Strict unpadded base64url codec: the RFC 4648 §5 URL-safe alphabet with all trailing = omitted (RFC 7515 §2 permits omission on the wire; this protocol's wire form never carries padding, so padded input rejects).

Decoding is total over binaries and rejects, in order:

• any input carrying = anywhere — :base64url_padded;
• any character outside the URL-safe alphabet — :base64url_invalid (RFC 4648 §3.3: non-alphabet characters MUST be rejected);
• any spelling that is not the byte-exact encoding of its own decoded bytes — :base64url_invalid. This covers encoded lengths that are not a whole number of octets (≡ 1 mod 4) and, per RFC 4648 §3.5, non-canonical spellings whose pad bits are non-zero: those alias the same bytes under a different string, and accepting one would let two distinct digest bodies decode identically.

Canonicality is enforced the same way AgentBlueprintProtocol.Canonicalization.verify/2 enforces canonical JSON: decode, re-encode, require byte equality. The stdlib Base module supplies bit assembly only — probed on this OTP, Base.url_decode64/2 alone accepts fully-padded input and non-zero pad bits, so every strict rejection above is this module's own guard. A pure codec — bytes in, bytes out; it never authorizes anything.