@byok-sdk/core 0.28.2 → 0.29.0

package/README.md

@@ -15,6 +15,17 @@ row, and consumes the JTI through an injected `DeviceAssertionReplayAuthority`.
 hosted production composition must inject durable atomic storage. The assertion
 authorizes one exchange only and is not a connector session or refresh token.
 
+Sealed payload v1 (#654) has its own subpath, so the root entry does not grow:
+
+```ts
+import { openSealedContent, sealContent } from '@byok-sdk/core/sealed-payload';
+```
+
+It seals and opens one category of a payload, wraps a scope key to one member
+as a signed key package, and signs and verifies one member chain entry. The
+receivers return a typed failure for hostile input and do not throw. The wire
+does not carry sealed content yet; later #654 slices add it.
+
 MIT licensed. Node.js 24.22.1 or newer.
 
 Runtime dependencies and size budgets: [entry dependency contract](../../README.md#entry-dependencies).

package/dist/sealed-payload/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `@byok-sdk/core/sealed-payload` — sealed payload v1 (#654): sealed contents,
+ * scope keys and key packages, and member chain entries. The browser, the
+ * device and the hosted Host run this same WebCrypto code.
+ *
+ * It is a subpath, not part of the package root, so the root bundle and every
+ * closure that imports the root do not grow. Only a consumer that seals or
+ * opens content imports it.
+ */
+export { SEALED_CATEGORIES, SEALED_CONTENT_SUITE, SEALED_CONTENT_VERSION, SEALED_DIRECTIONS, SealedContentHeaderV1Schema, openSealedContent, sealContent, } from './sealed-content';
+export type { OpenSealedContentInput, SealContentInput, SealedBinding, SealedCategory, SealedContent, SealedContentHeaderV1, SealedContentOpenFailure, SealedContentOpenResult, SealedDirection, SealedScopePolicy, } from './sealed-content';
+export { deriveScopeKeyId, generateScopeKey, openScopeKeyPackage, sealScopeKeyPackage } from './scope-key';
+export type { OpenScopeKeyPackageInput, ScopeKeyPackageOpenResult, ScopeKeyPackageV1, SealScopeKeyPackageInput, } from './scope-key';
+export { MEMBER_CHAIN_OPS, deriveMemberId, memberChainEntryHash, signMemberChainEntry, verifyMemberChainEntry, } from './member-chain';
+export type { MemberChainEntryV1, MemberChainEntryVerifyResult, MemberChainOp, UnsignedMemberChainEntryV1, } from './member-chain';