@byok-sdk/core 0.30.0 → 0.30.1

package/dist/sealed-payload/member-key-record.d.ts

@@ -0,0 +1,61 @@
+import { type WebCryptoKey } from '../webcrypto';
+import { type P256PublicJwk } from './primitives';
+export declare const MEMBER_KEY_RECORD_VERSION = 1;
+/**
+ * Whose keys a store holds. A device member's binding names its SDK device
+ * id; a client member's has none, as in its bundle.
+ */
+export interface MemberKeyBinding {
+    readonly tenantId: string;
+    readonly deviceId?: string;
+}
+export interface MemberKeys {
+    readonly binding: MemberKeyBinding;
+    /** Signs chain entries and key packages. The private key is not extractable. */
+    readonly signing: {
+        readonly publicJwk: P256PublicJwk;
+        readonly privateKey: WebCryptoKey;
+    };
+    /** Opens key packages. The private key is not extractable. `epoch` starts at 1. */
+    readonly kem: MemberKemKey;
+    /** The KEM key of a rotation that has begun and not finished, at `kem.epoch + 1`. */
+    readonly nextKem?: MemberKemKey;
+}
+export interface MemberKemKey {
+    readonly epoch: number;
+    readonly publicJwk: P256PublicJwk;
+    readonly privateKey: WebCryptoKey;
+}
+/** The custody port of one member's keys. Each store expects one writer. */
+export interface MemberKeyStore {
+    /** The keys bound to `binding`, or `undefined` when the store holds none for it. A malformed record throws. */
+    load(binding: MemberKeyBinding): Promise<MemberKeys | undefined>;
+    /** The keys bound to `binding`. A store that holds none for it creates new ones, which replace any other binding's keys. */
+    loadOrCreate(binding: MemberKeyBinding): Promise<MemberKeys>;
+}
+/**
+ * A new member's record for `binding`: a fresh signing key and a fresh KEM
+ * key at epoch 1, as one canonical JSON text. The text holds both private
+ * scalars; only the member's own custody stores it.
+ */
+export declare function generateMemberKeyRecord(binding: MemberKeyBinding): Promise<string>;
+/**
+ * The keys of a stored record, imported non-extractable, or `undefined` when
+ * the text is not a canonical v1 record, or a private scalar does not match
+ * its public point. Never throws for hostile input.
+ */
+export declare function openMemberKeyRecord(text: unknown): Promise<MemberKeys | undefined>;
+/**
+ * Begin a KEM rotation: the record with a new KEM key at `kemEpoch + 1`
+ * beside the current one. A record whose rotation has begun comes back
+ * unchanged, so a resumed rotation keeps its key. A record that is not
+ * canonical v1 text throws.
+ */
+export declare function beginMemberKemRotation(text: string): Promise<string>;
+/**
+ * Finish the KEM rotation to `epoch`: the next key becomes current, and the
+ * old private key is gone from the record. A repeat after the rotation
+ * finished comes back unchanged. Any other `epoch` returns `undefined`. A
+ * record that is not canonical v1 text throws.
+ */
+export declare function finishMemberKemRotation(text: string, epoch: number): string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/core",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "BYOK SDK platform contracts: branded tenant identity, tenant-first store ports, device proof canonicalization, and the composition conformance reference",
   "type": "module",
   "license": "MIT",