burnledger 0.9.0 → 0.9.1

package/dist/esm/webhooks.d.ts

@@ -16,11 +16,18 @@
 /**
  * Verify that a webhook payload was signed by the expected secret.
  *
+ * During a secret rotation the server sends both signatures in one header as
+ * `<old>,<new>` for a 24 h window, so whichever secret a receiver holds matches
+ * one of them without dropping deliveries. The header is split on the comma,
+ * each part is trimmed and strictly hex-decoded, and it verifies if any part
+ * matches under `secret`. A single signature (no comma) is the ordinary case and
+ * one iteration of the same loop.
+ *
  * @param secret  The webhook secret (raw UTF-8, as returned by the API)
  * @param timestamp The RFC3339 timestamp from the X-BurnLedger-Timestamp header
  * @param body    The raw request body bytes
- * @param signature The hex-encoded HMAC-SHA256 signature from the X-BurnLedger-Signature header
- * @returns true if the signature is valid
+ * @param signature The hex-encoded HMAC-SHA256 signature(s) from the X-BurnLedger-Signature header
+ * @returns true if any signature in the header is valid
  */
 export declare function verifyWebhookSignature(secret: string, timestamp: string, body: Uint8Array | string, signature: string): boolean;
 /**

package/dist/esm/webhooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAwBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,gBAAgB,GAAE,MAAY,GAC7B,OAAO,CAKT"}
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAeH;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,UAAU,GAAG,MAAM,EACzB,SAAS,EAAE,MAAM,GAChB,OAAO,CAuBT;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAC9B,SAAS,EAAE,MAAM,EACjB,gBAAgB,GAAE,MAAY,GAC7B,OAAO,CAKT"}

package/dist/esm/webhooks.js

@@ -14,14 +14,31 @@
  * Node-only — webhooks are received server-side.
  */
 import { createHmac, timingSafeEqual } from "node:crypto";
+/** Strictly hex-decode `value`, or undefined if it is not even-length pure hex.
+ * Buffer.from(_, "hex") silently truncates at the first non-hex character, which
+ * would decode only the first signature of a rotation header — so the input is
+ * validated as pure hex first. */
+function decodeHexStrict(value) {
+    if (value.length === 0 || value.length % 2 !== 0 || !/^[0-9a-fA-F]+$/.test(value)) {
+        return undefined;
+    }
+    return Buffer.from(value, "hex");
+}
 /**
  * Verify that a webhook payload was signed by the expected secret.
  *
+ * During a secret rotation the server sends both signatures in one header as
+ * `<old>,<new>` for a 24 h window, so whichever secret a receiver holds matches
+ * one of them without dropping deliveries. The header is split on the comma,
+ * each part is trimmed and strictly hex-decoded, and it verifies if any part
+ * matches under `secret`. A single signature (no comma) is the ordinary case and
+ * one iteration of the same loop.
+ *
  * @param secret  The webhook secret (raw UTF-8, as returned by the API)
  * @param timestamp The RFC3339 timestamp from the X-BurnLedger-Timestamp header
  * @param body    The raw request body bytes
- * @param signature The hex-encoded HMAC-SHA256 signature from the X-BurnLedger-Signature header
- * @returns true if the signature is valid
+ * @param signature The hex-encoded HMAC-SHA256 signature(s) from the X-BurnLedger-Signature header
+ * @returns true if any signature in the header is valid
  */
 export function verifyWebhookSignature(secret, timestamp, body, signature) {
     if (secret.length === 0)
@@ -37,16 +54,17 @@ export function verifyWebhookSignature(secret, timestamp, body, signature) {
         .update(Buffer.from(`${timestamp}.`, "utf-8"))
         .update(bodyBytes)
         .digest();
-    let received;
-    try {
-        received = Buffer.from(signature, "hex");
+    // Every candidate is compared in constant time; the loop does not return early
+    // on a match so the work does not reveal which position matched.
+    let matched = false;
+    for (const part of signature.split(",")) {
+        const received = decodeHexStrict(part.trim());
+        if (received === undefined || received.length !== expected.length)
+            continue;
+        if (timingSafeEqual(expected, received))
+            matched = true;
     }
-    catch {
-        return false;
-    }
-    if (received.length !== expected.length)
-        return false;
-    return timingSafeEqual(expected, received);
+    return matched;
 }
 /**
  * Verify that the webhook timestamp is within an acceptable freshness window.

package/dist/esm/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,SAAiB,EACjB,IAAyB,EACzB,SAAiB;IAEjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzC,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,EAAE,OAAO,CAAC,CAAC;SAC7C,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,EAAE,CAAC;IAEZ,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAEtD,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,gBAAgB,GAAW,GAAG;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,OAAO,UAAU,IAAI,gBAAgB,CAAC;AACxC,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE1D;;;kCAGkC;AAClC,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAAc,EACd,SAAiB,EACjB,IAAyB,EACzB,SAAiB;IAEjB,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzC,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,SAAS,GACb,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;SAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,SAAS,GAAG,EAAE,OAAO,CAAC,CAAC;SAC7C,MAAM,CAAC,SAAS,CAAC;SACjB,MAAM,EAAE,CAAC;IAEZ,+EAA+E;IAC/E,iEAAiE;IACjE,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,SAAS;QAC5E,IAAI,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAC9B,SAAiB,EACjB,gBAAgB,GAAW,GAAG;IAE9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC;IACxD,OAAO,UAAU,IAAI,gBAAgB,CAAC;AACxC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "burnledger",
-  "version": "0.9.0",
+  "version": "0.9.1",
   "description": "TypeScript SDK for the BurnLedger API — cryptographic deletion certificates",
   "type": "module",
   "main": "./dist/cjs/index.js",

package/src/cli.ts

@@ -182,11 +182,61 @@ export async function loadKeys(path: string): Promise<{ keys: Map<string, Public
  * issuer's signature.
  *
  * No Authorization header is sent. The endpoint takes none, and sending an API
- * key to an arbitrary --api-url is a credential leak the check never needed. */
-async function fetchStatusStatement(apiUrl: string, certId: string): Promise<StatusStatement> {
-  const res = await fetch(`${apiUrl.replace(/\/+$/, "")}/v1/certificates/${certId}/status`);
-  if (!res.ok) throw new Error(`HTTP ${res.status}`);
-  return unwrapStatusStatement(await res.json());
+ * key to an arbitrary --api-url is a credential leak the check never needed.
+ *
+ * Read under a 1 MiB cap and a total deadline, matching the anchor fetch
+ * (anchor.ts) and the Go CLI (cmd/cli/online.go): a status statement is a few
+ * hundred bytes, so anything near the cap is a misbehaving or hostile server.
+ * The AbortController bounds the whole fetch including the body read, which a
+ * server dripping bytes could otherwise hold open. Exported for testing. */
+export async function fetchStatusStatement(apiUrl: string, certId: string): Promise<StatusStatement> {
+  const url = `${apiUrl.replace(/\/+$/, "")}/v1/certificates/${certId}/status`;
+  const controller = new AbortController();
+  const timer = setTimeout(() => { controller.abort(); }, STATUS_FETCH_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, { signal: controller.signal });
+    const body = await readCapped(res);
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    try {
+      return unwrapStatusStatement(JSON.parse(body));
+    } catch (e) {
+      throw new Error(`parse response: ${e instanceof Error ? e.message : String(e)}`);
+    }
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/** How much of the status response to buffer (1 MiB) and how long the whole
+ * fetch may take (10 s), matching cmd/cli/online.go and anchor.ts. */
+const MAX_STATUS_BYTES = 1 << 20;
+const STATUS_FETCH_TIMEOUT_MS = 10_000;
+
+/** Read a response body, stopping at the cap instead of buffering whatever a
+ * hostile server decides to send. The stream is cancelled on the way out, so an
+ * endless body costs one megabyte and not the process. */
+async function readCapped(res: Response): Promise<string> {
+  const reader = res.body?.getReader();
+  if (reader === undefined) return "";
+  const chunks: Uint8Array[] = [];
+  let total = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    total += value.length;
+    if (total > MAX_STATUS_BYTES) {
+      await reader.cancel();
+      throw new Error(`read response: body exceeds ${MAX_STATUS_BYTES} bytes`);
+    }
+    chunks.push(value);
+  }
+  const joined = new Uint8Array(total);
+  let at = 0;
+  for (const c of chunks) {
+    joined.set(c, at);
+    at += c.length;
+  }
+  return new TextDecoder().decode(joined);
 }
 
 /** The verdicts a reader can act on, and therefore the ones that exit 0.

package/src/client.ts

@@ -50,6 +50,10 @@ import {
 } from "./models.js";
 import type { KeyEnrollmentResult, SystemRegistrationCertificate } from "./models.js";
 import { Paginator } from "./pagination.js";
+// Node-only work (enrolment, registration, savePdf) is reached through here, not
+// by naming the Node modules — so the browser entry that shares this class never
+// pulls node:crypto or node:fs into a bundle. See node-runtime.ts.
+import { loadNodeRuntime } from "./node-runtime.js";
 // Types only: erased at build, so the browser entry that shares this module
 // never loads node:crypto. The code behind them is imported lazily, on use.
 import type { CustomerKeyGroup } from "./customer-keys.js";
@@ -155,7 +159,7 @@ export class BurnLedger {
   async getSystem(systemId: string): Promise<System> {
     const data = await this.transport.request(
       "GET",
-      `/v1/systems/${systemId}`,
+      `/v1/systems/${encodeId(systemId)}`,
     );
     return parseSystem(data as Raw);
   }
@@ -167,13 +171,13 @@ export class BurnLedger {
   }
 
   async deregisterSystem(systemId: string): Promise<void> {
-    await this.transport.request("DELETE", `/v1/systems/${systemId}`);
+    await this.transport.request("DELETE", `/v1/systems/${encodeId(systemId)}`);
   }
 
   async healthCheck(systemId: string): Promise<System> {
     const data = await this.transport.request(
       "POST",
-      `/v1/systems/${systemId}/health-check`,
+      `/v1/systems/${encodeId(systemId)}/health-check`,
     );
     return parseSystem(data as Raw);
   }
@@ -206,7 +210,7 @@ export class BurnLedger {
   async getAttestation(attestationId: string): Promise<Attestation> {
     const data = await this.transport.request(
       "GET",
-      `/v1/attestations/${attestationId}`,
+      `/v1/attestations/${encodeId(attestationId)}`,
     );
     return parseAttestation(data as Raw);
   }
@@ -232,7 +236,7 @@ export class BurnLedger {
     const body = { subject_identifier: subjectIdentifier };
     const data = await this.transport.request(
       "POST",
-      `/v1/attestations/${attestationId}/verify`,
+      `/v1/attestations/${encodeId(attestationId)}/verify`,
       { json: body },
     );
     const result = parseVerifyResult(data as Raw);
@@ -246,7 +250,7 @@ export class BurnLedger {
       fetch: async () => {
         const d = await this.transport.request(
           "POST",
-          `/v1/attestations/${attestationId}/verify`,
+          `/v1/attestations/${encodeId(attestationId)}/verify`,
           { json: body },
         );
         return parseVerifyResult(d as Raw);
@@ -281,7 +285,7 @@ export class BurnLedger {
   async getCertificate(certificateId: string): Promise<CertificateResponse> {
     const data = await this.transport.request(
       "GET",
-      `/v1/certificates/${certificateId}`,
+      `/v1/certificates/${encodeId(certificateId)}`,
     );
     return parseCertificateResponse(data as Raw);
   }
@@ -300,20 +304,20 @@ export class BurnLedger {
   async downloadPdf(certificateId: string): Promise<Uint8Array> {
     return this.transport.requestBytes(
       "GET",
-      `/v1/certificates/${certificateId}/pdf`,
+      `/v1/certificates/${encodeId(certificateId)}/pdf`,
     );
   }
 
   async savePdf(certificateId: string, path: string): Promise<void> {
     const pdf = await this.downloadPdf(certificateId);
-    const { writeFile } = await import("node:fs/promises");
+    const { writeFile } = await loadNodeRuntime();
     await writeFile(path, pdf);
   }
 
   async getRevocationStatus(certificateId: string): Promise<RevocationStatus> {
     const data = await this.transport.request(
       "GET",
-      `/v1/certificates/${certificateId}/revocation-status`,
+      `/v1/certificates/${encodeId(certificateId)}/revocation-status`,
     );
     return parseRevocationStatus(data as Raw);
   }
@@ -324,7 +328,7 @@ export class BurnLedger {
   ): Promise<CertificateResponse> {
     const data = await this.transport.request(
       "POST",
-      `/v1/certificates/${certificateId}/revoke`,
+      `/v1/certificates/${encodeId(certificateId)}/revoke`,
       { json: { reason: opts.reason } },
     );
     return parseCertificateResponse(data as Raw);
@@ -389,13 +393,13 @@ export class BurnLedger {
   }
 
   async deleteWebhook(webhookId: string): Promise<void> {
-    await this.transport.request("DELETE", `/v1/webhooks/${webhookId}`);
+    await this.transport.request("DELETE", `/v1/webhooks/${encodeId(webhookId)}`);
   }
 
   async rotateWebhookSecret(webhookId: string): Promise<WebhookRotateResponse> {
     const data = await this.transport.request(
       "POST",
-      `/v1/webhooks/${webhookId}/rotate-secret`,
+      `/v1/webhooks/${encodeId(webhookId)}/rotate-secret`,
     );
     return parseWebhookRotateResponse(data as Raw);
   }
@@ -403,7 +407,7 @@ export class BurnLedger {
   async commitWebhookRotation(webhookId: string): Promise<void> {
     await this.transport.request(
       "POST",
-      `/v1/webhooks/${webhookId}/commit-rotation`,
+      `/v1/webhooks/${encodeId(webhookId)}/commit-rotation`,
     );
   }
 
@@ -419,14 +423,14 @@ export class BurnLedger {
   async retryDelivery(deliveryId: string): Promise<void> {
     await this.transport.request(
       "POST",
-      `/v1/webhooks/deliveries/${deliveryId}/retry`,
+      `/v1/webhooks/deliveries/${encodeId(deliveryId)}/retry`,
     );
   }
 
   async resolveDelivery(deliveryId: string): Promise<void> {
     await this.transport.request(
       "DELETE",
-      `/v1/webhooks/deliveries/${deliveryId}`,
+      `/v1/webhooks/deliveries/${encodeId(deliveryId)}`,
     );
   }
 
@@ -453,7 +457,7 @@ export class BurnLedger {
   }
 
   async revokeApiKey(keyId: string): Promise<void> {
-    await this.transport.request("DELETE", `/v1/api-keys/${keyId}`);
+    await this.transport.request("DELETE", `/v1/api-keys/${encodeId(keyId)}`);
   }
 
   // --- Profile ---
@@ -494,7 +498,7 @@ export class BurnLedger {
    * and every document they return must verify under its signing key.
    */
   async attestEnclaveIdentity(pin: EnclavePinOptions): Promise<EnclaveIdentity> {
-    const flow = await import("./enclave-registration.js");
+    const { registration: flow } = await loadNodeRuntime();
     const { nonce, params } = flow.attestationParams(pin.nonce);
     const data = await this.transport.request("GET", "/v1/enclave/attestation", {
       params,
@@ -521,7 +525,7 @@ export class BurnLedger {
     /** The time to judge the answer's not_before against. Defaults to now. */
     now?: Date;
   }): Promise<KeyEnrollmentResult> {
-    const flow = await import("./enclave-registration.js");
+    const { registration: flow } = await loadNodeRuntime();
     const { body, keyId, notAfter } = await flow.enrollBody(opts);
     const data = await this.transport.request("POST", "/v1/enclave/keys", { json: body });
     return flow.checkEnrollment(data, {
@@ -552,7 +556,7 @@ export class BurnLedger {
     /** The time to judge the answer's not_before against. Defaults to now. */
     now?: Date;
   }): Promise<KeyEnrollmentResult> {
-    const flow = await import("./enclave-registration.js");
+    const { registration: flow } = await loadNodeRuntime();
     const { body, prevKeyId, nextKeyId, notAfter } = await flow.rotateBody(opts);
     const data = await this.transport.request("POST", "/v1/enclave/keys/rotate", { json: body });
     return flow.checkEnrollment(data, {
@@ -581,7 +585,7 @@ export class BurnLedger {
     queryTemplate: string;
     connectorType: string;
   }): Promise<SystemRegistrationCertificate> {
-    const flow = await import("./enclave-registration.js");
+    const { registration: flow } = await loadNodeRuntime();
     const { body, keyId, configDigest } = await flow.registrationBody(opts);
     const data = await this.transport.request("POST", "/v1/enclave/registrations", { json: body });
     return flow.checkRegistration(data, {
@@ -615,8 +619,7 @@ export class BurnLedger {
     maxBytes?: number;
     queryTimeout?: string;
   }): Promise<RegisteredSystem> {
-    const flow = await import("./enclave-registration.js");
-    const { sealToKey } = await import("./enclave-seal.js");
+    const { registration: flow, seal } = await loadNodeRuntime();
     const config = flow.configBytes(resolveConnectionConfig(opts.connectionConfig, opts.dsn, opts.uri));
     const system = await this.registerSystem({
       name: opts.name,
@@ -627,7 +630,7 @@ export class BurnLedger {
       maxRecords: opts.maxRecords,
       maxBytes: opts.maxBytes,
       queryTimeout: opts.queryTimeout,
-      sealedConnectionConfig: await sealToKey(opts.enclave.configSealKey, config),
+      sealedConnectionConfig: await seal.sealToKey(opts.enclave.configSealKey, config),
     });
     const registration = await this.registerSystemWithKey({
       teamId: opts.teamId,
@@ -647,7 +650,7 @@ export class BurnLedger {
   async getSystemHealth(systemId: string): Promise<SystemHealth> {
     const data = await this.transport.request(
       "GET",
-      `/v1/systems/${systemId}/health`,
+      `/v1/systems/${encodeId(systemId)}/health`,
     );
     return parseSystemHealth(data as Raw);
   }
@@ -716,6 +719,20 @@ export class BurnLedger {
 // Connection config resolution
 // ---------------------------------------------------------------------------
 
+/** Percent-encode an id before it goes into a URL path, and refuse `.`/`..`.
+ *
+ * A raw id lets untrusted input escape its segment: `deregisterSystem("x/../../
+ * api-keys/k1")` would otherwise resolve to `DELETE /v1/api-keys/k1`.
+ * encodeURIComponent escapes the `/`, but it leaves `.` and `..` untouched, and
+ * a segment that IS `.` or `..` is still traversal — so those are rejected
+ * outright. An empty id is rejected too: it collapses two path segments into one. */
+function encodeId(id: string): string {
+  if (id === "" || id === "." || id === "..") {
+    throw new Error(`invalid id path segment: ${JSON.stringify(id)}`);
+  }
+  return encodeURIComponent(id);
+}
+
 /** Standard base64, as Go decodes a []byte field. No Buffer: this module is
  * also the browser entry's. */
 function bytesToBase64(bytes: Uint8Array): string {
@@ -769,7 +786,14 @@ async function poll<T>(opts: {
       result = await opts.fetch();
     } catch (err) {
       if (err instanceof RateLimitError && err.retryAfter !== undefined) {
-        await sleep(err.retryAfter * 1000);
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+          throw new TimeoutError(opts.operation, elapsed);
+        }
+        // Bound the wait to the caller's remaining budget: a server asking for a
+        // day, or an Infinity Retry-After, must not block past the timeout the
+        // caller set (Math.min(Infinity, remaining) === remaining).
+        await sleep(Math.min(err.retryAfter * 1000, remaining));
         continue;
       }
       throw err;

package/src/enclave-registration.ts

@@ -353,8 +353,20 @@ export async function registrationBody(opts: {
   };
 }
 
-/** Verify the registration under the attested enclave's signing key, then
- * refuse it unless it binds what this caller signed. */
+/** Verify the registration under the attested enclave's signing key, then refuse
+ * it unless it binds the key id, system id, config digest and connector this
+ * caller signed.
+ *
+ * Two signed fields are deliberately NOT compared here, so the binding is
+ * narrower than "everything you signed". `query_template_hash` in the answer is
+ * HashQuery over the NORMALIZED subject query, while the request signs sha256 of
+ * the RAW template; the two are not byte-equal even for an honest registration,
+ * so comparing them would reject legitimate answers (see the README's
+ * "query-template normalization" note). `registered_at` is not checked for
+ * freshness either: there is no signed bound to hold it to. A relay could
+ * therefore substitute an older genuine registration for the same system, config,
+ * connector and key but a different query template — the customer path calls this
+ * immediately after its own POST, which narrows that window but does not close it. */
 export async function checkRegistration(
   data: unknown,
   opts: {

package/src/index.ts

@@ -1,5 +1,18 @@
 /** BurnLedger TypeScript SDK — public API (Node.js entry point). */
 
+// Wire the Node-only client capabilities (enrolment, registration, savePdf). The
+// browser entry never does this, so those modules — and node:crypto/node:fs with
+// them — stay out of any browser bundle. See node-runtime.ts.
+import { setNodeRuntimeLoader } from "./node-runtime.js";
+setNodeRuntimeLoader(async () => {
+  const [registration, seal, fs] = await Promise.all([
+    import("./enclave-registration.js"),
+    import("./enclave-seal.js"),
+    import("node:fs/promises"),
+  ]);
+  return { registration, seal, writeFile: (path, data) => fs.writeFile(path, data) };
+});
+
 export { BurnLedger, MAX_BATCH_REVOKE } from "./client.js";
 export type { BurnLedgerOptions } from "./client.js";
 

package/src/node-runtime.ts

@@ -0,0 +1,57 @@
+/** The Node-only capabilities the shared client needs, injected at the entry.
+ *
+ * WHY THIS EXISTS. `client.ts` is imported by BOTH entry points — the Node one
+ * (index.ts) and the browser one (index.browser.ts). A few of its methods are
+ * Node-only by nature: key enrolment and system registration (ADR-025 §2 makes a
+ * client the customer runs locally the only place enrolment can happen), and
+ * `savePdf`, which writes to a filesystem path. Their implementations live in
+ * `enclave-registration.ts`, `enclave-seal.ts` (and, through them, `key-group.ts`
+ * and `crypto-node.ts`) and in `node:fs/promises` — all of which import
+ * `node:crypto` or another Node builtin.
+ *
+ * If the client named any of those modules directly — even behind a dynamic
+ * `import("./enclave-registration.js")` — a browser bundler following the browser
+ * entry's graph would drag `node:crypto` into the bundle and fail the build (the
+ * dashboard's vite build did exactly this). So the client never names them. The
+ * Node entry registers a loader for them here on import; the browser entry never
+ * does. A browser caller of a Node-only method therefore gets a clear error, and
+ * a browser bundle of the browser entry reaches no Node builtin at all.
+ *
+ * The imports below are type-only, so they are erased at build and add nothing to
+ * any bundle.
+ */
+
+import type * as RegistrationModule from "./enclave-registration.js";
+import type * as EnclaveSealModule from "./enclave-seal.js";
+
+/** The Node-only surface the client reaches through {@link loadNodeRuntime}. */
+export interface NodeRuntime {
+  readonly registration: typeof RegistrationModule;
+  readonly seal: typeof EnclaveSealModule;
+  /** `node:fs/promises`' `writeFile`, narrowed to what `savePdf` needs. */
+  writeFile(path: string, data: Uint8Array): Promise<void>;
+}
+
+type NodeRuntimeLoader = () => Promise<NodeRuntime>;
+
+let loader: NodeRuntimeLoader | undefined;
+
+/** Register the Node runtime. Called once by the Node entry point (index.ts) on
+ * import; never by the browser entry. */
+export function setNodeRuntimeLoader(load: NodeRuntimeLoader): void {
+  loader = load;
+}
+
+/** Load the Node-only runtime, or throw if it was never registered — the case in
+ * a browser bundle built from `burnledger/browser`. */
+export function loadNodeRuntime(): Promise<NodeRuntime> {
+  if (loader === undefined) {
+    return Promise.reject(
+      new Error(
+        "this operation is Node-only (key enrolment, system registration and " +
+          'savePdf); import BurnLedger from "burnledger", not "burnledger/browser".',
+      ),
+    );
+  }
+  return loader();
+}