@byok-sdk/cloud-dataplane 0.11.0 → 0.12.0

package/dist/index.js

@@ -826,6 +826,57 @@ async function rollback(client) {
   } catch {
   }
 }
+async function registerDeviceOnClient(client, tenant, input) {
+  if (input.machineId !== void 0) {
+    const superseded = await client.query(
+      `DELETE FROM device
+        WHERE tenant_id = $1 AND product_id = $2 AND machine_id = $3 AND device_id <> $4
+      RETURNING device_id`,
+      [tenant, input.productId, input.machineId, input.deviceId]
+    );
+    await deleteDeviceState(
+      client,
+      tenant,
+      superseded.rows.map((row) => row.device_id)
+    );
+  }
+  const result = await client.query(
+    `INSERT INTO device (
+       tenant_id, device_id, product_id, device_name, device_public_key,
+       proof_key_id, proof_key_epoch, revoked, machine_id
+     )
+     VALUES ($1, $2, $3, $4, $5, $6, $7, false, $8)
+     ON CONFLICT (tenant_id, device_id) DO UPDATE
+       SET product_id = EXCLUDED.product_id,
+           device_name = EXCLUDED.device_name,
+           device_public_key = EXCLUDED.device_public_key,
+           proof_key_id = EXCLUDED.proof_key_id,
+           proof_key_epoch = EXCLUDED.proof_key_epoch,
+           revoked = false,
+           machine_id = EXCLUDED.machine_id,
+           capabilities = NULL
+     RETURNING ${SELECT_COLUMNS}`,
+    [
+      tenant,
+      input.deviceId,
+      input.productId,
+      input.deviceName,
+      input.devicePublicKey,
+      input.proofKeyId,
+      input.proofKeyEpoch,
+      input.machineId ?? null
+    ]
+  );
+  return toRecord(result.rows[0]);
+}
+async function getDeviceOnClient(client, tenant, deviceId) {
+  const result = await client.query(
+    `SELECT ${SELECT_COLUMNS} FROM device WHERE tenant_id = $1 AND device_id = $2`,
+    [tenant, deviceId]
+  );
+  const row = result.rows[0];
+  return row === void 0 ? void 0 : toRecord(row);
+}
 var PostgresDeviceDirectory = class {
   #pool;
   #clock;
@@ -837,48 +888,9 @@ var PostgresDeviceDirectory = class {
     const client = await this.#pool.connect();
     try {
       await client.query("BEGIN");
-      if (input.machineId !== void 0) {
-        const superseded = await client.query(
-          `DELETE FROM device
-            WHERE tenant_id = $1 AND product_id = $2 AND machine_id = $3 AND device_id <> $4
-          RETURNING device_id`,
-          [tenant, input.productId, input.machineId, input.deviceId]
-        );
-        await deleteDeviceState(
-          client,
-          tenant,
-          superseded.rows.map((row) => row.device_id)
-        );
-      }
-      const result = await client.query(
-        `INSERT INTO device (
-           tenant_id, device_id, product_id, device_name, device_public_key,
-           proof_key_id, proof_key_epoch, revoked, machine_id
-         )
-         VALUES ($1, $2, $3, $4, $5, $6, $7, false, $8)
-         ON CONFLICT (tenant_id, device_id) DO UPDATE
-           SET product_id = EXCLUDED.product_id,
-               device_name = EXCLUDED.device_name,
-               device_public_key = EXCLUDED.device_public_key,
-               proof_key_id = EXCLUDED.proof_key_id,
-               proof_key_epoch = EXCLUDED.proof_key_epoch,
-               revoked = false,
-               machine_id = EXCLUDED.machine_id,
-               capabilities = NULL
-         RETURNING ${SELECT_COLUMNS}`,
-        [
-          tenant,
-          input.deviceId,
-          input.productId,
-          input.deviceName,
-          input.devicePublicKey,
-          input.proofKeyId,
-          input.proofKeyEpoch,
-          input.machineId ?? null
-        ]
-      );
+      const record = await registerDeviceOnClient(client, tenant, input);
       await client.query("COMMIT");
-      return toRecord(result.rows[0]);
+      return record;
     } catch (cause) {
       await rollback(client);
       throw cause;
@@ -887,12 +899,12 @@ var PostgresDeviceDirectory = class {
     }
   }
   async get(tenant, deviceId) {
-    const result = await this.#pool.query(
-      `SELECT ${SELECT_COLUMNS} FROM device WHERE tenant_id = $1 AND device_id = $2`,
-      [tenant, deviceId]
-    );
-    const row = result.rows[0];
-    return row === void 0 ? void 0 : toRecord(row);
+    const client = await this.#pool.connect();
+    try {
+      return await getDeviceOnClient(client, tenant, deviceId);
+    } finally {
+      client.release();
+    }
   }
   /**
    * Revocation removes the registration and the device-scoped state that only
@@ -1074,24 +1086,58 @@ var PostgresNonceStore = class {
     );
     return nonce;
   }
-  async validate(tenant, deviceId, nonce) {
+  async consumeIfValid(tenant, deviceId, nonce) {
     const result = await this.#pool.query(
-      `SELECT 1 FROM auth_nonce
-        WHERE tenant_id = $1 AND device_id = $2 AND nonce = $3
-          AND used = false AND expires_at >= $4`,
+      `UPDATE auth_nonce
+         SET used = true
+       WHERE tenant_id = $1 AND device_id = $2 AND nonce = $3
+         AND used = false AND expires_at >= $4
+       RETURNING nonce`,
       [tenant, deviceId, nonce, this.#clock.now().toISOString()]
     );
     return result.rowCount === 1;
   }
-  async markUsed(tenant, nonce) {
-    await this.#pool.query("UPDATE auth_nonce SET used = true WHERE tenant_id = $1 AND nonce = $2", [
-      tenant,
-      nonce
-    ]);
-  }
 };
 
 // src/stores/pairing-codes.ts
+function bindingOf(input) {
+  return {
+    deviceName: input.deviceName,
+    devicePublicKey: input.devicePublicKey,
+    proofKeyId: input.proofKeyId,
+    proofKeyEpoch: input.proofKeyEpoch,
+    ...input.machineId === void 0 ? {} : { machineId: input.machineId }
+  };
+}
+async function completionKey(pairingCode) {
+  const digest = new Uint8Array(await globalThis.crypto.subtle.digest(
+    "SHA-256",
+    new TextEncoder().encode(`byok-pairing-completion-v1\0${pairingCode}`)
+  ));
+  const hex = [...digest].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return `pairing-completion:v1:sha256:${hex}`;
+}
+function sameBinding(left, right) {
+  return left.deviceName === right.deviceName && left.devicePublicKey === right.devicePublicKey && left.proofKeyId === right.proofKeyId && left.proofKeyEpoch === right.proofKeyEpoch && left.machineId === right.machineId;
+}
+function sameDevice(device, claims, binding) {
+  return device.tenantId === claims.tenant_id && device.productId === claims.product_id && device.deviceName === binding.deviceName && device.devicePublicKey === binding.devicePublicKey && device.proofKeyId === binding.proofKeyId && device.proofKeyEpoch === binding.proofKeyEpoch && device.machineId === binding.machineId;
+}
+function parseCompletion(body) {
+  try {
+    const parsed = JSON.parse(body);
+    if (typeof parsed.deviceId !== "string" || parsed.binding === void 0 || typeof parsed.binding.deviceName !== "string" || typeof parsed.binding.devicePublicKey !== "string" || typeof parsed.binding.proofKeyId !== "string" || typeof parsed.binding.proofKeyEpoch !== "number" || parsed.binding.machineId !== void 0 && typeof parsed.binding.machineId !== "string") return void 0;
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function rollback2(client) {
+  try {
+    await client.query("ROLLBACK");
+  } catch {
+  }
+}
 var PostgresPairingCodeStore = class {
   #pool;
   #clock;
@@ -1100,30 +1146,102 @@ var PostgresPairingCodeStore = class {
     this.#clock = clock;
   }
   async issue(tenant, input) {
-    await this.#pool.query(
-      `INSERT INTO pairing_code (code, tenant_id, product_id, expires_at, redeemed_at)
-       VALUES ($1, $2, $3, $4, NULL)
-       ON CONFLICT (code) DO UPDATE
-         SET tenant_id = EXCLUDED.tenant_id,
-             product_id = EXCLUDED.product_id,
-             expires_at = EXCLUDED.expires_at,
-             redeemed_at = NULL`,
-      [input.code, tenant, input.productId, input.expiresAt]
-    );
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const previous = await client.query(
+        "SELECT tenant_id FROM pairing_code WHERE code = $1 FOR UPDATE",
+        [input.code]
+      );
+      const key = await completionKey(input.code);
+      const previousTenant = previous.rows[0]?.tenant_id;
+      if (previousTenant !== void 0) {
+        await client.query(
+          "DELETE FROM device_request_receipts WHERE tenant_id = $1 AND key = $2",
+          [previousTenant, key]
+        );
+      }
+      await client.query(
+        `INSERT INTO pairing_code (code, tenant_id, product_id, expires_at, redeemed_at)
+         VALUES ($1, $2, $3, $4, NULL)
+         ON CONFLICT (code) DO UPDATE
+           SET tenant_id = EXCLUDED.tenant_id,
+               product_id = EXCLUDED.product_id,
+               expires_at = EXCLUDED.expires_at,
+               redeemed_at = NULL`,
+        [input.code, tenant, input.productId, input.expiresAt]
+      );
+      await client.query("COMMIT");
+    } catch (cause) {
+      await rollback2(client);
+      throw cause;
+    } finally {
+      client.release();
+    }
     return { code: input.code, expiresAt: input.expiresAt };
   }
-  async redeem(code) {
-    const now = this.#clock.now().toISOString();
-    const result = await this.#pool.query(
-      `UPDATE pairing_code
-          SET redeemed_at = $2
-        WHERE code = $1 AND redeemed_at IS NULL AND expires_at >= $2
-      RETURNING tenant_id, product_id`,
-      [code, now]
-    );
-    const row = result.rows[0];
-    if (row === void 0) return void 0;
-    return { tenantId: row.tenant_id, productId: row.product_id };
+  async redeemAndRegister(input) {
+    const now = this.#clock.now();
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const selected = await client.query(
+        `SELECT tenant_id, product_id, expires_at, redeemed_at
+           FROM pairing_code WHERE code = $1 FOR UPDATE`,
+        [input.pairingCode]
+      );
+      const claims = selected.rows[0];
+      if (claims === void 0) {
+        await client.query("COMMIT");
+        return void 0;
+      }
+      const tenant = claims.tenant_id;
+      const binding = bindingOf(input);
+      if (claims.redeemed_at !== null) {
+        const stored = await client.query(
+          "SELECT body FROM device_request_receipts WHERE tenant_id = $1 AND key = $2",
+          [tenant, await completionKey(input.pairingCode)]
+        );
+        const completion2 = stored.rows[0] === void 0 ? void 0 : parseCompletion(stored.rows[0].body);
+        if (completion2 === void 0 || !sameBinding(completion2.binding, binding)) {
+          await client.query("COMMIT");
+          return void 0;
+        }
+        const device2 = await getDeviceOnClient(client, tenant, completion2.deviceId);
+        await client.query("COMMIT");
+        return device2 === void 0 || !sameDevice(device2, claims, binding) ? void 0 : device2;
+      }
+      if (claims.expires_at.getTime() < now.getTime()) {
+        await client.query("COMMIT");
+        return void 0;
+      }
+      await client.query(
+        "UPDATE pairing_code SET redeemed_at = $2 WHERE code = $1 AND redeemed_at IS NULL",
+        [input.pairingCode, now.toISOString()]
+      );
+      const device = await registerDeviceOnClient(client, tenant, {
+        productId: claims.product_id,
+        deviceId: input.deviceId,
+        deviceName: input.deviceName,
+        devicePublicKey: input.devicePublicKey,
+        proofKeyId: input.proofKeyId,
+        proofKeyEpoch: input.proofKeyEpoch,
+        ...input.machineId === void 0 ? {} : { machineId: input.machineId }
+      });
+      const completion = { deviceId: device.deviceId, binding };
+      await client.query(
+        `INSERT INTO device_request_receipts (tenant_id, key, body, recorded_at)
+         VALUES ($1, $2, $3, $4)`,
+        [tenant, await completionKey(input.pairingCode), JSON.stringify(completion), now.toISOString()]
+      );
+      await client.query("COMMIT");
+      return device;
+    } catch (cause) {
+      await rollback2(client);
+      throw cause;
+    } finally {
+      client.release();
+    }
   }
 };
 
@@ -1230,9 +1348,15 @@ var PostgresProofRequestReceiptStore = class {
     return row === void 0 ? void 0 : toReceipt2(row);
   }
 };
-
-// src/stores/task-attempts.ts
 var TASK_SELECT_COLUMNS = "tenant_id, task_id, device_id, agent_id, agent_profile_revision, owner_device_id, status, terminal_cause, cancel_requested_at, cancel_reason, cancel_message_id, updated_at";
+var AGENT_MESSAGE_ADMISSION_SELECT_COLUMNS = "message_id, payload_body, terminal_body";
+function admissionRowToRecord(row) {
+  return {
+    messageId: row.message_id,
+    payloadBody: row.payload_body,
+    ...row.terminal_body === null ? {} : { terminalBody: row.terminal_body }
+  };
+}
 function taskRowToAttempt(row) {
   return {
     tenantId: row.tenant_id,
@@ -1308,6 +1432,70 @@ var PostgresTaskAttemptStore = class {
     if (existing === void 0) throw new Error(`task ${input.taskId} vanished during Agent offer reservation`);
     return { attempt: existing, created: false };
   }
+  async reserveAgentMessage(tenant, input) {
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const selected = await client.query(
+        `SELECT ${TASK_SELECT_COLUMNS} FROM task
+          WHERE tenant_id = $1 AND task_id = $2 FOR UPDATE`,
+        [tenant, input.taskId]
+      );
+      const attempt = selected.rows[0];
+      if (attempt === void 0 || attempt.device_id !== input.deviceId || attempt.cancel_requested_at !== null || !["offered", "claimed", "running"].includes(attempt.status)) {
+        await client.query("COMMIT");
+        return "rejected";
+      }
+      const inserted = await client.query(
+        `INSERT INTO agent_message_admission (
+           tenant_id, device_id, task_id, message_id, payload_body
+         ) VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (tenant_id, device_id, task_id) DO NOTHING
+         RETURNING payload_body`,
+        [tenant, input.deviceId, input.taskId, input.messageId, input.payloadBody]
+      );
+      if (inserted.rows[0] !== void 0) {
+        await client.query("COMMIT");
+        return "reserved";
+      }
+      const existing = await client.query(
+        `SELECT message_id, payload_body FROM agent_message_admission
+          WHERE tenant_id = $1 AND device_id = $2 AND task_id = $3`,
+        [tenant, input.deviceId, input.taskId]
+      );
+      const admission = existing.rows[0];
+      await client.query("COMMIT");
+      return admission?.message_id === input.messageId && admission.payload_body === input.payloadBody ? "pending" : "rejected";
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+  }
+  async readAgentMessage(tenant, input) {
+    const result = await this.#pool.query(
+      `SELECT ${AGENT_MESSAGE_ADMISSION_SELECT_COLUMNS}
+         FROM agent_message_admission
+        WHERE tenant_id = $1 AND device_id = $2 AND task_id = $3`,
+      [tenant, input.deviceId, input.taskId]
+    );
+    const row = result.rows[0];
+    return row !== void 0 && row.message_id === input.messageId && row.payload_body === input.payloadBody ? admissionRowToRecord(row) : void 0;
+  }
+  async finalizeAgentMessage(tenant, input) {
+    const terminalized = await this.#pool.query(
+      `UPDATE agent_message_admission
+          SET terminal_body = $6
+        WHERE tenant_id = $1 AND device_id = $2 AND task_id = $3
+          AND message_id = $4 AND payload_body = $5 AND terminal_body IS NULL
+      RETURNING ${AGENT_MESSAGE_ADMISSION_SELECT_COLUMNS}`,
+      [tenant, input.deviceId, input.taskId, input.messageId, input.payloadBody, input.terminalBody]
+    );
+    const row = terminalized.rows[0];
+    return row === void 0 ? this.readAgentMessage(tenant, input) : admissionRowToRecord(row);
+  }
   async get(tenant, taskId) {
     const result = await this.#pool.query(
       `SELECT ${TASK_SELECT_COLUMNS} FROM task WHERE tenant_id = $1 AND task_id = $2`,
@@ -1503,13 +1691,29 @@ var PostgresMailboxStore = class {
     this.#requireDeviceId(input.deviceId);
     const now = this.#now();
     const moved = await this.#pool.query(
-      `WITH moved AS (
-         INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
-         VALUES ($1, $2, 1, $3::bigint, $4)
+      `WITH moved_zero AS (
+         INSERT INTO device_stream (
+           tenant_id, device_id, next_seq, acked_seq, acked_at, delivered_seq
+         )
+         SELECT $1, $2, 1, 0, $4, 0
+          WHERE $3::bigint = 0
          ON CONFLICT (tenant_id, device_id) DO UPDATE
-            SET acked_seq = EXCLUDED.acked_seq, acked_at = EXCLUDED.acked_at
-          WHERE device_stream.acked_seq <= EXCLUDED.acked_seq
-         RETURNING acked_seq, acked_at
+            SET acked_seq = 0, acked_at = EXCLUDED.acked_at
+          WHERE device_stream.acked_seq <= 0
+            AND device_stream.delivered_seq >= 0
+         RETURNING acked_seq, acked_at, delivered_seq
+       ), moved_positive AS (
+         UPDATE device_stream
+            SET acked_seq = $3::bigint, acked_at = $4
+          WHERE tenant_id = $1 AND device_id = $2
+            AND $3::bigint > 0
+            AND acked_seq <= $3::bigint
+            AND delivered_seq >= $3::bigint
+         RETURNING acked_seq, acked_at, delivered_seq
+       ), moved AS (
+         SELECT acked_seq, acked_at, delivered_seq FROM moved_zero
+         UNION ALL
+         SELECT acked_seq, acked_at, delivered_seq FROM moved_positive
        ), marked AS (
          UPDATE outbox
             SET state = 'acked'
@@ -1517,7 +1721,7 @@ var PostgresMailboxStore = class {
             AND seq <= (SELECT acked_seq FROM moved)
          RETURNING 1
        )
-       SELECT acked_seq, acked_at FROM moved`,
+       SELECT acked_seq, acked_at, delivered_seq FROM moved`,
       [tenant, input.deviceId, input.ackedSeq, now]
     );
     const row = moved.rows[0];
@@ -1525,21 +1729,51 @@ var PostgresMailboxStore = class {
       return {
         tenantId: tenant,
         deviceId: input.deviceId,
+        deliveredSeq: Number(row.delivered_seq),
         ackedSeq: Number(row.acked_seq),
         updatedAt: row.acked_at ?? now
       };
     }
     const current = await this.readCursor(tenant, input.deviceId);
+    if (input.ackedSeq < current.ackedSeq) {
+      throw new CoreConflictError(
+        "mailbox_cursor_regression",
+        `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
+        current,
+        this.#now()
+      );
+    }
     throw new CoreConflictError(
-      "mailbox_cursor_regression",
-      `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
+      "mailbox_cursor_ahead_of_delivery",
+      `Cursor for device ${input.deviceId} was delivered through ${current.deliveredSeq}; refusing to acknowledge future cursor ${input.ackedSeq}.`,
       current,
       this.#now()
     );
   }
+  async recordDelivery(tenant, input) {
+    this.#requireDeviceId(input.deviceId);
+    const recorded = await this.#pool.query(
+      `INSERT INTO device_stream (
+         tenant_id, device_id, next_seq, acked_seq, acked_at, delivered_seq
+       )
+       VALUES ($1, $2, 1, 0, NULL, $3::bigint)
+       ON CONFLICT (tenant_id, device_id) DO UPDATE
+          SET delivered_seq = GREATEST(device_stream.delivered_seq, EXCLUDED.delivered_seq)
+       RETURNING acked_seq, acked_at, delivered_seq`,
+      [tenant, input.deviceId, input.deliveredSeq]
+    );
+    const row = recorded.rows[0];
+    return {
+      tenantId: tenant,
+      deviceId: input.deviceId,
+      deliveredSeq: Number(row.delivered_seq),
+      ackedSeq: Number(row.acked_seq),
+      updatedAt: row.acked_at ?? this.#now()
+    };
+  }
   async readCursor(tenant, deviceId) {
     const result = await this.#pool.query(
-      `SELECT acked_seq, acked_at FROM device_stream
+      `SELECT acked_seq, acked_at, delivered_seq FROM device_stream
         WHERE tenant_id = $1 AND device_id = $2`,
       [tenant, deviceId]
     );
@@ -1547,6 +1781,7 @@ var PostgresMailboxStore = class {
     return {
       tenantId: tenant,
       deviceId,
+      deliveredSeq: row === void 0 ? 0 : Number(row.delivered_seq),
       ackedSeq: row === void 0 ? 0 : Number(row.acked_seq),
       updatedAt: row?.acked_at ?? this.#now()
     };
@@ -2151,7 +2386,7 @@ var PostgresAgentMemoryProjectionStore = class {
         }
       });
     } catch (cause) {
-      await rollback2(client);
+      await rollback3(client);
       throw cause;
     } finally {
       client.release();
@@ -2188,7 +2423,7 @@ var PostgresAgentMemoryProjectionStore = class {
       await client.query("COMMIT");
       return AgentMemoryProjectionEraseResultSchema.parse({ nextWriterEpoch });
     } catch (cause) {
-      await rollback2(client);
+      await rollback3(client);
       throw cause;
     } finally {
       client.release();
@@ -2325,7 +2560,7 @@ function toBase64(bytes) {
 function toBase64Url(bytes) {
   return toBase64(bytes).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
 }
-async function rollback2(client) {
+async function rollback3(client) {
   try {
     await client.query("ROLLBACK");
   } catch {
@@ -2384,11 +2619,16 @@ var PostgresDeviceAssertionReplayAuthority = class {
 // src/stores/index.ts
 function createPostgresCloudStores(options) {
   const { pool, clock, crypto } = options;
+  const devices = new PostgresDeviceDirectory(pool, clock);
+  const pairing = new PostgresPairingCodeStore(pool, clock);
   return {
     activity: new PostgresActivityStore(pool, clock),
     approvals: new PostgresApprovalTimelineStore(pool, clock),
-    devices: new PostgresDeviceDirectory(pool, clock),
-    pairingCodes: new PostgresPairingCodeStore(pool, clock),
+    devices,
+    // One durable code authority, projected into issuance and enrollment ports
+    // so consumers cannot reopen the old redeem-then-register sequence.
+    pairingCodes: { issue: pairing.issue.bind(pairing) },
+    pairing: { redeemAndRegister: pairing.redeemAndRegister.bind(pairing) },
     nonces: new PostgresNonceStore(pool, clock, crypto),
     dedup: new PostgresInboundDedupStore(pool),
     tasks: new PostgresTaskAttemptStore(pool, clock),
@@ -3677,7 +3917,7 @@ function toReceipt4(tenant, row) {
     recordedAt: row.recorded_at.toISOString()
   };
 }
-function sameBinding(receipt, input) {
+function sameBinding2(receipt, input) {
   return receipt.operation === input.operation && receipt.resource === input.resource && receipt.bodySha256 === input.proofBodySha256 && receipt.bodySize === input.proofBodySize;
 }
 function bodyColumns2(body) {
@@ -3716,7 +3956,7 @@ var PostgresTruthCommitter = class {
       ]);
       const replay = await this.#readReceipt(client, tenant, input.deviceId, input.requestId);
       if (replay !== void 0) {
-        if (!sameBinding(replay, input)) {
+        if (!sameBinding2(replay, input)) {
           throw new TruthCommitError(
             "proof_request_conflict",
             `Request ${input.requestId} was already used with a different binding.`
@@ -4779,6 +5019,10 @@ var PostgresCloudCleanup = class {
          ), receipts AS (
            DELETE FROM device_request_receipts
             WHERE tenant_id = $1 AND recorded_at < $5::timestamptz
+              -- Pairing completion is an immutable enrollment authority, not
+              -- a TTL-bound request receipt. Removing it would turn an exact
+              -- bearer-code retry into a new/failed enrollment after cleanup.
+              AND key NOT LIKE 'pairing-completion:v1:%'
            RETURNING 1
          ), presence AS (
            DELETE FROM device_presence
@@ -5309,6 +5553,7 @@ var TENANT_ERASURE_TABLES = [
   "agent_egress_event",
   "device_request_receipts",
   "proof_request_receipt",
+  "agent_message_admission",
   "task",
   "device_presence",
   "device_assertion_replay",