Security

// Manifest signing — configured automatically by @vhyxseal/nextjs
// Manual signing API from @vhyxseal/core:
import { signManifest, verifyManifest } from '@vhyxseal/core'

// Sign at build time or request time
const signed = signManifest(manifest, privateKey)
// { signature: "sha256:...", signedAt: "..." }

// Verify before trusting any contract data
const result = verifyManifest(signedManifest, publicKey)
// { valid: true, domain: "example.com", ... }
// On failure: all safety defaults apply — agents cannot act

// Sanitization runs automatically on all string fields
// Zero configuration required — built into defineContract()

import { sanitizeContract } from '@vhyxseal/core'

// Field length limits (enforced, not configurable):
// description:              max 500 characters
// intent:                   max 50 characters
// consequence:              max 300 characters
// condition.description:    max 200 characters

// 14 injection pattern categories detected:
// prompt injection, jailbreak, SSRF, XSS, path traversal,
// SQL injection, code execution, and more

// Action token — auto-generated by @vhyxseal/nextjs for every agent action
// Six-step verification:
//
// 1. Token ID exists in issued map
// 2. Date.now() < token.expiresAt  (60-second window)
// 3. token.contractId === expected.contractId
// 4. token.componentId === expected.componentId
// 5. token.intent === expected.intent
// 6. token.used === false  →  set token.used = true (atomic)
//
// Replay attack: step 6 fails — token already consumed.
// Expired token: step 2 fails — 60-second TTL enforced.

// Domain verification — site must prove ownership
// Verified token issued by VhyxSeal registry after confirmation

import { issueDomainToken, verifyDomainToken } from '@vhyxseal/core'

const { token } = await issueDomainToken("example.com")
// token is stored in manifest as verificationToken

const valid = await verifyDomainToken("example.com", token)
// true if ownership verified, false if not