feat(api): bind encrypted workspaces to accounts and devices

packages/core/src/frame.ts

@@ -49,7 +49,7 @@ export interface Envelope {
 export function parseEnvelope(data: Uint8Array): Envelope {
   if (data.length < HEADER_SIZE || data[0] !== 1) throw new IntegrityError('bad_envelope');
   const flags = data[1] as number;
-  if ((flags & 0xf0) !== 0) throw new IntegrityError('bad_envelope');
+  if ((flags & 0xe0) !== 0) throw new IntegrityError('bad_envelope');
   const payloadLength = readU32(data, 22);
   if (data.length !== HEADER_SIZE + payloadLength) throw new IntegrityError('bad_envelope');
 
@@ -109,7 +109,7 @@ export interface SealParams {
  */
 export async function sealFrame(itemKey: CryptoKey, channelId: Uint8Array, p: SealParams): Promise<Bytes> {
   if ((p.flags & Flags.Enc) === 0) throw new RangeError('enc 帧必须带 ENC 标志');
-  if ((p.flags & 0xf0) !== 0) throw new RangeError('保留标志位必须为 0');
+  if ((p.flags & 0xe0) !== 0) throw new RangeError('保留标志位必须为 0');
 
   const plaintext = padPlaintext(p.data);
   const header = concat(new Uint8Array([1, p.flags]), p.itemId, writeU32(p.index), writeU32(plaintext.length + TAG_SIZE));