@sema-agent/server 7.146.0 → 7.148.0

package/dist/runtime-caps-resolver.js

@@ -37,6 +37,12 @@ const CENTER_ENGINE_CAP_KEYS = [
     "allowBypassPermissions",
     "allowMemoryOptOut",
 ];
+export const AUTO_MODE_REFUSED_BY = ["center.autoMode", "center.allowAutoMode", "both"];
+export function autoModeRefusedByOf(ent) {
+    const byAutoMode = ent.autoMode === false;
+    const byAllowAutoMode = ent.allowAutoMode === false;
+    return byAutoMode && byAllowAutoMode ? "both" : byAutoMode ? "center.autoMode" : byAllowAutoMode ? "center.allowAutoMode" : undefined;
+}
 export function toCoreRuntimeCaps(ent) {
     if (!ent)
         return undefined;
@@ -53,7 +59,7 @@ export function toCoreRuntimeCaps(ent) {
         caps.allowFork = ent.allowFork;
     if (typeof ent.allowObservers === "boolean")
         caps.allowObservers = ent.allowObservers;
-    if (ent.autoMode === false || ent.allowAutoMode === false)
+    if (autoModeRefusedByOf(ent) !== undefined)
         caps.autoMode = false;
     else if (ent.autoMode === true)
         caps.autoMode = true;
@@ -87,10 +93,16 @@ export function gateExecutionLane(ruling, ownLane, logger = defaultLogger) {
 export function createPrincipalEntitlementsClient(opts) {
     const ttlMs = opts.ttlMs ?? 60_000;
     const denyTtlMs = opts.denyTtlMs ?? Math.min(ttlMs, 10_000);
-    const fetchImpl = opts.fetchImpl ?? fetch;
     const fetchCaps = opts.fetchCaps ?? fetchPrincipalCaps;
     const now = opts.now ?? (() => Date.now());
     const onError = opts.onError ?? ((err, principal) => defaultLogger.warn("runtime_caps_resolve_failed", { principal, err: String(err) }));
+    const audit = (err, principal) => {
+        try {
+            onError(err, principal);
+        }
+        catch {
+        }
+    };
     const binNow = createIdentityBins(opts.center.credential, (credential) => ({
         center: { baseUrl: opts.center.baseUrl, credential },
         cache: new Map(),
@@ -123,12 +135,13 @@ export function createPrincipalEntitlementsClient(opts) {
             return dup;
         const p = (async () => {
             try {
-                const r = await fetchCaps(bin.center, principal, cached?.etag, fetchImpl, opts.worker);
+                const r = await fetchCaps(bin.center, principal, cached?.etag, opts.fetchImpl, opts.worker);
                 if (r === null) {
                     const entry = {
                         caps: cached?.caps,
                         ...(cached?.scenario ? { scenario: cached.scenario } : {}),
                         ...(cached?.execution ? { execution: cached.execution } : {}),
+                        ...(cached?.autoModeRefusedBy ? { autoModeRefusedBy: cached.autoModeRefusedBy } : {}),
                         ...(cached?.etag ? { etag: cached.etag } : {}),
                         expiresAt: now() + ttlMs,
                     };
@@ -136,14 +149,16 @@ export function createPrincipalEntitlementsClient(opts) {
                     return entry;
                 }
                 if (r.executionDrift) {
-                    try {
-                        onError(new Error(`execution ruling wire drift: ${r.executionDrift}`), principal);
-                    }
-                    catch { }
+                    audit(new Error(`execution ruling wire drift: ${r.executionDrift}`), principal);
+                }
+                if (r.scenarioDrift) {
+                    audit(new Error(`scenario ruling wire drift: ${r.scenarioDrift}`), principal);
                 }
+                const refusedBy = r.runtimeCaps ? autoModeRefusedByOf(r.runtimeCaps) : undefined;
                 const entry = {
                     caps: toCoreRuntimeCaps(r.runtimeCaps),
-                    ...(r.scenario ? { scenario: r.scenario } : {}),
+                    ...(refusedBy !== undefined ? { autoModeRefusedBy: refusedBy } : {}),
+                    ...(r.scenarioDrift ? { scenario: "unavailable" } : r.scenario ? { scenario: r.scenario } : {}),
                     ...(r.execution ? { execution: r.execution } : {}),
                     ...(r.etag ? { etag: r.etag } : {}),
                     expiresAt: now() + ttlMs,
@@ -159,14 +174,11 @@ export function createPrincipalEntitlementsClient(opts) {
                 catch {
                     e = new Error("center fetch failed with an unstringifiable rejection reason");
                 }
-                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org", bypassPermissions: false }, expiresAt: now() + denyTtlMs };
+                const entry = { caps: { allowWorkflows: false, allowFork: false, autoMode: false, autoModeDenySource: "org", bypassPermissions: false }, scenario: "unavailable", expiresAt: now() + denyTtlMs };
                 if (!recordDeny)
                     readMintedDeny.add(entry);
                 putCache(bin.cache, principal, entry);
-                try {
-                    onError(e, principal);
-                }
-                catch { }
+                audit(e, principal);
                 return entry;
             }
             finally {
@@ -178,7 +190,12 @@ export function createPrincipalEntitlementsClient(opts) {
     }
     return {
         resolveRuntimeCaps: async (principal) => (principal ? (await load(principal)).caps : undefined),
-        peekRuntimeCaps: async (principal) => (principal ? (await load(principal, false)).caps : undefined),
+        peekRuntimeCapsReading: async (principal) => {
+            if (!principal)
+                return { caps: undefined };
+            const entry = await load(principal, false);
+            return { caps: entry.caps, ...(entry.autoModeRefusedBy !== undefined ? { autoModeRefusedBy: entry.autoModeRefusedBy } : {}) };
+        },
         scenarioRuling: async (principal) => (principal ? (await load(principal)).scenario : undefined),
         peekScenarioRuling: async (principal) => (principal ? (await load(principal, false)).scenario : undefined),
         executionRuling: async (principal) => (principal ? (await load(principal)).execution : undefined),

package/dist/runtime-governance.d.ts

@@ -24,7 +24,7 @@
  * name). Real isolation is the `executionEnv` sandbox. Same caveat core documents on `createCoarseCommandNamePolicy`.
  */
 import { type PermissionMode, type ShellGateDoctrine, type TaskSpec, type ToolPolicy } from "@sema-agent/core";
-import { AUTONOMY_MODES, type GovernanceConfig } from "@sema-agent/settings-schema";
+import { AUTONOMY_MODES, GovernanceConfig } from "@sema-agent/settings-schema";
 import { type GovernanceAskMarks } from "./governance-ask-marks.js";
 import { type GovernanceOverrides } from "./governance-overrides.js";
 /** 运维 autonomy 四档的**闭集**(契约成员表本尊,照旧从本模块转出)。`config.ts` 的 `parseAutonomy` 也从这里读 —— 四档词表全仓一份。 */
@@ -38,7 +38,7 @@ export type Autonomy = NonNullable<GovernanceConfig["autonomy"]>;
 /** 导出给 `test/coarse-shell-tools-mirror.test.ts` 的同源钉用(见那里的顶注)。 */
 export declare const COARSE_SHELL_TOOLS_MIRROR: readonly string[];
 /** Validate `commandPolicy` rules — the shape (array of {command, decision}), the `command` (a bare argv[0] name,
- *  see {@link VALID_COMMAND_NAME}), AND the `decision` enum. Returns the list of human-readable errors (empty =
+ *  judged by the contract's own cell, see {@link commandNameRefused}), AND the `decision` enum. Returns the list of human-readable errors (empty =
  *  OK). Called at config-apply (web-admin-client/facade.ts `applyRuntimeHot`) so a malformed rule that BYPASSED the
  *  registry schema (a hand-edited config.d / a non-conformant publish) is rejected LOUDLY rather than
  *  silently mis-compiling — review MEDIUM: an out-of-enum `decision` (e.g. "DENY") would otherwise fall through

package/dist/runtime-governance.js

@@ -1,5 +1,5 @@
 import { clampPermissionMode, combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createCoarseCommandNamePolicy, modePolicyOf, parseLeadingCommandName, wrapToolPolicy, } from "@sema-agent/core";
-import { AUTONOMY_MODES, COMMAND_DECISIONS } from "@sema-agent/settings-schema";
+import { AUTONOMY_MODES, COMMAND_DECISIONS, GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { tightenGoverned } from "./governance-overrides.js";
 import { createDeploymentAuthoredPolicy, operatorAsk } from "./operator-ask.js";
@@ -25,7 +25,9 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
         },
     };
 }
-const VALID_COMMAND_NAME = /^[A-Za-z0-9._+-]+$/;
+function commandNameRefused(command) {
+    return GovernanceConfig.safeParse({ commandPolicy: [{ command, decision: COMMAND_DECISIONS[0] }] }).error?.issues.some((issue) => issue.path[2] === "command") ?? false;
+}
 function isCommandDecision(raw) {
     return typeof raw === "string" && COMMAND_DECISIONS.includes(raw);
 }
@@ -39,7 +41,7 @@ export function validateCommandRules(rules) {
             continue;
         }
         const { command, decision } = r;
-        if (typeof command !== "string" || !VALID_COMMAND_NAME.test(command)) {
+        if (commandNameRefused(command)) {
             errors.push(`commandPolicy command "${String(command)}" is not a bare argv[0] name — core matches the EXACT command name (no glob/path/operators). ` +
                 `Use e.g. "git" not "git*"; to gate sub-commands or pipes, deny the interpreter ("sh"/"bash") + rely on the sandbox.`);
         }

package/dist/sealed-key-layout.d.ts

@@ -1,17 +1,23 @@
 /**
- * 钥匙保管目录的布局常量 —— 引擎建目录、写钥匙文件、建停驻行封签子目录时用的**唯一**值(`src/sealed-key.ts` 读它们)。
- *
- * 单独成一只零依赖的叶子模块:随包部署事实 `deploy/facts/sealed-key.json`(`src/deploy-facts.ts` 投影、`scripts/gen-deploy-lanes.ts` 生成)
- * 读的是同一份值,生成器不必为了三个常量把整只保管模块(libsodium / 中心上报)装载进来。
+ * 保管目录的**唯一解析**:`SEALED_KEY_DIR`(配置席 `sealedKeyDir`,唯一 env 读点在 `config.ts`)或缺省 `<数据根>/sealed-key`。
+ * 两个读者同读这一只:起服第 2 段建保管店(`boot/web-admin.ts`),与店的持久性判者取证(`store-posture.ts` 的三根之一,`boot/store-evidence.ts` 递路径)。
  */
+export declare function sealedKeyDirOf(config: {
+    readonly sealedKeyDir?: string;
+    readonly localDataRoot?: string;
+}, localRoot: string): string;
 /** 保管目录的权限位:每次建店都 `mkdir` + `chmod` 成它(目录预先存在时 `mkdir` 的 mode 不生效,所以另 `chmod` 一次)。 */
 export declare const SEALED_KEY_DIR_MODE = 448;
-/** 钥匙文件 `<publicKeyId>.json` 的权限位(`writeFile` 的 mode 受 umask 掩,所以另 `chmod` 一次)。 */
-export declare const SEALED_KEY_FILE_MODE = 384;
 /**
  * 停驻行凭据封签那一域的保管子目录名(在模型钥匙保管目录之下:`<保管目录>/checkpoint-ctx-keys/`)。**一个域一对钥匙**:模型钥匙(`ModelEntry.sealedApiKey`,
  * 浏览器对着 caps 公钥裸封)与停驻行封签各用自己目录里的钥匙对 —— 一边的开箱口在另一边的密文上恒「不持有那把钥匙」,不是靠哪一侧多判一句信封。
  * 放在模型钥匙目录之下是为了「多副本共享 / 跨重启持久」只有一个目录要管(整个保管目录);模型钥匙店只读这一层的 `*.json`,子目录不进它的视野。
  */
 export declare const CHECKPOINT_CTX_KEY_SUBDIR = "checkpoint-ctx-keys";
+/**
+ * 首把钥匙的**创建口**的互斥文件名(在保管目录里,`<保管目录>/.keygen.lock`):目录里一把可装载的钥匙都没有时,谁以 `wx`(`O_CREAT | O_EXCL`)独占建成它,谁生成并发布那一把;
+ * 发布之后(或失败退出时)删除。不以 `.json` 结尾 ⇒ 装载不会把它当钥匙文件,目录里恒不留它(崩溃在生成中途的极窄窗口除外 —— 那时拒句点名这个文件的路径)。
+ * 模型钥匙目录与它之下的 {@link CHECKPOINT_CTX_KEY_SUBDIR} 各是一只目录、各有一把自己的锁。
+ */
+export declare const KEYGEN_LOCK_FILE = ".keygen.lock";
 //# sourceMappingURL=sealed-key-layout.d.ts.map

package/dist/sealed-key-layout.js

@@ -1,4 +1,8 @@
+import { join } from "node:path";
+export function sealedKeyDirOf(config, localRoot) {
+    return config.sealedKeyDir ?? join(config.localDataRoot ?? localRoot, "sealed-key");
+}
 export const SEALED_KEY_DIR_MODE = 0o700;
-export const SEALED_KEY_FILE_MODE = 0o600;
 export const CHECKPOINT_CTX_KEY_SUBDIR = "checkpoint-ctx-keys";
+export const KEYGEN_LOCK_FILE = ".keygen.lock";
 //# sourceMappingURL=sealed-key-layout.js.map

package/dist/sealed-key.d.ts

@@ -73,14 +73,24 @@ export declare class SealedKeyPublicKeyRefusedError extends Error {
  * 前置:libsodium 已就绪(三处调用方都先等过它);没就绪 ⇒ 当场抛普通错误(不是判决)。
  */
 export declare function judgeSealedKeyPublicKey(publicKeyB64: string): Uint8Array;
+/** {@link ensureSealedKeyStore} 的选项。 */
+export interface EnsureSealedKeyStoreOptions {
+    /** 目录里没有钥匙、别人正拿着创建互斥时,最多等多久(毫秒;缺省 15 s)。测试缝;生产不设。 */
+    readonly genesisLockWaitMs?: number;
+}
 /**
  * Load every keypair under `dir` (creating dir + ONE fresh keypair when none exist) and return the
  * custody store. Invalid/corrupt files are skipped with a warn (they may be an OLD format or a
  * half-write — deleting operator key material on a parse error would destroy decryptability, so we
  * never do; we just don't serve them). Throws only when the store cannot exist at all (fs errors,
- * zero loadable keys AND generation failed).
+ * zero loadable keys AND generation failed, or another process holds the key-creation lock past the wait).
+ *
+ * **首把钥匙只有一个创建口**(共享卷上多个副本在空目录上同时首启,全体只出一把):一把可装载的钥匙都没有 ⇒ 取创建互斥({@link takeKeygenLock},`wx` 独占);
+ * 拿到的那一个**再读一次目录**(读目录到拿互斥之间别人可能已发布)—— 仍空才生成并发布({@link mintFirstKey}),然后撤互斥;没拿到(`EEXIST`)⇒ 重读目录:
+ * 有钥匙了就采用,没有就隔 {@link KEYGEN_LOCK_POLL_MS} 再读,等到 `genesisLockWaitMs` 仍没有 ⇒ 响亮拒({@link keygenLockTimeout}),**不**越过别人的互斥自己生成。
+ * 互斥只在「目录里没有可装载的钥匙」时被问到:已有钥匙的目录(含上次崩溃遗留互斥文件的)起服零等待;共享卷须提供原子的 `O_EXCL` 独占创建(本地盘、NFSv3+、常见 RWX 存储类满足)。
  */
-export declare function ensureSealedKeyStore(dir: string, logger?: Logger): Promise<SealedKeyStore>;
+export declare function ensureSealedKeyStore(dir: string, logger?: Logger, opts?: EnsureSealedKeyStoreOptions): Promise<SealedKeyStore>;
 declare const checkpointCtxKeyStoreBrand: unique symbol;
 /**
  * 停驻行封签那一域的保管店(品牌型):读口与 {@link SealedKeyStore} 同形,型不同 —— {@link createCheckpointCtxSealing} 只收它,模型钥匙那只店交进去是 tsc 错

package/dist/sealed-key.js

@@ -1,13 +1,16 @@
 import { createHash } from "node:crypto";
-import { chmod, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { chmod, open, readdir, readFile, rm, stat } from "node:fs/promises";
 import { join } from "node:path";
+import { ensureDir } from "@sema-agent/core";
 import _sodium from "libsodium-wrappers";
-import { CHECKPOINT_CTX_KEY_SUBDIR, SEALED_KEY_DIR_MODE, SEALED_KEY_FILE_MODE } from "./sealed-key-layout.js";
+import { CHECKPOINT_CTX_KEY_SUBDIR, KEYGEN_LOCK_FILE, SEALED_KEY_DIR_MODE } from "./sealed-key-layout.js";
+import { OWNER_ONLY_FILE_MODE, atomicWriteFileAsync } from "./plugins/owner-only-file-mode.js";
 import { buildDisplaySafeUrl } from "./trace/redact.js";
 import { createCenterCredentialSource } from "./center-credential.js";
 import { centerFetch } from "./web-admin-client/center-request.js";
 import { WEB_ADMIN_ENV } from "@sema-agent/settings-schema";
 import { CHECKPOINT_CTX_SEAL_ALG } from "./http/checkpoint-ctx.js";
+import { readUpstreamJson } from "./upstream-body.js";
 export const SEALED_KEY_ALG = "libsodium-sealedbox-x25519";
 const SEAL_OVERHEAD_BYTES = 48;
 const BASE64_STRICT = /^[A-Za-z0-9+/]+={0,2}$/;
@@ -59,12 +62,10 @@ export function judgeSealedKeyPublicKey(publicKeyB64) {
     }
     return bytes;
 }
-export async function ensureSealedKeyStore(dir, logger) {
-    await _sodium.ready;
+async function scanKeyDir(dir) {
     const sodium = _sodium;
-    await mkdir(dir, { recursive: true, mode: SEALED_KEY_DIR_MODE });
-    await chmod(dir, SEALED_KEY_DIR_MODE);
     const keys = new Map();
+    const notes = [];
     for (const name of (await readdir(dir)).filter((n) => n.endsWith(".json")).sort()) {
         const path = join(dir, name);
         try {
@@ -77,34 +78,123 @@ export async function ensureSealedKeyStore(dir, logger) {
             if (privateKey.length !== sodium.crypto_box_SECRETKEYBYTES)
                 throw new Error("bad key length");
             if (name !== `${raw.publicKeyId}.json`)
-                logger?.warn("sealed_key_filename_drift", { file: name, publicKeyId: raw.publicKeyId, note: "content publicKeyId wins; rename the file to silence this" });
+                notes.push({ msg: "sealed_key_filename_drift", fields: { file: name, publicKeyId: raw.publicKeyId, note: "content publicKeyId wins; rename the file to silence this" } });
             if (keys.has(raw.publicKeyId)) {
-                logger?.warn("sealed_key_duplicate_id", { file: name, publicKeyId: raw.publicKeyId, note: "duplicate publicKeyId — keeping the first, skipping this file" });
+                notes.push({ msg: "sealed_key_duplicate_id", fields: { file: name, publicKeyId: raw.publicKeyId, note: "duplicate publicKeyId — keeping the first, skipping this file" } });
                 continue;
             }
             keys.set(raw.publicKeyId, { publicKey, privateKey, publicKeyB64: raw.publicKey, createdAt: typeof raw.createdAt === "string" ? raw.createdAt : "" });
         }
         catch (err) {
-            logger?.warn("sealed_key_file_unreadable", { file: path, errKind: err instanceof Error ? err.name : "unknown", ...(err instanceof SealedKeyPublicKeyRefusedError ? { flaw: err.flaw } : {}), note: "skipped (NOT deleted) — ciphertexts sealed for this key will fail loud per-model" });
+            notes.push({
+                msg: "sealed_key_file_unreadable",
+                fields: { file: path, errKind: err instanceof Error ? err.name : "unknown", ...(err instanceof SealedKeyPublicKeyRefusedError ? { flaw: err.flaw } : {}), note: "skipped (NOT deleted) — ciphertexts sealed for this key will fail loud per-model" },
+            });
         }
     }
-    if (keys.size === 0) {
-        const kp = sodium.crypto_box_keypair();
-        const publicKeyB64 = Buffer.from(kp.publicKey).toString("base64");
-        const record = {
-            v: 1,
-            alg: SEALED_KEY_ALG,
-            publicKeyId: deriveKeyId(kp.publicKey),
-            publicKey: publicKeyB64,
-            privateKey: Buffer.from(kp.privateKey).toString("base64"),
-            createdAt: new Date().toISOString(),
-        };
-        const path = join(dir, `${record.publicKeyId}.json`);
-        await writeFile(path, JSON.stringify(record, null, 2) + "\n", { mode: SEALED_KEY_FILE_MODE });
-        await chmod(path, SEALED_KEY_FILE_MODE);
-        keys.set(record.publicKeyId, { publicKey: kp.publicKey, privateKey: kp.privateKey, publicKeyB64, createdAt: record.createdAt });
-        logger?.info("sealed_key_generated", { publicKeyId: record.publicKeyId, publicKey: publicKeyB64, dir, note: "new X25519 sealed-box keypair in this directory — the private key exists only here: keep the directory across restarts and identical on every replica that has to open what it sealed, and back it up as a private key" });
+    return { keys, notes };
+}
+const isExists = (err) => typeof err === "object" && err !== null && "code" in err && err.code === "EEXIST";
+const KEYGEN_LOCK_POLL_MS = 50;
+const KEYGEN_LOCK_WAIT_MS = 15_000;
+async function takeKeygenLock(dir) {
+    const path = join(dir, KEYGEN_LOCK_FILE);
+    let handle;
+    try {
+        handle = await open(path, "wx", OWNER_ONLY_FILE_MODE);
+    }
+    catch (err) {
+        if (isExists(err))
+            return undefined;
+        throw err;
+    }
+    try {
+        await handle.close();
+    }
+    catch (error) {
+        await releaseKeygenLock(path, { error }, undefined);
+        throw error;
+    }
+    return path;
+}
+async function releaseKeygenLock(path, primary, logger) {
+    try {
+        await rm(path, { force: true });
+    }
+    catch (cleanup) {
+        if (primary !== undefined) {
+            const text = (e) => (e instanceof Error ? e.message : String(e));
+            throw new Error(`sealed-key custody: ${text(primary.error)} — and the key-creation lock ${path} this process took could not be removed (${text(cleanup)}): remove it by hand, an empty directory is otherwise blocked on it`, { cause: primary.error });
+        }
+        logger?.warn("sealed_key_keygen_lock_not_released", { lock: path, errKind: cleanup instanceof Error ? cleanup.name : "unknown", note: "the key-creation lock this process took could not be removed — harmless while the directory holds a key; with an empty directory every start waits on it until it is removed by hand" });
+    }
+}
+async function keygenLockTimeout(dir, lock, waitedMs) {
+    const heldFor = await stat(lock).then((s) => Math.max(0, Math.round((Date.now() - s.mtimeMs) / 1000)), () => undefined);
+    return new Error(`sealed-key custody ${dir}: the key-creation lock ${lock} is held${heldFor !== undefined ? ` (for ${heldFor}s)` : ""} and no key file appeared within ${waitedMs} ms — ` +
+        `if no replica is starting right now, an earlier start died while generating the key: remove ${lock} and start again`);
+}
+async function mintFirstKey(dir, logger) {
+    const sodium = _sodium;
+    const kp = sodium.crypto_box_keypair();
+    const publicKeyB64 = Buffer.from(kp.publicKey).toString("base64");
+    const record = {
+        v: 1,
+        alg: SEALED_KEY_ALG,
+        publicKeyId: deriveKeyId(kp.publicKey),
+        publicKey: publicKeyB64,
+        privateKey: Buffer.from(kp.privateKey).toString("base64"),
+        createdAt: new Date().toISOString(),
+    };
+    const path = join(dir, `${record.publicKeyId}.json`);
+    await atomicWriteFileAsync(path, JSON.stringify(record, null, 2) + "\n", { durability: "best-effort" });
+    await chmod(path, OWNER_ONLY_FILE_MODE);
+    logger?.info("sealed_key_generated", { publicKeyId: record.publicKeyId, publicKey: publicKeyB64, dir, note: "new X25519 sealed-box keypair in this directory — the private key exists only here: keep the directory across restarts and identical on every replica that has to open what it sealed, and back it up as a private key" });
+    return { id: record.publicKeyId, key: { publicKey: kp.publicKey, privateKey: kp.privateKey, publicKeyB64, createdAt: record.createdAt } };
+}
+export async function ensureSealedKeyStore(dir, logger, opts = {}) {
+    await _sodium.ready;
+    const sodium = _sodium;
+    ensureDir(dir);
+    await chmod(dir, SEALED_KEY_DIR_MODE);
+    const waitMs = opts.genesisLockWaitMs ?? KEYGEN_LOCK_WAIT_MS;
+    const deadline = Date.now() + waitMs;
+    let scan = await scanKeyDir(dir);
+    let minted;
+    try {
+        while (scan.keys.size === 0 && minted === undefined) {
+            const lock = await takeKeygenLock(dir);
+            if (lock !== undefined) {
+                let failure;
+                try {
+                    scan = await scanKeyDir(dir);
+                    if (scan.keys.size === 0)
+                        minted = await mintFirstKey(dir, logger);
+                }
+                catch (error) {
+                    failure = { error };
+                    throw error;
+                }
+                finally {
+                    await releaseKeygenLock(lock, failure, logger);
+                }
+            }
+            else if (Date.now() >= deadline) {
+                throw await keygenLockTimeout(dir, join(dir, KEYGEN_LOCK_FILE), waitMs);
+            }
+            else {
+                await new Promise((resolve) => setTimeout(resolve, KEYGEN_LOCK_POLL_MS));
+                scan = await scanKeyDir(dir);
+            }
+        }
+    }
+    finally {
+        for (const n of scan.notes)
+            logger?.warn(n.msg, n.fields);
     }
+    const keys = new Map(scan.keys);
+    if (minted !== undefined)
+        keys.set(minted.id, minted.key);
     const latestEntry = [...keys.entries()].sort((a, b) => (a[1].createdAt < b[1].createdAt ? 1 : a[1].createdAt > b[1].createdAt ? -1 : a[0] < b[0] ? -1 : 1))[0];
     return {
         latest: { publicKeyId: latestEntry[0], publicKey: latestEntry[1].publicKeyB64, createdAt: latestEntry[1].createdAt },
@@ -207,7 +297,7 @@ export async function reportExecutionPublicKey(opts) {
         if (res.ok) {
             let idempotent = false;
             try {
-                idempotent = (await res.json())?.idempotent === true;
+                idempotent = (await readUpstreamJson(res))?.idempotent === true;
             }
             catch { }
             logger?.info(idempotent ? "sealed_key_already_registered" : "sealed_key_reported", { publicKeyId: key.publicKeyId, status: res.status });