@byok-sdk/core 0.31.0 → 0.33.0

package/dist/sealed-payload/scope-key.d.ts

@@ -1,8 +1,6 @@
 import type { WebCryptoKey } from '../webcrypto';
 import { type Bytes, type P256PublicJwk } from './primitives';
 export declare const SCOPE_KEY_BYTES = 32;
-/** 16 bytes of the key-id HMAC, as unpadded base64url. */
-export declare const SCOPE_KEY_ID_LENGTH = 22;
 export declare const SCOPE_KEY_ID_PATTERN: RegExp;
 /** Byte length of the per-content HKDF salt. */
 export declare const SEALED_SALT_BYTES = 32;

package/dist/store-compatibility.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The result type of the store compatibility precheck (#1102).
+ *
+ * Each local store is inspected by the package that owns it, with that
+ * package's own open path run on a private copy of the files, so the store's
+ * code stays the one authority on what it accepts:
+ *
+ * - `server-sqlite`: `inspectSqliteStore` in `@byok-sdk/server`
+ * - `keys-profile-store`: `inspectProviderProfileStore` in `@byok-sdk/keys`
+ * - `client-journal` and `pi-durable`: `inspectDaemonStores` in `@byok-sdk/client`
+ *
+ * The ids are the `store:<id>` items of the upgrade manifest
+ * (`docs/upgrade-manifest.md`). The hosted Postgres store is checked by
+ * `release-pack-migrate`, not here.
+ */
+export type LocalStoreId = 'server-sqlite' | 'client-journal' | 'keys-profile-store' | 'pi-durable';
+/**
+ * What the build that ran the check does when it opens the store:
+ *
+ * - `accepted`: it opens the store and keeps its data.
+ * - `new-path-repair`: it refuses the store as an older format. Start on a new
+ *   path and pair or provision again; the old files stay as they are.
+ * - `rejected`: it refuses the store for another reason (a newer format, a
+ *   damaged file, or data this build will not adopt). The operator resolves
+ *   it; `code` and `reason` say what the store reported.
+ * - `absent`: there is no store at the path yet, so nothing blocks the switch.
+ */
+export type StoreCompatibilityVerdict = 'accepted' | 'new-path-repair' | 'rejected' | 'absent';
+export interface StoreCompatibility {
+    readonly store: LocalStoreId;
+    /** The store file that was inspected. */
+    readonly path: string;
+    readonly verdict: StoreCompatibilityVerdict;
+    /** The error code the store reported when it refused the file. */
+    readonly code?: string;
+    readonly reason: string;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/core",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "BYOK SDK platform contracts: branded tenant identity, tenant-first store ports, device proof canonicalization, and the composition conformance reference",
   "type": "module",
   "license": "MIT",
@@ -48,7 +48,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
-    "zod": "^4.4.3"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "@hpke/core": "1.9.0"