@byok-sdk/core 0.28.2 → 0.29.0

package/dist/sealed-payload/index.js

@@ -0,0 +1,1048 @@
+import { z } from 'zod';
+import { ByokCoreError } from '@byok-sdk/core';
+
+// src/sealed-payload/sealed-content.ts
+var CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+var DEVICE_PROOF_SCHEMA_ID = "byok-device-proof-v1";
+var DEVICE_PROOF_VERSION = 1;
+var DEVICE_PROOF_ALGORITHMS = ["ed25519"];
+var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+var HTTP_METHOD_PATTERN = /^[A-Z]+$/;
+function canonicalizationFailure(path, reason) {
+  return new ByokCoreError(
+    "proof_canonicalization_failed",
+    `Cannot canonicalize ${path}: ${reason}`
+  );
+}
+function isPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function canonicalizeValue(value, path, seen) {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "string":
+      return JSON.stringify(value);
+    case "number": {
+      if (!Number.isSafeInteger(value)) {
+        throw canonicalizationFailure(
+          path,
+          `only safe integers are canonicalizable, received ${String(value)}`
+        );
+      }
+      return String(value === 0 ? 0 : value);
+    }
+    case "undefined":
+      throw canonicalizationFailure(path, "undefined has no canonical form");
+    case "bigint":
+      throw canonicalizationFailure(path, "bigint is not a JSON type");
+    case "function":
+    case "symbol":
+      throw canonicalizationFailure(path, `${typeof value} is not a JSON type`);
+    case "object":
+      break;
+    default:
+      throw canonicalizationFailure(path, `unsupported type ${typeof value}`);
+  }
+  const objectValue = value;
+  if (seen.has(objectValue)) {
+    throw canonicalizationFailure(path, "circular reference");
+  }
+  seen.add(objectValue);
+  try {
+    if (Array.isArray(objectValue)) {
+      const parts2 = objectValue.map(
+        (entry, index) => canonicalizeValue(entry, `${path}[${index}]`, seen)
+      );
+      return `[${parts2.join(",")}]`;
+    }
+    if (!isPlainObject(objectValue)) {
+      throw canonicalizationFailure(
+        path,
+        "only plain objects and arrays are canonicalizable"
+      );
+    }
+    const keys = Object.keys(objectValue).sort();
+    const record = objectValue;
+    const parts = keys.map((key) => {
+      const encodedKey = JSON.stringify(key);
+      const encodedValue = canonicalizeValue(record[key], `${path}.${key}`, seen);
+      return `${encodedKey}:${encodedValue}`;
+    });
+    return `{${parts.join(",")}}`;
+  } finally {
+    seen.delete(objectValue);
+  }
+}
+function canonicalizeJson(value) {
+  return canonicalizeValue(value, "<root>", /* @__PURE__ */ new Set());
+}
+function canonicalizeJsonBytes(value) {
+  return new TextEncoder().encode(canonicalizeJson(value));
+}
+var DeviceProofProtectedClaimsSchema = z.strictObject({
+  version: z.literal(DEVICE_PROOF_VERSION),
+  tenantId: z.string().min(1),
+  productId: z.string().min(1),
+  deviceId: z.string().min(1),
+  /** Identity of the signing key, resolved against the device row at verify time. */
+  keyId: z.string().min(1),
+  /** Rotation generation. An older epoch is rejected by the verifier, not here. */
+  keyEpoch: z.number().int().nonnegative(),
+  /** Idempotency key: exact replay returns the original result, reuse with a different body is a conflict. */
+  requestId: z.string().min(1),
+  /** Logical operation, e.g. `truth.write`. */
+  operation: z.string().min(1),
+  /** Tenant-scoped resource the operation targets. */
+  resource: z.string().min(1),
+  method: z.string().regex(HTTP_METHOD_PATTERN).optional(),
+  path: z.string().startsWith("/").optional(),
+  operationId: z.string().min(1).optional(),
+  bodySha256: z.string().regex(CONTENT_HASH_PATTERN),
+  /** Bound alongside the hash so a truncation attack cannot hide behind a hash collision claim. */
+  bodySize: z.number().int().nonnegative(),
+  issuedAt: z.iso.datetime(),
+  expiresAt: z.iso.datetime().optional(),
+  nonce: z.string().min(1).optional()
+}).superRefine((claims, ctx) => {
+  const hasRequestLine = claims.method !== void 0 && claims.path !== void 0;
+  const hasOperationId = claims.operationId !== void 0;
+  if (hasRequestLine === hasOperationId) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Claims must carry exactly one request binding: both `method` and `path`, or `operationId`."
+    });
+  }
+  if (!hasRequestLine && (claims.method !== void 0 || claims.path !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      message: "`method` and `path` must be supplied together."
+    });
+  }
+});
+z.strictObject({
+  schema: z.literal(DEVICE_PROOF_SCHEMA_ID),
+  algorithm: z.enum(DEVICE_PROOF_ALGORITHMS),
+  protected: DeviceProofProtectedClaimsSchema,
+  /** base64url, unpadded. */
+  signature: z.string().regex(BASE64URL_PATTERN)
+});
+var CANONICAL_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function isCanonicalTimestamp(value) {
+  if (typeof value !== "string") return false;
+  if (!CANONICAL_TIMESTAMP_PATTERN.test(value)) return false;
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed)) return false;
+  return new Date(parsed).toISOString() === value;
+}
+function webCryptoSubtle() {
+  const subtle = globalThis.crypto?.subtle;
+  if (subtle === void 0) {
+    throw new ByokCoreError("webcrypto_unavailable", "WebCrypto subtle is unavailable in this runtime");
+  }
+  return subtle;
+}
+var KEM_ID = 16;
+var KDF_ID = 1;
+var AEAD_ID = 1;
+var HPKE_P256_PUBLIC_KEY_BYTES = 65;
+var N_SECRET = 32;
+var N_K = 16;
+var N_N = 12;
+var N_H = 32;
+var HPKE_AEAD_TAG_BYTES = 16;
+var MODE_BASE = 0;
+var HPKE_V1 = utf8("HPKE-v1");
+var KEM_SUITE_ID = concat(utf8("KEM"), i2osp(KEM_ID, 2));
+var HPKE_SUITE_ID = concat(utf8("HPKE"), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2));
+var EMPTY = new Uint8Array(0);
+var ZERO_SALT = new Uint8Array(N_H);
+function utf8(value) {
+  return new TextEncoder().encode(value);
+}
+function concat(...parts) {
+  const length = parts.reduce((total, part) => total + part.byteLength, 0);
+  const out = new Uint8Array(length);
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.byteLength;
+  }
+  return out;
+}
+function i2osp(value, length) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new ByokCoreError("sealed_secret_invalid", "HPKE integer encoding requires a non-negative safe integer");
+  }
+  const out = new Uint8Array(length);
+  let remaining = value;
+  for (let index = length - 1; index >= 0; index -= 1) {
+    out[index] = remaining % 256;
+    remaining = Math.floor(remaining / 256);
+  }
+  if (remaining !== 0) {
+    throw new ByokCoreError("sealed_secret_invalid", "HPKE integer does not fit the requested width");
+  }
+  return out;
+}
+function copy(bytes) {
+  return new Uint8Array(bytes);
+}
+async function hmacSha256(key, data) {
+  const subtle = webCryptoSubtle();
+  const hmacKey = await subtle.importKey("raw", copy(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await subtle.sign("HMAC", hmacKey, copy(data)));
+}
+async function hkdfExpand(prk, info, length) {
+  if (length > 255 * N_H) {
+    throw new ByokCoreError("sealed_secret_invalid", "HKDF output length exceeds its limit");
+  }
+  const out = new Uint8Array(length);
+  let previous = EMPTY;
+  let offset = 0;
+  for (let counter = 1; offset < length; counter += 1) {
+    previous = await hmacSha256(prk, concat(previous, info, Uint8Array.of(counter)));
+    const take = Math.min(previous.byteLength, length - offset);
+    out.set(previous.subarray(0, take), offset);
+    offset += take;
+  }
+  return out;
+}
+async function labeledExtract(suiteId, salt, label, ikm) {
+  return hmacSha256(salt.byteLength === 0 ? ZERO_SALT : salt, concat(HPKE_V1, suiteId, utf8(label), ikm));
+}
+async function labeledExpand(suiteId, prk, label, info, length) {
+  return hkdfExpand(prk, concat(i2osp(length, 2), HPKE_V1, suiteId, utf8(label), info), length);
+}
+async function importP256PublicKey(raw) {
+  if (raw.byteLength !== HPKE_P256_PUBLIC_KEY_BYTES || raw[0] !== 4) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key must be a 65-byte uncompressed point");
+  }
+  try {
+    return await webCryptoSubtle().importKey("raw", copy(raw), { name: "ECDH", namedCurve: "P-256" }, true, []);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key is not a valid curve point", { cause });
+  }
+}
+async function ecdhP256(privateKey, publicKey) {
+  const bits = await webCryptoSubtle().deriveBits({ name: "ECDH", public: publicKey }, privateKey, N_SECRET * 8);
+  return new Uint8Array(bits);
+}
+async function extractAndExpand(dh, kemContext) {
+  const eaePrk = await labeledExtract(KEM_SUITE_ID, EMPTY, "eae_prk", dh);
+  return labeledExpand(KEM_SUITE_ID, eaePrk, "shared_secret", kemContext, N_SECRET);
+}
+async function keyScheduleBase(sharedSecret, info) {
+  const pskIdHash = await labeledExtract(HPKE_SUITE_ID, EMPTY, "psk_id_hash", EMPTY);
+  const infoHash = await labeledExtract(HPKE_SUITE_ID, EMPTY, "info_hash", info);
+  const context = concat(Uint8Array.of(MODE_BASE), pskIdHash, infoHash);
+  const secret = await labeledExtract(HPKE_SUITE_ID, sharedSecret, "secret", EMPTY);
+  return {
+    sharedSecret,
+    key: await labeledExpand(HPKE_SUITE_ID, secret, "key", context, N_K),
+    baseNonce: await labeledExpand(HPKE_SUITE_ID, secret, "base_nonce", context, N_N),
+    exporterSecret: await labeledExpand(HPKE_SUITE_ID, secret, "exp", context, N_H)
+  };
+}
+async function setupBaseSender(recipientPublicKey, info, ephemeral) {
+  const pkR = await importP256PublicKey(recipientPublicKey);
+  let pair = ephemeral;
+  if (pair === void 0) {
+    const subtle = webCryptoSubtle();
+    const generated = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
+    pair = {
+      privateKey: generated.privateKey,
+      publicKey: new Uint8Array(await subtle.exportKey("raw", generated.publicKey))
+    };
+  }
+  const enc = copy(pair.publicKey);
+  const dh = await ecdhP256(pair.privateKey, pkR);
+  const sharedSecret = await extractAndExpand(dh, concat(enc, recipientPublicKey));
+  return { enc, schedule: await keyScheduleBase(sharedSecret, info) };
+}
+async function setupBaseRecipient(enc, recipientPrivateKey, recipientPublicKey, info) {
+  if (recipientPublicKey.byteLength !== HPKE_P256_PUBLIC_KEY_BYTES || recipientPublicKey[0] !== 4) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 recipient public key must be a 65-byte uncompressed point");
+  }
+  const pkE = await importP256PublicKey(enc);
+  let dh;
+  try {
+    dh = await ecdhP256(recipientPrivateKey, pkE);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_open_failed", "HPKE decapsulation failed", { cause });
+  }
+  const sharedSecret = await extractAndExpand(dh, concat(enc, recipientPublicKey));
+  return keyScheduleBase(sharedSecret, info);
+}
+function hpkeNonce(baseNonce, sequence) {
+  const seq = i2osp(sequence, N_N);
+  const out = new Uint8Array(N_N);
+  for (let index = 0; index < N_N; index += 1) out[index] = baseNonce[index] ^ seq[index];
+  return out;
+}
+async function aesGcmKey(key, usage) {
+  return webCryptoSubtle().importKey("raw", copy(key), { name: "AES-GCM" }, false, [usage]);
+}
+async function hpkeAeadSeal(schedule, sequence, aad, plaintext) {
+  const ciphertext = await webCryptoSubtle().encrypt(
+    { name: "AES-GCM", iv: hpkeNonce(schedule.baseNonce, sequence), additionalData: copy(aad), tagLength: 128 },
+    await aesGcmKey(schedule.key, "encrypt"),
+    copy(plaintext)
+  );
+  return new Uint8Array(ciphertext);
+}
+async function hpkeAeadOpen(schedule, sequence, aad, ciphertext) {
+  if (ciphertext.byteLength < HPKE_AEAD_TAG_BYTES) {
+    throw new ByokCoreError("sealed_secret_invalid", "HPKE ciphertext is shorter than its authentication tag");
+  }
+  try {
+    const plaintext = await webCryptoSubtle().decrypt(
+      { name: "AES-GCM", iv: hpkeNonce(schedule.baseNonce, sequence), additionalData: copy(aad), tagLength: 128 },
+      await aesGcmKey(schedule.key, "decrypt"),
+      copy(ciphertext)
+    );
+    return new Uint8Array(plaintext);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_open_failed", "HPKE ciphertext failed authentication", { cause });
+  }
+}
+async function hpkeSealBase(input) {
+  const { enc, schedule } = await setupBaseSender(input.recipientPublicKey, input.info);
+  return { enc, ciphertext: await hpkeAeadSeal(schedule, 0, input.aad, input.plaintext) };
+}
+async function hpkeOpenBase(input) {
+  const schedule = await setupBaseRecipient(input.enc, input.recipientPrivateKey, input.recipientPublicKey, input.info);
+  return hpkeAeadOpen(schedule, 0, input.aad, input.ciphertext);
+}
+
+// src/sealed-provider-secret.ts
+var PROVIDER_SECRET_HPKE_SUITE = "hpke-base.dhkem-p256-hkdf-sha256.hkdf-sha256.aes-128-gcm";
+var PROVIDER_PROVISIONING_REQUEST_VERSION = 1;
+var PROVIDER_PROVISIONING_OPERATIONS = ["configure", "update_model", "replace_secret", "delete"];
+var PROVIDER_PROVISIONING_SECRET_OPERATIONS = ["configure", "replace_secret"];
+var PROVIDER_SECRET_MAX_PADDED_BYTES = 4096;
+var SEALING_KEY_ID_LENGTH = 22;
+var B64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+var B64URL_PATTERN = /^[A-Za-z0-9_-]*$/;
+function encodeBase64Url(bytes) {
+  let out = "";
+  let index = 0;
+  for (; index + 3 <= bytes.length; index += 3) {
+    const value = bytes[index] << 16 | bytes[index + 1] << 8 | bytes[index + 2];
+    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63] + B64URL_ALPHABET[value >> 6 & 63] + B64URL_ALPHABET[value & 63];
+  }
+  const rest = bytes.length - index;
+  if (rest === 1) {
+    const value = bytes[index] << 16;
+    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63];
+  } else if (rest === 2) {
+    const value = bytes[index] << 16 | bytes[index + 1] << 8;
+    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63] + B64URL_ALPHABET[value >> 6 & 63];
+  }
+  return out;
+}
+function decodeBase64Url(value, field) {
+  if (!B64URL_PATTERN.test(value) || value.length % 4 === 1) {
+    throw new ByokCoreError("sealed_secret_invalid", `${field} is not canonical base64url`);
+  }
+  const out = new Uint8Array(Math.floor(value.length * 3 / 4));
+  let buffer = 0;
+  let bits = 0;
+  let offset = 0;
+  for (const char of value) {
+    buffer = buffer << 6 | B64URL_ALPHABET.indexOf(char);
+    bits += 6;
+    if (bits >= 8) {
+      bits -= 8;
+      out[offset] = buffer >> bits & 255;
+      offset += 1;
+    }
+  }
+  if (encodeBase64Url(out) !== value) {
+    throw new ByokCoreError("sealed_secret_invalid", `${field} is not canonical base64url`);
+  }
+  return out;
+}
+function base64UrlField(bytes) {
+  return z.string().superRefine((value, ctx) => {
+    try {
+      const decoded = decodeBase64Url(value, "field");
+      if (bytes.exact !== void 0 && decoded.byteLength !== bytes.exact) {
+        ctx.addIssue({ code: "custom", message: `must decode to exactly ${bytes.exact} bytes` });
+      }
+      if (bytes.max !== void 0 && decoded.byteLength > bytes.max) {
+        ctx.addIssue({ code: "custom", message: `must decode to at most ${bytes.max} bytes` });
+      }
+    } catch {
+      ctx.addIssue({ code: "custom", message: "must be canonical unpadded base64url" });
+    }
+  });
+}
+var SealingPublicJwkSchema = z.strictObject({
+  kty: z.literal("EC"),
+  crv: z.literal("P-256"),
+  x: base64UrlField({ exact: 32 }),
+  y: base64UrlField({ exact: 32 })
+});
+var SealingKeyIdSchema = z.string().regex(new RegExp(`^[A-Za-z0-9_-]{${SEALING_KEY_ID_LENGTH}}$`));
+function parseSealingPublicJwk(input) {
+  const result = SealingPublicJwkSchema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError("sealed_secret_invalid", "Sealing public key must be a strict P-256 EC public JWK");
+  }
+  return result.data;
+}
+function sealingPublicKeyBytes(publicJwk) {
+  const jwk = parseSealingPublicJwk(publicJwk);
+  const raw = new Uint8Array(HPKE_P256_PUBLIC_KEY_BYTES);
+  raw[0] = 4;
+  raw.set(decodeBase64Url(jwk.x, "x"), 1);
+  raw.set(decodeBase64Url(jwk.y, "y"), 33);
+  return raw;
+}
+z.strictObject({
+  version: z.literal(1),
+  keyId: SealingKeyIdSchema,
+  epoch: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  publicJwk: SealingPublicJwkSchema
+});
+var OpaqueIdSchema = z.string().min(1).max(200).superRefine((value, ctx) => {
+  if (value.trim() !== value || /[\u0000-\u001f\u007f]/u.test(value)) {
+    ctx.addIssue({ code: "custom", message: "must not carry surrounding whitespace or control characters" });
+  }
+});
+var CanonicalTimestampSchema = z.string().refine(isCanonicalTimestamp, "must be a canonical ISO-8601 UTC instant");
+var ProfileRefSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);
+var ProviderKindSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);
+var ModelIdSchema = z.string().min(1).max(160).refine((value) => value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value), "model id is invalid");
+var CapabilitySchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u);
+var PiModelJsonSchema = z.custom((value) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  try {
+    canonicalizeJson(value);
+    return true;
+  } catch {
+    return false;
+  }
+}, "piModel must be a canonical JSON object");
+var ModelConfigFields = {
+  agentId: OpaqueIdSchema,
+  providerKind: ProviderKindSchema,
+  modelId: ModelIdSchema,
+  piModel: PiModelJsonSchema,
+  capabilities: z.array(CapabilitySchema).max(8).refine((values) => new Set(values).size === values.length, "capabilities must be unique")
+};
+var ProviderProvisioningConfigV1Schema = z.discriminatedUnion("operation", [
+  z.strictObject({ operation: z.literal("configure"), ...ModelConfigFields }),
+  z.strictObject({ operation: z.literal("update_model"), ...ModelConfigFields }),
+  z.strictObject({ operation: z.literal("replace_secret"), agentId: OpaqueIdSchema, providerKind: ProviderKindSchema }),
+  z.strictObject({ operation: z.literal("delete"), agentId: OpaqueIdSchema })
+]);
+var ProviderProvisioningExpectedProfileSchema = z.union([
+  z.null(),
+  z.strictObject({
+    profileRef: ProfileRefSchema,
+    profileRevision: z.string().regex(/^(?:0|[1-9][0-9]{0,19})$/u),
+    profileHash: z.string().regex(CONTENT_HASH_PATTERN)
+  })
+]);
+var ProviderProvisioningIdentityRevisionSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u);
+var ProviderProvisioningHeaderV1Schema = z.strictObject({
+  tenantId: OpaqueIdSchema,
+  deviceId: OpaqueIdSchema,
+  agentId: OpaqueIdSchema,
+  requestId: OpaqueIdSchema,
+  operation: z.enum(PROVIDER_PROVISIONING_OPERATIONS),
+  /** Non-secret, strictly increasing per bot (A3); a device rejects anything not above its high-watermark. */
+  operationGeneration: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  expectedProfile: ProviderProvisioningExpectedProfileSchema,
+  /** The device enrollment revision the Host authorized against (F2). */
+  expectedEnrollmentRevision: ProviderProvisioningIdentityRevisionSchema,
+  /** The agent placement revision the Host authorized against (F2). */
+  expectedPlacementRevision: ProviderProvisioningIdentityRevisionSchema,
+  configDigest: z.string().regex(CONTENT_HASH_PATTERN),
+  issuedAt: CanonicalTimestampSchema,
+  expiresAt: CanonicalTimestampSchema
+});
+var MAX_CIPHERTEXT_BYTES = PROVIDER_SECRET_MAX_PADDED_BYTES + HPKE_AEAD_TAG_BYTES;
+var SealedProviderSecretV1Schema = z.strictObject({
+  suite: z.literal(PROVIDER_SECRET_HPKE_SUITE),
+  keyId: SealingKeyIdSchema,
+  enc: base64UrlField({ exact: HPKE_P256_PUBLIC_KEY_BYTES }),
+  ciphertext: base64UrlField({ max: MAX_CIPHERTEXT_BYTES })
+});
+function isSecretOperation(operation) {
+  return PROVIDER_PROVISIONING_SECRET_OPERATIONS.includes(operation);
+}
+z.strictObject({
+  version: z.literal(PROVIDER_PROVISIONING_REQUEST_VERSION),
+  header: ProviderProvisioningHeaderV1Schema,
+  config: ProviderProvisioningConfigV1Schema,
+  sealed: SealedProviderSecretV1Schema.optional()
+}).superRefine((request, ctx) => {
+  if (request.header.operation !== request.config.operation) {
+    ctx.addIssue({ code: "custom", path: ["config", "operation"], message: "config operation must equal header operation" });
+  }
+  if (request.header.agentId !== request.config.agentId) {
+    ctx.addIssue({ code: "custom", path: ["config", "agentId"], message: "config agentId must equal header agentId" });
+  }
+  if (isSecretOperation(request.header.operation) !== (request.sealed !== void 0)) {
+    ctx.addIssue({ code: "custom", path: ["sealed"], message: "a sealed secret is required exactly for configure and replace_secret" });
+  }
+});
+
+// src/sealed-payload/primitives.ts
+var P256PublicJwkSchema = SealingPublicJwkSchema;
+var ECDSA_P256_SIGNATURE_BYTES = 64;
+function invalidInput(message) {
+  return new ByokCoreError("sealed_secret_invalid", message);
+}
+function utf82(value) {
+  return new TextEncoder().encode(value);
+}
+function copy2(bytes) {
+  return new Uint8Array(bytes);
+}
+function concat2(...parts) {
+  const out = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));
+  let offset = 0;
+  for (const part of parts) {
+    out.set(part, offset);
+    offset += part.byteLength;
+  }
+  return out;
+}
+function hex(bytes) {
+  let out = "";
+  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
+  return out;
+}
+function randomBytes(length) {
+  const source = globalThis.crypto;
+  if (source?.getRandomValues === void 0) {
+    throw new ByokCoreError("webcrypto_unavailable", "WebCrypto getRandomValues is unavailable in this runtime");
+  }
+  return source.getRandomValues(new Uint8Array(length));
+}
+async function sha256(bytes) {
+  return new Uint8Array(await webCryptoSubtle().digest("SHA-256", copy2(bytes)));
+}
+async function hmacSha2562(key, data) {
+  const subtle = webCryptoSubtle();
+  const hmacKey = await subtle.importKey("raw", copy2(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await subtle.sign("HMAC", hmacKey, copy2(data)));
+}
+async function hkdfSha256(ikm, salt, info, length) {
+  const subtle = webCryptoSubtle();
+  const key = await subtle.importKey("raw", copy2(ikm), { name: "HKDF" }, false, ["deriveBits"]);
+  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: copy2(salt), info: utf82(info) }, key, length * 8);
+  return new Uint8Array(bits);
+}
+function base64UrlBytes(bytes) {
+  return z.string().refine((value) => {
+    try {
+      return decodeBase64Url(value, "field").byteLength === bytes;
+    } catch {
+      return false;
+    }
+  }, `must be canonical unpadded base64url of ${bytes} bytes`);
+}
+var ECDSA_P256 = { name: "ECDSA", namedCurve: "P-256" };
+var ECDSA_SHA256 = { name: "ECDSA", hash: "SHA-256" };
+function ecdsaSubtle() {
+  return webCryptoSubtle();
+}
+async function p256PublicKeyBytes(publicJwk) {
+  const raw = sealingPublicKeyBytes(publicJwk);
+  await importEcdsaPublicKey(publicJwk);
+  return raw;
+}
+async function importEcdsaPublicKey(publicJwk) {
+  const jwk = P256PublicJwkSchema.parse(publicJwk);
+  try {
+    return await ecdsaSubtle().importKey("jwk", { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y }, ECDSA_P256, true, ["verify"]);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key is not a valid curve point", { cause });
+  }
+}
+async function ecdsaSign(publicJwk, privateKey, data) {
+  let signature;
+  try {
+    signature = encodeBase64Url(new Uint8Array(await ecdsaSubtle().sign(ECDSA_SHA256, privateKey, copy2(data))));
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_invalid", "Signing key is not an ECDSA P-256 private key", { cause });
+  }
+  if (!await ecdsaVerify(publicJwk, signature, data)) {
+    throw invalidInput("Signing private key does not pair with the signing public key");
+  }
+  return signature;
+}
+async function ecdsaVerify(publicJwk, signature, data) {
+  let signatureBytes;
+  try {
+    signatureBytes = decodeBase64Url(signature, "sig");
+  } catch {
+    return false;
+  }
+  if (signatureBytes.byteLength !== ECDSA_P256_SIGNATURE_BYTES) return false;
+  const key = await importEcdsaPublicKey(publicJwk);
+  return ecdsaSubtle().verify(ECDSA_SHA256, key, signatureBytes, copy2(data));
+}
+
+// src/sealed-payload/member-chain.ts
+var MEMBER_ID_DOMAIN = "byok-member-id-v1\n";
+var MEMBER_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
+var MEMBER_CHAIN_VERSION = 1;
+var MEMBER_CHAIN_DOMAIN_PREFIX = "byok-member-chain-v1\n";
+var MEMBER_CHAIN_OPS = ["add", "remove", "rotate", "scope-policy", "shred"];
+var CanonicalJsonObjectSchema = z.custom((value) => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  try {
+    canonicalizeJson(value);
+    return true;
+  } catch {
+    return false;
+  }
+}, "must be a canonical JSON object");
+var unsignedEntryShape = {
+  v: z.literal(MEMBER_CHAIN_VERSION),
+  tenantId: z.string().min(1),
+  seq: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  prev: z.union([z.null(), z.string().regex(CONTENT_HASH_PATTERN)]),
+  op: z.enum(MEMBER_CHAIN_OPS),
+  subject: CanonicalJsonObjectSchema,
+  signer: z.string().regex(MEMBER_ID_PATTERN)
+};
+function firstEntryHasNoPrev(entry, ctx) {
+  if (entry.seq === 1 !== (entry.prev === null)) {
+    ctx.addIssue({ code: "custom", path: ["prev"], message: "the first entry, and only the first, has no prev" });
+  }
+}
+var UnsignedMemberChainEntryV1Schema = z.strictObject(unsignedEntryShape).superRefine(firstEntryHasNoPrev);
+var MemberChainEntryV1Schema = z.strictObject({ ...unsignedEntryShape, sig: base64UrlBytes(64) }).superRefine(firstEntryHasNoPrev);
+async function deriveMemberId(signingPublicJwk) {
+  const raw = await p256PublicKeyBytes(signingPublicJwk);
+  return encodeBase64Url(await sha256(concat2(utf82(MEMBER_ID_DOMAIN), raw)));
+}
+function parseUnsignedEntry(entry) {
+  const parsed = UnsignedMemberChainEntryV1Schema.safeParse(entry);
+  if (!parsed.success) throw invalidInput("Member chain entry is invalid");
+  return parsed.data;
+}
+function signingInput(entry) {
+  return concat2(
+    utf82(MEMBER_CHAIN_DOMAIN_PREFIX),
+    canonicalizeJsonBytes({
+      v: entry.v,
+      tenantId: entry.tenantId,
+      seq: entry.seq,
+      prev: entry.prev,
+      op: entry.op,
+      subject: entry.subject,
+      signer: entry.signer
+    })
+  );
+}
+function memberChainSigningInput(entry) {
+  return signingInput(parseUnsignedEntry(entry));
+}
+async function memberChainEntryHash(entry) {
+  return `sha256:${hex(await sha256(memberChainSigningInput(entry)))}`;
+}
+async function signMemberChainEntry(entry, signer) {
+  const unsigned = parseUnsignedEntry(entry);
+  if (await deriveMemberId(signer.publicJwk) !== unsigned.signer) {
+    throw invalidInput("Member chain entry signer does not match the signing key");
+  }
+  return { ...unsigned, sig: await ecdsaSign(signer.publicJwk, signer.privateKey, signingInput(unsigned)) };
+}
+async function verifyMemberChainEntry(entry, signerPublicJwk) {
+  const parsed = MemberChainEntryV1Schema.safeParse(entry);
+  if (!parsed.success || await deriveMemberId(signerPublicJwk) !== parsed.data.signer) {
+    return { ok: false, reason: "member_chain_entry_invalid" };
+  }
+  const input = signingInput(parsed.data);
+  if (!await ecdsaVerify(signerPublicJwk, parsed.data.sig, input)) {
+    return { ok: false, reason: "member_chain_signature_invalid" };
+  }
+  return { ok: true, entry: parsed.data, hash: `sha256:${hex(await sha256(input))}` };
+}
+var SCOPE_KEY_BYTES = 32;
+var SCOPE_KEY_ID_PATTERN = /^[A-Za-z0-9_-]{22}$/u;
+var KEY_ID_MESSAGE = "byok-scope-key-id-v1";
+var CONTENT_KEY_INFO = "byok-sdk.sealed.v1.enc";
+var MAC_KEY_INFO = "byok-sdk.sealed.v1.mac";
+var SEALED_SALT_BYTES = 32;
+var SCOPE_KEY_PACKAGE_VERSION = 1;
+var SCOPE_KEY_HPKE_INFO = "byok-sdk.scope-key.v1";
+var SCOPE_KEY_PACKAGE_DOMAIN_PREFIX = "byok-scope-key-package-v1\n";
+var P256_POINT_BYTES = 65;
+var AEAD_TAG_BYTES = 16;
+function assertScopeKey(scopeKey) {
+  if (scopeKey.byteLength !== SCOPE_KEY_BYTES) throw invalidInput(`Scope key must be ${SCOPE_KEY_BYTES} bytes`);
+}
+function generateScopeKey() {
+  return randomBytes(SCOPE_KEY_BYTES);
+}
+async function deriveScopeKeyId(scopeKey) {
+  assertScopeKey(scopeKey);
+  const mac = await hmacSha2562(scopeKey, utf82(KEY_ID_MESSAGE));
+  return encodeBase64Url(mac.subarray(0, 16));
+}
+async function deriveSealedContentKey(scopeKey, salt) {
+  assertScopeKey(scopeKey);
+  if (salt.byteLength !== SEALED_SALT_BYTES) throw invalidInput(`Sealed content salt must be ${SEALED_SALT_BYTES} bytes`);
+  return hkdfSha256(scopeKey, salt, CONTENT_KEY_INFO, 32);
+}
+async function deriveSealedMacKey(scopeKey) {
+  assertScopeKey(scopeKey);
+  return hkdfSha256(scopeKey, new Uint8Array(32), MAC_KEY_INFO, 32);
+}
+var ScopeKeyPackageV1Schema = z.strictObject({
+  v: z.literal(SCOPE_KEY_PACKAGE_VERSION),
+  tenantId: z.string().min(1),
+  scopeId: z.string().min(1),
+  epoch: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  keyId: z.string().regex(SCOPE_KEY_ID_PATTERN),
+  recipient: z.string().regex(MEMBER_ID_PATTERN),
+  sender: z.string().regex(MEMBER_ID_PATTERN),
+  enc: base64UrlBytes(P256_POINT_BYTES),
+  ciphertext: base64UrlBytes(SCOPE_KEY_BYTES + AEAD_TAG_BYTES),
+  sig: base64UrlBytes(64)
+});
+function packageAad(identity) {
+  return canonicalizeJsonBytes({
+    v: identity.v,
+    tenantId: identity.tenantId,
+    scopeId: identity.scopeId,
+    epoch: identity.epoch,
+    keyId: identity.keyId,
+    recipient: identity.recipient,
+    sender: identity.sender
+  });
+}
+function packageSigningInput(pkg) {
+  return concat2(
+    utf82(SCOPE_KEY_PACKAGE_DOMAIN_PREFIX),
+    canonicalizeJsonBytes({
+      v: pkg.v,
+      tenantId: pkg.tenantId,
+      scopeId: pkg.scopeId,
+      epoch: pkg.epoch,
+      keyId: pkg.keyId,
+      recipient: pkg.recipient,
+      sender: pkg.sender,
+      enc: pkg.enc,
+      ciphertext: pkg.ciphertext
+    })
+  );
+}
+var PackageIdentitySchema = ScopeKeyPackageV1Schema.omit({ enc: true, ciphertext: true, sig: true });
+async function sealScopeKeyPackage(input) {
+  const parsed = PackageIdentitySchema.safeParse({
+    v: SCOPE_KEY_PACKAGE_VERSION,
+    tenantId: input.tenantId,
+    scopeId: input.scopeId,
+    epoch: input.epoch,
+    keyId: await deriveScopeKeyId(input.scopeKey),
+    recipient: input.recipient.memberId,
+    sender: await deriveMemberId(input.sender.signingPublicJwk)
+  });
+  if (!parsed.success) throw invalidInput("Scope key package input is invalid");
+  const identity = parsed.data;
+  const { enc, ciphertext } = await hpkeSealBase({
+    recipientPublicKey: await p256PublicKeyBytes(input.recipient.kemPublicJwk),
+    info: utf82(SCOPE_KEY_HPKE_INFO),
+    aad: packageAad(identity),
+    plaintext: input.scopeKey
+  });
+  const unsigned = { ...identity, enc: encodeBase64Url(enc), ciphertext: encodeBase64Url(ciphertext) };
+  return { ...unsigned, sig: await ecdsaSign(input.sender.signingPublicJwk, input.sender.signingPrivateKey, packageSigningInput(unsigned)) };
+}
+async function openScopeKeyPackage(input) {
+  const parsed = ScopeKeyPackageV1Schema.safeParse(input.package);
+  if (!parsed.success) return { ok: false, reason: "key_package_invalid" };
+  const pkg = parsed.data;
+  if (pkg.recipient !== input.recipient.memberId || pkg.tenantId !== input.expected.tenantId || pkg.scopeId !== input.expected.scopeId || pkg.epoch !== input.expected.epoch || pkg.sender !== await deriveMemberId(input.senderSigningPublicJwk)) {
+    return { ok: false, reason: "key_package_invalid" };
+  }
+  if (!await ecdsaVerify(input.senderSigningPublicJwk, pkg.sig, packageSigningInput(pkg))) {
+    return { ok: false, reason: "key_package_signature_invalid" };
+  }
+  let scopeKey;
+  try {
+    scopeKey = await hpkeOpenBase({
+      recipientPrivateKey: input.recipient.kemPrivateKey,
+      recipientPublicKey: await p256PublicKeyBytes(input.recipient.kemPublicJwk),
+      enc: decodeBase64Url(pkg.enc, "enc"),
+      info: utf82(SCOPE_KEY_HPKE_INFO),
+      aad: packageAad(pkg),
+      ciphertext: decodeBase64Url(pkg.ciphertext, "ciphertext")
+    });
+  } catch (error) {
+    if (error instanceof ByokCoreError) return { ok: false, reason: "key_package_open_failed" };
+    throw error;
+  }
+  if (scopeKey.byteLength !== SCOPE_KEY_BYTES || await deriveScopeKeyId(scopeKey) !== pkg.keyId) {
+    scopeKey.fill(0);
+    return { ok: false, reason: "key_package_open_failed" };
+  }
+  return { ok: true, scopeKey, keyId: pkg.keyId };
+}
+
+// src/sealed-payload/sealed-content.ts
+var SEALED_CONTENT_VERSION = 1;
+var SEALED_CONTENT_SUITE = "byok-sealed-v1.hkdf-sha256.aes-256-gcm";
+var SEALED_CATEGORIES = ["task-input", "agent-message", "task-output", "memory-projection"];
+var SEALED_DIRECTIONS = ["server-to-daemon", "daemon-to-server"];
+var SEALED_NONCE_BYTES = 12;
+var AEAD_TAG_BYTES2 = 16;
+var FRAME_HEADER_BYTES = 4;
+var ALIGNED_FRAME_LIMIT = 16 * 1024;
+var FRAME_ALIGNMENT = 256;
+var MAX_CONTENT_LENGTH = 4294967295;
+var CONTENT_MAC_PREFIX = "byok-content-mac-v1\n";
+var CONTENT_MAC_PATTERN = /^hmac-sha256:[0-9a-f]{64}$/u;
+var FAMILY_PATTERN = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/u;
+var IDENTITY_FIELD_PATTERN = /^[a-z][A-Za-z0-9]*$/u;
+var ROUTINE_TEMPLATE_FAMILY = "routine.template";
+function floorLog2(value) {
+  let exponent = 0;
+  for (let remaining = value; remaining >= 2; remaining = Math.floor(remaining / 2)) exponent += 1;
+  return exponent;
+}
+function sealedPaddedLength(frameLength) {
+  if (!Number.isSafeInteger(frameLength) || frameLength < FRAME_HEADER_BYTES) {
+    throw invalidInput("Sealed frame length must be a safe integer of at least 4");
+  }
+  if (frameLength <= ALIGNED_FRAME_LIMIT) return Math.ceil(frameLength / FRAME_ALIGNMENT) * FRAME_ALIGNMENT;
+  const exponent = floorLog2(frameLength);
+  const step = 2 ** (exponent - (floorLog2(exponent) + 1));
+  return Math.ceil(frameLength / step) * step;
+}
+function isLegalPaddedLength(paddedLength) {
+  return Number.isSafeInteger(paddedLength) && paddedLength >= FRAME_ALIGNMENT && sealedPaddedLength(paddedLength) === paddedLength;
+}
+function encodeSealedFrame(content) {
+  if (content.byteLength > MAX_CONTENT_LENGTH) throw invalidInput("Sealed content exceeds the 32-bit frame length");
+  const frame = new Uint8Array(sealedPaddedLength(FRAME_HEADER_BYTES + content.byteLength));
+  new DataView(frame.buffer).setUint32(0, content.byteLength, false);
+  frame.set(content, FRAME_HEADER_BYTES);
+  return frame;
+}
+function decodeSealedFrame(frame, paddedLength, maxContentLength) {
+  if (frame.byteLength !== paddedLength || paddedLength < FRAME_HEADER_BYTES) return void 0;
+  const contentLength = new DataView(frame.buffer, frame.byteOffset, frame.byteLength).getUint32(0, false);
+  if (contentLength > paddedLength - FRAME_HEADER_BYTES) return void 0;
+  if (sealedPaddedLength(FRAME_HEADER_BYTES + contentLength) !== paddedLength) return void 0;
+  if (contentLength > maxContentLength) return void 0;
+  for (let index = FRAME_HEADER_BYTES + contentLength; index < paddedLength; index += 1) {
+    if (frame[index] !== 0) return void 0;
+  }
+  return frame.subarray(FRAME_HEADER_BYTES, FRAME_HEADER_BYTES + contentLength);
+}
+var NonEmptyStringSchema = z.string().min(1);
+var PositiveIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var SealedContentHeaderV1Schema = z.strictObject({
+  v: z.literal(SEALED_CONTENT_VERSION),
+  suite: z.literal(SEALED_CONTENT_SUITE),
+  category: z.enum(SEALED_CATEGORIES),
+  scope: z.strictObject({
+    id: NonEmptyStringSchema,
+    epoch: PositiveIntegerSchema,
+    keyId: z.string().regex(SCOPE_KEY_ID_PATTERN)
+  }),
+  chainHead: z.strictObject({
+    seq: PositiveIntegerSchema,
+    hash: z.string().regex(CONTENT_HASH_PATTERN)
+  }),
+  sender: z.string().regex(MEMBER_ID_PATTERN),
+  salt: base64UrlBytes(SEALED_SALT_BYTES),
+  nonce: base64UrlBytes(SEALED_NONCE_BYTES),
+  paddedLength: PositiveIntegerSchema.refine(isLegalPaddedLength, "must be a legal padded frame length"),
+  contentMac: z.string().regex(CONTENT_MAC_PATTERN)
+});
+function isCanonicalCategoryList(categories) {
+  return categories.every((category, index) => index === 0 || SEALED_CATEGORIES.indexOf(categories[index - 1]) < SEALED_CATEGORIES.indexOf(category));
+}
+var SealedBindingSchema = z.strictObject({
+  tenantId: NonEmptyStringSchema,
+  family: z.string().regex(FAMILY_PATTERN),
+  direction: z.enum(SEALED_DIRECTIONS),
+  identity: z.record(
+    z.string().regex(IDENTITY_FIELD_PATTERN),
+    z.union([NonEmptyStringSchema, z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)])
+  ).refine((identity) => Object.keys(identity).length > 0, "identity must name at least one field"),
+  deviceId: z.union([z.null(), NonEmptyStringSchema]),
+  agentRef: z.union([z.null(), z.strictObject({ agentId: NonEmptyStringSchema, profileRevision: NonEmptyStringSchema })]),
+  categories: z.array(z.enum(SEALED_CATEGORIES)).min(1).refine(isCanonicalCategoryList, "categories must be unique and in canonical order"),
+  notAfter: z.union([z.null(), z.string().refine(isCanonicalTimestamp, "must be a canonical UTC instant")])
+}).superRefine((binding, ctx) => {
+  const template = binding.family === ROUTINE_TEMPLATE_FAMILY;
+  if (binding.deviceId === null !== template || binding.notAfter === null === template) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["deviceId"],
+      message: "a routine template binds an expiry and no device; every other family binds a device and no expiry"
+    });
+  }
+});
+function parseBinding(binding) {
+  const parsed = SealedBindingSchema.safeParse(binding);
+  if (!parsed.success) throw invalidInput("Sealed content binding is invalid");
+  return parsed.data;
+}
+function assertMaxContentLength(maxContentLength) {
+  if (!Number.isSafeInteger(maxContentLength) || maxContentLength < 0 || maxContentLength > MAX_CONTENT_LENGTH) {
+    throw invalidInput("Sealed content limit must be a non-negative 32-bit integer");
+  }
+}
+function aadBytes(header, binding) {
+  return canonicalizeJsonBytes({
+    v: header.v,
+    suite: header.suite,
+    category: header.category,
+    tenantId: binding.tenantId,
+    scopeId: header.scope.id,
+    epoch: header.scope.epoch,
+    keyId: header.scope.keyId,
+    chainHead: { seq: header.chainHead.seq, hash: header.chainHead.hash },
+    sender: header.sender,
+    family: binding.family,
+    direction: binding.direction,
+    identity: binding.identity,
+    deviceId: binding.deviceId,
+    agentRef: binding.agentRef === null ? null : { agentId: binding.agentRef.agentId, profileRevision: binding.agentRef.profileRevision },
+    categories: [...binding.categories],
+    notAfter: binding.notAfter,
+    paddedLength: header.paddedLength,
+    contentMac: header.contentMac
+  });
+}
+function isNonEmptyPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  return (prototype === Object.prototype || prototype === null) && Object.keys(value).length > 0;
+}
+function canonicalPlaintext(plaintext) {
+  if (!isNonEmptyPlainObject(plaintext)) throw invalidInput("Sealed plaintext must be a non-empty plain JSON object");
+  try {
+    return canonicalizeJson(plaintext);
+  } catch (cause) {
+    throw new ByokCoreError("sealed_secret_invalid", "Sealed plaintext is not canonical JSON", { cause });
+  }
+}
+function parseCanonicalPlaintext(content) {
+  let text;
+  let value;
+  try {
+    text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(content);
+    value = JSON.parse(text);
+    if (!isNonEmptyPlainObject(value) || canonicalizeJson(value) !== text) return void 0;
+  } catch {
+    return void 0;
+  }
+  return { value, text };
+}
+async function contentMacOf(scopeKey, category, binding, plaintextText) {
+  const macKey = await deriveSealedMacKey(scopeKey);
+  try {
+    const input = `${CONTENT_MAC_PREFIX}${category}
+${binding.family}
+${canonicalizeJson(binding.identity)}
+${plaintextText}`;
+    return `hmac-sha256:${hex(await hmacSha2562(macKey, utf82(input)))}`;
+  } finally {
+    macKey.fill(0);
+  }
+}
+async function aesGcm(mode, key, nonce, aad, data) {
+  const subtle = webCryptoSubtle();
+  const cryptoKey = await subtle.importKey("raw", copy2(key), { name: "AES-GCM" }, false, [mode]);
+  const params = { name: "AES-GCM", iv: copy2(nonce), additionalData: copy2(aad), tagLength: 128 };
+  const out = mode === "encrypt" ? await subtle.encrypt(params, cryptoKey, copy2(data)) : await subtle.decrypt(params, cryptoKey, copy2(data));
+  return new Uint8Array(out);
+}
+async function sealContent(input) {
+  return sealContentWithRandomness(input, { salt: randomBytes(SEALED_SALT_BYTES), nonce: randomBytes(SEALED_NONCE_BYTES) });
+}
+async function sealContentWithRandomness(input, randomness) {
+  const binding = parseBinding(input.binding);
+  assertMaxContentLength(input.maxContentLength);
+  if (!binding.categories.includes(input.category)) {
+    throw invalidInput("Sealed content category is not one of the task sealing categories");
+  }
+  const plaintextText = canonicalPlaintext(input.plaintext);
+  const content = utf82(plaintextText);
+  if (content.byteLength > input.maxContentLength) throw invalidInput("Sealed content exceeds its plaintext limit");
+  const frame = encodeSealedFrame(content);
+  const { salt, nonce } = randomness;
+  const parsed = SealedContentHeaderV1Schema.safeParse({
+    v: SEALED_CONTENT_VERSION,
+    suite: SEALED_CONTENT_SUITE,
+    category: input.category,
+    scope: { id: input.scope.id, epoch: input.scope.epoch, keyId: await deriveScopeKeyId(input.scopeKey) },
+    chainHead: { seq: input.chainHead.seq, hash: input.chainHead.hash },
+    sender: input.sender,
+    salt: encodeBase64Url(salt),
+    nonce: encodeBase64Url(nonce),
+    paddedLength: frame.byteLength,
+    contentMac: await contentMacOf(input.scopeKey, input.category, binding, plaintextText)
+  });
+  if (!parsed.success) throw invalidInput("Sealed content header input is invalid");
+  const contentKey = await deriveSealedContentKey(input.scopeKey, salt);
+  try {
+    const ciphertext = await aesGcm("encrypt", contentKey, nonce, aadBytes(parsed.data, binding), frame);
+    return { header: parsed.data, ciphertext };
+  } finally {
+    contentKey.fill(0);
+    frame.fill(0);
+    content.fill(0);
+  }
+}
+var SealedScopePolicySchema = z.strictObject({ scopeId: NonEmptyStringSchema, epoch: PositiveIntegerSchema });
+function failure(reason) {
+  return { ok: false, reason };
+}
+async function openSealedContent(input) {
+  assertMaxContentLength(input.maxContentLength);
+  const parsedBinding = SealedBindingSchema.safeParse(input.binding);
+  const parsedSealing = SealedScopePolicySchema.safeParse(input.sealing);
+  if (!parsedBinding.success || !parsedSealing.success) return failure("sealing_policy_mismatch");
+  const binding = parsedBinding.data;
+  const sealing = parsedSealing.data;
+  const parsed = SealedContentHeaderV1Schema.safeParse(input.header);
+  if (!parsed.success) return failure("sealed_open_failed");
+  const header = parsed.data;
+  if (!binding.categories.includes(header.category) || header.scope.id !== sealing.scopeId || header.scope.epoch < sealing.epoch) {
+    return failure("sealing_policy_mismatch");
+  }
+  if (await deriveScopeKeyId(input.scopeKey) !== header.scope.keyId) return failure("sealed_key_unavailable");
+  if (input.ciphertext.byteLength !== header.paddedLength + AEAD_TAG_BYTES2) return failure("sealed_open_failed");
+  const contentKey = await deriveSealedContentKey(input.scopeKey, decodeBase64Url(header.salt, "salt"));
+  let frame;
+  try {
+    frame = await aesGcm("decrypt", contentKey, decodeBase64Url(header.nonce, "nonce"), aadBytes(header, binding), input.ciphertext);
+  } catch {
+    return failure("sealed_open_failed");
+  } finally {
+    contentKey.fill(0);
+  }
+  try {
+    const content = decodeSealedFrame(frame, header.paddedLength, input.maxContentLength);
+    const plaintext = content === void 0 ? void 0 : parseCanonicalPlaintext(content);
+    if (plaintext === void 0) return failure("sealed_open_failed");
+    if (await contentMacOf(input.scopeKey, header.category, binding, plaintext.text) !== header.contentMac) {
+      return failure("sealed_content_mac_mismatch");
+    }
+    return { ok: true, plaintext: plaintext.value, header };
+  } finally {
+    frame.fill(0);
+  }
+}
+
+export { MEMBER_CHAIN_OPS, SEALED_CATEGORIES, SEALED_CONTENT_SUITE, SEALED_CONTENT_VERSION, SEALED_DIRECTIONS, SealedContentHeaderV1Schema, deriveMemberId, deriveScopeKeyId, generateScopeKey, memberChainEntryHash, openScopeKeyPackage, openSealedContent, sealContent, sealScopeKeyPackage, signMemberChainEntry, verifyMemberChainEntry };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map