEnv) {
     };
 }
 /**
- * Run `fn` with the model env, through a translator on this host when the
- * provider speaks Chat Completions or Responses — the same one a step uses
- * (runner.ts), started for this call and closed after it.
+ * Run `fn` with the model env, through a translator on this host — the one a
+ * step uses (runner.ts) when the provider speaks Chat Completions or
+ * Responses, and a passthrough when it speaks Anthropic's Messages (FOL-95):
+ * either way the SDK talks only to loopback, and the tenant's endpoint is
+ * reached through fetchUntrusted, after the platform's check of its URL.
+ * The platform's own credential (`supply: "platform"`) goes as it always did.
+ * Started for this call and closed after it.
  */
 export async function withModelEnv(m, fn) {
-    if (!m.translator)
+    const spec = m.translator ?? (m.supply === "provider" ? anthropicPassthrough(m.env) : null);
+    if (!spec)
         return fn(m.env);
-    const t = await startTranslator(m.translator);
+    const why = await platform.checkUntrustedUrl(spec.upstreamBase);
+    if (why)
+        throw new ModelKeyError(`provider base_url refused: ${why}`, 422);
+    const t = await startTranslator(spec);
     try {
         return await fn({ ...m.env, ...t.env });
     }
@@ -80,3 +95,26 @@ export async function withModelEnv(m, fn) {
         await t.close();
     }
 }
+/** The passthrough for an Anthropic-format provider, read back from the env
+ *  providerEnvFor (store.ts) built for it: the base URL, the key in the slot
+ *  that names its header, and ANTHROPIC_CUSTOM_HEADERS. Null with no base. */
+export function anthropicPassthrough(env) {
+    const base = env.ANTHROPIC_BASE_URL;
+    if (!base)
+        return null;
+    const apiKey = env.ANTHROPIC_API_KEY ?? "";
+    const headers = {};
+    for (const line of (env.ANTHROPIC_CUSTOM_HEADERS ?? "").split("\n")) {
+        const at = line.indexOf(":");
+        if (at > 0)
+            headers[line.slice(0, at).trim()] = line.slice(at + 1).trim();
+    }
+    return {
+        wire: "anthropic",
+        upstreamBase: base,
+        upstreamKey: apiKey || (env.ANTHROPIC_AUTH_TOKEN ?? ""),
+        upstreamAuth: apiKey ? "x-api-key" : "bearer",
+        headers,
+        label: base,
+    };
+}

package/dist/src/platform.d.ts

@@ -175,6 +175,16 @@ export interface PlatformHooks {
     fetchUntrusted(url: string, init?: RequestInit, opts?: {
         maxBytes?: number;
     }): Promise<Response>;
+    /**
+     * May the host call this URL a tenant chose — a provider's base_url,
+     * before an eval's judge or a dashboard draft talks to it? A reason it may
+     * not, or null. This is the early refusal people can read; the guarantee
+     * is that every byte of such a call goes through fetchUntrusted (FOL-95).
+     * Default: hostUrlProblem below — https on an install that guards
+     * untrusted fetches, anything on a laptop (its own localhost included).
+     * A platform may bind a stricter check (the addresses a name resolves to).
+     */
+    checkUntrustedUrl(url: string): Promise<string | null>;
     /**
      * Hand a notify: webhook to whatever delivers it. The platform records
      * the delivery, makes the first attempt now and retries on a backoff from
@@ -207,6 +217,20 @@ export interface WebhookDeliveryOutcome {
     retrying?: boolean;
 }
 export declare const platform: PlatformHooks;
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export declare function guardsUntrustedUrls(): boolean;
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export declare function hostUrlProblem(url: string): string | null;
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export declare function registerPlatform(hooks: Partial<PlatformHooks>): void;
 /**

package/dist/src/platform.js

@@ -12,6 +12,10 @@
 // and calls registerPlatform() once at boot. A process that forgets to is a
 // local install — which is exactly the failure that is safe.
 import { matchFilter } from "./trigger-filter.js";
+/** Marks the laptop's fetchUntrusted. A symbol from the global registry, not
+ *  the function itself: every bundle has its own copy of this module (see
+ *  KEY below), and only the shared object says which one was registered. */
+const LAPTOP_FETCH = Symbol.for("foldrun.laptop-fetch");
 const local = {
     edition: () => "self-hosted",
     async enqueueFlowRun(tenant, workspace, steps, flowName, modelOverride, tags = [], startedBy = null, opts = {}) {
@@ -40,7 +44,8 @@ const local = {
     platformKeyAllowed: () => true,
     galleryDir: () => null,
     noteOAuthRefresh: async () => undefined,
-    fetchUntrusted: (url, init) => fetch(url, init),
+    fetchUntrusted: Object.assign((url, init) => fetch(url, init), { [LAPTOP_FETCH]: true }),
+    checkUntrustedUrl: async (url) => hostUrlProblem(url),
     async deliverWebhook(tenant, workspace, delivery) {
         const { attemptWebhook, newDeliveryId } = await import("./notify.js");
         const deliveryId = newDeliveryId();
@@ -60,6 +65,35 @@ const local = {
 const KEY = Symbol.for("foldrun.platform");
 const g = globalThis;
 export const platform = (g[KEY] ??= { ...local });
+/** True when this process fetches tenant-chosen URLs through a guard: a
+ *  platform bound fetchUntrusted. A laptop has not, and calls its own LAN on
+ *  purpose. */
+export function guardsUntrustedUrls() {
+    return !platform.fetchUntrusted[LAPTOP_FETCH];
+}
+/**
+ * Why the host may not call a tenant's model endpoint at this URL, or null.
+ * On an install that guards untrusted fetches the endpoint must be https: the
+ * key rides in every request, and a plain-http base is also how a tenant
+ * names a cluster service. Private and internal addresses are refused by the
+ * guard itself, on every hop. FOLDRUN_EGRESS_ALLOW_PRIVATE=1 — the operator's
+ * own install calling its own network — lifts this as it lifts the guard. A
+ * laptop: always null.
+ */
+export function hostUrlProblem(url) {
+    if (!guardsUntrustedUrls() || process.env.FOLDRUN_EGRESS_ALLOW_PRIVATE === "1")
+        return null;
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return `${url} is not a URL`;
+    }
+    if (u.protocol !== "https:")
+        return `${u.origin} is not https — this platform calls a model endpoint only over https`;
+    return null;
+}
 /** Install the platform's implementations. Partial: what is not given keeps its local default. */
 export function registerPlatform(hooks) {
     Object.assign(platform, hooks, {

package/dist/src/runner.d.ts

@@ -387,6 +387,7 @@ grantsOnly?: boolean): {
         upstreamBase: string;
         wire?: import("./translator.ts").TranslatorWire;
         upstreamKey: string;
+        upstreamAuth?: "bearer" | "x-api-key";
         headers?: Record<string, string>;
         maxTokensParam?: "max_tokens" | "max_completion_tokens";
         reasoningEffort?: boolean;
@@ -400,6 +401,7 @@ grantsOnly?: boolean): {
         upstreamBase: string;
         wire?: import("./translator.ts").TranslatorWire;
         upstreamKey: string;
+        upstreamAuth?: "bearer" | "x-api-key";
         headers?: Record<string, string>;
         maxTokensParam?: "max_tokens" | "max_completion_tokens";
         reasoningEffort?: boolean;

package/dist/src/secrets.d.ts

@@ -31,8 +31,12 @@ interface StoredSecret {
      *  these sites alone. Metadata, not a value, so it is stored in the clear
      *  beside the ciphertext and survives the value being set again. */
     sites?: string[];
+    /** 2: sealed with the record's place as AAD — account, scope, name, kind,
+     *  key and sites (vaultAad). Absent: the older, unbound form. */
+    v?: 2;
 }
 type SecretsFile = Record<string, StoredSecret>;
+declare const writeBound: () => boolean;
 /**
  * Change one vault file safely: `change` gets what is stored now and returns
  * the new contents, or null to leave the file untouched. Returns what is
@@ -183,6 +187,11 @@ export declare function materializeSecrets(env: Record<string, string>,
 ctx?: {
     tenant: string;
     workspace?: string;
+    /** A rotated refresh token goes here INSTEAD of the vault: a caller that
+     *  cannot open the vault (the egress proxy without the install key)
+     *  keeps it itself and has it written by a process that can. `next` is
+     *  the stored value with the new refresh token. */
+    onRotate?: (name: string, usedValue: string, next: string) => unknown;
 }): Promise<Record<string, string>>;
 export interface ServiceAccountConfig {
     token_url: string;
@@ -254,6 +263,19 @@ export declare function basicAuthorization(username: string, password: string):
 export declare function setApiSecret(tenant: string, name: string, config: ApiConfig, workspace?: string): void;
 export declare function isApiValue(value: string): boolean;
 export declare function apiConfigOf(value: string): ApiConfig;
+/**
+ * Seal every unbound record of an account for its place (v2). Run at boot
+ * once the install writes bound records (FOLDRUN_VAULT_WRITE_BOUND=1), and by
+ * scripts/seal-vault-bindings.mjs. Per file, all or nothing: every unbound
+ * value is opened first, and a file holding one that will not open is left
+ * exactly as it is and reported. Idempotent: bound records are skipped.
+ */
+export declare function sealVaultBindings(tenant: string): {
+    sealed: number;
+    unreadable: string[];
+};
+/** Whether this install writes bound vault records (and migrates at boot). */
+export declare const vaultWritesBound: typeof writeBound;
 /**
  * Move an account's secrets from the install key onto its own key.
  *

package/dist/src/secrets.js

@@ -56,6 +56,12 @@ export function installKeyMaterial() {
     const fromEnv = process.env.FOLDRUN_SECRET_KEY;
     if (fromEnv)
         return fromEnv;
+    // A process that must never hold the install key (the egress proxy) says
+    // so; without this, asking for it would quietly mint a NEW random key on
+    // the shared data volume — a second root key nobody chose.
+    if (process.env.FOLDRUN_INSTALL_KEY_ABSENT === "1") {
+        throw new Error("this process runs without the install key (FOLDRUN_INSTALL_KEY_ABSENT=1) — whatever asked for it belongs in the worker");
+    }
     fs.mkdirSync(dataRoot(), { recursive: true });
     if (!fs.existsSync(keyFile())) {
         fs.writeFileSync(keyFile(), crypto.randomBytes(32).toString("hex"), { mode: 0o600 });
@@ -76,6 +82,81 @@ function secretsFile(tenant, workspace) {
     const base = fs.existsSync(legacy) ? legacy : path.join(dataRoot(), tenant, "workspaces", workspace);
     return path.join(base, "secrets.json");
 }
+// ------------------------------------------------------------ binding
+//
+// A v2 record is sealed with WHERE it belongs as additional authenticated
+// data: the account, the scope (account or which workspace), the name, its
+// kind, which key sealed it, and the sites it is bound to. Before 29 Oct 2026
+// (OWASP review) a record was bound to nothing: anyone who could write the
+// data volume or a backup could move one secret's ciphertext under another
+// name, scope or account, or rewrite its clear `sites` and have the egress
+// proxy fill it for their own host. Now any of those makes it fail to open,
+// which reads as "not set" — never as unbound.
+//
+// The place comes from the FILE the record is read from, never from fields
+// inside it. Sites stay in clear beside the ciphertext (listing needs no
+// key, and a pod from before v2 reads them there) and are authenticated by
+// the AAD.
+//
+// Rolled out in steps: every release since reads v2; FOLDRUN_VAULT_WRITE_BOUND=1
+// writes it and migrates existing records at boot; FOLDRUN_VAULT_REQUIRE_BOUND=1
+// refuses the old form once none is left.
+// The scope is account or workspace, not WHICH workspace: a workspace can be
+// renamed (its folder moves with its vault), and binding the name would make
+// every rename a re-seal racing other writers. What that leaves open — a
+// ciphertext moved between two workspaces of the same account by someone who
+// can already write the volume — is the residual, and stays inside one account.
+function vaultAad(tenant, workspace, name, rec) {
+    if (rec.sites !== undefined && (!Array.isArray(rec.sites) || rec.sites.some((x) => typeof x !== "string"))) {
+        throw new Error("malformed sites");
+    }
+    return Buffer.from(JSON.stringify(["foldrun-vault/2", tenant, workspace ? "w" : "a", name, rec.kind ?? "", rec.k ?? "install", [...(rec.sites ?? [])].sort()]), "utf8");
+}
+const writeBound = () => process.env.FOLDRUN_VAULT_WRITE_BOUND === "1";
+const requireBound = () => process.env.FOLDRUN_VAULT_REQUIRE_BOUND === "1";
+/** One record, sealed for its place. Bound (v2) when the install writes bound
+ *  records or `bound` says so; the unbound form otherwise. */
+function sealRecord(tenant, workspace, name, value, meta, bound = writeBound()) {
+    const { key, mark } = keyFor(tenant);
+    const rec = {
+        iv: "",
+        tag: "",
+        data: "",
+        updatedAt: meta.updatedAt ?? new Date().toISOString(),
+        ...(meta.kind ? { kind: meta.kind } : {}),
+        ...(mark ? { k: mark } : {}),
+        ...(meta.sites?.length ? { sites: [...meta.sites] } : {}),
+    };
+    const iv = crypto.randomBytes(12);
+    const cipher = crypto.createCipheriv("aes-256-gcm", key, iv, GCM);
+    if (bound) {
+        cipher.setAAD(vaultAad(tenant, workspace, name, rec));
+        rec.v = 2;
+    }
+    const enc = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+    rec.iv = iv.toString("base64");
+    rec.tag = cipher.getAuthTag().toString("base64");
+    rec.data = enc.toString("base64");
+    return rec;
+}
+/** A record's value, opened for its place; null when it will not open. */
+function openRecord(tenant, workspace, name, rec) {
+    if (!rec)
+        return null;
+    if (rec.v === 2) {
+        // Metadata someone rewrote into a shape that is not a list fails closed,
+        // like a bad tag — never as an exception up the read path.
+        let aad;
+        try {
+            aad = vaultAad(tenant, workspace, name, rec);
+        }
+        catch {
+            return null;
+        }
+        return decrypt(tenant, rec, aad);
+    }
+    return requireBound() ? null : decrypt(tenant, rec);
+}
 function read(tenant, workspace) {
     return readFile(secretsFile(tenant, workspace));
 }
@@ -162,18 +243,15 @@ export function setSecret(tenant, name, value, workspace, kind) {
     }
     if (value.length > 8192)
         throw new Error("secret too long");
-    const sealed = encryptValue(tenant, value);
     mutateVaultFile(secretsFile(tenant, workspace), (all) => {
         // A new value keeps the sites the old one was bound to: binding is a
         // property of the credential's use, not of its current value, and a
         // rotation that silently unbound it would put the new value in pods.
+        // Sealed here, under the lock: a bound record's AAD names those sites.
         const sites = all[name]?.sites;
-        all[name] = {
-            ...sealed,
-            updatedAt: new Date().toISOString(),
-            ...(kind ? { kind } : {}),
-            ...(sites?.length ? { sites } : {}),
-        };
+        // Once bound, always bound: a re-save with the switch off must not
+        // quietly drop the record's authentication.
+        all[name] = sealRecord(tenant, workspace, name, value, { kind, sites }, all[name]?.v === 2 || writeBound());
         return all;
     });
 }
@@ -205,6 +283,16 @@ export function setSecretSites(tenant, name, sites, workspace) {
         if (rec.kind === "client-cert" && clean.some((s) => s.startsWith("*."))) {
             throw new Error(`${name} is a client certificate — bind it to exact hosts, not a wildcard`);
         }
+        // A bound record names its sites in its seal: open it with the old
+        // binding and seal it again with the new one. One that will not open is
+        // refused, never relabelled.
+        if (rec.v === 2) {
+            const value = openRecord(tenant, workspace, name, rec);
+            if (value === null)
+                throw new Error(`${name} cannot be read with this install's keys — set its value again before binding it`);
+            all[name] = sealRecord(tenant, workspace, name, value, { kind: rec.kind, sites: clean, updatedAt: rec.updatedAt }, true);
+            return all;
+        }
         if (clean.length)
             rec.sites = clean;
         else
@@ -225,7 +313,11 @@ export function secretSites(tenant, names, workspace) {
     const own = workspace ? read(tenant, workspace) : {};
     const account = read(tenant);
     for (const name of names) {
-        const rec = own[name] ?? account[name];
+        // The record getSecret would take the VALUE from — the workspace's only
+        // when it opens, else the account's. Picking by presence paired an
+        // account value with a workspace record's (unauthenticated) sites.
+        const ownRec = own[name];
+        const rec = ownRec && openRecord(tenant, workspace, name, ownRec) !== null ? ownRec : account[name];
         if (rec?.sites?.length)
             out[name] = [...rec.sites];
     }
@@ -260,9 +352,12 @@ export function encryptValue(tenant, value) {
 export function decryptValue(tenant, rec) {
     return decrypt(tenant, rec);
 }
-function decrypt(tenant, rec) {
+function decrypt(tenant, rec, aad) {
     if (!rec)
         return null;
+    // A bound record opens only with its binding: one without is not a guess.
+    if (rec.v === 2 && !aad)
+        return null;
     try {
         // The record says which key wrote it. An unmarked one predates per-account
         // keys and is under the install key; guessing either way would turn a
@@ -286,6 +381,8 @@ function decrypt(tenant, rec) {
         }
         const decipher = crypto.createDecipheriv("aes-256-gcm", key, Buffer.from(rec.iv, "base64"), GCM);
         decipher.setAuthTag(Buffer.from(rec.tag, "base64"));
+        if (aad)
+            decipher.setAAD(aad);
         return Buffer.concat([
             decipher.update(Buffer.from(rec.data, "base64")),
             decipher.final(),
@@ -298,11 +395,11 @@ function decrypt(tenant, rec) {
 /** Nearest wins: a workspace secret shadows an account one of the same name. */
 export function getSecret(tenant, name, workspace) {
     if (workspace) {
-        const own = decrypt(tenant, read(tenant, workspace)[name]);
+        const own = openRecord(tenant, workspace, name, read(tenant, workspace)[name]);
         if (own !== null)
             return { value: own, scope: "workspace" };
     }
-    const shared = decrypt(tenant, read(tenant)[name]);
+    const shared = openRecord(tenant, undefined, name, read(tenant)[name]);
     return shared === null ? null : { value: shared, scope: "account" };
 }
 export function deleteSecret(tenant, name, workspace) {
@@ -408,7 +505,7 @@ export function rotateMasterKey(tenant, from, to) {
     const newKey = crypto.createHash("sha256").update(to).digest();
     const rewritten = [];
     const unreadable = [];
-    for (const { file } of secretFiles(tenant)) {
+    for (const { file, workspace } of secretFiles(tenant)) {
         let count = 0;
         mutateVaultFile(file, (all) => {
             const next = {};
@@ -423,10 +520,16 @@ export function rotateMasterKey(tenant, from, to) {
                     next[name] = rec;
                     continue;
                 }
+                // A bound record keeps its binding: same place, same AAD.
+                let aad = null;
                 let plain;
                 try {
+                    if (rec.v === 2)
+                        aad = vaultAad(tenant, workspace, name, rec);
                     const d = crypto.createDecipheriv("aes-256-gcm", oldKey, Buffer.from(rec.iv, "base64"), GCM);
                     d.setAuthTag(Buffer.from(rec.tag, "base64"));
+                    if (aad)
+                        d.setAAD(aad);
                     plain = Buffer.concat([d.update(Buffer.from(rec.data, "base64")), d.final()]).toString("utf8");
                 }
                 catch {
@@ -436,6 +539,8 @@ export function rotateMasterKey(tenant, from, to) {
                 }
                 const iv = crypto.randomBytes(12);
                 const c = crypto.createCipheriv("aes-256-gcm", newKey, iv, GCM);
+                if (aad)
+                    c.setAAD(aad);
                 const enc = Buffer.concat([c.update(plain, "utf8"), c.final()]);
                 next[name] = {
                     iv: iv.toString("base64"),
@@ -445,6 +550,10 @@ export function rotateMasterKey(tenant, from, to) {
                     // Kept: without it an oauth2 secret stops being refreshed after a
                     // rotation, and a file/ssh/api secret stops being materialised.
                     ...(rec.kind ? { kind: rec.kind } : {}),
+                    // Kept too (it was dropped until 29 Oct 2026): a rotation that
+                    // unbinds every bound secret puts their values into pods.
+                    ...(rec.sites?.length ? { sites: rec.sites } : {}),
+                    ...(aad ? { v: 2 } : {}),
                 };
                 count++;
             }
@@ -519,8 +628,11 @@ export function replaceOAuth2RefreshToken(tenant, name, workspace, usedValue, re
         let replaced = false;
         mutateVaultFile(secretsFile(tenant, scope), (all) => {
             const rec = all[name];
-            if (rec && decrypt(tenant, rec) === usedValue) {
-                all[name] = { ...rec, ...encryptValue(tenant, next), updatedAt: new Date().toISOString() };
+            if (rec && openRecord(tenant, scope, name, rec) === usedValue) {
+                // Built whole, not spread over the old record: a spread kept a stale
+                // `k: "tenant"` when this seal fell back to the install key, and the
+                // record then opened with neither.
+                all[name] = sealRecord(tenant, scope, name, next, { kind: rec.kind, sites: rec.sites }, rec.v === 2 || writeBound());
                 replaced = true;
             }
             return all;
@@ -641,7 +753,9 @@ ctx) {
                     // the next run does not refresh again.
                     const next = OAUTH2_PREFIX + JSON.stringify({ ...config, refresh_token: live.rotated });
                     try {
-                        if (ctx)
+                        if (ctx?.onRotate)
+                            await ctx.onRotate(name, value, next);
+                        else if (ctx)
                             replaceOAuth2RefreshToken(ctx.tenant, name, ctx.workspace, value, live.rotated);
                     }
                     catch {
@@ -849,7 +963,7 @@ export function setClientCertSecret(tenant, name, config, workspace) {
     };
     if (!SECRET_NAME.test(name))
         throw new Error(`secret name "${name}" must be UPPER_SNAKE_CASE`);
-    const sealed = encryptValue(tenant, CLIENT_CERT_PREFIX + JSON.stringify(stored));
+    const plainCert = CLIENT_CERT_PREFIX + JSON.stringify(stored);
     // Written under the vault's own lock, with the binding checked in the same
     // step: a value set over a secret keeps its site binding, and a wildcard
     // one would present the certificate to a whole domain.
@@ -858,7 +972,7 @@ export function setClientCertSecret(tenant, name, config, workspace) {
         if (sites?.some((site) => site.startsWith("*."))) {
             throw new Error(`${name} is bound to ${sites.join(", ")} — a client certificate is bound to exact hosts; unbind the wildcard first`);
         }
-        all[name] = { ...sealed, updatedAt: new Date().toISOString(), kind: "client-cert", ...(sites?.length ? { sites } : {}) };
+        all[name] = sealRecord(tenant, workspace, name, plainCert, { kind: "client-cert", sites }, all[name]?.v === 2 || writeBound());
         return all;
     });
 }
@@ -944,6 +1058,46 @@ export function isApiValue(value) {
 export function apiConfigOf(value) {
     return JSON.parse(value.slice(API_PREFIX.length));
 }
+/**
+ * Seal every unbound record of an account for its place (v2). Run at boot
+ * once the install writes bound records (FOLDRUN_VAULT_WRITE_BOUND=1), and by
+ * scripts/seal-vault-bindings.mjs. Per file, all or nothing: every unbound
+ * value is opened first, and a file holding one that will not open is left
+ * exactly as it is and reported. Idempotent: bound records are skipped.
+ */
+export function sealVaultBindings(tenant) {
+    assertSafeName(tenant, "tenant");
+    let sealed = 0;
+    const unreadable = [];
+    for (const { file, workspace } of secretFiles(tenant)) {
+        mutateVaultFile(file, (all) => {
+            const plain = new Map();
+            const bad = [];
+            for (const [name, rec] of Object.entries(all)) {
+                if (rec.v === 2)
+                    continue;
+                const value = decrypt(tenant, rec);
+                if (value === null)
+                    bad.push(workspace ? `${workspace}/${name}` : name);
+                else
+                    plain.set(name, value);
+            }
+            unreadable.push(...bad);
+            if (plain.size === 0 || bad.length)
+                return null;
+            const next = { ...all };
+            for (const [name, value] of plain) {
+                const rec = all[name];
+                next[name] = sealRecord(tenant, workspace, name, value, { kind: rec.kind, sites: rec.sites, updatedAt: rec.updatedAt }, true);
+            }
+            sealed += plain.size;
+            return next;
+        });
+    }
+    return { sealed, unreadable };
+}
+/** Whether this install writes bound vault records (and migrates at boot). */
+export const vaultWritesBound = writeBound;
 /**
  * Move an account's secrets from the install key onto its own key.
  *
@@ -958,7 +1112,7 @@ export function rewrapTenantSecrets(tenant) {
         return { moved: 0, unreadable: [] };
     let moved = 0;
     const unreadable = [];
-    for (const { file } of secretFiles(tenant)) {
+    for (const { file, workspace } of secretFiles(tenant)) {
         // Under the vault's lock: every pod runs this at boot, and a save made
         // between our read and our write must not be lost.
         mutateVaultFile(file, (all) => {
@@ -967,7 +1121,7 @@ export function rewrapTenantSecrets(tenant) {
             for (const [name, rec] of Object.entries(all)) {
                 if (rec.k === "tenant")
                     continue; // already moved
-                const value = decrypt(tenant, rec);
+                const value = openRecord(tenant, workspace, name, rec);
                 if (value === null) {
                     unreadableHere.push(name);
                     continue;
@@ -982,12 +1136,7 @@ export function rewrapTenantSecrets(tenant) {
                 return null;
             const next = { ...all };
             for (const [name, value] of plain) {
-                next[name] = {
-                    ...encryptValue(tenant, value),
-                    updatedAt: all[name].updatedAt,
-                    ...(all[name].kind ? { kind: all[name].kind } : {}),
-                    ...(all[name].sites?.length ? { sites: all[name].sites } : {}),
-                };
+                next[name] = sealRecord(tenant, workspace, name, value, { kind: all[name].kind, sites: all[name].sites, updatedAt: all[name].updatedAt }, all[name].v === 2 || writeBound());
             }
             moved += plain.size;
             return next;

package/dist/src/translator.d.ts

@@ -11,15 +11,21 @@ export declare function anthropicUsage(u: Json | undefined, wire: TranslatorWire
     cached: number;
     output: number;
 };
-export type TranslatorWire = "chat" | "responses";
+/** `anthropic` is no translation at all: the host-side passthrough for an
+ *  endpoint that already speaks Messages, so the SDK on the host talks only
+ *  to loopback and every byte to the tenant's URL goes through the guard
+ *  (FOL-95). A step never gets it (translatorSpecFor returns null there). */
+export type TranslatorWire = "chat" | "responses" | "anthropic";
 export interface TranslatorSpec {
     /** The provider's base, e.g. https://api.openai.com/v1 — `/chat/completions`
      *  or `/responses` is appended, by `wire`. */
     upstreamBase: string;
     /** Which OpenAI shape the endpoint speaks. Default chat. */
     wire?: TranslatorWire;
-    /** Already resolved. Sent as `Authorization: Bearer`. */
+    /** Already resolved. Sent as `Authorization: Bearer`, or as `x-api-key`
+     *  where `upstreamAuth` says so (the anthropic wire only). */
     upstreamKey: string;
+    upstreamAuth?: "bearer" | "x-api-key";
     /** Extra headers the provider wants, already resolved. */
     headers?: Record<string, string>;
     maxTokensParam?: "max_tokens" | "max_completion_tokens";