@byok-sdk/core 0.30.2 → 0.32.0

package/dist/sealed-payload/index.js

@@ -1,1585 +1,10 @@
 import { z } from 'zod';
 import { ByokCoreError } from '@byok-sdk/core';
 
-// src/sealed-payload/sealed-content.ts
-var CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
-var DEVICE_PROOF_SCHEMA_ID = "byok-device-proof-v1";
-var DEVICE_PROOF_VERSION = 1;
-var DEVICE_PROOF_ALGORITHMS = ["ed25519"];
-var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
-var HTTP_METHOD_PATTERN = /^[A-Z]+$/;
-function canonicalizationFailure(path, reason) {
-  return new ByokCoreError(
-    "proof_canonicalization_failed",
-    `Cannot canonicalize ${path}: ${reason}`
-  );
-}
-function isPlainObject(value) {
-  const prototype = Object.getPrototypeOf(value);
-  return prototype === Object.prototype || prototype === null;
-}
-function canonicalizeValue(value, path, seen) {
-  if (value === null) return "null";
-  switch (typeof value) {
-    case "boolean":
-      return value ? "true" : "false";
-    case "string":
-      return JSON.stringify(value);
-    case "number": {
-      if (!Number.isSafeInteger(value)) {
-        throw canonicalizationFailure(
-          path,
-          `only safe integers are canonicalizable, received ${String(value)}`
-        );
-      }
-      return String(value === 0 ? 0 : value);
-    }
-    case "undefined":
-      throw canonicalizationFailure(path, "undefined has no canonical form");
-    case "bigint":
-      throw canonicalizationFailure(path, "bigint is not a JSON type");
-    case "function":
-    case "symbol":
-      throw canonicalizationFailure(path, `${typeof value} is not a JSON type`);
-    case "object":
-      break;
-    default:
-      throw canonicalizationFailure(path, `unsupported type ${typeof value}`);
-  }
-  const objectValue = value;
-  if (seen.has(objectValue)) {
-    throw canonicalizationFailure(path, "circular reference");
-  }
-  seen.add(objectValue);
-  try {
-    if (Array.isArray(objectValue)) {
-      const parts2 = objectValue.map(
-        (entry, index) => canonicalizeValue(entry, `${path}[${index}]`, seen)
-      );
-      return `[${parts2.join(",")}]`;
-    }
-    if (!isPlainObject(objectValue)) {
-      throw canonicalizationFailure(
-        path,
-        "only plain objects and arrays are canonicalizable"
-      );
-    }
-    const keys = Object.keys(objectValue).sort();
-    const record = objectValue;
-    const parts = keys.map((key) => {
-      const encodedKey = JSON.stringify(key);
-      const encodedValue = canonicalizeValue(record[key], `${path}.${key}`, seen);
-      return `${encodedKey}:${encodedValue}`;
-    });
-    return `{${parts.join(",")}}`;
-  } finally {
-    seen.delete(objectValue);
-  }
-}
-function canonicalizeJson(value) {
-  return canonicalizeValue(value, "<root>", /* @__PURE__ */ new Set());
-}
-function canonicalizeJsonBytes(value) {
-  return new TextEncoder().encode(canonicalizeJson(value));
-}
-var DeviceProofProtectedClaimsSchema = z.strictObject({
-  version: z.literal(DEVICE_PROOF_VERSION),
-  tenantId: z.string().min(1),
-  productId: z.string().min(1),
-  deviceId: z.string().min(1),
-  /** Identity of the signing key, resolved against the device row at verify time. */
-  keyId: z.string().min(1),
-  /** Rotation generation. An older epoch is rejected by the verifier, not here. */
-  keyEpoch: z.number().int().nonnegative(),
-  /** Idempotency key: exact replay returns the original result, reuse with a different body is a conflict. */
-  requestId: z.string().min(1),
-  /** Logical operation, e.g. `truth.write`. */
-  operation: z.string().min(1),
-  /** Tenant-scoped resource the operation targets. */
-  resource: z.string().min(1),
-  method: z.string().regex(HTTP_METHOD_PATTERN).optional(),
-  path: z.string().startsWith("/").optional(),
-  operationId: z.string().min(1).optional(),
-  bodySha256: z.string().regex(CONTENT_HASH_PATTERN),
-  /** Bound alongside the hash so a truncation attack cannot hide behind a hash collision claim. */
-  bodySize: z.number().int().nonnegative(),
-  issuedAt: z.iso.datetime(),
-  expiresAt: z.iso.datetime().optional(),
-  nonce: z.string().min(1).optional()
-}).superRefine((claims, ctx) => {
-  const hasRequestLine = claims.method !== void 0 && claims.path !== void 0;
-  const hasOperationId = claims.operationId !== void 0;
-  if (hasRequestLine === hasOperationId) {
-    ctx.addIssue({
-      code: "custom",
-      message: "Claims must carry exactly one request binding: both `method` and `path`, or `operationId`."
-    });
-  }
-  if (!hasRequestLine && (claims.method !== void 0 || claims.path !== void 0)) {
-    ctx.addIssue({
-      code: "custom",
-      message: "`method` and `path` must be supplied together."
-    });
-  }
-});
-z.strictObject({
-  schema: z.literal(DEVICE_PROOF_SCHEMA_ID),
-  algorithm: z.enum(DEVICE_PROOF_ALGORITHMS),
-  protected: DeviceProofProtectedClaimsSchema,
-  /** base64url, unpadded. */
-  signature: z.string().regex(BASE64URL_PATTERN)
-});
-var CANONICAL_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
-function isCanonicalTimestamp(value) {
-  if (typeof value !== "string") return false;
-  if (!CANONICAL_TIMESTAMP_PATTERN.test(value)) return false;
-  const parsed = Date.parse(value);
-  if (!Number.isFinite(parsed)) return false;
-  return new Date(parsed).toISOString() === value;
-}
-
-// src/total-parse.ts
-function safeParseTotal(schema, value) {
-  try {
-    return schema.safeParse(value);
-  } catch {
-    return { success: false };
-  }
-}
-function webCryptoSubtle() {
-  const subtle = globalThis.crypto?.subtle;
-  if (subtle === void 0) {
-    throw new ByokCoreError("webcrypto_unavailable", "WebCrypto subtle is unavailable in this runtime");
-  }
-  return subtle;
-}
-var KEM_ID = 16;
-var KDF_ID = 1;
-var AEAD_ID = 1;
-var HPKE_P256_PUBLIC_KEY_BYTES = 65;
-var N_SECRET = 32;
-var N_K = 16;
-var N_N = 12;
-var N_H = 32;
-var HPKE_AEAD_TAG_BYTES = 16;
-var MODE_BASE = 0;
-var HPKE_V1 = utf8("HPKE-v1");
-var KEM_SUITE_ID = concat(utf8("KEM"), i2osp(KEM_ID, 2));
-var HPKE_SUITE_ID = concat(utf8("HPKE"), i2osp(KEM_ID, 2), i2osp(KDF_ID, 2), i2osp(AEAD_ID, 2));
-var EMPTY = new Uint8Array(0);
-var ZERO_SALT = new Uint8Array(N_H);
-function utf8(value) {
-  return new TextEncoder().encode(value);
-}
-function concat(...parts) {
-  const length = parts.reduce((total, part) => total + part.byteLength, 0);
-  const out = new Uint8Array(length);
-  let offset = 0;
-  for (const part of parts) {
-    out.set(part, offset);
-    offset += part.byteLength;
-  }
-  return out;
-}
-function i2osp(value, length) {
-  if (!Number.isSafeInteger(value) || value < 0) {
-    throw new ByokCoreError("sealed_secret_invalid", "HPKE integer encoding requires a non-negative safe integer");
-  }
-  const out = new Uint8Array(length);
-  let remaining = value;
-  for (let index = length - 1; index >= 0; index -= 1) {
-    out[index] = remaining % 256;
-    remaining = Math.floor(remaining / 256);
-  }
-  if (remaining !== 0) {
-    throw new ByokCoreError("sealed_secret_invalid", "HPKE integer does not fit the requested width");
-  }
-  return out;
-}
-function copy(bytes) {
-  return new Uint8Array(bytes);
-}
-async function hmacSha256(key, data) {
-  const subtle = webCryptoSubtle();
-  const hmacKey = await subtle.importKey("raw", copy(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  return new Uint8Array(await subtle.sign("HMAC", hmacKey, copy(data)));
-}
-async function hkdfExpand(prk, info, length) {
-  if (length > 255 * N_H) {
-    throw new ByokCoreError("sealed_secret_invalid", "HKDF output length exceeds its limit");
-  }
-  const out = new Uint8Array(length);
-  let previous = EMPTY;
-  let offset = 0;
-  for (let counter = 1; offset < length; counter += 1) {
-    previous = await hmacSha256(prk, concat(previous, info, Uint8Array.of(counter)));
-    const take = Math.min(previous.byteLength, length - offset);
-    out.set(previous.subarray(0, take), offset);
-    offset += take;
-  }
-  return out;
-}
-async function labeledExtract(suiteId, salt, label, ikm) {
-  return hmacSha256(salt.byteLength === 0 ? ZERO_SALT : salt, concat(HPKE_V1, suiteId, utf8(label), ikm));
-}
-async function labeledExpand(suiteId, prk, label, info, length) {
-  return hkdfExpand(prk, concat(i2osp(length, 2), HPKE_V1, suiteId, utf8(label), info), length);
-}
-async function importP256PublicKey(raw) {
-  if (raw.byteLength !== HPKE_P256_PUBLIC_KEY_BYTES || raw[0] !== 4) {
-    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key must be a 65-byte uncompressed point");
-  }
-  try {
-    return await webCryptoSubtle().importKey("raw", copy(raw), { name: "ECDH", namedCurve: "P-256" }, true, []);
-  } catch (cause) {
-    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key is not a valid curve point", { cause });
-  }
-}
-async function ecdhP256(privateKey, publicKey) {
-  const bits = await webCryptoSubtle().deriveBits({ name: "ECDH", public: publicKey }, privateKey, N_SECRET * 8);
-  return new Uint8Array(bits);
-}
-async function extractAndExpand(dh, kemContext) {
-  const eaePrk = await labeledExtract(KEM_SUITE_ID, EMPTY, "eae_prk", dh);
-  return labeledExpand(KEM_SUITE_ID, eaePrk, "shared_secret", kemContext, N_SECRET);
-}
-async function keyScheduleBase(sharedSecret, info) {
-  const pskIdHash = await labeledExtract(HPKE_SUITE_ID, EMPTY, "psk_id_hash", EMPTY);
-  const infoHash = await labeledExtract(HPKE_SUITE_ID, EMPTY, "info_hash", info);
-  const context = concat(Uint8Array.of(MODE_BASE), pskIdHash, infoHash);
-  const secret = await labeledExtract(HPKE_SUITE_ID, sharedSecret, "secret", EMPTY);
-  return {
-    sharedSecret,
-    key: await labeledExpand(HPKE_SUITE_ID, secret, "key", context, N_K),
-    baseNonce: await labeledExpand(HPKE_SUITE_ID, secret, "base_nonce", context, N_N),
-    exporterSecret: await labeledExpand(HPKE_SUITE_ID, secret, "exp", context, N_H)
-  };
-}
-async function setupBaseSender(recipientPublicKey, info, ephemeral) {
-  const pkR = await importP256PublicKey(recipientPublicKey);
-  let pair = ephemeral;
-  if (pair === void 0) {
-    const subtle = webCryptoSubtle();
-    const generated = await subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveBits"]);
-    pair = {
-      privateKey: generated.privateKey,
-      publicKey: new Uint8Array(await subtle.exportKey("raw", generated.publicKey))
-    };
-  }
-  const enc = copy(pair.publicKey);
-  const dh = await ecdhP256(pair.privateKey, pkR);
-  const sharedSecret = await extractAndExpand(dh, concat(enc, recipientPublicKey));
-  return { enc, schedule: await keyScheduleBase(sharedSecret, info) };
-}
-async function setupBaseRecipient(enc, recipientPrivateKey, recipientPublicKey, info) {
-  if (recipientPublicKey.byteLength !== HPKE_P256_PUBLIC_KEY_BYTES || recipientPublicKey[0] !== 4) {
-    throw new ByokCoreError("sealed_secret_invalid", "P-256 recipient public key must be a 65-byte uncompressed point");
-  }
-  const pkE = await importP256PublicKey(enc);
-  let dh;
-  try {
-    dh = await ecdhP256(recipientPrivateKey, pkE);
-  } catch (cause) {
-    throw new ByokCoreError("sealed_secret_open_failed", "HPKE decapsulation failed", { cause });
-  }
-  const sharedSecret = await extractAndExpand(dh, concat(enc, recipientPublicKey));
-  return keyScheduleBase(sharedSecret, info);
-}
-function hpkeNonce(baseNonce, sequence) {
-  const seq = i2osp(sequence, N_N);
-  const out = new Uint8Array(N_N);
-  for (let index = 0; index < N_N; index += 1) out[index] = baseNonce[index] ^ seq[index];
-  return out;
-}
-async function aesGcmKey(key, usage) {
-  return webCryptoSubtle().importKey("raw", copy(key), { name: "AES-GCM" }, false, [usage]);
-}
-async function hpkeAeadSeal(schedule, sequence, aad, plaintext) {
-  const ciphertext = await webCryptoSubtle().encrypt(
-    { name: "AES-GCM", iv: hpkeNonce(schedule.baseNonce, sequence), additionalData: copy(aad), tagLength: 128 },
-    await aesGcmKey(schedule.key, "encrypt"),
-    copy(plaintext)
-  );
-  return new Uint8Array(ciphertext);
-}
-async function hpkeAeadOpen(schedule, sequence, aad, ciphertext) {
-  if (ciphertext.byteLength < HPKE_AEAD_TAG_BYTES) {
-    throw new ByokCoreError("sealed_secret_invalid", "HPKE ciphertext is shorter than its authentication tag");
-  }
-  try {
-    const plaintext = await webCryptoSubtle().decrypt(
-      { name: "AES-GCM", iv: hpkeNonce(schedule.baseNonce, sequence), additionalData: copy(aad), tagLength: 128 },
-      await aesGcmKey(schedule.key, "decrypt"),
-      copy(ciphertext)
-    );
-    return new Uint8Array(plaintext);
-  } catch (cause) {
-    throw new ByokCoreError("sealed_secret_open_failed", "HPKE ciphertext failed authentication", { cause });
-  }
-}
-async function hpkeSealBase(input) {
-  const { enc, schedule } = await setupBaseSender(input.recipientPublicKey, input.info);
-  return { enc, ciphertext: await hpkeAeadSeal(schedule, 0, input.aad, input.plaintext) };
-}
-async function hpkeOpenBase(input) {
-  const schedule = await setupBaseRecipient(input.enc, input.recipientPrivateKey, input.recipientPublicKey, input.info);
-  return hpkeAeadOpen(schedule, 0, input.aad, input.ciphertext);
-}
-
-// src/sealed-provider-secret.ts
-var PROVIDER_SECRET_HPKE_SUITE = "hpke-base.dhkem-p256-hkdf-sha256.hkdf-sha256.aes-128-gcm";
-var PROVIDER_PROVISIONING_REQUEST_VERSION = 1;
-var PROVIDER_PROVISIONING_OPERATIONS = ["configure", "update_model", "replace_secret", "delete"];
-var PROVIDER_PROVISIONING_SECRET_OPERATIONS = ["configure", "replace_secret"];
-var PROVIDER_SECRET_MAX_PADDED_BYTES = 4096;
-var SEALING_KEY_ID_LENGTH = 22;
-var B64URL_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
-var B64URL_PATTERN = /^[A-Za-z0-9_-]*$/;
-function encodeBase64Url(bytes) {
-  let out = "";
-  let index = 0;
-  for (; index + 3 <= bytes.length; index += 3) {
-    const value = bytes[index] << 16 | bytes[index + 1] << 8 | bytes[index + 2];
-    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63] + B64URL_ALPHABET[value >> 6 & 63] + B64URL_ALPHABET[value & 63];
-  }
-  const rest = bytes.length - index;
-  if (rest === 1) {
-    const value = bytes[index] << 16;
-    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63];
-  } else if (rest === 2) {
-    const value = bytes[index] << 16 | bytes[index + 1] << 8;
-    out += B64URL_ALPHABET[value >> 18 & 63] + B64URL_ALPHABET[value >> 12 & 63] + B64URL_ALPHABET[value >> 6 & 63];
-  }
-  return out;
-}
-function decodeBase64Url(value, field) {
-  if (!B64URL_PATTERN.test(value) || value.length % 4 === 1) {
-    throw new ByokCoreError("sealed_secret_invalid", `${field} is not canonical base64url`);
-  }
-  const out = new Uint8Array(Math.floor(value.length * 3 / 4));
-  let buffer = 0;
-  let bits = 0;
-  let offset = 0;
-  for (const char of value) {
-    buffer = buffer << 6 | B64URL_ALPHABET.indexOf(char);
-    bits += 6;
-    if (bits >= 8) {
-      bits -= 8;
-      out[offset] = buffer >> bits & 255;
-      offset += 1;
-    }
-  }
-  if (encodeBase64Url(out) !== value) {
-    throw new ByokCoreError("sealed_secret_invalid", `${field} is not canonical base64url`);
-  }
-  return out;
-}
-function base64UrlField(bytes) {
-  return z.string().superRefine((value, ctx) => {
-    try {
-      const decoded = decodeBase64Url(value, "field");
-      if (bytes.exact !== void 0 && decoded.byteLength !== bytes.exact) {
-        ctx.addIssue({ code: "custom", message: `must decode to exactly ${bytes.exact} bytes` });
-      }
-      if (bytes.max !== void 0 && decoded.byteLength > bytes.max) {
-        ctx.addIssue({ code: "custom", message: `must decode to at most ${bytes.max} bytes` });
-      }
-    } catch {
-      ctx.addIssue({ code: "custom", message: "must be canonical unpadded base64url" });
-    }
-  });
-}
-var SealingPublicJwkSchema = z.strictObject({
-  kty: z.literal("EC"),
-  crv: z.literal("P-256"),
-  x: base64UrlField({ exact: 32 }),
-  y: base64UrlField({ exact: 32 })
-});
-var SealingKeyIdSchema = z.string().regex(new RegExp(`^[A-Za-z0-9_-]{${SEALING_KEY_ID_LENGTH}}$`));
-function parseSealingPublicJwk(input) {
-  const result = safeParseTotal(SealingPublicJwkSchema, input);
-  if (!result.success) {
-    throw new ByokCoreError("sealed_secret_invalid", "Sealing public key must be a strict P-256 EC public JWK");
-  }
-  return result.data;
-}
-function sealingPublicKeyBytes(publicJwk) {
-  const jwk = parseSealingPublicJwk(publicJwk);
-  const raw = new Uint8Array(HPKE_P256_PUBLIC_KEY_BYTES);
-  raw[0] = 4;
-  raw.set(decodeBase64Url(jwk.x, "x"), 1);
-  raw.set(decodeBase64Url(jwk.y, "y"), 33);
-  return raw;
-}
-z.strictObject({
-  version: z.literal(1),
-  keyId: SealingKeyIdSchema,
-  epoch: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  publicJwk: SealingPublicJwkSchema
-});
-var OpaqueIdSchema = z.string().min(1).max(200).superRefine((value, ctx) => {
-  if (value.trim() !== value || /[\u0000-\u001f\u007f]/u.test(value)) {
-    ctx.addIssue({ code: "custom", message: "must not carry surrounding whitespace or control characters" });
-  }
-});
-var CanonicalTimestampSchema = z.string().refine(isCanonicalTimestamp, "must be a canonical ISO-8601 UTC instant");
-var ProfileRefSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);
-var ProviderKindSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);
-var ModelIdSchema = z.string().min(1).max(160).refine((value) => value.trim() === value && !/[\u0000-\u001f\u007f]/u.test(value), "model id is invalid");
-var CapabilitySchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u);
-var PiModelJsonSchema = z.custom((value) => {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  try {
-    canonicalizeJson(value);
-    return true;
-  } catch {
-    return false;
-  }
-}, "piModel must be a canonical JSON object");
-var ModelConfigFields = {
-  agentId: OpaqueIdSchema,
-  providerKind: ProviderKindSchema,
-  modelId: ModelIdSchema,
-  piModel: PiModelJsonSchema,
-  capabilities: z.array(CapabilitySchema).max(8).refine((values) => new Set(values).size === values.length, "capabilities must be unique")
-};
-var ProviderProvisioningConfigV1Schema = z.discriminatedUnion("operation", [
-  z.strictObject({ operation: z.literal("configure"), ...ModelConfigFields }),
-  z.strictObject({ operation: z.literal("update_model"), ...ModelConfigFields }),
-  z.strictObject({ operation: z.literal("replace_secret"), agentId: OpaqueIdSchema, providerKind: ProviderKindSchema }),
-  z.strictObject({ operation: z.literal("delete"), agentId: OpaqueIdSchema })
-]);
-var ProviderProvisioningExpectedProfileSchema = z.union([
-  z.null(),
-  z.strictObject({
-    profileRef: ProfileRefSchema,
-    profileRevision: z.string().regex(/^(?:0|[1-9][0-9]{0,19})$/u),
-    profileHash: z.string().regex(CONTENT_HASH_PATTERN)
-  })
-]);
-var ProviderProvisioningIdentityRevisionSchema = z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u);
-var ProviderProvisioningHeaderV1Schema = z.strictObject({
-  tenantId: OpaqueIdSchema,
-  deviceId: OpaqueIdSchema,
-  agentId: OpaqueIdSchema,
-  requestId: OpaqueIdSchema,
-  operation: z.enum(PROVIDER_PROVISIONING_OPERATIONS),
-  /** Non-secret, strictly increasing per bot (A3); a device rejects anything not above its high-watermark. */
-  operationGeneration: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  expectedProfile: ProviderProvisioningExpectedProfileSchema,
-  /** The device enrollment revision the Host authorized against (F2). */
-  expectedEnrollmentRevision: ProviderProvisioningIdentityRevisionSchema,
-  /** The agent placement revision the Host authorized against (F2). */
-  expectedPlacementRevision: ProviderProvisioningIdentityRevisionSchema,
-  configDigest: z.string().regex(CONTENT_HASH_PATTERN),
-  issuedAt: CanonicalTimestampSchema,
-  expiresAt: CanonicalTimestampSchema
-});
-var MAX_CIPHERTEXT_BYTES = PROVIDER_SECRET_MAX_PADDED_BYTES + HPKE_AEAD_TAG_BYTES;
-var SealedProviderSecretV1Schema = z.strictObject({
-  suite: z.literal(PROVIDER_SECRET_HPKE_SUITE),
-  keyId: SealingKeyIdSchema,
-  enc: base64UrlField({ exact: HPKE_P256_PUBLIC_KEY_BYTES }),
-  ciphertext: base64UrlField({ max: MAX_CIPHERTEXT_BYTES })
-});
-function isSecretOperation(operation) {
-  return PROVIDER_PROVISIONING_SECRET_OPERATIONS.includes(operation);
-}
-z.strictObject({
-  version: z.literal(PROVIDER_PROVISIONING_REQUEST_VERSION),
-  header: ProviderProvisioningHeaderV1Schema,
-  config: ProviderProvisioningConfigV1Schema,
-  sealed: SealedProviderSecretV1Schema.optional()
-}).superRefine((request, ctx) => {
-  if (request.header.operation !== request.config.operation) {
-    ctx.addIssue({ code: "custom", path: ["config", "operation"], message: "config operation must equal header operation" });
-  }
-  if (request.header.agentId !== request.config.agentId) {
-    ctx.addIssue({ code: "custom", path: ["config", "agentId"], message: "config agentId must equal header agentId" });
-  }
-  if (isSecretOperation(request.header.operation) !== (request.sealed !== void 0)) {
-    ctx.addIssue({ code: "custom", path: ["sealed"], message: "a sealed secret is required exactly for configure and replace_secret" });
-  }
-});
-
-// src/sealed-payload/primitives.ts
-var P256PublicJwkSchema = SealingPublicJwkSchema;
-var ECDSA_P256_SIGNATURE_BYTES = 64;
-function invalidInput(message) {
-  return new ByokCoreError("sealed_secret_invalid", message);
-}
-function utf82(value) {
-  return new TextEncoder().encode(value);
-}
-function copy2(bytes) {
-  return new Uint8Array(bytes);
-}
-function concat2(...parts) {
-  const out = new Uint8Array(parts.reduce((total, part) => total + part.byteLength, 0));
-  let offset = 0;
-  for (const part of parts) {
-    out.set(part, offset);
-    offset += part.byteLength;
-  }
-  return out;
-}
-function hex(bytes) {
-  let out = "";
-  for (const byte of bytes) out += byte.toString(16).padStart(2, "0");
-  return out;
-}
-function randomBytes(length) {
-  const source = globalThis.crypto;
-  if (source?.getRandomValues === void 0) {
-    throw new ByokCoreError("webcrypto_unavailable", "WebCrypto getRandomValues is unavailable in this runtime");
-  }
-  return source.getRandomValues(new Uint8Array(length));
-}
-async function sha256(bytes) {
-  return new Uint8Array(await webCryptoSubtle().digest("SHA-256", copy2(bytes)));
-}
-async function hmacSha2562(key, data) {
-  const subtle = webCryptoSubtle();
-  const hmacKey = await subtle.importKey("raw", copy2(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-  return new Uint8Array(await subtle.sign("HMAC", hmacKey, copy2(data)));
-}
-async function hkdfSha256(ikm, salt, info, length) {
-  const subtle = webCryptoSubtle();
-  const key = await subtle.importKey("raw", copy2(ikm), { name: "HKDF" }, false, ["deriveBits"]);
-  const bits = await subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: copy2(salt), info: utf82(info) }, key, length * 8);
-  return new Uint8Array(bits);
-}
-function base64UrlBytes(bytes) {
-  return z.string().refine((value) => {
-    try {
-      return decodeBase64Url(value, "field").byteLength === bytes;
-    } catch {
-      return false;
-    }
-  }, `must be canonical unpadded base64url of ${bytes} bytes`);
-}
-var ECDSA_P256 = { name: "ECDSA", namedCurve: "P-256" };
-var ECDSA_SHA256 = { name: "ECDSA", hash: "SHA-256" };
-function ecdsaSubtle() {
-  return webCryptoSubtle();
-}
-async function p256PublicKeyBytes(publicJwk) {
-  const raw = sealingPublicKeyBytes(publicJwk);
-  await importEcdsaPublicKey(publicJwk);
-  return raw;
-}
-async function importEcdsaPublicKey(publicJwk) {
-  const jwk = P256PublicJwkSchema.parse(publicJwk);
-  try {
-    return await ecdsaSubtle().importKey("jwk", { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y }, ECDSA_P256, true, ["verify"]);
-  } catch (cause) {
-    throw new ByokCoreError("sealed_secret_invalid", "P-256 public key is not a valid curve point", { cause });
-  }
-}
-async function ecdsaSign(publicJwk, privateKey, data) {
-  let signature;
-  try {
-    signature = encodeBase64Url(new Uint8Array(await ecdsaSubtle().sign(ECDSA_SHA256, privateKey, copy2(data))));
-  } catch (cause) {
-    throw new ByokCoreError("sealed_secret_invalid", "Signing key is not an ECDSA P-256 private key", { cause });
-  }
-  if (!await ecdsaVerify(publicJwk, signature, data)) {
-    throw invalidInput("Signing private key does not pair with the signing public key");
-  }
-  return signature;
-}
-async function ecdsaVerify(publicJwk, signature, data) {
-  let signatureBytes;
-  try {
-    signatureBytes = decodeBase64Url(signature, "sig");
-  } catch {
-    return false;
-  }
-  if (signatureBytes.byteLength !== ECDSA_P256_SIGNATURE_BYTES) return false;
-  const key = await importEcdsaPublicKey(publicJwk);
-  return ecdsaSubtle().verify(ECDSA_SHA256, key, signatureBytes, copy2(data));
-}
-
-// src/sealed-payload/member-chain.ts
-var MEMBER_ID_DOMAIN = "byok-member-id-v1\n";
-var MEMBER_ID_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-var MEMBER_CHAIN_VERSION = 1;
-var MEMBER_CHAIN_DOMAIN_PREFIX = "byok-member-chain-v1\n";
-var MEMBER_CHAIN_OPS = ["add", "remove", "rotate", "scope-policy", "shred"];
-var CanonicalJsonObjectSchema = z.unknown().transform((value, ctx) => {
-  try {
-    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
-      return JSON.parse(canonicalizeJson(value));
-    }
-  } catch {
-  }
-  ctx.addIssue({ code: "custom", message: "must be a canonical JSON object" });
-  return z.NEVER;
-});
-var unsignedEntryShape = {
-  v: z.literal(MEMBER_CHAIN_VERSION),
-  tenantId: z.string().min(1),
-  seq: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  prev: z.union([z.null(), z.string().regex(CONTENT_HASH_PATTERN)]),
-  op: z.enum(MEMBER_CHAIN_OPS),
-  subject: CanonicalJsonObjectSchema,
-  signer: z.string().regex(MEMBER_ID_PATTERN)
-};
-function firstEntryHasNoPrev(entry, ctx) {
-  if (entry.seq === 1 !== (entry.prev === null)) {
-    ctx.addIssue({ code: "custom", path: ["prev"], message: "the first entry, and only the first, has no prev" });
-  }
-}
-var UnsignedMemberChainEntryV1Schema = z.strictObject(unsignedEntryShape).superRefine(firstEntryHasNoPrev);
-var MemberChainEntryV1Schema = z.strictObject({ ...unsignedEntryShape, sig: base64UrlBytes(64) }).superRefine(firstEntryHasNoPrev);
-async function deriveMemberId(signingPublicJwk) {
-  const raw = await p256PublicKeyBytes(signingPublicJwk);
-  return encodeBase64Url(await sha256(concat2(utf82(MEMBER_ID_DOMAIN), raw)));
-}
-function parseUnsignedEntry(entry) {
-  const parsed = safeParseTotal(UnsignedMemberChainEntryV1Schema, entry);
-  if (!parsed.success) throw invalidInput("Member chain entry is invalid");
-  return parsed.data;
-}
-function signingInput(entry) {
-  return concat2(
-    utf82(MEMBER_CHAIN_DOMAIN_PREFIX),
-    canonicalizeJsonBytes({
-      v: entry.v,
-      tenantId: entry.tenantId,
-      seq: entry.seq,
-      prev: entry.prev,
-      op: entry.op,
-      subject: entry.subject,
-      signer: entry.signer
-    })
-  );
-}
-function memberChainSigningInput(entry) {
-  return signingInput(parseUnsignedEntry(entry));
-}
-async function memberChainEntryHash(entry) {
-  return `sha256:${hex(await sha256(memberChainSigningInput(entry)))}`;
-}
-async function signMemberChainEntry(entry, signer) {
-  const unsigned = parseUnsignedEntry(entry);
-  if (await deriveMemberId(signer.publicJwk) !== unsigned.signer) {
-    throw invalidInput("Member chain entry signer does not match the signing key");
-  }
-  return { ...unsigned, sig: await ecdsaSign(signer.publicJwk, signer.privateKey, signingInput(unsigned)) };
-}
-async function verifyMemberChainEntry(entry, signerPublicJwk) {
-  const parsed = safeParseTotal(MemberChainEntryV1Schema, entry);
-  if (!parsed.success || await deriveMemberId(signerPublicJwk) !== parsed.data.signer) {
-    return { ok: false, reason: "member_chain_entry_invalid" };
-  }
-  const input = signingInput(parsed.data);
-  if (!await ecdsaVerify(signerPublicJwk, parsed.data.sig, input)) {
-    return { ok: false, reason: "member_chain_signature_invalid" };
-  }
-  return { ok: true, entry: parsed.data, hash: `sha256:${hex(await sha256(input))}` };
-}
-var MEMBER_KEY_BUNDLE_VERSION = 1;
-var MEMBER_KEM_DOMAIN_PREFIX = "byok-member-kem-v1\n";
-var KemEpochSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var KemSigSchema = base64UrlBytes(64);
-var MemberKeyBundleV1Schema = z.strictObject({
-  v: z.literal(MEMBER_KEY_BUNDLE_VERSION),
-  memberId: z.string().regex(MEMBER_ID_PATTERN),
-  signingPublicJwk: P256PublicJwkSchema,
-  kemPublicJwk: P256PublicJwkSchema,
-  kemEpoch: KemEpochSchema,
-  kemSig: KemSigSchema,
-  deviceId: z.string().min(1).optional()
-});
-var CreateInputSchema = z.object({
-  signingPublicJwk: P256PublicJwkSchema,
-  signingPrivateKey: z.custom(),
-  kemPublicJwk: P256PublicJwkSchema,
-  kemEpoch: KemEpochSchema,
-  deviceId: z.string().min(1).optional()
-});
-var KemSignerSchema = z.object({ memberId: z.string().regex(MEMBER_ID_PATTERN), signingPublicJwk: P256PublicJwkSchema });
-var KemStatementSchema = z.object({ kemPublicJwk: P256PublicJwkSchema, kemEpoch: KemEpochSchema, kemSig: KemSigSchema });
-function memberKemSigningInput(memberId, kemPublicJwk, kemEpoch) {
-  return concat2(
-    utf82(MEMBER_KEM_DOMAIN_PREFIX),
-    canonicalizeJsonBytes({ memberId, kemPublicKey: { x: kemPublicJwk.x, y: kemPublicJwk.y }, kemEpoch })
-  );
-}
-async function createMemberKeyBundle(input) {
-  const parsed = safeParseTotal(CreateInputSchema, input);
-  if (!parsed.success) throw invalidInput("Member key bundle input is invalid");
-  const { signingPublicJwk, signingPrivateKey, kemPublicJwk, kemEpoch, deviceId } = parsed.data;
-  const memberId = await deriveMemberId(signingPublicJwk);
-  if (!await isValidMemberKemKey(kemPublicJwk, signingPublicJwk)) throw invalidInput("Member KEM key is invalid");
-  const kemSig = await ecdsaSign(signingPublicJwk, signingPrivateKey, memberKemSigningInput(memberId, kemPublicJwk, kemEpoch));
-  return {
-    v: MEMBER_KEY_BUNDLE_VERSION,
-    memberId,
-    signingPublicJwk,
-    kemPublicJwk,
-    kemEpoch,
-    kemSig,
-    ...deviceId === void 0 ? {} : { deviceId }
-  };
-}
-async function isValidMemberKemKey(kemPublicJwk, signingPublicJwk) {
-  if (kemPublicJwk.x === signingPublicJwk.x && kemPublicJwk.y === signingPublicJwk.y) return false;
-  try {
-    await p256PublicKeyBytes(kemPublicJwk);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function verifyMemberKem(member, kem) {
-  const signer = safeParseTotal(KemSignerSchema, member);
-  const statement = safeParseTotal(KemStatementSchema, kem);
-  if (!signer.success || !statement.success) return false;
-  const { memberId, signingPublicJwk } = signer.data;
-  const { kemPublicJwk, kemEpoch, kemSig } = statement.data;
-  if (!await isValidMemberKemKey(kemPublicJwk, signingPublicJwk)) return false;
-  try {
-    return await ecdsaVerify(signingPublicJwk, kemSig, memberKemSigningInput(memberId, kemPublicJwk, kemEpoch));
-  } catch {
-    return false;
-  }
-}
-async function parseMemberKeyBundle(value) {
-  const parsed = safeParseTotal(MemberKeyBundleV1Schema, value);
-  if (!parsed.success) return void 0;
-  const bundle = parsed.data;
-  try {
-    if (await deriveMemberId(bundle.signingPublicJwk) !== bundle.memberId) return void 0;
-  } catch {
-    return void 0;
-  }
-  if (!await verifyMemberKem(bundle, bundle)) return void 0;
-  return bundle;
-}
-
-// src/sealed-payload/scope-key.ts
-var SCOPE_KEY_BYTES = 32;
-var SCOPE_KEY_ID_PATTERN = /^[A-Za-z0-9_-]{22}$/u;
-var KEY_ID_MESSAGE = "byok-scope-key-id-v1";
-var CONTENT_KEY_INFO = "byok-sdk.sealed.v1.enc";
-var MAC_KEY_INFO = "byok-sdk.sealed.v1.mac";
-var SEALED_SALT_BYTES = 32;
-var SCOPE_KEY_PACKAGE_VERSION = 1;
-var SCOPE_KEY_HPKE_INFO = "byok-sdk.scope-key.v1";
-var SCOPE_KEY_PACKAGE_DOMAIN_PREFIX = "byok-scope-key-package-v1\n";
-var SCOPE_KEY_PACKAGE_V2 = 2;
-var SCOPE_KEY_HPKE_INFO_V2 = "byok-sdk.scope-key.v2";
-var SCOPE_KEY_PACKAGE_V2_DOMAIN_PREFIX = "byok-scope-key-package-v2\n";
-var P256_POINT_BYTES = 65;
-var AEAD_TAG_BYTES = 16;
-function assertScopeKey(scopeKey) {
-  if (scopeKey.byteLength !== SCOPE_KEY_BYTES) throw invalidInput(`Scope key must be ${SCOPE_KEY_BYTES} bytes`);
-}
-function generateScopeKey() {
-  return randomBytes(SCOPE_KEY_BYTES);
-}
-async function deriveScopeKeyId(scopeKey) {
-  assertScopeKey(scopeKey);
-  const mac = await hmacSha2562(scopeKey, utf82(KEY_ID_MESSAGE));
-  return encodeBase64Url(mac.subarray(0, 16));
-}
-async function deriveSealedContentKey(scopeKey, salt) {
-  assertScopeKey(scopeKey);
-  if (salt.byteLength !== SEALED_SALT_BYTES) throw invalidInput(`Sealed content salt must be ${SEALED_SALT_BYTES} bytes`);
-  return hkdfSha256(scopeKey, salt, CONTENT_KEY_INFO, 32);
-}
-async function deriveSealedMacKey(scopeKey) {
-  assertScopeKey(scopeKey);
-  return hkdfSha256(scopeKey, new Uint8Array(32), MAC_KEY_INFO, 32);
-}
-var ScopeKeyPackageV1Schema = z.strictObject({
-  v: z.literal(SCOPE_KEY_PACKAGE_VERSION),
-  tenantId: z.string().min(1),
-  scopeId: z.string().min(1),
-  epoch: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  keyId: z.string().regex(SCOPE_KEY_ID_PATTERN),
-  recipient: z.string().regex(MEMBER_ID_PATTERN),
-  sender: z.string().regex(MEMBER_ID_PATTERN),
-  enc: base64UrlBytes(P256_POINT_BYTES),
-  ciphertext: base64UrlBytes(SCOPE_KEY_BYTES + AEAD_TAG_BYTES),
-  sig: base64UrlBytes(64)
-});
-var ScopeKeyPackageV2Schema = z.strictObject({
-  ...ScopeKeyPackageV1Schema.shape,
-  v: z.literal(SCOPE_KEY_PACKAGE_V2),
-  recipientKemEpoch: KemEpochSchema
-});
-var ScopeKeyPackageSchema = z.union([ScopeKeyPackageV1Schema, ScopeKeyPackageV2Schema]);
-function packageAad({ enc: _enc, ciphertext: _ciphertext, sig: _sig, ...identity }) {
-  return canonicalizeJsonBytes(identity);
-}
-function packageSigningInput({ sig: _sig, ...pkg }) {
-  return concat2(utf82(pkg.v === SCOPE_KEY_PACKAGE_V2 ? SCOPE_KEY_PACKAGE_V2_DOMAIN_PREFIX : SCOPE_KEY_PACKAGE_DOMAIN_PREFIX), canonicalizeJsonBytes(pkg));
-}
-var PackageIdentitySchema = ScopeKeyPackageV2Schema.omit({ enc: true, ciphertext: true, sig: true });
-async function sealScopeKeyPackage(input) {
-  const parsed = safeParseTotal(PackageIdentitySchema, {
-    v: SCOPE_KEY_PACKAGE_V2,
-    tenantId: input.tenantId,
-    scopeId: input.scopeId,
-    epoch: input.epoch,
-    keyId: await deriveScopeKeyId(input.scopeKey),
-    recipient: input.recipient.memberId,
-    recipientKemEpoch: input.recipient.kemEpoch,
-    sender: await deriveMemberId(input.sender.signingPublicJwk)
-  });
-  if (!parsed.success) throw invalidInput("Scope key package input is invalid");
-  const identity = parsed.data;
-  const { enc, ciphertext } = await hpkeSealBase({
-    recipientPublicKey: await p256PublicKeyBytes(input.recipient.kemPublicJwk),
-    info: utf82(SCOPE_KEY_HPKE_INFO_V2),
-    aad: packageAad(identity),
-    plaintext: input.scopeKey
-  });
-  const unsigned = { ...identity, enc: encodeBase64Url(enc), ciphertext: encodeBase64Url(ciphertext) };
-  return { ...unsigned, sig: await ecdsaSign(input.sender.signingPublicJwk, input.sender.signingPrivateKey, packageSigningInput(unsigned)) };
-}
-async function openScopeKeyPackage(input) {
-  const parsed = safeParseTotal(ScopeKeyPackageSchema, input.package);
-  if (!parsed.success) return { ok: false, reason: "key_package_invalid" };
-  const pkg = parsed.data;
-  if (pkg.recipient !== input.recipient.memberId || pkg.v === SCOPE_KEY_PACKAGE_V2 && pkg.recipientKemEpoch !== input.recipient.kemEpoch || pkg.tenantId !== input.expected.tenantId || pkg.scopeId !== input.expected.scopeId || pkg.epoch !== input.expected.epoch || pkg.sender !== await deriveMemberId(input.senderSigningPublicJwk)) {
-    return { ok: false, reason: "key_package_invalid" };
-  }
-  if (!await ecdsaVerify(input.senderSigningPublicJwk, pkg.sig, packageSigningInput(pkg))) {
-    return { ok: false, reason: "key_package_signature_invalid" };
-  }
-  let scopeKey;
-  try {
-    scopeKey = await hpkeOpenBase({
-      recipientPrivateKey: input.recipient.kemPrivateKey,
-      recipientPublicKey: await p256PublicKeyBytes(input.recipient.kemPublicJwk),
-      enc: decodeBase64Url(pkg.enc, "enc"),
-      info: utf82(pkg.v === SCOPE_KEY_PACKAGE_V2 ? SCOPE_KEY_HPKE_INFO_V2 : SCOPE_KEY_HPKE_INFO),
-      aad: packageAad(pkg),
-      ciphertext: decodeBase64Url(pkg.ciphertext, "ciphertext")
-    });
-  } catch (error) {
-    if (error instanceof ByokCoreError) return { ok: false, reason: "key_package_open_failed" };
-    throw error;
-  }
-  if (scopeKey.byteLength !== SCOPE_KEY_BYTES || await deriveScopeKeyId(scopeKey) !== pkg.keyId) {
-    scopeKey.fill(0);
-    return { ok: false, reason: "key_package_open_failed" };
-  }
-  return { ok: true, scopeKey, keyId: pkg.keyId };
-}
-
-// src/sealed-payload/sealed-json.ts
-function canonicalValue(value, seen) {
-  if (value === null) return "null";
-  switch (typeof value) {
-    case "boolean":
-      return value ? "true" : "false";
-    case "string":
-      return JSON.stringify(value);
-    case "number":
-      if (!Number.isFinite(value)) throw invalidInput("Sealed plaintext holds a number with no JSON form");
-      return String(value);
-    case "object":
-      break;
-    default:
-      throw invalidInput(`Sealed plaintext holds a ${typeof value}, which is not a JSON type`);
-  }
-  if (seen.has(value)) throw invalidInput("Sealed plaintext holds a circular reference");
-  seen.add(value);
-  try {
-    if (Array.isArray(value)) return `[${Array.from(value, (entry) => canonicalValue(entry, seen)).join(",")}]`;
-    const prototype = Object.getPrototypeOf(value);
-    if (prototype !== Object.prototype && prototype !== null) throw invalidInput("Sealed plaintext holds an object that is not plain");
-    const record = value;
-    const members = Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${canonicalValue(record[key], seen)}`);
-    return `{${members.join(",")}}`;
-  } finally {
-    seen.delete(value);
-  }
-}
-function canonicalizeSealedJson(value) {
-  return canonicalValue(value, /* @__PURE__ */ new Set());
-}
-
-// src/sealed-payload/sealed-content.ts
-var SEALED_CONTENT_VERSION = 1;
-var SEALED_CONTENT_SUITE = "byok-sealed-v1.hkdf-sha256.aes-256-gcm";
-var SEALED_CATEGORIES = ["task-input", "agent-message", "task-output", "memory-projection"];
-var SEALED_DIRECTIONS = ["server-to-daemon", "daemon-to-server"];
-var SEALED_NONCE_BYTES = 12;
-var AEAD_TAG_BYTES2 = 16;
-var FRAME_HEADER_BYTES = 4;
-var ALIGNED_FRAME_LIMIT = 16 * 1024;
-var FRAME_ALIGNMENT = 256;
-var MAX_CONTENT_LENGTH = 4294967295;
-var CONTENT_MAC_PREFIX = "byok-content-mac-v1\n";
-var CONTENT_MAC_PATTERN = /^hmac-sha256:[0-9a-f]{64}$/u;
-var FAMILY_PATTERN = /^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/u;
-var IDENTITY_FIELD_PATTERN = /^[a-z][A-Za-z0-9]*$/u;
-var ROUTINE_TEMPLATE_FAMILY = "routine.template";
-function floorLog2(value) {
-  let exponent = 0;
-  for (let remaining = value; remaining >= 2; remaining = Math.floor(remaining / 2)) exponent += 1;
-  return exponent;
-}
-function sealedPaddedLength(frameLength) {
-  if (!Number.isSafeInteger(frameLength) || frameLength < FRAME_HEADER_BYTES) {
-    throw invalidInput("Sealed frame length must be a safe integer of at least 4");
-  }
-  if (frameLength <= ALIGNED_FRAME_LIMIT) return Math.ceil(frameLength / FRAME_ALIGNMENT) * FRAME_ALIGNMENT;
-  const exponent = floorLog2(frameLength);
-  const step = 2 ** (exponent - (floorLog2(exponent) + 1));
-  return Math.ceil(frameLength / step) * step;
-}
-function isLegalPaddedLength(paddedLength) {
-  return Number.isSafeInteger(paddedLength) && paddedLength >= FRAME_ALIGNMENT && sealedPaddedLength(paddedLength) === paddedLength;
-}
-function encodeSealedFrame(content) {
-  if (content.byteLength > MAX_CONTENT_LENGTH) throw invalidInput("Sealed content exceeds the 32-bit frame length");
-  const frame = new Uint8Array(sealedPaddedLength(FRAME_HEADER_BYTES + content.byteLength));
-  new DataView(frame.buffer).setUint32(0, content.byteLength, false);
-  frame.set(content, FRAME_HEADER_BYTES);
-  return frame;
-}
-function decodeSealedFrame(frame, paddedLength, maxContentLength) {
-  if (frame.byteLength !== paddedLength || paddedLength < FRAME_HEADER_BYTES) return void 0;
-  const contentLength = new DataView(frame.buffer, frame.byteOffset, frame.byteLength).getUint32(0, false);
-  if (contentLength > paddedLength - FRAME_HEADER_BYTES) return void 0;
-  if (sealedPaddedLength(FRAME_HEADER_BYTES + contentLength) !== paddedLength) return void 0;
-  if (contentLength > maxContentLength) return void 0;
-  for (let index = FRAME_HEADER_BYTES + contentLength; index < paddedLength; index += 1) {
-    if (frame[index] !== 0) return void 0;
-  }
-  return frame.subarray(FRAME_HEADER_BYTES, FRAME_HEADER_BYTES + contentLength);
-}
-var NonEmptyStringSchema = z.string().min(1);
-var PositiveIntegerSchema = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var SealedContentHeaderV1Schema = z.strictObject({
-  v: z.literal(SEALED_CONTENT_VERSION),
-  suite: z.literal(SEALED_CONTENT_SUITE),
-  category: z.enum(SEALED_CATEGORIES),
-  scope: z.strictObject({
-    id: NonEmptyStringSchema,
-    epoch: PositiveIntegerSchema,
-    keyId: z.string().regex(SCOPE_KEY_ID_PATTERN)
-  }),
-  chainHead: z.strictObject({
-    seq: PositiveIntegerSchema,
-    hash: z.string().regex(CONTENT_HASH_PATTERN)
-  }),
-  sender: z.string().regex(MEMBER_ID_PATTERN),
-  salt: base64UrlBytes(SEALED_SALT_BYTES),
-  nonce: base64UrlBytes(SEALED_NONCE_BYTES),
-  paddedLength: PositiveIntegerSchema.refine(isLegalPaddedLength, "must be a legal padded frame length"),
-  contentMac: z.string().regex(CONTENT_MAC_PATTERN)
-});
-function isCanonicalCategoryList(categories) {
-  return categories.every((category, index) => index === 0 || SEALED_CATEGORIES.indexOf(categories[index - 1]) < SEALED_CATEGORIES.indexOf(category));
-}
-var SealedBindingSchema = z.strictObject({
-  tenantId: NonEmptyStringSchema,
-  family: z.string().regex(FAMILY_PATTERN),
-  direction: z.enum(SEALED_DIRECTIONS),
-  identity: z.record(
-    z.string().regex(IDENTITY_FIELD_PATTERN),
-    z.union([NonEmptyStringSchema, z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)])
-  ).refine((identity) => Object.keys(identity).length > 0, "identity must name at least one field"),
-  deviceId: z.union([z.null(), NonEmptyStringSchema]),
-  agentRef: z.union([z.null(), z.strictObject({ agentId: NonEmptyStringSchema, profileRevision: NonEmptyStringSchema })]),
-  categories: z.array(z.enum(SEALED_CATEGORIES)).min(1).refine(isCanonicalCategoryList, "categories must be unique and in canonical order"),
-  notAfter: z.union([z.null(), z.string().refine(isCanonicalTimestamp, "must be a canonical UTC instant")])
-}).superRefine((binding, ctx) => {
-  const template = binding.family === ROUTINE_TEMPLATE_FAMILY;
-  if (binding.deviceId === null !== template || binding.notAfter === null === template) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["deviceId"],
-      message: "a routine template binds an expiry and no device; every other family binds a device and no expiry"
-    });
-  }
-});
-function parseBinding(binding) {
-  const parsed = safeParseTotal(SealedBindingSchema, binding);
-  if (!parsed.success) throw invalidInput("Sealed content binding is invalid");
-  return parsed.data;
-}
-function assertMaxContentLength(maxContentLength) {
-  if (!Number.isSafeInteger(maxContentLength) || maxContentLength < 0 || maxContentLength > MAX_CONTENT_LENGTH) {
-    throw invalidInput("Sealed content limit must be a non-negative 32-bit integer");
-  }
-}
-function bindingAad(header, binding) {
-  return {
-    v: header.v,
-    suite: header.suite,
-    category: header.category,
-    tenantId: binding.tenantId,
-    scopeId: header.scope.id,
-    epoch: header.scope.epoch,
-    keyId: header.scope.keyId,
-    chainHead: { seq: header.chainHead.seq, hash: header.chainHead.hash },
-    sender: header.sender,
-    family: binding.family,
-    direction: binding.direction,
-    identity: binding.identity,
-    deviceId: binding.deviceId,
-    agentRef: binding.agentRef === null ? null : { agentId: binding.agentRef.agentId, profileRevision: binding.agentRef.profileRevision },
-    categories: [...binding.categories],
-    notAfter: binding.notAfter
-  };
-}
-function aadBytes(header, binding) {
-  return canonicalizeJsonBytes({ ...bindingAad(header, binding), paddedLength: header.paddedLength, contentMac: header.contentMac });
-}
-function isNonEmptyPlainObject(value) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-  const prototype = Object.getPrototypeOf(value);
-  return (prototype === Object.prototype || prototype === null) && Object.keys(value).length > 0;
-}
-function canonicalPlaintext(plaintext) {
-  try {
-    if (isNonEmptyPlainObject(plaintext)) return canonicalizeSealedJson(plaintext);
-  } catch (cause) {
-    throw new ByokCoreError("sealed_secret_invalid", "Sealed plaintext is not canonical JSON", { cause });
-  }
-  throw invalidInput("Sealed plaintext must be a non-empty plain JSON object");
-}
-function parseCanonicalPlaintext(content) {
-  let text;
-  let value;
-  try {
-    text = new TextDecoder("utf-8", { fatal: true, ignoreBOM: true }).decode(content);
-    value = JSON.parse(text);
-    if (!isNonEmptyPlainObject(value) || canonicalizeSealedJson(value) !== text) return void 0;
-  } catch {
-    return void 0;
-  }
-  return { value, text };
-}
-async function contentMacOf(scopeKey, category, binding, plaintextText) {
-  const macKey = await deriveSealedMacKey(scopeKey);
-  try {
-    const input = `${CONTENT_MAC_PREFIX}${category}
+var CONTENT_HASH_PATTERN=/^sha256:[0-9a-f]{64}$/;var DEVICE_PROOF_SCHEMA_ID="byok-device-proof-v1";var DEVICE_PROOF_VERSION=1;var DEVICE_PROOF_ALGORITHMS=["ed25519"];var BASE64URL_PATTERN=/^[A-Za-z0-9_-]+$/;var HTTP_METHOD_PATTERN=/^[A-Z]+$/;function canonicalizationFailure(path,reason){return new ByokCoreError("proof_canonicalization_failed",`Cannot canonicalize ${path}: ${reason}`)}function isPlainObject(value){const prototype=Object.getPrototypeOf(value);return prototype===Object.prototype||prototype===null}function canonicalizeValue(value,path,seen){if(value===null)return "null";switch(typeof value){case "boolean":return value?"true":"false";case "string":return JSON.stringify(value);case "number":{if(!Number.isSafeInteger(value)){throw canonicalizationFailure(path,`only safe integers are canonicalizable, received ${String(value)}`)}return String(value===0?0:value)}case "undefined":throw canonicalizationFailure(path,"undefined has no canonical form");case "bigint":throw canonicalizationFailure(path,"bigint is not a JSON type");case "function":case "symbol":throw canonicalizationFailure(path,`${typeof value} is not a JSON type`);case "object":break;default:throw canonicalizationFailure(path,`unsupported type ${typeof value}`)}const objectValue=value;if(seen.has(objectValue)){throw canonicalizationFailure(path,"circular reference")}seen.add(objectValue);try{if(Array.isArray(objectValue)){const parts2=objectValue.map((entry,index)=>canonicalizeValue(entry,`${path}[${index}]`,seen));return `[${parts2.join(",")}]`}if(!isPlainObject(objectValue)){throw canonicalizationFailure(path,"only plain objects and arrays are canonicalizable")}const keys=Object.keys(objectValue).sort();const record=objectValue;const parts=keys.map(key=>{const encodedKey=JSON.stringify(key);const encodedValue=canonicalizeValue(record[key],`${path}.${key}`,seen);return `${encodedKey}:${encodedValue}`});return `{${parts.join(",")}}`}finally{seen.delete(objectValue);}}function canonicalizeJson(value){return canonicalizeValue(value,"<root>",new Set)}function canonicalizeJsonBytes(value){return new TextEncoder().encode(canonicalizeJson(value))}var DeviceProofProtectedClaimsSchema=z.strictObject({version:z.literal(DEVICE_PROOF_VERSION),tenantId:z.string().min(1),productId:z.string().min(1),deviceId:z.string().min(1),keyId:z.string().min(1),keyEpoch:z.number().int().nonnegative(),requestId:z.string().min(1),operation:z.string().min(1),resource:z.string().min(1),method:z.string().regex(HTTP_METHOD_PATTERN).optional(),path:z.string().startsWith("/").optional(),operationId:z.string().min(1).optional(),bodySha256:z.string().regex(CONTENT_HASH_PATTERN),bodySize:z.number().int().nonnegative(),issuedAt:z.iso.datetime(),expiresAt:z.iso.datetime().optional(),nonce:z.string().min(1).optional()}).superRefine((claims,ctx)=>{const hasRequestLine=claims.method!==void 0&&claims.path!==void 0;const hasOperationId=claims.operationId!==void 0;if(hasRequestLine===hasOperationId){ctx.addIssue({code:"custom",message:"Claims must carry exactly one request binding: both `method` and `path`, or `operationId`."});}if(!hasRequestLine&&(claims.method!==void 0||claims.path!==void 0)){ctx.addIssue({code:"custom",message:"`method` and `path` must be supplied together."});}});z.strictObject({schema:z.literal(DEVICE_PROOF_SCHEMA_ID),algorithm:z.enum(DEVICE_PROOF_ALGORITHMS),protected:DeviceProofProtectedClaimsSchema,signature:z.string().regex(BASE64URL_PATTERN)});var CANONICAL_TIMESTAMP_PATTERN=/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;function isCanonicalTimestamp(value){if(typeof value!=="string")return false;if(!CANONICAL_TIMESTAMP_PATTERN.test(value))return false;const parsed=Date.parse(value);if(!Number.isFinite(parsed))return false;return new Date(parsed).toISOString()===value}function safeParseTotal(schema,value){try{return schema.safeParse(value)}catch{return {success:false}}}function webCryptoSubtle(){const subtle=globalThis.crypto?.subtle;if(subtle===void 0){throw new ByokCoreError("webcrypto_unavailable","WebCrypto subtle is unavailable in this runtime")}return subtle}var KEM_ID=16;var KDF_ID=1;var AEAD_ID=1;var HPKE_P256_PUBLIC_KEY_BYTES=65;var N_SECRET=32;var N_K=16;var N_N=12;var N_H=32;var HPKE_AEAD_TAG_BYTES=16;var MODE_BASE=0;var HPKE_V1=utf8("HPKE-v1");var KEM_SUITE_ID=concat(utf8("KEM"),i2osp(KEM_ID,2));var HPKE_SUITE_ID=concat(utf8("HPKE"),i2osp(KEM_ID,2),i2osp(KDF_ID,2),i2osp(AEAD_ID,2));var EMPTY=new Uint8Array(0);var ZERO_SALT=new Uint8Array(N_H);function utf8(value){return new TextEncoder().encode(value)}function concat(...parts){const length=parts.reduce((total,part)=>total+part.byteLength,0);const out=new Uint8Array(length);let offset=0;for(const part of parts){out.set(part,offset);offset+=part.byteLength;}return out}function i2osp(value,length){if(!Number.isSafeInteger(value)||value<0){throw new ByokCoreError("sealed_secret_invalid","HPKE integer encoding requires a non-negative safe integer")}const out=new Uint8Array(length);let remaining=value;for(let index=length-1;index>=0;index-=1){out[index]=remaining%256;remaining=Math.floor(remaining/256);}if(remaining!==0){throw new ByokCoreError("sealed_secret_invalid","HPKE integer does not fit the requested width")}return out}function copy(bytes){return new Uint8Array(bytes)}async function hmacSha256(key,data){const subtle=webCryptoSubtle();const hmacKey=await subtle.importKey("raw",copy(key),{name:"HMAC",hash:"SHA-256"},false,["sign"]);return new Uint8Array(await subtle.sign("HMAC",hmacKey,copy(data)))}async function hkdfExpand(prk,info,length){if(length>255*N_H){throw new ByokCoreError("sealed_secret_invalid","HKDF output length exceeds its limit")}const out=new Uint8Array(length);let previous=EMPTY;let offset=0;for(let counter=1;offset<length;counter+=1){previous=await hmacSha256(prk,concat(previous,info,Uint8Array.of(counter)));const take=Math.min(previous.byteLength,length-offset);out.set(previous.subarray(0,take),offset);offset+=take;}return out}async function labeledExtract(suiteId,salt,label,ikm){return hmacSha256(salt.byteLength===0?ZERO_SALT:salt,concat(HPKE_V1,suiteId,utf8(label),ikm))}async function labeledExpand(suiteId,prk,label,info,length){return hkdfExpand(prk,concat(i2osp(length,2),HPKE_V1,suiteId,utf8(label),info),length)}async function importP256PublicKey(raw){if(raw.byteLength!==HPKE_P256_PUBLIC_KEY_BYTES||raw[0]!==4){throw new ByokCoreError("sealed_secret_invalid","P-256 public key must be a 65-byte uncompressed point")}try{return await webCryptoSubtle().importKey("raw",copy(raw),{name:"ECDH",namedCurve:"P-256"},true,[])}catch(cause){throw new ByokCoreError("sealed_secret_invalid","P-256 public key is not a valid curve point",{cause})}}async function ecdhP256(privateKey,publicKey){const bits=await webCryptoSubtle().deriveBits({name:"ECDH",public:publicKey},privateKey,N_SECRET*8);return new Uint8Array(bits)}async function extractAndExpand(dh,kemContext){const eaePrk=await labeledExtract(KEM_SUITE_ID,EMPTY,"eae_prk",dh);return labeledExpand(KEM_SUITE_ID,eaePrk,"shared_secret",kemContext,N_SECRET)}async function keyScheduleBase(sharedSecret,info){const pskIdHash=await labeledExtract(HPKE_SUITE_ID,EMPTY,"psk_id_hash",EMPTY);const infoHash=await labeledExtract(HPKE_SUITE_ID,EMPTY,"info_hash",info);const context=concat(Uint8Array.of(MODE_BASE),pskIdHash,infoHash);const secret=await labeledExtract(HPKE_SUITE_ID,sharedSecret,"secret",EMPTY);return {sharedSecret,key:await labeledExpand(HPKE_SUITE_ID,secret,"key",context,N_K),baseNonce:await labeledExpand(HPKE_SUITE_ID,secret,"base_nonce",context,N_N),exporterSecret:await labeledExpand(HPKE_SUITE_ID,secret,"exp",context,N_H)}}async function setupBaseSender(recipientPublicKey,info,ephemeral){const pkR=await importP256PublicKey(recipientPublicKey);let pair=ephemeral;if(pair===void 0){const subtle=webCryptoSubtle();const generated=await subtle.generateKey({name:"ECDH",namedCurve:"P-256"},true,["deriveBits"]);pair={privateKey:generated.privateKey,publicKey:new Uint8Array(await subtle.exportKey("raw",generated.publicKey))};}const enc=copy(pair.publicKey);const dh=await ecdhP256(pair.privateKey,pkR);const sharedSecret=await extractAndExpand(dh,concat(enc,recipientPublicKey));return {enc,schedule:await keyScheduleBase(sharedSecret,info)}}async function setupBaseRecipient(enc,recipientPrivateKey,recipientPublicKey,info){if(recipientPublicKey.byteLength!==HPKE_P256_PUBLIC_KEY_BYTES||recipientPublicKey[0]!==4){throw new ByokCoreError("sealed_secret_invalid","P-256 recipient public key must be a 65-byte uncompressed point")}const pkE=await importP256PublicKey(enc);let dh;try{dh=await ecdhP256(recipientPrivateKey,pkE);}catch(cause){throw new ByokCoreError("sealed_secret_open_failed","HPKE decapsulation failed",{cause})}const sharedSecret=await extractAndExpand(dh,concat(enc,recipientPublicKey));return keyScheduleBase(sharedSecret,info)}function hpkeNonce(baseNonce,sequence){const seq=i2osp(sequence,N_N);const out=new Uint8Array(N_N);for(let index=0;index<N_N;index+=1)out[index]=baseNonce[index]^seq[index];return out}async function aesGcmKey(key,usage){return webCryptoSubtle().importKey("raw",copy(key),{name:"AES-GCM"},false,[usage])}async function hpkeAeadSeal(schedule,sequence,aad,plaintext){const ciphertext=await webCryptoSubtle().encrypt({name:"AES-GCM",iv:hpkeNonce(schedule.baseNonce,sequence),additionalData:copy(aad),tagLength:128},await aesGcmKey(schedule.key,"encrypt"),copy(plaintext));return new Uint8Array(ciphertext)}async function hpkeAeadOpen(schedule,sequence,aad,ciphertext){if(ciphertext.byteLength<HPKE_AEAD_TAG_BYTES){throw new ByokCoreError("sealed_secret_invalid","HPKE ciphertext is shorter than its authentication tag")}try{const plaintext=await webCryptoSubtle().decrypt({name:"AES-GCM",iv:hpkeNonce(schedule.baseNonce,sequence),additionalData:copy(aad),tagLength:128},await aesGcmKey(schedule.key,"decrypt"),copy(ciphertext));return new Uint8Array(plaintext)}catch(cause){throw new ByokCoreError("sealed_secret_open_failed","HPKE ciphertext failed authentication",{cause})}}async function hpkeSealBase(input){const{enc,schedule}=await setupBaseSender(input.recipientPublicKey,input.info);return {enc,ciphertext:await hpkeAeadSeal(schedule,0,input.aad,input.plaintext)}}async function hpkeOpenBase(input){const schedule=await setupBaseRecipient(input.enc,input.recipientPrivateKey,input.recipientPublicKey,input.info);return hpkeAeadOpen(schedule,0,input.aad,input.ciphertext)}var PROVIDER_SECRET_HPKE_SUITE="hpke-base.dhkem-p256-hkdf-sha256.hkdf-sha256.aes-128-gcm";var PROVIDER_PROVISIONING_REQUEST_VERSION=1;var PROVIDER_PROVISIONING_OPERATIONS=["configure","update_model","replace_secret","delete"];var PROVIDER_PROVISIONING_SECRET_OPERATIONS=["configure","replace_secret"];var PROVIDER_SECRET_MAX_PADDED_BYTES=4096;var SEALING_KEY_ID_LENGTH=22;var B64URL_ALPHABET="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";var B64URL_PATTERN=/^[A-Za-z0-9_-]*$/;function encodeBase64Url(bytes){let out="";let index=0;for(;index+3<=bytes.length;index+=3){const value=bytes[index]<<16|bytes[index+1]<<8|bytes[index+2];out+=B64URL_ALPHABET[value>>18&63]+B64URL_ALPHABET[value>>12&63]+B64URL_ALPHABET[value>>6&63]+B64URL_ALPHABET[value&63];}const rest=bytes.length-index;if(rest===1){const value=bytes[index]<<16;out+=B64URL_ALPHABET[value>>18&63]+B64URL_ALPHABET[value>>12&63];}else if(rest===2){const value=bytes[index]<<16|bytes[index+1]<<8;out+=B64URL_ALPHABET[value>>18&63]+B64URL_ALPHABET[value>>12&63]+B64URL_ALPHABET[value>>6&63];}return out}function decodeBase64Url(value,field){if(!B64URL_PATTERN.test(value)||value.length%4===1){throw new ByokCoreError("sealed_secret_invalid",`${field} is not canonical base64url`)}const out=new Uint8Array(Math.floor(value.length*3/4));let buffer=0;let bits=0;let offset=0;for(const char of value){buffer=buffer<<6|B64URL_ALPHABET.indexOf(char);bits+=6;if(bits>=8){bits-=8;out[offset]=buffer>>bits&255;offset+=1;}}if(encodeBase64Url(out)!==value){throw new ByokCoreError("sealed_secret_invalid",`${field} is not canonical base64url`)}return out}function base64UrlField(bytes){return z.string().superRefine((value,ctx)=>{try{const decoded=decodeBase64Url(value,"field");if(bytes.exact!==void 0&&decoded.byteLength!==bytes.exact){ctx.addIssue({code:"custom",message:`must decode to exactly ${bytes.exact} bytes`});}if(bytes.max!==void 0&&decoded.byteLength>bytes.max){ctx.addIssue({code:"custom",message:`must decode to at most ${bytes.max} bytes`});}}catch{ctx.addIssue({code:"custom",message:"must be canonical unpadded base64url"});}})}var SealingPublicJwkSchema=z.strictObject({kty:z.literal("EC"),crv:z.literal("P-256"),x:base64UrlField({exact:32}),y:base64UrlField({exact:32})});var SealingKeyIdSchema=z.string().regex(new RegExp(`^[A-Za-z0-9_-]{${SEALING_KEY_ID_LENGTH}}$`));function parseSealingPublicJwk(input){const result=safeParseTotal(SealingPublicJwkSchema,input);if(!result.success){throw new ByokCoreError("sealed_secret_invalid","Sealing public key must be a strict P-256 EC public JWK")}return result.data}function sealingPublicKeyBytes(publicJwk){const jwk=parseSealingPublicJwk(publicJwk);const raw=new Uint8Array(HPKE_P256_PUBLIC_KEY_BYTES);raw[0]=4;raw.set(decodeBase64Url(jwk.x,"x"),1);raw.set(decodeBase64Url(jwk.y,"y"),33);return raw}z.strictObject({version:z.literal(1),keyId:SealingKeyIdSchema,epoch:z.number().int().positive().max(Number.MAX_SAFE_INTEGER),publicJwk:SealingPublicJwkSchema});var OpaqueIdSchema=z.string().min(1).max(200).superRefine((value,ctx)=>{if(value.trim()!==value||/[\u0000-\u001f\u007f]/u.test(value)){ctx.addIssue({code:"custom",message:"must not carry surrounding whitespace or control characters"});}});var CanonicalTimestampSchema=z.string().refine(isCanonicalTimestamp,"must be a canonical ISO-8601 UTC instant");var ProfileRefSchema=z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);var ProviderKindSchema=z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u);var ModelIdSchema=z.string().min(1).max(160).refine(value=>value.trim()===value&&!/[\u0000-\u001f\u007f]/u.test(value),"model id is invalid");var CapabilitySchema=z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u);var PiModelJsonSchema=z.custom(value=>{if(value===null||typeof value!=="object"||Array.isArray(value))return false;try{canonicalizeJson(value);return true}catch{return false}},"piModel must be a canonical JSON object");var ModelConfigFields={agentId:OpaqueIdSchema,providerKind:ProviderKindSchema,modelId:ModelIdSchema,piModel:PiModelJsonSchema,capabilities:z.array(CapabilitySchema).max(8).refine(values=>new Set(values).size===values.length,"capabilities must be unique")};var ProviderProvisioningConfigV1Schema=z.discriminatedUnion("operation",[z.strictObject({operation:z.literal("configure"),...ModelConfigFields}),z.strictObject({operation:z.literal("update_model"),...ModelConfigFields}),z.strictObject({operation:z.literal("replace_secret"),agentId:OpaqueIdSchema,providerKind:ProviderKindSchema}),z.strictObject({operation:z.literal("delete"),agentId:OpaqueIdSchema})]);var ProviderProvisioningExpectedProfileSchema=z.union([z.null(),z.strictObject({profileRef:ProfileRefSchema,profileRevision:z.string().regex(/^(?:0|[1-9][0-9]{0,19})$/u),profileHash:z.string().regex(CONTENT_HASH_PATTERN)})]);var ProviderProvisioningIdentityRevisionSchema=z.string().min(1).max(128).regex(/^[A-Za-z0-9._:-]+$/u);var ProviderProvisioningHeaderV1Schema=z.strictObject({tenantId:OpaqueIdSchema,deviceId:OpaqueIdSchema,agentId:OpaqueIdSchema,requestId:OpaqueIdSchema,operation:z.enum(PROVIDER_PROVISIONING_OPERATIONS),operationGeneration:z.number().int().positive().max(Number.MAX_SAFE_INTEGER),expectedProfile:ProviderProvisioningExpectedProfileSchema,expectedEnrollmentRevision:ProviderProvisioningIdentityRevisionSchema,expectedPlacementRevision:ProviderProvisioningIdentityRevisionSchema,configDigest:z.string().regex(CONTENT_HASH_PATTERN),issuedAt:CanonicalTimestampSchema,expiresAt:CanonicalTimestampSchema});var MAX_CIPHERTEXT_BYTES=PROVIDER_SECRET_MAX_PADDED_BYTES+HPKE_AEAD_TAG_BYTES;var SealedProviderSecretV1Schema=z.strictObject({suite:z.literal(PROVIDER_SECRET_HPKE_SUITE),keyId:SealingKeyIdSchema,enc:base64UrlField({exact:HPKE_P256_PUBLIC_KEY_BYTES}),ciphertext:base64UrlField({max:MAX_CIPHERTEXT_BYTES})});function isSecretOperation(operation){return PROVIDER_PROVISIONING_SECRET_OPERATIONS.includes(operation)}z.strictObject({version:z.literal(PROVIDER_PROVISIONING_REQUEST_VERSION),header:ProviderProvisioningHeaderV1Schema,config:ProviderProvisioningConfigV1Schema,sealed:SealedProviderSecretV1Schema.optional()}).superRefine((request,ctx)=>{if(request.header.operation!==request.config.operation){ctx.addIssue({code:"custom",path:["config","operation"],message:"config operation must equal header operation"});}if(request.header.agentId!==request.config.agentId){ctx.addIssue({code:"custom",path:["config","agentId"],message:"config agentId must equal header agentId"});}if(isSecretOperation(request.header.operation)!==(request.sealed!==void 0)){ctx.addIssue({code:"custom",path:["sealed"],message:"a sealed secret is required exactly for configure and replace_secret"});}});var P256PublicJwkSchema=SealingPublicJwkSchema;var ECDSA_P256_SIGNATURE_BYTES=64;function invalidInput(message){return new ByokCoreError("sealed_secret_invalid",message)}function utf82(value){return new TextEncoder().encode(value)}function copy2(bytes){return new Uint8Array(bytes)}function concat2(...parts){const out=new Uint8Array(parts.reduce((total,part)=>total+part.byteLength,0));let offset=0;for(const part of parts){out.set(part,offset);offset+=part.byteLength;}return out}function hex(bytes){let out="";for(const byte of bytes)out+=byte.toString(16).padStart(2,"0");return out}function randomBytes(length){const source=globalThis.crypto;if(source?.getRandomValues===void 0){throw new ByokCoreError("webcrypto_unavailable","WebCrypto getRandomValues is unavailable in this runtime")}return source.getRandomValues(new Uint8Array(length))}async function sha256(bytes){return new Uint8Array(await webCryptoSubtle().digest("SHA-256",copy2(bytes)))}async function hmacSha2562(key,data){const subtle=webCryptoSubtle();const hmacKey=await subtle.importKey("raw",copy2(key),{name:"HMAC",hash:"SHA-256"},false,["sign"]);return new Uint8Array(await subtle.sign("HMAC",hmacKey,copy2(data)))}async function hkdfSha256(ikm,salt,info,length){const subtle=webCryptoSubtle();const key=await subtle.importKey("raw",copy2(ikm),{name:"HKDF"},false,["deriveBits"]);const bits=await subtle.deriveBits({name:"HKDF",hash:"SHA-256",salt:copy2(salt),info:utf82(info)},key,length*8);return new Uint8Array(bits)}function base64UrlBytes(bytes){return z.string().refine(value=>{try{return decodeBase64Url(value,"field").byteLength===bytes}catch{return false}},`must be canonical unpadded base64url of ${bytes} bytes`)}var ECDSA_P256={name:"ECDSA",namedCurve:"P-256"};var ECDSA_SHA256={name:"ECDSA",hash:"SHA-256"};function ecdsaSubtle(){return webCryptoSubtle()}async function p256PublicKeyBytes(publicJwk){const raw=sealingPublicKeyBytes(publicJwk);await importEcdsaPublicKey(publicJwk);return raw}async function importEcdsaPublicKey(publicJwk){const jwk=P256PublicJwkSchema.parse(publicJwk);try{return await ecdsaSubtle().importKey("jwk",{kty:jwk.kty,crv:jwk.crv,x:jwk.x,y:jwk.y},ECDSA_P256,true,["verify"])}catch(cause){throw new ByokCoreError("sealed_secret_invalid","P-256 public key is not a valid curve point",{cause})}}async function ecdsaSign(publicJwk,privateKey,data){let signature;try{signature=encodeBase64Url(new Uint8Array(await ecdsaSubtle().sign(ECDSA_SHA256,privateKey,copy2(data))));}catch(cause){throw new ByokCoreError("sealed_secret_invalid","Signing key is not an ECDSA P-256 private key",{cause})}if(!await ecdsaVerify(publicJwk,signature,data)){throw invalidInput("Signing private key does not pair with the signing public key")}return signature}async function ecdsaVerify(publicJwk,signature,data){let signatureBytes;try{signatureBytes=decodeBase64Url(signature,"sig");}catch{return false}if(signatureBytes.byteLength!==ECDSA_P256_SIGNATURE_BYTES)return false;const key=await importEcdsaPublicKey(publicJwk);return ecdsaSubtle().verify(ECDSA_SHA256,key,signatureBytes,copy2(data))}var MEMBER_ID_DOMAIN="byok-member-id-v1\n";var MEMBER_ID_PATTERN=/^[A-Za-z0-9_-]{43}$/u;var MEMBER_CHAIN_VERSION=1;var MEMBER_CHAIN_DOMAIN_PREFIX="byok-member-chain-v1\n";var MEMBER_CHAIN_OPS=["add","remove","rotate","scope-policy","shred"];var CanonicalJsonObjectSchema=z.unknown().transform((value,ctx)=>{try{if(value!==null&&typeof value==="object"&&!Array.isArray(value)){return JSON.parse(canonicalizeJson(value))}}catch{}ctx.addIssue({code:"custom",message:"must be a canonical JSON object"});return z.NEVER});var unsignedEntryShape={v:z.literal(MEMBER_CHAIN_VERSION),tenantId:z.string().min(1),seq:z.number().int().positive().max(Number.MAX_SAFE_INTEGER),prev:z.union([z.null(),z.string().regex(CONTENT_HASH_PATTERN)]),op:z.enum(MEMBER_CHAIN_OPS),subject:CanonicalJsonObjectSchema,signer:z.string().regex(MEMBER_ID_PATTERN)};function firstEntryHasNoPrev(entry,ctx){if(entry.seq===1!==(entry.prev===null)){ctx.addIssue({code:"custom",path:["prev"],message:"the first entry, and only the first, has no prev"});}}var UnsignedMemberChainEntryV1Schema=z.strictObject(unsignedEntryShape).superRefine(firstEntryHasNoPrev);var MemberChainEntryV1Schema=z.strictObject({...unsignedEntryShape,sig:base64UrlBytes(64)}).superRefine(firstEntryHasNoPrev);async function deriveMemberId(signingPublicJwk){const raw=await p256PublicKeyBytes(signingPublicJwk);return encodeBase64Url(await sha256(concat2(utf82(MEMBER_ID_DOMAIN),raw)))}function parseUnsignedEntry(entry){const parsed=safeParseTotal(UnsignedMemberChainEntryV1Schema,entry);if(!parsed.success)throw invalidInput("Member chain entry is invalid");return parsed.data}function signingInput(entry){return concat2(utf82(MEMBER_CHAIN_DOMAIN_PREFIX),canonicalizeJsonBytes({v:entry.v,tenantId:entry.tenantId,seq:entry.seq,prev:entry.prev,op:entry.op,subject:entry.subject,signer:entry.signer}))}function memberChainSigningInput(entry){return signingInput(parseUnsignedEntry(entry))}async function memberChainEntryHash(entry){return `sha256:${hex(await sha256(memberChainSigningInput(entry)))}`}async function signMemberChainEntry(entry,signer){const unsigned=parseUnsignedEntry(entry);if(await deriveMemberId(signer.publicJwk)!==unsigned.signer){throw invalidInput("Member chain entry signer does not match the signing key")}return {...unsigned,sig:await ecdsaSign(signer.publicJwk,signer.privateKey,signingInput(unsigned))}}async function verifyMemberChainEntry(entry,signerPublicJwk){const parsed=safeParseTotal(MemberChainEntryV1Schema,entry);if(!parsed.success||await deriveMemberId(signerPublicJwk)!==parsed.data.signer){return {ok:false,reason:"member_chain_entry_invalid"}}const input=signingInput(parsed.data);if(!await ecdsaVerify(signerPublicJwk,parsed.data.sig,input)){return {ok:false,reason:"member_chain_signature_invalid"}}return {ok:true,entry:parsed.data,hash:`sha256:${hex(await sha256(input))}`}}var MEMBER_KEY_BUNDLE_VERSION=1;var MEMBER_KEM_DOMAIN_PREFIX="byok-member-kem-v1\n";var KemEpochSchema=z.number().int().positive().max(Number.MAX_SAFE_INTEGER);var KemSigSchema=base64UrlBytes(64);var MemberKeyBundleV1Schema=z.strictObject({v:z.literal(MEMBER_KEY_BUNDLE_VERSION),memberId:z.string().regex(MEMBER_ID_PATTERN),signingPublicJwk:P256PublicJwkSchema,kemPublicJwk:P256PublicJwkSchema,kemEpoch:KemEpochSchema,kemSig:KemSigSchema,deviceId:z.string().min(1).optional()});var CreateInputSchema=z.object({signingPublicJwk:P256PublicJwkSchema,signingPrivateKey:z.custom(),kemPublicJwk:P256PublicJwkSchema,kemEpoch:KemEpochSchema,deviceId:z.string().min(1).optional()});var KemSignerSchema=z.object({memberId:z.string().regex(MEMBER_ID_PATTERN),signingPublicJwk:P256PublicJwkSchema});var KemStatementSchema=z.object({kemPublicJwk:P256PublicJwkSchema,kemEpoch:KemEpochSchema,kemSig:KemSigSchema});function memberKemSigningInput(memberId,kemPublicJwk,kemEpoch){return concat2(utf82(MEMBER_KEM_DOMAIN_PREFIX),canonicalizeJsonBytes({memberId,kemPublicKey:{x:kemPublicJwk.x,y:kemPublicJwk.y},kemEpoch}))}async function createMemberKeyBundle(input){const parsed=safeParseTotal(CreateInputSchema,input);if(!parsed.success)throw invalidInput("Member key bundle input is invalid");const{signingPublicJwk,signingPrivateKey,kemPublicJwk,kemEpoch,deviceId}=parsed.data;const memberId=await deriveMemberId(signingPublicJwk);if(!await isValidMemberKemKey(kemPublicJwk,signingPublicJwk))throw invalidInput("Member KEM key is invalid");const kemSig=await ecdsaSign(signingPublicJwk,signingPrivateKey,memberKemSigningInput(memberId,kemPublicJwk,kemEpoch));return {v:MEMBER_KEY_BUNDLE_VERSION,memberId,signingPublicJwk,kemPublicJwk,kemEpoch,kemSig,...deviceId===void 0?{}:{deviceId}}}async function isValidMemberKemKey(kemPublicJwk,signingPublicJwk){if(kemPublicJwk.x===signingPublicJwk.x&&kemPublicJwk.y===signingPublicJwk.y)return false;try{await p256PublicKeyBytes(kemPublicJwk);return true}catch{return false}}async function verifyMemberKem(member,kem){const signer=safeParseTotal(KemSignerSchema,member);const statement=safeParseTotal(KemStatementSchema,kem);if(!signer.success||!statement.success)return false;const{memberId,signingPublicJwk}=signer.data;const{kemPublicJwk,kemEpoch,kemSig}=statement.data;if(!await isValidMemberKemKey(kemPublicJwk,signingPublicJwk))return false;try{return await ecdsaVerify(signingPublicJwk,kemSig,memberKemSigningInput(memberId,kemPublicJwk,kemEpoch))}catch{return false}}async function parseMemberKeyBundle(value){const parsed=safeParseTotal(MemberKeyBundleV1Schema,value);if(!parsed.success)return void 0;const bundle=parsed.data;try{if(await deriveMemberId(bundle.signingPublicJwk)!==bundle.memberId)return void 0}catch{return void 0}if(!await verifyMemberKem(bundle,bundle))return void 0;return bundle}var SCOPE_KEY_BYTES=32;var SCOPE_KEY_ID_PATTERN=/^[A-Za-z0-9_-]{22}$/u;var KEY_ID_MESSAGE="byok-scope-key-id-v1";var CONTENT_KEY_INFO="byok-sdk.sealed.v1.enc";var MAC_KEY_INFO="byok-sdk.sealed.v1.mac";var SEALED_SALT_BYTES=32;var SCOPE_KEY_PACKAGE_VERSION=1;var SCOPE_KEY_HPKE_INFO="byok-sdk.scope-key.v1";var SCOPE_KEY_PACKAGE_DOMAIN_PREFIX="byok-scope-key-package-v1\n";var SCOPE_KEY_PACKAGE_V2=2;var SCOPE_KEY_HPKE_INFO_V2="byok-sdk.scope-key.v2";var SCOPE_KEY_PACKAGE_V2_DOMAIN_PREFIX="byok-scope-key-package-v2\n";var P256_POINT_BYTES=65;var AEAD_TAG_BYTES=16;function assertScopeKey(scopeKey){if(scopeKey.byteLength!==SCOPE_KEY_BYTES)throw invalidInput(`Scope key must be ${SCOPE_KEY_BYTES} bytes`)}function generateScopeKey(){return randomBytes(SCOPE_KEY_BYTES)}async function deriveScopeKeyId(scopeKey){assertScopeKey(scopeKey);const mac=await hmacSha2562(scopeKey,utf82(KEY_ID_MESSAGE));return encodeBase64Url(mac.subarray(0,16))}async function deriveSealedContentKey(scopeKey,salt){assertScopeKey(scopeKey);if(salt.byteLength!==SEALED_SALT_BYTES)throw invalidInput(`Sealed content salt must be ${SEALED_SALT_BYTES} bytes`);return hkdfSha256(scopeKey,salt,CONTENT_KEY_INFO,32)}async function deriveSealedMacKey(scopeKey){assertScopeKey(scopeKey);return hkdfSha256(scopeKey,new Uint8Array(32),MAC_KEY_INFO,32)}var ScopeKeyPackageV1Schema=z.strictObject({v:z.literal(SCOPE_KEY_PACKAGE_VERSION),tenantId:z.string().min(1),scopeId:z.string().min(1),epoch:z.number().int().positive().max(Number.MAX_SAFE_INTEGER),keyId:z.string().regex(SCOPE_KEY_ID_PATTERN),recipient:z.string().regex(MEMBER_ID_PATTERN),sender:z.string().regex(MEMBER_ID_PATTERN),enc:base64UrlBytes(P256_POINT_BYTES),ciphertext:base64UrlBytes(SCOPE_KEY_BYTES+AEAD_TAG_BYTES),sig:base64UrlBytes(64)});var ScopeKeyPackageV2Schema=z.strictObject({...ScopeKeyPackageV1Schema.shape,v:z.literal(SCOPE_KEY_PACKAGE_V2),recipientKemEpoch:KemEpochSchema});var ScopeKeyPackageSchema=z.union([ScopeKeyPackageV1Schema,ScopeKeyPackageV2Schema]);function packageAad({enc:_enc,ciphertext:_ciphertext,sig:_sig,...identity}){return canonicalizeJsonBytes(identity)}function packageSigningInput({sig:_sig,...pkg}){return concat2(utf82(pkg.v===SCOPE_KEY_PACKAGE_V2?SCOPE_KEY_PACKAGE_V2_DOMAIN_PREFIX:SCOPE_KEY_PACKAGE_DOMAIN_PREFIX),canonicalizeJsonBytes(pkg))}var PackageIdentitySchema=ScopeKeyPackageV2Schema.omit({enc:true,ciphertext:true,sig:true});async function sealScopeKeyPackage(input){const parsed=safeParseTotal(PackageIdentitySchema,{v:SCOPE_KEY_PACKAGE_V2,tenantId:input.tenantId,scopeId:input.scopeId,epoch:input.epoch,keyId:await deriveScopeKeyId(input.scopeKey),recipient:input.recipient.memberId,recipientKemEpoch:input.recipient.kemEpoch,sender:await deriveMemberId(input.sender.signingPublicJwk)});if(!parsed.success)throw invalidInput("Scope key package input is invalid");const identity=parsed.data;const{enc,ciphertext}=await hpkeSealBase({recipientPublicKey:await p256PublicKeyBytes(input.recipient.kemPublicJwk),info:utf82(SCOPE_KEY_HPKE_INFO_V2),aad:packageAad(identity),plaintext:input.scopeKey});const unsigned={...identity,enc:encodeBase64Url(enc),ciphertext:encodeBase64Url(ciphertext)};return {...unsigned,sig:await ecdsaSign(input.sender.signingPublicJwk,input.sender.signingPrivateKey,packageSigningInput(unsigned))}}async function openScopeKeyPackage(input){const parsed=safeParseTotal(ScopeKeyPackageSchema,input.package);if(!parsed.success)return {ok:false,reason:"key_package_invalid"};const pkg=parsed.data;if(pkg.recipient!==input.recipient.memberId||pkg.v===SCOPE_KEY_PACKAGE_V2&&pkg.recipientKemEpoch!==input.recipient.kemEpoch||pkg.tenantId!==input.expected.tenantId||pkg.scopeId!==input.expected.scopeId||pkg.epoch!==input.expected.epoch||pkg.sender!==await deriveMemberId(input.senderSigningPublicJwk)){return {ok:false,reason:"key_package_invalid"}}if(!await ecdsaVerify(input.senderSigningPublicJwk,pkg.sig,packageSigningInput(pkg))){return {ok:false,reason:"key_package_signature_invalid"}}let scopeKey;try{scopeKey=await hpkeOpenBase({recipientPrivateKey:input.recipient.kemPrivateKey,recipientPublicKey:await p256PublicKeyBytes(input.recipient.kemPublicJwk),enc:decodeBase64Url(pkg.enc,"enc"),info:utf82(pkg.v===SCOPE_KEY_PACKAGE_V2?SCOPE_KEY_HPKE_INFO_V2:SCOPE_KEY_HPKE_INFO),aad:packageAad(pkg),ciphertext:decodeBase64Url(pkg.ciphertext,"ciphertext")});}catch(error){if(error instanceof ByokCoreError)return {ok:false,reason:"key_package_open_failed"};throw error}if(scopeKey.byteLength!==SCOPE_KEY_BYTES||await deriveScopeKeyId(scopeKey)!==pkg.keyId){scopeKey.fill(0);return {ok:false,reason:"key_package_open_failed"}}return {ok:true,scopeKey,keyId:pkg.keyId}}function canonicalValue(value,seen){if(value===null)return "null";switch(typeof value){case "boolean":return value?"true":"false";case "string":return JSON.stringify(value);case "number":if(!Number.isFinite(value))throw invalidInput("Sealed plaintext holds a number with no JSON form");return String(value);case "object":break;default:throw invalidInput(`Sealed plaintext holds a ${typeof value}, which is not a JSON type`)}if(seen.has(value))throw invalidInput("Sealed plaintext holds a circular reference");seen.add(value);try{if(Array.isArray(value))return `[${Array.from(value,entry=>canonicalValue(entry,seen)).join(",")}]`;const prototype=Object.getPrototypeOf(value);if(prototype!==Object.prototype&&prototype!==null)throw invalidInput("Sealed plaintext holds an object that is not plain");const record=value;const members=Object.keys(record).sort().map(key=>`${JSON.stringify(key)}:${canonicalValue(record[key],seen)}`);return `{${members.join(",")}}`}finally{seen.delete(value);}}function canonicalizeSealedJson(value){return canonicalValue(value,new Set)}var SEALED_CONTENT_VERSION=1;var SEALED_CONTENT_SUITE="byok-sealed-v1.hkdf-sha256.aes-256-gcm";var SEALED_CATEGORIES=["task-input","agent-message","task-output","memory-projection"];var SEALED_DIRECTIONS=["server-to-daemon","daemon-to-server"];var SEALED_NONCE_BYTES=12;var AEAD_TAG_BYTES2=16;var FRAME_HEADER_BYTES=4;var ALIGNED_FRAME_LIMIT=16*1024;var FRAME_ALIGNMENT=256;var MAX_CONTENT_LENGTH=4294967295;var CONTENT_MAC_PREFIX="byok-content-mac-v1\n";var CONTENT_MAC_PATTERN=/^hmac-sha256:[0-9a-f]{64}$/u;var FAMILY_PATTERN=/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+$/u;var IDENTITY_FIELD_PATTERN=/^[a-z][A-Za-z0-9]*$/u;var ROUTINE_TEMPLATE_FAMILY="routine.template";function floorLog2(value){let exponent=0;for(let remaining=value;remaining>=2;remaining=Math.floor(remaining/2))exponent+=1;return exponent}function sealedPaddedLength(frameLength){if(!Number.isSafeInteger(frameLength)||frameLength<FRAME_HEADER_BYTES){throw invalidInput("Sealed frame length must be a safe integer of at least 4")}if(frameLength<=ALIGNED_FRAME_LIMIT)return Math.ceil(frameLength/FRAME_ALIGNMENT)*FRAME_ALIGNMENT;const exponent=floorLog2(frameLength);const step=2**(exponent-(floorLog2(exponent)+1));return Math.ceil(frameLength/step)*step}function isLegalPaddedLength(paddedLength){return Number.isSafeInteger(paddedLength)&&paddedLength>=FRAME_ALIGNMENT&&sealedPaddedLength(paddedLength)===paddedLength}function encodeSealedFrame(content){if(content.byteLength>MAX_CONTENT_LENGTH)throw invalidInput("Sealed content exceeds the 32-bit frame length");const frame=new Uint8Array(sealedPaddedLength(FRAME_HEADER_BYTES+content.byteLength));new DataView(frame.buffer).setUint32(0,content.byteLength,false);frame.set(content,FRAME_HEADER_BYTES);return frame}function decodeSealedFrame(frame,paddedLength,maxContentLength){if(frame.byteLength!==paddedLength||paddedLength<FRAME_HEADER_BYTES)return void 0;const contentLength=new DataView(frame.buffer,frame.byteOffset,frame.byteLength).getUint32(0,false);if(contentLength>paddedLength-FRAME_HEADER_BYTES)return void 0;if(sealedPaddedLength(FRAME_HEADER_BYTES+contentLength)!==paddedLength)return void 0;if(contentLength>maxContentLength)return void 0;for(let index=FRAME_HEADER_BYTES+contentLength;index<paddedLength;index+=1){if(frame[index]!==0)return void 0}return frame.subarray(FRAME_HEADER_BYTES,FRAME_HEADER_BYTES+contentLength)}var NonEmptyStringSchema=z.string().min(1);var PositiveIntegerSchema=z.number().int().positive().max(Number.MAX_SAFE_INTEGER);var SealedContentHeaderV1Schema=z.strictObject({v:z.literal(SEALED_CONTENT_VERSION),suite:z.literal(SEALED_CONTENT_SUITE),category:z.enum(SEALED_CATEGORIES),scope:z.strictObject({id:NonEmptyStringSchema,epoch:PositiveIntegerSchema,keyId:z.string().regex(SCOPE_KEY_ID_PATTERN)}),chainHead:z.strictObject({seq:PositiveIntegerSchema,hash:z.string().regex(CONTENT_HASH_PATTERN)}),sender:z.string().regex(MEMBER_ID_PATTERN),salt:base64UrlBytes(SEALED_SALT_BYTES),nonce:base64UrlBytes(SEALED_NONCE_BYTES),paddedLength:PositiveIntegerSchema.refine(isLegalPaddedLength,"must be a legal padded frame length"),contentMac:z.string().regex(CONTENT_MAC_PATTERN)});function isCanonicalCategoryList(categories){return categories.every((category,index)=>index===0||SEALED_CATEGORIES.indexOf(categories[index-1])<SEALED_CATEGORIES.indexOf(category))}var SealedBindingSchema=z.strictObject({tenantId:NonEmptyStringSchema,family:z.string().regex(FAMILY_PATTERN),direction:z.enum(SEALED_DIRECTIONS),identity:z.record(z.string().regex(IDENTITY_FIELD_PATTERN),z.union([NonEmptyStringSchema,z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER)])).refine(identity=>Object.keys(identity).length>0,"identity must name at least one field"),deviceId:z.union([z.null(),NonEmptyStringSchema]),agentRef:z.union([z.null(),z.strictObject({agentId:NonEmptyStringSchema,profileRevision:NonEmptyStringSchema})]),categories:z.array(z.enum(SEALED_CATEGORIES)).min(1).refine(isCanonicalCategoryList,"categories must be unique and in canonical order"),notAfter:z.union([z.null(),z.string().refine(isCanonicalTimestamp,"must be a canonical UTC instant")])}).superRefine((binding,ctx)=>{const template=binding.family===ROUTINE_TEMPLATE_FAMILY;if(binding.deviceId===null!==template||binding.notAfter===null===template){ctx.addIssue({code:"custom",path:["deviceId"],message:"a routine template binds an expiry and no device; every other family binds a device and no expiry"});}});function parseBinding(binding){const parsed=safeParseTotal(SealedBindingSchema,binding);if(!parsed.success)throw invalidInput("Sealed content binding is invalid");return parsed.data}function assertMaxContentLength(maxContentLength){if(!Number.isSafeInteger(maxContentLength)||maxContentLength<0||maxContentLength>MAX_CONTENT_LENGTH){throw invalidInput("Sealed content limit must be a non-negative 32-bit integer")}}function bindingAad(header,binding){return {v:header.v,suite:header.suite,category:header.category,tenantId:binding.tenantId,scopeId:header.scope.id,epoch:header.scope.epoch,keyId:header.scope.keyId,chainHead:{seq:header.chainHead.seq,hash:header.chainHead.hash},sender:header.sender,family:binding.family,direction:binding.direction,identity:binding.identity,deviceId:binding.deviceId,agentRef:binding.agentRef===null?null:{agentId:binding.agentRef.agentId,profileRevision:binding.agentRef.profileRevision},categories:[...binding.categories],notAfter:binding.notAfter}}function aadBytes(header,binding){return canonicalizeJsonBytes({...bindingAad(header,binding),paddedLength:header.paddedLength,contentMac:header.contentMac})}function isNonEmptyPlainObject(value){if(value===null||typeof value!=="object"||Array.isArray(value))return false;const prototype=Object.getPrototypeOf(value);return (prototype===Object.prototype||prototype===null)&&Object.keys(value).length>0}function canonicalPlaintext(plaintext){try{if(isNonEmptyPlainObject(plaintext))return canonicalizeSealedJson(plaintext)}catch(cause){throw new ByokCoreError("sealed_secret_invalid","Sealed plaintext is not canonical JSON",{cause})}throw invalidInput("Sealed plaintext must be a non-empty plain JSON object")}function parseCanonicalPlaintext(content){let text;let value;try{text=new TextDecoder("utf-8",{fatal:true,ignoreBOM:true}).decode(content);value=JSON.parse(text);if(!isNonEmptyPlainObject(value)||canonicalizeSealedJson(value)!==text)return void 0}catch{return void 0}return {value,text}}async function contentMacOf(scopeKey,category,binding,plaintextText){const macKey=await deriveSealedMacKey(scopeKey);try{const input=`${CONTENT_MAC_PREFIX}${category}
 ${binding.family}
 ${canonicalizeJson(binding.identity)}
-${plaintextText}`;
-    return `hmac-sha256:${hex(await hmacSha2562(macKey, utf82(input)))}`;
-  } finally {
-    macKey.fill(0);
-  }
-}
-async function aesGcm(mode, key, nonce, aad, data) {
-  const subtle = webCryptoSubtle();
-  const cryptoKey = await subtle.importKey("raw", copy2(key), { name: "AES-GCM" }, false, [mode]);
-  const params = { name: "AES-GCM", iv: copy2(nonce), additionalData: copy2(aad), tagLength: 128 };
-  const out = mode === "encrypt" ? await subtle.encrypt(params, cryptoKey, copy2(data)) : await subtle.decrypt(params, cryptoKey, copy2(data));
-  return new Uint8Array(out);
-}
-async function sealContent(input) {
-  return sealContentWithRandomness(input, { salt: randomBytes(SEALED_SALT_BYTES), nonce: randomBytes(SEALED_NONCE_BYTES) });
-}
-async function sealContentWithRandomness(input, randomness) {
-  const binding = parseBinding(input.binding);
-  assertMaxContentLength(input.maxContentLength);
-  if (!binding.categories.includes(input.category)) {
-    throw invalidInput("Sealed content category is not one of the task sealing categories");
-  }
-  const plaintextText = canonicalPlaintext(input.plaintext);
-  const content = utf82(plaintextText);
-  if (content.byteLength > input.maxContentLength) throw invalidInput("Sealed content exceeds its plaintext limit");
-  const frame = encodeSealedFrame(content);
-  const { salt, nonce } = randomness;
-  const parsed = safeParseTotal(SealedContentHeaderV1Schema, {
-    v: SEALED_CONTENT_VERSION,
-    suite: SEALED_CONTENT_SUITE,
-    category: input.category,
-    scope: { id: input.scope.id, epoch: input.scope.epoch, keyId: await deriveScopeKeyId(input.scopeKey) },
-    chainHead: { seq: input.chainHead.seq, hash: input.chainHead.hash },
-    sender: input.sender,
-    salt: encodeBase64Url(salt),
-    nonce: encodeBase64Url(nonce),
-    paddedLength: frame.byteLength,
-    contentMac: await contentMacOf(input.scopeKey, input.category, binding, plaintextText)
-  });
-  if (!parsed.success) throw invalidInput("Sealed content header input is invalid");
-  const contentKey = await deriveSealedContentKey(input.scopeKey, salt);
-  try {
-    const ciphertext = await aesGcm("encrypt", contentKey, nonce, aadBytes(parsed.data, binding), frame);
-    return { header: parsed.data, ciphertext };
-  } finally {
-    contentKey.fill(0);
-    frame.fill(0);
-    content.fill(0);
-  }
-}
-var SealedScopePolicySchema = z.strictObject({ scopeId: NonEmptyStringSchema, epoch: PositiveIntegerSchema });
-function failure(reason) {
-  return { ok: false, reason };
-}
-async function openSealedContent(input) {
-  assertMaxContentLength(input.maxContentLength);
-  const parsedBinding = safeParseTotal(SealedBindingSchema, input.binding);
-  const parsedSealing = safeParseTotal(SealedScopePolicySchema, input.sealing);
-  if (!parsedBinding.success || !parsedSealing.success) return failure("sealing_policy_mismatch");
-  const binding = parsedBinding.data;
-  const sealing = parsedSealing.data;
-  const parsed = safeParseTotal(SealedContentHeaderV1Schema, input.header);
-  if (!parsed.success) return failure("sealed_open_failed");
-  const header = parsed.data;
-  if (!binding.categories.includes(header.category) || header.scope.id !== sealing.scopeId || header.scope.epoch < sealing.epoch) {
-    return failure("sealing_policy_mismatch");
-  }
-  if (await deriveScopeKeyId(input.scopeKey) !== header.scope.keyId) return failure("sealed_key_unavailable");
-  if (input.ciphertext.byteLength !== header.paddedLength + AEAD_TAG_BYTES2) return failure("sealed_open_failed");
-  const contentKey = await deriveSealedContentKey(input.scopeKey, decodeBase64Url(header.salt, "salt"));
-  let frame;
-  try {
-    frame = await aesGcm("decrypt", contentKey, decodeBase64Url(header.nonce, "nonce"), aadBytes(header, binding), input.ciphertext);
-  } catch {
-    return failure("sealed_open_failed");
-  } finally {
-    contentKey.fill(0);
-  }
-  try {
-    const content = decodeSealedFrame(frame, header.paddedLength, input.maxContentLength);
-    const plaintext = content === void 0 ? void 0 : parseCanonicalPlaintext(content);
-    if (plaintext === void 0) return failure("sealed_open_failed");
-    if (await contentMacOf(input.scopeKey, header.category, binding, plaintext.text) !== header.contentMac) {
-      return failure("sealed_content_mac_mismatch");
-    }
-    return { ok: true, plaintext: plaintext.value, header };
-  } finally {
-    frame.fill(0);
-  }
-}
-var MEMBER_KEY_RECORD_VERSION = 1;
-var PrivateJwkSchema = z.strictObject({
-  kty: z.literal("EC"),
-  crv: z.literal("P-256"),
-  x: base64UrlBytes(32),
-  y: base64UrlBytes(32),
-  d: base64UrlBytes(32)
-});
-var KemEpochSchema2 = z.number().int().positive().max(Number.MAX_SAFE_INTEGER);
-var MemberKeyRecordV1Schema = z.strictObject({
-  v: z.literal(MEMBER_KEY_RECORD_VERSION),
-  tenantId: z.string().min(1),
-  deviceId: z.string().min(1).optional(),
-  signingJwk: PrivateJwkSchema,
-  kemEpoch: KemEpochSchema2,
-  kemJwk: PrivateJwkSchema,
-  nextKem: z.strictObject({ epoch: KemEpochSchema2, jwk: PrivateJwkSchema }).optional()
-}).refine((record) => record.nextKem === void 0 || record.nextKem.epoch === record.kemEpoch + 1);
-var BindingSchema = z.object({ tenantId: z.string().min(1), deviceId: z.string().min(1).optional() });
-function keySubtle() {
-  return webCryptoSubtle();
-}
-var ECDSA_P2562 = { name: "ECDSA", namedCurve: "P-256" };
-var ECDSA_SHA2562 = { name: "ECDSA", hash: "SHA-256" };
-var ECDH_P256 = { name: "ECDH", namedCurve: "P-256" };
-async function generatePrivateJwk(algorithm, usages) {
-  const pair = await keySubtle().generateKey(algorithm, true, usages);
-  const { kty, crv, x, y, d } = await keySubtle().exportKey("jwk", pair.privateKey);
-  return PrivateJwkSchema.parse({ kty, crv, x, y, d });
-}
-async function generateMemberKeyRecord(binding) {
-  const parsed = safeParseTotal(BindingSchema, binding);
-  if (!parsed.success) throw invalidInput("Member key binding is invalid");
-  const { tenantId, deviceId } = parsed.data;
-  return canonicalizeJson({
-    v: MEMBER_KEY_RECORD_VERSION,
-    tenantId,
-    ...deviceId === void 0 ? {} : { deviceId },
-    signingJwk: await generatePrivateJwk(ECDSA_P2562, ["sign", "verify"]),
-    kemEpoch: 1,
-    kemJwk: await generatePrivateJwk(ECDH_P256, ["deriveBits"])
-  });
-}
-function publicJwkOf(jwk) {
-  return P256PublicJwkSchema.parse({ kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y });
-}
-function bytesEqual(left, right) {
-  const a = new Uint8Array(left);
-  const b = new Uint8Array(right);
-  return a.length === b.length && a.every((byte, index) => byte === b[index]);
-}
-async function importSigningKey(jwk) {
-  const subtle = keySubtle();
-  const publicJwk = publicJwkOf(jwk);
-  const privateKey = await subtle.importKey("jwk", { ...jwk, ext: false }, ECDSA_P2562, false, ["sign"]);
-  const publicKey = await subtle.importKey("jwk", publicJwk, ECDSA_P2562, true, ["verify"]);
-  const probe = randomBytes(32);
-  if (!await subtle.verify(ECDSA_SHA2562, publicKey, await subtle.sign(ECDSA_SHA2562, privateKey, probe), probe)) {
-    throw new TypeError("signing scalar does not match its public point");
-  }
-  return { publicJwk, privateKey };
-}
-async function importKemKey(jwk) {
-  const subtle = keySubtle();
-  const publicJwk = publicJwkOf(jwk);
-  const privateKey = await subtle.importKey("jwk", { ...jwk, ext: false }, ECDH_P256, false, ["deriveBits"]);
-  const publicKey = await subtle.importKey("jwk", publicJwk, ECDH_P256, true, []);
-  const probe = await subtle.generateKey(ECDH_P256, false, ["deriveBits"]);
-  const viaMember = await subtle.deriveBits({ name: "ECDH", public: probe.publicKey }, privateKey, 256);
-  const viaProbe = await subtle.deriveBits({ name: "ECDH", public: publicKey }, probe.privateKey, 256);
-  if (!bytesEqual(viaMember, viaProbe)) throw new TypeError("KEM scalar does not match its public point");
-  return { publicJwk, privateKey };
-}
-async function openMemberKeyRecord(text) {
-  const record = parseRecord(text);
-  if (record === void 0) return void 0;
-  try {
-    const signing = await importSigningKey(record.signingJwk);
-    const kem = { epoch: record.kemEpoch, ...await importKemKey(record.kemJwk) };
-    const binding = record.deviceId === void 0 ? { tenantId: record.tenantId } : { tenantId: record.tenantId, deviceId: record.deviceId };
-    if (record.nextKem === void 0) return { binding, signing, kem };
-    return { binding, signing, kem, nextKem: { epoch: record.nextKem.epoch, ...await importKemKey(record.nextKem.jwk) } };
-  } catch {
-    return void 0;
-  }
-}
-async function beginMemberKemRotation(text) {
-  const record = parseRecord(text);
-  if (record === void 0) throw invalidInput("Member key record is invalid");
-  if (record.nextKem !== void 0) return text;
-  return canonicalizeJson({ ...record, nextKem: { epoch: record.kemEpoch + 1, jwk: await generatePrivateJwk(ECDH_P256, ["deriveBits"]) } });
-}
-function finishMemberKemRotation(text, epoch) {
-  const record = parseRecord(text);
-  if (record === void 0) throw invalidInput("Member key record is invalid");
-  if (record.nextKem === void 0) return record.kemEpoch === epoch ? text : void 0;
-  if (record.nextKem.epoch !== epoch) return void 0;
-  const { nextKem, ...rest } = record;
-  return canonicalizeJson({ ...rest, kemEpoch: nextKem.epoch, kemJwk: nextKem.jwk });
-}
-function parseRecord(text) {
-  if (typeof text !== "string") return void 0;
-  try {
-    const parsed = safeParseTotal(MemberKeyRecordV1Schema, JSON.parse(text));
-    return parsed.success && canonicalizeJson(parsed.data) === text ? parsed.data : void 0;
-  } catch {
-    return void 0;
-  }
-}
-var MEMBER_FINGERPRINT_DOMAIN = "byok-member-fingerprint-v1\n";
-var FINGERPRINT_GROUPS = 5;
-var GROUP_BYTES = 5;
-var GROUP_MODULUS = 100000n;
-var FingerprintInputSchema = z.object({ tenantId: z.string().min(1), signingPublicJwk: P256PublicJwkSchema });
-async function memberFingerprint(input) {
-  return (await fingerprintGroups(input)).groups.join(" ");
-}
-async function memberApprovalCode(tenantId, first, second) {
-  const members = await Promise.all([first, second].map((signingPublicJwk) => fingerprintGroups({ tenantId, signingPublicJwk })));
-  if (members[0].memberId === members[1].memberId) throw invalidInput("An approval code needs two different members");
-  members.sort((a, b) => a.memberId < b.memberId ? -1 : 1);
-  return members.flatMap((member) => member.groups).join(" ");
-}
-async function fingerprintGroups(input) {
-  const parsed = safeParseTotal(FingerprintInputSchema, input);
-  if (!parsed.success) throw invalidInput("Member fingerprint needs a tenant id and a P-256 signing key");
-  const { tenantId, signingPublicJwk } = parsed.data;
-  const memberId = await deriveMemberId(signingPublicJwk);
-  const digest = await sha256(
-    concat2(
-      utf82(MEMBER_FINGERPRINT_DOMAIN),
-      canonicalizeJsonBytes({ v: 1, tenantId, signingKey: { x: signingPublicJwk.x, y: signingPublicJwk.y } })
-    )
-  );
-  const groups = [];
-  for (let group = 0; group < FINGERPRINT_GROUPS; group += 1) {
-    let value = 0n;
-    for (const byte of digest.subarray(group * GROUP_BYTES, (group + 1) * GROUP_BYTES)) value = value << 8n | BigInt(byte);
-    groups.push((value % GROUP_MODULUS).toString().padStart(5, "0"));
-  }
-  return { memberId, groups };
-}
-var PAIRING_VERIFICATION_SECRET_BYTES = 16;
-var PAIRING_VERIFICATION_TEXT_LENGTH = 26;
-var BASE32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
-var PV_TEXT_PATTERN = /^[A-Za-z2-7]{26}$/u;
-function generatePairingVerificationSecret() {
-  return randomBytes(PAIRING_VERIFICATION_SECRET_BYTES);
-}
-function encodePairingVerificationSecret(pv) {
-  if (pv.byteLength !== PAIRING_VERIFICATION_SECRET_BYTES) {
-    throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_SECRET_BYTES} bytes`);
-  }
-  let out = "";
-  let buffer = 0;
-  let bits = 0;
-  for (const byte of pv) {
-    buffer = buffer << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      bits -= 5;
-      out += BASE32_ALPHABET[buffer >>> bits & 31];
-    }
-    buffer &= (1 << bits) - 1;
-  }
-  return out + BASE32_ALPHABET[buffer << 5 - bits & 31];
-}
-function decodePairingVerificationSecret(text) {
-  if (!PV_TEXT_PATTERN.test(text)) {
-    throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_TEXT_LENGTH} base32 characters`);
-  }
-  const upper = text.toUpperCase();
-  const out = new Uint8Array(PAIRING_VERIFICATION_SECRET_BYTES);
-  let buffer = 0;
-  let bits = 0;
-  let index = 0;
-  for (const char of upper) {
-    buffer = buffer << 5 | BASE32_ALPHABET.indexOf(char);
-    bits += 5;
-    if (bits >= 8) {
-      bits -= 8;
-      out[index++] = buffer >>> bits & 255;
-    }
-    buffer &= (1 << bits) - 1;
-  }
-  if (buffer !== 0) throw invalidInput("Pairing verification secret has nonzero trailing bits");
-  return out;
-}
-function formatPairingInput(pairingCode, pv) {
-  if (pairingCode.length === 0) throw invalidInput("Pairing code must not be empty");
-  return `${pairingCode}.${encodePairingVerificationSecret(pv)}`;
-}
-function parsePairingInput(text) {
-  const dot = text.lastIndexOf(".");
-  if (dot <= 0) throw invalidInput("Pairing input must be <pairing code>.<verification secret>");
-  return { pairingCode: text.slice(0, dot), pv: decodePairingVerificationSecret(text.slice(dot + 1)) };
-}
-var DEVICE_PAIRING_MAC_DOMAIN = "byok-pairing-device-mac-v1\n";
-var CLIENT_PAIRING_MAC_DOMAIN = "byok-pairing-client-mac-v1\n";
-var PairingMacSchema = base64UrlBytes(32);
-var ChainHeadSchema = z.strictObject({
-  seq: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
-  hash: z.string().regex(CONTENT_HASH_PATTERN)
-});
-var DeviceMacInputSchema = z.object({ tenantId: z.string().min(1), deviceId: z.string().min(1), member: MemberKeyBundleV1Schema });
-var ClientMacInputSchema = z.object({ member: MemberKeyBundleV1Schema, chainHead: ChainHeadSchema });
-function devicePairingMacInput(input) {
-  const parsed = safeParseTotal(DeviceMacInputSchema, input);
-  if (!parsed.success || parsed.data.member.deviceId !== parsed.data.deviceId) {
-    throw invalidInput("Device pairing MAC input must name the device member's own device id");
-  }
-  const { tenantId, deviceId, member } = parsed.data;
-  return concat2(utf82(DEVICE_PAIRING_MAC_DOMAIN), canonicalizeJsonBytes({ tenantId, deviceId, member }));
-}
-function clientPairingMacInput(input) {
-  const parsed = safeParseTotal(ClientMacInputSchema, input);
-  if (!parsed.success || parsed.data.member.deviceId !== void 0) {
-    throw invalidInput("Client pairing MAC input must hold a client member and a chain head");
-  }
-  const { member, chainHead } = parsed.data;
-  return concat2(utf82(CLIENT_PAIRING_MAC_DOMAIN), canonicalizeJsonBytes({ member, chainHead: { seq: chainHead.seq, hash: chainHead.hash } }));
-}
-function checkPv(pv) {
-  if (pv.byteLength !== PAIRING_VERIFICATION_SECRET_BYTES) {
-    throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_SECRET_BYTES} bytes`);
-  }
-}
-async function computeDevicePairingMac(pv, input) {
-  checkPv(pv);
-  return encodeBase64Url(await hmacSha2562(pv, devicePairingMacInput(input)));
-}
-async function computeClientPairingMac(pv, input) {
-  checkPv(pv);
-  return encodeBase64Url(await hmacSha2562(pv, clientPairingMacInput(input)));
-}
-async function verifyDevicePairingMac(pv, input, mac) {
-  checkPv(pv);
-  return hmacVerify(pv, () => devicePairingMacInput(input), mac);
-}
-async function verifyClientPairingMac(pv, input, mac) {
-  checkPv(pv);
-  return hmacVerify(pv, () => clientPairingMacInput(input), mac);
-}
-async function hmacVerify(key, buildData, mac) {
-  const parsed = safeParseTotal(PairingMacSchema, mac);
-  if (!parsed.success) return false;
-  let data;
-  try {
-    data = buildData();
-  } catch {
-    return false;
-  }
-  const subtle = webCryptoSubtle();
-  const hmacKey = await subtle.importKey("raw", copy2(key), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
-  return subtle.verify("HMAC", hmacKey, decodeBase64Url(parsed.data, "mac"), data);
-}
-var MemberIdSchema = z.string().regex(MEMBER_ID_PATTERN);
-var ScopeIdSchema = z.string().min(1);
-var AddSubjectSchema = z.strictObject({ member: z.unknown() });
-var RemoveSubjectSchema = z.strictObject({ memberId: MemberIdSchema });
-var RotateSubjectSchema = z.strictObject({
-  memberId: MemberIdSchema,
-  kemPublicJwk: P256PublicJwkSchema,
-  kemEpoch: KemEpochSchema,
-  kemSig: KemSigSchema
-});
-var ScopePolicySubjectSchema = z.strictObject({
-  scopeId: ScopeIdSchema,
-  categories: z.array(z.enum(SEALED_CATEGORIES)).min(1),
-  members: z.array(MemberIdSchema).min(1)
-});
-var ShredSubjectSchema = z.strictObject({ scopeId: ScopeIdSchema });
-var SignerSchema = z.object({ signer: MemberIdSchema });
-var GenesisSchema = z.object({ op: z.literal("add"), subject: AddSubjectSchema });
-var HeadSchema = z.object({ seq: z.number(), hash: z.string() });
-var EntriesSchema = z.array(z.unknown());
-var AnchorInputSchema = z.object({
-  tenantId: z.string(),
-  entries: EntriesSchema,
-  self: z.unknown(),
-  approverSigningPublicJwk: P256PublicJwkSchema,
-  authenticatedHead: z.unknown().optional()
-});
-function emptyMemberChainState(tenantId) {
-  return { tenantId, head: null, members: /* @__PURE__ */ new Map(), removed: /* @__PURE__ */ new Set(), scopes: /* @__PURE__ */ new Map(), shredded: /* @__PURE__ */ new Set() };
-}
-function memberChainScopeRecipients(state, scopeId) {
-  const scope = state.scopes.get(scopeId);
-  if (scope === void 0) return [];
-  return scope.members.flatMap((memberId) => {
-    const member = state.members.get(memberId);
-    return member === void 0 ? [] : [member];
-  });
-}
-async function applyMemberChainEntries(state, entries) {
-  const list = safeParseTotal(EntriesSchema, entries);
-  if (!list.success) return { ok: false, reason: "member_chain_entry_invalid", index: 0 };
-  const result = await walk(state, list.data, () => false);
-  return result.ok ? { ok: true, state: result.state } : result;
-}
-async function genesisSigner(state, raw, signer) {
-  if (state.head !== null || state.members.size > 0) return void 0;
-  const entry = safeParseTotal(GenesisSchema, raw);
-  const member = entry.success ? await parseMemberKeyBundle(entry.data.subject.member) : void 0;
-  return member !== void 0 && member.memberId === signer ? member : void 0;
-}
-async function walk(state, entries, mark) {
-  const next = {
-    tenantId: state.tenantId,
-    head: state.head,
-    members: new Map(state.members),
-    removed: new Set(state.removed),
-    scopes: new Map(state.scopes),
-    shredded: new Set(state.shredded)
-  };
-  let marked;
-  for (const [index, raw] of entries.entries()) {
-    const signer = safeParseTotal(SignerSchema, raw);
-    if (!signer.success) return { ok: false, reason: "member_chain_entry_invalid", index };
-    const signerBundle = next.members.get(signer.data.signer) ?? await genesisSigner(next, raw, signer.data.signer);
-    if (signerBundle === void 0) return { ok: false, reason: "member_chain_signer_invalid", index };
-    const verified = await verifyMemberChainEntry(raw, signerBundle.signingPublicJwk);
-    if (!verified.ok) return { ok: false, reason: verified.reason, index };
-    const entry = verified.entry;
-    const expected = next.head === null ? { seq: 1, prev: null } : { seq: next.head.seq + 1, prev: next.head.hash };
-    if (entry.tenantId !== next.tenantId || entry.seq !== expected.seq || entry.prev !== expected.prev) {
-      return { ok: false, reason: "member_chain_link_invalid", index };
-    }
-    if (marked === void 0 && mark(entry, signerBundle.signingPublicJwk)) marked = { index, seq: entry.seq, hash: verified.hash };
-    const applied = await applySubject(next, entry);
-    if (applied !== true) return { ok: false, reason: applied === false ? "member_chain_subject_invalid" : applied, index };
-    next.head = { seq: entry.seq, hash: verified.hash };
-  }
-  return { ok: true, state: next, marked };
-}
-async function applySubject(state, entry) {
-  switch (entry.op) {
-    case "add": {
-      const subject = safeParseTotal(AddSubjectSchema, entry.subject);
-      const member = subject.success ? await parseMemberKeyBundle(subject.data.member) : void 0;
-      if (member === void 0 || state.members.has(member.memberId) || state.removed.has(member.memberId)) return false;
-      state.members.set(member.memberId, member);
-      return true;
-    }
-    case "remove": {
-      const subject = safeParseTotal(RemoveSubjectSchema, entry.subject);
-      if (!subject.success || !state.members.has(subject.data.memberId) || state.members.size === 1) return false;
-      state.members.delete(subject.data.memberId);
-      state.removed.add(subject.data.memberId);
-      return true;
-    }
-    case "rotate": {
-      const subject = safeParseTotal(RotateSubjectSchema, entry.subject);
-      if (!subject.success || subject.data.memberId !== entry.signer) return false;
-      const member = state.members.get(subject.data.memberId);
-      if (member === void 0 || subject.data.kemEpoch !== member.kemEpoch + 1) return false;
-      const { kemPublicJwk } = subject.data;
-      if (kemPublicJwk.x === member.kemPublicJwk.x && kemPublicJwk.y === member.kemPublicJwk.y) return false;
-      if (!await verifyMemberKem(member, subject.data)) return false;
-      state.members.set(member.memberId, {
-        ...member,
-        kemPublicJwk: subject.data.kemPublicJwk,
-        kemEpoch: subject.data.kemEpoch,
-        kemSig: subject.data.kemSig
-      });
-      return true;
-    }
-    case "scope-policy": {
-      const subject = safeParseTotal(ScopePolicySubjectSchema, entry.subject);
-      if (!subject.success || state.shredded.has(subject.data.scopeId)) return false;
-      const { categories, members } = subject.data;
-      if (!strictlyIncreasing(categories.map((category) => SEALED_CATEGORIES.indexOf(category)))) return false;
-      if (!strictlyIncreasing(members) || !members.every((memberId) => state.members.has(memberId))) return false;
-      if (!(state.scopes.get(subject.data.scopeId)?.members ?? members).includes(entry.signer)) return "member_chain_signer_invalid";
-      state.scopes.set(subject.data.scopeId, { categories, members, policySeq: entry.seq });
-      return true;
-    }
-    case "shred": {
-      const subject = safeParseTotal(ShredSubjectSchema, entry.subject);
-      if (!subject.success) return false;
-      const scope = state.scopes.get(subject.data.scopeId);
-      if (scope === void 0) return false;
-      if (!scope.members.includes(entry.signer)) return "member_chain_signer_invalid";
-      state.scopes.delete(subject.data.scopeId);
-      state.shredded.add(subject.data.scopeId);
-      return true;
-    }
-  }
-}
-function strictlyIncreasing(values) {
-  return values.every((value, index) => index === 0 || values[index - 1] < value);
-}
-async function verifyMemberChainFromAnchor(input) {
-  const parsed = safeParseTotal(AnchorInputSchema, input);
-  if (!parsed.success) return { ok: false, reason: "member_chain_anchor_missing" };
-  const { tenantId, entries, self, approverSigningPublicJwk: approver, authenticatedHead } = parsed.data;
-  let approverId;
-  let selfText;
-  try {
-    approverId = await deriveMemberId(approver);
-    selfText = canonicalizeJson(self);
-  } catch {
-    return { ok: false, reason: "member_chain_anchor_missing" };
-  }
-  const isAnchor = (entry, signerKey) => {
-    if (entry.op !== "add" || entry.signer !== approverId || signerKey.x !== approver.x || signerKey.y !== approver.y) return false;
-    try {
-      return canonicalizeJson(entry.subject.member) === selfText;
-    } catch {
-      return false;
-    }
-  };
-  const outcome = await walk(emptyMemberChainState(tenantId), entries, isAnchor);
-  if (!outcome.ok) return outcome;
-  const anchor = outcome.marked;
-  if (anchor === void 0) return { ok: false, reason: "member_chain_anchor_missing" };
-  if (authenticatedHead !== void 0) {
-    const head = safeParseTotal(HeadSchema, authenticatedHead);
-    if (!head.success || head.data.seq !== anchor.seq || head.data.hash !== anchor.hash) {
-      return { ok: false, reason: "member_chain_head_mismatch", index: anchor.index };
-    }
-  }
-  return { ok: true, state: outcome.state, anchorSeq: anchor.seq };
-}
+${plaintextText}`;return `hmac-sha256:${hex(await hmacSha2562(macKey,utf82(input)))}`}finally{macKey.fill(0);}}async function aesGcm(mode,key,nonce,aad,data){const subtle=webCryptoSubtle();const cryptoKey=await subtle.importKey("raw",copy2(key),{name:"AES-GCM"},false,[mode]);const params={name:"AES-GCM",iv:copy2(nonce),additionalData:copy2(aad),tagLength:128};const out=mode==="encrypt"?await subtle.encrypt(params,cryptoKey,copy2(data)):await subtle.decrypt(params,cryptoKey,copy2(data));return new Uint8Array(out)}async function sealContent(input){return sealContentWithRandomness(input,{salt:randomBytes(SEALED_SALT_BYTES),nonce:randomBytes(SEALED_NONCE_BYTES)})}async function sealContentWithRandomness(input,randomness){const binding=parseBinding(input.binding);assertMaxContentLength(input.maxContentLength);if(!binding.categories.includes(input.category)){throw invalidInput("Sealed content category is not one of the task sealing categories")}const plaintextText=canonicalPlaintext(input.plaintext);const content=utf82(plaintextText);if(content.byteLength>input.maxContentLength)throw invalidInput("Sealed content exceeds its plaintext limit");const frame=encodeSealedFrame(content);const{salt,nonce}=randomness;const parsed=safeParseTotal(SealedContentHeaderV1Schema,{v:SEALED_CONTENT_VERSION,suite:SEALED_CONTENT_SUITE,category:input.category,scope:{id:input.scope.id,epoch:input.scope.epoch,keyId:await deriveScopeKeyId(input.scopeKey)},chainHead:{seq:input.chainHead.seq,hash:input.chainHead.hash},sender:input.sender,salt:encodeBase64Url(salt),nonce:encodeBase64Url(nonce),paddedLength:frame.byteLength,contentMac:await contentMacOf(input.scopeKey,input.category,binding,plaintextText)});if(!parsed.success)throw invalidInput("Sealed content header input is invalid");const contentKey=await deriveSealedContentKey(input.scopeKey,salt);try{const ciphertext=await aesGcm("encrypt",contentKey,nonce,aadBytes(parsed.data,binding),frame);return {header:parsed.data,ciphertext}}finally{contentKey.fill(0);frame.fill(0);content.fill(0);}}var SealedScopePolicySchema=z.strictObject({scopeId:NonEmptyStringSchema,epoch:PositiveIntegerSchema});function failure(reason){return {ok:false,reason}}async function openSealedContent(input){assertMaxContentLength(input.maxContentLength);const parsedBinding=safeParseTotal(SealedBindingSchema,input.binding);const parsedSealing=safeParseTotal(SealedScopePolicySchema,input.sealing);if(!parsedBinding.success||!parsedSealing.success)return failure("sealing_policy_mismatch");const binding=parsedBinding.data;const sealing=parsedSealing.data;const parsed=safeParseTotal(SealedContentHeaderV1Schema,input.header);if(!parsed.success)return failure("sealed_open_failed");const header=parsed.data;if(!binding.categories.includes(header.category)||header.scope.id!==sealing.scopeId||header.scope.epoch<sealing.epoch){return failure("sealing_policy_mismatch")}if(await deriveScopeKeyId(input.scopeKey)!==header.scope.keyId)return failure("sealed_key_unavailable");if(input.ciphertext.byteLength!==header.paddedLength+AEAD_TAG_BYTES2)return failure("sealed_open_failed");const contentKey=await deriveSealedContentKey(input.scopeKey,decodeBase64Url(header.salt,"salt"));let frame;try{frame=await aesGcm("decrypt",contentKey,decodeBase64Url(header.nonce,"nonce"),aadBytes(header,binding),input.ciphertext);}catch{return failure("sealed_open_failed")}finally{contentKey.fill(0);}try{const content=decodeSealedFrame(frame,header.paddedLength,input.maxContentLength);const plaintext=content===void 0?void 0:parseCanonicalPlaintext(content);if(plaintext===void 0)return failure("sealed_open_failed");if(await contentMacOf(input.scopeKey,header.category,binding,plaintext.text)!==header.contentMac){return failure("sealed_content_mac_mismatch")}return {ok:true,plaintext:plaintext.value,header}}finally{frame.fill(0);}}var MEMBER_KEY_RECORD_VERSION=1;var PrivateJwkSchema=z.strictObject({kty:z.literal("EC"),crv:z.literal("P-256"),x:base64UrlBytes(32),y:base64UrlBytes(32),d:base64UrlBytes(32)});var KemEpochSchema2=z.number().int().positive().max(Number.MAX_SAFE_INTEGER);var MemberKeyRecordV1Schema=z.strictObject({v:z.literal(MEMBER_KEY_RECORD_VERSION),tenantId:z.string().min(1),deviceId:z.string().min(1).optional(),signingJwk:PrivateJwkSchema,kemEpoch:KemEpochSchema2,kemJwk:PrivateJwkSchema,nextKem:z.strictObject({epoch:KemEpochSchema2,jwk:PrivateJwkSchema}).optional()}).refine(record=>record.nextKem===void 0||record.nextKem.epoch===record.kemEpoch+1);var BindingSchema=z.object({tenantId:z.string().min(1),deviceId:z.string().min(1).optional()});function keySubtle(){return webCryptoSubtle()}var ECDSA_P2562={name:"ECDSA",namedCurve:"P-256"};var ECDSA_SHA2562={name:"ECDSA",hash:"SHA-256"};var ECDH_P256={name:"ECDH",namedCurve:"P-256"};async function generatePrivateJwk(algorithm,usages){const pair=await keySubtle().generateKey(algorithm,true,usages);const{kty,crv,x,y,d}=await keySubtle().exportKey("jwk",pair.privateKey);return PrivateJwkSchema.parse({kty,crv,x,y,d})}async function generateMemberKeyRecord(binding){const parsed=safeParseTotal(BindingSchema,binding);if(!parsed.success)throw invalidInput("Member key binding is invalid");const{tenantId,deviceId}=parsed.data;return canonicalizeJson({v:MEMBER_KEY_RECORD_VERSION,tenantId,...deviceId===void 0?{}:{deviceId},signingJwk:await generatePrivateJwk(ECDSA_P2562,["sign","verify"]),kemEpoch:1,kemJwk:await generatePrivateJwk(ECDH_P256,["deriveBits"])})}function publicJwkOf(jwk){return P256PublicJwkSchema.parse({kty:jwk.kty,crv:jwk.crv,x:jwk.x,y:jwk.y})}function bytesEqual(left,right){const a=new Uint8Array(left);const b=new Uint8Array(right);return a.length===b.length&&a.every((byte,index)=>byte===b[index])}async function importSigningKey(jwk){const subtle=keySubtle();const publicJwk=publicJwkOf(jwk);const privateKey=await subtle.importKey("jwk",{...jwk,ext:false},ECDSA_P2562,false,["sign"]);const publicKey=await subtle.importKey("jwk",publicJwk,ECDSA_P2562,true,["verify"]);const probe=randomBytes(32);if(!await subtle.verify(ECDSA_SHA2562,publicKey,await subtle.sign(ECDSA_SHA2562,privateKey,probe),probe)){throw new TypeError("signing scalar does not match its public point")}return {publicJwk,privateKey}}async function importKemKey(jwk){const subtle=keySubtle();const publicJwk=publicJwkOf(jwk);const privateKey=await subtle.importKey("jwk",{...jwk,ext:false},ECDH_P256,false,["deriveBits"]);const publicKey=await subtle.importKey("jwk",publicJwk,ECDH_P256,true,[]);const probe=await subtle.generateKey(ECDH_P256,false,["deriveBits"]);const viaMember=await subtle.deriveBits({name:"ECDH",public:probe.publicKey},privateKey,256);const viaProbe=await subtle.deriveBits({name:"ECDH",public:publicKey},probe.privateKey,256);if(!bytesEqual(viaMember,viaProbe))throw new TypeError("KEM scalar does not match its public point");return {publicJwk,privateKey}}async function openMemberKeyRecord(text){const record=parseRecord(text);if(record===void 0)return void 0;try{const signing=await importSigningKey(record.signingJwk);const kem={epoch:record.kemEpoch,...await importKemKey(record.kemJwk)};const binding=record.deviceId===void 0?{tenantId:record.tenantId}:{tenantId:record.tenantId,deviceId:record.deviceId};if(record.nextKem===void 0)return {binding,signing,kem};return {binding,signing,kem,nextKem:{epoch:record.nextKem.epoch,...await importKemKey(record.nextKem.jwk)}}}catch{return void 0}}async function beginMemberKemRotation(text){const record=parseRecord(text);if(record===void 0)throw invalidInput("Member key record is invalid");if(record.nextKem!==void 0)return text;return canonicalizeJson({...record,nextKem:{epoch:record.kemEpoch+1,jwk:await generatePrivateJwk(ECDH_P256,["deriveBits"])}})}function finishMemberKemRotation(text,epoch){const record=parseRecord(text);if(record===void 0)throw invalidInput("Member key record is invalid");if(record.nextKem===void 0)return record.kemEpoch===epoch?text:void 0;if(record.nextKem.epoch!==epoch)return void 0;const{nextKem,...rest}=record;return canonicalizeJson({...rest,kemEpoch:nextKem.epoch,kemJwk:nextKem.jwk})}function parseRecord(text){if(typeof text!=="string")return void 0;try{const parsed=safeParseTotal(MemberKeyRecordV1Schema,JSON.parse(text));return parsed.success&&canonicalizeJson(parsed.data)===text?parsed.data:void 0}catch{return void 0}}var MEMBER_FINGERPRINT_DOMAIN="byok-member-fingerprint-v1\n";var FINGERPRINT_GROUPS=5;var GROUP_BYTES=5;var GROUP_MODULUS=100000n;var FingerprintInputSchema=z.object({tenantId:z.string().min(1),signingPublicJwk:P256PublicJwkSchema});async function memberFingerprint(input){return (await fingerprintGroups(input)).groups.join(" ")}async function memberApprovalCode(tenantId,first,second){const members=await Promise.all([first,second].map(signingPublicJwk=>fingerprintGroups({tenantId,signingPublicJwk})));if(members[0].memberId===members[1].memberId)throw invalidInput("An approval code needs two different members");members.sort((a,b)=>a.memberId<b.memberId?-1:1);return members.flatMap(member=>member.groups).join(" ")}async function fingerprintGroups(input){const parsed=safeParseTotal(FingerprintInputSchema,input);if(!parsed.success)throw invalidInput("Member fingerprint needs a tenant id and a P-256 signing key");const{tenantId,signingPublicJwk}=parsed.data;const memberId=await deriveMemberId(signingPublicJwk);const digest=await sha256(concat2(utf82(MEMBER_FINGERPRINT_DOMAIN),canonicalizeJsonBytes({v:1,tenantId,signingKey:{x:signingPublicJwk.x,y:signingPublicJwk.y}})));const groups=[];for(let group=0;group<FINGERPRINT_GROUPS;group+=1){let value=0n;for(const byte of digest.subarray(group*GROUP_BYTES,(group+1)*GROUP_BYTES))value=value<<8n|BigInt(byte);groups.push((value%GROUP_MODULUS).toString().padStart(5,"0"));}return {memberId,groups}}var PAIRING_VERIFICATION_SECRET_BYTES=16;var PAIRING_VERIFICATION_TEXT_LENGTH=26;var BASE32_ALPHABET="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";var PV_TEXT_PATTERN=/^[A-Za-z2-7]{26}$/u;function generatePairingVerificationSecret(){return randomBytes(PAIRING_VERIFICATION_SECRET_BYTES)}function encodePairingVerificationSecret(pv){if(pv.byteLength!==PAIRING_VERIFICATION_SECRET_BYTES){throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_SECRET_BYTES} bytes`)}let out="";let buffer=0;let bits=0;for(const byte of pv){buffer=buffer<<8|byte;bits+=8;while(bits>=5){bits-=5;out+=BASE32_ALPHABET[buffer>>>bits&31];}buffer&=(1<<bits)-1;}return out+BASE32_ALPHABET[buffer<<5-bits&31]}function decodePairingVerificationSecret(text){if(!PV_TEXT_PATTERN.test(text)){throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_TEXT_LENGTH} base32 characters`)}const upper=text.toUpperCase();const out=new Uint8Array(PAIRING_VERIFICATION_SECRET_BYTES);let buffer=0;let bits=0;let index=0;for(const char of upper){buffer=buffer<<5|BASE32_ALPHABET.indexOf(char);bits+=5;if(bits>=8){bits-=8;out[index++]=buffer>>>bits&255;}buffer&=(1<<bits)-1;}if(buffer!==0)throw invalidInput("Pairing verification secret has nonzero trailing bits");return out}function formatPairingInput(pairingCode,pv){if(pairingCode.length===0)throw invalidInput("Pairing code must not be empty");return `${pairingCode}.${encodePairingVerificationSecret(pv)}`}function parsePairingInput(text){const dot=text.lastIndexOf(".");if(dot<=0)throw invalidInput("Pairing input must be <pairing code>.<verification secret>");return {pairingCode:text.slice(0,dot),pv:decodePairingVerificationSecret(text.slice(dot+1))}}var DEVICE_PAIRING_MAC_DOMAIN="byok-pairing-device-mac-v1\n";var CLIENT_PAIRING_MAC_DOMAIN="byok-pairing-client-mac-v1\n";var PairingMacSchema=base64UrlBytes(32);var ChainHeadSchema=z.strictObject({seq:z.number().int().positive().max(Number.MAX_SAFE_INTEGER),hash:z.string().regex(CONTENT_HASH_PATTERN)});var DeviceMacInputSchema=z.object({tenantId:z.string().min(1),deviceId:z.string().min(1),member:MemberKeyBundleV1Schema});var ClientMacInputSchema=z.object({member:MemberKeyBundleV1Schema,chainHead:ChainHeadSchema});function devicePairingMacInput(input){const parsed=safeParseTotal(DeviceMacInputSchema,input);if(!parsed.success||parsed.data.member.deviceId!==parsed.data.deviceId){throw invalidInput("Device pairing MAC input must name the device member's own device id")}const{tenantId,deviceId,member}=parsed.data;return concat2(utf82(DEVICE_PAIRING_MAC_DOMAIN),canonicalizeJsonBytes({tenantId,deviceId,member}))}function clientPairingMacInput(input){const parsed=safeParseTotal(ClientMacInputSchema,input);if(!parsed.success||parsed.data.member.deviceId!==void 0){throw invalidInput("Client pairing MAC input must hold a client member and a chain head")}const{member,chainHead}=parsed.data;return concat2(utf82(CLIENT_PAIRING_MAC_DOMAIN),canonicalizeJsonBytes({member,chainHead:{seq:chainHead.seq,hash:chainHead.hash}}))}function checkPv(pv){if(pv.byteLength!==PAIRING_VERIFICATION_SECRET_BYTES){throw invalidInput(`Pairing verification secret must be ${PAIRING_VERIFICATION_SECRET_BYTES} bytes`)}}async function computeDevicePairingMac(pv,input){checkPv(pv);return encodeBase64Url(await hmacSha2562(pv,devicePairingMacInput(input)))}async function computeClientPairingMac(pv,input){checkPv(pv);return encodeBase64Url(await hmacSha2562(pv,clientPairingMacInput(input)))}async function verifyDevicePairingMac(pv,input,mac){checkPv(pv);return hmacVerify(pv,()=>devicePairingMacInput(input),mac)}async function verifyClientPairingMac(pv,input,mac){checkPv(pv);return hmacVerify(pv,()=>clientPairingMacInput(input),mac)}async function hmacVerify(key,buildData,mac){const parsed=safeParseTotal(PairingMacSchema,mac);if(!parsed.success)return false;let data;try{data=buildData();}catch{return false}const subtle=webCryptoSubtle();const hmacKey=await subtle.importKey("raw",copy2(key),{name:"HMAC",hash:"SHA-256"},false,["verify"]);return subtle.verify("HMAC",hmacKey,decodeBase64Url(parsed.data,"mac"),data)}var MemberIdSchema=z.string().regex(MEMBER_ID_PATTERN);var ScopeIdSchema=z.string().min(1);var AddSubjectSchema=z.strictObject({member:z.unknown()});var RemoveSubjectSchema=z.strictObject({memberId:MemberIdSchema});var RotateSubjectSchema=z.strictObject({memberId:MemberIdSchema,kemPublicJwk:P256PublicJwkSchema,kemEpoch:KemEpochSchema,kemSig:KemSigSchema});var ScopePolicySubjectSchema=z.strictObject({scopeId:ScopeIdSchema,categories:z.array(z.enum(SEALED_CATEGORIES)).min(1),members:z.array(MemberIdSchema).min(1)});var ShredSubjectSchema=z.strictObject({scopeId:ScopeIdSchema});var SignerSchema=z.object({signer:MemberIdSchema});var GenesisSchema=z.object({op:z.literal("add"),subject:AddSubjectSchema});var HeadSchema=z.object({seq:z.number(),hash:z.string()});var EntriesSchema=z.array(z.unknown());var AnchorInputSchema=z.object({tenantId:z.string(),entries:EntriesSchema,self:z.unknown(),approverSigningPublicJwk:P256PublicJwkSchema,authenticatedHead:z.unknown().optional()});function emptyMemberChainState(tenantId){return {tenantId,head:null,members:new Map,removed:new Set,scopes:new Map,shredded:new Set}}function memberChainScopeRecipients(state,scopeId){const scope=state.scopes.get(scopeId);if(scope===void 0)return [];return scope.members.flatMap(memberId=>{const member=state.members.get(memberId);return member===void 0?[]:[member]})}async function applyMemberChainEntries(state,entries){const list=safeParseTotal(EntriesSchema,entries);if(!list.success)return {ok:false,reason:"member_chain_entry_invalid",index:0};const result=await walk(state,list.data,()=>false);return result.ok?{ok:true,state:result.state}:result}async function genesisSigner(state,raw,signer){if(state.head!==null||state.members.size>0)return void 0;const entry=safeParseTotal(GenesisSchema,raw);const member=entry.success?await parseMemberKeyBundle(entry.data.subject.member):void 0;return member!==void 0&&member.memberId===signer?member:void 0}async function walk(state,entries,mark){const next={tenantId:state.tenantId,head:state.head,members:new Map(state.members),removed:new Set(state.removed),scopes:new Map(state.scopes),shredded:new Set(state.shredded)};let marked;for(const[index,raw]of entries.entries()){const signer=safeParseTotal(SignerSchema,raw);if(!signer.success)return {ok:false,reason:"member_chain_entry_invalid",index};const signerBundle=next.members.get(signer.data.signer)??await genesisSigner(next,raw,signer.data.signer);if(signerBundle===void 0)return {ok:false,reason:"member_chain_signer_invalid",index};const verified=await verifyMemberChainEntry(raw,signerBundle.signingPublicJwk);if(!verified.ok)return {ok:false,reason:verified.reason,index};const entry=verified.entry;const expected=next.head===null?{seq:1,prev:null}:{seq:next.head.seq+1,prev:next.head.hash};if(entry.tenantId!==next.tenantId||entry.seq!==expected.seq||entry.prev!==expected.prev){return {ok:false,reason:"member_chain_link_invalid",index}}if(marked===void 0&&mark(entry,signerBundle.signingPublicJwk))marked={index,seq:entry.seq,hash:verified.hash};const applied=await applySubject(next,entry);if(applied!==true)return {ok:false,reason:applied===false?"member_chain_subject_invalid":applied,index};next.head={seq:entry.seq,hash:verified.hash};}return {ok:true,state:next,marked}}async function applySubject(state,entry){switch(entry.op){case "add":{const subject=safeParseTotal(AddSubjectSchema,entry.subject);const member=subject.success?await parseMemberKeyBundle(subject.data.member):void 0;if(member===void 0||state.members.has(member.memberId)||state.removed.has(member.memberId))return false;state.members.set(member.memberId,member);return true}case "remove":{const subject=safeParseTotal(RemoveSubjectSchema,entry.subject);if(!subject.success||!state.members.has(subject.data.memberId)||state.members.size===1)return false;state.members.delete(subject.data.memberId);state.removed.add(subject.data.memberId);return true}case "rotate":{const subject=safeParseTotal(RotateSubjectSchema,entry.subject);if(!subject.success||subject.data.memberId!==entry.signer)return false;const member=state.members.get(subject.data.memberId);if(member===void 0||subject.data.kemEpoch!==member.kemEpoch+1)return false;const{kemPublicJwk}=subject.data;if(kemPublicJwk.x===member.kemPublicJwk.x&&kemPublicJwk.y===member.kemPublicJwk.y)return false;if(!await verifyMemberKem(member,subject.data))return false;state.members.set(member.memberId,{...member,kemPublicJwk:subject.data.kemPublicJwk,kemEpoch:subject.data.kemEpoch,kemSig:subject.data.kemSig});return true}case "scope-policy":{const subject=safeParseTotal(ScopePolicySubjectSchema,entry.subject);if(!subject.success||state.shredded.has(subject.data.scopeId))return false;const{categories,members}=subject.data;if(!strictlyIncreasing(categories.map(category=>SEALED_CATEGORIES.indexOf(category))))return false;if(!strictlyIncreasing(members)||!members.every(memberId=>state.members.has(memberId)))return false;if(!(state.scopes.get(subject.data.scopeId)?.members??members).includes(entry.signer))return "member_chain_signer_invalid";state.scopes.set(subject.data.scopeId,{categories,members,policySeq:entry.seq});return true}case "shred":{const subject=safeParseTotal(ShredSubjectSchema,entry.subject);if(!subject.success)return false;const scope=state.scopes.get(subject.data.scopeId);if(scope===void 0)return false;if(!scope.members.includes(entry.signer))return "member_chain_signer_invalid";state.scopes.delete(subject.data.scopeId);state.shredded.add(subject.data.scopeId);return true}}}function strictlyIncreasing(values){return values.every((value,index)=>index===0||values[index-1]<value)}async function verifyMemberChainFromAnchor(input){const parsed=safeParseTotal(AnchorInputSchema,input);if(!parsed.success)return {ok:false,reason:"member_chain_anchor_missing"};const{tenantId,entries,self,approverSigningPublicJwk:approver,authenticatedHead}=parsed.data;let approverId;let selfText;try{approverId=await deriveMemberId(approver);selfText=canonicalizeJson(self);}catch{return {ok:false,reason:"member_chain_anchor_missing"}}const isAnchor=(entry,signerKey)=>{if(entry.op!=="add"||entry.signer!==approverId||signerKey.x!==approver.x||signerKey.y!==approver.y)return false;try{return canonicalizeJson(entry.subject.member)===selfText}catch{return false}};const outcome=await walk(emptyMemberChainState(tenantId),entries,isAnchor);if(!outcome.ok)return outcome;const anchor=outcome.marked;if(anchor===void 0)return {ok:false,reason:"member_chain_anchor_missing"};if(authenticatedHead!==void 0){const head=safeParseTotal(HeadSchema,authenticatedHead);if(!head.success||head.data.seq!==anchor.seq||head.data.hash!==anchor.hash){return {ok:false,reason:"member_chain_head_mismatch",index:anchor.index}}}return {ok:true,state:outcome.state,anchorSeq:anchor.seq}}
 
 export { CLIENT_PAIRING_MAC_DOMAIN, DEVICE_PAIRING_MAC_DOMAIN, MEMBER_CHAIN_OPS, MEMBER_FINGERPRINT_DOMAIN, MEMBER_KEY_BUNDLE_VERSION, PAIRING_VERIFICATION_SECRET_BYTES, SEALED_CATEGORIES, SEALED_CONTENT_SUITE, SEALED_CONTENT_VERSION, SEALED_DIRECTIONS, SealedContentHeaderV1Schema, applyMemberChainEntries, beginMemberKemRotation, computeClientPairingMac, computeDevicePairingMac, createMemberKeyBundle, decodePairingVerificationSecret, deriveMemberId, deriveScopeKeyId, emptyMemberChainState, encodePairingVerificationSecret, finishMemberKemRotation, formatPairingInput, generateMemberKeyRecord, generatePairingVerificationSecret, generateScopeKey, memberApprovalCode, memberChainEntryHash, memberChainScopeRecipients, memberFingerprint, openMemberKeyRecord, openScopeKeyPackage, openSealedContent, parseMemberKeyBundle, parsePairingInput, sealContent, sealScopeKeyPackage, signMemberChainEntry, verifyClientPairingMac, verifyDevicePairingMac, verifyMemberChainEntry, verifyMemberChainFromAnchor, verifyMemberKem };
 //# sourceMappingURL=index.js.map