sealkeep 0.9.0 → 0.11.0

package/dist/packages/{vaultline-crypto → sealkeep-crypto}/src/stream.js

@@ -17,7 +17,9 @@
  */
 import { createReadStream, createWriteStream } from "node:fs";
 import { open, rm, stat } from "node:fs/promises";
+import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
+import { setImmediate as yieldToEventLoop } from "node:timers/promises";
 import { createGunzip, createGzip, gunzipSync, gzipSync } from "node:zlib";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { dirname, join } from "node:path";
@@ -26,7 +28,9 @@ import { CryptoError, unwrapArchiveKey, zeroize } from "./recipients.js";
 import { StreamingSha256 } from "./sha256-stream.js";
 import { wrapAll, validateEnvelope } from "./envelope.js";
 import { DEFAULT_CHUNK_BYTES, ENVELOPE_VERSION, KEY_BYTES, SUITES, TAG_BYTES, chunkAad, chunkNonce } from "./format.js";
+import { squeezeStream, squeezeSync, unsqueezeStream, unsqueezeSync } from "./squeeze.js";
 const sha256 = (input) => createHash("sha256").update(input).digest("hex");
+const COOPERATIVE_BYTES = 16 * 1024 * 1024;
 /**
  * Both hash flavours answer in hex here; the branch exists so the seal loop can
  * feed an injected resumable hasher and a fresh `createHash` identically. Note
@@ -35,10 +39,28 @@ const sha256 = (input) => createHash("sha256").update(input).digest("hex");
  */
 const digestHex = (hash) => hash instanceof StreamingSha256 ? hash.digestHex() : hash.digest("hex");
 /** `FileHandle.read` may come up short; a chunk boundary is not a suggestion. */
-async function readExactly(handle, into, length, position) {
+async function waitForSignal(work, signal) {
+    if (!signal)
+        return work;
+    signal.throwIfAborted();
+    let cancel;
+    const aborted = new Promise((_resolve, reject) => {
+        cancel = () => reject(signal.reason instanceof Error ? signal.reason : new DOMException("The seal was cancelled", "AbortError"));
+        signal.addEventListener("abort", cancel, { once: true });
+    });
+    try {
+        return await Promise.race([work, aborted]);
+    }
+    finally {
+        if (cancel)
+            signal.removeEventListener("abort", cancel);
+    }
+}
+async function readExactly(handle, into, length, position, signal) {
     let filled = 0;
     while (filled < length) {
-        const { bytesRead } = await handle.read(into, filled, length - filled, position + filled);
+        signal?.throwIfAborted();
+        const { bytesRead } = await waitForSignal(handle.read(into, filled, length - filled, position + filled), signal);
         if (bytesRead === 0)
             throw new CryptoError("ciphertext_length_mismatch", `Expected ${length} bytes at offset ${position}; the file ended after ${filled}`);
         filled += bytesRead;
@@ -53,6 +75,7 @@ async function readExactly(handle, into, length, position) {
  * must happen after this resolves. On failure the destination is removed.
  */
 export async function sealArchiveToFile(source, destPath, options) {
+    options.signal?.throwIfAborted();
     const suite = options.suite ?? "chacha20-poly1305";
     if (!SUITES.includes(suite))
         throw new CryptoError("suite_unsupported", `Unsupported suite: ${suite}`);
@@ -64,8 +87,14 @@ export async function sealArchiveToFile(source, destPath, options) {
     const noncePrefix = options.deterministic?.noncePrefix ?? randomBytes(4);
     if (archiveKey.length !== KEY_BYTES)
         throw new CryptoError("key_malformed", `An archive key must be ${KEY_BYTES} bytes`);
-    const compressed = (options.compression ?? "none") === "gzip";
-    const chunkCompressed = (options.compression ?? "none") === "gzip-chunk";
+    // Which compressor, and whether it sees the whole file or one chunk at a
+    // time. Whole-file is the one that matters: the duplicate screenshots this
+    // is here to collapse sit megabytes apart, so a per-chunk window never
+    // sees them. Measured on one 672 MB session: 4 MB chunks 2x, whole file 59x.
+    const codec = options.compression ?? "none";
+    const zstd = codec === "zstd" || codec === "zstd-chunk";
+    const compressed = codec === "gzip" || codec === "zstd";
+    const chunkCompressed = codec === "gzip-chunk" || codec === "zstd-chunk";
     const start = source.start ?? 0;
     const sourceBytes = (await stat(source.path)).size;
     const end = Math.min(source.end ?? sourceBytes, sourceBytes);
@@ -101,16 +130,23 @@ export async function sealArchiveToFile(source, destPath, options) {
     let originalBytes = 0;
     try {
         if (compressed) {
+            let nextYieldAt = COOPERATIVE_BYTES;
             // Pass one: the caller's bytes are hashed on the way past, so the source
             // is read exactly once even though the body is produced separately.
-            await pipeline(createReadStream(source.path, { start, end: Math.max(start, end - 1) }), async function* (chunks) {
+            await pipeline(createReadStream(source.path, { start, end: Math.max(start, end - 1), signal: options.signal }), async function* (chunks) {
                 for await (const piece of chunks) {
+                    options.signal?.throwIfAborted();
                     originalHash.update(piece);
                     originalBytes += piece.length;
                     options.onProgress?.(originalBytes);
+                    if (originalBytes >= nextYieldAt) {
+                        nextYieldAt = originalBytes + COOPERATIVE_BYTES;
+                        await options.onYield?.();
+                        options.signal?.throwIfAborted();
+                    }
                     yield piece;
                 }
-            }, createGzip({ level: 6 }), createWriteStream(bodyPath, { mode: 0o600 }));
+            }, zstd ? squeezeStream() : createGzip({ level: 6 }), createWriteStream(bodyPath, { mode: 0o600, signal: options.signal }), { signal: options.signal });
         }
         const bodyStart = compressed ? 0 : start;
         const bodyBytes = compressed ? (await stat(bodyPath)).size : end - start;
@@ -120,12 +156,14 @@ export async function sealArchiveToFile(source, destPath, options) {
         const ciphertextHash = createHash("sha256");
         let storedBytes = 0;
         const buffer = Buffer.allocUnsafe(Math.min(chunkBytes, Math.max(bodyBytes, 1)));
+        let nextSealYieldAt = COOPERATIVE_BYTES;
         const body = await open(bodyPath, "r");
         const dest = await open(destPath, "w", 0o600);
         try {
             for (let index = 0; index < totalChunks; index += 1) {
+                options.signal?.throwIfAborted();
                 const want = Math.max(0, Math.min(chunkBytes, bodyBytes - index * chunkBytes));
-                const slice = want === 0 ? buffer.subarray(0, 0) : await readExactly(body, buffer, want, bodyStart + index * chunkBytes);
+                const slice = want === 0 ? buffer.subarray(0, 0) : await readExactly(body, buffer, want, bodyStart + index * chunkBytes, options.signal);
                 const final = index === totalChunks - 1;
                 const nonce = chunkNonce(noncePrefix, index);
                 const cipher = aeadCipher(suite, archiveKey, nonce);
@@ -144,12 +182,17 @@ export async function sealArchiveToFile(source, destPath, options) {
                 // the restore, which is far too late if the source has been reclaimed
                 // in between. Refusing here keeps the archive and the hash the same
                 // object for the same reason the destination path checks its errno.
-                const { bytesWritten } = await dest.write(stored);
+                const { bytesWritten } = await waitForSignal(dest.write(stored), options.signal);
                 if (bytesWritten !== stored.length) {
                     throw new CryptoError("destination_write_failed", `Only ${bytesWritten} of ${stored.length} bytes of chunk ${index} reached ${destPath} — the volume is probably full`);
                 }
                 storedBytes += stored.length;
                 chunks.push({ index, plaintextBytes: slice.length, storedBytes: stored.length, sha256: sha256(stored), nonce: nonce.toString("base64"), final });
+                if ((index + 1) * chunkBytes >= nextSealYieldAt) {
+                    nextSealYieldAt = (index + 1) * chunkBytes + COOPERATIVE_BYTES;
+                    await options.onYield?.();
+                    options.signal?.throwIfAborted();
+                }
             }
         }
         finally {
@@ -160,7 +203,7 @@ export async function sealArchiveToFile(source, destPath, options) {
             version: ENVELOPE_VERSION, archiveId, suite, chunkBytes, chunks,
             manifest: {
                 plaintextSha256: bodyHash.digest("hex"), plaintextBytes: bodyBytes,
-                ...(compressed ? { compression: "gzip", originalBytes, originalSha256: originalHash.digest("hex") } : {}),
+                ...(compressed ? { compression: zstd ? "zstd" : "gzip", originalBytes, originalSha256: originalHash.digest("hex") } : {}),
                 createdAt: options.createdAt ?? new Date().toISOString(), adapter: options.adapter
             },
             wrappedKeys: wrapAll(archiveKey, options.recipients, suite, archiveId, options.deterministic)
@@ -216,12 +259,46 @@ function writeFailure(error, destPath) {
  * a rejection can leave a partial file behind, which is why `restoreArchive`
  * renames into place rather than writing the destination directly.
  */
-export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlock) {
+/**
+ * `destPath` may be a Writable instead of a path. Verification needs to prove an
+ * archive decrypts to its recorded bytes, and materialising the plaintext to do
+ * so costs as much free disk as the original — on the nearly-full disk that
+ * makes someone reach for this product in the first place, that is exactly the
+ * space they do not have, so the proof became impossible precisely when it
+ * mattered. Every integrity check below runs the same either way; only the
+ * destination changes.
+ */
+export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlock, options = {}) {
+    const sink = () => typeof destPath === "string" ? createWriteStream(destPath, { mode: 0o600 }) : destPath;
+    const destLabel = typeof destPath === "string" ? destPath : "(stream)";
     const storedOnDisk = (await stat(ciphertextPath)).size;
     validateEnvelope(envelope, storedOnDisk);
+    if (options.maxStoredChunkBytes !== undefined
+        && (!Number.isSafeInteger(options.maxStoredChunkBytes) || options.maxStoredChunkBytes <= 0)) {
+        throw new CryptoError("resource_limit_invalid", "maxStoredChunkBytes must be a positive safe integer");
+    }
+    if (options.maxOriginalBytes !== undefined
+        && (!Number.isSafeInteger(options.maxOriginalBytes) || options.maxOriginalBytes < 0)) {
+        throw new CryptoError("resource_limit_invalid", "maxOriginalBytes must be a non-negative safe integer");
+    }
+    if (options.maxExpandedChunkBytes !== undefined
+        && (!Number.isSafeInteger(options.maxExpandedChunkBytes) || options.maxExpandedChunkBytes < 0)) {
+        throw new CryptoError("resource_limit_invalid", "maxExpandedChunkBytes must be a non-negative safe integer");
+    }
+    if (options.maxStoredChunkBytes !== undefined
+        && envelope.chunks.some((chunk) => chunk.storedBytes > options.maxStoredChunkBytes)) {
+        throw new CryptoError("resource_limit_exceeded", "A stored archive chunk exceeds the configured opening limit");
+    }
     const compression = envelope.manifest.compression;
-    if (compression !== undefined && compression !== "gzip" && compression !== "gzip-chunk")
+    if (compression !== undefined && compression !== "gzip" && compression !== "gzip-chunk" && compression !== "zstd" && compression !== "zstd-chunk")
         throw new CryptoError("envelope_malformed", "Unsupported compression");
+    // The archive says which compressor sealed it. Everything written before
+    // zstd existed says gzip and keeps opening through the gzip path.
+    const wasZstd = compression === "zstd" || compression === "zstd-chunk";
+    const declaredOriginalBytes = compression === undefined ? envelope.manifest.plaintextBytes : envelope.manifest.originalBytes;
+    if (options.maxOriginalBytes !== undefined && declaredOriginalBytes > options.maxOriginalBytes) {
+        throw new CryptoError("resource_limit_exceeded", "The archive's declared original size exceeds the configured opening limit");
+    }
     const archiveKey = unwrapArchiveKey(envelope.wrappedKeys, envelope.suite, envelope.archiveId, unlock);
     if (archiveKey.length !== KEY_BYTES) {
         zeroize(archiveKey);
@@ -262,40 +339,80 @@ export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlo
         if (bodyDigest !== envelope.manifest.plaintextSha256)
             throw new CryptoError("plaintext_hash_mismatch", "Decrypted bytes do not match the manifest hash");
     }
+    function accountOriginal(piece) {
+        const next = originalBytes + piece.length;
+        if (!Number.isSafeInteger(next) || (options.maxOriginalBytes !== undefined && next > options.maxOriginalBytes)) {
+            throw new CryptoError("resource_limit_exceeded", "Decompressed archive bytes exceed the configured opening limit");
+        }
+        originalHash.update(piece);
+        originalBytes = next;
+    }
     async function* measure(chunks) {
         for await (const piece of chunks) {
-            originalHash.update(piece);
-            originalBytes += piece.length;
+            accountOriginal(piece);
             yield piece;
         }
     }
     try {
-        if (compression === "gzip-chunk") {
+        if (compression === "gzip-chunk" || compression === "zstd-chunk") {
             // Each authenticated piece is exactly one chunk's compressed slice —
             // undone on its own, in chunk order. This is the same access pattern a
             // ranged fetch will use, just walked start to end.
             async function* perChunk(chunks) {
+                let index = 0;
                 for await (const piece of chunks) {
-                    let slice;
-                    try {
-                        slice = gunzipSync(piece);
+                    let chunkBytes = 0;
+                    const accountChunk = (slice) => {
+                        const next = chunkBytes + slice.length;
+                        if (!Number.isSafeInteger(next)
+                            || (options.maxExpandedChunkBytes !== undefined && next > options.maxExpandedChunkBytes)) {
+                            throw new CryptoError("resource_limit_exceeded", "One decompressed archive chunk exceeds the configured opening limit");
+                        }
+                        chunkBytes = next;
+                        accountOriginal(slice);
+                    };
+                    if (options.streamChunkDecompression || options.maxOriginalBytes !== undefined
+                        || options.maxExpandedChunkBytes !== undefined) {
+                        try {
+                            const expanded = Readable.from([piece]).pipe(wasZstd ? unsqueezeStream() : createGunzip());
+                            for await (const chunk of expanded) {
+                                const slice = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+                                accountChunk(slice);
+                                yield slice;
+                            }
+                        }
+                        catch (error) {
+                            if (error instanceof CryptoError)
+                                throw error;
+                            throw new CryptoError("plaintext_hash_mismatch", "Decompression failed after authentication");
+                        }
                     }
-                    catch {
-                        throw new CryptoError("plaintext_hash_mismatch", "Decompression failed after authentication");
+                    else {
+                        let slice;
+                        try {
+                            slice = wasZstd ? unsqueezeSync(piece) : gunzipSync(piece);
+                        }
+                        catch {
+                            throw new CryptoError("plaintext_hash_mismatch", "Decompression failed after authentication");
+                        }
+                        accountChunk(slice);
+                        yield slice;
                     }
-                    originalHash.update(slice);
-                    originalBytes += slice.length;
-                    yield slice;
+                    const declaredRawBytes = envelope.chunks[index]?.rawBytes;
+                    if (declaredRawBytes !== undefined && chunkBytes !== declaredRawBytes) {
+                        throw new CryptoError("plaintext_length_mismatch", `Decompressed chunk ${index} does not match its recorded original length`);
+                    }
+                    index += 1;
                 }
             }
             try {
-                await pipeline(authenticatedBody(), perChunk, createWriteStream(destPath, { mode: 0o600 }));
+                await pipeline(authenticatedBody(), perChunk, sink());
             }
             catch (error) {
                 if (error instanceof CryptoError)
                     throw error;
                 if (isSystemError(error))
-                    throw writeFailure(error, destPath);
+                    throw writeFailure(error, destLabel);
                 throw error;
             }
             if (originalBytes !== envelope.manifest.originalBytes)
@@ -305,9 +422,9 @@ export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlo
                 throw new CryptoError("plaintext_hash_mismatch", "Decompressed bytes do not match the manifest hash");
             return { bytes: originalBytes, sha256: digest };
         }
-        if (compression === "gzip") {
+        if (compression === "gzip" || compression === "zstd") {
             try {
-                await pipeline(authenticatedBody(), createGunzip(), measure, createWriteStream(destPath, { mode: 0o600 }));
+                await pipeline(authenticatedBody(), wasZstd ? unsqueezeStream() : createGunzip(), measure, sink());
             }
             catch (error) {
                 // A zlib failure here is not a tampering signal — every byte fed to the
@@ -316,7 +433,7 @@ export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlo
                 if (error instanceof CryptoError)
                     throw error;
                 if (isSystemError(error))
-                    throw writeFailure(error, destPath);
+                    throw writeFailure(error, destLabel);
                 throw new CryptoError("plaintext_hash_mismatch", "Decompression failed after authentication");
             }
             // The archive is honoured only once the caller's own bytes are proven, not
@@ -329,13 +446,13 @@ export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlo
             return { bytes: originalBytes, sha256: digest };
         }
         try {
-            await pipeline(authenticatedBody(), createWriteStream(destPath, { mode: 0o600 }));
+            await pipeline(authenticatedBody(), sink());
         }
         catch (error) {
             if (error instanceof CryptoError)
                 throw error;
             if (isSystemError(error))
-                throw writeFailure(error, destPath);
+                throw writeFailure(error, destLabel);
             throw error;
         }
         return { bytes: bodyBytes, sha256: bodyDigest };
@@ -356,7 +473,8 @@ export async function openArchiveToFile(envelope, ciphertextPath, destPath, unlo
  *
  * An offset past the end of the file is simply absent from the result.
  */
-export async function hashFilePrefixes(path, offsets) {
+export async function hashFilePrefixes(path, offsets, onProgress, signal, onYield) {
+    signal?.throwIfAborted();
     const wanted = [...new Set(offsets)].filter((offset) => offset > 0).sort((a, b) => a - b);
     const digests = new Map();
     if (wanted.length === 0)
@@ -367,7 +485,9 @@ export async function hashFilePrefixes(path, offsets) {
     const limit = wanted[wanted.length - 1];
     let read = 0;
     let next = 0;
-    for await (const piece of createReadStream(path, { start: 0, end: limit - 1 })) {
+    let nextYield = COOPERATIVE_BYTES;
+    for await (const piece of createReadStream(path, { start: 0, end: limit - 1, signal })) {
+        signal?.throwIfAborted();
         const buffer = piece;
         let offset = 0;
         while (offset < buffer.length && next < wanted.length) {
@@ -378,6 +498,17 @@ export async function hashFilePrefixes(path, offsets) {
             while (next < wanted.length && wanted[next] === read)
                 digests.set(wanted[next++], hash.copy().digest("hex"));
         }
+        onProgress?.(read);
+        if (read >= nextYield) {
+            nextYield = read + COOPERATIVE_BYTES;
+            // A cached multi-gigabyte file can keep the stream iterator's promises
+            // continuously ready. Explicitly visit the timers/check phases so the
+            // daemon heartbeat and queue lease are not starved by useful hashing.
+            if (onYield)
+                await onYield();
+            else
+                await yieldToEventLoop();
+        }
     }
     return digests;
 }
@@ -388,15 +519,26 @@ export async function hashFilePrefixes(path, offsets) {
  * live file and comparing it with what an archive recorded is the only evidence
  * that the archive's bytes are still a prefix of it.
  */
-export async function hashFileRange(path, start = 0, end) {
+export async function hashFileRange(path, start = 0, end, onProgress, signal, onYield) {
+    signal?.throwIfAborted();
     const size = (await stat(path)).size;
     const last = Math.min(end ?? size, size);
     const hash = createHash("sha256");
     let bytes = 0;
+    let nextYield = COOPERATIVE_BYTES;
     if (last > start) {
-        for await (const piece of createReadStream(path, { start, end: last - 1 })) {
+        for await (const piece of createReadStream(path, { start, end: last - 1, signal })) {
+            signal?.throwIfAborted();
             hash.update(piece);
             bytes += piece.length;
+            onProgress?.(bytes);
+            if (bytes >= nextYield) {
+                nextYield = bytes + COOPERATIVE_BYTES;
+                if (onYield)
+                    await onYield();
+                else
+                    await yieldToEventLoop();
+            }
         }
     }
     return { sha256: hash.digest("hex"), bytes };
@@ -409,6 +551,7 @@ export async function hashFileRange(path, start = 0, end) {
  * in memory, full stop.
  */
 export async function sealChunksToSink(source, sink, options) {
+    options.signal?.throwIfAborted();
     const suite = options.suite ?? "chacha20-poly1305";
     const chunkBytes = options.chunkBytes ?? DEFAULT_CHUNK_BYTES;
     const archiveId = options.archiveId ?? randomUUID();
@@ -416,6 +559,9 @@ export async function sealChunksToSink(source, sink, options) {
     const archiveKey = options.archiveKey ?? randomBytes(KEY_BYTES);
     const noncePrefix = options.noncePrefix ?? randomBytes(4);
     const firstChunkIndex = options.firstChunkIndex ?? 0;
+    // Per-chunk compression, so the window is one chunk wide either way; zstd
+    // still beats gzip here, just not by the margin the whole-file path gets.
+    const zstd = (options.compression ?? "none") === "zstd-chunk";
     if (!Number.isInteger(firstChunkIndex) || firstChunkIndex < 0)
         throw new CryptoError("invalid_range", "firstChunkIndex must be a non-negative integer");
     const start = source.start ?? 0;
@@ -433,18 +579,31 @@ export async function sealChunksToSink(source, sink, options) {
     let originalBytes = 0;
     let bodyBytes = 0;
     let storedBytesTotal = 0;
+    let nextYield = COOPERATIVE_BYTES;
     const buffer = Buffer.allocUnsafe(Math.min(chunkBytes, Math.max(raw, 1)));
     const src = await open(source.path, "r");
     try {
         for (let position = 0; position < localChunks; position += 1) {
+            options.signal?.throwIfAborted();
             const index = firstChunkIndex + position;
             const want = Math.max(0, Math.min(chunkBytes, raw - position * chunkBytes));
-            const slice = want === 0 ? buffer.subarray(0, 0) : await readExactly(src, buffer, want, start + position * chunkBytes);
+            const slice = want === 0 ? buffer.subarray(0, 0) : await readExactly(src, buffer, want, start + position * chunkBytes, options.signal);
             originalHash.update(slice);
             originalBytes += slice.length;
             options.onProgress?.(originalBytes);
             options.onPlaintext?.(index, slice);
-            const packed = gzipSync(slice, { level: 6 });
+            const packed = zstd ? squeezeSync(slice) : gzipSync(slice, { level: 6 });
+            // Automatic callers use reviewed 4 MiB chunks and account every chunk;
+            // manual callers still get the ordinary 16 MiB event-loop checkpoint.
+            // This runs after compression so the duty-cycle controller measures the
+            // synchronous work it is repaying before the next chunk starts.
+            if (options.onYield)
+                await options.onYield();
+            else if (originalBytes >= nextYield) {
+                nextYield = originalBytes + COOPERATIVE_BYTES;
+                await yieldToEventLoop();
+            }
+            options.signal?.throwIfAborted();
             const final = index === totalChunks - 1;
             const nonce = chunkNonce(noncePrefix, index);
             const cipher = aeadCipher(suite, archiveKey, nonce);
@@ -453,7 +612,7 @@ export async function sealChunksToSink(source, sink, options) {
             bodyHash.update(packed);
             bodyBytes += packed.length;
             ciphertextHash.update(stored);
-            await sink.write(stored);
+            await waitForSignal(sink.write(stored), options.signal);
             storedBytesTotal += stored.length;
             chunks.push({ index, plaintextBytes: packed.length, rawBytes: slice.length, storedBytes: stored.length, sha256: createHash("sha256").update(stored).digest("hex"), nonce: nonce.toString("base64"), final });
         }
@@ -466,7 +625,7 @@ export async function sealChunksToSink(source, sink, options) {
         version: ENVELOPE_VERSION, archiveId, suite, chunkBytes, chunks,
         manifest: {
             plaintextSha256: bodyHash.digest("hex"), plaintextBytes: bodyBytes,
-            compression: "gzip-chunk", originalBytes, originalSha256,
+            compression: zstd ? "zstd-chunk" : "gzip-chunk", originalBytes, originalSha256,
             createdAt: options.createdAt ?? new Date().toISOString(), adapter: options.adapter
         },
         wrappedKeys: wrapAll(archiveKey, options.recipients, suite, archiveId, options.deterministic)