diff --git a/src/envelope_crypto/envelope_crypto.py b/src/envelope_crypto/envelope_crypto.py index be4d29c..05642c9 100644 --- a/src/envelope_crypto/envelope_crypto.py +++ b/src/envelope_crypto/envelope_crypto.py @@ -476,9 +476,11 @@ class EnvelopeCrypto: pattern) it is re-encrypted directly and returned in place of `record`. traversal recurses into nested DICTS only - a blob nested inside a LIST is - not re-encrypted and not covered by the depth-limit raise below; flatten - list-nested blobs to dict fields before rotation or they'll be silently - left under the old key. + not re-encrypted. the depth-limit raise below IS reached for a list-nested + blob when the cutoff dict scan finds it (it walks lists too), but a blob + one level shallower - hit during normal traversal instead of the cutoff + scan - is skipped silently; flatten list-nested blobs to dict fields before + rotation or they can be silently left under the old key. Args: source_crypto: instance holding the old (source) key.