@kubun/credential 0.14.0 → 0.14.1

package/lib/key-cache.d.ts

@@ -27,6 +27,12 @@ export type KeyCache = {
         contentKey: Uint8Array;
         branchID: string;
     } | null;
+    /**
+     * Whether an unexpired, current-version key is cached, without materialising a
+     * copy of it. Presence-only callers (`status`) use this so a probe never mints
+     * a secret buffer it immediately discards.
+     */
+    has(keyID: string, keyVersion: number): boolean;
     set(keyID: string, contentKey: Uint8Array, keyVersion: number, branchID: string): void;
     evict(keyID: string): void;
     evictAll(): void;

package/lib/key-cache.js

@@ -8,8 +8,8 @@ export function createKeyCache(params = {}) {
    *
    * Dropping the entry alone leaves the bytes wherever they are until a
    * collector reaches them. Zeroing is the part that can be guaranteed;
-   * JavaScript cannot promise no interpreter-level copy survives, and the design
-   * spec records that limit rather than implying hygiene it cannot deliver.
+   * JavaScript cannot promise no interpreter-level copy survives, so this is
+   * best-effort hygiene, not a guarantee that no copy of the key remains.
    */ function evict(keyID) {
         const cached = entries.get(keyID);
         if (cached != null) {
@@ -17,27 +17,48 @@ export function createKeyCache(params = {}) {
             entries.delete(keyID);
         }
     }
+    /**
+   * The still-valid cached entry for this key/version, or null — evicting a
+   * stale one on the way. A rotation invalidates the cache as surely as time
+   * does: serving the pre-rotation key would decrypt entries the rotation was
+   * retiring. Shared by `get` and `has` so both apply identical validity and
+   * lazy-eviction rules; neither exposes the buffer.
+   */ function live(keyID, keyVersion) {
+        const cached = entries.get(keyID);
+        if (cached == null) {
+            return null;
+        }
+        if (now() - cached.unlockedAt >= ttl || cached.keyVersion !== keyVersion) {
+            evict(keyID);
+            return null;
+        }
+        return cached;
+    }
     return {
         get (keyID, keyVersion) {
-            const cached = entries.get(keyID);
+            const cached = live(keyID, keyVersion);
             if (cached == null) {
                 return null;
             }
-            // A rotation invalidates the cache as surely as time does: serving the
-            // pre-rotation key would decrypt entries the rotation was retiring.
-            if (now() - cached.unlockedAt >= ttl || cached.keyVersion !== keyVersion) {
-                evict(keyID);
-                return null;
-            }
+            // The caller receives a private copy, never the cache's own buffer: the
+            // cache reserves the right to zero what it holds (on evict, replacement,
+            // expiry or lock), and a returned alias would let that zeroing corrupt a
+            // consumer still holding the key across an await.
             return {
-                contentKey: cached.contentKey,
+                contentKey: cached.contentKey.slice(),
                 branchID: cached.branchID
             };
         },
+        has (keyID, keyVersion) {
+            return live(keyID, keyVersion) != null;
+        },
         set (keyID, contentKey, keyVersion, branchID) {
             evict(keyID);
+            // Store a private clone so the caller's buffer is never the cached buffer:
+            // the caller may zero its own copy after use without disturbing the cache,
+            // and the cache may zero its clone on evict without disturbing the caller.
             entries.set(keyID, {
-                contentKey,
+                contentKey: contentKey.slice(),
                 keyVersion,
                 branchID,
                 unlockedAt: now()

package/lib/manager.js

@@ -28,6 +28,21 @@ export function createCredentialManager(params) {
         ...params.pinThrottle,
         now: params.now
     });
+    // Concurrency guards for `openKey`:
+    // - `inFlight` collapses a thundering herd of input-free opens of one key into
+    //   a single unwrap; each waiter then takes its own clone from the cache.
+    // - `keyGeneration` (bumped by `lock`) and `lockAllEpoch` (bumped by `lockAll`)
+    //   let a lock landing mid-open suppress that open's `cache.set`, so an open
+    //   begun before the lock cannot re-warm the cache the lock just cleared. The
+    //   in-flight read still returns its key — it was already authorized; the lock
+    //   only means "do not stay warm."
+    const inFlight = new Map();
+    const keyGeneration = new Map();
+    let lockAllEpoch = 0;
+    // Input-bearing opens (a supplied pin/passphrase) never dedup: their outcome
+    // and the PIN throttle are caller-specific, so one caller's attempt must not
+    // stand in for another's.
+    const hasSuppliedInputs = (inputs)=>inputs != null && Object.values(inputs).some((value)=>value != null);
     let floorPromise;
     /**
    * Floor the shared clock to the greatest stored entry HLC, once per manager.
@@ -151,18 +166,27 @@ export function createCredentialManager(params) {
         const key = await loadKey(keyID);
         const existing = await ownWrapping(keyID, key.version);
         const { contentKey, branchID } = await openKey(keyID, inputs);
-        const factors = change(factorsFromDescriptors(existing.factors, inputs));
         const suite = getSuite(key.suite);
         const wrappingID = runtime.getRandomID();
-        const { descriptors, iv, wrappedKey } = await suite.wrap({
-            runtime,
-            contentKey,
-            factors,
-            wrappingID,
-            keyID,
-            keyVersion: key.version,
-            methods
-        });
+        // `contentKey` is our own private clone from the cache; zero it once its use — this
+        // rewrap — is done, on success or throw. The `try` opens right after the
+        // acquisition so the caller-supplied `change` throwing also cannot leak it.
+        let wrapped;
+        try {
+            const factors = change(factorsFromDescriptors(existing.factors, inputs));
+            wrapped = await suite.wrap({
+                runtime,
+                contentKey,
+                factors,
+                wrappingID,
+                keyID,
+                keyVersion: key.version,
+                methods
+            });
+        } finally{
+            contentKey.fill(0);
+        }
+        const { descriptors, iv, wrappedKey } = wrapped;
         const replacement = {
             wrappingID,
             keyID,
@@ -197,7 +221,17 @@ export function createCredentialManager(params) {
    * failure this is depends on whether any of them COULD have opened with input
    * this device is able to ask for — locked and unopenable are the same event
    * with opposite remedies.
-   */ async function openKey(keyID, inputs) {
+   */ /**
+   * Recover a key's content key. Wrapped by `openKey`, which adds the input-free
+   * dedup; this is the actual open. Captures the lock generation and epoch at
+   * entry so a `lock`/`lockAll` that lands before the terminal `cache.set` can
+   * suppress it — the key is still returned to this caller, but the cache is not
+   * re-warmed behind a lock.
+   */ async function doOpenKey(keyID, inputs, genAtStart, epochAtStart) {
+        // `genAtStart`/`epochAtStart` are captured by `openKey` at the moment the
+        // caller entered — before any dedup wait — so a lock that lands while a
+        // waiter is queued still suppresses that waiter's eventual re-warm.
+        const lockedSince = ()=>(keyGeneration.get(keyID) ?? 0) !== genAtStart || lockAllEpoch !== epochAtStart;
         const key = await loadKey(keyID);
         const proven = new Set((await store.listKeyBranches(keyID, key.version)).map((branch)=>branch.branch_id));
         const winner = proven.size >= 2 ? selectWinningBranch([
@@ -212,6 +246,9 @@ export function createCredentialManager(params) {
                     branchID: cached.branchID
                 };
             }
+            // A fork-losing hit: `cached.contentKey` is our private clone that
+            // we are about to discard for a re-unwrap, so zero it rather than orphan it.
+            cached.contentKey.fill(0);
             cache.evict(keyID);
         }
         const suite = getSuite(key.suite);
@@ -258,7 +295,11 @@ export function createCredentialManager(params) {
                 // winner as the resolved branch converges post-fork writes even when an
                 // empty-label fallback wrapping is what actually opened.
                 const branchID = winner ?? wrapping.branch_id;
-                cache.set(keyID, contentKey, key.version, branchID);
+                // Suppress the re-warm if a lock landed while we were unwrapping: the
+                // caller still gets its key, but the cache stays cleared.
+                if (!lockedSince()) {
+                    cache.set(keyID, contentKey, key.version, branchID);
+                }
                 return {
                     contentKey,
                     version: key.version,
@@ -289,6 +330,55 @@ export function createCredentialManager(params) {
         }
         throw new CredentialUnopenable(keyID, reasons.join('; '));
     }
+    /**
+   * Open a key, collapsing concurrent input-free opens of the same key into one
+   * unwrap. A waiter shares only the fact that an open ran, then takes its own
+   * clone from the cache; on a miss — the leader hit a lock and skipped its set,
+   * or failed — it falls through to its own open. Input-bearing opens never join
+   * the herd (see `hasSuppliedInputs`).
+   */ async function openKey(keyID, inputs) {
+        // Captured once, at entry, so a lock landing while this call is queued behind
+        // another open still counts against it (see `doOpenKey`).
+        const genAtStart = keyGeneration.get(keyID) ?? 0;
+        const epochAtStart = lockAllEpoch;
+        if (hasSuppliedInputs(inputs)) {
+            return doOpenKey(keyID, inputs, genAtStart, epochAtStart);
+        }
+        // Join any open already in flight for this key; on a miss, re-contend for
+        // leadership rather than opening in parallel — so post-miss opens (a leader
+        // that failed or was lock-suppressed) serialize into one leader at a time
+        // instead of re-forming the herd.
+        while(true){
+            const pending = inFlight.get(keyID);
+            if (pending == null) {
+                break;
+            }
+            await pending;
+            const key = await loadKey(keyID);
+            const hit = cache.get(keyID, key.version);
+            if (hit != null) {
+                return {
+                    contentKey: hit.contentKey,
+                    version: key.version,
+                    branchID: hit.branchID
+                };
+            }
+        }
+        const run = doOpenKey(keyID, inputs, genAtStart, epochAtStart);
+        // A gate that never rejects, so a waiter's `await pending` cannot throw the
+        // leader's error into the wrong caller; the waiter re-derives its own result
+        // from the cache (or its own open) after the gate settles.
+        const gate = run.then(()=>undefined, ()=>undefined);
+        inFlight.set(keyID, gate);
+        try {
+            return await run;
+        } finally{
+            // Only clear our own entry — a later leader may already have replaced it.
+            if (inFlight.get(keyID) === gate) {
+                inFlight.delete(keyID);
+            }
+        }
+    }
     return {
         availableFactors () {
             // A passphrase or pin needs no key material, only someone to ask. They are
@@ -302,7 +392,9 @@ export function createCredentialManager(params) {
         },
         async unlock (keyID, inputs) {
             if (inputs?.pin == null) {
-                await openKey(keyID, inputs);
+                // Unlock only warms the cache; the returned clone is ours to zero.
+                ;
+                (await openKey(keyID, inputs)).contentKey.fill(0);
                 return;
             }
             // Refused BEFORE `openKey`, so a throttled attempt never reaches Argon2.
@@ -316,7 +408,8 @@ export function createCredentialManager(params) {
                 });
             }
             try {
-                await openKey(keyID, inputs);
+                ;
+                (await openKey(keyID, inputs)).contentKey.fill(0);
             } catch (error) {
                 // Only a rejected secret advances the counter. A key that is simply not
                 // addressed to this device, or whose suite is unknown, is not someone
@@ -378,9 +471,13 @@ export function createCredentialManager(params) {
             }, params?.methods);
         },
         lock (keyID) {
+            // Bump before evicting so an `openKey` already past its generation capture
+            // sees the change and skips its `cache.set`.
+            keyGeneration.set(keyID, (keyGeneration.get(keyID) ?? 0) + 1);
             cache.evict(keyID);
         },
         lockAll () {
+            lockAllEpoch += 1;
             cache.evictAll();
         },
         async status (keyID) {
@@ -397,7 +494,7 @@ export function createCredentialManager(params) {
                     reason: 'unsupported-suite'
                 };
             }
-            if (cache.get(keyID, key.version) != null) {
+            if (cache.has(keyID, key.version)) {
                 return {
                     state: 'unlocked'
                 };
@@ -461,6 +558,10 @@ export function createCredentialManager(params) {
                 wrappings,
                 methods: createParams.methods
             });
+            // The wrappings already encapsulate the content key; createKey never reads
+            // `built.contentKey` again, so zero it rather than leave the generated
+            // secret live until collection.
+            built.contentKey.fill(0);
             const keyParams = {
                 keyID: built.keyID,
                 ownerDID: built.ownerDID,
@@ -508,121 +609,134 @@ export function createCredentialManager(params) {
             // read, has to fail while the store is still untouched — past the first
             // write there is nothing here that could put it back.
             const previousKey = (await openKey(keyID, rotateParams?.inputs)).contentKey;
-            const retained = (await store.listWrappings(keyID, key.version)).map((wrapping)=>({
-                    recipientDID: wrapping.recipient_did,
-                    factors: factorsFromDescriptors(wrapping.factors, rotateParams?.inputs)
-                }));
-            const plaintexts = (await store.listEntries(keyID)).map((entry)=>{
-                // An entry left behind by a rotation that did not finish. Carrying it
-                // forward is impossible — its ciphertext is under a content key nothing
-                // holds — and skipping it would quietly strand it one version further.
-                if (entry.key_version !== key.version) {
-                    throw new CredentialKeyVersionMismatch(entry.entry_id, entry.key_version, key.version);
-                }
-                return {
-                    entryID: entry.entry_id,
-                    plaintext: previousSuite.decryptEntry({
-                        contentKey: previousKey,
-                        iv: new Uint8Array(entry.iv),
-                        ciphertext: new Uint8Array(entry.ciphertext),
-                        keyID,
-                        keyVersion: entry.key_version,
-                        entryID: entry.entry_id
-                    })
-                };
-            });
-            const contentKey = suite.generateContentKey(runtime);
-            // Signed before the entries and wrappings it labels — its branch is what
-            // they join — but persisted last, so the version bump still lands after
-            // the rows a reader needs at it. Signing touches no store, so this only
-            // moves the key-op's stamp ahead of the batch, which is where the branch
-            // it introduces belongs.
-            const rotatedKey = {
-                keyID,
-                ownerDID: key.owner_did,
-                suite: suiteID,
-                version: newVersion,
-                state: key.state === 'retired' ? 'retired' : 'active'
-            };
-            const rotatedKeyOp = await ops.key(rotatedKey, await nextHLC());
-            const branchID = rotatedKeyOp.branchID;
-            await store.recordKeyBranch({
-                keyID,
-                keyVersion: newVersion,
-                authorDID: rotatedKeyOp.authorDID,
-                hlc: rotatedKeyOp.hlc,
-                opJWT: rotatedKeyOp.opJWT,
-                opHash: rotatedKeyOp.opHash,
-                branchID: rotatedKeyOp.branchID
-            });
-            for (const { entryID, plaintext } of plaintexts){
-                const { iv, ciphertext } = suite.encryptEntry({
-                    runtime,
-                    contentKey,
-                    plaintext,
-                    keyID,
-                    keyVersion: newVersion,
-                    entryID
+            // Both key buffers are our private clones. One try spans from here to the end so
+            // a throw anywhere in the rotation zeros them, not only the success path.
+            // `previousKey` is read only in the plaintext-recovery loop; the generated
+            // key through the last write. It is declared here so the `finally` can zero
+            // it whether or not generation was reached.
+            let generatedKey;
+            try {
+                const retained = (await store.listWrappings(keyID, key.version)).map((wrapping)=>({
+                        recipientDID: wrapping.recipient_did,
+                        factors: factorsFromDescriptors(wrapping.factors, rotateParams?.inputs)
+                    }));
+                const plaintexts = (await store.listEntries(keyID)).map((entry)=>{
+                    // An entry left behind by a rotation that did not finish. Carrying it
+                    // forward is impossible — its ciphertext is under a content key nothing
+                    // holds — and skipping it would quietly strand it one version further.
+                    if (entry.key_version !== key.version) {
+                        throw new CredentialKeyVersionMismatch(entry.entry_id, entry.key_version, key.version);
+                    }
+                    return {
+                        entryID: entry.entry_id,
+                        plaintext: previousSuite.decryptEntry({
+                            contentKey: previousKey,
+                            iv: new Uint8Array(entry.iv),
+                            ciphertext: new Uint8Array(entry.ciphertext),
+                            keyID,
+                            keyVersion: entry.key_version,
+                            entryID: entry.entry_id
+                        })
+                    };
                 });
-                const entryParams = {
-                    entryID,
+                const contentKey = suite.generateContentKey(runtime);
+                generatedKey = contentKey;
+                // Signed before the entries and wrappings it labels — its branch is what
+                // they join — but persisted last, so the version bump still lands after
+                // the rows a reader needs at it. Signing touches no store, so this only
+                // moves the key-op's stamp ahead of the batch, which is where the branch
+                // it introduces belongs.
+                const rotatedKey = {
                     keyID,
-                    keyVersion: newVersion,
-                    iv,
-                    ciphertext,
-                    hlc: await nextHLC()
+                    ownerDID: key.owner_did,
+                    suite: suiteID,
+                    version: newVersion,
+                    state: key.state === 'retired' ? 'retired' : 'active'
                 };
-                await store.putEntry(entryParams, await ops.entry(entryParams, branchID));
-            }
-            for (const { recipientDID, factors } of retained){
-                const wrappingID = runtime.getRandomID();
-                const { descriptors, iv, wrappedKey } = await suite.wrap({
-                    runtime,
-                    contentKey,
-                    factors,
-                    wrappingID,
+                const rotatedKeyOp = await ops.key(rotatedKey, await nextHLC());
+                const branchID = rotatedKeyOp.branchID;
+                await store.recordKeyBranch({
                     keyID,
                     keyVersion: newVersion,
-                    methods: rotateParams?.methods
+                    authorDID: rotatedKeyOp.authorDID,
+                    hlc: rotatedKeyOp.hlc,
+                    opJWT: rotatedKeyOp.opJWT,
+                    opHash: rotatedKeyOp.opHash,
+                    branchID: rotatedKeyOp.branchID
                 });
-                const wrappingParams = {
-                    wrappingID,
-                    keyID,
-                    keyVersion: newVersion,
-                    factors: descriptors,
-                    iv,
-                    wrappedKey,
-                    recipientDID
-                };
-                await store.putWrapping(wrappingParams, await ops.wrapping(wrappingParams, await nextHLC(), branchID));
-            }
-            // The version and the suite have to land together — an entry encrypted
-            // under one and read under the other fails its tag — and the op speaks for
-            // the whole row either way, so both branches sign the same shape. The op
-            // was signed above so its label could tag the rows; it persists here.
-            if (suiteID === key.suite) {
-                await store.setKeyVersion(keyID, newVersion, rotatedKeyOp);
-            } else {
-                await store.putKey(rotatedKey, rotatedKeyOp);
-            }
-            // Listed before the sweep so every removed row gets a tombstone: the delete
-            // predicate spans versions, and a row it takes with no tombstone comes back
-            // the first time a peer that still holds it ships it over.
-            const superseded = (await store.listWrappings(keyID)).filter((wrapping)=>wrapping.key_version < newVersion);
-            const tombstones = [];
-            for (const wrapping of superseded){
-                tombstones.push(await ops.wrappingTombstone({
-                    subjectKind: 'wrapping',
-                    subjectID: wrapping.wrapping_id,
-                    keyID,
-                    keyVersion: wrapping.key_version
-                }, await nextHLC()));
+                for (const { entryID, plaintext } of plaintexts){
+                    const { iv, ciphertext } = suite.encryptEntry({
+                        runtime,
+                        contentKey,
+                        plaintext,
+                        keyID,
+                        keyVersion: newVersion,
+                        entryID
+                    });
+                    const entryParams = {
+                        entryID,
+                        keyID,
+                        keyVersion: newVersion,
+                        iv,
+                        ciphertext,
+                        hlc: await nextHLC()
+                    };
+                    await store.putEntry(entryParams, await ops.entry(entryParams, branchID));
+                }
+                for (const { recipientDID, factors } of retained){
+                    const wrappingID = runtime.getRandomID();
+                    const { descriptors, iv, wrappedKey } = await suite.wrap({
+                        runtime,
+                        contentKey,
+                        factors,
+                        wrappingID,
+                        keyID,
+                        keyVersion: newVersion,
+                        methods: rotateParams?.methods
+                    });
+                    const wrappingParams = {
+                        wrappingID,
+                        keyID,
+                        keyVersion: newVersion,
+                        factors: descriptors,
+                        iv,
+                        wrappedKey,
+                        recipientDID
+                    };
+                    await store.putWrapping(wrappingParams, await ops.wrapping(wrappingParams, await nextHLC(), branchID));
+                }
+                // The version and the suite have to land together — an entry encrypted
+                // under one and read under the other fails its tag — and the op speaks
+                // for the whole row either way, so both branches sign the same shape. The
+                // op was signed above so its label could tag the rows; it persists here.
+                if (suiteID === key.suite) {
+                    await store.setKeyVersion(keyID, newVersion, rotatedKeyOp);
+                } else {
+                    await store.putKey(rotatedKey, rotatedKeyOp);
+                }
+                // Listed before the sweep so every removed row gets a tombstone: the
+                // delete predicate spans versions, and a row it takes with no tombstone
+                // comes back the first time a peer that still holds it ships it over.
+                const superseded = (await store.listWrappings(keyID)).filter((wrapping)=>wrapping.key_version < newVersion);
+                const tombstones = [];
+                for (const wrapping of superseded){
+                    tombstones.push(await ops.wrappingTombstone({
+                        subjectKind: 'wrapping',
+                        subjectID: wrapping.wrapping_id,
+                        keyID,
+                        keyVersion: wrapping.key_version
+                    }, await nextHLC()));
+                }
+                await store.deleteWrappingsBelowVersion(keyID, newVersion, tombstones);
+                // The rotation's own key-op labels the branch it just made. `cache.set`
+                // stores its own clone, so zeroing the local generated key in the
+                // `finally` does not disturb the cached one.
+                cache.set(keyID, contentKey, newVersion, branchID);
+                return newVersion;
+            } finally{
+                previousKey.fill(0);
+                generatedKey?.fill(0);
             }
-            await store.deleteWrappingsBelowVersion(keyID, newVersion, tombstones);
-            // Zeroes `previousKey` on the way in, which is why nothing above may read
-            // it afterwards. The rotation's own key-op labels the branch it just made.
-            cache.set(keyID, contentKey, newVersion, branchID);
-            return newVersion;
         },
         async grant (keyID, recipientWrappableDID, params) {
             const key = await loadKey(keyID);
@@ -654,20 +768,27 @@ export function createCredentialManager(params) {
             // leave a wrapping nobody can open.
             const { contentKey, branchID } = await openKey(keyID);
             const wrappingID = runtime.getRandomID();
-            const { descriptors, iv, wrappedKey } = await getSuite(key.suite).wrap({
-                runtime,
-                contentKey,
-                factors: [
-                    {
-                        kind: 'did',
-                        recipientDID: recipientWrappableDID
-                    }
-                ],
-                wrappingID,
-                keyID,
-                keyVersion: key.version,
-                methods: params?.methods
-            });
+            const suite = getSuite(key.suite);
+            let wrapped;
+            try {
+                wrapped = await suite.wrap({
+                    runtime,
+                    contentKey,
+                    factors: [
+                        {
+                            kind: 'did',
+                            recipientDID: recipientWrappableDID
+                        }
+                    ],
+                    wrappingID,
+                    keyID,
+                    keyVersion: key.version,
+                    methods: params?.methods
+                });
+            } finally{
+                contentKey.fill(0);
+            }
+            const { descriptors, iv, wrappedKey } = wrapped;
             const granted = {
                 wrappingID,
                 keyID,
@@ -712,20 +833,25 @@ export function createCredentialManager(params) {
         },
         async putEntry (keyID, plaintext) {
             const { contentKey, version, branchID } = await openKey(keyID);
-            const key = await store.getKey(keyID);
-            const entry = buildCredentialEntry({
-                runtime,
-                key: {
-                    keyID,
-                    // The key's owner, not this device: an entry under a viewer's key
-                    // belongs to that viewer even when a server wrote it.
-                    ownerDID: key?.owner_did ?? identity.id,
-                    suite: key?.suite ?? SUITE_KUBUN_CRED_1,
-                    version,
-                    contentKey
-                },
-                plaintext
-            });
+            let entry;
+            try {
+                const key = await store.getKey(keyID);
+                entry = buildCredentialEntry({
+                    runtime,
+                    key: {
+                        keyID,
+                        // The key's owner, not this device: an entry under a viewer's key
+                        // belongs to that viewer even when a server wrote it.
+                        ownerDID: key?.owner_did ?? identity.id,
+                        suite: key?.suite ?? SUITE_KUBUN_CRED_1,
+                        version,
+                        contentKey
+                    },
+                    plaintext
+                });
+            } finally{
+                contentKey.fill(0);
+            }
             const entryParams = {
                 ...entry,
                 hlc: await nextHLC()
@@ -739,18 +865,25 @@ export function createCredentialManager(params) {
                 throw new CredentialNotFound('Credential entry', entryID);
             }
             const { contentKey, version, branchID } = await openKey(existing.key_id);
-            const suite = getSuite((await store.getKey(existing.key_id))?.suite ?? SUITE_KUBUN_CRED_1);
             // Re-encrypted under the key's CURRENT version, not the version the entry
             // was written at: an update is a fresh write, and leaving it behind would
-            // keep a rotated-away version alive indefinitely.
-            const { iv, ciphertext } = suite.encryptEntry({
-                runtime,
-                contentKey,
-                plaintext,
-                keyID: existing.key_id,
-                keyVersion: version,
-                entryID
-            });
+            // keep a rotated-away version alive indefinitely. The suite lookup's store
+            // read is inside the `try` so a rejection cannot leak the key copy.
+            let encrypted;
+            try {
+                const suite = getSuite((await store.getKey(existing.key_id))?.suite ?? SUITE_KUBUN_CRED_1);
+                encrypted = suite.encryptEntry({
+                    runtime,
+                    contentKey,
+                    plaintext,
+                    keyID: existing.key_id,
+                    keyVersion: version,
+                    entryID
+                });
+            } finally{
+                contentKey.fill(0);
+            }
+            const { iv, ciphertext } = encrypted;
             const updated = {
                 entryID,
                 keyID: existing.key_id,
@@ -777,18 +910,24 @@ export function createCredentialManager(params) {
                 throw new CredentialKeyVersionMismatch(entryID, entry.key_version, key.version);
             }
             const { contentKey, branchID } = await openKey(entry.key_id);
-            const entryBranchID = (await store.getOp('entry', entryID))?.branch_id ?? '';
-            if (entryBranchID !== '' && branchID !== '' && entryBranchID !== branchID) {
-                throw new CredentialSupersededBranch(entryID, entryBranchID, branchID);
+            // Zero our private clone on every exit — the branch-mismatch throw
+            // and the decrypt alike.
+            try {
+                const entryBranchID = (await store.getOp('entry', entryID))?.branch_id ?? '';
+                if (entryBranchID !== '' && branchID !== '' && entryBranchID !== branchID) {
+                    throw new CredentialSupersededBranch(entryID, entryBranchID, branchID);
+                }
+                return getSuite(key.suite).decryptEntry({
+                    contentKey,
+                    iv: new Uint8Array(entry.iv),
+                    ciphertext: new Uint8Array(entry.ciphertext),
+                    keyID: entry.key_id,
+                    keyVersion: entry.key_version,
+                    entryID
+                });
+            } finally{
+                contentKey.fill(0);
             }
-            return getSuite(key.suite).decryptEntry({
-                contentKey,
-                iv: new Uint8Array(entry.iv),
-                ciphertext: new Uint8Array(entry.ciphertext),
-                keyID: entry.key_id,
-                keyVersion: entry.key_version,
-                entryID
-            });
         },
         async getEntryProvenance (entryID) {
             const entry = await store.getEntryWithProvenance(entryID);
@@ -848,25 +987,36 @@ export function createCredentialManager(params) {
             // A target this device cannot open has to fail while the entry is still
             // where it was.
             const { contentKey: fromContentKey } = await openKey(entry.key_id);
-            const plaintext = getSuite(fromKey.suite).decryptEntry({
-                contentKey: fromContentKey,
-                iv: new Uint8Array(entry.iv),
-                ciphertext: new Uint8Array(entry.ciphertext),
-                keyID: entry.key_id,
-                keyVersion: entry.key_version,
-                entryID
-            });
+            let plaintext;
+            try {
+                plaintext = getSuite(fromKey.suite).decryptEntry({
+                    contentKey: fromContentKey,
+                    iv: new Uint8Array(entry.iv),
+                    ciphertext: new Uint8Array(entry.ciphertext),
+                    keyID: entry.key_id,
+                    keyVersion: entry.key_version,
+                    entryID
+                });
+            } finally{
+                fromContentKey.fill(0);
+            }
             const { contentKey: toContentKey, version, branchID } = await openKey(toKeyID);
             // The target's CURRENT version, as an update is: landing on an older one
             // would strand the entry the moment the key rotates.
-            const { iv, ciphertext } = getSuite(toKey.suite).encryptEntry({
-                runtime,
-                contentKey: toContentKey,
-                plaintext,
-                keyID: toKeyID,
-                keyVersion: version,
-                entryID
-            });
+            let reEncrypted;
+            try {
+                reEncrypted = getSuite(toKey.suite).encryptEntry({
+                    runtime,
+                    contentKey: toContentKey,
+                    plaintext,
+                    keyID: toKeyID,
+                    keyVersion: version,
+                    entryID
+                });
+            } finally{
+                toContentKey.fill(0);
+            }
+            const { iv, ciphertext } = reEncrypted;
             const moved = {
                 entryID,
                 keyID: toKeyID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/credential",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -23,8 +23,8 @@
     "@kubun/id": "^0.14.0",
     "@kubun/logger": "^0.14.0",
     "@kubun/store-credential": "^0.14.0",
-    "@noble/ciphers": "^2.3.0",
-    "@noble/hashes": "^2.3.0",
+    "@noble/ciphers": "^2.4.0",
+    "@noble/hashes": "^2.4.0",
     "@sozai/codec": "^0.4.0",
     "@sozai/runtime": "^0.1.0"
   },