# X_SEAL_CALL_OUTSIDE_CORE

## Means

a package writes its own AES call instead of calling `seal()` / `open()`

## Typical cause

shipped source outside `packages/core/src/{secrets,seal,seal-keys}.ts` (`SEAL_SEAM`) and the modules `STANDARD_CIPHERS` names — a cipher a standard fixes, toward a key that is not the app's: `packages/pwa/src/push-{encrypt,decrypt}.ts`, RFC 8291 — calls `subtle.encrypt(` / `subtle.decrypt(`, uses `createCipheriv` / `createDecipheriv`, or names an AES algorithm (`'AES-GCM'`). A second cipher call is a second key source, a second wire format and a value with no purpose bound in. Signing, verifying and hashing are not sealing and are never reported; tests are fixtures

## Fix

edit the file the finding names — call `seal(value, { purpose })` / `open(sealed, { purpose })` from `@ultimat3/core`, then `bun run seal-calls --json`

[CLI and verify](/error-codes#cli-and-verify)