@byok-sdk/cloud-dataplane 0.4.2 → 0.6.0

package/dist/runtime.js

@@ -1,6 +1,6 @@
 import pg from 'pg';
 import { DEDUP_RING_CAPACITY, NONCE_TTL_MS, validateActivityAppend, projectTimelineEvents, ByokCloudError, validateApprovalTimelineAppend, ApprovalObservationSchema, AllowAllRateLimiter, TruthCommitError, TruthCommitResponseSchema, truthRecordMetadata, TRUTH_REQUEST_ID_MAX_LENGTH, parseTimelineEvents, activityCursor, parseApprovalObservations, approvalTimelineCursor } from '@byok-sdk/cloud';
-import { ByokCoreError, assertCanonicalTimestamp, contentHash, isContentHash, tenantObjectKey, objectKeyPrefix, CoreConflictError, isLegalBoardTransition, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
+import { contentHash, ByokCoreError, assertCanonicalTimestamp, isContentHash, tenantObjectKey, objectKeyPrefix, CoreConflictError, isLegalBoardTransition, checkSkillPackManifest, checkSkillPackEntry, SKILL_PACK_ENTRY_PATH, SKILL_PACK_MANIFEST_SCHEMA_ID } from '@byok-sdk/core';
 import { AwsClient } from 'aws4fetch';
 import { XMLParser } from 'fast-xml-parser';
 
@@ -591,7 +591,7 @@ var R2ObjectMaintenanceStore = class {
         `A ListObjectsV2 page limit of ${String(limit)} is not a whole number in [1, 1000].`
       );
     }
-    const prefix = `${tenant}/sha256/`;
+    const prefix = tenantObjectKey(tenant, LIST_PREFIX_HASH, this.#keyPrefix).slice(0, -LIST_HASH_HEX_LENGTH);
     const url = new URL(`${this.#origin}/${this.#bucket}`);
     url.searchParams.set("list-type", "2");
     url.searchParams.set("prefix", prefix);
@@ -775,6 +775,8 @@ function parseListObjectsV2(xml, prefix, attempts) {
   return { objects, nextContinuationToken };
 }
 var HASH_KEY_SUFFIX = /^[0-9a-f]{64}$/;
+var LIST_HASH_HEX_LENGTH = 64;
+var LIST_PREFIX_HASH = contentHash(`sha256:${"0".repeat(LIST_HASH_HEX_LENGTH)}`);
 function asRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
 }
@@ -786,8 +788,6 @@ function requiredText(record, field, attempts) {
     attempts
   );
 }
-
-// src/stores/devices.ts
 function toRecord(row) {
   return {
     tenantId: row.tenant_id,
@@ -803,8 +803,10 @@ function toRecord(row) {
 var SELECT_COLUMNS = "tenant_id, device_id, product_id, device_name, device_public_key, proof_key_id, proof_key_epoch, revoked";
 var PostgresDeviceDirectory = class {
   #pool;
-  constructor(pool) {
+  #clock;
+  constructor(pool, clock) {
     this.#pool = pool;
+    this.#clock = clock;
   }
   async register(tenant, input) {
     const result = await this.#pool.query(
@@ -854,6 +856,73 @@ var PostgresDeviceDirectory = class {
     );
     return result.rows.map(toRecord);
   }
+  async readiness(tenant, _presence) {
+    const result = await this.#pool.query(
+      `SELECT
+         d.device_id,
+         d.product_id,
+         d.device_name,
+         d.revoked,
+         CASE WHEN NOT d.revoked THEN p.level END AS presence_level,
+         CASE WHEN NOT d.revoked THEN p.detail END AS presence_detail,
+         CASE WHEN NOT d.revoked THEN p.configured_toolsets END AS presence_configured_toolsets,
+         CASE WHEN NOT d.revoked THEN p.client_version END AS presence_client_version,
+         CASE WHEN NOT d.revoked THEN p.protocol_versions END AS presence_protocol_versions,
+         CASE WHEN NOT d.revoked THEN p.runtimes END AS presence_runtimes,
+         CASE WHEN NOT d.revoked THEN p.observed_at END AS presence_observed_at,
+         CASE WHEN NOT d.revoked THEN p.expires_at END AS presence_expires_at,
+         (COUNT(*) FILTER (WHERE NOT d.revoked) OVER ())::int AS active_paired_device_count,
+         (COUNT(*) FILTER (WHERE d.revoked) OVER ())::int AS revoked_device_count,
+         (COUNT(*) FILTER (WHERE NOT d.revoked AND p.device_id IS NOT NULL) OVER ())::int AS observed_presence_count,
+         (COUNT(*) FILTER (WHERE NOT d.revoked AND p.level = 'online') OVER ())::int AS observed_online_count,
+         (COUNT(*) FILTER (WHERE NOT d.revoked AND p.level = 'thinking') OVER ())::int AS observed_thinking_count,
+         (COUNT(*) FILTER (WHERE NOT d.revoked AND p.level = 'working') OVER ())::int AS observed_working_count,
+         (COUNT(*) FILTER (WHERE NOT d.revoked AND p.level = 'error') OVER ())::int AS observed_error_count,
+         (COUNT(*) FILTER (WHERE NOT d.revoked AND p.level = 'offline') OVER ())::int AS observed_offline_count
+       FROM device d
+       LEFT JOIN device_presence p
+         ON p.tenant_id = d.tenant_id
+        AND p.device_id = d.device_id
+        AND p.expires_at > $2
+       WHERE d.tenant_id = $1
+       ORDER BY d.device_id`,
+      [tenant, this.#clock?.now().toISOString() ?? (/* @__PURE__ */ new Date()).toISOString()]
+    );
+    const row = result.rows[0];
+    const count = (value) => Number(value);
+    const devices = result.rows.map((device) => ({
+      deviceId: device.device_id,
+      productId: device.product_id,
+      deviceName: device.device_name,
+      revoked: device.revoked,
+      ...device.presence_level === null ? {} : {
+        presence: {
+          level: device.presence_level,
+          ...device.presence_detail === null ? {} : { detail: device.presence_detail },
+          ...device.presence_configured_toolsets === null ? {} : { configuredToolsets: Object.freeze([...device.presence_configured_toolsets]) },
+          ...device.presence_client_version === null ? {} : { clientVersion: device.presence_client_version },
+          ...device.presence_protocol_versions === null ? {} : { protocolVersions: Object.freeze([...device.presence_protocol_versions]) },
+          ...device.presence_runtimes === null ? {} : { runtimes: Object.freeze(device.presence_runtimes.map((runtime) => Object.freeze({ ...runtime }))) },
+          observedAt: device.presence_observed_at,
+          expiresAt: device.presence_expires_at
+        }
+      }
+    }));
+    return {
+      tenantId: tenant,
+      activePairedDeviceCount: count(row?.active_paired_device_count ?? 0),
+      revokedDeviceCount: count(row?.revoked_device_count ?? 0),
+      observedPresenceCount: count(row?.observed_presence_count ?? 0),
+      observedPresenceByLevel: {
+        online: count(row?.observed_online_count ?? 0),
+        thinking: count(row?.observed_thinking_count ?? 0),
+        working: count(row?.observed_working_count ?? 0),
+        error: count(row?.observed_error_count ?? 0),
+        offline: count(row?.observed_offline_count ?? 0)
+      },
+      devices
+    };
+  }
   async resolveByDeviceId(deviceId) {
     const result = await this.#pool.query(
       `SELECT ${SELECT_COLUMNS} FROM device WHERE device_id = $1`,
@@ -1077,8 +1146,8 @@ var PostgresProofRequestReceiptStore = class {
 };
 
 // src/stores/task-attempts.ts
-var SELECT_COLUMNS4 = "tenant_id, task_id, device_id, owner_device_id, status, updated_at";
-function toAttempt(row) {
+var TASK_SELECT_COLUMNS = "tenant_id, task_id, device_id, owner_device_id, status, cancel_requested_at, cancel_reason, cancel_message_id, updated_at";
+function taskRowToAttempt(row) {
   return {
     tenantId: row.tenant_id,
     taskId: row.task_id,
@@ -1089,6 +1158,12 @@ function toAttempt(row) {
     // former.
     ...row.owner_device_id === null ? {} : { ownerDeviceId: row.owner_device_id },
     status: row.status,
+    ...row.cancel_requested_at === null ? {} : {
+      cancellation: {
+        requestedAt: row.cancel_requested_at.toISOString(),
+        ...row.cancel_reason === null ? {} : { reason: row.cancel_reason }
+      }
+    },
     updatedAt: row.updated_at.toISOString()
   };
 }
@@ -1104,33 +1179,42 @@ var PostgresTaskAttemptStore = class {
       `INSERT INTO task (tenant_id, task_id, device_id, owner_device_id, status, updated_at)
        VALUES ($1, $2, $3, NULL, 'offered', $4)
        ON CONFLICT (tenant_id, task_id) DO NOTHING
-       RETURNING ${SELECT_COLUMNS4}`,
+       RETURNING ${TASK_SELECT_COLUMNS}`,
       [tenant, input.taskId, input.deviceId, this.#now()]
     );
     const created = inserted.rows[0];
-    if (created !== void 0) return toAttempt(created);
+    if (created !== void 0) return taskRowToAttempt(created);
     const existing = await this.get(tenant, input.taskId);
     if (existing === void 0) throw new Error(`task ${input.taskId} vanished during open`);
     return existing;
   }
   async get(tenant, taskId) {
     const result = await this.#pool.query(
-      `SELECT ${SELECT_COLUMNS4} FROM task WHERE tenant_id = $1 AND task_id = $2`,
+      `SELECT ${TASK_SELECT_COLUMNS} FROM task WHERE tenant_id = $1 AND task_id = $2`,
       [tenant, taskId]
     );
     const row = result.rows[0];
-    return row === void 0 ? void 0 : toAttempt(row);
+    return row === void 0 ? void 0 : taskRowToAttempt(row);
+  }
+  async getMany(tenant, taskIds) {
+    if (taskIds.length === 0) return [];
+    const result = await this.#pool.query(
+      `SELECT ${TASK_SELECT_COLUMNS} FROM task WHERE tenant_id = $1 AND task_id = ANY($2::text[])`,
+      [tenant, [...new Set(taskIds)]]
+    );
+    return result.rows.map(taskRowToAttempt);
   }
   async claim(tenant, input) {
     const claimed = await this.#pool.query(
       `UPDATE task
           SET owner_device_id = $3, status = 'claimed', updated_at = $4
         WHERE tenant_id = $1 AND task_id = $2 AND owner_device_id IS NULL
-      RETURNING ${SELECT_COLUMNS4}`,
+          AND cancel_requested_at IS NULL AND status = 'offered'
+      RETURNING ${TASK_SELECT_COLUMNS}`,
       [tenant, input.taskId, input.deviceId, this.#now()]
     );
     const won = claimed.rows[0];
-    if (won !== void 0) return toAttempt(won);
+    if (won !== void 0) return taskRowToAttempt(won);
     return this.get(tenant, input.taskId);
   }
   async recordStatus(tenant, input) {
@@ -1138,16 +1222,336 @@ var PostgresTaskAttemptStore = class {
       `UPDATE task
           SET status = $3, updated_at = $4
         WHERE tenant_id = $1 AND task_id = $2
-      RETURNING ${SELECT_COLUMNS4}`,
+          AND (
+            (cancel_requested_at IS NULL AND status NOT IN ('complete', 'failed', 'cancelled'))
+            OR (cancel_requested_at IS NOT NULL AND $3 = 'cancelled' AND status <> 'cancelled')
+          )
+      RETURNING ${TASK_SELECT_COLUMNS}`,
       [tenant, input.taskId, input.status, this.#now()]
     );
     const row = result.rows[0];
-    return row === void 0 ? void 0 : toAttempt(row);
+    return row === void 0 ? this.get(tenant, input.taskId) : taskRowToAttempt(row);
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/stores/core/mailbox-sequence.ts
+async function allocateMailboxSequence(client, tenant, deviceId, now) {
+  const allocation = await client.query(
+    `INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
+     VALUES ($1, $2, 2, 0, $3)
+     ON CONFLICT (tenant_id, device_id) DO UPDATE
+        SET next_seq = device_stream.next_seq + 1
+     RETURNING next_seq - 1 AS seq`,
+    [tenant, deviceId, now]
+  );
+  return Number(allocation.rows[0].seq);
+}
+
+// src/stores/core/mailbox.ts
+var DEFAULT_READ_LIMIT = 50;
+var OUTBOX_COLUMNS = "tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at";
+function toMailboxMessage(row) {
+  return {
+    tenantId: row.tenant_id,
+    deviceId: row.device_id,
+    // `seq` is bigint in the column and `number` on the port, because it is the
+    // envelope `seq` on the wire. The column is wide so the counter cannot wrap
+    // into a redelivery bug; the narrowing happens once, here.
+    seq: Number(row.seq),
+    messageId: row.message_id,
+    body: row.body,
+    bodyHash: row.body_hash,
+    byteSize: row.byte_size,
+    state: row.state,
+    appendedAt: row.appended_at
+  };
+}
+var PostgresMailboxStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async append(tenant, input) {
+    this.#requireDeviceId(input.deviceId);
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const existing = await client.query(
+        `SELECT ${OUTBOX_COLUMNS} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+        [tenant, input.deviceId, input.messageId]
+      );
+      const replayed = existing.rows[0];
+      if (replayed !== void 0) {
+        await client.query("COMMIT");
+        return toMailboxMessage(replayed);
+      }
+      const seq = await allocateMailboxSequence(client, tenant, input.deviceId, this.#now());
+      const serializedExisting = await client.query(
+        `SELECT ${OUTBOX_COLUMNS} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+        [tenant, input.deviceId, input.messageId]
+      );
+      const winnerAfterLock = serializedExisting.rows[0];
+      if (winnerAfterLock !== void 0) {
+        await client.query("ROLLBACK");
+        return toMailboxMessage(winnerAfterLock);
+      }
+      const materialized = await input.materialize(seq);
+      const now = this.#now();
+      const inserted = await client.query(
+        `INSERT INTO outbox (${OUTBOX_COLUMNS})
+         VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8)
+         ON CONFLICT (tenant_id, device_id, message_id) DO NOTHING
+         RETURNING ${OUTBOX_COLUMNS}`,
+        [
+          tenant,
+          input.deviceId,
+          seq,
+          input.messageId,
+          materialized.body,
+          materialized.bodyHash,
+          materialized.byteSize,
+          now
+        ]
+      );
+      const row = inserted.rows[0];
+      if (row !== void 0) {
+        await client.query("COMMIT");
+        return toMailboxMessage(row);
+      }
+      const winner = await client.query(
+        `SELECT ${OUTBOX_COLUMNS} FROM outbox
+          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+        [tenant, input.deviceId, input.messageId]
+      );
+      await client.query("ROLLBACK");
+      const won = winner.rows[0];
+      if (won === void 0) {
+        throw new ByokCoreError(
+          "mailbox_message_not_found",
+          `Message ${input.messageId} vanished during an idempotent append.`
+        );
+      }
+      return toMailboxMessage(won);
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+  }
+  async readAfter(tenant, query) {
+    const limit = query.limit ?? DEFAULT_READ_LIMIT;
+    const result = await this.#pool.query(
+      `SELECT ${OUTBOX_COLUMNS} FROM outbox
+        WHERE tenant_id = $1 AND device_id = $2 AND state = 'pending' AND seq > $3::bigint
+        ORDER BY seq
+        LIMIT $4`,
+      [tenant, query.deviceId, query.afterSeq, limit + 1]
+    );
+    const page = result.rows.slice(0, limit).map(toMailboxMessage);
+    return {
+      messages: page,
+      // Nothing above was mutated, so an identical call replays the same page.
+      // The returned position is a READ cursor and moves no ack.
+      nextSeq: page.at(-1)?.seq ?? query.afterSeq,
+      hasMore: result.rows.length > page.length
+    };
+  }
+  async advanceCursor(tenant, input) {
+    this.#requireDeviceId(input.deviceId);
+    const now = this.#now();
+    const moved = await this.#pool.query(
+      `WITH moved AS (
+         INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
+         VALUES ($1, $2, 1, $3::bigint, $4)
+         ON CONFLICT (tenant_id, device_id) DO UPDATE
+            SET acked_seq = EXCLUDED.acked_seq, acked_at = EXCLUDED.acked_at
+          WHERE device_stream.acked_seq <= EXCLUDED.acked_seq
+         RETURNING acked_seq, acked_at
+       ), marked AS (
+         UPDATE outbox
+            SET state = 'acked'
+          WHERE tenant_id = $1 AND device_id = $2 AND state = 'pending'
+            AND seq <= (SELECT acked_seq FROM moved)
+         RETURNING 1
+       )
+       SELECT acked_seq, acked_at FROM moved`,
+      [tenant, input.deviceId, input.ackedSeq, now]
+    );
+    const row = moved.rows[0];
+    if (row !== void 0) {
+      return {
+        tenantId: tenant,
+        deviceId: input.deviceId,
+        ackedSeq: Number(row.acked_seq),
+        updatedAt: row.acked_at ?? now
+      };
+    }
+    const current = await this.readCursor(tenant, input.deviceId);
+    throw new CoreConflictError(
+      "mailbox_cursor_regression",
+      `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
+      current,
+      this.#now()
+    );
+  }
+  async readCursor(tenant, deviceId) {
+    const result = await this.#pool.query(
+      `SELECT acked_seq, acked_at FROM device_stream
+        WHERE tenant_id = $1 AND device_id = $2`,
+      [tenant, deviceId]
+    );
+    const row = result.rows[0];
+    return {
+      tenantId: tenant,
+      deviceId,
+      ackedSeq: row === void 0 ? 0 : Number(row.acked_seq),
+      updatedAt: row?.acked_at ?? this.#now()
+    };
+  }
+  async collectRetired(tenant, input) {
+    assertCanonicalTimestamp(input.ackedBefore, "ackedBefore");
+    assertCanonicalTimestamp(input.expireUnackedBefore, "expireUnackedBefore");
+    const swept = await this.#pool.query(
+      `WITH deleted AS (
+         DELETE FROM outbox
+          WHERE tenant_id = $1
+            AND ($2::text IS NULL OR device_id = $2::text)
+            AND state = 'acked'
+            AND appended_at < $3
+         RETURNING byte_size
+       ), expired AS (
+         UPDATE outbox
+            SET state = 'expired'
+          WHERE tenant_id = $1
+            AND ($2::text IS NULL OR device_id = $2::text)
+            AND state = 'pending'
+            AND appended_at < $4
+         RETURNING 1
+       )
+       SELECT (SELECT count(*) FROM deleted)                           AS deleted_count,
+              (SELECT count(*) FROM expired)                           AS expired_count,
+              (SELECT COALESCE(SUM(byte_size), 0) FROM deleted)::bigint AS released_bytes`,
+      [tenant, input.deviceId ?? null, input.ackedBefore, input.expireUnackedBefore]
+    );
+    const row = swept.rows[0];
+    return {
+      deletedCount: Number(row.deleted_count),
+      expiredCount: Number(row.expired_count),
+      releasedBytes: row.released_bytes
+    };
+  }
+  /**
+   * The in-memory reference refuses an empty device id rather than opening a
+   * mailbox nothing can address. Kept here so the two compositions answer the
+   * same way; the table itself would happily store the row.
+   */
+  #requireDeviceId(deviceId) {
+    if (deviceId.length === 0) {
+      throw new ByokCoreError("mailbox_message_not_found", "Device id must not be empty.");
+    }
   }
   #now() {
     return this.#clock.now().toISOString();
   }
 };
+
+// src/stores/task-cancellations.ts
+var PostgresTaskCancellationStore = class {
+  #pool;
+  #clock;
+  constructor(pool, clock) {
+    this.#pool = pool;
+    this.#clock = clock;
+  }
+  async request(tenant, input) {
+    const client = await this.#pool.connect();
+    try {
+      await client.query("BEGIN");
+      const selected = await client.query(
+        `SELECT ${TASK_SELECT_COLUMNS} FROM task
+          WHERE tenant_id = $1 AND task_id = $2
+          FOR UPDATE`,
+        [tenant, input.taskId]
+      );
+      const current = selected.rows[0];
+      if (current === void 0) {
+        await client.query("ROLLBACK");
+        return void 0;
+      }
+      if (current.cancel_requested_at === null && (current.status === "complete" || current.status === "failed" || current.status === "cancelled")) {
+        await client.query("COMMIT");
+        return { attempt: taskRowToAttempt(current) };
+      }
+      if (current.cancel_message_id !== null) {
+        const replayed = await client.query(
+          `SELECT ${OUTBOX_COLUMNS} FROM outbox
+            WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
+          [tenant, current.device_id, current.cancel_message_id]
+        );
+        const message = replayed.rows[0];
+        if (message === void 0) {
+          if (current.status === "cancelled") {
+            await client.query("COMMIT");
+            return { attempt: taskRowToAttempt(current) };
+          }
+          throw new Error(`Cancellation delivery ${current.cancel_message_id} is missing for task ${input.taskId}`);
+        }
+        await client.query("COMMIT");
+        return { attempt: taskRowToAttempt(current), message: toMailboxMessage(message) };
+      }
+      const now = this.#clock.now().toISOString();
+      const messageId = input.proposedMessageId;
+      const seq = await allocateMailboxSequence(client, tenant, current.device_id, now);
+      const materialized = await input.materialize(seq, messageId);
+      const insertedMessage = await client.query(
+        `INSERT INTO outbox (${OUTBOX_COLUMNS})
+         VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8)
+         RETURNING ${OUTBOX_COLUMNS}`,
+        [
+          tenant,
+          current.device_id,
+          seq,
+          messageId,
+          materialized.body,
+          materialized.bodyHash,
+          materialized.byteSize,
+          now
+        ]
+      );
+      const updated = await client.query(
+        `UPDATE task
+            SET status = CASE WHEN owner_device_id IS NULL THEN 'cancelled' ELSE 'cancel_requested' END,
+                cancel_requested_at = $3,
+                cancel_reason = $4,
+                cancel_message_id = $5,
+                updated_at = $3
+          WHERE tenant_id = $1 AND task_id = $2
+        RETURNING ${TASK_SELECT_COLUMNS}`,
+        [tenant, input.taskId, now, input.reason ?? null, messageId]
+      );
+      await client.query("COMMIT");
+      return {
+        attempt: taskRowToAttempt(updated.rows[0]),
+        message: toMailboxMessage(insertedMessage.rows[0])
+      };
+    } catch (cause) {
+      await client.query("ROLLBACK").catch(() => {
+      });
+      throw cause;
+    } finally {
+      client.release();
+    }
+  }
+};
 function toTail(row) {
   const entries = parseTimelineEvents(row.entries);
   const cursor = activityCursor(entries);
@@ -1382,17 +1786,67 @@ var PostgresApprovalTimelineStore = class {
   }
 };
 
+// src/stores/device-assertion-replay.ts
+var PostgresDeviceAssertionReplayAuthority = class {
+  #pool;
+  constructor(pool) {
+    this.#pool = pool;
+  }
+  async consume(input) {
+    if (!Number.isFinite(Date.parse(input.expiresAt))) {
+      throw new Error("device assertion replay expiry is invalid");
+    }
+    const result = await this.#pool.query(
+      `INSERT INTO device_assertion_replay (
+         tenant_id, issuer, product_id, device_id, audience, jti, expires_at
+       )
+       VALUES ($1, $2, $3, $4, $5, $6, $7)
+       ON CONFLICT (tenant_id, issuer, product_id, device_id, audience, jti) DO NOTHING
+       RETURNING jti`,
+      [
+        input.tenantId,
+        input.issuer,
+        input.productId,
+        input.deviceId,
+        input.audience,
+        input.jti,
+        input.expiresAt
+      ]
+    );
+    return result.rowCount === 1;
+  }
+  /** Bounded retention cleanup; callers choose cadence and batch size. */
+  async deleteExpired(before, limit) {
+    if (!Number.isFinite(before.getTime()) || !Number.isSafeInteger(limit) || limit <= 0) {
+      throw new Error("device assertion replay cleanup bounds are invalid");
+    }
+    const result = await this.#pool.query(
+      `DELETE FROM device_assertion_replay
+       WHERE ctid IN (
+         SELECT ctid
+         FROM device_assertion_replay
+         WHERE expires_at <= $1
+         ORDER BY expires_at
+         LIMIT $2
+       )`,
+      [before.toISOString(), limit]
+    );
+    return result.rowCount ?? 0;
+  }
+};
+
 // src/stores/index.ts
 function createPostgresCloudStores(options) {
   const { pool, clock, crypto } = options;
   return {
     activity: new PostgresActivityStore(pool, clock),
     approvals: new PostgresApprovalTimelineStore(pool, clock),
-    devices: new PostgresDeviceDirectory(pool),
+    devices: new PostgresDeviceDirectory(pool, clock),
     pairingCodes: new PostgresPairingCodeStore(pool, clock),
     nonces: new PostgresNonceStore(pool, clock, crypto),
     dedup: new PostgresInboundDedupStore(pool),
     tasks: new PostgresTaskAttemptStore(pool, clock),
+    cancellations: new PostgresTaskCancellationStore(pool, clock),
     receipts: new PostgresRequestReceiptStore(pool, clock),
     proofReceipts: new PostgresProofRequestReceiptStore(pool, clock),
     // A second `PostgresObjectStore` instance, not a shared one: it is a
@@ -1406,7 +1860,7 @@ function createPostgresCloudStores(options) {
     rateLimiter: new AllowAllRateLimiter()
   };
 }
-var PRESENCE_COLUMNS = "tenant_id, device_id, level, detail, configured_toolsets, observed_at, expires_at";
+var PRESENCE_COLUMNS = "tenant_id, device_id, level, detail, configured_toolsets, client_version, protocol_versions, runtimes, observed_at, expires_at";
 function toHint(row) {
   return {
     tenantId: row.tenant_id,
@@ -1414,6 +1868,19 @@ function toHint(row) {
     level: row.level,
     ...row.detail === null ? {} : { detail: row.detail },
     ...row.configured_toolsets === null ? {} : { configuredToolsets: Object.freeze([...row.configured_toolsets]) },
+    ...row.client_version === null ? {} : { clientVersion: row.client_version },
+    ...row.protocol_versions === null ? {} : { protocolVersions: Object.freeze([...row.protocol_versions]) },
+    ...row.runtimes === null ? {} : {
+      runtimes: Object.freeze(
+        row.runtimes.map(
+          (runtime) => Object.freeze({
+            id: runtime.id,
+            ...runtime.version === void 0 ? {} : { version: runtime.version },
+            ...runtime.authPresent === void 0 ? {} : { authPresent: runtime.authPresent }
+          })
+        )
+      )
+    },
     observedAt: row.observed_at,
     expiresAt: row.expires_at
   };
@@ -1449,15 +1916,18 @@ var PostgresPresenceStore = class {
     const allowedBefore = new Date(now.getTime() - input.minimumIntervalMs).toISOString();
     const result = await this.#pool.query(
       `INSERT INTO device_presence (${PRESENCE_COLUMNS})
-       VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7)
+       VALUES ($1, $2, $3, $4, $5::jsonb, $6, $7::jsonb, $8::jsonb, $9, $10)
        ON CONFLICT (tenant_id, device_id) DO UPDATE
           SET level       = EXCLUDED.level,
               detail      = EXCLUDED.detail,
               configured_toolsets = EXCLUDED.configured_toolsets,
+              client_version = EXCLUDED.client_version,
+              protocol_versions = EXCLUDED.protocol_versions,
+              runtimes    = EXCLUDED.runtimes,
               observed_at = EXCLUDED.observed_at,
               expires_at  = EXCLUDED.expires_at
         WHERE device_presence.expires_at <= EXCLUDED.observed_at
-           OR device_presence.observed_at <= $8
+           OR device_presence.observed_at <= $11
        RETURNING ${PRESENCE_COLUMNS}`,
       [
         tenant,
@@ -1465,6 +1935,9 @@ var PostgresPresenceStore = class {
         input.level,
         input.detail ?? null,
         input.configuredToolsets === void 0 ? null : JSON.stringify(input.configuredToolsets),
+        input.clientVersion ?? null,
+        input.protocolVersions === void 0 ? null : JSON.stringify(input.protocolVersions),
+        input.runtimes === void 0 ? null : JSON.stringify(input.runtimes),
         observedAt,
         new Date(now.getTime() + input.ttlMs).toISOString(),
         allowedBefore
@@ -1732,233 +2205,6 @@ var PostgresBoardStore = class {
     return this.#clock.now().toISOString();
   }
 };
-
-// src/stores/core/mailbox-sequence.ts
-async function allocateMailboxSequence(client, tenant, deviceId, now) {
-  const allocation = await client.query(
-    `INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
-     VALUES ($1, $2, 2, 0, $3)
-     ON CONFLICT (tenant_id, device_id) DO UPDATE
-        SET next_seq = device_stream.next_seq + 1
-     RETURNING next_seq - 1 AS seq`,
-    [tenant, deviceId, now]
-  );
-  return Number(allocation.rows[0].seq);
-}
-
-// src/stores/core/mailbox.ts
-var DEFAULT_READ_LIMIT = 50;
-var OUTBOX_COLUMNS = "tenant_id, device_id, seq, message_id, body, body_hash, byte_size, state, appended_at";
-function toMessage(row) {
-  return {
-    tenantId: row.tenant_id,
-    deviceId: row.device_id,
-    // `seq` is bigint in the column and `number` on the port, because it is the
-    // envelope `seq` on the wire. The column is wide so the counter cannot wrap
-    // into a redelivery bug; the narrowing happens once, here.
-    seq: Number(row.seq),
-    messageId: row.message_id,
-    body: row.body,
-    bodyHash: row.body_hash,
-    byteSize: row.byte_size,
-    state: row.state,
-    appendedAt: row.appended_at
-  };
-}
-var PostgresMailboxStore = class {
-  #pool;
-  #clock;
-  constructor(pool, clock) {
-    this.#pool = pool;
-    this.#clock = clock;
-  }
-  async append(tenant, input) {
-    this.#requireDeviceId(input.deviceId);
-    const client = await this.#pool.connect();
-    try {
-      await client.query("BEGIN");
-      const existing = await client.query(
-        `SELECT ${OUTBOX_COLUMNS} FROM outbox
-          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
-        [tenant, input.deviceId, input.messageId]
-      );
-      const replayed = existing.rows[0];
-      if (replayed !== void 0) {
-        await client.query("COMMIT");
-        return toMessage(replayed);
-      }
-      const seq = await allocateMailboxSequence(client, tenant, input.deviceId, this.#now());
-      const serializedExisting = await client.query(
-        `SELECT ${OUTBOX_COLUMNS} FROM outbox
-          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
-        [tenant, input.deviceId, input.messageId]
-      );
-      const winnerAfterLock = serializedExisting.rows[0];
-      if (winnerAfterLock !== void 0) {
-        await client.query("ROLLBACK");
-        return toMessage(winnerAfterLock);
-      }
-      const materialized = await input.materialize(seq);
-      const now = this.#now();
-      const inserted = await client.query(
-        `INSERT INTO outbox (${OUTBOX_COLUMNS})
-         VALUES ($1, $2, $3::bigint, $4, $5, $6, $7::bigint, 'pending', $8)
-         ON CONFLICT (tenant_id, device_id, message_id) DO NOTHING
-         RETURNING ${OUTBOX_COLUMNS}`,
-        [
-          tenant,
-          input.deviceId,
-          seq,
-          input.messageId,
-          materialized.body,
-          materialized.bodyHash,
-          materialized.byteSize,
-          now
-        ]
-      );
-      const row = inserted.rows[0];
-      if (row !== void 0) {
-        await client.query("COMMIT");
-        return toMessage(row);
-      }
-      const winner = await client.query(
-        `SELECT ${OUTBOX_COLUMNS} FROM outbox
-          WHERE tenant_id = $1 AND device_id = $2 AND message_id = $3`,
-        [tenant, input.deviceId, input.messageId]
-      );
-      await client.query("ROLLBACK");
-      const won = winner.rows[0];
-      if (won === void 0) {
-        throw new ByokCoreError(
-          "mailbox_message_not_found",
-          `Message ${input.messageId} vanished during an idempotent append.`
-        );
-      }
-      return toMessage(won);
-    } catch (cause) {
-      await client.query("ROLLBACK").catch(() => {
-      });
-      throw cause;
-    } finally {
-      client.release();
-    }
-  }
-  async readAfter(tenant, query) {
-    const limit = query.limit ?? DEFAULT_READ_LIMIT;
-    const result = await this.#pool.query(
-      `SELECT ${OUTBOX_COLUMNS} FROM outbox
-        WHERE tenant_id = $1 AND device_id = $2 AND state = 'pending' AND seq > $3::bigint
-        ORDER BY seq
-        LIMIT $4`,
-      [tenant, query.deviceId, query.afterSeq, limit + 1]
-    );
-    const page = result.rows.slice(0, limit).map(toMessage);
-    return {
-      messages: page,
-      // Nothing above was mutated, so an identical call replays the same page.
-      // The returned position is a READ cursor and moves no ack.
-      nextSeq: page.at(-1)?.seq ?? query.afterSeq,
-      hasMore: result.rows.length > page.length
-    };
-  }
-  async advanceCursor(tenant, input) {
-    this.#requireDeviceId(input.deviceId);
-    const now = this.#now();
-    const moved = await this.#pool.query(
-      `WITH moved AS (
-         INSERT INTO device_stream (tenant_id, device_id, next_seq, acked_seq, acked_at)
-         VALUES ($1, $2, 1, $3::bigint, $4)
-         ON CONFLICT (tenant_id, device_id) DO UPDATE
-            SET acked_seq = EXCLUDED.acked_seq, acked_at = EXCLUDED.acked_at
-          WHERE device_stream.acked_seq <= EXCLUDED.acked_seq
-         RETURNING acked_seq, acked_at
-       ), marked AS (
-         UPDATE outbox
-            SET state = 'acked'
-          WHERE tenant_id = $1 AND device_id = $2 AND state = 'pending'
-            AND seq <= (SELECT acked_seq FROM moved)
-         RETURNING 1
-       )
-       SELECT acked_seq, acked_at FROM moved`,
-      [tenant, input.deviceId, input.ackedSeq, now]
-    );
-    const row = moved.rows[0];
-    if (row !== void 0) {
-      return {
-        tenantId: tenant,
-        deviceId: input.deviceId,
-        ackedSeq: Number(row.acked_seq),
-        updatedAt: row.acked_at ?? now
-      };
-    }
-    const current = await this.readCursor(tenant, input.deviceId);
-    throw new CoreConflictError(
-      "mailbox_cursor_regression",
-      `Cursor for device ${input.deviceId} is at ${current.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
-      current,
-      this.#now()
-    );
-  }
-  async readCursor(tenant, deviceId) {
-    const result = await this.#pool.query(
-      `SELECT acked_seq, acked_at FROM device_stream
-        WHERE tenant_id = $1 AND device_id = $2`,
-      [tenant, deviceId]
-    );
-    const row = result.rows[0];
-    return {
-      tenantId: tenant,
-      deviceId,
-      ackedSeq: row === void 0 ? 0 : Number(row.acked_seq),
-      updatedAt: row?.acked_at ?? this.#now()
-    };
-  }
-  async collectRetired(tenant, input) {
-    assertCanonicalTimestamp(input.ackedBefore, "ackedBefore");
-    assertCanonicalTimestamp(input.expireUnackedBefore, "expireUnackedBefore");
-    const swept = await this.#pool.query(
-      `WITH deleted AS (
-         DELETE FROM outbox
-          WHERE tenant_id = $1
-            AND ($2::text IS NULL OR device_id = $2::text)
-            AND state = 'acked'
-            AND appended_at < $3
-         RETURNING byte_size
-       ), expired AS (
-         UPDATE outbox
-            SET state = 'expired'
-          WHERE tenant_id = $1
-            AND ($2::text IS NULL OR device_id = $2::text)
-            AND state = 'pending'
-            AND appended_at < $4
-         RETURNING 1
-       )
-       SELECT (SELECT count(*) FROM deleted)                           AS deleted_count,
-              (SELECT count(*) FROM expired)                           AS expired_count,
-              (SELECT COALESCE(SUM(byte_size), 0) FROM deleted)::bigint AS released_bytes`,
-      [tenant, input.deviceId ?? null, input.ackedBefore, input.expireUnackedBefore]
-    );
-    const row = swept.rows[0];
-    return {
-      deletedCount: Number(row.deleted_count),
-      expiredCount: Number(row.expired_count),
-      releasedBytes: row.released_bytes
-    };
-  }
-  /**
-   * The in-memory reference refuses an empty device id rather than opening a
-   * mailbox nothing can address. Kept here so the two compositions answer the
-   * same way; the table itself would happily store the row.
-   */
-  #requireDeviceId(deviceId) {
-    if (deviceId.length === 0) {
-      throw new ByokCoreError("mailbox_message_not_found", "Device id must not be empty.");
-    }
-  }
-  #now() {
-    return this.#clock.now().toISOString();
-  }
-};
 var WARNING_NUMERATOR = 80n;
 var WARNING_DENOMINATOR = 100n;
 var ENTITLEMENT_COLUMNS = "tenant_id, version, hard_limit_bytes, max_object_bytes, max_inline_bytes, mailbox_limit_bytes, retention_policy_id, downgrade_grace_until";
@@ -3304,6 +3550,6 @@ var PostgresTruthCommitter = class {
   }
 };
 
-export { DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, ObjectStoreRequestError, PostgresActivityStore, PostgresApprovalTimelineStore, PostgresBoardStore, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresProofRequestReceiptStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresSkillPackStore, PostgresTaskAttemptStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudStores, createPostgresCoreStores };
+export { DEFAULT_MAX_ATTEMPTS, DEFAULT_PRESIGN_TTL_SECONDS, DEFAULT_RETRY_DELAY_MS, MAX_PRESIGN_TTL_SECONDS, MIN_PRESIGN_TTL_SECONDS, ObjectStoreRequestError, PostgresActivityStore, PostgresApprovalTimelineStore, PostgresBoardStore, PostgresDeviceAssertionReplayAuthority, PostgresDeviceDirectory, PostgresInboundDedupStore, PostgresMailboxStore, PostgresNonceStore, PostgresObjectStore, PostgresPairingCodeStore, PostgresPresenceStore, PostgresProofRequestReceiptStore, PostgresQuotaStore, PostgresRequestReceiptStore, PostgresSkillPackStore, PostgresTaskAttemptStore, PostgresTaskCancellationStore, PostgresTruthCommitter, PostgresTruthStore, R2BlobStoreError, R2CloudBlobStore, R2ObjectMaintenanceStore, R2_BLOB_ERROR_CODES, createByokPool, createPostgresCloudStores, createPostgresCoreStores };
 //# sourceMappingURL=runtime.js.map
 //# sourceMappingURL=runtime.js.map