@byok-sdk/cloud-dataplane 0.4.0

package/dist/index.js

@@ -0,0 +1,4284 @@
+import pg from 'pg';
+import { createHash } from 'crypto';
+import { readdir, readFile } from 'fs/promises';
+import { join } from 'path';
+import { fileURLToPath } from 'url';
+import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, AllowAllRateLimiter, TruthCommitError, TruthCommitResponseSchema, truthRecordMetadata, TRUTH_REQUEST_ID_MAX_LENGTH } from '@byok-sdk/cloud';
+import { ByokCoreError, assertCanonicalTimestamp, contentHash, isContentHash, tenantObjectKey, objectKeyPrefix, DEFAULT_ACTIVITY_CAPACITY, CoreConflictError, isLegalBoardTransition, tenantId, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
+import { AwsClient } from 'aws4fetch';
+import { XMLParser } from 'fast-xml-parser';
+import { decodeEnvelope, isServerToDaemonType, EnvelopeSchema, encodeEnvelope } from '@byok-sdk/protocol';
+
+// src/pool.ts
+var defaultTypeParser = pg.types.getTypeParser;
+var int8Parsers = {
+  getTypeParser(id, format) {
+    if (id === pg.types.builtins.INT8) return (value) => BigInt(value);
+    return defaultTypeParser(id, format);
+  }
+};
+function createByokPool(options) {
+  const { onPoolError, ...poolConfig } = options;
+  const pool = new pg.Pool({ ...poolConfig, types: int8Parsers });
+  pool.on("error", (err, client) => {
+    if (onPoolError) {
+      onPoolError(err, client);
+      return;
+    }
+    console.error("[byok-sdk] idle pg pool client error (handled, not fatal)", err);
+  });
+  return pool;
+}
+var MIGRATION_ADVISORY_LOCK_KEY = "4021960801";
+var MIGRATION_FILENAME_PATTERN = /^(\d{4})[_-].+\.sql$/;
+var LEDGER_DDL = `
+CREATE TABLE IF NOT EXISTS byok_schema_migration (
+  version     text        PRIMARY KEY,
+  checksum    text        NOT NULL,
+  applied_at  timestamptz NOT NULL
+)`;
+var MigrationChecksumMismatchError = class extends Error {
+  version;
+  expectedChecksum;
+  actualChecksum;
+  constructor(version, expectedChecksum, actualChecksum) {
+    super(
+      `Migration ${version} was already applied with checksum ${expectedChecksum}, but the file on disk hashes to ${actualChecksum}. Published migrations are immutable: add a new file instead of editing this one.`
+    );
+    this.name = "MigrationChecksumMismatchError";
+    this.version = version;
+    this.expectedChecksum = expectedChecksum;
+    this.actualChecksum = actualChecksum;
+  }
+};
+var MigrationFilenameError = class extends Error {
+  filename;
+  constructor(filename, reason) {
+    super(`Migration file ${filename} is not usable: ${reason}`);
+    this.name = "MigrationFilenameError";
+    this.filename = filename;
+  }
+};
+function sha256(text) {
+  return createHash("sha256").update(text, "utf8").digest("hex");
+}
+async function readMigrationFiles(directory) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  const files = [];
+  for (const entry of entries) {
+    if (!entry.isFile() || !entry.name.endsWith(".sql")) continue;
+    const match = MIGRATION_FILENAME_PATTERN.exec(entry.name);
+    if (match === null) {
+      throw new MigrationFilenameError(
+        entry.name,
+        "expected a four-digit prefix, e.g. 0001_cloud_local.sql"
+      );
+    }
+    const sql = await readFile(join(directory, entry.name), "utf8");
+    files.push({
+      version: entry.name,
+      ordinal: Number.parseInt(match[1], 10),
+      checksum: sha256(sql),
+      sql
+    });
+  }
+  files.sort((left, right) => left.ordinal - right.ordinal);
+  for (let index = 1; index < files.length; index += 1) {
+    const previous = files[index - 1];
+    const current = files[index];
+    if (previous.ordinal === current.ordinal) {
+      throw new MigrationFilenameError(
+        current.version,
+        `duplicate prefix ${String(current.ordinal).padStart(4, "0")}, already used by ${previous.version}`
+      );
+    }
+  }
+  return files;
+}
+async function readLedger(client) {
+  const result = await client.query(
+    "SELECT version, checksum FROM byok_schema_migration"
+  );
+  return new Map(result.rows.map((row) => [row.version, row.checksum]));
+}
+async function migrate(pool, directory) {
+  const files = await readMigrationFiles(directory);
+  const client = await pool.connect();
+  try {
+    await client.query("SELECT pg_advisory_lock($1)", [MIGRATION_ADVISORY_LOCK_KEY]);
+    try {
+      await client.query(LEDGER_DDL);
+      const ledger = await readLedger(client);
+      const applied = [];
+      const alreadyApplied = [];
+      for (const file of files) {
+        const recordedChecksum = ledger.get(file.version);
+        if (recordedChecksum !== void 0) {
+          if (recordedChecksum !== file.checksum) {
+            throw new MigrationChecksumMismatchError(file.version, recordedChecksum, file.checksum);
+          }
+          alreadyApplied.push(file.version);
+          continue;
+        }
+        await client.query("BEGIN");
+        try {
+          await client.query(file.sql);
+          await client.query(
+            "INSERT INTO byok_schema_migration (version, checksum, applied_at) VALUES ($1, $2, now())",
+            [file.version, file.checksum]
+          );
+          await client.query("COMMIT");
+        } catch (error) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw error;
+        }
+        applied.push(file.version);
+      }
+      return { applied, alreadyApplied };
+    } finally {
+      await client.query("SELECT pg_advisory_unlock($1)", [MIGRATION_ADVISORY_LOCK_KEY]);
+    }
+  } finally {
+    client.release();
+  }
+}
+function migrationsDir() {
+  return fileURLToPath(new URL("./sql", import.meta.url));
+}
+var DEFAULT_LIST_LIMIT = 100;
+var MANIFEST_COLUMNS = "tenant_id, hash, byte_size, content_type, state, ref_count, created_at, updated_at, delete_pending_at";
+function toEntry(row) {
+  return {
+    tenantId: row.tenant_id,
+    hash: row.hash,
+    byteSize: row.byte_size,
+    contentType: row.content_type,
+    state: row.state,
+    refCount: row.ref_count,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at,
+    ...row.delete_pending_at === null ? {} : { deletePendingAt: row.delete_pending_at }
+  };
+}
+var PostgresObjectStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async putManifest(tenant, input) {
+    const now = this.#now();
+    const upserted = await this.#pool.query(
+      `INSERT INTO object_manifest (${MANIFEST_COLUMNS})
+       VALUES ($1, $2, $3::bigint, $4, 'pending', 0, $5, $5, NULL)
+       ON CONFLICT (tenant_id, hash) DO UPDATE
+          SET byte_size         = EXCLUDED.byte_size,
+              content_type      = EXCLUDED.content_type,
+              state             = 'pending',
+              ref_count         = 0,
+              created_at        = EXCLUDED.created_at,
+              updated_at        = EXCLUDED.updated_at,
+              delete_pending_at = NULL
+        WHERE object_manifest.state = 'deleted'
+       RETURNING ${MANIFEST_COLUMNS}`,
+      [tenant, input.hash, input.byteSize, input.contentType, now]
+    );
+    const row = upserted.rows[0];
+    if (row !== void 0) return toEntry(row);
+    return this.#require(tenant, input.hash);
+  }
+  async commit(tenant, input) {
+    const committed = await this.#pool.query(
+      `UPDATE object_manifest
+          SET state = 'committed', updated_at = $3
+        WHERE tenant_id = $1 AND hash = $2
+          AND state = 'pending'
+          AND byte_size = $4::bigint
+          AND content_type = $5
+       RETURNING ${MANIFEST_COLUMNS}`,
+      [tenant, input.hash, this.#now(), input.observedByteSize, input.observedContentType]
+    );
+    const row = committed.rows[0];
+    if (row !== void 0) return toEntry(row);
+    const current = await this.#require(tenant, input.hash);
+    if (current.byteSize !== input.observedByteSize || current.contentType !== input.observedContentType) {
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Observed object ${input.hash} (${String(input.observedByteSize)} bytes, ${input.observedContentType}) does not match the declared manifest.`
+      );
+    }
+    if (current.state === "committed") return current;
+    throw this.#stateInvalid(current.state, "committed");
+  }
+  async get(tenant, hash) {
+    const result = await this.#pool.query(
+      `SELECT ${MANIFEST_COLUMNS} FROM object_manifest WHERE tenant_id = $1 AND hash = $2`,
+      [tenant, hash]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toEntry(row);
+  }
+  async list(tenant, query) {
+    if (query.deletePendingBefore !== void 0) {
+      assertCanonicalTimestamp(query.deletePendingBefore, "deletePendingBefore");
+    }
+    const result = await this.#pool.query(
+      `SELECT ${MANIFEST_COLUMNS} FROM object_manifest
+        WHERE tenant_id = $1
+          AND ($2::text IS NULL OR state = $2::text)
+          AND ($3::text IS NULL
+               OR (delete_pending_at IS NOT NULL AND delete_pending_at < $3::text))
+        ORDER BY hash COLLATE "C"
+        LIMIT $4`,
+      [
+        tenant,
+        query.state ?? null,
+        query.deletePendingBefore ?? null,
+        query.limit ?? DEFAULT_LIST_LIMIT
+      ]
+    );
+    return result.rows.map(toEntry);
+  }
+  async addReference(tenant, input) {
+    return this.#withManifestLocked(tenant, input.hash, async (client, current) => {
+      if (current.state !== "committed") {
+        return new ByokCoreError(
+          "object_state_invalid",
+          `Only committed objects can be referenced; ${input.hash} is ${current.state}.`
+        );
+      }
+      await client.query(
+        `INSERT INTO object_reference (tenant_id, hash, ref_kind, ref_id, created_at)
+         VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (tenant_id, hash, ref_kind, ref_id) DO NOTHING`,
+        [tenant, input.hash, input.refKind, input.refId, this.#now()]
+      );
+      return this.#recount(client, tenant, input.hash);
+    });
+  }
+  async removeReference(tenant, input) {
+    return this.#withManifestLocked(tenant, input.hash, async (client) => {
+      await client.query(
+        `DELETE FROM object_reference
+          WHERE tenant_id = $1 AND hash = $2 AND ref_kind = $3 AND ref_id = $4`,
+        [tenant, input.hash, input.refKind, input.refId]
+      );
+      return this.#recount(client, tenant, input.hash);
+    });
+  }
+  async markDeletePending(tenant, hash) {
+    const marked = await this.#pool.query(
+      `UPDATE object_manifest
+          SET gc_accounted_bytes = CASE WHEN state = 'committed' THEN byte_size ELSE 0 END,
+              gc_accounted_object = (state = 'committed'),
+              state = 'delete_pending', delete_pending_at = $3, updated_at = $3
+        WHERE tenant_id = $1 AND hash = $2
+          AND ref_count = 0
+          AND state IN ('pending', 'committed')
+       RETURNING ${MANIFEST_COLUMNS}`,
+      [tenant, hash, this.#now()]
+    );
+    const row = marked.rows[0];
+    if (row !== void 0) return toEntry(row);
+    const current = await this.#require(tenant, hash);
+    if (current.refCount !== 0) {
+      throw new ByokCoreError(
+        "object_state_invalid",
+        `Object ${hash} still has ${current.refCount} reference(s).`
+      );
+    }
+    throw this.#stateInvalid(current.state, "delete_pending");
+  }
+  async markDeleted(tenant, hash) {
+    const deleted = await this.#pool.query(
+      `UPDATE object_manifest
+          SET state = 'deleted', updated_at = $3
+        WHERE tenant_id = $1 AND hash = $2 AND state = 'delete_pending'
+       RETURNING ${MANIFEST_COLUMNS}`,
+      [tenant, hash, this.#now()]
+    );
+    const row = deleted.rows[0];
+    if (row !== void 0) return toEntry(row);
+    const current = await this.#require(tenant, hash);
+    throw this.#stateInvalid(current.state, "deleted");
+  }
+  /**
+   * Runs a reference mutation with the manifest row held under `FOR UPDATE`.
+   *
+   * The lock is taken before anything is read, so the state the callback judges
+   * is the state no concurrent `markDeletePending` can move underneath it. A
+   * typed refusal is RETURNED rather than thrown, the way
+   * `PostgresQuotaStore.reserve` defers its rejection past `COMMIT`: it keeps
+   * the `catch` reserved for genuine faults, so a rollback that itself fails
+   * cannot replace this store's own answer.
+   */
+  async #withManifestLocked(tenant, hash, mutate) {
+    const client = await this.#pool.connect();
+    let settled;
+    try {
+      await client.query("BEGIN");
+      const locked = await client.query(
+        `SELECT ${MANIFEST_COLUMNS} FROM object_manifest
+          WHERE tenant_id = $1 AND hash = $2
+          FOR UPDATE`,
+        [tenant, hash]
+      );
+      const row = locked.rows[0];
+      settled = row === void 0 ? this.#notFound(hash) : await mutate(client, toEntry(row));
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw error;
+    } finally {
+      client.release();
+    }
+    if (settled instanceof ByokCoreError) throw settled;
+    return settled;
+  }
+  /** Sets `ref_count` to what the reference rows actually say. */
+  async #recount(client, tenant, hash) {
+    const result = await client.query(
+      `UPDATE object_manifest
+          SET ref_count = (SELECT count(*) FROM object_reference r
+                            WHERE r.tenant_id = $1 AND r.hash = $2),
+              updated_at = $3
+        WHERE tenant_id = $1 AND hash = $2
+       RETURNING ${MANIFEST_COLUMNS}`,
+      [tenant, hash, this.#now()]
+    );
+    const row = result.rows[0];
+    if (row === void 0) throw this.#notFound(hash);
+    return toEntry(row);
+  }
+  async #require(tenant, hash) {
+    const entry = await this.get(tenant, hash);
+    if (entry === void 0) throw this.#notFound(hash);
+    return entry;
+  }
+  #notFound(hash) {
+    return new ByokCoreError(
+      "object_not_found",
+      `Object ${hash} has no manifest row in this tenant.`
+    );
+  }
+  #stateInvalid(from, to) {
+    return new ByokCoreError(
+      "object_state_invalid",
+      `${from} to ${to} is not a legal object manifest transition.`
+    );
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+var DEFAULT_PRESIGN_TTL_SECONDS = 15 * 60;
+var MIN_PRESIGN_TTL_SECONDS = 1;
+var MAX_PRESIGN_TTL_SECONDS = 604800;
+var DEFAULT_MAX_ATTEMPTS = 3;
+var DEFAULT_RETRY_DELAY_MS = 100;
+var ObjectStoreRequestError = class extends Error {
+  status;
+  attempts;
+  constructor(message, attempts, status, options) {
+    super(message, options);
+    this.name = "ObjectStoreRequestError";
+    this.attempts = attempts;
+    this.status = status;
+  }
+};
+var R2_BLOB_ERROR_CODES = {
+  /**
+   * A tenant id that cannot be one safe path segment. Wire-relevant: it is the
+   * only signal a control plane gets that the id it issued cannot address
+   * object storage, and it is raised BEFORE any key is built.
+   */
+  storage_tenant_key_unsafe: "storage_tenant_key_unsafe",
+  /** A presign lifetime outside `[MIN_PRESIGN_TTL_SECONDS, MAX_PRESIGN_TTL_SECONDS]`. Construction-time only. */
+  storage_presign_ttl_invalid: "storage_presign_ttl_invalid",
+  /** ListObjectsV2 accepts 1..1000 keys per page. Maintenance input only. */
+  storage_list_limit_invalid: "storage_list_limit_invalid",
+  /** Continuation tokens are opaque but non-empty. Maintenance input only. */
+  storage_list_cursor_invalid: "storage_list_cursor_invalid"
+};
+var R2BlobStoreError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "R2BlobStoreError";
+    this.code = code;
+  }
+};
+var R2CloudBlobStore = class {
+  #objects;
+  #signingClock;
+  #client;
+  #origin;
+  #bucket;
+  #keyPrefix;
+  #presignTtlSeconds;
+  #fetch;
+  #maxAttempts;
+  #retryDelayMs;
+  constructor(options) {
+    this.#objects = options.objects;
+    this.#signingClock = options.signingClock;
+    this.#client = new AwsClient({
+      accessKeyId: options.accessKeyId,
+      secretAccessKey: options.secretAccessKey,
+      service: "s3",
+      region: options.region,
+      // The client's own retry loop is bypassed: this store only ever calls
+      // `sign`, and drives its own bounded, jitter-free retries below so the
+      // transient-error dimension can assert an exact attempt sequence.
+      retries: 0
+    });
+    this.#origin = options.endpoint.replace(/\/+$/, "");
+    this.#bucket = options.bucket;
+    this.#keyPrefix = resolveKeyPrefix(options.keyPrefix);
+    this.#presignTtlSeconds = assertPresignTtl(options.presignTtlSeconds ?? DEFAULT_PRESIGN_TTL_SECONDS);
+    this.#fetch = options.fetch ?? ((request) => globalThis.fetch(request));
+    this.#maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    this.#retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+  }
+  /**
+   * Reserve the manifest row, then hand back a PUT bound to this tenant, this
+   * key, this length, this type, and this expiry.
+   *
+   * `putManifest` is idempotent per (tenant, hash), so a device that declares
+   * the same content twice while it is still `pending` gets the same row and
+   * the same key — an interrupted upload is retried, not duplicated. It is
+   * idempotent per TENANT, which is the same reason the key embeds the tenant:
+   * two tenants holding identical bytes hold two independent objects, and
+   * neither can learn of the other's.
+   *
+   * Idempotence stops at `committed`, and that boundary is the point: a
+   * committed object is what a truth record is allowed to reference, so it has
+   * to be immutable, and re-issuing a write grant for one is the only way this
+   * adapter could make it otherwise.
+   */
+  async createUpload(tenant, reservation) {
+    this.#assertReservedObject(tenant, reservation);
+    const hash = contentHash(reservation.contentHash);
+    const byteSize = reservation.expectedBytes;
+    assertKeySegmentTenant(tenant);
+    const entry = await this.#objects.putManifest(tenant, {
+      hash,
+      byteSize,
+      contentType: reservation.contentType
+    });
+    if (entry.byteSize !== byteSize || entry.contentType !== reservation.contentType) {
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Object ${hash} is already declared as ${String(entry.byteSize)} bytes of ${entry.contentType}; this upload declares ${String(byteSize)} bytes of ${reservation.contentType}.`
+      );
+    }
+    if (entry.state !== "pending") {
+      throw new ByokCoreError(
+        "object_state_invalid",
+        `Object ${hash} is ${entry.state}; only a pending object can receive an upload grant.`
+      );
+    }
+    const url = this.#objectUrl(tenant, hash);
+    url.searchParams.set("X-Amz-Expires", String(this.#presignTtlSeconds));
+    const signed = await this.#client.sign(
+      new Request(url, {
+        method: "PUT",
+        headers: {
+          "content-length": String(byteSize),
+          "content-type": reservation.contentType
+        }
+      }),
+      {
+        // `allHeaders` is load-bearing: aws4fetch treats `content-length` and
+        // `content-type` as unsignable by default (they are per-hop headers for
+        // most services), and without this the grant would bind the key and the
+        // expiry but not the SHAPE of what may be written to it.
+        aws: { signQuery: true, allHeaders: true, datetime: this.#datetime() }
+      }
+    );
+    return { blobId: hash, uploadUrl: signed.url };
+  }
+  async observeUpload(tenant, blobId, reservation) {
+    if (!isContentHash(blobId) || reservation.tenantId !== tenant || reservation.kind !== "object" || reservation.contentHash !== blobId) {
+      return void 0;
+    }
+    const entry = await this.#objects.get(tenant, reservation.contentHash);
+    if (entry === void 0 || entry.state !== "pending" && entry.state !== "committed") {
+      return void 0;
+    }
+    const observed = await this.#head(tenant, reservation.contentHash);
+    if (!observed.present) return void 0;
+    return {
+      observedByteSize: observed.byteSize,
+      observedContentType: observed.contentType
+    };
+  }
+  /**
+   * A GET for a committed object this tenant owns; `undefined` otherwise.
+   *
+   * Every miss answers identically — unknown hash, another tenant's object, a
+   * malformed id, bytes that never landed, a tombstoned row. A caller cannot
+   * tell them apart, which is what keeps `getDownloadUrl` from being an
+   * existence oracle across tenants.
+   *
+   * This is a pure committed-manifest gate. Observation and commit belong to
+   * the explicit finalize route; a download must never decide accounting.
+   */
+  async getDownloadUrl(tenant, blobId) {
+    if (!isContentHash(blobId)) return void 0;
+    const hash = blobId;
+    const entry = await this.#objects.get(tenant, hash);
+    if (entry === void 0) return void 0;
+    if (entry.state !== "committed") {
+      return void 0;
+    }
+    const url = this.#objectUrl(tenant, hash);
+    url.searchParams.set("X-Amz-Expires", String(this.#presignTtlSeconds));
+    const signed = await this.#client.sign(new Request(url, { method: "GET" }), {
+      aws: { signQuery: true, datetime: this.#datetime() }
+    });
+    return signed.url;
+  }
+  /**
+   * The ONLY place an object key is built, and therefore the only place the
+   * key's two segments have to be safe.
+   *
+   * The hash half is closed by construction: `tenantObjectKey` is core's and it
+   * takes a `ContentHash` — a branded type with exactly one mint point that
+   * rejects anything but 64 lowercase hex — so a traversal segment, an absolute
+   * path, or an uppercase digest cannot be smuggled through a parameter that
+   * will not accept them.
+   *
+   * The tenant half is NOT, and that asymmetry is why the guard below exists.
+   * `tenantId()` fails closed on empty, padded, over-long, and `NUL`-bearing
+   * values, and deliberately normalizes nothing else — normalizing would make
+   * the SDK disagree with the control plane that issued the id about its
+   * canonical form (`@byok-sdk/core`'s `tenant.ts`). So `a/../b` is a legitimate
+   * tenant id, and the line below would otherwise hand it to `new URL()`, which
+   * resolves the traversal and returns tenant `b`'s key. That is a cross-tenant
+   * alias: `a/../b` could probe, overwrite, and read what `b` owns.
+   *
+   * Refused rather than encoded. Percent-encoding the segment would keep the
+   * key distinct, and would also give every tenant id two spellings — the one
+   * the control plane issued and the one at rest in the object store — which is
+   * the second source of truth core refused to create in the first place.
+   */
+  #objectUrl(tenant, hash) {
+    assertKeySegmentTenant(tenant);
+    return new URL(
+      `${this.#origin}/${this.#bucket}/${tenantObjectKey(tenant, hash, this.#keyPrefix)}`
+    );
+  }
+  /**
+   * `HEAD` the key, with bounded retries for transient faults.
+   *
+   * `HEAD` is idempotent by construction, so a retry can never double an
+   * effect — which is the whole reason the retry loop is allowed to exist here
+   * and not around anything that writes.
+   */
+  async #head(tenant, hash) {
+    const url = this.#objectUrl(tenant, hash);
+    const { response, attempts } = await this.#send(new Request(url, { method: "HEAD" }));
+    if (response.status === 404) {
+      return { present: false, byteSize: 0n, contentType: "" };
+    }
+    if (!response.ok) {
+      throw new ObjectStoreRequestError(
+        `HEAD on the object store answered ${response.status}.`,
+        attempts,
+        response.status
+      );
+    }
+    const length = response.headers.get("content-length");
+    const contentType = response.headers.get("content-type");
+    if (length === null || contentType === null) {
+      throw new ObjectStoreRequestError(
+        `HEAD on the object store omitted content-length or content-type, so ${hash} cannot be verified.`,
+        attempts,
+        response.status
+      );
+    }
+    return { present: true, byteSize: BigInt(length), contentType };
+  }
+  /**
+   * Signs, sends, and retries 5xx/429/network faults with a doubling delay.
+   *
+   * Returns the attempt count alongside the response because the caller is what
+   * decides the answer was a failure. A 4xx costs however many attempts the
+   * transient faults before it did, and `attempts` is the only field
+   * {@link ObjectStoreRequestError} carries that an operator can use to tell a
+   * flapping remote from a hard refusal — so it has to be counted here, where
+   * the loop is, rather than assumed to be 1 at the throw site.
+   */
+  async #send(request) {
+    const failures = [];
+    for (let attempt = 1; attempt <= this.#maxAttempts; attempt += 1) {
+      const signed = await this.#client.sign(request.clone(), {
+        aws: { datetime: this.#datetime() }
+      });
+      const outcome = await this.#attempt(signed);
+      if (outcome.response !== void 0) return { response: outcome.response, attempts: attempt };
+      failures.push(outcome.failure);
+      if (attempt < this.#maxAttempts) {
+        await this.#sleep(this.#retryDelayMs * 2 ** (attempt - 1));
+      }
+    }
+    throw new ObjectStoreRequestError(
+      `The object store failed ${this.#maxAttempts} attempt(s): ${failures.join(", ")}.`,
+      this.#maxAttempts
+    );
+  }
+  async #attempt(signed) {
+    try {
+      const response = await this.#fetch(signed);
+      if (response.status !== 429 && response.status < 500) return { response, failure: "" };
+      return { failure: `HTTP ${response.status}` };
+    } catch (cause) {
+      return { failure: cause instanceof Error ? cause.message : String(cause) };
+    }
+  }
+  #sleep(ms) {
+    return new Promise((resolve) => {
+      setTimeout(resolve, ms);
+    });
+  }
+  /** SigV4's `YYYYMMDDTHHmmssZ`, off the signing clock — see its doc for why that is a separate one. */
+  #datetime() {
+    return this.#signingClock.now().toISOString().replaceAll(/[:-]|\.\d{3}/g, "");
+  }
+  #assertReservedObject(tenant, reservation) {
+    if (reservation.tenantId === tenant && reservation.kind === "object" && reservation.state === "reserved" && reservation.expectedBytes >= 0n) {
+      return;
+    }
+    throw new ByokCoreError(
+      "storage_integrity_mismatch",
+      "An upload grant requires a reserved object reservation owned by this tenant."
+    );
+  }
+};
+var R2ObjectMaintenanceStore = class {
+  #signingClock;
+  #client;
+  #origin;
+  #bucket;
+  #keyPrefix;
+  #fetch;
+  #maxAttempts;
+  #retryDelayMs;
+  constructor(options) {
+    this.#signingClock = options.signingClock;
+    this.#client = new AwsClient({
+      accessKeyId: options.accessKeyId,
+      secretAccessKey: options.secretAccessKey,
+      service: "s3",
+      region: options.region,
+      retries: 0
+    });
+    this.#origin = options.endpoint.replace(/\/+$/, "");
+    this.#bucket = options.bucket;
+    this.#keyPrefix = resolveKeyPrefix(options.keyPrefix);
+    this.#fetch = options.fetch ?? ((request) => globalThis.fetch(request));
+    this.#maxAttempts = options.maxAttempts ?? DEFAULT_MAX_ATTEMPTS;
+    this.#retryDelayMs = options.retryDelayMs ?? DEFAULT_RETRY_DELAY_MS;
+  }
+  async inspectObject(tenant, hash) {
+    const observed = await this.#head(tenant, hash);
+    if (!observed.present) return void 0;
+    return {
+      observedByteSize: observed.byteSize,
+      observedContentType: observed.contentType
+    };
+  }
+  async deleteObject(tenant, hash) {
+    const url = this.#objectUrl(tenant, hash);
+    const { response, attempts } = await this.#send(new Request(url, { method: "DELETE" }));
+    if (response.status === 404) return "absent";
+    if (!response.ok) {
+      throw new ObjectStoreRequestError(
+        `DELETE on the object store answered ${response.status}.`,
+        attempts,
+        response.status
+      );
+    }
+    return "deleted";
+  }
+  async listTenantObjects(tenant, continuationToken, limit = 100) {
+    assertKeySegmentTenant(tenant);
+    if (!Number.isInteger(limit) || limit < 1 || limit > 1e3) {
+      throw new R2BlobStoreError(
+        "storage_list_limit_invalid",
+        `A ListObjectsV2 page limit of ${String(limit)} is not a whole number in [1, 1000].`
+      );
+    }
+    const prefix = `${tenant}/sha256/`;
+    const url = new URL(`${this.#origin}/${this.#bucket}`);
+    url.searchParams.set("list-type", "2");
+    url.searchParams.set("prefix", prefix);
+    url.searchParams.set("max-keys", String(limit));
+    if (continuationToken !== void 0) {
+      if (continuationToken.length === 0) {
+        throw new R2BlobStoreError(
+          "storage_list_cursor_invalid",
+          "A ListObjectsV2 continuation token must not be empty."
+        );
+      }
+      url.searchParams.set("continuation-token", continuationToken);
+    }
+    const { response, attempts } = await this.#send(new Request(url, { method: "GET" }));
+    if (!response.ok) {
+      throw new ObjectStoreRequestError(
+        `ListObjectsV2 on the object store answered ${response.status}.`,
+        attempts,
+        response.status
+      );
+    }
+    return parseListObjectsV2(await response.text(), prefix, attempts);
+  }
+  async #head(tenant, hash) {
+    const { response, attempts } = await this.#send(
+      new Request(this.#objectUrl(tenant, hash), { method: "HEAD" })
+    );
+    if (response.status === 404) {
+      return { present: false, byteSize: 0n, contentType: "" };
+    }
+    if (!response.ok) {
+      throw new ObjectStoreRequestError(
+        `HEAD on the object store answered ${response.status}.`,
+        attempts,
+        response.status
+      );
+    }
+    const length = response.headers.get("content-length");
+    const contentType = response.headers.get("content-type");
+    if (length === null || contentType === null) {
+      throw new ObjectStoreRequestError(
+        `HEAD on the object store omitted content-length or content-type, so ${hash} cannot be observed.`,
+        attempts,
+        response.status
+      );
+    }
+    return { present: true, byteSize: BigInt(length), contentType };
+  }
+  #objectUrl(tenant, hash) {
+    assertKeySegmentTenant(tenant);
+    return new URL(
+      `${this.#origin}/${this.#bucket}/${tenantObjectKey(tenant, hash, this.#keyPrefix)}`
+    );
+  }
+  async #send(request) {
+    const failures = [];
+    for (let attempt = 1; attempt <= this.#maxAttempts; attempt += 1) {
+      const signed = await this.#client.sign(request.clone(), {
+        aws: { datetime: this.#datetime() }
+      });
+      try {
+        const response = await this.#fetch(signed);
+        if (response.status !== 429 && response.status < 500) {
+          return { response, attempts: attempt };
+        }
+        failures.push(`HTTP ${response.status}`);
+      } catch (cause) {
+        failures.push(cause instanceof Error ? cause.message : String(cause));
+      }
+      if (attempt < this.#maxAttempts) {
+        await new Promise((resolve) => {
+          setTimeout(resolve, this.#retryDelayMs * 2 ** (attempt - 1));
+        });
+      }
+    }
+    throw new ObjectStoreRequestError(
+      `The object store failed ${this.#maxAttempts} attempt(s): ${failures.join(", ")}.`,
+      this.#maxAttempts
+    );
+  }
+  #datetime() {
+    return this.#signingClock.now().toISOString().replaceAll(/[:-]|\.\d{3}/g, "");
+  }
+};
+var SAFE_TENANT_SEGMENT = /^[A-Za-z0-9._~-]+$/;
+function assertKeySegmentTenant(tenant) {
+  if (SAFE_TENANT_SEGMENT.test(tenant) && !tenant.startsWith(".")) return;
+  throw new R2BlobStoreError(
+    "storage_tenant_key_unsafe",
+    `Tenant id ${JSON.stringify(tenant)} is not a single safe object-key segment, so no key can be built for it.`
+  );
+}
+function resolveKeyPrefix(keyPrefix) {
+  return keyPrefix === void 0 ? void 0 : objectKeyPrefix(keyPrefix);
+}
+function assertPresignTtl(seconds) {
+  if (Number.isInteger(seconds) && seconds >= MIN_PRESIGN_TTL_SECONDS && seconds <= MAX_PRESIGN_TTL_SECONDS) {
+    return seconds;
+  }
+  throw new R2BlobStoreError(
+    "storage_presign_ttl_invalid",
+    `A presign lifetime of ${String(seconds)} is not a whole number of seconds in [${String(MIN_PRESIGN_TTL_SECONDS)}, ${String(MAX_PRESIGN_TTL_SECONDS)}], which is the range R2 will honor.`
+  );
+}
+var LIST_OBJECTS_XML = new XMLParser({
+  ignoreAttributes: true,
+  parseTagValue: false,
+  trimValues: true,
+  processEntities: false
+});
+function parseListObjectsV2(xml, prefix, attempts) {
+  let parsed;
+  try {
+    parsed = LIST_OBJECTS_XML.parse(xml);
+  } catch (cause) {
+    throw new ObjectStoreRequestError(
+      "ListObjectsV2 returned malformed XML.",
+      attempts,
+      void 0,
+      { cause }
+    );
+  }
+  const document = asRecord(parsed);
+  const root = asRecord(document?.ListBucketResult);
+  if (root === void 0) {
+    throw new ObjectStoreRequestError(
+      "ListObjectsV2 XML omitted ListBucketResult.",
+      attempts
+    );
+  }
+  const isTruncated = requiredText(root, "IsTruncated", attempts);
+  if (isTruncated !== "true" && isTruncated !== "false") {
+    throw new ObjectStoreRequestError(
+      `ListObjectsV2 XML contained invalid IsTruncated=${JSON.stringify(isTruncated)}.`,
+      attempts
+    );
+  }
+  const rawContents = root.Contents === void 0 ? [] : Array.isArray(root.Contents) ? root.Contents : [root.Contents];
+  const objects = rawContents.map((raw, index) => {
+    const content = asRecord(raw);
+    if (content === void 0) {
+      throw new ObjectStoreRequestError(
+        `ListObjectsV2 XML contained a non-object Contents entry at index ${String(index)}.`,
+        attempts
+      );
+    }
+    const key = requiredText(content, "Key", attempts);
+    const sizeText = requiredText(content, "Size", attempts);
+    let byteSize;
+    try {
+      byteSize = BigInt(sizeText);
+    } catch (cause) {
+      throw new ObjectStoreRequestError(
+        `ListObjectsV2 XML contained invalid Size=${JSON.stringify(sizeText)}.`,
+        attempts,
+        void 0,
+        { cause }
+      );
+    }
+    if (byteSize < 0n) {
+      throw new ObjectStoreRequestError(
+        `ListObjectsV2 XML contained negative Size=${sizeText}.`,
+        attempts
+      );
+    }
+    const suffix = key.startsWith(prefix) ? key.slice(prefix.length) : "";
+    return {
+      key,
+      byteSize,
+      ...HASH_KEY_SUFFIX.test(suffix) ? { hash: contentHash(`sha256:${suffix}`) } : {}
+    };
+  });
+  if (isTruncated === "false") return { objects };
+  const nextContinuationToken = requiredText(root, "NextContinuationToken", attempts);
+  if (nextContinuationToken.length === 0) {
+    throw new ObjectStoreRequestError(
+      "ListObjectsV2 XML was truncated but its continuation token was empty.",
+      attempts
+    );
+  }
+  return { objects, nextContinuationToken };
+}
+var HASH_KEY_SUFFIX = /^[0-9a-f]{64}$/;
+function asRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function requiredText(record, field, attempts) {
+  const value = record[field];
+  if (typeof value === "string") return value;
+  throw new ObjectStoreRequestError(
+    `ListObjectsV2 XML omitted text field ${field}.`,
+    attempts
+  );
+}
+
+// src/stores/devices.ts
+function toRecord(row) {
+  return {
+    tenantId: row.tenant_id,
+    productId: row.product_id,
+    deviceId: row.device_id,
+    deviceName: row.device_name,
+    devicePublicKey: row.device_public_key,
+    proofKeyId: row.proof_key_id,
+    proofKeyEpoch: row.proof_key_epoch,
+    revoked: row.revoked
+  };
+}
+var SELECT_COLUMNS = "tenant_id, device_id, product_id, device_name, device_public_key, proof_key_id, proof_key_epoch, revoked";
+var PostgresDeviceDirectory = class {
+  #pool;
+  constructor(pool) {
+    this.#pool = pool;
+  }
+  async register(tenant, input) {
+    const result = await this.#pool.query(
+      `INSERT INTO device (
+         tenant_id, device_id, product_id, device_name, device_public_key,
+         proof_key_id, proof_key_epoch, revoked
+       )
+       VALUES ($1, $2, $3, $4, $5, $6, $7, false)
+       ON CONFLICT (tenant_id, device_id) DO UPDATE
+         SET product_id = EXCLUDED.product_id,
+             device_name = EXCLUDED.device_name,
+             device_public_key = EXCLUDED.device_public_key,
+             proof_key_id = EXCLUDED.proof_key_id,
+             proof_key_epoch = EXCLUDED.proof_key_epoch,
+             revoked = false
+       RETURNING ${SELECT_COLUMNS}`,
+      [
+        tenant,
+        input.deviceId,
+        input.productId,
+        input.deviceName,
+        input.devicePublicKey,
+        input.proofKeyId,
+        input.proofKeyEpoch
+      ]
+    );
+    return toRecord(result.rows[0]);
+  }
+  async get(tenant, deviceId) {
+    const result = await this.#pool.query(
+      `SELECT ${SELECT_COLUMNS} FROM device WHERE tenant_id = $1 AND device_id = $2`,
+      [tenant, deviceId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toRecord(row);
+  }
+  async revoke(tenant, deviceId) {
+    await this.#pool.query("UPDATE device SET revoked = true WHERE tenant_id = $1 AND device_id = $2", [
+      tenant,
+      deviceId
+    ]);
+  }
+  async list(tenant) {
+    const result = await this.#pool.query(
+      `SELECT ${SELECT_COLUMNS} FROM device WHERE tenant_id = $1 ORDER BY device_id`,
+      [tenant]
+    );
+    return result.rows.map(toRecord);
+  }
+  async resolveByDeviceId(deviceId) {
+    const result = await this.#pool.query(
+      `SELECT ${SELECT_COLUMNS} FROM device WHERE device_id = $1`,
+      [deviceId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toRecord(row);
+  }
+};
+var PostgresInboundDedupStore = class {
+  #pool;
+  #capacity;
+  constructor(pool, capacity = DEDUP_RING_CAPACITY) {
+    this.#pool = pool;
+    this.#capacity = capacity;
+  }
+  async checkAndRecord(tenant, deviceId, envelopeId) {
+    const inserted = await this.#pool.query(
+      `INSERT INTO inbound_dedup (tenant_id, device_id, envelope_id)
+       VALUES ($1, $2, $3)
+       ON CONFLICT (tenant_id, device_id, envelope_id) DO NOTHING
+       RETURNING 1`,
+      [tenant, deviceId, envelopeId]
+    );
+    if (inserted.rowCount === 0) return true;
+    await this.#pool.query(
+      `DELETE FROM inbound_dedup
+        WHERE tenant_id = $1 AND device_id = $2
+          AND recorded_seq <= (
+            SELECT recorded_seq FROM inbound_dedup
+             WHERE tenant_id = $1 AND device_id = $2
+             ORDER BY recorded_seq DESC
+             OFFSET $3 LIMIT 1)`,
+      [tenant, deviceId, this.#capacity]
+    );
+    return false;
+  }
+};
+var NONCE_BYTES = 24;
+var PostgresNonceStore = class {
+  #pool;
+  #clock;
+  #crypto;
+  #ttlMs;
+  constructor(pool, clock, crypto, ttlMs = NONCE_TTL_MS) {
+    this.#pool = pool;
+    this.#clock = clock;
+    this.#crypto = crypto;
+    this.#ttlMs = ttlMs;
+  }
+  async issue(tenant, deviceId) {
+    const nowMs = this.#clock.now().getTime();
+    const now = new Date(nowMs).toISOString();
+    await this.#pool.query(
+      "DELETE FROM auth_nonce WHERE tenant_id = $1 AND device_id = $2 AND (used OR expires_at < $3)",
+      [tenant, deviceId, now]
+    );
+    const nonce = this.#crypto.randomToken(NONCE_BYTES);
+    await this.#pool.query(
+      `INSERT INTO auth_nonce (tenant_id, device_id, nonce, expires_at, used)
+       VALUES ($1, $2, $3, $4, false)`,
+      [tenant, deviceId, nonce, new Date(nowMs + this.#ttlMs).toISOString()]
+    );
+    return nonce;
+  }
+  async validate(tenant, deviceId, nonce) {
+    const result = await this.#pool.query(
+      `SELECT 1 FROM auth_nonce
+        WHERE tenant_id = $1 AND device_id = $2 AND nonce = $3
+          AND used = false AND expires_at >= $4`,
+      [tenant, deviceId, nonce, this.#clock.now().toISOString()]
+    );
+    return result.rowCount === 1;
+  }
+  async markUsed(tenant, nonce) {
+    await this.#pool.query("UPDATE auth_nonce SET used = true WHERE tenant_id = $1 AND nonce = $2", [
+      tenant,
+      nonce
+    ]);
+  }
+};
+
+// src/stores/pairing-codes.ts
+var PostgresPairingCodeStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async issue(tenant, input) {
+    await this.#pool.query(
+      `INSERT INTO pairing_code (code, tenant_id, product_id, expires_at, redeemed_at)
+       VALUES ($1, $2, $3, $4, NULL)
+       ON CONFLICT (code) DO UPDATE
+         SET tenant_id = EXCLUDED.tenant_id,
+             product_id = EXCLUDED.product_id,
+             expires_at = EXCLUDED.expires_at,
+             redeemed_at = NULL`,
+      [input.code, tenant, input.productId, input.expiresAt]
+    );
+    return { code: input.code, expiresAt: input.expiresAt };
+  }
+  async redeem(code) {
+    const now = this.#clock.now().toISOString();
+    const result = await this.#pool.query(
+      `UPDATE pairing_code
+          SET redeemed_at = $2
+        WHERE code = $1 AND redeemed_at IS NULL AND expires_at >= $2
+      RETURNING tenant_id, product_id`,
+      [code, now]
+    );
+    const row = result.rows[0];
+    if (row === void 0) return void 0;
+    return { tenantId: row.tenant_id, productId: row.product_id };
+  }
+};
+
+// src/stores/receipts.ts
+var SELECT_COLUMNS2 = "tenant_id, key, body, recorded_at";
+function toReceipt(row) {
+  return {
+    tenantId: row.tenant_id,
+    key: row.key,
+    body: row.body,
+    recordedAt: row.recorded_at.toISOString()
+  };
+}
+var PostgresRequestReceiptStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async record(tenant, input) {
+    const inserted = await this.#pool.query(
+      `INSERT INTO device_request_receipts (tenant_id, key, body, recorded_at)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (tenant_id, key) DO NOTHING
+       RETURNING ${SELECT_COLUMNS2}`,
+      [tenant, input.key, input.body, this.#clock.now().toISOString()]
+    );
+    const created = inserted.rows[0];
+    if (created !== void 0) return { receipt: toReceipt(created), created: true };
+    const existing = await this.get(tenant, input.key);
+    if (existing === void 0) throw new Error(`receipt ${input.key} vanished during record`);
+    return { receipt: existing, created: false };
+  }
+  async get(tenant, key) {
+    const result = await this.#pool.query(
+      `SELECT ${SELECT_COLUMNS2} FROM device_request_receipts WHERE tenant_id = $1 AND key = $2`,
+      [tenant, key]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toReceipt(row);
+  }
+};
+
+// src/stores/proof-receipts.ts
+var SELECT_COLUMNS3 = `tenant_id, device_id, request_id, operation, resource,
+  body_sha256, body_size, response_status, response_body, recorded_at`;
+function toReceipt2(row) {
+  return {
+    tenantId: row.tenant_id,
+    deviceId: row.device_id,
+    requestId: row.request_id,
+    operation: row.operation,
+    resource: row.resource,
+    bodySha256: row.body_sha256,
+    bodySize: BigInt(row.body_size),
+    responseStatus: row.response_status,
+    responseBody: row.response_body,
+    recordedAt: row.recorded_at.toISOString()
+  };
+}
+var PostgresProofRequestReceiptStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async record(tenant, input) {
+    const result = await this.#pool.query(
+      `INSERT INTO proof_request_receipt (
+         tenant_id, device_id, request_id, operation, resource, body_sha256,
+         body_size, response_status, response_body, recorded_at
+       ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)
+       ON CONFLICT (tenant_id, device_id, request_id) DO NOTHING
+       RETURNING ${SELECT_COLUMNS3}`,
+      [
+        tenant,
+        input.deviceId,
+        input.requestId,
+        input.operation,
+        input.resource,
+        input.bodySha256,
+        input.bodySize.toString(),
+        input.responseStatus,
+        input.responseBody,
+        this.#clock.now().toISOString()
+      ]
+    );
+    const inserted = result.rows[0];
+    if (inserted !== void 0) return { receipt: toReceipt2(inserted), created: true };
+    const existing = await this.get(tenant, input.deviceId, input.requestId);
+    if (existing === void 0) throw new Error(`proof receipt ${input.requestId} vanished during record`);
+    return { receipt: existing, created: false };
+  }
+  async get(tenant, deviceId, requestId) {
+    const result = await this.#pool.query(
+      `SELECT ${SELECT_COLUMNS3}
+       FROM proof_request_receipt
+       WHERE tenant_id = $1 AND device_id = $2 AND request_id = $3`,
+      [tenant, deviceId, requestId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toReceipt2(row);
+  }
+};
+
+// src/stores/task-attempts.ts
+var SELECT_COLUMNS4 = "tenant_id, task_id, device_id, owner_device_id, status, updated_at";
+function toAttempt(row) {
+  return {
+    tenantId: row.tenant_id,
+    taskId: row.task_id,
+    deviceId: row.device_id,
+    // `exactOptionalPropertyTypes` is off here, but an explicit absent key is
+    // still what the in-memory reference produces for an unclaimed attempt, and
+    // `toEqual` in the suite treats `undefined` and absent alike only for the
+    // former.
+    ...row.owner_device_id === null ? {} : { ownerDeviceId: row.owner_device_id },
+    status: row.status,
+    updatedAt: row.updated_at.toISOString()
+  };
+}
+var PostgresTaskAttemptStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async open(tenant, input) {
+    const inserted = await this.#pool.query(
+      `INSERT INTO task (tenant_id, task_id, device_id, owner_device_id, status, updated_at)
+       VALUES ($1, $2, $3, NULL, 'offered', $4)
+       ON CONFLICT (tenant_id, task_id) DO NOTHING
+       RETURNING ${SELECT_COLUMNS4}`,
+      [tenant, input.taskId, input.deviceId, this.#now()]
+    );
+    const created = inserted.rows[0];
+    if (created !== void 0) return toAttempt(created);
+    const existing = await this.get(tenant, input.taskId);
+    if (existing === void 0) throw new Error(`task ${input.taskId} vanished during open`);
+    return existing;
+  }
+  async get(tenant, taskId) {
+    const result = await this.#pool.query(
+      `SELECT ${SELECT_COLUMNS4} FROM task WHERE tenant_id = $1 AND task_id = $2`,
+      [tenant, taskId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toAttempt(row);
+  }
+  async claim(tenant, input) {
+    const claimed = await this.#pool.query(
+      `UPDATE task
+          SET owner_device_id = $3, status = 'claimed', updated_at = $4
+        WHERE tenant_id = $1 AND task_id = $2 AND owner_device_id IS NULL
+      RETURNING ${SELECT_COLUMNS4}`,
+      [tenant, input.taskId, input.deviceId, this.#now()]
+    );
+    const won = claimed.rows[0];
+    if (won !== void 0) return toAttempt(won);
+    return this.get(tenant, input.taskId);
+  }
+  async recordStatus(tenant, input) {
+    const result = await this.#pool.query(
+      `UPDATE task
+          SET status = $3, updated_at = $4
+        WHERE tenant_id = $1 AND task_id = $2
+      RETURNING ${SELECT_COLUMNS4}`,
+      [tenant, input.taskId, input.status, this.#now()]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toAttempt(row);
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/stores/index.ts
+function createPostgresCloudStores(options) {
+  const { pool, clock, crypto } = options;
+  return {
+    devices: new PostgresDeviceDirectory(pool),
+    pairingCodes: new PostgresPairingCodeStore(pool, clock),
+    nonces: new PostgresNonceStore(pool, clock, crypto),
+    dedup: new PostgresInboundDedupStore(pool),
+    tasks: new PostgresTaskAttemptStore(pool, clock),
+    receipts: new PostgresRequestReceiptStore(pool, clock),
+    proofReceipts: new PostgresProofRequestReceiptStore(pool, clock),
+    // A second `PostgresObjectStore` instance, not a shared one: it is a
+    // stateless wrapper over the pool, so the two read and write the same rows
+    // under the same locks, and requiring the caller to build the core
+    // composition first would be an ordering dependency bought for nothing.
+    blobs: new R2CloudBlobStore({
+      ...options.objectStorage,
+      objects: new PostgresObjectStore(pool, clock)
+    }),
+    rateLimiter: new AllowAllRateLimiter()
+  };
+}
+var PRESENCE_COLUMNS = "tenant_id, device_id, level, detail, configured_toolsets, observed_at, expires_at";
+function toHint(row) {
+  return {
+    tenantId: row.tenant_id,
+    deviceId: row.device_id,
+    level: row.level,
+    ...row.detail === null ? {} : { detail: row.detail },
+    ...row.configured_toolsets === null ? {} : { configuredToolsets: Object.freeze([...row.configured_toolsets]) },
+    observedAt: row.observed_at,
+    expiresAt: row.expires_at
+  };
+}
+function toTail(row) {
+  return {
+    tenantId: row.tenant_id,
+    taskId: row.task_id,
+    entries: row.entries,
+    dropped: row.dropped,
+    capacity: row.capacity,
+    expiresAt: row.expires_at
+  };
+}
+function assertTtl(ttlMs) {
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+    throw new ByokCoreError(
+      "hint_ttl_invalid",
+      `Hint ttl must be a positive number of milliseconds, received ${String(ttlMs)}.`
+    );
+  }
+}
+function assertMinimumInterval(minimumIntervalMs) {
+  if (!Number.isFinite(minimumIntervalMs) || minimumIntervalMs < 0) {
+    throw new ByokCoreError(
+      "hint_ttl_invalid",
+      `Hint minimum interval must be a non-negative number of milliseconds, received ${String(minimumIntervalMs)}.`
+    );
+  }
+}
+var PostgresPresenceStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async publish(tenant, input) {
+    assertTtl(input.ttlMs);
+    assertMinimumInterval(input.minimumIntervalMs);
+    const now = this.#clock.now();
+    const observedAt = now.toISOString();
+    const allowedBefore = new Date(now.getTime() - input.minimumIntervalMs).toISOString();
+    const result = await this.#pool.query(
+      `INSERT INTO device_presence (${PRESENCE_COLUMNS})
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7)
+       ON CONFLICT (tenant_id, device_id) DO UPDATE
+          SET level       = EXCLUDED.level,
+              detail      = EXCLUDED.detail,
+              configured_toolsets = EXCLUDED.configured_toolsets,
+              observed_at = EXCLUDED.observed_at,
+              expires_at  = EXCLUDED.expires_at
+        WHERE device_presence.expires_at <= EXCLUDED.observed_at
+           OR device_presence.observed_at <= $8
+       RETURNING ${PRESENCE_COLUMNS}`,
+      [
+        tenant,
+        input.deviceId,
+        input.level,
+        input.detail ?? null,
+        input.configuredToolsets === void 0 ? null : JSON.stringify(input.configuredToolsets),
+        observedAt,
+        new Date(now.getTime() + input.ttlMs).toISOString(),
+        allowedBefore
+      ]
+    );
+    const row = result.rows[0];
+    if (row === void 0) {
+      throw new ByokCoreError(
+        "hint_rate_limited",
+        `Presence for ${input.deviceId} was published more recently than the configured minimum interval.`
+      );
+    }
+    return toHint(row);
+  }
+  async read(tenant, deviceId) {
+    const result = await this.#pool.query(
+      `SELECT ${PRESENCE_COLUMNS} FROM device_presence
+        WHERE tenant_id = $1 AND device_id = $2 AND expires_at > $3`,
+      [tenant, deviceId, this.#now()]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toHint(row);
+  }
+  async list(tenant) {
+    const result = await this.#pool.query(
+      `SELECT ${PRESENCE_COLUMNS} FROM device_presence
+        WHERE tenant_id = $1 AND expires_at > $2
+        ORDER BY device_id COLLATE "C"`,
+      [tenant, this.#now()]
+    );
+    return result.rows.map(toHint);
+  }
+  #expiry(ttlMs) {
+    return new Date(this.#clock.now().getTime() + ttlMs).toISOString();
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+var PostgresActivityStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async append(tenant, input) {
+    assertTtl(input.ttlMs);
+    const capacity = input.capacity ?? DEFAULT_ACTIVITY_CAPACITY;
+    if (!Number.isSafeInteger(capacity) || capacity <= 0) {
+      throw new ByokCoreError(
+        "activity_capacity_invalid",
+        `Activity capacity must be a positive integer, received ${String(capacity)}.`
+      );
+    }
+    if (input.details.length === 0 || !Number.isSafeInteger(input.dropped) || input.dropped < 0) {
+      throw new ByokCoreError(
+        "activity_batch_invalid",
+        "Activity batches require at least one detail and a non-negative integer dropped count."
+      );
+    }
+    const now = this.#now();
+    const incoming = input.details.map((detail) => ({ at: now, detail }));
+    const result = await this.#pool.query(
+      `WITH trimmed AS (
+         SELECT COALESCE(
+                  (SELECT jsonb_agg(entry ORDER BY ordinality)
+                     FROM jsonb_array_elements($4::jsonb)
+                          WITH ORDINALITY AS element(entry, ordinality)
+                    WHERE ordinality > GREATEST(jsonb_array_length($4::jsonb) - $6, 0)),
+                  '[]'::jsonb) AS entries,
+                $5::integer + GREATEST(jsonb_array_length($4::jsonb) - $6, 0) AS dropped
+       )
+       INSERT INTO activity_tail (tenant_id, task_id, entries, dropped, capacity, expires_at)
+       SELECT $1, $2, trimmed.entries, trimmed.dropped, $6, $7 FROM trimmed
+       ON CONFLICT (tenant_id, task_id) DO UPDATE
+          SET entries    = (
+                SELECT COALESCE(jsonb_agg(entry ORDER BY ordinality), '[]'::jsonb)
+                  FROM jsonb_array_elements(
+                         (CASE WHEN activity_tail.expires_at > $3
+                               THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
+                       ) WITH ORDINALITY AS element(entry, ordinality)
+                 WHERE ordinality > GREATEST(
+                   jsonb_array_length(
+                     (CASE WHEN activity_tail.expires_at > $3
+                           THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
+                   ) - $6,
+                   0
+                 )
+              ),
+              dropped    = (CASE WHEN activity_tail.expires_at > $3
+                                 THEN activity_tail.dropped ELSE 0 END)
+                           + $5::integer
+                           + GREATEST(
+                               jsonb_array_length(
+                                 (CASE WHEN activity_tail.expires_at > $3
+                                       THEN activity_tail.entries ELSE '[]'::jsonb END) || $4::jsonb
+                               ) - $6,
+                               0
+                             ),
+              capacity   = EXCLUDED.capacity,
+              expires_at = EXCLUDED.expires_at
+       RETURNING tenant_id, task_id, entries, dropped, capacity, expires_at`,
+      [
+        tenant,
+        input.taskId,
+        now,
+        JSON.stringify(incoming),
+        input.dropped,
+        capacity,
+        this.#expiry(input.ttlMs)
+      ]
+    );
+    return toTail(result.rows[0]);
+  }
+  async read(tenant, taskId) {
+    const result = await this.#pool.query(
+      `SELECT tenant_id, task_id, entries, dropped, capacity, expires_at
+         FROM activity_tail
+        WHERE tenant_id = $1 AND task_id = $2 AND expires_at > $3`,
+      [tenant, taskId, this.#now()]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toTail(row);
+  }
+  #expiry(ttlMs) {
+    return new Date(this.#clock.now().getTime() + ttlMs).toISOString();
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+var DEFAULT_LIST_LIMIT2 = 50;
+var BOARD_COLUMNS = "tenant_id, item_id, channel, title, status, holder_id, held_since, board_seq, created_at, updated_at";
+function toItem(row) {
+  return {
+    tenantId: row.tenant_id,
+    itemId: row.item_id,
+    channel: row.channel,
+    title: row.title,
+    status: row.status,
+    // An unheld item has NO assignee rather than an assignee with an empty
+    // holder, which is what lets `expect(item.assignee).toBeUndefined()` mean
+    // "nobody holds this" in both compositions.
+    ...row.holder_id === null || row.held_since === null ? {} : { assignee: { holderId: row.holder_id, heldSince: row.held_since } },
+    boardSeq: Number(row.board_seq),
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+var PostgresBoardStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async create(tenant, input) {
+    const now = this.#now();
+    const boardSeq = await this.#allocateSeq(tenant);
+    const inserted = await this.#pool.query(
+      `INSERT INTO board_item (${BOARD_COLUMNS})
+       VALUES ($1, $2, $3, $4, $5, NULL, NULL, $6::bigint, $7, $7)
+       ON CONFLICT (tenant_id, item_id) DO NOTHING
+       RETURNING ${BOARD_COLUMNS}`,
+      [tenant, input.itemId, input.channel, input.title, input.status ?? "todo", boardSeq, now]
+    );
+    const row = inserted.rows[0];
+    if (row === void 0) {
+      throw new ByokCoreError(
+        "board_item_exists",
+        `Board item ${input.itemId} already exists in this tenant.`
+      );
+    }
+    return toItem(row);
+  }
+  async get(tenant, itemId) {
+    const result = await this.#pool.query(
+      `SELECT ${BOARD_COLUMNS} FROM board_item WHERE tenant_id = $1 AND item_id = $2`,
+      [tenant, itemId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toItem(row);
+  }
+  async list(tenant, query) {
+    const afterSeq = query.afterSeq ?? 0;
+    const limit = query.limit ?? DEFAULT_LIST_LIMIT2;
+    const result = await this.#pool.query(
+      `SELECT ${BOARD_COLUMNS} FROM board_item
+        WHERE tenant_id = $1
+          AND board_seq > $2::bigint
+          AND ($3::text IS NULL OR channel = $3::text)
+          AND ($4::text IS NULL OR status = $4::text)
+        ORDER BY board_seq
+        LIMIT $5`,
+      [tenant, afterSeq, query.channel ?? null, query.status ?? null, limit + 1]
+    );
+    const page = result.rows.slice(0, limit).map(toItem);
+    return {
+      items: page,
+      nextSeq: page.at(-1)?.boardSeq ?? afterSeq,
+      hasMore: result.rows.length > page.length
+    };
+  }
+  async claim(tenant, input) {
+    const expectedStatus = input.expectedStatus ?? "todo";
+    const now = this.#now();
+    const boardSeq = await this.#allocateSeq(tenant);
+    const claimed = await this.#pool.query(
+      `UPDATE board_item
+          SET status    = CASE WHEN status = 'todo' THEN 'in_progress' ELSE status END,
+              holder_id = $3,
+              held_since = $5,
+              board_seq = $6::bigint,
+              updated_at = $5
+        WHERE tenant_id = $1 AND item_id = $2
+          AND holder_id IS NULL
+          AND status = $4::text
+          AND status IN ('todo', 'in_progress')
+       RETURNING ${BOARD_COLUMNS}`,
+      [tenant, input.itemId, input.holderId, expectedStatus, now, boardSeq]
+    );
+    const won = claimed.rows[0];
+    if (won !== void 0) return toItem(won);
+    const current = await this.get(tenant, input.itemId);
+    if (current === void 0) throw this.#itemNotFound(input.itemId);
+    if (current.assignee !== void 0) {
+      if (current.assignee.holderId === input.holderId) {
+        if (input.expectedStatus !== void 0 && current.status !== input.expectedStatus) {
+          throw this.#statusConflict(input.itemId, current, input.expectedStatus);
+        }
+        return current;
+      }
+      throw new CoreConflictError(
+        "board_claim_conflict",
+        `Board item ${input.itemId} is held by ${current.assignee.holderId}.`,
+        current,
+        this.#now()
+      );
+    }
+    if (current.status !== expectedStatus) {
+      throw this.#statusConflict(input.itemId, current, expectedStatus);
+    }
+    throw new CoreConflictError(
+      "board_transition_invalid",
+      `Board item ${input.itemId} cannot be claimed from ${current.status}.`,
+      current,
+      this.#now()
+    );
+  }
+  async unclaim(tenant, input) {
+    const now = this.#now();
+    const boardSeq = await this.#allocateSeq(tenant);
+    const released = await this.#pool.query(
+      `UPDATE board_item
+          SET status     = CASE WHEN status = 'in_progress' THEN 'todo' ELSE status END,
+              holder_id  = NULL,
+              held_since = NULL,
+              board_seq  = $4::bigint,
+              updated_at = $5
+        WHERE tenant_id = $1 AND item_id = $2 AND holder_id = $3
+       RETURNING ${BOARD_COLUMNS}`,
+      [tenant, input.itemId, input.holderId, boardSeq, now]
+    );
+    const row = released.rows[0];
+    if (row !== void 0) return toItem(row);
+    const current = await this.get(tenant, input.itemId);
+    if (current === void 0) throw this.#itemNotFound(input.itemId);
+    if (current.assignee === void 0) {
+      throw new ByokCoreError(
+        "board_not_held",
+        `Board item ${input.itemId} is not held by anyone.`
+      );
+    }
+    throw new CoreConflictError(
+      "board_claim_conflict",
+      `Board item ${input.itemId} is held by ${current.assignee.holderId}, not ${input.holderId}.`,
+      current,
+      this.#now()
+    );
+  }
+  async updateStatus(tenant, input) {
+    if (isLegalBoardTransition(input.expectedStatus, input.status)) {
+      const now = this.#now();
+      const boardSeq = await this.#allocateSeq(tenant);
+      const updated = await this.#pool.query(
+        `UPDATE board_item
+            SET status = $4::text, board_seq = $6::bigint, updated_at = $7
+          WHERE tenant_id = $1 AND item_id = $2
+            AND status = $3::text
+            AND ($5::text IS NULL OR holder_id = $5::text)
+         RETURNING ${BOARD_COLUMNS}`,
+        [
+          tenant,
+          input.itemId,
+          input.expectedStatus,
+          input.status,
+          input.holderId ?? null,
+          boardSeq,
+          now
+        ]
+      );
+      const row = updated.rows[0];
+      if (row !== void 0) return toItem(row);
+    }
+    const current = await this.get(tenant, input.itemId);
+    if (current === void 0) throw this.#itemNotFound(input.itemId);
+    if (current.status !== input.expectedStatus) {
+      throw this.#statusConflict(input.itemId, current, input.expectedStatus);
+    }
+    if (input.holderId !== void 0 && current.assignee?.holderId !== input.holderId) {
+      throw new CoreConflictError(
+        "board_claim_conflict",
+        `Board item ${input.itemId} is not held by ${input.holderId}.`,
+        current,
+        this.#now()
+      );
+    }
+    if (!isLegalBoardTransition(input.expectedStatus, input.status)) {
+      throw new CoreConflictError(
+        "board_transition_invalid",
+        `${input.expectedStatus} to ${input.status} is not a legal board transition.`,
+        current,
+        this.#now()
+      );
+    }
+    throw this.#statusConflict(input.itemId, current, input.expectedStatus);
+  }
+  /**
+   * One statement, its own transaction, lock released immediately. See the file
+   * header for why this is not a CTE inside the write it feeds.
+   */
+  async #allocateSeq(tenant) {
+    const result = await this.#pool.query(
+      `INSERT INTO tenant_stream (tenant_id, board_seq)
+       VALUES ($1, 1)
+       ON CONFLICT (tenant_id) DO UPDATE SET board_seq = tenant_stream.board_seq + 1
+       RETURNING board_seq`,
+      [tenant]
+    );
+    return result.rows[0].board_seq;
+  }
+  #itemNotFound(itemId) {
+    return new ByokCoreError(
+      "board_item_not_found",
+      `Board item ${itemId} does not exist in this tenant.`
+    );
+  }
+  #statusConflict(itemId, current, expected) {
+    return new CoreConflictError(
+      "board_status_conflict",
+      `Board item ${itemId} is ${current.status}, not ${expected}.`,
+      current,
+      this.#now()
+    );
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/stores/core/mailbox-sequence.ts
+async function allocateMailboxSequence(client, tenant, deviceId, now) {
+  const allocation = await client.query(
+    `INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
+     VALUES ($1, $2, 2, 0, $3)
+     ON CONFLICT (tenant_id, device_id) DO UPDATE
+        SET next_seq = device_stream.next_seq + 1
+     RETURNING next_seq - 1 AS seq`,
+    [tenant, deviceId, now]
+  );
+  return Number(allocation.rows[0].seq);
+}
+
+// src/stores/core/mailbox.ts
+var DEFAULT_READ_LIMIT = 50;
+var OUTBOX_COLUMNS = "tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at";
+function toMessage(row) {
+  return {
+    tenantId: row.tenant_id,
+    deviceId: row.device_id,
+    // `seq` is bigint in the column and `number` on the port, because it is the
+    // envelope `seq` on the wire. The column is wide so the counter cannot wrap
+    // into a redelivery bug; the narrowing happens once, here.
+    seq: Number(row.seq),
+    messageId: row.message_id,
+    body: row.body,
+    bodyHash: row.body_hash,
+    byteSize: row.byte_size,
+    state: row.state,
+    appendedAt: row.appended_at
+  };
+}
+var PostgresMailboxStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async append(tenant, input) {
+    this.#requireDeviceId(input.deviceId);
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const existing = await client.query(
+        `SELECT ${OUTBOX_COLUMNS} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+        [tenant, input.deviceId, input.messageId]
+      );
+      const replayed = existing.rows[0];
+      if (replayed !== void 0) {
+        await client.query("COMMIT");
+        return toMessage(replayed);
+      }
+      const seq = await allocateMailboxSequence(client, tenant, input.deviceId, this.#now());
+      const serializedExisting = await client.query(
+        `SELECT ${OUTBOX_COLUMNS} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+        [tenant, input.deviceId, input.messageId]
+      );
+      const winnerAfterLock = serializedExisting.rows[0];
+      if (winnerAfterLock !== void 0) {
+        await client.query("ROLLBACK");
+        return toMessage(winnerAfterLock);
+      }
+      const materialized = await input.materialize(seq);
+      const now = this.#now();
+      const inserted = await client.query(
+        `INSERT INTO outbox (${OUTBOX_COLUMNS})
+         VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8)
+         ON CONFLICT (tenant_id, device_id, message_id) DO NOTHING
+         RETURNING ${OUTBOX_COLUMNS}`,
+        [
+          tenant,
+          input.deviceId,
+          seq,
+          input.messageId,
+          materialized.body,
+          materialized.bodyHash,
+          materialized.byteSize,
+          now
+        ]
+      );
+      const row = inserted.rows[0];
+      if (row !== void 0) {
+        await client.query("COMMIT");
+        return toMessage(row);
+      }
+      const winner = await client.query(
+        `SELECT ${OUTBOX_COLUMNS} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+        [tenant, input.deviceId, input.messageId]
+      );
+      await client.query("ROLLBACK");
+      const won = winner.rows[0];
+      if (won === void 0) {
+        throw new ByokCoreError(
+          "mailbox_message_not_found",
+          `Message ${input.messageId} vanished during an idempotent append.`
+        );
+      }
+      return toMessage(won);
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+  }
+  async readAfter(tenant, query) {
+    const limit = query.limit ?? DEFAULT_READ_LIMIT;
+    const result = await this.#pool.query(
+      `SELECT ${OUTBOX_COLUMNS} FROM outbox
+        WHERE tenant_id = $1 AND device_id = $2 AND state = 'pending' AND seq > $3::bigint
+        ORDER BY seq
+        LIMIT $4`,
+      [tenant, query.deviceId, query.afterSeq, limit + 1]
+    );
+    const page = result.rows.slice(0, limit).map(toMessage);
+    return {
+      messages: page,
+      // Nothing above was mutated, so an identical call replays the same page.
+      // The returned position is a READ cursor and moves no ack.
+      nextSeq: page.at(-1)?.seq ?? query.afterSeq,
+      hasMore: result.rows.length > page.length
+    };
+  }
+  async advanceCursor(tenant, input) {
+    this.#requireDeviceId(input.deviceId);
+    const now = this.#now();
+    const moved = await this.#pool.query(
+      `WITH moved AS (
+         INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
+         VALUES ($1, $2, 1, $3::bigint, $4)
+         ON CONFLICT (tenant_id, device_id) DO UPDATE
+            SET acked_seq = EXCLUDED.acked_seq, acked_at = EXCLUDED.acked_at
+          WHERE device_stream.acked_seq <= EXCLUDED.acked_seq
+         RETURNING acked_seq, acked_at
+       ), marked AS (
+         UPDATE outbox
+            SET state = 'acked'
+          WHERE tenant_id = $1 AND device_id = $2 AND state = 'pending'
+            AND seq <= (SELECT acked_seq FROM moved)
+         RETURNING 1
+       )
+       SELECT acked_seq, acked_at FROM moved`,
+      [tenant, input.deviceId, input.ackedSeq, now]
+    );
+    const row = moved.rows[0];
+    if (row !== void 0) {
+      return {
+        tenantId: tenant,
+        deviceId: input.deviceId,
+        ackedSeq: Number(row.acked_seq),
+        updatedAt: row.acked_at ?? now
+      };
+    }
+    const current = await this.readCursor(tenant, input.deviceId);
+    throw new CoreConflictError(
+      "mailbox_cursor_regression",
+      `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
+      current,
+      this.#now()
+    );
+  }
+  async readCursor(tenant, deviceId) {
+    const result = await this.#pool.query(
+      `SELECT acked_seq, acked_at FROM device_stream
+        WHERE tenant_id = $1 AND device_id = $2`,
+      [tenant, deviceId]
+    );
+    const row = result.rows[0];
+    return {
+      tenantId: tenant,
+      deviceId,
+      ackedSeq: row === void 0 ? 0 : Number(row.acked_seq),
+      updatedAt: row?.acked_at ?? this.#now()
+    };
+  }
+  async collectRetired(tenant, input) {
+    assertCanonicalTimestamp(input.ackedBefore, "ackedBefore");
+    assertCanonicalTimestamp(input.expireUnackedBefore, "expireUnackedBefore");
+    const swept = await this.#pool.query(
+      `WITH deleted AS (
+         DELETE FROM outbox
+          WHERE tenant_id = $1
+            AND ($2::text IS NULL OR device_id = $2::text)
+            AND state = 'acked'
+            AND appended_at < $3
+         RETURNING byte_size
+       ), expired AS (
+         UPDATE outbox
+            SET state = 'expired'
+          WHERE tenant_id = $1
+            AND ($2::text IS NULL OR device_id = $2::text)
+            AND state = 'pending'
+            AND appended_at < $4
+         RETURNING 1
+       )
+       SELECT (SELECT count(*) FROM deleted)                           AS deleted_count,
+              (SELECT count(*) FROM expired)                           AS expired_count,
+              (SELECT COALESCE(SUM(byte_size), 0) FROM deleted)::bigint AS released_bytes`,
+      [tenant, input.deviceId ?? null, input.ackedBefore, input.expireUnackedBefore]
+    );
+    const row = swept.rows[0];
+    return {
+      deletedCount: Number(row.deleted_count),
+      expiredCount: Number(row.expired_count),
+      releasedBytes: row.released_bytes
+    };
+  }
+  /**
+   * The in-memory reference refuses an empty device id rather than opening a
+   * mailbox nothing can address. Kept here so the two compositions answer the
+   * same way; the table itself would happily store the row.
+   */
+  #requireDeviceId(deviceId) {
+    if (deviceId.length === 0) {
+      throw new ByokCoreError("mailbox_message_not_found", "Device id must not be empty.");
+    }
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+var WARNING_NUMERATOR = 80n;
+var WARNING_DENOMINATOR = 100n;
+var ENTITLEMENT_COLUMNS = "tenant_id, version, hard_limit_bytes, max_object_bytes, max_inline_bytes, mailbox_limit_bytes, retention_policy_id, downgrade_grace_until";
+var RESERVATION_COLUMNS = "tenant_id, reservation_id, state, kind, expected_bytes, content_hash, content_type, created_at, expires_at, settled_at, deduplicated";
+var QUALIFIED_RESERVATION_COLUMNS = RESERVATION_COLUMNS.split(", ").map((column) => `r.${column}`).join(", ");
+function toEntitlement(row) {
+  return {
+    tenantId: row.tenant_id,
+    version: row.version,
+    hardLimitBytes: row.hard_limit_bytes,
+    maxObjectBytes: row.max_object_bytes,
+    maxInlineBytes: row.max_inline_bytes,
+    mailboxLimitBytes: row.mailbox_limit_bytes,
+    retentionPolicyId: row.retention_policy_id,
+    ...row.downgrade_grace_until === null ? {} : { downgradeGraceUntil: row.downgrade_grace_until }
+  };
+}
+function toReservation(row) {
+  return {
+    tenantId: row.tenant_id,
+    reservationId: row.reservation_id,
+    state: row.state,
+    kind: row.kind,
+    expectedBytes: row.expected_bytes,
+    contentHash: row.content_hash,
+    contentType: row.content_type,
+    createdAt: row.created_at,
+    expiresAt: row.expires_at,
+    ...row.settled_at === null ? {} : { settledAt: row.settled_at }
+  };
+}
+function toUsage(row) {
+  return {
+    committedObjectBytes: row.committed_object_bytes,
+    committedInlineBytes: row.committed_inline_bytes,
+    reservedBytes: row.reserved_bytes,
+    mailboxBytes: row.mailbox_bytes,
+    objectCount: row.object_count,
+    updatedAt: row.updated_at
+  };
+}
+var USAGE_SQL = `
+  SELECT
+    COALESCE(u.committed_object_bytes, 0)::bigint AS committed_object_bytes,
+    COALESCE(u.committed_inline_bytes, 0)::bigint AS committed_inline_bytes,
+    COALESCE(u.mailbox_bytes, 0)::bigint          AS mailbox_bytes,
+    COALESCE(u.object_count, 0)::bigint           AS object_count,
+    COALESCE(u.updated_at, $2)                    AS updated_at,
+    COALESCE((SELECT SUM(r.expected_bytes) FROM storage_reservation r
+               WHERE r.tenant_id = $1 AND r.state = 'reserved'), 0)::bigint AS reserved_bytes
+    FROM (SELECT $1::text AS tenant_id) AS scope
+    LEFT JOIN storage_usage u ON u.tenant_id = scope.tenant_id`;
+var PostgresQuotaStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async readEntitlement(tenant) {
+    const result = await this.#pool.query(
+      `SELECT ${ENTITLEMENT_COLUMNS} FROM storage_entitlement WHERE tenant_id = $1`,
+      [tenant]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toEntitlement(row);
+  }
+  async writeEntitlement(tenant, input) {
+    if (input.downgradeGraceUntil !== void 0) {
+      assertCanonicalTimestamp(input.downgradeGraceUntil, "downgradeGraceUntil");
+    }
+    const applied = await this.#pool.query(
+      `WITH applied AS (
+         INSERT INTO storage_entitlement (${ENTITLEMENT_COLUMNS})
+         VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+         ON CONFLICT (tenant_id) DO UPDATE
+            SET version               = EXCLUDED.version,
+                hard_limit_bytes      = EXCLUDED.hard_limit_bytes,
+                max_object_bytes      = EXCLUDED.max_object_bytes,
+                max_inline_bytes      = EXCLUDED.max_inline_bytes,
+                mailbox_limit_bytes   = EXCLUDED.mailbox_limit_bytes,
+                retention_policy_id   = EXCLUDED.retention_policy_id,
+                downgrade_grace_until = EXCLUDED.downgrade_grace_until
+          WHERE storage_entitlement.version < EXCLUDED.version
+         RETURNING ${ENTITLEMENT_COLUMNS}
+       ), seeded AS (
+         INSERT INTO storage_usage (tenant_id, updated_at)
+         SELECT $1, $9 FROM applied
+         ON CONFLICT (tenant_id) DO NOTHING
+         RETURNING 1
+       )
+       SELECT ${ENTITLEMENT_COLUMNS} FROM applied`,
+      [
+        tenant,
+        input.version,
+        input.hardLimitBytes,
+        input.maxObjectBytes,
+        input.maxInlineBytes,
+        input.mailboxLimitBytes,
+        input.retentionPolicyId,
+        input.downgradeGraceUntil ?? null,
+        this.#now()
+      ]
+    );
+    const row = applied.rows[0];
+    if (row !== void 0) return toEntitlement(row);
+    const current = await this.readEntitlement(tenant);
+    if (current === void 0) {
+      throw new Error(`entitlement for ${tenant} vanished during a version CAS`);
+    }
+    throw new CoreConflictError(
+      "storage_entitlement_version_conflict",
+      `Entitlement is at version ${String(current.version)}; refusing to apply version ${String(input.version)}.`,
+      current,
+      this.#now()
+    );
+  }
+  async readUsage(tenant) {
+    const result = await this.#pool.query(USAGE_SQL, [tenant, this.#now()]);
+    return toUsage(result.rows[0]);
+  }
+  async readStatus(tenant) {
+    const entitlement = await this.readEntitlement(tenant);
+    if (entitlement === void 0) throw this.#entitlementMissing();
+    const usage = await this.readUsage(tenant);
+    const used = usedBytes(usage);
+    const graceActive = this.#graceActive(entitlement);
+    return {
+      entitlement,
+      usage,
+      posture: posture(entitlement, usage, graceActive),
+      availableBytes: used >= entitlement.hardLimitBytes ? 0n : entitlement.hardLimitBytes - used,
+      graceActive
+    };
+  }
+  async readReservation(tenant, reservationId) {
+    return (await this.#readReservation(tenant, reservationId))?.reservation;
+  }
+  async reserve(tenant, input) {
+    const client = await this.#pool.connect();
+    let admitted;
+    let rejection;
+    try {
+      await client.query("BEGIN");
+      const entitlement = await this.#lockEntitlement(client, tenant);
+      if (entitlement === void 0) {
+        rejection = this.#entitlementMissing();
+      } else {
+        const now = this.#now();
+        await client.query(
+          `UPDATE storage_reservation
+              SET state = 'expired', settled_at = $2
+            WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $2`,
+          [tenant, now]
+        );
+        const inserted = await client.query(
+          `WITH ent AS (
+             SELECT hard_limit_bytes, max_object_bytes, max_inline_bytes, downgrade_grace_until
+               FROM storage_entitlement WHERE tenant_id = $1
+           ), used AS (
+             SELECT COALESCE((SELECT committed_object_bytes + committed_inline_bytes
+                                FROM storage_usage WHERE tenant_id = $1), 0)::bigint
+                  + COALESCE((SELECT SUM(expected_bytes) FROM storage_reservation
+                               WHERE tenant_id = $1 AND state = 'reserved'), 0)::bigint
+                  AS used_bytes
+           )
+           INSERT INTO storage_reservation
+             (tenant_id, reservation_id, state, kind, expected_bytes,
+              content_hash, content_type, created_at, expires_at)
+           SELECT $1, $2, 'reserved', $3::text, $4::bigint, $5, $6, $7, $8
+             FROM ent, used
+            WHERE $4::bigint <= (CASE WHEN $3::text = 'object'
+                                      THEN ent.max_object_bytes
+                                      ELSE ent.max_inline_bytes END)
+              AND used.used_bytes + $4::bigint <= ent.hard_limit_bytes
+              AND ($3::text <> 'object' OR NOT EXISTS (
+                    SELECT 1 FROM object_manifest m
+                     WHERE m.tenant_id = $1 AND m.hash = $5
+                       AND m.state = 'delete_pending'
+                  ))
+              AND NOT (used.used_bytes >= ent.hard_limit_bytes
+                       AND ent.downgrade_grace_until IS NOT NULL
+                       AND ent.downgrade_grace_until <= $9)
+           ON CONFLICT (tenant_id, reservation_id) DO NOTHING
+           RETURNING ${RESERVATION_COLUMNS}`,
+          [
+            tenant,
+            input.reservationId,
+            input.kind,
+            input.expectedBytes,
+            input.contentHash,
+            input.contentType,
+            now,
+            this.#expiry(input.ttlMs),
+            now
+          ]
+        );
+        const row = inserted.rows[0];
+        if (row !== void 0) {
+          admitted = toReservation(row);
+        } else {
+          const outcome = await this.#explainRefusedReservation(
+            client,
+            tenant,
+            input,
+            entitlement
+          );
+          if (outcome instanceof ByokCoreError) rejection = outcome;
+          else admitted = outcome;
+        }
+      }
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw error;
+    } finally {
+      client.release();
+    }
+    if (rejection !== void 0) throw rejection;
+    return admitted;
+  }
+  async finalizeReservation(tenant, input) {
+    const existing = await this.#readReservation(tenant, input.reservationId);
+    if (existing === void 0) throw this.#reservationMissing(input.reservationId);
+    if (existing.reservation.state === "committed") {
+      return {
+        reservation: existing.reservation,
+        usage: await this.readUsage(tenant),
+        deduplicated: existing.deduplicated
+      };
+    }
+    if (existing.reservation.state !== "reserved") {
+      throw new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} is ${existing.reservation.state}.`
+      );
+    }
+    if (this.#now() >= existing.reservation.expiresAt) {
+      await this.#settle(tenant, input.reservationId, "expired");
+      throw new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} expired at ${existing.reservation.expiresAt}.`
+      );
+    }
+    if (input.observedByteSize !== existing.reservation.expectedBytes || input.observedContentType !== existing.reservation.contentType) {
+      await this.#settle(tenant, input.reservationId, "aborted");
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Observed object does not match reservation ${input.reservationId}.`
+      );
+    }
+    const settled = await this.#pool.query(
+      `WITH candidate AS MATERIALIZED (
+         SELECT r.tenant_id,
+                r.reservation_id,
+                r.kind,
+                r.content_hash,
+                r.expected_bytes,
+                r.content_type,
+                m.state AS manifest_state,
+                (m.tenant_id IS NOT NULL
+                 AND m.state IN ('pending', 'committed')
+                 AND m.byte_size = $4::bigint
+                 AND m.content_type = $5) AS manifest_valid,
+                EXISTS (
+                  SELECT 1 FROM storage_reservation p
+                   WHERE p.tenant_id = r.tenant_id
+                     AND p.content_hash = r.content_hash
+                     AND p.state = 'committed'
+                ) AS inline_deduplicated
+           FROM storage_reservation r
+           LEFT JOIN object_manifest m
+             ON m.tenant_id = r.tenant_id AND m.hash = r.content_hash
+          WHERE r.tenant_id = $1
+            AND r.reservation_id = $2
+            AND r.state = 'reserved'
+       ), committed_manifest AS (
+         UPDATE object_manifest m
+            SET state = 'committed', updated_at = $3
+           FROM candidate c
+          WHERE c.kind = 'object'
+            AND c.manifest_valid
+            AND m.state = 'pending'
+            AND m.tenant_id = c.tenant_id
+            AND m.hash = c.content_hash
+         RETURNING 1
+       ), settled AS (
+         UPDATE storage_reservation r
+            SET state = CASE
+                          WHEN c.kind = 'object' AND NOT c.manifest_valid
+                            THEN 'aborted'
+                          ELSE 'committed'
+                        END,
+                settled_at = $3,
+                deduplicated = CASE
+                                 WHEN c.kind = 'object'
+                                   THEN NOT EXISTS (SELECT 1 FROM committed_manifest)
+                                 ELSE c.inline_deduplicated
+                               END
+           FROM candidate c,
+                (SELECT COUNT(*) FROM committed_manifest) AS manifest_barrier
+          WHERE r.tenant_id = c.tenant_id
+            AND r.reservation_id = c.reservation_id
+            AND r.state = 'reserved'
+         RETURNING ${QUALIFIED_RESERVATION_COLUMNS}
+       ), accounted AS (
+         UPDATE storage_usage u
+            SET committed_object_bytes = u.committed_object_bytes
+                  + CASE WHEN s.kind = 'object' AND NOT s.deduplicated
+                         THEN s.expected_bytes ELSE 0 END,
+                committed_inline_bytes = u.committed_inline_bytes
+                  + CASE WHEN s.kind = 'inline' AND NOT s.deduplicated
+                         THEN s.expected_bytes ELSE 0 END,
+                object_count = u.object_count
+                  + CASE WHEN s.kind = 'object' AND NOT s.deduplicated THEN 1 ELSE 0 END,
+                updated_at = $3
+           FROM settled s
+          WHERE u.tenant_id = $1 AND s.state = 'committed'
+         RETURNING 1
+       )
+       SELECT ${RESERVATION_COLUMNS} FROM settled`,
+      [
+        tenant,
+        input.reservationId,
+        this.#now(),
+        input.observedByteSize,
+        input.observedContentType
+      ]
+    );
+    const row = settled.rows[0];
+    if (row === void 0) {
+      const raced = await this.#readReservation(tenant, input.reservationId);
+      if (raced !== void 0 && raced.reservation.state === "committed") {
+        return {
+          reservation: raced.reservation,
+          usage: await this.readUsage(tenant),
+          deduplicated: raced.deduplicated
+        };
+      }
+      throw new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} was settled concurrently.`
+      );
+    }
+    const reservation = toReservation(row);
+    if (reservation.state === "aborted") {
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Reservation ${input.reservationId} has no matching committable object manifest.`
+      );
+    }
+    return {
+      reservation,
+      usage: await this.readUsage(tenant),
+      deduplicated: row.deduplicated
+    };
+  }
+  async abortReservation(tenant, reservationId) {
+    const existing = await this.#readReservation(tenant, reservationId);
+    if (existing === void 0) throw this.#reservationMissing(reservationId);
+    if (existing.reservation.state !== "reserved") return existing.reservation;
+    const settled = await this.#settle(tenant, reservationId, "aborted");
+    if (settled !== void 0) return settled;
+    const raced = await this.#readReservation(tenant, reservationId);
+    if (raced === void 0) throw this.#reservationMissing(reservationId);
+    return raced.reservation;
+  }
+  async expireReservations(tenant) {
+    const expired = await this.#pool.query(
+      `UPDATE storage_reservation
+          SET state = 'expired', settled_at = $2
+        WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $2
+       RETURNING ${RESERVATION_COLUMNS}`,
+      [tenant, this.#now()]
+    );
+    return expired.rows.map(toReservation).sort((left, right) => left.reservationId.localeCompare(right.reservationId));
+  }
+  async applyMailboxDelta(tenant, input) {
+    const applied = await this.#pool.query(
+      `WITH ent AS (
+         SELECT mailbox_limit_bytes FROM storage_entitlement WHERE tenant_id = $1
+       )
+       UPDATE storage_usage u
+          SET mailbox_bytes = GREATEST(u.mailbox_bytes + $2::bigint, 0::bigint),
+              updated_at    = $3
+         FROM ent
+        WHERE u.tenant_id = $1
+          AND ($2::bigint <= 0 OR u.mailbox_bytes + $2::bigint <= ent.mailbox_limit_bytes)
+       RETURNING 1`,
+      [tenant, input.deltaBytes, this.#now()]
+    );
+    if (applied.rowCount === 0) {
+      const entitlement = await this.readEntitlement(tenant);
+      if (entitlement === void 0) throw this.#entitlementMissing();
+      const usage = await this.readUsage(tenant);
+      throw new ByokCoreError(
+        "storage_quota_exceeded",
+        `Mailbox would reach ${String(usage.mailboxBytes + input.deltaBytes)} bytes, over the limit of ${String(entitlement.mailboxLimitBytes)} bytes.`
+      );
+    }
+    return this.readUsage(tenant);
+  }
+  async #lockEntitlement(client, tenant) {
+    const result = await client.query(
+      `SELECT ${ENTITLEMENT_COLUMNS} FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE`,
+      [tenant]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toEntitlement(row);
+  }
+  /**
+   * Names the refusal. Runs only after the guarded insert has already declined,
+   * inside the same locked transaction, so the state it reads is the state that
+   * refused. The order matches the contract's precedence: an existing
+   * reservation is an idempotent answer, not a rejection; a suspended tenant is
+   * read-only (423) before it is over-quota (507); a single oversized write is
+   * 413 regardless of how much room is left.
+   */
+  async #explainRefusedReservation(client, tenant, input, entitlement) {
+    const existing = await client.query(
+      `SELECT ${RESERVATION_COLUMNS} FROM storage_reservation
+        WHERE tenant_id = $1 AND reservation_id = $2`,
+      [tenant, input.reservationId]
+    );
+    const held = existing.rows[0];
+    if (held !== void 0) {
+      if (held.state === "reserved") {
+        if (held.kind !== input.kind || held.expected_bytes !== input.expectedBytes || held.content_hash !== input.contentHash || held.content_type !== input.contentType) {
+          return new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Reservation ${input.reservationId} already binds a different storage declaration.`
+          );
+        }
+        return toReservation(held);
+      }
+      return new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} is already ${held.state}.`
+      );
+    }
+    if (input.kind === "object") {
+      const tombstone = await client.query(
+        `SELECT state FROM object_manifest
+          WHERE tenant_id = $1 AND hash = $2 AND state = 'delete_pending'`,
+        [tenant, input.contentHash]
+      );
+      if (tombstone.rows[0] !== void 0) {
+        return new ByokCoreError(
+          "object_state_invalid",
+          `Object ${input.contentHash} is pending deletion and cannot accept a new reservation.`
+        );
+      }
+    }
+    const usageResult = await client.query(USAGE_SQL, [tenant, this.#now()]);
+    const usage = toUsage(usageResult.rows[0]);
+    if (posture(entitlement, usage, this.#graceActive(entitlement)) === "suspended") {
+      return new ByokCoreError(
+        "storage_write_suspended",
+        "Tenant is over its hard limit and its downgrade grace has ended; durable writes are suspended."
+      );
+    }
+    const perWriteLimit = input.kind === "object" ? entitlement.maxObjectBytes : entitlement.maxInlineBytes;
+    if (input.expectedBytes > perWriteLimit) {
+      return new ByokCoreError(
+        "storage_object_too_large",
+        `${String(input.expectedBytes)} bytes exceeds the ${input.kind} limit of ${String(perWriteLimit)} bytes.`
+      );
+    }
+    return new ByokCoreError(
+      "storage_quota_exceeded",
+      `Reserving ${String(input.expectedBytes)} bytes would exceed the hard limit of ${String(entitlement.hardLimitBytes)} bytes.`
+    );
+  }
+  async #readReservation(tenant, reservationId) {
+    const result = await this.#pool.query(
+      `SELECT ${RESERVATION_COLUMNS} FROM storage_reservation
+        WHERE tenant_id = $1 AND reservation_id = $2`,
+      [tenant, reservationId]
+    );
+    const row = result.rows[0];
+    if (row === void 0) return void 0;
+    return { reservation: toReservation(row), deduplicated: row.deduplicated };
+  }
+  /**
+   * The settle guard. `WHERE state = 'reserved'` is what makes two settlements
+   * of the same reservation produce one winner; the loser gets zero rows and
+   * re-reads rather than stamping a second `settled_at` over the first.
+   * Releasing the reserved bytes needs no second write: they were never a
+   * counter, only the sum of rows in this state.
+   */
+  async #settle(tenant, reservationId, state) {
+    const result = await this.#pool.query(
+      `UPDATE storage_reservation
+          SET state = $3, settled_at = $4
+        WHERE tenant_id = $1 AND reservation_id = $2 AND state = 'reserved'
+       RETURNING ${RESERVATION_COLUMNS}`,
+      [tenant, reservationId, state, this.#now()]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toReservation(row);
+  }
+  #graceActive(entitlement) {
+    return entitlement.downgradeGraceUntil !== void 0 && this.#now() < entitlement.downgradeGraceUntil;
+  }
+  #entitlementMissing() {
+    return new ByokCoreError(
+      "storage_entitlement_missing",
+      "No storage entitlement has been issued for this tenant."
+    );
+  }
+  #reservationMissing(reservationId) {
+    return new ByokCoreError(
+      "storage_reservation_not_found",
+      `Reservation ${reservationId} does not exist in this tenant.`
+    );
+  }
+  #expiry(ttlMs) {
+    return new Date(this.#clock.now().getTime() + ttlMs).toISOString();
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+function usedBytes(usage) {
+  return usage.committedObjectBytes + usage.committedInlineBytes + usage.reservedBytes;
+}
+function posture(entitlement, usage, graceActive) {
+  const used = usedBytes(usage);
+  if (used >= entitlement.hardLimitBytes) {
+    const graceConfigured = entitlement.downgradeGraceUntil !== void 0;
+    return graceConfigured && !graceActive ? "suspended" : "blocked";
+  }
+  if (entitlement.hardLimitBytes > 0n && used * WARNING_DENOMINATOR >= entitlement.hardLimitBytes * WARNING_NUMERATOR) {
+    return "warning";
+  }
+  return "normal";
+}
+var DEFAULT_LIST_LIMIT3 = 50;
+function toManifest(pack, files) {
+  return {
+    schema: SKILL_PACK_MANIFEST_SCHEMA_ID,
+    name: pack.name,
+    version: pack.version,
+    description: pack.description,
+    files: files.map(toFile),
+    contentHash: pack.content_hash
+  };
+}
+function toFile(row) {
+  return {
+    path: row.path,
+    contentHash: row.content_hash,
+    byteSize: row.byte_size
+  };
+}
+var PostgresSkillPackStore = class {
+  #pool;
+  constructor(pool) {
+    this.#pool = pool;
+  }
+  async publish(tenant, input) {
+    const { manifest } = input;
+    const structural = checkSkillPackManifest(manifest);
+    if (!structural.ok) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `Refusing to publish ${JSON.stringify(manifest.name)}: ${structural.reason} \u2014 ${structural.detail}`
+      );
+    }
+    const contents = /* @__PURE__ */ new Map();
+    for (const file of input.files) {
+      if (contents.has(file.path)) {
+        throw new ByokCoreError(
+          "skill_pack_manifest_invalid",
+          `Refusing to publish ${JSON.stringify(manifest.name)}: ${JSON.stringify(file.path)} was supplied twice.`
+        );
+      }
+      contents.set(file.path, file.content);
+    }
+    for (const declared of manifest.files) {
+      const content = contents.get(declared.path);
+      if (content === void 0) {
+        throw new ByokCoreError(
+          "skill_pack_manifest_invalid",
+          `Refusing to publish ${JSON.stringify(manifest.name)}: ${JSON.stringify(declared.path)} is declared but was not supplied.`
+        );
+      }
+      const bytes = new TextEncoder().encode(content).length;
+      if (bytes !== declared.byteSize) {
+        throw new ByokCoreError(
+          "skill_pack_manifest_invalid",
+          `Refusing to publish ${JSON.stringify(manifest.name)}: ${JSON.stringify(declared.path)} declares ${declared.byteSize} bytes and supplies ${bytes}.`
+        );
+      }
+    }
+    if (contents.size !== manifest.files.length) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `Refusing to publish ${JSON.stringify(manifest.name)}: ${contents.size} files were supplied for ${manifest.files.length} declared rows.`
+      );
+    }
+    const entry = checkSkillPackEntry(manifest, contents.get(SKILL_PACK_ENTRY_PATH));
+    if (!entry.ok) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `Refusing to publish ${JSON.stringify(manifest.name)}: ${entry.reason} \u2014 ${entry.detail}`
+      );
+    }
+    await this.#inTransaction(async (client) => {
+      await client.query(
+        `INSERT INTO skill_pack (tenant_id, name, version, description, content_hash)
+         VALUES ($1, $2, $3, $4, $5)
+         ON CONFLICT (tenant_id, name) DO UPDATE
+            SET version      = EXCLUDED.version,
+                description  = EXCLUDED.description,
+                content_hash = EXCLUDED.content_hash`,
+        [tenant, manifest.name, manifest.version, manifest.description, manifest.contentHash]
+      );
+      await client.query(`DELETE FROM skill_pack_file WHERE tenant_id = $1 AND pack_name = $2`, [
+        tenant,
+        manifest.name
+      ]);
+      for (const declared of manifest.files) {
+        await client.query(
+          `INSERT INTO skill_pack_file (tenant_id, pack_name, path, content_hash, byte_size, content)
+           VALUES ($1, $2, $3, $4, $5, $6)`,
+          [
+            tenant,
+            manifest.name,
+            declared.path,
+            declared.contentHash,
+            declared.byteSize,
+            contents.get(declared.path)
+          ]
+        );
+      }
+    });
+    return manifest;
+  }
+  async get(tenant, name) {
+    const packResult = await this.#pool.query(
+      `SELECT name, version, description, content_hash
+         FROM skill_pack WHERE tenant_id = $1 AND name = $2`,
+      [tenant, name]
+    );
+    const pack = packResult.rows[0];
+    if (pack === void 0) return void 0;
+    const files = await this.#filesFor(tenant, [name]);
+    return toManifest(pack, files);
+  }
+  async list(tenant, query) {
+    const packs = await this.#pool.query(
+      `SELECT name, version, description, content_hash
+         FROM skill_pack WHERE tenant_id = $1
+        ORDER BY name COLLATE "C"
+        LIMIT $2`,
+      [tenant, query.limit ?? DEFAULT_LIST_LIMIT3]
+    );
+    if (packs.rows.length === 0) return [];
+    const files = await this.#filesFor(
+      tenant,
+      packs.rows.map((row) => row.name)
+    );
+    const byPack = /* @__PURE__ */ new Map();
+    for (const file of files) {
+      const bucket = byPack.get(file.pack_name);
+      if (bucket === void 0) byPack.set(file.pack_name, [file]);
+      else bucket.push(file);
+    }
+    return packs.rows.map((pack) => toManifest(pack, byPack.get(pack.name) ?? []));
+  }
+  async readFile(tenant, name, path) {
+    const result = await this.#pool.query(
+      `SELECT pack_name, path, content_hash, byte_size, content
+         FROM skill_pack_file
+        WHERE tenant_id = $1 AND pack_name = $2 AND path = $3`,
+      [tenant, name, path]
+    );
+    const row = result.rows[0];
+    if (row === void 0) return void 0;
+    return {
+      path: row.path,
+      contentHash: row.content_hash,
+      byteSize: row.byte_size,
+      content: row.content
+    };
+  }
+  /** Every file row for the named packs, in byte order of (pack_name, path). */
+  async #filesFor(tenant, names) {
+    const result = await this.#pool.query(
+      `SELECT pack_name, path, content_hash, byte_size, content
+         FROM skill_pack_file
+        WHERE tenant_id = $1 AND pack_name = ANY($2::text[])
+        ORDER BY pack_name COLLATE "C", path COLLATE "C"`,
+      [tenant, names]
+    );
+    return result.rows;
+  }
+  async #inTransaction(run) {
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      await run(client);
+      await client.query("COMMIT");
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+};
+var DEFAULT_MANIFEST_LIMIT = 100;
+var RECORD_COLUMNS = "tenant_id, kind, subject_id, rev, content_hash, byte_size, body_kind, body_inline, body_object_hash, label, request_id, written_at";
+function toBody(row) {
+  return row.body_kind === "inline" ? { kind: "inline", body: row.body_inline ?? "" } : { kind: "object", hash: row.body_object_hash ?? "" };
+}
+function toRecord2(row) {
+  return {
+    tenantId: row.tenant_id,
+    kind: row.kind,
+    recordKey: row.subject_id,
+    rev: row.rev,
+    contentHash: row.content_hash,
+    byteSize: row.byte_size,
+    body: toBody(row),
+    ...row.label === null ? {} : { label: row.label },
+    ...row.request_id === null ? {} : { requestId: row.request_id },
+    writtenAt: row.written_at
+  };
+}
+function bodyColumns(body) {
+  return body.kind === "inline" ? ["inline", body.body, null] : ["object", null, body.hash];
+}
+var PostgresTruthStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async writeTerminal(tenant, input) {
+    const [bodyKind, bodyInline, bodyObjectHash] = bodyColumns(input.body);
+    const inserted = await this.#pool.query(
+      `INSERT INTO attested_record (${RECORD_COLUMNS})
+       VALUES ($1, 'task.terminal', $2, 1, $3, $4::bigint, $5, $6, $7, $8, $9, $10)
+       ON CONFLICT (tenant_id, kind, subject_id) DO NOTHING
+       RETURNING ${RECORD_COLUMNS}`,
+      [
+        tenant,
+        input.taskId,
+        input.contentHash,
+        input.byteSize,
+        bodyKind,
+        bodyInline,
+        bodyObjectHash,
+        input.label ?? null,
+        input.requestId ?? null,
+        this.#now()
+      ]
+    );
+    const row = inserted.rows[0];
+    if (row !== void 0) return toRecord2(row);
+    const existing = await this.getRecord(tenant, {
+      kind: "task.terminal",
+      recordKey: input.taskId
+    });
+    if (existing === void 0) {
+      throw new Error(`terminal record for ${input.taskId} vanished during a first write`);
+    }
+    if (existing.contentHash === input.contentHash) return existing;
+    throw new CoreConflictError(
+      "terminal_conflict",
+      `Task ${input.taskId} already has an immutable terminal record with a different hash.`,
+      existing,
+      this.#now()
+    );
+  }
+  async writeSnapshot(tenant, input) {
+    const [bodyKind, bodyInline, bodyObjectHash] = bodyColumns(input.body);
+    const now = this.#now();
+    const written = input.expectedRev === 0 ? await this.#pool.query(
+      `INSERT INTO attested_record (${RECORD_COLUMNS})
+             VALUES ($1, $2, $3, 1, $4, $5::bigint, $6, $7, $8, $9, $10, $11)
+             ON CONFLICT (tenant_id, kind, subject_id) DO NOTHING
+             RETURNING ${RECORD_COLUMNS}`,
+      [
+        tenant,
+        input.kind,
+        input.recordKey,
+        input.contentHash,
+        input.byteSize,
+        bodyKind,
+        bodyInline,
+        bodyObjectHash,
+        input.label ?? null,
+        input.requestId ?? null,
+        now
+      ]
+    ) : await this.#pool.query(
+      `UPDATE attested_record
+                SET rev              = rev + 1,
+                    content_hash     = $4,
+                    byte_size        = $5::bigint,
+                    body_kind        = $6,
+                    body_inline      = $7,
+                    body_object_hash = $8,
+                    label            = $9,
+                    request_id       = $10,
+                    written_at       = $11
+              WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3 AND rev = $12
+             RETURNING ${RECORD_COLUMNS}`,
+      [
+        tenant,
+        input.kind,
+        input.recordKey,
+        input.contentHash,
+        input.byteSize,
+        bodyKind,
+        bodyInline,
+        bodyObjectHash,
+        input.label ?? null,
+        input.requestId ?? null,
+        now,
+        input.expectedRev
+      ]
+    );
+    const row = written.rows[0];
+    if (row !== void 0) return toRecord2(row);
+    const current = await this.getRecord(tenant, {
+      kind: input.kind,
+      recordKey: input.recordKey
+    });
+    throw new CoreConflictError(
+      "truth_revision_conflict",
+      `Record ${input.kind}/${input.recordKey} is at rev ${current?.rev ?? 0}, not ${input.expectedRev}.`,
+      current,
+      this.#now()
+    );
+  }
+  async getRecord(tenant, selector) {
+    const result = await this.#pool.query(
+      `SELECT ${RECORD_COLUMNS} FROM attested_record
+        WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3`,
+      [tenant, selector.kind, selector.recordKey]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toRecord2(row);
+  }
+  async listManifest(tenant, query) {
+    const result = await this.#pool.query(
+      `SELECT kind, subject_id, rev, content_hash, byte_size, label, written_at
+         FROM attested_record
+        WHERE tenant_id = $1
+          AND ($2::text IS NULL OR kind = $2::text)
+          AND ($3::text IS NULL OR starts_with(subject_id, $3::text))
+        ORDER BY kind COLLATE "C", subject_id COLLATE "C"
+        LIMIT $4`,
+      [tenant, query.kind ?? null, query.keyPrefix ?? null, query.limit ?? DEFAULT_MANIFEST_LIMIT]
+    );
+    return result.rows.map((row) => ({
+      kind: row.kind,
+      recordKey: row.subject_id,
+      rev: row.rev,
+      contentHash: row.content_hash,
+      byteSize: row.byte_size,
+      ...row.label === null ? {} : { label: row.label },
+      updatedAt: row.written_at
+    }));
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/stores/core/index.ts
+function createPostgresCoreStores(options) {
+  const { pool, clock } = options;
+  return {
+    mailbox: new PostgresMailboxStore(pool, clock),
+    board: new PostgresBoardStore(pool, clock),
+    truth: new PostgresTruthStore(pool, clock),
+    presence: new PostgresPresenceStore(pool, clock),
+    activity: new PostgresActivityStore(pool, clock),
+    objects: new PostgresObjectStore(pool, clock),
+    quota: new PostgresQuotaStore(pool, clock),
+    // No clock: a skill-pack manifest carries no timestamp, so this store reads
+    // none — the same shape as the cloud-local `devices` directory.
+    skillPacks: new PostgresSkillPackStore(pool)
+  };
+}
+var DEFAULT_BATCH_SIZE = 100;
+var MAX_BATCH_SIZE = 1e3;
+var ADVISORY_LOCK_NAMESPACE = 1106736963;
+var OUTBOX_COLUMNS2 = "tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at, replay_source_seq";
+var CLOUD_CLEANUP_ERROR_CODES = {
+  cleanup_invalid_input: "cleanup_invalid_input",
+  cleanup_policy_missing: "cleanup_policy_missing",
+  cleanup_job_running: "cleanup_job_running",
+  cleanup_dead_letter_not_found: "cleanup_dead_letter_not_found",
+  cleanup_accounting_drift: "cleanup_accounting_drift"
+};
+var CloudCleanupError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "CloudCleanupError";
+    this.code = code;
+  }
+};
+var PostgresCloudCleanup = class {
+  #pool;
+  #clock;
+  #objectStorage;
+  #batchSize;
+  constructor(options) {
+    this.#pool = options.pool;
+    this.#clock = options.clock;
+    this.#objectStorage = options.objectStorage;
+    this.#batchSize = assertBatchSize(options.batchSize ?? DEFAULT_BATCH_SIZE);
+  }
+  async writeRetentionPolicy(tenant, input) {
+    assertPolicy(input);
+    const written = await this.#pool.query(
+      `INSERT INTO tenant_retention_policy (
+         tenant_id, policy_id, mailbox_acked_retention_ms,
+         mailbox_unacked_retention_ms, request_receipt_retention_ms,
+         object_orphan_grace_ms, updated_at
+       ) VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (tenant_id, policy_id) DO UPDATE
+          SET mailbox_acked_retention_ms = EXCLUDED.mailbox_acked_retention_ms,
+              mailbox_unacked_retention_ms = EXCLUDED.mailbox_unacked_retention_ms,
+              request_receipt_retention_ms = EXCLUDED.request_receipt_retention_ms,
+              object_orphan_grace_ms = EXCLUDED.object_orphan_grace_ms,
+              updated_at = EXCLUDED.updated_at
+       RETURNING tenant_id, policy_id, mailbox_acked_retention_ms,
+                 mailbox_unacked_retention_ms, request_receipt_retention_ms,
+                 object_orphan_grace_ms, updated_at`,
+      [
+        tenant,
+        input.policyId,
+        input.mailboxAckedRetentionMs,
+        input.mailboxUnackedRetentionMs,
+        input.requestReceiptRetentionMs,
+        input.objectOrphanGraceMs,
+        this.#now()
+      ]
+    );
+    return toPolicy(written.rows[0]);
+  }
+  async readRetentionPolicy(tenant) {
+    return this.#readRetentionPolicy(this.#pool, tenant);
+  }
+  /** Run one bounded tenant maintenance cycle. Completed job ids are replay-safe. */
+  async runTenant(tenant, jobId) {
+    assertIdentifier(jobId, "jobId");
+    const client = await this.#pool.connect();
+    let jobStarted = false;
+    try {
+      const lock = await client.query(
+        "SELECT pg_try_advisory_lock(hashtextextended($1, $2)) AS locked",
+        [tenant, ADVISORY_LOCK_NAMESPACE]
+      );
+      if (lock.rows[0]?.locked !== true) {
+        throw new CloudCleanupError(
+          "cleanup_job_running",
+          `A cleanup job is already running for tenant ${tenant}.`
+        );
+      }
+      const replay = await this.#startJob(client, tenant, jobId);
+      if (replay !== void 0) return replay;
+      jobStarted = true;
+      const policy = await this.#readRetentionPolicy(client, tenant);
+      const counts = emptyCounts();
+      const retention = await this.#runRetention(client, tenant, policy);
+      counts.mailboxDeletedCount = retention.mailbox_deleted_count;
+      counts.mailboxExpiredCount = retention.mailbox_expired_count;
+      counts.mailboxReleasedBytes = retention.mailbox_released_bytes;
+      counts.reservationsExpired = retention.reservations_expired;
+      counts.ttlRowsDeleted = retention.ttl_rows_deleted;
+      const orphanCutoff = cutoff(this.#clock.now(), policy.objectOrphanGraceMs);
+      counts.objectsTombstoned = await this.#markTombstones(client, tenant, orphanCutoff);
+      const deleteCursor = await this.#readCursor(client, tenant, "delete");
+      const pending = await client.query(
+        `SELECT hash, byte_size, content_type, state,
+                gc_accounted_bytes, gc_accounted_object
+           FROM object_manifest
+          WHERE tenant_id = $1
+            AND state = 'delete_pending'
+            AND gc_accounted_bytes IS NOT NULL
+            AND gc_accounted_object IS NOT NULL
+            AND hash > $2
+          ORDER BY hash
+          LIMIT $3`,
+        [tenant, deleteCursor ?? "", this.#batchSize]
+      );
+      for (const manifest of pending.rows) {
+        try {
+          await this.#objectStorage.deleteObject(tenant, manifest.hash);
+          const released = await this.#settleDeleted(client, tenant, manifest.hash);
+          if (released !== void 0) {
+            counts.objectsDeleted += 1n;
+            counts.objectReleasedBytes += released;
+          }
+        } catch {
+          counts.operationErrors += 1n;
+        }
+      }
+      await this.#advanceLexicalCursor(
+        client,
+        tenant,
+        "delete",
+        pending.rows.at(-1)?.hash,
+        pending.rows.length
+      );
+      await this.#reconcileManifests(client, tenant, counts);
+      await this.#reconcileR2(client, tenant, counts);
+      const state = counts.operationErrors === 0n ? "completed" : "completed_with_errors";
+      return this.#finishJob(client, tenant, jobId, state, counts);
+    } catch (cause) {
+      if (jobStarted) {
+        await this.#failJob(client, tenant, jobId, cause).catch(() => {
+        });
+      }
+      throw cause;
+    } finally {
+      await client.query("SELECT pg_advisory_unlock(hashtextextended($1, $2))", [
+        tenant,
+        ADVISORY_LOCK_NAMESPACE
+      ]).catch(() => {
+      });
+      client.release();
+    }
+  }
+  async listDeadLetters(tenant, query = {}) {
+    const limit = assertBatchSize(query.limit ?? DEFAULT_BATCH_SIZE);
+    if (query.deviceId !== void 0) assertIdentifier(query.deviceId, "deviceId");
+    if (query.after !== void 0) assertDeadLetterRef(query.after);
+    if (query.deviceId !== void 0 && query.after !== void 0 && query.deviceId !== query.after.deviceId) {
+      throw new CloudCleanupError(
+        "cleanup_invalid_input",
+        "A device-scoped dead-letter cursor must belong to the same device."
+      );
+    }
+    const listed = await this.#pool.query(
+      `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+        WHERE tenant_id = $1
+          AND state = 'expired'
+          AND ($2::text IS NULL OR device_id = $2::text)
+          AND (device_id > $3 OR (device_id = $3 AND seq > $4::bigint))
+        ORDER BY device_id, seq
+        LIMIT $5`,
+      [
+        tenant,
+        query.deviceId ?? null,
+        query.after?.deviceId ?? "",
+        query.after?.seq ?? 0,
+        limit + 1
+      ]
+    );
+    return {
+      messages: listed.rows.slice(0, limit).map(toMailboxMessage),
+      hasMore: listed.rows.length > limit
+    };
+  }
+  /** Clone an expired row to a new monotonic seq. The original remains evidence. */
+  async replayDeadLetter(tenant, input) {
+    assertDeadLetterRef(input);
+    assertIdentifier(input.replayMessageId, "replayMessageId");
+    const client = await this.#pool.connect();
+    let result;
+    let rejection;
+    let rollbackAllocation = false;
+    try {
+      await client.query("BEGIN");
+      const originalResult = await client.query(
+        `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
+            AND state = 'expired'
+          FOR UPDATE`,
+        [tenant, input.deviceId, input.seq]
+      );
+      const original = originalResult.rows[0];
+      if (original === void 0) {
+        rejection = deadLetterMissing(input);
+      } else {
+        const existingResult = await client.query(
+          `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+            WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+          [tenant, input.deviceId, input.replayMessageId]
+        );
+        const existing = existingResult.rows[0];
+        if (existing !== void 0) {
+          if (!replayMatches(existing, original)) {
+            rejection = new CloudCleanupError(
+              "cleanup_invalid_input",
+              `Replay id ${input.replayMessageId} already binds a different replay delivery.`
+            );
+          } else {
+            result = toMailboxMessage(existing);
+          }
+        } else {
+          const entitlement = await client.query(
+            `SELECT e.mailbox_limit_bytes, u.mailbox_bytes
+               FROM storage_entitlement e
+               JOIN storage_usage u ON u.tenant_id = e.tenant_id
+              WHERE e.tenant_id = $1
+              FOR UPDATE OF e, u`,
+            [tenant]
+          );
+          const capacity = entitlement.rows[0];
+          const serializedExisting = await client.query(
+            `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+              WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+            [tenant, input.deviceId, input.replayMessageId]
+          );
+          const winner = serializedExisting.rows[0];
+          if (winner !== void 0) {
+            if (!replayMatches(winner, original)) {
+              rejection = new CloudCleanupError(
+                "cleanup_invalid_input",
+                `Replay id ${input.replayMessageId} already binds a different replay delivery.`
+              );
+            } else {
+              result = toMailboxMessage(winner);
+            }
+          } else if (capacity === void 0) {
+            rejection = new CloudCleanupError(
+              "cleanup_policy_missing",
+              `Tenant ${tenant} has no storage entitlement/usage row.`
+            );
+          } else {
+            const seq = await allocateMailboxSequence(
+              client,
+              tenant,
+              input.deviceId,
+              this.#now()
+            );
+            const afterAllocation = await client.query(
+              `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+                WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+              [tenant, input.deviceId, input.replayMessageId]
+            );
+            const appendWinner = afterAllocation.rows[0];
+            if (appendWinner !== void 0) {
+              rollbackAllocation = true;
+              if (!replayMatches(appendWinner, original)) {
+                rejection = new CloudCleanupError(
+                  "cleanup_invalid_input",
+                  `Replay id ${input.replayMessageId} already binds a different replay delivery.`
+                );
+              } else {
+                result = toMailboxMessage(appendWinner);
+              }
+            } else {
+              const rebound = materializeReplayBody(original, seq);
+              if (capacity.mailbox_bytes + rebound.byteSize > capacity.mailbox_limit_bytes) {
+                rejection = new ByokCoreError(
+                  "storage_quota_exceeded",
+                  `Replaying the dead letter would exceed tenant ${tenant}'s mailbox limit.`
+                );
+              } else {
+                const inserted = await client.query(
+                  `INSERT INTO outbox (${OUTBOX_COLUMNS2})
+                   VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8, $9)
+                   RETURNING ${OUTBOX_COLUMNS2}`,
+                  [
+                    tenant,
+                    input.deviceId,
+                    seq,
+                    input.replayMessageId,
+                    rebound.body,
+                    rebound.bodyHash,
+                    rebound.byteSize,
+                    this.#now(),
+                    original.seq
+                  ]
+                );
+                await client.query(
+                  `UPDATE storage_usage
+                      SET mailbox_bytes = mailbox_bytes + $2::bigint, updated_at = $3
+                    WHERE tenant_id = $1`,
+                  [tenant, rebound.byteSize, this.#now()]
+                );
+                result = toMailboxMessage(inserted.rows[0]);
+              }
+            }
+          }
+        }
+      }
+      if (rejection === void 0 && !rollbackAllocation) await client.query("COMMIT");
+      else await client.query("ROLLBACK");
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+    if (rejection !== void 0) throw rejection;
+    return result;
+  }
+  /** Explicit operator discard. Automatic retention never deletes dead letters. */
+  async discardDeadLetter(tenant, ref) {
+    assertDeadLetterRef(ref);
+    const client = await this.#pool.connect();
+    let row;
+    let rejection;
+    try {
+      await client.query("BEGIN");
+      const existing = await client.query(
+        `SELECT ${OUTBOX_COLUMNS2} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
+            AND state = 'expired'
+          FOR UPDATE`,
+        [tenant, ref.deviceId, ref.seq]
+      );
+      const deadLetter = existing.rows[0];
+      const usage = await client.query(
+        "SELECT mailbox_bytes FROM storage_usage WHERE tenant_id = $1 FOR UPDATE",
+        [tenant]
+      );
+      if (deadLetter === void 0) {
+        rejection = deadLetterMissing(ref);
+      } else if (usage.rows[0] === void 0 || usage.rows[0].mailbox_bytes < deadLetter.byte_size) {
+        rejection = new CloudCleanupError(
+          "cleanup_accounting_drift",
+          `Mailbox accounting cannot release dead letter ${ref.deviceId}/${String(ref.seq)}.`
+        );
+      } else {
+        const removed = await client.query(
+          `DELETE FROM outbox
+            WHERE tenant_id = $1 AND device_id = $2 AND seq = $3::bigint
+              AND state = 'expired'
+            RETURNING ${OUTBOX_COLUMNS2}`,
+          [tenant, ref.deviceId, ref.seq]
+        );
+        await client.query(
+          `UPDATE storage_usage
+              SET mailbox_bytes = mailbox_bytes - $2::bigint, updated_at = $3
+            WHERE tenant_id = $1`,
+          [tenant, deadLetter.byte_size, this.#now()]
+        );
+        row = removed.rows[0];
+      }
+      if (rejection === void 0) await client.query("COMMIT");
+      else await client.query("ROLLBACK");
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+    if (rejection !== void 0) throw rejection;
+    return toMailboxMessage(row);
+  }
+  /**
+   * Explicit recovery operation: rebuild object accounting from committed
+   * Postgres manifests. Reconciliation must run first; R2 LIST is never used as
+   * billing authority and inline/mailbox usage is left untouched.
+   */
+  async rebuildObjectUsage(tenant) {
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const locked = await client.query(
+        "SELECT 1 FROM storage_usage WHERE tenant_id = $1 FOR UPDATE",
+        [tenant]
+      );
+      if (locked.rowCount === 0) {
+        throw new CloudCleanupError(
+          "cleanup_policy_missing",
+          `Tenant ${tenant} has no storage usage row to rebuild.`
+        );
+      }
+      const rebuilt = await client.query(
+        `WITH authority AS MATERIALIZED (
+           SELECT COALESCE(SUM(byte_size), 0)::bigint AS committed_object_bytes,
+                  count(*)::bigint AS object_count
+             FROM object_manifest
+            WHERE tenant_id = $1 AND state = 'committed'
+         )
+         UPDATE storage_usage u
+            SET committed_object_bytes = authority.committed_object_bytes,
+                object_count = authority.object_count,
+                updated_at = $2
+           FROM authority
+          WHERE u.tenant_id = $1
+         RETURNING u.committed_object_bytes, u.object_count, u.updated_at`,
+        [tenant, this.#now()]
+      );
+      await client.query("COMMIT");
+      const row = rebuilt.rows[0];
+      return {
+        committedObjectBytes: row.committed_object_bytes,
+        objectCount: row.object_count,
+        updatedAt: row.updated_at
+      };
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+  }
+  async #readRetentionPolicy(queryable, tenant) {
+    const result = await queryable.query(
+      `SELECT p.tenant_id, p.policy_id, p.mailbox_acked_retention_ms,
+              p.mailbox_unacked_retention_ms, p.request_receipt_retention_ms,
+              p.object_orphan_grace_ms, p.updated_at
+         FROM storage_entitlement e
+         JOIN tenant_retention_policy p
+           ON p.tenant_id = e.tenant_id AND p.policy_id = e.retention_policy_id
+        WHERE e.tenant_id = $1`,
+      [tenant]
+    );
+    const row = result.rows[0];
+    if (row === void 0) {
+      throw new CloudCleanupError(
+        "cleanup_policy_missing",
+        `Tenant ${tenant} has no retention policy matching its entitlement.`
+      );
+    }
+    const policy = toPolicy(row);
+    assertPolicy(policy);
+    return policy;
+  }
+  async #startJob(client, tenant, jobId) {
+    const now = this.#now();
+    const started = await client.query(
+      `INSERT INTO cleanup_job (tenant_id, job_id, kind, state, started_at)
+       VALUES ($1, $2, 'tenant_cleanup', 'running', $3)
+       ON CONFLICT (tenant_id, job_id) DO UPDATE
+          SET state = 'running', started_at = EXCLUDED.started_at,
+              finished_at = NULL, error_message = NULL
+        WHERE cleanup_job.state IN ('running', 'failed')
+       RETURNING ${JOB_COLUMNS}`,
+      [tenant, jobId, now]
+    );
+    if (started.rows[0] !== void 0) return void 0;
+    const existing = await this.#readJob(client, tenant, jobId);
+    return toCleanupResult(existing);
+  }
+  async #runRetention(client, tenant, policy) {
+    const ackedBefore = cutoff(this.#clock.now(), policy.mailboxAckedRetentionMs);
+    const expireBefore = cutoff(this.#clock.now(), policy.mailboxUnackedRetentionMs);
+    const receiptBefore = cutoff(this.#clock.now(), policy.requestReceiptRetentionMs);
+    const now = this.#now();
+    try {
+      await client.query("BEGIN");
+      const swept = await client.query(
+        `WITH deleted AS (
+           DELETE FROM outbox
+            WHERE tenant_id = $1 AND state = 'acked' AND appended_at < $2
+           RETURNING byte_size
+         ), released AS MATERIALIZED (
+           SELECT COALESCE(SUM(byte_size), 0)::bigint AS bytes FROM deleted
+         ), expired AS (
+           UPDATE outbox SET state = 'expired'
+            WHERE tenant_id = $1 AND state = 'pending' AND appended_at < $3
+           RETURNING 1
+         ), reservations AS (
+           UPDATE storage_reservation SET state = 'expired', settled_at = $4
+            WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $4
+           RETURNING 1
+         ), nonces AS (
+           DELETE FROM auth_nonce
+            WHERE tenant_id = $1 AND (used OR expires_at <= $4::timestamptz)
+           RETURNING 1
+         ), pairing_codes AS (
+           DELETE FROM pairing_code
+            WHERE tenant_id = $1
+              AND (redeemed_at IS NOT NULL OR expires_at <= $4::timestamptz)
+           RETURNING 1
+         ), receipts AS (
+           DELETE FROM device_request_receipts
+            WHERE tenant_id = $1 AND recorded_at < $5::timestamptz
+           RETURNING 1
+         ), presence AS (
+           DELETE FROM device_presence
+            WHERE tenant_id = $1 AND expires_at <= $4
+           RETURNING 1
+         ), activity AS (
+           DELETE FROM activity_tail
+            WHERE tenant_id = $1 AND expires_at <= $4
+           RETURNING 1
+         ), accounted AS (
+           UPDATE storage_usage u
+              SET mailbox_bytes = u.mailbox_bytes - released.bytes, updated_at = $4
+             FROM released
+            WHERE u.tenant_id = $1 AND u.mailbox_bytes >= released.bytes
+           RETURNING released.bytes
+         )
+         SELECT (SELECT count(*) FROM deleted)::bigint AS mailbox_deleted_count,
+                (SELECT count(*) FROM expired)::bigint AS mailbox_expired_count,
+                (SELECT bytes FROM released)::bigint AS mailbox_released_bytes,
+                (SELECT count(*) FROM accounted)::bigint AS usage_accounted,
+                (SELECT count(*) FROM reservations)::bigint AS reservations_expired,
+                ((SELECT count(*) FROM nonces)
+                 + (SELECT count(*) FROM pairing_codes)
+                 + (SELECT count(*) FROM receipts)
+                 + (SELECT count(*) FROM presence)
+                 + (SELECT count(*) FROM activity))::bigint AS ttl_rows_deleted`,
+        [tenant, ackedBefore, expireBefore, now, receiptBefore]
+      );
+      const result = swept.rows[0];
+      if (result.usage_accounted !== 1n) {
+        throw new CloudCleanupError(
+          "cleanup_accounting_drift",
+          `Mailbox accounting cannot release ${String(result.mailbox_released_bytes)} deleted bytes for tenant ${tenant}.`
+        );
+      }
+      await client.query("COMMIT");
+      return result;
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    }
+  }
+  async #markTombstones(client, tenant, orphanCutoff) {
+    try {
+      await client.query("BEGIN");
+      await client.query(
+        "SELECT 1 FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE",
+        [tenant]
+      );
+      const marked = await client.query(
+        `WITH candidates AS MATERIALIZED (
+         SELECT m.tenant_id, m.hash
+           FROM object_manifest m
+          WHERE m.tenant_id = $1
+            AND m.state IN ('pending', 'committed')
+            AND m.ref_count = 0
+            AND m.updated_at < $2
+            AND NOT EXISTS (
+              SELECT 1 FROM object_reference r
+               WHERE r.tenant_id = m.tenant_id AND r.hash = m.hash
+            )
+            AND NOT EXISTS (
+              SELECT 1 FROM storage_reservation s
+               WHERE s.tenant_id = m.tenant_id AND s.content_hash = m.hash
+                 AND s.state = 'reserved'
+            )
+          ORDER BY m.updated_at, m.hash
+          LIMIT $3
+          FOR UPDATE OF m SKIP LOCKED
+       )
+       UPDATE object_manifest m
+          SET gc_accounted_bytes = CASE WHEN m.state = 'committed' THEN m.byte_size ELSE 0 END,
+              gc_accounted_object = (m.state = 'committed'),
+              state = 'delete_pending', delete_pending_at = $4, updated_at = $4
+         FROM candidates c
+        WHERE m.tenant_id = c.tenant_id AND m.hash = c.hash
+       RETURNING m.hash`,
+        [tenant, orphanCutoff, this.#batchSize, this.#now()]
+      );
+      await client.query("COMMIT");
+      return BigInt(marked.rowCount ?? 0);
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    }
+  }
+  async #settleDeleted(client, tenant, hash) {
+    const settled = await client.query(
+      `WITH candidate AS MATERIALIZED (
+         SELECT m.gc_accounted_bytes, m.gc_accounted_object
+           FROM object_manifest m
+           JOIN storage_usage u ON u.tenant_id = m.tenant_id
+          WHERE m.tenant_id = $1 AND m.hash = $2
+            AND m.state = 'delete_pending'
+            AND m.ref_count = 0
+            AND m.gc_accounted_bytes IS NOT NULL
+            AND m.gc_accounted_object IS NOT NULL
+            AND NOT EXISTS (
+              SELECT 1 FROM object_reference r
+               WHERE r.tenant_id = m.tenant_id AND r.hash = m.hash
+            )
+            AND u.committed_object_bytes >= m.gc_accounted_bytes
+            AND u.object_count >= CASE WHEN m.gc_accounted_object THEN 1 ELSE 0 END
+          FOR UPDATE OF m, u
+       ), moved AS (
+         UPDATE object_manifest m
+            SET state = 'deleted', updated_at = $3
+           FROM candidate c
+          WHERE m.tenant_id = $1 AND m.hash = $2 AND m.state = 'delete_pending'
+         RETURNING c.gc_accounted_bytes, c.gc_accounted_object
+       ), accounted AS (
+         UPDATE storage_usage u
+            SET committed_object_bytes = u.committed_object_bytes - moved.gc_accounted_bytes,
+                object_count = u.object_count - CASE WHEN moved.gc_accounted_object THEN 1 ELSE 0 END,
+                updated_at = $3
+           FROM moved
+          WHERE u.tenant_id = $1
+         RETURNING moved.gc_accounted_bytes
+       )
+       SELECT gc_accounted_bytes FROM accounted`,
+      [tenant, hash, this.#now()]
+    );
+    const row = settled.rows[0];
+    if (row !== void 0) return row.gc_accounted_bytes;
+    const current = await client.query(
+      "SELECT state FROM object_manifest WHERE tenant_id = $1 AND hash = $2",
+      [tenant, hash]
+    );
+    if (current.rows[0]?.state === "deleted") return void 0;
+    throw new CloudCleanupError(
+      "cleanup_accounting_drift",
+      `Object ${hash} could not settle its delete tombstone against storage usage.`
+    );
+  }
+  async #reconcileManifests(client, tenant, counts) {
+    const cursor = await this.#readCursor(client, tenant, "manifest");
+    const page = await client.query(
+      `SELECT hash, byte_size, content_type, state,
+              gc_accounted_bytes, gc_accounted_object
+         FROM object_manifest
+        WHERE tenant_id = $1
+          AND state IN ('committed', 'delete_pending')
+          AND hash > $2
+        ORDER BY hash
+        LIMIT $3`,
+      [tenant, cursor ?? "", this.#batchSize]
+    );
+    for (const manifest of page.rows) {
+      const observed = await this.#objectStorage.inspectObject(
+        tenant,
+        manifest.hash
+      );
+      if (manifest.state === "delete_pending") {
+        if (observed === void 0) {
+          try {
+            const released = await this.#settleDeleted(
+              client,
+              tenant,
+              manifest.hash
+            );
+            if (released !== void 0) {
+              counts.objectsDeleted += 1n;
+              counts.objectReleasedBytes += released;
+            }
+          } catch {
+            counts.operationErrors += 1n;
+          }
+        }
+        continue;
+      }
+      if (observed === void 0) {
+        counts.missingObjects += 1n;
+      } else if (observed.observedByteSize !== manifest.byte_size || observed.observedContentType !== manifest.content_type) {
+        counts.shapeDrift += 1n;
+      }
+    }
+    await this.#advanceLexicalCursor(
+      client,
+      tenant,
+      "manifest",
+      page.rows.at(-1)?.hash,
+      page.rows.length
+    );
+  }
+  async #reconcileR2(client, tenant, counts) {
+    const cursor = await this.#readCursor(client, tenant, "r2");
+    const page = await this.#objectStorage.listTenantObjects(
+      tenant,
+      cursor ?? void 0,
+      this.#batchSize
+    );
+    for (const object of page.objects) {
+      if (object.hash === void 0) {
+        counts.invalidObjectKeys += 1n;
+        continue;
+      }
+      const manifest = await client.query(
+        "SELECT state FROM object_manifest WHERE tenant_id = $1 AND hash = $2",
+        [tenant, object.hash]
+      );
+      const state = manifest.rows[0]?.state;
+      if (state !== void 0 && state !== "deleted") continue;
+      const observed = await this.#objectStorage.inspectObject(tenant, object.hash);
+      if (observed === void 0) continue;
+      const witnessed = await client.query(
+        `INSERT INTO object_manifest (
+           tenant_id, hash, byte_size, content_type, state, ref_count,
+           created_at, updated_at, delete_pending_at,
+           gc_accounted_bytes, gc_accounted_object
+         ) VALUES ($1, $2, $3, $4, 'pending', 0, $5, $5, NULL, NULL, NULL)
+         ON CONFLICT (tenant_id, hash) DO UPDATE
+            SET byte_size = EXCLUDED.byte_size,
+                content_type = EXCLUDED.content_type,
+                state = 'pending', ref_count = 0,
+                created_at = EXCLUDED.created_at,
+                updated_at = EXCLUDED.updated_at,
+                delete_pending_at = NULL,
+                gc_accounted_bytes = NULL,
+                gc_accounted_object = NULL
+          WHERE object_manifest.state = 'deleted'
+         RETURNING 1`,
+        [
+          tenant,
+          object.hash,
+          observed.observedByteSize,
+          observed.observedContentType,
+          this.#now()
+        ]
+      );
+      counts.orphanWitnessesCreated += BigInt(witnessed.rowCount ?? 0);
+    }
+    if (page.nextContinuationToken === void 0) {
+      await this.#clearCursor(client, tenant, "r2");
+    } else {
+      await this.#writeCursor(client, tenant, "r2", page.nextContinuationToken);
+    }
+  }
+  async #advanceLexicalCursor(client, tenant, kind, lastValue, rowCount) {
+    if (lastValue === void 0 || rowCount < this.#batchSize) {
+      await this.#clearCursor(client, tenant, kind);
+    } else {
+      await this.#writeCursor(client, tenant, kind, lastValue);
+    }
+  }
+  async #readCursor(client, tenant, kind) {
+    const result = await client.query(
+      "SELECT cursor_value FROM gc_cursor WHERE tenant_id = $1 AND cursor_kind = $2",
+      [tenant, kind]
+    );
+    return result.rows[0]?.cursor_value ?? null;
+  }
+  async #writeCursor(client, tenant, kind, value) {
+    await client.query(
+      `INSERT INTO gc_cursor (tenant_id, cursor_kind, cursor_value, updated_at)
+       VALUES ($1, $2, $3, $4)
+       ON CONFLICT (tenant_id, cursor_kind) DO UPDATE
+          SET cursor_value = EXCLUDED.cursor_value, updated_at = EXCLUDED.updated_at`,
+      [tenant, kind, value, this.#now()]
+    );
+  }
+  async #clearCursor(client, tenant, kind) {
+    await client.query(
+      "DELETE FROM gc_cursor WHERE tenant_id = $1 AND cursor_kind = $2",
+      [tenant, kind]
+    );
+  }
+  async #finishJob(client, tenant, jobId, state, counts) {
+    const finished = await client.query(
+      `UPDATE cleanup_job SET
+         state = $3, finished_at = $4,
+         mailbox_deleted_count = $5, mailbox_expired_count = $6,
+         mailbox_released_bytes = $7, reservations_expired = $8,
+         ttl_rows_deleted = $9,
+         objects_tombstoned = $10, objects_deleted = $11,
+         object_released_bytes = $12, orphan_witnesses_created = $13,
+         missing_objects = $14, shape_drift = $15,
+         invalid_object_keys = $16, operation_errors = $17,
+         error_message = NULL
+       WHERE tenant_id = $1 AND job_id = $2
+       RETURNING ${JOB_COLUMNS}`,
+      [
+        tenant,
+        jobId,
+        state,
+        this.#now(),
+        counts.mailboxDeletedCount,
+        counts.mailboxExpiredCount,
+        counts.mailboxReleasedBytes,
+        counts.reservationsExpired,
+        counts.ttlRowsDeleted,
+        counts.objectsTombstoned,
+        counts.objectsDeleted,
+        counts.objectReleasedBytes,
+        counts.orphanWitnessesCreated,
+        counts.missingObjects,
+        counts.shapeDrift,
+        counts.invalidObjectKeys,
+        counts.operationErrors
+      ]
+    );
+    return toCleanupResult(finished.rows[0]);
+  }
+  async #failJob(client, tenant, jobId, cause) {
+    const message = (cause instanceof Error ? cause.message : String(cause)).slice(0, 2e3);
+    await client.query(
+      `UPDATE cleanup_job
+          SET state = 'failed', finished_at = $3, error_message = $4
+        WHERE tenant_id = $1 AND job_id = $2`,
+      [tenant, jobId, this.#now(), message]
+    );
+  }
+  async #readJob(client, tenant, jobId) {
+    const result = await client.query(
+      `SELECT ${JOB_COLUMNS} FROM cleanup_job WHERE tenant_id = $1 AND job_id = $2`,
+      [tenant, jobId]
+    );
+    return result.rows[0];
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+function createPostgresCloudMaintenance(options) {
+  const objectStorage = new R2ObjectMaintenanceStore(options.objectStorage);
+  return new PostgresCloudCleanup({
+    pool: options.pool,
+    clock: options.clock,
+    objectStorage,
+    ...options.batchSize === void 0 ? {} : { batchSize: options.batchSize }
+  });
+}
+var JOB_COLUMNS = [
+  "tenant_id",
+  "job_id",
+  "state",
+  "started_at",
+  "finished_at",
+  "mailbox_deleted_count",
+  "mailbox_expired_count",
+  "mailbox_released_bytes",
+  "reservations_expired",
+  "ttl_rows_deleted",
+  "objects_tombstoned",
+  "objects_deleted",
+  "object_released_bytes",
+  "orphan_witnesses_created",
+  "missing_objects",
+  "shape_drift",
+  "invalid_object_keys",
+  "operation_errors",
+  "error_message"
+].join(", ");
+function emptyCounts() {
+  return {
+    mailboxDeletedCount: 0n,
+    mailboxExpiredCount: 0n,
+    mailboxReleasedBytes: 0n,
+    reservationsExpired: 0n,
+    ttlRowsDeleted: 0n,
+    objectsTombstoned: 0n,
+    objectsDeleted: 0n,
+    objectReleasedBytes: 0n,
+    orphanWitnessesCreated: 0n,
+    missingObjects: 0n,
+    shapeDrift: 0n,
+    invalidObjectKeys: 0n,
+    operationErrors: 0n
+  };
+}
+function toPolicy(row) {
+  return {
+    tenantId: tenantId(row.tenant_id),
+    policyId: row.policy_id,
+    mailboxAckedRetentionMs: row.mailbox_acked_retention_ms,
+    mailboxUnackedRetentionMs: row.mailbox_unacked_retention_ms,
+    requestReceiptRetentionMs: row.request_receipt_retention_ms,
+    objectOrphanGraceMs: row.object_orphan_grace_ms,
+    updatedAt: row.updated_at
+  };
+}
+function toCleanupResult(row) {
+  return {
+    tenantId: tenantId(row.tenant_id),
+    jobId: row.job_id,
+    state: row.state,
+    startedAt: row.started_at,
+    ...row.finished_at === null ? {} : { finishedAt: row.finished_at },
+    mailboxDeletedCount: row.mailbox_deleted_count,
+    mailboxExpiredCount: row.mailbox_expired_count,
+    mailboxReleasedBytes: row.mailbox_released_bytes,
+    reservationsExpired: row.reservations_expired,
+    ttlRowsDeleted: row.ttl_rows_deleted,
+    objectsTombstoned: row.objects_tombstoned,
+    objectsDeleted: row.objects_deleted,
+    objectReleasedBytes: row.object_released_bytes,
+    orphanWitnessesCreated: row.orphan_witnesses_created,
+    missingObjects: row.missing_objects,
+    shapeDrift: row.shape_drift,
+    invalidObjectKeys: row.invalid_object_keys,
+    operationErrors: row.operation_errors,
+    ...row.error_message === null ? {} : { errorMessage: row.error_message }
+  };
+}
+function toMailboxMessage(row) {
+  return {
+    tenantId: tenantId(row.tenant_id),
+    deviceId: row.device_id,
+    seq: Number(row.seq),
+    messageId: row.message_id,
+    body: row.body,
+    bodyHash: row.body_hash,
+    byteSize: row.byte_size,
+    state: row.state,
+    appendedAt: row.appended_at
+  };
+}
+function materializeReplayBody(original, seq) {
+  try {
+    const envelope = decodeEnvelope(original.body);
+    if (!isServerToDaemonType(envelope.type)) {
+      throw new Error(`Envelope type ${envelope.type} is not server-to-daemon.`);
+    }
+    const rebound = EnvelopeSchema.parse({ ...envelope, seq });
+    const body = encodeEnvelope(rebound);
+    const bytes = new TextEncoder().encode(body);
+    return {
+      body,
+      bodyHash: contentHash(`sha256:${createHash("sha256").update(bytes).digest("hex")}`),
+      byteSize: BigInt(bytes.length)
+    };
+  } catch (cause) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      `Dead letter ${original.device_id}/${String(original.seq)} is not a replayable server-to-daemon envelope.`,
+      { cause }
+    );
+  }
+}
+function replayMatches(row, original) {
+  if (row.replay_source_seq !== original.seq) return false;
+  const expected = materializeReplayBody(original, Number(row.seq));
+  return row.body === expected.body && row.body_hash === expected.bodyHash && row.byte_size === expected.byteSize;
+}
+function assertPolicy(input) {
+  assertIdentifier(input.policyId, "policyId");
+  for (const [field, value] of [
+    ["mailboxAckedRetentionMs", input.mailboxAckedRetentionMs],
+    ["mailboxUnackedRetentionMs", input.mailboxUnackedRetentionMs],
+    ["requestReceiptRetentionMs", input.requestReceiptRetentionMs],
+    ["objectOrphanGraceMs", input.objectOrphanGraceMs]
+  ]) {
+    if (value < 0n || value > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new CloudCleanupError(
+        "cleanup_invalid_input",
+        `${field} must be a non-negative duration no larger than Number.MAX_SAFE_INTEGER milliseconds.`
+      );
+    }
+  }
+}
+function assertBatchSize(value) {
+  if (!Number.isInteger(value) || value < 1 || value > MAX_BATCH_SIZE) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      `batchSize/limit must be a whole number in [1, ${String(MAX_BATCH_SIZE)}].`
+    );
+  }
+  return value;
+}
+function assertIdentifier(value, field) {
+  if (value.length === 0 || value.length > 256 || value.trim() !== value) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      `${field} must be a non-empty, unpadded string no longer than 256 characters.`
+    );
+  }
+}
+function assertDeadLetterRef(ref) {
+  assertIdentifier(ref.deviceId, "deviceId");
+  if (!Number.isSafeInteger(ref.seq) || ref.seq < 1) {
+    throw new CloudCleanupError(
+      "cleanup_invalid_input",
+      "A dead-letter seq must be a positive safe integer."
+    );
+  }
+}
+function cutoff(now, durationMs) {
+  return new Date(now.getTime() - Number(durationMs)).toISOString();
+}
+function deadLetterMissing(ref) {
+  return new CloudCleanupError(
+    "cleanup_dead_letter_not_found",
+    `Expired mailbox row ${ref.deviceId}/${String(ref.seq)} was not found.`
+  );
+}
+var RECORD_COLUMNS2 = "tenant_id, kind, subject_id, rev, content_hash, byte_size, body_kind, body_inline, body_object_hash, label, request_id, written_at";
+var RECEIPT_COLUMNS = "tenant_id, device_id, request_id, operation, resource, body_sha256, body_size, response_status, response_body, recorded_at";
+function toBody2(row) {
+  return row.body_kind === "inline" ? { kind: "inline", body: row.body_inline ?? "" } : { kind: "object", hash: row.body_object_hash ?? "" };
+}
+function toRecord3(tenant, row) {
+  return {
+    tenantId: tenant,
+    kind: row.kind,
+    recordKey: row.subject_id,
+    rev: row.rev,
+    contentHash: row.content_hash,
+    byteSize: row.byte_size,
+    body: toBody2(row),
+    ...row.label === null ? {} : { label: row.label },
+    ...row.request_id === null ? {} : { requestId: row.request_id },
+    writtenAt: row.written_at
+  };
+}
+function toReceipt3(tenant, row) {
+  return {
+    tenantId: tenant,
+    deviceId: row.device_id,
+    requestId: row.request_id,
+    operation: row.operation,
+    resource: row.resource,
+    bodySha256: row.body_sha256,
+    bodySize: row.body_size,
+    responseStatus: row.response_status,
+    responseBody: row.response_body,
+    recordedAt: row.recorded_at.toISOString()
+  };
+}
+function sameBinding(receipt, input) {
+  return receipt.operation === input.operation && receipt.resource === input.resource && receipt.bodySha256 === input.proofBodySha256 && receipt.bodySize === input.proofBodySize;
+}
+function bodyColumns2(body) {
+  return body.kind === "inline" ? ["inline", body.body, null] : ["object", null, body.hash];
+}
+function writeKey(write) {
+  return `${write.kind}\0${write.recordKey}`;
+}
+function referenceId(write) {
+  return `${write.kind}:${write.recordKey}`;
+}
+var PostgresTruthCommitter = class {
+  #pool;
+  #clock;
+  #crypto;
+  #truth;
+  constructor(options) {
+    this.#pool = options.pool;
+    this.#clock = options.clock;
+    this.#crypto = options.crypto;
+    this.#truth = new PostgresTruthStore(options.pool, options.clock);
+  }
+  getRecord(tenant, selector) {
+    return this.#truth.getRecord(tenant, selector);
+  }
+  listManifest(tenant, query) {
+    return this.#truth.listManifest(tenant, query);
+  }
+  async commit(tenant, input) {
+    await this.#validateInput(input);
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+        JSON.stringify(["truth-receipt", tenant, input.deviceId, input.requestId])
+      ]);
+      const replay = await this.#readReceipt(client, tenant, input.deviceId, input.requestId);
+      if (replay !== void 0) {
+        if (!sameBinding(replay, input)) {
+          throw new TruthCommitError(
+            "proof_request_conflict",
+            `Request ${input.requestId} was already used with a different binding.`
+          );
+        }
+        const response2 = TruthCommitResponseSchema.parse(JSON.parse(replay.responseBody));
+        await client.query("COMMIT");
+        return { response: response2, replayed: true };
+      }
+      const before = await this.#lockCurrentRecords(client, tenant, input.writes);
+      this.#assertWritePreconditions(input.writes, before);
+      await this.#lockAndVerifyObjects(client, tenant, input.writes, before);
+      const inlineAffected = input.writes.some((write) => {
+        const current = before.get(writeKey(write));
+        if (write.kind === "task.terminal" && current !== void 0) return false;
+        return current?.body.kind === "inline" || write.body.kind === "inline";
+      });
+      const inlineDelta = inlineAffected ? await this.#prepareInlineAccounting(client, tenant, input.writes, before) : 0n;
+      const applied = await this.#applyWrites(client, tenant, input, before);
+      await this.#replaceObjectReferences(client, tenant, applied);
+      await this.#settleInlineAccounting(client, tenant, inlineDelta);
+      const response = {
+        primary: truthRecordMetadata(applied[0].record),
+        snapshots: applied.slice(1).map((entry) => truthRecordMetadata(entry.record))
+      };
+      await client.query(
+        `INSERT INTO proof_request_receipt (${RECEIPT_COLUMNS})
+         VALUES ($1, $2, $3, $4, $5, $6, $7::bigint, 200, $8, $9)`,
+        [
+          tenant,
+          input.deviceId,
+          input.requestId,
+          input.operation,
+          input.resource,
+          input.proofBodySha256,
+          input.proofBodySize,
+          JSON.stringify(response),
+          this.#now()
+        ]
+      );
+      await client.query("COMMIT");
+      return { response, replayed: false };
+    } catch (error) {
+      await client.query("ROLLBACK").catch(() => void 0);
+      throw error;
+    } finally {
+      client.release();
+    }
+  }
+  async #validateInput(input) {
+    if (input.requestId.length === 0 || input.requestId.length > TRUTH_REQUEST_ID_MAX_LENGTH) {
+      throw new TruthCommitError("proof_request_conflict", "Request id is outside the record contract.");
+    }
+    const seen = /* @__PURE__ */ new Set();
+    const objectSizes = /* @__PURE__ */ new Map();
+    for (const write of input.writes) {
+      const key = writeKey(write);
+      if (seen.has(key)) {
+        throw new TruthCommitError("proof_request_conflict", `Duplicate truth write ${key}.`);
+      }
+      seen.add(key);
+      if (write.body.kind === "inline") {
+        const bytes = new TextEncoder().encode(write.body.body);
+        if (BigInt(bytes.byteLength) !== write.byteSize) {
+          throw new ByokCoreError("storage_integrity_mismatch", "Inline byte size disagrees with its content.");
+        }
+        if (await this.#crypto.sha256(bytes) !== write.contentHash) {
+          throw new ByokCoreError("storage_integrity_mismatch", "Inline hash disagrees with its content.");
+        }
+      } else if (write.body.hash !== write.contentHash) {
+        throw new ByokCoreError("storage_integrity_mismatch", "Object body hash disagrees with record hash.");
+      } else {
+        const priorSize = objectSizes.get(write.body.hash);
+        if (priorSize !== void 0 && priorSize !== write.byteSize) {
+          throw new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Object ${write.body.hash} was declared with inconsistent byte sizes.`
+          );
+        }
+        objectSizes.set(write.body.hash, write.byteSize);
+      }
+    }
+  }
+  async #readReceipt(client, tenant, deviceId, requestId) {
+    const result = await client.query(
+      `SELECT ${RECEIPT_COLUMNS} FROM proof_request_receipt
+        WHERE tenant_id = $1 AND device_id = $2 AND request_id = $3`,
+      [tenant, deviceId, requestId]
+    );
+    const row = result.rows[0];
+    return row === void 0 ? void 0 : toReceipt3(tenant, row);
+  }
+  async #lockCurrentRecords(client, tenant, writes) {
+    const current = /* @__PURE__ */ new Map();
+    const ordered = [...writes].sort((a, b) => writeKey(a).localeCompare(writeKey(b)));
+    for (const write of ordered) {
+      await client.query("SELECT pg_advisory_xact_lock(hashtextextended($1, 0))", [
+        JSON.stringify(["truth-record", tenant, write.kind, write.recordKey])
+      ]);
+    }
+    for (const write of ordered) {
+      const result = await client.query(
+        `SELECT ${RECORD_COLUMNS2} FROM attested_record
+          WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3
+          FOR UPDATE`,
+        [tenant, write.kind, write.recordKey]
+      );
+      current.set(
+        writeKey(write),
+        result.rows[0] === void 0 ? void 0 : toRecord3(tenant, result.rows[0])
+      );
+    }
+    return current;
+  }
+  #assertWritePreconditions(writes, current) {
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal") {
+        if (before !== void 0 && before.contentHash !== write.contentHash) {
+          throw new CoreConflictError(
+            "terminal_conflict",
+            `Task ${write.recordKey} already has a different immutable terminal.`,
+            before,
+            this.#now()
+          );
+        }
+      } else if ((before?.rev ?? 0) !== write.expectedRev) {
+        throw new CoreConflictError(
+          "truth_revision_conflict",
+          `${write.kind}/${write.recordKey} is at rev ${before?.rev ?? 0}, not ${write.expectedRev}.`,
+          before,
+          this.#now()
+        );
+      }
+    }
+  }
+  async #lockAndVerifyObjects(client, tenant, writes, current) {
+    const requested = /* @__PURE__ */ new Map();
+    const affected = /* @__PURE__ */ new Set();
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) continue;
+      if (before?.body.kind === "object") affected.add(before.body.hash);
+      if (write.body.kind === "object") {
+        const existing = requested.get(write.body.hash);
+        if (existing !== void 0 && existing !== write.byteSize) {
+          throw new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Object ${write.body.hash} was declared with inconsistent byte sizes.`
+          );
+        }
+        requested.set(write.body.hash, write.byteSize);
+        affected.add(write.body.hash);
+      }
+    }
+    for (const hash of [...affected].sort()) {
+      const result = await client.query(
+        `SELECT hash, byte_size, state FROM object_manifest
+          WHERE tenant_id = $1 AND hash = $2 FOR UPDATE`,
+        [tenant, hash]
+      );
+      const manifest = result.rows[0];
+      const byteSize = requested.get(hash);
+      if (manifest === void 0 || byteSize !== void 0 && (manifest.state !== "committed" || manifest.byte_size !== byteSize)) {
+        throw new TruthCommitError(
+          "truth_object_not_committed",
+          `Object ${hash} is not a committed matching manifest.`
+        );
+      }
+    }
+  }
+  async #prepareInlineAccounting(client, tenant, writes, current) {
+    const entitlementResult = await client.query(
+      `SELECT hard_limit_bytes, max_inline_bytes, downgrade_grace_until
+         FROM storage_entitlement WHERE tenant_id = $1 FOR UPDATE`,
+      [tenant]
+    );
+    const entitlement = entitlementResult.rows[0];
+    if (entitlement === void 0) {
+      throw new ByokCoreError("storage_entitlement_missing", "Tenant has no storage entitlement.");
+    }
+    const now = this.#now();
+    await client.query(
+      `UPDATE storage_reservation SET state = 'expired', settled_at = $2
+        WHERE tenant_id = $1 AND state = 'reserved' AND expires_at <= $2`,
+      [tenant, now]
+    );
+    const usageResult = await client.query(
+      `SELECT u.committed_object_bytes, u.committed_inline_bytes,
+              COALESCE((SELECT SUM(expected_bytes) FROM storage_reservation r
+                         WHERE r.tenant_id = $1 AND r.state = 'reserved'), 0)::bigint AS reserved_bytes
+         FROM storage_usage u WHERE u.tenant_id = $1 FOR UPDATE`,
+      [tenant]
+    );
+    const usage = usageResult.rows[0];
+    if (usage === void 0) throw new Error(`storage usage for ${tenant} is missing`);
+    const affectedHashes = /* @__PURE__ */ new Set();
+    const sizes = /* @__PURE__ */ new Map();
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) continue;
+      if (before?.body.kind === "inline") {
+        affectedHashes.add(before.contentHash);
+        sizes.set(before.contentHash, before.byteSize);
+      }
+      if (write.body.kind !== "inline") continue;
+      if (write.byteSize > entitlement.max_inline_bytes) {
+        throw new ByokCoreError(
+          "storage_object_too_large",
+          `Inline truth ${write.kind}/${write.recordKey} exceeds maxInlineBytes.`
+        );
+      }
+      const knownSize = sizes.get(write.contentHash);
+      if (knownSize !== void 0 && knownSize !== write.byteSize) {
+        throw new ByokCoreError(
+          "storage_integrity_mismatch",
+          `Inline hash ${write.contentHash} was declared with inconsistent byte sizes.`
+        );
+      }
+      affectedHashes.add(write.contentHash);
+      sizes.set(write.contentHash, write.byteSize);
+    }
+    const hashes = [...affectedHashes].sort();
+    const baseline = new Map(hashes.map((hash) => [hash, 0n]));
+    const existing = await client.query(
+      `SELECT content_hash, byte_size, count(*)::bigint AS ref_count
+         FROM attested_record
+        WHERE tenant_id = $1 AND body_kind = 'inline' AND content_hash = ANY($2::text[])
+        GROUP BY content_hash, byte_size`,
+      [tenant, hashes]
+    );
+    for (const row of existing.rows) {
+      const knownSize = sizes.get(row.content_hash);
+      if (knownSize !== void 0 && knownSize !== row.byte_size) {
+        throw new ByokCoreError(
+          "storage_integrity_mismatch",
+          `Stored inline hash ${row.content_hash} disagrees on byte size.`
+        );
+      }
+      if ((baseline.get(row.content_hash) ?? 0n) !== 0n) {
+        throw new ByokCoreError(
+          "storage_integrity_mismatch",
+          `Stored inline hash ${row.content_hash} has multiple byte sizes.`
+        );
+      }
+      baseline.set(row.content_hash, row.ref_count);
+      sizes.set(row.content_hash, row.byte_size);
+    }
+    const projected = new Map(baseline);
+    for (const write of writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) continue;
+      if (before?.body.kind === "inline") {
+        projected.set(before.contentHash, (projected.get(before.contentHash) ?? 0n) - 1n);
+      }
+      if (write.body.kind === "inline") {
+        projected.set(write.contentHash, (projected.get(write.contentHash) ?? 0n) + 1n);
+      }
+    }
+    let delta = 0n;
+    let newlyCommitted = 0n;
+    for (const hash of hashes) {
+      const before = baseline.get(hash) ?? 0n;
+      const after = projected.get(hash) ?? 0n;
+      if (after < 0n) throw new Error(`inline reference count for ${hash} would become negative`);
+      const byteSize = sizes.get(hash);
+      if (byteSize === void 0) throw new Error(`inline byte size for ${hash} is missing`);
+      if (before === 0n && after > 0n) {
+        delta += byteSize;
+        newlyCommitted += byteSize;
+      } else if (before > 0n && after === 0n) {
+        delta -= byteSize;
+      }
+    }
+    const used = usage.committed_object_bytes + usage.committed_inline_bytes + usage.reserved_bytes;
+    if (newlyCommitted > 0n && used >= entitlement.hard_limit_bytes && entitlement.downgrade_grace_until !== null && entitlement.downgrade_grace_until <= now) {
+      throw new ByokCoreError("storage_write_suspended", "Durable writes are suspended.");
+    }
+    if (used + delta > entitlement.hard_limit_bytes) {
+      throw new ByokCoreError("storage_quota_exceeded", "Final inline truth usage exceeds quota.");
+    }
+    return delta;
+  }
+  async #applyWrites(client, tenant, input, current) {
+    const applied = [];
+    for (const write of input.writes) {
+      const before = current.get(writeKey(write));
+      if (write.kind === "task.terminal" && before !== void 0) {
+        applied.push({ input: write, before, record: before, mutated: false });
+        continue;
+      }
+      const [bodyKind, bodyInline, bodyObjectHash] = bodyColumns2(write.body);
+      const values = [
+        tenant,
+        write.kind,
+        write.recordKey,
+        write.contentHash,
+        write.byteSize,
+        bodyKind,
+        bodyInline,
+        bodyObjectHash,
+        write.label ?? null,
+        input.requestId,
+        this.#now()
+      ];
+      const result = before === void 0 ? await client.query(
+        `INSERT INTO attested_record (${RECORD_COLUMNS2})
+               VALUES ($1, $2, $3, 1, $4, $5, $6, $7, $8, $9, $10, $11)
+               RETURNING ${RECORD_COLUMNS2}`,
+        values
+      ) : await client.query(
+        `UPDATE attested_record
+                  SET rev = rev + 1, content_hash = $4, byte_size = $5,
+                      body_kind = $6, body_inline = $7, body_object_hash = $8,
+                      label = $9, request_id = $10, written_at = $11
+                WHERE tenant_id = $1 AND kind = $2 AND subject_id = $3
+               RETURNING ${RECORD_COLUMNS2}`,
+        values
+      );
+      applied.push({
+        input: write,
+        before,
+        record: toRecord3(tenant, result.rows[0]),
+        mutated: true
+      });
+    }
+    return applied;
+  }
+  async #replaceObjectReferences(client, tenant, applied) {
+    const affected = /* @__PURE__ */ new Set();
+    for (const entry of applied) {
+      if (!entry.mutated) continue;
+      const refId = referenceId(entry.input);
+      if (entry.input.body.kind === "object") {
+        affected.add(entry.input.body.hash);
+        await client.query(
+          `INSERT INTO object_reference (tenant_id, hash, ref_kind, ref_id, created_at)
+           VALUES ($1, $2, 'truth', $3, $4)
+           ON CONFLICT (tenant_id, hash, ref_kind, ref_id) DO NOTHING`,
+          [tenant, entry.input.body.hash, refId, this.#now()]
+        );
+      }
+      if (entry.before?.body.kind === "object" && (entry.input.body.kind !== "object" || entry.input.body.hash !== entry.before.body.hash)) {
+        affected.add(entry.before.body.hash);
+        await client.query(
+          `DELETE FROM object_reference
+            WHERE tenant_id = $1 AND hash = $2 AND ref_kind = 'truth' AND ref_id = $3`,
+          [tenant, entry.before.body.hash, refId]
+        );
+      }
+    }
+    for (const hash of [...affected].sort()) {
+      await client.query(
+        `UPDATE object_manifest
+            SET ref_count = (SELECT count(*) FROM object_reference r
+                              WHERE r.tenant_id = $1 AND r.hash = $2),
+                updated_at = $3
+          WHERE tenant_id = $1 AND hash = $2`,
+        [tenant, hash, this.#now()]
+      );
+    }
+  }
+  async #settleInlineAccounting(client, tenant, delta) {
+    if (delta !== 0n) {
+      const updated = await client.query(
+        `UPDATE storage_usage
+            SET committed_inline_bytes = committed_inline_bytes + $2::bigint,
+                updated_at = $3
+          WHERE tenant_id = $1 AND committed_inline_bytes + $2::bigint >= 0
+         RETURNING 1`,
+        [tenant, delta, this.#now()]
+      );
+      if (updated.rowCount !== 1) throw new Error("inline accounting would become negative");
+    }
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+export { CLOUD_CLEANUP_ERROR_CODES, CloudCleanupError, DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, MigrationChecksumMismatchError, MigrationFilenameError, ObjectStoreRequestError, PostgresActivityStore, PostgresBoardStore, PostgresCloudCleanup, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresTaskAttemptStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudMaintenance, createPostgresCloudStores, createPostgresCoreStores, migrate, migrationsDir, readMigrationFiles };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map