@byok-sdk/core 0.21.0 → 0.23.0

package/dist/index.js

@@ -19,6 +19,13 @@ var CORE_ERROR_CODES = {
   // exactly how a log stops being able to say which authentication surface was
   // probed.
   assertion_envelope_invalid: "assertion_envelope_invalid",
+  // sealed provider provisioning (plan web-sealed-provisioning). Messages
+  // never carry plaintext, ciphertext, or key material — only which check
+  // failed.
+  webcrypto_unavailable: "webcrypto_unavailable",
+  sealed_secret_invalid: "sealed_secret_invalid",
+  sealed_secret_open_failed: "sealed_secret_open_failed",
+  provider_provisioning_request_invalid: "provider_provisioning_request_invalid",
   // mailbox (§12.7.3)
   mailbox_message_not_found: "mailbox_message_not_found",
   mailbox_cursor_regression: "mailbox_cursor_regression",
@@ -200,8 +207,8 @@ function objectKeyPrefix(value) {
   return value;
 }
 function tenantObjectKey(tenant, hash, prefix) {
-  const hex = hash.slice("sha256:".length);
-  const key = `tenants/${tenant}/objects/sha256/${hex}`;
+  const hex2 = hash.slice("sha256:".length);
+  const key = `tenants/${tenant}/objects/sha256/${hex2}`;
   return prefix === void 0 ? key : `${prefix}/${key}`;
 }
 var OBJECT_STATES = ["pending", "committed", "delete_pending", "deleted"];
@@ -1076,6 +1083,565 @@ async function authenticateTaskAssertion(input, deps) {
   };
 }
 
+// src/webcrypto.ts
+function webCryptoSubtle() {
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle === void 0) {
+    throw new ByokCoreError("webcrypto_unavailable", "WebCrypto subtle is unavailable in this runtime");
+  }
+  return subtle;
+}
+
+// src/hpke.ts
+var KEM_ID = 16;
+var KDF_ID = 1;
+var AEAD_ID = 1;
+var HPKE_P256_PUBLIC_KEY_BYTES = 65;
+var N_SECRET = 32;
+var N_K = 16;
+var N_N = 12;
+var N_H = 32;
+var HPKE_AEAD_TAG_BYTES = 16;
+var MODE_BASE = 0;
+var HPKE_V1 = utf8("HPKE-v1");
+var KEM_SUITE_ID = concat(utf8("KEM"), i2osp(KEM_ID, 2));
+var HPKE_SUITE_ID = concat(utf8("HPKE"), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2));
+var EMPTY = new Uint8Array(0);
+var ZERO_SALT = new Uint8Array(N_H);
+function utf8(value) {
+  return new TextEncoder().encode(value);
+}
+function concat(...parts) {
+  const length = parts.reduce((total, part) => total + part.byteLength, 0);
+  const out = new Uint8Array(length);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.byteLength;
+  }
+  return out;
+}
+function i2osp(value, length) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new ByokCoreError("sealed_secret_invalid", "HPKE integer encoding requires a non-negative safe integer");
+  }
+  const out = new Uint8Array(length);
+  let remaining = value;
+  for (let index = length - 1; index >= 0; index -= 1) {
+    out[index] = remaining % 256;
+    remaining = Math.floor(remaining / 256);
+  }
+  if (remaining !== 0) {
+    throw new ByokCoreError("sealed_secret_invalid", "HPKE integer does not fit the requested width");
+  }
+  return out;
+}
+function copy(bytes) {
+  return new Uint8Array(bytes);
+}
+async function hmacSha256(key, data) {
+  const subtle = webCryptoSubtle();
+  const hmacKey = await subtle.importKey("raw", copy(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await subtle.sign("HMAC", hmacKey, copy(data)));
+}
+async function hkdfExpand(prk, info, length) {
+  if (length > 255 * N_H) {
+    throw new ByokCoreError("sealed_secret_invalid", "HKDF output length exceeds its limit");
+  }
+  const out = new Uint8Array(length);
+  let previous = EMPTY;
+  let offset = 0;
+  for (let counter = 1; offset < length; counter += 1) {
+    previous = await hmacSha256(prk, concat(previous, info, Uint8Array.of(counter)));
+    const take = Math.min(previous.byteLength, length - offset);
+    out.set(previous.subarray(0, take), offset);
+    offset += take;
+  }
+  return out;
+}
+async function labeledExtract(suiteId, salt, label, ikm) {
+  return hmacSha256(salt.byteLength === 0 ? ZERO_SALT : salt, concat(HPKE_V1, suiteId, utf8(label), ikm));
+}
+async function labeledExpand(suiteId, prk, label, info, length) {
+  return hkdfExpand(prk, concat(i2osp(length, 2), HPKE_V1, suiteId, utf8(label), info), length);
+}
+async function importP256PublicKey(raw) {
+  if (raw.byteLength !== HPKE_P256_PUBLIC_KEY_BYTES || raw[0] !== 4) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key must be a 65-byte uncompressed point");
+  }
+  try {
+    return await webCryptoSubtle().importKey("raw", copy(raw), { name: "ECDH", namedCurve: "P-256" }, true, []);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key is not a valid curve point", { cause });
+  }
+}
+async function ecdhP256(privateKey, publicKey) {
+  const bits = await webCryptoSubtle().deriveBits({ name: "ECDH", public: publicKey }, privateKey, N_SECRET * 8);
+  return new Uint8Array(bits);
+}
+async function extractAndExpand(dh, kemContext) {
+  const eaePrk = await labeledExtract(KEM_SUITE_ID, EMPTY, "eae_prk", dh);
+  return labeledExpand(KEM_SUITE_ID, eaePrk, "shared_secret", kemContext, N_SECRET);
+}
+async function keyScheduleBase(sharedSecret, info) {
+  const pskIdHash = await labeledExtract(HPKE_SUITE_ID, EMPTY, "psk_id_hash", EMPTY);
+  const infoHash = await labeledExtract(HPKE_SUITE_ID, EMPTY, "info_hash", info);
+  const context = concat(Uint8Array.of(MODE_BASE), pskIdHash, infoHash);
+  const secret = await labeledExtract(HPKE_SUITE_ID, sharedSecret, "secret", EMPTY);
+  return {
+    sharedSecret,
+    key: await labeledExpand(HPKE_SUITE_ID, secret, "key", context, N_K),
+    baseNonce: await labeledExpand(HPKE_SUITE_ID, secret, "base_nonce", context, N_N),
+    exporterSecret: await labeledExpand(HPKE_SUITE_ID, secret, "exp", context, N_H)
+  };
+}
+async function setupBaseSender(recipientPublicKey, info, ephemeral) {
+  const pkR = await importP256PublicKey(recipientPublicKey);
+  let pair = ephemeral;
+  if (pair === void 0) {
+    const subtle = webCryptoSubtle();
+    const generated = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    pair = {
+      privateKey: generated.privateKey,
+      publicKey: new Uint8Array(await subtle.exportKey("raw", generated.publicKey))
+    };
+  }
+  const enc = copy(pair.publicKey);
+  const dh = await ecdhP256(pair.privateKey, pkR);
+  const sharedSecret = await extractAndExpand(dh, concat(enc, recipientPublicKey));
+  return { enc, schedule: await keyScheduleBase(sharedSecret, info) };
+}
+async function setupBaseRecipient(enc, recipientPrivateKey, recipientPublicKey, info) {
+  if (recipientPublicKey.byteLength !== HPKE_P256_PUBLIC_KEY_BYTES || recipientPublicKey[0] !== 4) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 recipient public key must be a 65-byte uncompressed point");
+  }
+  const pkE = await importP256PublicKey(enc);
+  let dh;
+  try {
+    dh = await ecdhP256(recipientPrivateKey, pkE);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_open_failed", "HPKE decapsulation failed", { cause });
+  }
+  const sharedSecret = await extractAndExpand(dh, concat(enc, recipientPublicKey));
+  return keyScheduleBase(sharedSecret, info);
+}
+function hpkeNonce(baseNonce, sequence) {
+  const seq = i2osp(sequence, N_N);
+  const out = new Uint8Array(N_N);
+  for (let index = 0; index < N_N; index += 1) out[index] = baseNonce[index] ^ seq[index];
+  return out;
+}
+async function aesGcmKey(key, usage) {
+  return webCryptoSubtle().importKey("raw", copy(key), { name: "AES-GCM" }, false, [usage]);
+}
+async function hpkeAeadSeal(schedule, sequence, aad, plaintext) {
+  const ciphertext = await webCryptoSubtle().encrypt(
+    { name: "AES-GCM", iv: hpkeNonce(schedule.baseNonce, sequence), additionalData: copy(aad), tagLength: 128 },
+    await aesGcmKey(schedule.key, "encrypt"),
+    copy(plaintext)
+  );
+  return new Uint8Array(ciphertext);
+}
+async function hpkeAeadOpen(schedule, sequence, aad, ciphertext) {
+  if (ciphertext.byteLength < HPKE_AEAD_TAG_BYTES) {
+    throw new ByokCoreError("sealed_secret_invalid", "HPKE ciphertext is shorter than its authentication tag");
+  }
+  try {
+    const plaintext = await webCryptoSubtle().decrypt(
+      { name: "AES-GCM", iv: hpkeNonce(schedule.baseNonce, sequence), additionalData: copy(aad), tagLength: 128 },
+      await aesGcmKey(schedule.key, "decrypt"),
+      copy(ciphertext)
+    );
+    return new Uint8Array(plaintext);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_open_failed", "HPKE ciphertext failed authentication", { cause });
+  }
+}
+async function hpkeSealBase(input) {
+  const { enc, schedule } = await setupBaseSender(input.recipientPublicKey, input.info);
+  return { enc, ciphertext: await hpkeAeadSeal(schedule, 0, input.aad, input.plaintext) };
+}
+async function hpkeOpenBase(input) {
+  const schedule = await setupBaseRecipient(input.enc, input.recipientPrivateKey, input.recipientPublicKey, input.info);
+  return hpkeAeadOpen(schedule, 0, input.aad, input.ciphertext);
+}
+
+// src/sealed-provider-secret.ts
+var PROVIDER_SECRET_HPKE_SUITE = "hpke-base.dhkem-p256-hkdf-sha256.hkdf-sha256.aes-128-gcm";
+var PROVIDER_SECRET_HPKE_INFO = "byok-sdk.provider-secret.v1";
+var PROVIDER_PROVISIONING_REQUEST_VERSION = 1;
+var PROVIDER_PROVISIONING_OPERATIONS = ["configure", "update_model", "replace_secret", "delete"];
+var PROVIDER_PROVISIONING_SECRET_OPERATIONS = ["configure", "replace_secret"];
+var PROVIDER_PROVISIONING_MAX_TTL_MS = 15 * 60 * 1e3;
+var PROVIDER_SECRET_PAD_BLOCK_BYTES = 256;
+var PROVIDER_SECRET_MAX_PADDED_BYTES = 4096;
+var PROVIDER_SECRET_MAX_BYTES = PROVIDER_SECRET_MAX_PADDED_BYTES - 2;
+var SEALING_KEY_ID_LENGTH = 22;
+var B64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var B64URL_PATTERN = /^[A-Za-z0-9_-]*$/;
+function encodeBase64Url(bytes) {
+  let out = "";
+  let index = 0;
+  for (; index + 3 <= bytes.length; index += 3) {
+    const value = bytes[index] << 16 | bytes[index + 1] << 8 | bytes[index + 2];
+    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63] + B64URL_ALPHABET[value >> 6 & 63] + B64URL_ALPHABET[value & 63];
+  }
+  const rest = bytes.length - index;
+  if (rest === 1) {
+    const value = bytes[index] << 16;
+    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63];
+  } else if (rest === 2) {
+    const value = bytes[index] << 16 | bytes[index + 1] << 8;
+    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63] + B64URL_ALPHABET[value >> 6 & 63];
+  }
+  return out;
+}
+function decodeBase64Url(value, field) {
+  if (!B64URL_PATTERN.test(value) || value.length % 4 === 1) {
+    throw new ByokCoreError("sealed_secret_invalid", `${field} is not canonical base64url`);
+  }
+  const out = new Uint8Array(Math.floor(value.length * 3 / 4));
+  let buffer = 0;
+  let bits = 0;
+  let offset = 0;
+  for (const char of value) {
+    buffer = buffer << 6 | B64URL_ALPHABET.indexOf(char);
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[offset] = buffer >> bits & 255;
+      offset += 1;
+    }
+  }
+  if (encodeBase64Url(out) !== value) {
+    throw new ByokCoreError("sealed_secret_invalid", `${field} is not canonical base64url`);
+  }
+  return out;
+}
+function base64UrlField(bytes) {
+  return z.string().superRefine((value, ctx) => {
+    try {
+      const decoded = decodeBase64Url(value, "field");
+      if (bytes.exact !== void 0 && decoded.byteLength !== bytes.exact) {
+        ctx.addIssue({ code: "custom", message: `must decode to exactly ${bytes.exact} bytes` });
+      }
+      if (bytes.max !== void 0 && decoded.byteLength > bytes.max) {
+        ctx.addIssue({ code: "custom", message: `must decode to at most ${bytes.max} bytes` });
+      }
+    } catch {
+      ctx.addIssue({ code: "custom", message: "must be canonical unpadded base64url" });
+    }
+  });
+}
+async function sha256(bytes) {
+  return new Uint8Array(await webCryptoSubtle().digest("SHA-256", new Uint8Array(bytes)));
+}
+function hex(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+async function contentDigest(value) {
+  return `sha256:${hex(await sha256(canonicalizeJsonBytes(value)))}`;
+}
+var SealingPublicJwkSchema = z.strictObject({
+  kty: z.literal("EC"),
+  crv: z.literal("P-256"),
+  x: base64UrlField({ exact: 32 }),
+  y: base64UrlField({ exact: 32 })
+});
+var SealingKeyIdSchema = z.string().regex(new RegExp(`^[A-Za-z0-9_-]{${SEALING_KEY_ID_LENGTH}}$`));
+function parseSealingPublicJwk(input) {
+  const result = SealingPublicJwkSchema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError("sealed_secret_invalid", "Sealing public key must be a strict P-256 EC public JWK");
+  }
+  return result.data;
+}
+function sealingPublicKeyBytes(publicJwk) {
+  const jwk = parseSealingPublicJwk(publicJwk);
+  const raw = new Uint8Array(HPKE_P256_PUBLIC_KEY_BYTES);
+  raw[0] = 4;
+  raw.set(decodeBase64Url(jwk.x, "x"), 1);
+  raw.set(decodeBase64Url(jwk.y, "y"), 33);
+  return raw;
+}
+async function deriveSealingKeyId(publicJwk) {
+  const raw = sealingPublicKeyBytes(publicJwk);
+  await importP256PublicKey(raw);
+  return encodeBase64Url(await sha256(raw)).slice(0, SEALING_KEY_ID_LENGTH);
+}
+var SealingKeyClaimV1Schema = z.strictObject({
+  version: z.literal(1),
+  keyId: SealingKeyIdSchema,
+  epoch: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  publicJwk: SealingPublicJwkSchema
+});
+function sealingKeyClaimCanonicalBytes(claim) {
+  const result = SealingKeyClaimV1Schema.safeParse(claim);
+  if (!result.success) {
+    throw new ByokCoreError("sealed_secret_invalid", "Sealing key claim is invalid");
+  }
+  const parsed = result.data;
+  return canonicalizeJsonBytes({
+    version: parsed.version,
+    keyId: parsed.keyId,
+    epoch: parsed.epoch,
+    publicJwk: { kty: parsed.publicJwk.kty, crv: parsed.publicJwk.crv, x: parsed.publicJwk.x, y: parsed.publicJwk.y }
+  });
+}
+var OpaqueIdSchema = z.string().min(1).max(200).superRefine((value, ctx) => {
+  if (value.trim() !== value || /[\u0000-\u001f\u007f]/u.test(value)) {
+    ctx.addIssue({ code: "custom", message: "must not carry surrounding whitespace or control characters" });
+  }
+});
+var CanonicalTimestampSchema = z.string().refine(isCanonicalTimestamp, "must be a canonical ISO-8601 UTC instant");
+var ProfileRefSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);
+var ProviderKindSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);
+var ModelIdSchema = z.string().min(1).max(160).refine((value) => value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value), "model id is invalid");
+var CapabilitySchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u);
+var PiModelJsonSchema = z.custom((value) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  try {
+    canonicalizeJson(value);
+    return true;
+  } catch {
+    return false;
+  }
+}, "piModel must be a canonical JSON object");
+var ModelConfigFields = {
+  agentId: OpaqueIdSchema,
+  providerKind: ProviderKindSchema,
+  modelId: ModelIdSchema,
+  piModel: PiModelJsonSchema,
+  capabilities: z.array(CapabilitySchema).max(8).refine((values) => new Set(values).size === values.length, "capabilities must be unique")
+};
+var ProviderProvisioningConfigV1Schema = z.discriminatedUnion("operation", [
+  z.strictObject({ operation: z.literal("configure"), ...ModelConfigFields }),
+  z.strictObject({ operation: z.literal("update_model"), ...ModelConfigFields }),
+  z.strictObject({ operation: z.literal("replace_secret"), agentId: OpaqueIdSchema, providerKind: ProviderKindSchema }),
+  z.strictObject({ operation: z.literal("delete"), agentId: OpaqueIdSchema })
+]);
+var ProviderProvisioningExpectedProfileSchema = z.union([
+  z.null(),
+  z.strictObject({
+    profileRef: ProfileRefSchema,
+    profileRevision: z.string().regex(/^(?:0|[1-9][0-9]{0,19})$/u),
+    profileHash: z.string().regex(CONTENT_HASH_PATTERN)
+  })
+]);
+var ProviderProvisioningIdentityRevisionSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u);
+var ProviderProvisioningHeaderV1Schema = z.strictObject({
+  tenantId: OpaqueIdSchema,
+  deviceId: OpaqueIdSchema,
+  agentId: OpaqueIdSchema,
+  requestId: OpaqueIdSchema,
+  operation: z.enum(PROVIDER_PROVISIONING_OPERATIONS),
+  /** Non-secret, strictly increasing per bot (A3); a device rejects anything not above its high-watermark. */
+  operationGeneration: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  expectedProfile: ProviderProvisioningExpectedProfileSchema,
+  /** The device enrollment revision the Host authorized against (F2). */
+  expectedEnrollmentRevision: ProviderProvisioningIdentityRevisionSchema,
+  /** The agent placement revision the Host authorized against (F2). */
+  expectedPlacementRevision: ProviderProvisioningIdentityRevisionSchema,
+  configDigest: z.string().regex(CONTENT_HASH_PATTERN),
+  issuedAt: CanonicalTimestampSchema,
+  expiresAt: CanonicalTimestampSchema
+});
+var MAX_CIPHERTEXT_BYTES = PROVIDER_SECRET_MAX_PADDED_BYTES + HPKE_AEAD_TAG_BYTES;
+var SealedProviderSecretV1Schema = z.strictObject({
+  suite: z.literal(PROVIDER_SECRET_HPKE_SUITE),
+  keyId: SealingKeyIdSchema,
+  enc: base64UrlField({ exact: HPKE_P256_PUBLIC_KEY_BYTES }),
+  ciphertext: base64UrlField({ max: MAX_CIPHERTEXT_BYTES })
+});
+function isSecretOperation(operation) {
+  return PROVIDER_PROVISIONING_SECRET_OPERATIONS.includes(operation);
+}
+var ProviderProvisioningRequestV1Schema = z.strictObject({
+  version: z.literal(PROVIDER_PROVISIONING_REQUEST_VERSION),
+  header: ProviderProvisioningHeaderV1Schema,
+  config: ProviderProvisioningConfigV1Schema,
+  sealed: SealedProviderSecretV1Schema.optional()
+}).superRefine((request, ctx) => {
+  if (request.header.operation !== request.config.operation) {
+    ctx.addIssue({ code: "custom", path: ["config", "operation"], message: "config operation must equal header operation" });
+  }
+  if (request.header.agentId !== request.config.agentId) {
+    ctx.addIssue({ code: "custom", path: ["config", "agentId"], message: "config agentId must equal header agentId" });
+  }
+  if (isSecretOperation(request.header.operation) !== (request.sealed !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["sealed"], message: "a sealed secret is required exactly for configure and replace_secret" });
+  }
+});
+function parseProviderProvisioningRequest(input) {
+  const result = ProviderProvisioningRequestV1Schema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError(
+      "provider_provisioning_request_invalid",
+      `Invalid provider provisioning request: ${result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`
+    );
+  }
+  return result.data;
+}
+function configJson(config) {
+  return config;
+}
+async function providerProvisioningConfigDigest(config) {
+  const result = ProviderProvisioningConfigV1Schema.safeParse(config);
+  if (!result.success) {
+    throw new ByokCoreError("provider_provisioning_request_invalid", "Provider provisioning config is invalid");
+  }
+  return contentDigest(configJson(result.data));
+}
+function providerSecretAadBytes(header, keyId) {
+  const parsed = ProviderProvisioningHeaderV1Schema.safeParse(header);
+  if (!parsed.success || !SealingKeyIdSchema.safeParse(keyId).success) {
+    throw new ByokCoreError("provider_provisioning_request_invalid", "Provider provisioning AAD input is invalid");
+  }
+  const value = parsed.data;
+  return canonicalizeJsonBytes({
+    v: PROVIDER_PROVISIONING_REQUEST_VERSION,
+    tenantId: value.tenantId,
+    deviceId: value.deviceId,
+    keyId,
+    requestId: value.requestId,
+    agentId: value.agentId,
+    operation: value.operation,
+    operationGeneration: value.operationGeneration,
+    expectedProfile: value.expectedProfile === null ? null : {
+      profileRef: value.expectedProfile.profileRef,
+      profileRevision: value.expectedProfile.profileRevision,
+      profileHash: value.expectedProfile.profileHash
+    },
+    expectedEnrollmentRevision: value.expectedEnrollmentRevision,
+    expectedPlacementRevision: value.expectedPlacementRevision,
+    configDigest: value.configDigest,
+    issuedAt: value.issuedAt,
+    expiresAt: value.expiresAt
+  });
+}
+async function providerProvisioningRequestDigest(request) {
+  const parsed = parseProviderProvisioningRequest(request);
+  return contentDigest(parsed);
+}
+async function assertProviderProvisioningConfigDigest(request) {
+  const parsed = parseProviderProvisioningRequest(request);
+  if (await providerProvisioningConfigDigest(parsed.config) !== parsed.header.configDigest) {
+    throw new ByokCoreError("provider_provisioning_request_invalid", "Provider provisioning config digest does not match its header");
+  }
+}
+function padProviderSecret(secret) {
+  const bytes = new TextEncoder().encode(secret);
+  if (bytes.byteLength === 0 || bytes.byteLength > PROVIDER_SECRET_MAX_BYTES) {
+    throw new ByokCoreError("sealed_secret_invalid", `Provider secret must be 1 to ${PROVIDER_SECRET_MAX_BYTES} UTF-8 bytes`);
+  }
+  const total = Math.ceil((bytes.byteLength + 2) / PROVIDER_SECRET_PAD_BLOCK_BYTES) * PROVIDER_SECRET_PAD_BLOCK_BYTES;
+  const out = new Uint8Array(total);
+  out[0] = bytes.byteLength >> 8;
+  out[1] = bytes.byteLength & 255;
+  out.set(bytes, 2);
+  return out;
+}
+function unpadProviderSecret(padded) {
+  if (padded.byteLength < PROVIDER_SECRET_PAD_BLOCK_BYTES || padded.byteLength > PROVIDER_SECRET_MAX_PADDED_BYTES || padded.byteLength % PROVIDER_SECRET_PAD_BLOCK_BYTES !== 0) {
+    throw new ByokCoreError("sealed_secret_invalid", "Padded provider secret has an invalid length");
+  }
+  const length = padded[0] << 8 | padded[1];
+  if (length === 0 || length + 2 > padded.byteLength || padded.byteLength - (length + 2) >= PROVIDER_SECRET_PAD_BLOCK_BYTES) {
+    throw new ByokCoreError("sealed_secret_invalid", "Padded provider secret has an invalid length prefix");
+  }
+  for (let index = length + 2; index < padded.byteLength; index += 1) {
+    if (padded[index] !== 0) {
+      throw new ByokCoreError("sealed_secret_invalid", "Padded provider secret has non-zero padding");
+    }
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(padded.subarray(2, length + 2));
+  } catch {
+    throw new ByokCoreError("sealed_secret_invalid", "Provider secret is not valid UTF-8");
+  }
+}
+var INFO_BYTES = () => new TextEncoder().encode(PROVIDER_SECRET_HPKE_INFO);
+async function sealProviderProvisioningRequest(input) {
+  const configResult = ProviderProvisioningConfigV1Schema.safeParse(input.config);
+  if (!configResult.success) {
+    throw new ByokCoreError("provider_provisioning_request_invalid", "Provider provisioning config is invalid");
+  }
+  const config = configResult.data;
+  const headerResult = ProviderProvisioningHeaderV1Schema.safeParse({
+    ...input.header,
+    configDigest: await providerProvisioningConfigDigest(config)
+  });
+  if (!headerResult.success) {
+    throw new ByokCoreError("provider_provisioning_request_invalid", "Provider provisioning header is invalid");
+  }
+  const header = headerResult.data;
+  const needsSecret = isSecretOperation(header.operation);
+  if (needsSecret !== (input.secret !== void 0) || needsSecret !== (input.recipient !== void 0)) {
+    throw new ByokCoreError(
+      "provider_provisioning_request_invalid",
+      "A secret and recipient are required exactly for configure and replace_secret"
+    );
+  }
+  let sealed;
+  if (needsSecret) {
+    const recipient = input.recipient;
+    const publicJwk = parseSealingPublicJwk(recipient.publicJwk);
+    if (await deriveSealingKeyId(publicJwk) !== recipient.keyId) {
+      throw new ByokCoreError("sealed_secret_invalid", "Sealing key id does not match its public key");
+    }
+    const { enc, ciphertext } = await hpkeSealBase({
+      recipientPublicKey: sealingPublicKeyBytes(publicJwk),
+      info: INFO_BYTES(),
+      aad: providerSecretAadBytes(header, recipient.keyId),
+      plaintext: padProviderSecret(input.secret)
+    });
+    sealed = {
+      suite: PROVIDER_SECRET_HPKE_SUITE,
+      keyId: recipient.keyId,
+      enc: encodeBase64Url(enc),
+      ciphertext: encodeBase64Url(ciphertext)
+    };
+  }
+  return parseProviderProvisioningRequest({
+    version: PROVIDER_PROVISIONING_REQUEST_VERSION,
+    header,
+    config,
+    ...sealed === void 0 ? {} : { sealed }
+  });
+}
+async function openProviderProvisioningSecret(input) {
+  const request = parseProviderProvisioningRequest(input.request);
+  const sealed = request.sealed;
+  if (sealed === void 0) {
+    throw new ByokCoreError("provider_provisioning_request_invalid", "Provider provisioning request carries no sealed secret");
+  }
+  const publicJwk = parseSealingPublicJwk(input.recipient.publicJwk);
+  if (sealed.keyId !== input.recipient.keyId || await deriveSealingKeyId(publicJwk) !== input.recipient.keyId) {
+    throw new ByokCoreError("sealed_secret_invalid", "Sealed secret is not addressed to this sealing key");
+  }
+  await assertProviderProvisioningConfigDigest(request);
+  const ciphertext = decodeBase64Url(sealed.ciphertext, "ciphertext");
+  const paddedLength = ciphertext.byteLength - HPKE_AEAD_TAG_BYTES;
+  if (paddedLength < PROVIDER_SECRET_PAD_BLOCK_BYTES || paddedLength > PROVIDER_SECRET_MAX_PADDED_BYTES || paddedLength % PROVIDER_SECRET_PAD_BLOCK_BYTES !== 0) {
+    throw new ByokCoreError("sealed_secret_invalid", "Sealed secret ciphertext has an invalid length");
+  }
+  const padded = await hpkeOpenBase({
+    recipientPrivateKey: input.recipient.privateKey,
+    recipientPublicKey: sealingPublicKeyBytes(publicJwk),
+    enc: decodeBase64Url(sealed.enc, "enc"),
+    info: INFO_BYTES(),
+    aad: providerSecretAadBytes(request.header, sealed.keyId),
+    ciphertext
+  });
+  try {
+    return unpadProviderSecret(padded);
+  } finally {
+    padded.fill(0);
+  }
+}
+
 // src/pairing.ts
 var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
 function nonceSigningBytes(nonce) {
@@ -2234,6 +2800,6 @@ function createInMemoryCoreCompositionWithClock() {
   return { stores: createInMemoryCoreStores({ clock }).stores, clock };
 }
 
-export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, assertCanonicalTimestamp, assertCapability, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
+export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, PROVIDER_PROVISIONING_MAX_TTL_MS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_REQUEST_VERSION, PROVIDER_PROVISIONING_SECRET_OPERATIONS, PROVIDER_SECRET_HPKE_INFO, PROVIDER_SECRET_HPKE_SUITE, PROVIDER_SECRET_MAX_BYTES, PROVIDER_SECRET_MAX_PADDED_BYTES, PROVIDER_SECRET_PAD_BLOCK_BYTES, ProviderProvisioningConfigV1Schema, ProviderProvisioningExpectedProfileSchema, ProviderProvisioningHeaderV1Schema, ProviderProvisioningIdentityRevisionSchema, ProviderProvisioningRequestV1Schema, SEALING_KEY_ID_LENGTH, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SealedProviderSecretV1Schema, SealingKeyClaimV1Schema, SealingKeyIdSchema, SealingPublicJwkSchema, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, assertCanonicalTimestamp, assertCapability, assertProviderProvisioningConfigDigest, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deriveSealingKeyId, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, openProviderProvisioningSecret, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseProviderProvisioningRequest, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, providerProvisioningConfigDigest, providerProvisioningRequestDigest, providerSecretAadBytes, sealProviderProvisioningRequest, sealingKeyClaimCanonicalBytes, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map