X_SEAL_CALL_OUTSIDE_CORE

a package writes its own AES call instead of calling seal() / open()

shipped source outside packages/core/src/{secrets,seal,seal-keys}.ts (SEAL_SEAM) and the modules STANDARD_CIPHERS names — a cipher a standard fixes, toward a key that is not the app's: packages/pwa/src/push-{encrypt,decrypt}.ts, RFC 8291 — calls subtle.encrypt( / subtle.decrypt(, uses createCipheriv / createDecipheriv, or names an AES algorithm ('AES-GCM'). A second cipher call is a second key source, a second wire format and a value with no purpose bound in. Signing, verifying and hashing are not sealing and are never reported; tests are fixtures

edit the file the finding names — call seal(value, { purpose }) / open(sealed, { purpose }) from @ultimat3/core, then bun run seal-calls --json