@byok-sdk/core 0.29.0 → 0.30.1

package/dist/sealed-payload/index.js

@@ -137,6 +137,15 @@ function isCanonicalTimestamp(value) {
   if (!Number.isFinite(parsed)) return false;
   return new Date(parsed).toISOString() === value;
 }
+
+// src/total-parse.ts
+function safeParseTotal(schema, value) {
+  try {
+    return schema.safeParse(value);
+  } catch {
+    return { success: false };
+  }
+}
 function webCryptoSubtle() {
   const subtle = globalThis.crypto?.subtle;
   if (subtle === void 0) {
@@ -388,7 +397,7 @@ var SealingPublicJwkSchema = z.strictObject({
 });
 var SealingKeyIdSchema = z.string().regex(new RegExp(`^[A-Za-z0-9_-]{${SEALING_KEY_ID_LENGTH}}$`));
 function parseSealingPublicJwk(input) {
-  const result = SealingPublicJwkSchema.safeParse(input);
+  const result = safeParseTotal(SealingPublicJwkSchema, input);
   if (!result.success) {
     throw new ByokCoreError("sealed_secret_invalid", "Sealing public key must be a strict P-256 EC public JWK");
   }
@@ -597,15 +606,16 @@ var MEMBER_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
 var MEMBER_CHAIN_VERSION = 1;
 var MEMBER_CHAIN_DOMAIN_PREFIX = "byok-member-chain-v1\n";
 var MEMBER_CHAIN_OPS = ["add", "remove", "rotate", "scope-policy", "shred"];
-var CanonicalJsonObjectSchema = z.custom((value) => {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+var CanonicalJsonObjectSchema = z.unknown().transform((value, ctx) => {
   try {
-    canonicalizeJson(value);
-    return true;
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      return JSON.parse(canonicalizeJson(value));
+    }
   } catch {
-    return false;
   }
-}, "must be a canonical JSON object");
+  ctx.addIssue({ code: "custom", message: "must be a canonical JSON object" });
+  return z.NEVER;
+});
 var unsignedEntryShape = {
   v: z.literal(MEMBER_CHAIN_VERSION),
   tenantId: z.string().min(1),
@@ -627,7 +637,7 @@ async function deriveMemberId(signingPublicJwk) {
   return encodeBase64Url(await sha256(concat2(utf82(MEMBER_ID_DOMAIN), raw)));
 }
 function parseUnsignedEntry(entry) {
-  const parsed = UnsignedMemberChainEntryV1Schema.safeParse(entry);
+  const parsed = safeParseTotal(UnsignedMemberChainEntryV1Schema, entry);
   if (!parsed.success) throw invalidInput("Member chain entry is invalid");
   return parsed.data;
 }
@@ -659,7 +669,7 @@ async function signMemberChainEntry(entry, signer) {
   return { ...unsigned, sig: await ecdsaSign(signer.publicJwk, signer.privateKey, signingInput(unsigned)) };
 }
 async function verifyMemberChainEntry(entry, signerPublicJwk) {
-  const parsed = MemberChainEntryV1Schema.safeParse(entry);
+  const parsed = safeParseTotal(MemberChainEntryV1Schema, entry);
   if (!parsed.success || await deriveMemberId(signerPublicJwk) !== parsed.data.signer) {
     return { ok: false, reason: "member_chain_entry_invalid" };
   }
@@ -741,7 +751,7 @@ function packageSigningInput(pkg) {
 }
 var PackageIdentitySchema = ScopeKeyPackageV1Schema.omit({ enc: true, ciphertext: true, sig: true });
 async function sealScopeKeyPackage(input) {
-  const parsed = PackageIdentitySchema.safeParse({
+  const parsed = safeParseTotal(PackageIdentitySchema, {
     v: SCOPE_KEY_PACKAGE_VERSION,
     tenantId: input.tenantId,
     scopeId: input.scopeId,
@@ -762,7 +772,7 @@ async function sealScopeKeyPackage(input) {
   return { ...unsigned, sig: await ecdsaSign(input.sender.signingPublicJwk, input.sender.signingPrivateKey, packageSigningInput(unsigned)) };
 }
 async function openScopeKeyPackage(input) {
-  const parsed = ScopeKeyPackageV1Schema.safeParse(input.package);
+  const parsed = safeParseTotal(ScopeKeyPackageV1Schema, input.package);
   if (!parsed.success) return { ok: false, reason: "key_package_invalid" };
   const pkg = parsed.data;
   if (pkg.recipient !== input.recipient.memberId || pkg.tenantId !== input.expected.tenantId || pkg.scopeId !== input.expected.scopeId || pkg.epoch !== input.expected.epoch || pkg.sender !== await deriveMemberId(input.senderSigningPublicJwk)) {
@@ -792,6 +802,39 @@ async function openScopeKeyPackage(input) {
   return { ok: true, scopeKey, keyId: pkg.keyId };
 }
 
+// src/sealed-payload/sealed-json.ts
+function canonicalValue(value, seen) {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "string":
+      return JSON.stringify(value);
+    case "number":
+      if (!Number.isFinite(value)) throw invalidInput("Sealed plaintext holds a number with no JSON form");
+      return String(value);
+    case "object":
+      break;
+    default:
+      throw invalidInput(`Sealed plaintext holds a ${typeof value}, which is not a JSON type`);
+  }
+  if (seen.has(value)) throw invalidInput("Sealed plaintext holds a circular reference");
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) return `[${Array.from(value, (entry) => canonicalValue(entry, seen)).join(",")}]`;
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) throw invalidInput("Sealed plaintext holds an object that is not plain");
+    const record = value;
+    const members = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalValue(record[key], seen)}`);
+    return `{${members.join(",")}}`;
+  } finally {
+    seen.delete(value);
+  }
+}
+function canonicalizeSealedJson(value) {
+  return canonicalValue(value, /* @__PURE__ */ new Set());
+}
+
 // src/sealed-payload/sealed-content.ts
 var SEALED_CONTENT_VERSION = 1;
 var SEALED_CONTENT_SUITE = "byok-sealed-v1.hkdf-sha256.aes-256-gcm";
@@ -890,7 +933,7 @@ var SealedBindingSchema = z.strictObject({
   }
 });
 function parseBinding(binding) {
-  const parsed = SealedBindingSchema.safeParse(binding);
+  const parsed = safeParseTotal(SealedBindingSchema, binding);
   if (!parsed.success) throw invalidInput("Sealed content binding is invalid");
   return parsed.data;
 }
@@ -899,8 +942,8 @@ function assertMaxContentLength(maxContentLength) {
     throw invalidInput("Sealed content limit must be a non-negative 32-bit integer");
   }
 }
-function aadBytes(header, binding) {
-  return canonicalizeJsonBytes({
+function bindingAad(header, binding) {
+  return {
     v: header.v,
     suite: header.suite,
     category: header.category,
@@ -916,10 +959,11 @@ function aadBytes(header, binding) {
     deviceId: binding.deviceId,
     agentRef: binding.agentRef === null ? null : { agentId: binding.agentRef.agentId, profileRevision: binding.agentRef.profileRevision },
     categories: [...binding.categories],
-    notAfter: binding.notAfter,
-    paddedLength: header.paddedLength,
-    contentMac: header.contentMac
-  });
+    notAfter: binding.notAfter
+  };
+}
+function aadBytes(header, binding) {
+  return canonicalizeJsonBytes({ ...bindingAad(header, binding), paddedLength: header.paddedLength, contentMac: header.contentMac });
 }
 function isNonEmptyPlainObject(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
@@ -927,12 +971,12 @@ function isNonEmptyPlainObject(value) {
   return (prototype === Object.prototype || prototype === null) && Object.keys(value).length > 0;
 }
 function canonicalPlaintext(plaintext) {
-  if (!isNonEmptyPlainObject(plaintext)) throw invalidInput("Sealed plaintext must be a non-empty plain JSON object");
   try {
-    return canonicalizeJson(plaintext);
+    if (isNonEmptyPlainObject(plaintext)) return canonicalizeSealedJson(plaintext);
   } catch (cause) {
     throw new ByokCoreError("sealed_secret_invalid", "Sealed plaintext is not canonical JSON", { cause });
   }
+  throw invalidInput("Sealed plaintext must be a non-empty plain JSON object");
 }
 function parseCanonicalPlaintext(content) {
   let text;
@@ -940,7 +984,7 @@ function parseCanonicalPlaintext(content) {
   try {
     text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(content);
     value = JSON.parse(text);
-    if (!isNonEmptyPlainObject(value) || canonicalizeJson(value) !== text) return void 0;
+    if (!isNonEmptyPlainObject(value) || canonicalizeSealedJson(value) !== text) return void 0;
   } catch {
     return void 0;
   }
@@ -979,7 +1023,7 @@ async function sealContentWithRandomness(input, randomness) {
   if (content.byteLength > input.maxContentLength) throw invalidInput("Sealed content exceeds its plaintext limit");
   const frame = encodeSealedFrame(content);
   const { salt, nonce } = randomness;
-  const parsed = SealedContentHeaderV1Schema.safeParse({
+  const parsed = safeParseTotal(SealedContentHeaderV1Schema, {
     v: SEALED_CONTENT_VERSION,
     suite: SEALED_CONTENT_SUITE,
     category: input.category,
@@ -1008,12 +1052,12 @@ function failure(reason) {
 }
 async function openSealedContent(input) {
   assertMaxContentLength(input.maxContentLength);
-  const parsedBinding = SealedBindingSchema.safeParse(input.binding);
-  const parsedSealing = SealedScopePolicySchema.safeParse(input.sealing);
+  const parsedBinding = safeParseTotal(SealedBindingSchema, input.binding);
+  const parsedSealing = safeParseTotal(SealedScopePolicySchema, input.sealing);
   if (!parsedBinding.success || !parsedSealing.success) return failure("sealing_policy_mismatch");
   const binding = parsedBinding.data;
   const sealing = parsedSealing.data;
-  const parsed = SealedContentHeaderV1Schema.safeParse(input.header);
+  const parsed = safeParseTotal(SealedContentHeaderV1Schema, input.header);
   if (!parsed.success) return failure("sealed_open_failed");
   const header = parsed.data;
   if (!binding.categories.includes(header.category) || header.scope.id !== sealing.scopeId || header.scope.epoch < sealing.epoch) {
@@ -1042,7 +1086,510 @@ async function openSealedContent(input) {
     frame.fill(0);
   }
 }
+var MEMBER_KEY_BUNDLE_VERSION = 1;
+var MEMBER_KEM_DOMAIN_PREFIX = "byok-member-kem-v1\n";
+var KemEpochSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var KemSigSchema = base64UrlBytes(64);
+var MemberKeyBundleV1Schema = z.strictObject({
+  v: z.literal(MEMBER_KEY_BUNDLE_VERSION),
+  memberId: z.string().regex(MEMBER_ID_PATTERN),
+  signingPublicJwk: P256PublicJwkSchema,
+  kemPublicJwk: P256PublicJwkSchema,
+  kemEpoch: KemEpochSchema,
+  kemSig: KemSigSchema,
+  deviceId: z.string().min(1).optional()
+});
+var CreateInputSchema = z.object({
+  signingPublicJwk: P256PublicJwkSchema,
+  signingPrivateKey: z.custom(),
+  kemPublicJwk: P256PublicJwkSchema,
+  kemEpoch: KemEpochSchema,
+  deviceId: z.string().min(1).optional()
+});
+var KemSignerSchema = z.object({ memberId: z.string().regex(MEMBER_ID_PATTERN), signingPublicJwk: P256PublicJwkSchema });
+var KemStatementSchema = z.object({ kemPublicJwk: P256PublicJwkSchema, kemEpoch: KemEpochSchema, kemSig: KemSigSchema });
+function memberKemSigningInput(memberId, kemPublicJwk, kemEpoch) {
+  return concat2(
+    utf82(MEMBER_KEM_DOMAIN_PREFIX),
+    canonicalizeJsonBytes({ memberId, kemPublicKey: { x: kemPublicJwk.x, y: kemPublicJwk.y }, kemEpoch })
+  );
+}
+async function createMemberKeyBundle(input) {
+  const parsed = safeParseTotal(CreateInputSchema, input);
+  if (!parsed.success) throw invalidInput("Member key bundle input is invalid");
+  const { signingPublicJwk, signingPrivateKey, kemPublicJwk, kemEpoch, deviceId } = parsed.data;
+  const memberId = await deriveMemberId(signingPublicJwk);
+  if (!await isValidMemberKemKey(kemPublicJwk, signingPublicJwk)) throw invalidInput("Member KEM key is invalid");
+  const kemSig = await ecdsaSign(signingPublicJwk, signingPrivateKey, memberKemSigningInput(memberId, kemPublicJwk, kemEpoch));
+  return {
+    v: MEMBER_KEY_BUNDLE_VERSION,
+    memberId,
+    signingPublicJwk,
+    kemPublicJwk,
+    kemEpoch,
+    kemSig,
+    ...deviceId === void 0 ? {} : { deviceId }
+  };
+}
+async function isValidMemberKemKey(kemPublicJwk, signingPublicJwk) {
+  if (kemPublicJwk.x === signingPublicJwk.x && kemPublicJwk.y === signingPublicJwk.y) return false;
+  try {
+    await p256PublicKeyBytes(kemPublicJwk);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function verifyMemberKem(member, kem) {
+  const signer = safeParseTotal(KemSignerSchema, member);
+  const statement = safeParseTotal(KemStatementSchema, kem);
+  if (!signer.success || !statement.success) return false;
+  const { memberId, signingPublicJwk } = signer.data;
+  const { kemPublicJwk, kemEpoch, kemSig } = statement.data;
+  if (!await isValidMemberKemKey(kemPublicJwk, signingPublicJwk)) return false;
+  try {
+    return await ecdsaVerify(signingPublicJwk, kemSig, memberKemSigningInput(memberId, kemPublicJwk, kemEpoch));
+  } catch {
+    return false;
+  }
+}
+async function parseMemberKeyBundle(value) {
+  const parsed = safeParseTotal(MemberKeyBundleV1Schema, value);
+  if (!parsed.success) return void 0;
+  const bundle = parsed.data;
+  try {
+    if (await deriveMemberId(bundle.signingPublicJwk) !== bundle.memberId) return void 0;
+  } catch {
+    return void 0;
+  }
+  if (!await verifyMemberKem(bundle, bundle)) return void 0;
+  return bundle;
+}
+var MEMBER_KEY_RECORD_VERSION = 1;
+var PrivateJwkSchema = z.strictObject({
+  kty: z.literal("EC"),
+  crv: z.literal("P-256"),
+  x: base64UrlBytes(32),
+  y: base64UrlBytes(32),
+  d: base64UrlBytes(32)
+});
+var KemEpochSchema2 = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
+var MemberKeyRecordV1Schema = z.strictObject({
+  v: z.literal(MEMBER_KEY_RECORD_VERSION),
+  tenantId: z.string().min(1),
+  deviceId: z.string().min(1).optional(),
+  signingJwk: PrivateJwkSchema,
+  kemEpoch: KemEpochSchema2,
+  kemJwk: PrivateJwkSchema,
+  nextKem: z.strictObject({ epoch: KemEpochSchema2, jwk: PrivateJwkSchema }).optional()
+}).refine((record) => record.nextKem === void 0 || record.nextKem.epoch === record.kemEpoch + 1);
+var BindingSchema = z.object({ tenantId: z.string().min(1), deviceId: z.string().min(1).optional() });
+function keySubtle() {
+  return webCryptoSubtle();
+}
+var ECDSA_P2562 = { name: "ECDSA", namedCurve: "P-256" };
+var ECDSA_SHA2562 = { name: "ECDSA", hash: "SHA-256" };
+var ECDH_P256 = { name: "ECDH", namedCurve: "P-256" };
+async function generatePrivateJwk(algorithm, usages) {
+  const pair = await keySubtle().generateKey(algorithm, true, usages);
+  const { kty, crv, x, y, d } = await keySubtle().exportKey("jwk", pair.privateKey);
+  return PrivateJwkSchema.parse({ kty, crv, x, y, d });
+}
+async function generateMemberKeyRecord(binding) {
+  const parsed = safeParseTotal(BindingSchema, binding);
+  if (!parsed.success) throw invalidInput("Member key binding is invalid");
+  const { tenantId, deviceId } = parsed.data;
+  return canonicalizeJson({
+    v: MEMBER_KEY_RECORD_VERSION,
+    tenantId,
+    ...deviceId === void 0 ? {} : { deviceId },
+    signingJwk: await generatePrivateJwk(ECDSA_P2562, ["sign", "verify"]),
+    kemEpoch: 1,
+    kemJwk: await generatePrivateJwk(ECDH_P256, ["deriveBits"])
+  });
+}
+function publicJwkOf(jwk) {
+  return P256PublicJwkSchema.parse({ kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y });
+}
+function bytesEqual(left, right) {
+  const a = new Uint8Array(left);
+  const b = new Uint8Array(right);
+  return a.length === b.length && a.every((byte, index) => byte === b[index]);
+}
+async function importSigningKey(jwk) {
+  const subtle = keySubtle();
+  const publicJwk = publicJwkOf(jwk);
+  const privateKey = await subtle.importKey("jwk", { ...jwk, ext: false }, ECDSA_P2562, false, ["sign"]);
+  const publicKey = await subtle.importKey("jwk", publicJwk, ECDSA_P2562, true, ["verify"]);
+  const probe = randomBytes(32);
+  if (!await subtle.verify(ECDSA_SHA2562, publicKey, await subtle.sign(ECDSA_SHA2562, privateKey, probe), probe)) {
+    throw new TypeError("signing scalar does not match its public point");
+  }
+  return { publicJwk, privateKey };
+}
+async function importKemKey(jwk) {
+  const subtle = keySubtle();
+  const publicJwk = publicJwkOf(jwk);
+  const privateKey = await subtle.importKey("jwk", { ...jwk, ext: false }, ECDH_P256, false, ["deriveBits"]);
+  const publicKey = await subtle.importKey("jwk", publicJwk, ECDH_P256, true, []);
+  const probe = await subtle.generateKey(ECDH_P256, false, ["deriveBits"]);
+  const viaMember = await subtle.deriveBits({ name: "ECDH", public: probe.publicKey }, privateKey, 256);
+  const viaProbe = await subtle.deriveBits({ name: "ECDH", public: publicKey }, probe.privateKey, 256);
+  if (!bytesEqual(viaMember, viaProbe)) throw new TypeError("KEM scalar does not match its public point");
+  return { publicJwk, privateKey };
+}
+async function openMemberKeyRecord(text) {
+  const record = parseRecord(text);
+  if (record === void 0) return void 0;
+  try {
+    const signing = await importSigningKey(record.signingJwk);
+    const kem = { epoch: record.kemEpoch, ...await importKemKey(record.kemJwk) };
+    const binding = record.deviceId === void 0 ? { tenantId: record.tenantId } : { tenantId: record.tenantId, deviceId: record.deviceId };
+    if (record.nextKem === void 0) return { binding, signing, kem };
+    return { binding, signing, kem, nextKem: { epoch: record.nextKem.epoch, ...await importKemKey(record.nextKem.jwk) } };
+  } catch {
+    return void 0;
+  }
+}
+async function beginMemberKemRotation(text) {
+  const record = parseRecord(text);
+  if (record === void 0) throw invalidInput("Member key record is invalid");
+  if (record.nextKem !== void 0) return text;
+  return canonicalizeJson({ ...record, nextKem: { epoch: record.kemEpoch + 1, jwk: await generatePrivateJwk(ECDH_P256, ["deriveBits"]) } });
+}
+function finishMemberKemRotation(text, epoch) {
+  const record = parseRecord(text);
+  if (record === void 0) throw invalidInput("Member key record is invalid");
+  if (record.nextKem === void 0) return record.kemEpoch === epoch ? text : void 0;
+  if (record.nextKem.epoch !== epoch) return void 0;
+  const { nextKem, ...rest } = record;
+  return canonicalizeJson({ ...rest, kemEpoch: nextKem.epoch, kemJwk: nextKem.jwk });
+}
+function parseRecord(text) {
+  if (typeof text !== "string") return void 0;
+  try {
+    const parsed = safeParseTotal(MemberKeyRecordV1Schema, JSON.parse(text));
+    return parsed.success && canonicalizeJson(parsed.data) === text ? parsed.data : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MEMBER_FINGERPRINT_DOMAIN = "byok-member-fingerprint-v1\n";
+var FINGERPRINT_GROUPS = 5;
+var GROUP_BYTES = 5;
+var GROUP_MODULUS = 100000n;
+var FingerprintInputSchema = z.object({ tenantId: z.string().min(1), signingPublicJwk: P256PublicJwkSchema });
+async function memberFingerprint(input) {
+  return (await fingerprintGroups(input)).groups.join(" ");
+}
+async function memberApprovalCode(tenantId, first, second) {
+  const members = await Promise.all([first, second].map((signingPublicJwk) => fingerprintGroups({ tenantId, signingPublicJwk })));
+  if (members[0].memberId === members[1].memberId) throw invalidInput("An approval code needs two different members");
+  members.sort((a, b) => a.memberId < b.memberId ? -1 : 1);
+  return members.flatMap((member) => member.groups).join(" ");
+}
+async function fingerprintGroups(input) {
+  const parsed = safeParseTotal(FingerprintInputSchema, input);
+  if (!parsed.success) throw invalidInput("Member fingerprint needs a tenant id and a P-256 signing key");
+  const { tenantId, signingPublicJwk } = parsed.data;
+  const memberId = await deriveMemberId(signingPublicJwk);
+  const digest = await sha256(
+    concat2(
+      utf82(MEMBER_FINGERPRINT_DOMAIN),
+      canonicalizeJsonBytes({ v: 1, tenantId, signingKey: { x: signingPublicJwk.x, y: signingPublicJwk.y } })
+    )
+  );
+  const groups = [];
+  for (let group = 0; group < FINGERPRINT_GROUPS; group += 1) {
+    let value = 0n;
+    for (const byte of digest.subarray(group * GROUP_BYTES, (group + 1) * GROUP_BYTES)) value = value << 8n | BigInt(byte);
+    groups.push((value % GROUP_MODULUS).toString().padStart(5, "0"));
+  }
+  return { memberId, groups };
+}
+var PAIRING_VERIFICATION_SECRET_BYTES = 16;
+var PAIRING_VERIFICATION_TEXT_LENGTH = 26;
+var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+var PV_TEXT_PATTERN = /^[A-Za-z2-7]{26}$/u;
+function generatePairingVerificationSecret() {
+  return randomBytes(PAIRING_VERIFICATION_SECRET_BYTES);
+}
+function encodePairingVerificationSecret(pv) {
+  if (pv.byteLength !== PAIRING_VERIFICATION_SECRET_BYTES) {
+    throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_SECRET_BYTES} bytes`);
+  }
+  let out = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of pv) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      bits -= 5;
+      out += BASE32_ALPHABET[buffer >>> bits & 31];
+    }
+    buffer &= (1 << bits) - 1;
+  }
+  return out + BASE32_ALPHABET[buffer << 5 - bits & 31];
+}
+function decodePairingVerificationSecret(text) {
+  if (!PV_TEXT_PATTERN.test(text)) {
+    throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_TEXT_LENGTH} base32 characters`);
+  }
+  const upper = text.toUpperCase();
+  const out = new Uint8Array(PAIRING_VERIFICATION_SECRET_BYTES);
+  let buffer = 0;
+  let bits = 0;
+  let index = 0;
+  for (const char of upper) {
+    buffer = buffer << 5 | BASE32_ALPHABET.indexOf(char);
+    bits += 5;
+    if (bits >= 8) {
+      bits -= 8;
+      out[index++] = buffer >>> bits & 255;
+    }
+    buffer &= (1 << bits) - 1;
+  }
+  if (buffer !== 0) throw invalidInput("Pairing verification secret has nonzero trailing bits");
+  return out;
+}
+function formatPairingInput(pairingCode, pv) {
+  if (pairingCode.length === 0) throw invalidInput("Pairing code must not be empty");
+  return `${pairingCode}.${encodePairingVerificationSecret(pv)}`;
+}
+function parsePairingInput(text) {
+  const dot = text.lastIndexOf(".");
+  if (dot <= 0) throw invalidInput("Pairing input must be <pairing code>.<verification secret>");
+  return { pairingCode: text.slice(0, dot), pv: decodePairingVerificationSecret(text.slice(dot + 1)) };
+}
+var DEVICE_PAIRING_MAC_DOMAIN = "byok-pairing-device-mac-v1\n";
+var CLIENT_PAIRING_MAC_DOMAIN = "byok-pairing-client-mac-v1\n";
+var PairingMacSchema = base64UrlBytes(32);
+var ChainHeadSchema = z.strictObject({
+  seq: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+  hash: z.string().regex(CONTENT_HASH_PATTERN)
+});
+var DeviceMacInputSchema = z.object({ tenantId: z.string().min(1), deviceId: z.string().min(1), member: MemberKeyBundleV1Schema });
+var ClientMacInputSchema = z.object({ member: MemberKeyBundleV1Schema, chainHead: ChainHeadSchema });
+function devicePairingMacInput(input) {
+  const parsed = safeParseTotal(DeviceMacInputSchema, input);
+  if (!parsed.success || parsed.data.member.deviceId !== parsed.data.deviceId) {
+    throw invalidInput("Device pairing MAC input must name the device member's own device id");
+  }
+  const { tenantId, deviceId, member } = parsed.data;
+  return concat2(utf82(DEVICE_PAIRING_MAC_DOMAIN), canonicalizeJsonBytes({ tenantId, deviceId, member }));
+}
+function clientPairingMacInput(input) {
+  const parsed = safeParseTotal(ClientMacInputSchema, input);
+  if (!parsed.success || parsed.data.member.deviceId !== void 0) {
+    throw invalidInput("Client pairing MAC input must hold a client member and a chain head");
+  }
+  const { member, chainHead } = parsed.data;
+  return concat2(utf82(CLIENT_PAIRING_MAC_DOMAIN), canonicalizeJsonBytes({ member, chainHead: { seq: chainHead.seq, hash: chainHead.hash } }));
+}
+function checkPv(pv) {
+  if (pv.byteLength !== PAIRING_VERIFICATION_SECRET_BYTES) {
+    throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_SECRET_BYTES} bytes`);
+  }
+}
+async function computeDevicePairingMac(pv, input) {
+  checkPv(pv);
+  return encodeBase64Url(await hmacSha2562(pv, devicePairingMacInput(input)));
+}
+async function computeClientPairingMac(pv, input) {
+  checkPv(pv);
+  return encodeBase64Url(await hmacSha2562(pv, clientPairingMacInput(input)));
+}
+async function verifyDevicePairingMac(pv, input, mac) {
+  checkPv(pv);
+  return hmacVerify(pv, () => devicePairingMacInput(input), mac);
+}
+async function verifyClientPairingMac(pv, input, mac) {
+  checkPv(pv);
+  return hmacVerify(pv, () => clientPairingMacInput(input), mac);
+}
+async function hmacVerify(key, buildData, mac) {
+  const parsed = safeParseTotal(PairingMacSchema, mac);
+  if (!parsed.success) return false;
+  let data;
+  try {
+    data = buildData();
+  } catch {
+    return false;
+  }
+  const subtle = webCryptoSubtle();
+  const hmacKey = await subtle.importKey("raw", copy2(key), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+  return subtle.verify("HMAC", hmacKey, decodeBase64Url(parsed.data, "mac"), data);
+}
+var MemberIdSchema = z.string().regex(MEMBER_ID_PATTERN);
+var ScopeIdSchema = z.string().min(1);
+var AddSubjectSchema = z.strictObject({ member: z.unknown() });
+var RemoveSubjectSchema = z.strictObject({ memberId: MemberIdSchema });
+var RotateSubjectSchema = z.strictObject({
+  memberId: MemberIdSchema,
+  kemPublicJwk: P256PublicJwkSchema,
+  kemEpoch: KemEpochSchema,
+  kemSig: KemSigSchema
+});
+var ScopePolicySubjectSchema = z.strictObject({
+  scopeId: ScopeIdSchema,
+  categories: z.array(z.enum(SEALED_CATEGORIES)).min(1),
+  members: z.array(MemberIdSchema).min(1)
+});
+var ShredSubjectSchema = z.strictObject({ scopeId: ScopeIdSchema });
+var SignerSchema = z.object({ signer: MemberIdSchema });
+var GenesisSchema = z.object({ op: z.literal("add"), subject: AddSubjectSchema });
+var HeadSchema = z.object({ seq: z.number(), hash: z.string() });
+var EntriesSchema = z.array(z.unknown());
+var AnchorInputSchema = z.object({
+  tenantId: z.string(),
+  entries: EntriesSchema,
+  self: z.unknown(),
+  approverSigningPublicJwk: P256PublicJwkSchema,
+  authenticatedHead: z.unknown().optional()
+});
+function emptyMemberChainState(tenantId) {
+  return { tenantId, head: null, members: /* @__PURE__ */ new Map(), removed: /* @__PURE__ */ new Set(), scopes: /* @__PURE__ */ new Map(), shredded: /* @__PURE__ */ new Set() };
+}
+function memberChainScopeRecipients(state, scopeId) {
+  const scope = state.scopes.get(scopeId);
+  if (scope === void 0) return [];
+  return scope.members.flatMap((memberId) => {
+    const member = state.members.get(memberId);
+    return member === void 0 ? [] : [member];
+  });
+}
+async function applyMemberChainEntries(state, entries) {
+  const list = safeParseTotal(EntriesSchema, entries);
+  if (!list.success) return { ok: false, reason: "member_chain_entry_invalid", index: 0 };
+  const result = await walk(state, list.data, () => false);
+  return result.ok ? { ok: true, state: result.state } : result;
+}
+async function genesisSigner(state, raw, signer) {
+  if (state.head !== null || state.members.size > 0) return void 0;
+  const entry = safeParseTotal(GenesisSchema, raw);
+  const member = entry.success ? await parseMemberKeyBundle(entry.data.subject.member) : void 0;
+  return member !== void 0 && member.memberId === signer ? member : void 0;
+}
+async function walk(state, entries, mark) {
+  const next = {
+    tenantId: state.tenantId,
+    head: state.head,
+    members: new Map(state.members),
+    removed: new Set(state.removed),
+    scopes: new Map(state.scopes),
+    shredded: new Set(state.shredded)
+  };
+  let marked;
+  for (const [index, raw] of entries.entries()) {
+    const signer = safeParseTotal(SignerSchema, raw);
+    if (!signer.success) return { ok: false, reason: "member_chain_entry_invalid", index };
+    const signerBundle = next.members.get(signer.data.signer) ?? await genesisSigner(next, raw, signer.data.signer);
+    if (signerBundle === void 0) return { ok: false, reason: "member_chain_signer_invalid", index };
+    const verified = await verifyMemberChainEntry(raw, signerBundle.signingPublicJwk);
+    if (!verified.ok) return { ok: false, reason: verified.reason, index };
+    const entry = verified.entry;
+    const expected = next.head === null ? { seq: 1, prev: null } : { seq: next.head.seq + 1, prev: next.head.hash };
+    if (entry.tenantId !== next.tenantId || entry.seq !== expected.seq || entry.prev !== expected.prev) {
+      return { ok: false, reason: "member_chain_link_invalid", index };
+    }
+    if (marked === void 0 && mark(entry, signerBundle.signingPublicJwk)) marked = { index, seq: entry.seq, hash: verified.hash };
+    const applied = await applySubject(next, entry);
+    if (applied !== true) return { ok: false, reason: applied === false ? "member_chain_subject_invalid" : applied, index };
+    next.head = { seq: entry.seq, hash: verified.hash };
+  }
+  return { ok: true, state: next, marked };
+}
+async function applySubject(state, entry) {
+  switch (entry.op) {
+    case "add": {
+      const subject = safeParseTotal(AddSubjectSchema, entry.subject);
+      const member = subject.success ? await parseMemberKeyBundle(subject.data.member) : void 0;
+      if (member === void 0 || state.members.has(member.memberId) || state.removed.has(member.memberId)) return false;
+      state.members.set(member.memberId, member);
+      return true;
+    }
+    case "remove": {
+      const subject = safeParseTotal(RemoveSubjectSchema, entry.subject);
+      if (!subject.success || !state.members.has(subject.data.memberId) || state.members.size === 1) return false;
+      state.members.delete(subject.data.memberId);
+      state.removed.add(subject.data.memberId);
+      return true;
+    }
+    case "rotate": {
+      const subject = safeParseTotal(RotateSubjectSchema, entry.subject);
+      if (!subject.success || subject.data.memberId !== entry.signer) return false;
+      const member = state.members.get(subject.data.memberId);
+      if (member === void 0 || subject.data.kemEpoch !== member.kemEpoch + 1) return false;
+      const { kemPublicJwk } = subject.data;
+      if (kemPublicJwk.x === member.kemPublicJwk.x && kemPublicJwk.y === member.kemPublicJwk.y) return false;
+      if (!await verifyMemberKem(member, subject.data)) return false;
+      state.members.set(member.memberId, {
+        ...member,
+        kemPublicJwk: subject.data.kemPublicJwk,
+        kemEpoch: subject.data.kemEpoch,
+        kemSig: subject.data.kemSig
+      });
+      return true;
+    }
+    case "scope-policy": {
+      const subject = safeParseTotal(ScopePolicySubjectSchema, entry.subject);
+      if (!subject.success || state.shredded.has(subject.data.scopeId)) return false;
+      const { categories, members } = subject.data;
+      if (!strictlyIncreasing(categories.map((category) => SEALED_CATEGORIES.indexOf(category)))) return false;
+      if (!strictlyIncreasing(members) || !members.every((memberId) => state.members.has(memberId))) return false;
+      if (!(state.scopes.get(subject.data.scopeId)?.members ?? members).includes(entry.signer)) return "member_chain_signer_invalid";
+      state.scopes.set(subject.data.scopeId, { categories, members, policySeq: entry.seq });
+      return true;
+    }
+    case "shred": {
+      const subject = safeParseTotal(ShredSubjectSchema, entry.subject);
+      if (!subject.success) return false;
+      const scope = state.scopes.get(subject.data.scopeId);
+      if (scope === void 0) return false;
+      if (!scope.members.includes(entry.signer)) return "member_chain_signer_invalid";
+      state.scopes.delete(subject.data.scopeId);
+      state.shredded.add(subject.data.scopeId);
+      return true;
+    }
+  }
+}
+function strictlyIncreasing(values) {
+  return values.every((value, index) => index === 0 || values[index - 1] < value);
+}
+async function verifyMemberChainFromAnchor(input) {
+  const parsed = safeParseTotal(AnchorInputSchema, input);
+  if (!parsed.success) return { ok: false, reason: "member_chain_anchor_missing" };
+  const { tenantId, entries, self, approverSigningPublicJwk: approver, authenticatedHead } = parsed.data;
+  let approverId;
+  let selfText;
+  try {
+    approverId = await deriveMemberId(approver);
+    selfText = canonicalizeJson(self);
+  } catch {
+    return { ok: false, reason: "member_chain_anchor_missing" };
+  }
+  const isAnchor = (entry, signerKey) => {
+    if (entry.op !== "add" || entry.signer !== approverId || signerKey.x !== approver.x || signerKey.y !== approver.y) return false;
+    try {
+      return canonicalizeJson(entry.subject.member) === selfText;
+    } catch {
+      return false;
+    }
+  };
+  const outcome = await walk(emptyMemberChainState(tenantId), entries, isAnchor);
+  if (!outcome.ok) return outcome;
+  const anchor = outcome.marked;
+  if (anchor === void 0) return { ok: false, reason: "member_chain_anchor_missing" };
+  if (authenticatedHead !== void 0) {
+    const head = safeParseTotal(HeadSchema, authenticatedHead);
+    if (!head.success || head.data.seq !== anchor.seq || head.data.hash !== anchor.hash) {
+      return { ok: false, reason: "member_chain_head_mismatch", index: anchor.index };
+    }
+  }
+  return { ok: true, state: outcome.state, anchorSeq: anchor.seq };
+}
 
-export { MEMBER_CHAIN_OPS, SEALED_CATEGORIES, SEALED_CONTENT_SUITE, SEALED_CONTENT_VERSION, SEALED_DIRECTIONS, SealedContentHeaderV1Schema, deriveMemberId, deriveScopeKeyId, generateScopeKey, memberChainEntryHash, openScopeKeyPackage, openSealedContent, sealContent, sealScopeKeyPackage, signMemberChainEntry, verifyMemberChainEntry };
+export { CLIENT_PAIRING_MAC_DOMAIN, DEVICE_PAIRING_MAC_DOMAIN, MEMBER_CHAIN_OPS, MEMBER_FINGERPRINT_DOMAIN, MEMBER_KEY_BUNDLE_VERSION, PAIRING_VERIFICATION_SECRET_BYTES, SEALED_CATEGORIES, SEALED_CONTENT_SUITE, SEALED_CONTENT_VERSION, SEALED_DIRECTIONS, SealedContentHeaderV1Schema, applyMemberChainEntries, beginMemberKemRotation, computeClientPairingMac, computeDevicePairingMac, createMemberKeyBundle, decodePairingVerificationSecret, deriveMemberId, deriveScopeKeyId, emptyMemberChainState, encodePairingVerificationSecret, finishMemberKemRotation, formatPairingInput, generateMemberKeyRecord, generatePairingVerificationSecret, generateScopeKey, memberApprovalCode, memberChainEntryHash, memberChainScopeRecipients, memberFingerprint, openMemberKeyRecord, openScopeKeyPackage, openSealedContent, parseMemberKeyBundle, parsePairingInput, sealContent, sealScopeKeyPackage, signMemberChainEntry, verifyClientPairingMac, verifyDevicePairingMac, verifyMemberChainEntry, verifyMemberChainFromAnchor, verifyMemberKem };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map