@epochquant/sealed-for-ai

Cryptographic receipts for AI-generated artifacts. One POST per artifact, public verifier URL, 7-year retention.

Install

npm install @epochquant/sealed-for-ai
# or
pnpm add @epochquant/sealed-for-ai
# or
bun add @epochquant/sealed-for-ai

Node 18+, Bun, Cloudflare Workers, Deno, browsers (CORS-enabled).

Five-minute quickstart

import { SealedAIClient } from "@epochquant/sealed-for-ai";
import { createHash } from "node:crypto";

const client = new SealedAIClient({ apiKey: process.env.SEALED_AI_KEY! });

const output = "This is whatever your AI just produced.";
const hash = createHash("sha256").update(output).digest("hex");

const receipt = await client.seal({
  artifactKind: "llm_output",
  subject: "Generated for customer #42",
  payloadSha256: hash,
  metadata: { model: "claude-opus-4-7", tokens: 1284 },
});

console.log("Verifier URL:", receipt.verifierUrl);
console.log("Seal ID:", receipt.sealId);

In a Cloudflare Worker

The SDK uses standard fetch — works natively in Workers, no Node polyfill needed.

import { SealedAIClient } from "@epochquant/sealed-for-ai";

export default {
  async fetch(req: Request, env: Env): Promise<Response> {
    const client = new SealedAIClient({ apiKey: env.SEALED_AI_KEY });
    // hash the artifact with Web Crypto (available in Workers)
    const data = await req.arrayBuffer();
    const digestBuf = await crypto.subtle.digest("SHA-256", data);
    const hash = [...new Uint8Array(digestBuf)]
      .map(b => b.toString(16).padStart(2, "0")).join("");

    const receipt = await client.seal({
      artifactKind: "llm_output",
      subject: "edge-sealed output",
      payloadSha256: hash,
    });
    return Response.json(receipt);
  },
};

Chaining

const a = await client.seal({ artifactKind: "rag_response", ... });
const b = await client.seal({ artifactKind: "llm_output", chainPrev: a.fullHash, ... });
const c = await client.seal({ artifactKind: "agent_action", chainPrev: b.fullHash, ... });

Verification

const v = await client.verify("EP-DKAP-A5C2F07B...");
if (v.found && v.signatures.ed25519Valid) {
  console.log("Sealed at:", v.sealedAt);
}

Configuration

const client = new SealedAIClient({
  apiKey: "sk-ai-...",
  baseUrl: "https://ai.epochpay.today",  // default
  timeoutMs: 30_000,                     // default
  maxRetries: 3,                         // exponential backoff on 5xx
});

Defaults are also read from env: SEALED_AI_KEY, SEALED_AI_BASE_URL.

Errors

Every API error is a typed class. Catch the base SealedError to handle them all, or specific subclasses for granular logic:

import { SealedRateLimitError } from "@epochquant/sealed-for-ai";

try {
  await client.seal({ ... });
} catch (e) {
  if (e instanceof SealedRateLimitError) {
    console.log(`Wait ${e.retryAfter}s and retry.`);
  }
}

Types

Full TypeScript types ship in the package. See src/types.ts for the shape of SealRequest, Receipt, VerifyResult, etc.

License

Proprietary · © 2026 EpochCore LLC · All Rights Reserved · Patent Pending.