@byok-sdk/core

Tenant-first platform contracts, branded identity types, store ports, device proof canonicalization, object/quota contracts, and in-memory reference stores. This package is runtime-neutral: it has no Node built-in or protocol dependency.

import { tenantId, InMemoryCoreStores } from '@byok-sdk/core';

For connector setup, authenticateDeviceAssertion() verifies exact trusted issuer/product/audience bindings, derives the principal from the current device row, and consumes the JTI through an injected DeviceAssertionReplayAuthority. InMemoryDeviceAssertionReplayAuthority is the reference implementation; a hosted production composition must inject durable atomic storage. The assertion authorizes one exchange only and is not a connector session or refresh token.

Sealed payload v1 (#654) has its own subpath, so the root entry does not grow:

import { openSealedContent, sealContent } from '@byok-sdk/core/sealed-payload';

It seals and opens one category of a payload, wraps a scope key to one member as a signed key package, and signs and verifies one member chain entry. The receivers return a typed failure for hostile input and do not throw. The wire does not carry sealed content yet; later #654 slices add it.

MIT licensed. Node.js 24.22.1 or newer.

Runtime dependencies and size budgets: entry dependency contract.