sealkeep 0.9.0 → 0.11.0

package/dist/src/context-reader.js

@@ -0,0 +1,447 @@
+import { readSourceBytes } from "./source-reader.js";
+import { isRecalledMemoryLine } from "./search.js";
+import { fail, isSealkeepError } from "./errors.js";
+const object = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : undefined;
+const string = (value) => typeof value === "string" ? value : undefined;
+function textContent(value) {
+    if (typeof value === "string")
+        return value;
+    if (!Array.isArray(value))
+        return "";
+    return value.flatMap((part) => {
+        const item = object(part);
+        if (!item)
+            return [];
+        if (typeof item.text === "string")
+            return [item.text];
+        if (item.type === "tool_result")
+            return [textContent(item.content)];
+        if (item.type === "tool_use")
+            return [JSON.stringify(item.input ?? {})];
+        return [];
+    }).join("\n");
+}
+/** Select an honest excerpt of a long message, not a synthetic summary.
+ * Bound candidate work; explicit cursors always retain their exact offset. */
+function queryTextOffset(text, terms, width) {
+    if (!terms.length || text.length <= width)
+        return 0;
+    const lower = text.toLowerCase();
+    const positions = new Set([0]);
+    for (const term of terms) {
+        let at = -1;
+        for (let count = 0; count < 64; count++) {
+            at = lower.indexOf(term, at + 1);
+            if (at < 0)
+                break;
+            positions.add(Math.max(0, at - Math.floor(width / 4)));
+        }
+    }
+    let selected = 0, coverage = -1;
+    for (const at of positions) {
+        const passage = lower.slice(at, at + width);
+        const score = terms.filter(term => passage.includes(term)).length;
+        if (score > coverage) {
+            coverage = score;
+            selected = at;
+        }
+    }
+    // Never cut a UTF-16 surrogate pair in half.
+    if (selected > 0 && /[\uDC00-\uDFFF]/.test(text[selected]))
+        selected--;
+    return selected;
+}
+/** Newer native Codex logs distinguish real input from injected role:user blocks. */
+function annotatedUserText(payload) {
+    if (payload.type !== "message" || payload.role !== "user")
+        return;
+    const metadata = object(payload.internal_chat_message_metadata_passthrough);
+    const kinds = metadata?.content_item_kinds;
+    if (!Array.isArray(payload.content) || !Array.isArray(kinds) || kinds.length !== payload.content.length
+        || !kinds.every(kind => typeof kind === "string"))
+        return;
+    const outerTurn = string(payload.turn_id);
+    const nativeTurn = string(metadata?.turn_id);
+    if (outerTurn && nativeTurn && outerTurn !== nativeTurn)
+        return;
+    const indexes = [];
+    const text = [];
+    for (let at = 0; at < payload.content.length; at++) {
+        const part = object(payload.content[at]);
+        if (kinds[at] !== "user.text" || part?.type !== "input_text" || typeof part.text !== "string"
+            || !part.text || isRecalledMemoryLine(part.text))
+            continue;
+        indexes.push(at);
+        text.push(part.text);
+    }
+    if (!indexes.length)
+        return;
+    return { text: text.join("\n"), indexes, ...(nativeTurn || outerTurn ? { turnId: nativeTurn || outerTurn } : {}) };
+}
+const retrievalName = (name) => !!name
+    && /(?:^|__|[.:/])sealkeep_(?:search|read_context)$/.test(name);
+/** Native direct MCP calls and code-mode calls retain the actual tool identity. */
+function retrievalCall(name, input) {
+    if (retrievalName(name))
+        return true;
+    let args = object(input);
+    if (!args && typeof input === "string") {
+        try {
+            args = object(JSON.parse(input));
+        }
+        catch { /* code-mode input, not JSON */ }
+    }
+    if (retrievalName(string(args?.tool) ?? string(args?.name)))
+        return true;
+    if (name && /(?:^|[.:])exec$/.test(name) && typeof input === "string") {
+        // Match an executed tool member, not incidental prose naming a tool.
+        return /\btools\.[\w]*sealkeep_(?:search|read_context)\s*\(/.test(input);
+    }
+    return false;
+}
+/** Recognize typed search/context replies when a bounded window omits the call. */
+function retrievedMemoryResult(text) {
+    let remaining = 256 * 1024;
+    let nodes = 32;
+    const inspect = (value, depth) => {
+        if (depth > 12 || --nodes < 0)
+            return false;
+        if (typeof value === "string") {
+            if (value.length > remaining)
+                return false;
+            remaining -= value.length;
+            let candidate = value.trim();
+            const output = candidate.indexOf("\nOutput:\n");
+            if (output >= 0)
+                candidate = candidate.slice(output + "\nOutput:\n".length).trim();
+            if (!/^[{[\"]/.test(candidate))
+                return false;
+            try {
+                return inspect(JSON.parse(candidate), depth + 1);
+            }
+            catch {
+                return false;
+            }
+        }
+        if (Array.isArray(value))
+            return value.slice(0, 16).some(item => inspect(item, depth + 1));
+        const row = object(value);
+        if (!row)
+            return false;
+        if ((row.mode === "content" || row.mode === "metadata") && Array.isArray(row.hits))
+            return true;
+        const source = object(row.source);
+        if (source && typeof source.sourceSha256 === "string" && typeof source.archiveId === "string"
+            && Array.isArray(row.messages) && (row.status === "ok" || row.status === "unsupported"))
+            return true;
+        // Only known response envelopes are traversed, not arbitrary code/input.
+        return [row.content, row.structuredContent, row.result, row.output, row.type === "text" ? row.text : undefined]
+            .some(item => item !== undefined && inspect(item, depth + 1));
+    };
+    return inspect(text, 0);
+}
+/** Byte locations refer to the immutable original JSONL, never reconstructed prose. */
+export function parseContextMessages(bytes, source, byteStart = 0) {
+    const messages = [];
+    let offset = 0;
+    let turnId;
+    const calls = new Map();
+    while (offset < bytes.length) {
+        const newline = bytes.indexOf(10, offset);
+        const end = newline < 0 ? bytes.length : newline;
+        const raw = bytes.subarray(offset, end).toString("utf8");
+        const from = byteStart + offset;
+        offset = newline < 0 ? bytes.length : newline + 1;
+        if (!raw.trim())
+            continue;
+        let row;
+        try {
+            row = object(JSON.parse(raw));
+        }
+        catch {
+            continue;
+        }
+        if (!row)
+            continue;
+        const payload = object(row.payload) ?? row;
+        const nativeUser = row.type === "response_item" ? annotatedUserText(payload) : undefined;
+        // Mixed native rows may contain both genuine user text and hook context.
+        // Only positively annotated, individually filtered user text survives.
+        if (isRecalledMemoryLine(raw) && !nativeUser)
+            continue;
+        if (row.type === "turn_context") {
+            const nativeTurn = string(payload.turn_id);
+            if (nativeTurn) {
+                turnId = nativeTurn;
+                const pendingUser = messages[messages.length - 1];
+                // Only the immediately pending, provisionally identified user event
+                // can acquire this native turn. A new turn cannot relabel old history.
+                if (pendingUser?.actualUserMessage && pendingUser.turnId === pendingUser.messageId)
+                    pendingUser.turnId = nativeTurn;
+            }
+            continue;
+        }
+        let role = "unknown";
+        let text = "";
+        let actualUserMessage = false;
+        let userEvidence;
+        let callId;
+        let parentCallId;
+        let kind = "message";
+        let toolName;
+        let recalled = false;
+        let unresolvedToolResult = false;
+        if (row.type === "event_msg") {
+            if (payload.type === "user_message") {
+                role = "user";
+                text = string(payload.message) ?? "";
+                actualUserMessage = true;
+                userEvidence = "native_user_event";
+            }
+            else if (payload.type === "agent_message") {
+                role = "assistant";
+                text = string(payload.message) ?? "";
+            }
+            else
+                continue;
+        }
+        else if (row.type === "response_item") {
+            if (payload.type === "function_call" || payload.type === "custom_tool_call") {
+                role = "assistant";
+                text = string(payload.arguments) ?? string(payload.input) ?? "";
+                callId = string(payload.call_id);
+                kind = "tool_call";
+                toolName = string(payload.name);
+                recalled = retrievalCall(toolName, text);
+            }
+            else if (payload.type === "function_call_output" || payload.type === "custom_tool_call_output") {
+                role = "tool";
+                text = textContent(payload.output);
+                parentCallId = string(payload.call_id);
+                kind = "tool_result";
+            }
+            else {
+                const rawRole = string(payload.role);
+                if (rawRole === "user" || rawRole === "assistant" || rawRole === "tool")
+                    role = rawRole;
+                else if (rawRole === "system" || rawRole === "developer")
+                    continue;
+                if (rawRole === "tool") {
+                    kind = "tool_result";
+                    parentCallId = string(payload.call_id) ?? string(payload.tool_call_id);
+                }
+                text = nativeUser?.text ?? textContent(payload.content);
+                if (nativeUser) {
+                    actualUserMessage = true;
+                    userEvidence = "native_user_text";
+                }
+                else if (rawRole === "user") {
+                    const kinds = object(payload.internal_chat_message_metadata_passthrough)?.content_item_kinds;
+                    if (Array.isArray(kinds) && kinds.length && kinds.every(kind => typeof kind === "string" && /^(?:plugins|environments|hooks)\./.test(kind)))
+                        continue;
+                }
+            }
+        }
+        else if (row.type === "user" || row.type === "assistant") {
+            const message = object(row.message);
+            const content = message?.content ?? row.message;
+            const result = Array.isArray(content) ? content.map(object).find((part) => part?.type === "tool_result") : undefined;
+            const call = Array.isArray(content) ? content.map(object).find((part) => part?.type === "tool_use") : undefined;
+            role = result ? "tool" : row.type;
+            text = textContent(content);
+            parentCallId = string(result?.tool_use_id);
+            callId = string(call?.id);
+            kind = result ? "tool_result" : call ? "tool_call" : "message";
+            toolName = string(call?.name);
+            recalled = !!call && retrievalCall(toolName, call.input);
+            // Claude also transports automated notifications in role:user rows.
+            // Preserve their contents, but never present them as a human instruction
+            // or let them start a new user turn. Some historical rows lack isMeta.
+            const automatedUser = row.type === "user" && (row.isMeta === true || row.isCompactSummary === true
+                || /^\s*<(?:task-notification|local-command-stdout|local-command-stderr|system-reminder)(?:\s|>)/.test(text));
+            if (automatedUser && !result)
+                role = "unknown";
+            actualUserMessage = row.type === "user" && !result && !automatedUser;
+            if (actualUserMessage)
+                userEvidence = "claude_user_message";
+        }
+        else
+            continue;
+        if (callId)
+            calls.set(callId, { name: toolName, recalled });
+        if (parentCallId) {
+            const call = calls.get(parentCallId);
+            toolName = call?.name;
+            recalled = call?.recalled ?? false;
+        }
+        // A byte window may start after its tool call. Absence of a retrieval
+        // marker is not proof that this output was generated by the current task.
+        unresolvedToolResult = kind === "tool_result" && !toolName;
+        if (kind === "tool_result" && !recalled)
+            recalled = retrievedMemoryResult(text);
+        if (!text)
+            continue;
+        const nativeId = string(payload.id) ?? string(row.uuid) ?? string(object(row.message)?.id);
+        const messageId = `${source.sourceSha256}:${from}${nativeId ? `:${nativeId}` : ""}`;
+        const previous = messages[messages.length - 1];
+        // Codex records both event and response representations of some messages.
+        // Never promote an earlier unproven row or collapse identical new prompts.
+        const explicitUserTurn = nativeUser?.turnId ?? string(payload.turn_id);
+        const userDuplicate = actualUserMessage && previous?.actualUserMessage && previous.userEvidence !== userEvidence
+            && (!explicitUserTurn || previous.turnId === previous.messageId || previous.turnId === explicitUserTurn);
+        if (previous && previous.role === role && previous.kind === kind && previous.text === text
+            && (!actualUserMessage || userDuplicate)) {
+            if (userDuplicate) {
+                if (explicitUserTurn && previous.turnId === previous.messageId)
+                    previous.turnId = explicitUserTurn;
+                turnId = previous.turnId;
+            }
+            continue;
+        }
+        if (actualUserMessage)
+            turnId = nativeUser?.turnId ?? string(payload.turn_id) ?? messageId;
+        messages.push({ messageId, role, kind, provenance: recalled ? "retrieved_memory" : unresolvedToolResult ? "unknown" : "session", text, byteStart: from, byteEnd: byteStart + end,
+            ...(turnId ? { turnId } : {}), ...(actualUserMessage ? { actualUserMessage: true } : {}),
+            ...(userEvidence ? { userEvidence } : {}), ...(nativeUser ? { userContentIndexes: nativeUser.indexes } : {}),
+            ...(toolName ? { toolName } : {}),
+            ...(callId ? { callId } : {}), ...(parentCallId ? { parentCallId } : {}) });
+    }
+    return messages;
+}
+/** Conservative byte accounting bounds text tokens without depending on a model tokenizer. */
+export async function readContext(dataDir, phrase, options) {
+    const maxTokens = options.maxTokens ?? 8192;
+    if (!Number.isSafeInteger(maxTokens) || maxTokens < 2048 || maxTokens > 32768)
+        fail("invalid_argument", "maxTokens must be between 2048 and 32768");
+    if (options.cursor && options.cursor.sourceSha256 !== options.source.sourceSha256)
+        fail("invalid_argument", "The continuation belongs to a different immutable source");
+    const requestedStart = options.cursor?.byteStart ?? options.byteStart ?? 0;
+    if (!Number.isSafeInteger(requestedStart) || requestedStart < 0 || requestedStart > options.source.sourceBytes)
+        fail("invalid_argument", "The context byte position must be a safe integer within this source");
+    if (options.cursor?.textOffset !== undefined && (!Number.isSafeInteger(options.cursor.textOffset) || options.cursor.textOffset < 0))
+        fail("invalid_argument", "The continuation text offset must be a non-negative safe integer");
+    const maximum = options.maxDecodedBytes ?? 16 * 1024 * 1024;
+    // Reparse bounded small sources from their beginning so continuations retain
+    // observed turn/call provenance instead of relabeling an isolated tool echo.
+    const range = options.source.sourceBytes <= maximum
+        ? { start: 0, end: options.source.sourceBytes }
+        : { start: requestedStart, end: Math.min(options.source.sourceBytes, requestedStart + Math.max(1, Math.min(Math.floor(maximum / 2), 256 * 1024))) };
+    let read;
+    try {
+        read = await readSourceBytes(dataDir, phrase, options.source, { ...options, range });
+    }
+    catch (error) {
+        if (isSealkeepError(error) && error.code === "provider_unsupported") {
+            return { status: "unsupported", source: options.source, messages: [],
+                reason: error.details.reason ?? "partial_read_unsupported", message: error.message };
+        }
+        throw error;
+    }
+    try {
+        const lastNewline = read.bytes.lastIndexOf(10);
+        const hasIncompleteTail = read.byteEnd < read.source.sourceBytes && lastNewline !== read.bytes.length - 1;
+        const incompleteByteStart = hasIncompleteTail ? read.byteStart + lastNewline + 1 : undefined;
+        if (hasIncompleteTail && lastNewline < 0) {
+            await read.assertCurrent();
+            return { status: "unsupported", source: read.source, messages: [], reason: "record_exceeds_context_window",
+                message: "The JSONL message crosses this bounded window. Increase the decoded budget or explicitly restore the source.",
+                continuation: { sourceSha256: read.source.sourceSha256, byteStart: read.byteStart }, truncated: true };
+        }
+        const all = parseContextMessages(hasIncompleteTail ? read.bytes.subarray(0, lastNewline + 1) : read.bytes, read.source, read.byteStart);
+        const terms = [...new Set((options.query ?? "").toLowerCase().match(/[\p{L}\p{N}_]+/gu) ?? [])];
+        let anchor = 0;
+        if (options.cursor || options.byteStart !== undefined) {
+            const next = all.findIndex((message) => message.byteStart >= requestedStart);
+            anchor = next < 0 ? all.length : next;
+        }
+        else if (terms.length) {
+            const frequency = terms.map(term => all.filter(message => message.provenance === "session"
+                && message.text.toLowerCase().includes(term)).length);
+            let best = [];
+            for (let index = 0; index < all.length; index++) {
+                const message = all[index];
+                const matches = terms.filter((term) => message.text.toLowerCase().includes(term)).length;
+                const rarity = terms.reduce((sum, term, at) => sum + (message.text.toLowerCase().includes(term)
+                    ? 1 / Math.max(1, frequency[at]) : 0), 0);
+                // Imported memory is useful context but not this source's answer.
+                // Among genuine evidence, coverage still lets a patch/test beat prose;
+                // prose wins only equal coverage, with later decisions breaking ties.
+                const score = [matches > 0 ? 1 : 0, message.provenance === "session" ? 1 : 0,
+                    matches, rarity, message.role === "assistant" || message.role === "tool" ? 1 : 0,
+                    message.kind === "message" ? 1 : 0, index];
+                const difference = score.findIndex((value, at) => value !== (best[at] ?? -1));
+                if (difference >= 0 && score[difference] > (best[difference] ?? -1)) {
+                    anchor = index;
+                    best = score;
+                }
+            }
+        }
+        const selected = all[anchor];
+        if (options.cursor?.textOffset !== undefined && options.cursor.textOffset > 0
+            && (!selected || selected.byteStart !== requestedStart || options.cursor.textOffset > selected.text.length)) {
+            fail("invalid_argument", "The continuation text offset is outside its source message");
+        }
+        const user = selected ? all.slice(0, anchor + 1).reverse().find((message) => message.actualUserMessage
+            && (!selected.turnId || message.turnId === selected.turnId)) : undefined;
+        const neighbors = Math.max(0, Math.min(options.neighboringMessages ?? 3, 12));
+        const start = options.cursor || !selected ? anchor : Math.max(0, anchor - neighbors);
+        const end = Math.min(all.length, anchor + neighbors + 1);
+        // A continuation is forward-only. Keep its initiating-user metadata, but
+        // do not spend the next page on earlier prompt text and jump its cursor
+        // backwards. Continuing within that prompt itself remains valid.
+        const includeUserText = user && (!options.cursor || user.byteStart >= requestedStart);
+        const candidates = [...new Set([...(selected ? [selected] : []), ...(includeUserText ? [user] : []), ...all.slice(start, end)])];
+        const messages = [];
+        const base = { status: "ok", source: read.source, extractionVersion: 3,
+            userAnchor: user ? { status: "observed", messageId: user.messageId, byteStart: user.byteStart }
+                : { status: "unavailable", reason: "No actual user event is present in this verified source window" },
+            range: { byteStart: read.byteStart, byteEnd: read.byteEnd },
+            usage: { wireBytes: read.wireBytes, decodedBytes: read.decodedBytes, tokenBudget: maxTokens, accounting: "conservative_utf8_bytes" } };
+        let remaining = maxTokens - Buffer.byteLength(JSON.stringify({ ...base, messages: [], truncated: true })) - 220;
+        if (remaining < 128)
+            fail("invalid_argument", "The token budget is too small for this citation's provenance");
+        let continuation;
+        for (const message of candidates) {
+            const offset = options.cursor && message.byteStart === options.cursor.byteStart ? options.cursor.textOffset ?? 0
+                : !options.cursor && options.byteStart === undefined && message === selected
+                    ? queryTextOffset(message.text, terms, Math.max(128, Math.floor((remaining - 700) / 2))) : 0;
+            const text = message.text.slice(offset);
+            const overhead = Buffer.byteLength(JSON.stringify({ ...message, text: "", textOffset: offset, truncated: true }), "utf8") + 4;
+            if (remaining <= overhead) {
+                continuation = { sourceSha256: read.source.sourceSha256, byteStart: message.byteStart, ...(offset ? { textOffset: offset } : {}) };
+                break;
+            }
+            const allowance = remaining - overhead;
+            let low = 0;
+            let high = text.length;
+            while (low < high) {
+                const midpoint = Math.ceil((low + high) / 2);
+                if (Buffer.byteLength(JSON.stringify(text.slice(0, midpoint))) - 2 <= allowance)
+                    low = midpoint;
+                else
+                    high = midpoint - 1;
+            }
+            let kept = text.slice(0, low);
+            if (kept.length && /[\uD800-\uDBFF]$/.test(kept))
+                kept = kept.slice(0, -1);
+            const truncated = kept.length < text.length;
+            messages.push({ ...message, text: kept, ...(offset ? { textOffset: offset, omittedPrefix: true } : {}), ...(truncated ? { truncated: true } : {}) });
+            remaining -= overhead + Buffer.byteLength(JSON.stringify(kept)) - 2;
+            if (truncated) {
+                continuation = { sourceSha256: read.source.sourceSha256, byteStart: message.byteStart, textOffset: offset + kept.length };
+                break;
+            }
+        }
+        if (!continuation && end < all.length)
+            continuation = { sourceSha256: read.source.sourceSha256, byteStart: all[end].byteStart };
+        if (!continuation && read.byteEnd < read.source.sourceBytes)
+            continuation = { sourceSha256: read.source.sourceSha256,
+                byteStart: incompleteByteStart ?? read.byteEnd };
+        await read.assertCurrent();
+        return { ...base, messages,
+            ...(continuation ? { continuation, truncated: true } : { truncated: false }) };
+    }
+    finally {
+        read.bytes.fill(0);
+    }
+}

package/dist/src/control-plane/auth.d.ts

@@ -9,13 +9,33 @@ import type { ControlPlaneStore, Device } from "./store.js";
  * changes the string, and replaying it verbatim is caught by the nonce cache.
  */
 export declare const SIGNATURE_WINDOW_MS: number;
+/**
+ * The request-signing contract, mid-rename.
+ *
+ * These four header names and the signing prefix below are the one place where
+ * a rename cannot be done on one side alone: the prefix is INSIDE the signed
+ * message, so changing it changes every signature. Rename the client first and
+ * every request 401s; rename the server first and nothing breaks, because a
+ * server that accepts both is compatible with a client that has not moved yet.
+ *
+ * So the server half lands first and reads either spelling. The client keeps
+ * sending the old names until the deployed plane is known to accept the new
+ * ones — flipping `SIGNS_AS` is the whole of that second step.
+ */
 export declare const HEADERS: {
+    readonly device: "x-sealkeep-device";
+    readonly timestamp: "x-sealkeep-timestamp";
+    readonly nonce: "x-sealkeep-nonce";
+    readonly signature: "x-sealkeep-signature";
+};
+export declare const LEGACY_HEADERS: {
     readonly device: "x-vaultline-device";
     readonly timestamp: "x-vaultline-timestamp";
     readonly nonce: "x-vaultline-nonce";
     readonly signature: "x-vaultline-signature";
 };
-export declare function signingString(method: string, path: string, timestamp: string, nonce: string, body: Buffer | string): string;
+export declare const SIGNING_PREFIXES: readonly ["sealkeep-request:v1", "vaultline-request:v1"];
+export declare function signingString(method: string, path: string, timestamp: string, nonce: string, body: Buffer | string, prefix?: string): string;
 /** Client helper: produces the four headers a signed request needs. */
 export declare function signRequest(input: {
     method: string;
@@ -54,9 +74,17 @@ export declare function hashEnrollmentToken(token: string): string;
 export declare function enrollmentTokenMatches(token: string, hash: string): boolean;
 /** A token bucket per key. Abuse control that does not need shared state. */
 export declare class RateLimiter {
-    private readonly capacity;
-    private readonly refillPerSecond;
+    readonly capacity: number;
+    readonly refillPerSecond: number;
+    private readonly maxBuckets;
+    private readonly idleTtlMs;
     private readonly buckets;
-    constructor(capacity?: number, refillPerSecond?: number);
+    constructor(capacity?: number, refillPerSecond?: number, maxBuckets?: number, idleTtlMs?: number);
+    consume(key: string, now?: number): {
+        allowed: boolean;
+        remaining: number;
+        retryAfterMs: number;
+        resetAt: number;
+    };
     take(key: string, now?: number): boolean;
 }

package/dist/src/control-plane/auth.js

@@ -7,15 +7,43 @@ import { createHash, createPublicKey, sign as edSign, verify as edVerify, timing
  * changes the string, and replaying it verbatim is caught by the nonce cache.
  */
 export const SIGNATURE_WINDOW_MS = 5 * 60_000;
+/**
+ * The request-signing contract, mid-rename.
+ *
+ * These four header names and the signing prefix below are the one place where
+ * a rename cannot be done on one side alone: the prefix is INSIDE the signed
+ * message, so changing it changes every signature. Rename the client first and
+ * every request 401s; rename the server first and nothing breaks, because a
+ * server that accepts both is compatible with a client that has not moved yet.
+ *
+ * So the server half lands first and reads either spelling. The client keeps
+ * sending the old names until the deployed plane is known to accept the new
+ * ones — flipping `SIGNS_AS` is the whole of that second step.
+ */
 export const HEADERS = {
+    device: "x-sealkeep-device",
+    timestamp: "x-sealkeep-timestamp",
+    nonce: "x-sealkeep-nonce",
+    signature: "x-sealkeep-signature"
+};
+export const LEGACY_HEADERS = {
     device: "x-vaultline-device",
     timestamp: "x-vaultline-timestamp",
     nonce: "x-vaultline-nonce",
     signature: "x-vaultline-signature"
 };
+export const SIGNING_PREFIXES = ["sealkeep-request:v1", "vaultline-request:v1"];
+/**
+ * What the CLIENT signs and sends today. Still the old spelling, deliberately:
+ * the deployed control plane has not been updated yet, and a client that signs
+ * with a prefix the server does not know is a client that cannot talk to its
+ * own account. Flip to index 0 in the same change that deploys the plane.
+ */
+const SIGNS_AS = SIGNING_PREFIXES[1];
+const SENDS = LEGACY_HEADERS;
 const sha256hex = (value) => createHash("sha256").update(value).digest("hex");
-export function signingString(method, path, timestamp, nonce, body) {
-    return `vaultline-request:v1\n${method.toUpperCase()}\n${path}\n${timestamp}\n${nonce}\n${sha256hex(body)}`;
+export function signingString(method, path, timestamp, nonce, body, prefix = SIGNS_AS) {
+    return `${prefix}\n${method.toUpperCase()}\n${path}\n${timestamp}\n${nonce}\n${sha256hex(body)}`;
 }
 /** Client helper: produces the four headers a signed request needs. */
 export function signRequest(input) {
@@ -23,10 +51,10 @@ export function signRequest(input) {
     const message = signingString(input.method, input.path, timestamp, input.nonce, input.body ?? "");
     const key = typeof input.privateKey === "string" ? createPublicKey(input.privateKey) : input.privateKey;
     return {
-        [HEADERS.device]: input.deviceId,
-        [HEADERS.timestamp]: timestamp,
-        [HEADERS.nonce]: input.nonce,
-        [HEADERS.signature]: edSign(null, Buffer.from(message), key).toString("base64")
+        [SENDS.device]: input.deviceId,
+        [SENDS.timestamp]: timestamp,
+        [SENDS.nonce]: input.nonce,
+        [SENDS.signature]: edSign(null, Buffer.from(message), key).toString("base64")
     };
 }
 export class NonceCache {
@@ -52,10 +80,11 @@ export class NonceCache {
 }
 export function authenticate(store, request, path, body, nonces, now = Date.now()) {
     const header = (name) => { const value = request.headers[name]; return typeof value === "string" ? value : undefined; };
-    const deviceId = header(HEADERS.device);
-    const timestamp = header(HEADERS.timestamp);
-    const nonce = header(HEADERS.nonce);
-    const signature = header(HEADERS.signature);
+    const either = (name) => header(HEADERS[name]) ?? header(LEGACY_HEADERS[name]);
+    const deviceId = either("device");
+    const timestamp = either("timestamp");
+    const nonce = either("nonce");
+    const signature = either("signature");
     if (!deviceId || !timestamp || !nonce || !signature)
         return { ok: false, status: 401, code: "unauthorized", message: "A signed device request is required" };
     const at = Date.parse(timestamp);
@@ -70,13 +99,21 @@ export function authenticate(store, request, path, body, nonces, now = Date.now(
         return { ok: false, status: 401, code: "unauthorized", message: "Unknown device", deviceId };
     if (device.revokedAt)
         return { ok: false, status: 403, code: "forbidden", message: `Device revoked at ${device.revokedAt}`, deviceId };
-    const message = Buffer.from(signingString(request.method ?? "GET", path, timestamp, nonce, body));
+    // Either prefix verifies, so a client on the old spelling keeps working while
+    // the plane is ahead of it. Both are checked because the prefix is signed:
+    // there is no way to tell from the outside which one the client used.
+    const key = publicKeyFromRaw(device.publicKey);
+    const claimed = Buffer.from(signature, "base64");
     let valid = false;
-    try {
-        valid = edVerify(null, message, publicKeyFromRaw(device.publicKey), Buffer.from(signature, "base64"));
-    }
-    catch {
-        valid = false;
+    for (const prefix of SIGNING_PREFIXES) {
+        const message = Buffer.from(signingString(request.method ?? "GET", path, timestamp, nonce, body, prefix));
+        try {
+            if (edVerify(null, message, key, claimed)) {
+                valid = true;
+                break;
+            }
+        }
+        catch { /* try the other */ }
     }
     if (!valid)
         return { ok: false, status: 401, code: "unauthorized", message: "Request signature does not verify", deviceId };
@@ -104,20 +141,44 @@ export function enrollmentTokenMatches(token, hash) {
 export class RateLimiter {
     capacity;
     refillPerSecond;
+    maxBuckets;
+    idleTtlMs;
     buckets = new Map();
-    constructor(capacity = 60, refillPerSecond = 1) {
+    constructor(capacity = 60, refillPerSecond = 1, maxBuckets = 10_000, idleTtlMs = 15 * 60_000) {
         this.capacity = capacity;
         this.refillPerSecond = refillPerSecond;
+        this.maxBuckets = maxBuckets;
+        this.idleTtlMs = idleTtlMs;
     }
-    take(key, now = Date.now()) {
+    consume(key, now = Date.now()) {
+        // The key is an untrusted network cardinality even when each value is an
+        // unspoofable remote address. Bound memory under distributed scans. The
+        // O(n) sweep runs only when a new key would cross the cap, never on the
+        // normal hot path.
+        if (!this.buckets.has(key) && this.buckets.size >= this.maxBuckets) {
+            for (const [candidate, bucket] of this.buckets) {
+                if (now - bucket.updatedAt > this.idleTtlMs)
+                    this.buckets.delete(candidate);
+            }
+            while (this.buckets.size >= this.maxBuckets) {
+                const oldest = this.buckets.keys().next().value;
+                if (oldest === undefined)
+                    break;
+                this.buckets.delete(oldest);
+            }
+        }
         const bucket = this.buckets.get(key) ?? { tokens: this.capacity, updatedAt: now };
         const refill = ((now - bucket.updatedAt) / 1000) * this.refillPerSecond;
         const tokens = Math.min(this.capacity, bucket.tokens + refill);
-        if (tokens < 1) {
-            this.buckets.set(key, { tokens, updatedAt: now });
-            return false;
-        }
-        this.buckets.set(key, { tokens: tokens - 1, updatedAt: now });
-        return true;
+        const allowed = tokens >= 1;
+        const settled = allowed ? tokens - 1 : tokens;
+        // Refresh insertion order so emergency eviction removes the least recently
+        // consumed bucket instead of an arbitrary long-lived customer.
+        this.buckets.delete(key);
+        this.buckets.set(key, { tokens: settled, updatedAt: now });
+        const retryAfterMs = allowed ? 0 : this.refillPerSecond > 0 ? Math.ceil(((1 - settled) / this.refillPerSecond) * 1_000) : 60_000;
+        const resetMs = this.refillPerSecond > 0 ? Math.ceil(((this.capacity - settled) / this.refillPerSecond) * 1_000) : 60_000;
+        return { allowed, remaining: Math.max(0, Math.floor(settled)), retryAfterMs, resetAt: now + resetMs };
     }
+    take(key, now = Date.now()) { return this.consume(key, now).allowed; }
 }