functions/private/Resolve-SodiumKey.ps1

function Resolve-SodiumKey {
    param(
        [Parameter(Mandatory)]
        [object]$Key
    )
    if ($Key -is [byte[]]) {
        if ($Key.Length -ne 32) {
            throw "byte[] Key must be exactly 32 bytes, got $($Key.Length)"
        }
        return $Key
    }
    if ($Key -is [string]) {
        if ($Key -notmatch '^[0-9a-fA-F]{64}$') {
            throw "String Key must be exactly 64 hexadecimal characters, got $($Key.Length) chars"
        }
        $out = [byte[]]::new(32)
        for ($i = 0; $i -lt 32; $i++) {
            $out[$i] = [System.Convert]::ToByte($Key.Substring($i * 2, 2), 16)
        }
        return $out
    }
    throw "Key must be a 64-char hex string or byte[32], got: $($Key.GetType().FullName)"
}