@byok-sdk/cloud 0.1.0

package/dist/crypto/web-crypto.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The reference {@link CloudCrypto}, built entirely on the WebCrypto API that
+ * Node >=20, Cloudflare Workers, and Deno all expose as `globalThis.crypto`.
+ *
+ * No `node:crypto`, no dependency: the point of the port is that a hosted
+ * composition stays runtime-neutral, and an adapter that reached for a Node
+ * built-in here would make that claim false for the default composition.
+ */
+import type { CloudCrypto } from './port';
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+/**
+ * Decode base64url. Returns `undefined` rather than throwing for input that
+ * is not base64url at all — every caller here is verifying attacker-supplied
+ * material, where "not decodable" and "does not verify" must be the same
+ * answer.
+ */
+export declare function base64UrlDecode(value: string): Uint8Array | undefined;
+/**
+ * WebCrypto's own types are derived from the runtime's `globalThis.crypto`
+ * rather than named directly: `CryptoKey`/`SubtleCrypto`/`KeyUsage` are DOM
+ * lib globals, and this package compiles without the DOM lib (a Workers build
+ * has no DOM either). Deriving keeps the types exact without pulling in a
+ * `node:` import or widening `lib`.
+ */
+export type SubtleCryptoLike = typeof globalThis.crypto.subtle;
+export type CryptoKeyLike = Awaited<ReturnType<SubtleCryptoLike['importKey']>>;
+export type KeyUsageLike = Parameters<SubtleCryptoLike['importKey']>[4][number];
+export declare function createWebCrypto(): CloudCrypto;

package/dist/errors.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The one error taxonomy for `@byok-sdk/cloud`.
+ *
+ * Same idiom as `@byok-sdk/core`'s `errors.ts`: one class, code-based branching,
+ * so a composition maps failures onto HTTP with a code table instead of an
+ * `instanceof` chain. Cloud does not re-export core's codes — a cloud error is
+ * about the hosted surface (a store contract the composition broke, a
+ * declaration the host mis-configured), and core errors travel up unchanged.
+ */
+export declare const CLOUD_ERROR_CODES: {
+    /** A pairing code that is unknown, expired, or already redeemed (§6.1). */
+    readonly pairing_code_invalid: 'pairing_code_invalid';
+    /** The composition handed a device row whose tenant is not a mintable `TenantId`. */
+    readonly device_tenant_invalid: 'device_tenant_invalid';
+    /**
+     * The mailbox assigned a row `seq` that disagrees with the delivery `seq`
+     * baked into the enqueued envelope. Loud rather than silent: those two
+     * numbers ARE the daemon's redelivery cursor, and a composition whose
+     * mailbox numbers rows differently from `DeviceSequenceStore` would
+     * mis-deliver every subsequent poll.
+     */
+    readonly mailbox_seq_mismatch: 'mailbox_seq_mismatch';
+    /** A capability declaration the host supplied that core refused. */
+    readonly capability_declaration_invalid: 'capability_declaration_invalid';
+    /**
+     * The declaration names a capability this composition cannot serve, so the
+     * deployment would publish a surface it does not have (ADR-010).
+     *
+     * Construction-time and fatal. A client learns what a deployment supports by
+     * READING the declaration and is entitled to act on it without probing, so a
+     * declaration that over-states is not a degraded deployment — it is a
+     * deployment whose one honest interface lies.
+     */
+    readonly capability_over_declared: 'capability_over_declared';
+    /** Host-supplied board labels or coordination input exceeded the explicit contract. */
+    readonly coordination_input_invalid: 'coordination_input_invalid';
+    /** A progress/activity batch exceeded the configured event or byte ceiling. */
+    readonly activity_batch_too_large: 'activity_batch_too_large';
+};
+export type CloudErrorCode = (typeof CLOUD_ERROR_CODES)[keyof typeof CLOUD_ERROR_CODES];
+export declare class ByokCloudError extends Error {
+    readonly code: CloudErrorCode;
+    constructor(code: CloudErrorCode, message: string, options?: ErrorOptions);
+}
+export declare function isCloudError(value: unknown, code?: CloudErrorCode): value is ByokCloudError;

package/dist/handlers/auth.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Auth v2 (docs/protocol.md §6): pair, challenge, token.
+ *
+ * Byte-for-byte the same request/response DTOs the daemon already speaks,
+ * because they come from `@byok-sdk/protocol` rather than from a hosted copy of
+ * them. The behavior differences a hosted surface DOES make are two, both
+ * narrowing:
+ *
+ * - a pairing code that is unknown, expired, or already used gets one 401 with
+ *   one message (the reference server names the reason);
+ * - an unknown device and a revoked device were already indistinguishable on
+ *   the reference server, and stay so here.
+ */
+import type { Context } from 'hono';
+import type { AuthPlane } from '../auth/plane';
+export interface AuthRouteDeps {
+    readonly auth: AuthPlane;
+}
+export declare function pairHandler(deps: AuthRouteDeps): (c: Context) => Promise<Response>;
+export declare function challengeHandler(deps: AuthRouteDeps): (c: Context) => Promise<Response>;
+export declare function tokenHandler(deps: AuthRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/blobs.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Blob flows (§7).
+ *
+ * Two route classes on purpose: `POST /byok/blobs` and `GET
+ * /byok/blobs/:id/url` are bearer-authed and therefore tenant-closed (a
+ * download URL is minted only for a blob the caller's own tenant owns, and a
+ * foreign blob is indistinguishable from a missing one); the two `/content`
+ * routes are presigned, because they are meant to be hit directly — by a
+ * browser, by a `PUT` from a daemon that holds only the signed URL — with no
+ * JWT in scope at all. The HMAC signature over the blob id plus its expiry IS
+ * the credential there, which is why those two carry the `presigned` class in
+ * the route inventory rather than being lumped in with the device routes.
+ *
+ * The split runs all the way down: the bearer-authed pair reaches blobs only
+ * through the tenant facade and never holds a naked store, and the presigned
+ * pair holds only a {@link BlobContentProxy} and no bearer deps. A composition
+ * without a proxy does not mount them (`cloud.ts`).
+ */
+import type { Context } from 'hono';
+import type { BlobContentProxy } from '../stores/ports';
+import { type DeviceRouteDeps } from './shared';
+/** The three bearer-authed routes: everything they touch goes through the tenant facade. */
+export interface BlobRouteDeps extends DeviceRouteDeps {
+    readonly maxBlobSizeBytes: number;
+}
+/** Reservation and presign grants deliberately share one expiry horizon. */
+export declare const BLOB_RESERVATION_TTL_MS: number;
+/**
+ * The two presigned routes. No bearer deps at all — there is no principal to
+ * build a facade from, and the proxy is the only thing they need.
+ */
+export interface BlobContentRouteDeps {
+    readonly contentProxy: BlobContentProxy;
+}
+export declare function createBlobHandler(deps: BlobRouteDeps): (c: Context) => Promise<Response>;
+export declare function finalizeBlobHandler(deps: BlobRouteDeps): (c: Context) => Promise<Response>;
+export declare function blobDownloadUrlHandler(deps: BlobRouteDeps): (c: Context) => Promise<Response>;
+export declare function blobUploadContentHandler(deps: BlobContentRouteDeps): (c: Context) => Promise<Response>;
+export declare function blobDownloadContentHandler(deps: BlobContentRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/board.d.ts

@@ -0,0 +1,21 @@
+import { type BoardPage } from '@byok-sdk/core';
+import type { Context } from 'hono';
+import { type DeviceRouteDeps } from './shared';
+export declare const DEFAULT_BOARD_PAGE_LIMIT = 50;
+export declare const DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS = 5000;
+export declare const DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS = 15000;
+export declare const DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS = 120000;
+export interface BoardRouteDeps extends DeviceRouteDeps {
+    readonly pageLimit: number;
+}
+export interface BoardStreamRouteDeps extends BoardRouteDeps {
+    readonly queryIntervalMs: number;
+    readonly heartbeatIntervalMs: number;
+    readonly reconciliationIntervalMs: number;
+}
+export declare function boardListHandler(deps: BoardRouteDeps): (c: Context) => Promise<Response>;
+export declare function boardClaimHandler(deps: DeviceRouteDeps): (c: Context) => Promise<Response>;
+export declare function boardUnclaimHandler(deps: DeviceRouteDeps): (c: Context) => Promise<Response>;
+export declare function boardStatusHandler(deps: DeviceRouteDeps): (c: Context) => Promise<Response>;
+export declare function boardStreamHandler(deps: BoardStreamRouteDeps): (c: Context) => Promise<Response>;
+export type BoardPollResponse = BoardPage;

package/dist/handlers/capabilities.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `GET /byok/capabilities` — the declaration route (ADR-010).
+ *
+ * Public by design: a client has to be able to read what a deployment supports
+ * before it holds a credential, and the declaration is a deployment-level
+ * fact, not a tenant-level one. Nothing tenant-scoped may ever be added to
+ * this response for exactly that reason.
+ */
+import type { Context } from 'hono';
+import type { CapabilityDeclaration } from '@byok-sdk/core';
+export interface CapabilitiesRouteDeps {
+    readonly declaration: CapabilityDeclaration;
+}
+export declare function capabilitiesHandler(deps: CapabilitiesRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/events.d.ts

@@ -0,0 +1,33 @@
+/**
+ * `GET /byok/events?cursor=N` — the long-poll receive half (§8).
+ *
+ * Three properties the daemon's transport depends on, reproduced against the
+ * core mailbox rather than an in-process outbox:
+ *
+ * - **Reading is not acknowledging.** `readAfter` never moves the cursor. The
+ *   ONLY ack is the cursor the daemon brings back on its NEXT poll, after it
+ *   has durably processed what it was handed — which is why the ack below
+ *   happens before the read, against the incoming `cursor`, and why a poll
+ *   that hands back the same cursor replays the same page forever.
+ * - **The ack is monotonic.** A cursor at or below what the device already
+ *   acked carries no new information and is not an ack attempt; only a
+ *   strictly higher one advances. The store's own
+ *   `mailbox_cursor_regression` guard stays the authority on going backwards
+ *   (asserted directly in `src/__tests__/mailbox-cursor.test.ts`).
+ * - **The hold.** An empty poll is held open instead of answered immediately,
+ *   so an idle daemon is not a busy-loop. The hold is a bounded re-read, not a
+ *   registered waiter: a waiter map is exactly the cross-request state a
+ *   stateless handler may not keep (S3.5 boxes 14-15), and a second cloud
+ *   instance would not see it anyway.
+ */
+import type { Context } from 'hono';
+import { type DeviceRouteDeps } from './shared';
+export interface EventsRouteDeps extends DeviceRouteDeps {
+    /** How long an empty poll is held open, ms. */
+    readonly longPollHoldMs: number;
+    /** How often the mailbox is re-read while holding, ms. */
+    readonly longPollIntervalMs: number;
+    /** Max rows per response. */
+    readonly pageLimit: number;
+}
+export declare function eventsHandler(deps: EventsRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/messages.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `POST /byok/messages` — the long-poll send half (§8.2).
+ *
+ * A device long-polling for cloud -> daemon traffic has no live socket to
+ * carry its own outbound envelopes; this batches them over authed HTTP. Every
+ * envelope goes through the same gate (`../inbound.ts`) in the same order, so
+ * claim/progress/complete behave identically no matter which transport carried
+ * them.
+ *
+ * The batch stays tolerant at the schema level — one malformed envelope must
+ * not 400 the whole request — so only a structurally invalid `Envelope` or an
+ * oversized batch (`MAX_MESSAGES_PER_BATCH`) fails the request outright.
+ *
+ * Rate limiting is per REQUEST, not per envelope: the moment any envelope
+ * comes back `rate_limited`, the rest of the batch is abandoned (its bucket is
+ * empty, so every remaining envelope would limit too) and the WHOLE request
+ * answers 429. Envelopes processed earlier in the same batch already took
+ * effect — there are no rollback semantics here — which is safe because every
+ * `task.*` type is idempotent (§9): a client that retries the same batch gets
+ * `duplicate` for whatever already landed.
+ */
+import type { Context } from 'hono';
+import type { ActivityBounds } from '../coordination';
+import { type DeviceRouteDeps } from './shared';
+export interface MessagesRouteDeps extends DeviceRouteDeps {
+    readonly activityBounds: ActivityBounds;
+}
+export declare function messagesHandler(deps: MessagesRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/presence.d.ts

@@ -0,0 +1,13 @@
+import type { Context } from 'hono';
+import { type ActivityBounds } from '../coordination';
+import { type DeviceRouteDeps } from './shared';
+export interface PresenceRouteDeps extends DeviceRouteDeps {
+    readonly ttlMs: number;
+    readonly minimumIntervalMs: number;
+    readonly detailMaxBytes: number;
+}
+export interface ActivityRouteDeps extends DeviceRouteDeps {
+    readonly bounds: ActivityBounds;
+}
+export declare function presencePublishHandler(deps: PresenceRouteDeps): (c: Context) => Promise<Response>;
+export declare function activityAppendHandler(deps: ActivityRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/shared.d.ts

@@ -0,0 +1,30 @@
+/**
+ * The two things every device-facing handler starts from: a tolerant JSON body
+ * read, and the bearer -> principal -> tenant-closed-facade step.
+ *
+ * Once {@link authenticateDevice} has answered, a handler holds a
+ * `TenantStores` and a `DevicePrincipal` and never sees a `TenantId` again.
+ */
+import type { Context } from 'hono';
+import type { DevicePrincipal } from '@byok-sdk/core';
+import { type BearerAuthDeps } from '../auth/bearer';
+import { type CloudRootStores, type TenantStores } from '../tenant-stores';
+/** Every error response on this surface is `{ error }` — the same shape the reference server uses. */
+export interface ErrorBody {
+    readonly error: string;
+}
+export declare function readJsonBody(c: Context): Promise<unknown>;
+export interface DeviceRouteDeps {
+    readonly bearer: BearerAuthDeps;
+    readonly root: CloudRootStores;
+}
+export interface AuthenticatedDeviceContext {
+    readonly device: DevicePrincipal;
+    readonly stores: TenantStores;
+}
+/**
+ * `undefined` means "answer 401" — and it means that for a missing header, a
+ * forged token, an expired token, a revoked device, a product mismatch, and a
+ * token whose tenant does not own the device, indistinguishably.
+ */
+export declare function authenticateDevice(c: Context, deps: DeviceRouteDeps): Promise<AuthenticatedDeviceContext | undefined>;

package/dist/handlers/truth.d.ts

@@ -0,0 +1,15 @@
+import type { Context } from 'hono';
+import { type DeviceProofAuthDeps } from '../auth/device-proof';
+import { type TruthCommitter, type TruthObjectDownloads } from '../truth/contract';
+export declare const DEVICE_PROOF_HEADER = "x-byok-device-proof";
+export declare const DEFAULT_MAX_TRUTH_REQUEST_BYTES: number;
+export declare const MAX_DEVICE_PROOF_HEADER_BYTES: number;
+export interface TruthRouteDeps {
+    readonly proof: DeviceProofAuthDeps;
+    readonly truth: TruthCommitter;
+    readonly objectDownloads: TruthObjectDownloads;
+    readonly maxRequestBytes: number;
+}
+export declare function truthManifestHandler(deps: TruthRouteDeps): (c: Context) => Promise<Response>;
+export declare function truthGetHandler(deps: TruthRouteDeps): (c: Context) => Promise<Response>;
+export declare function truthPutHandler(deps: TruthRouteDeps): (c: Context) => Promise<Response>;

package/dist/inbound.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The single inbound choke point for every daemon -> cloud envelope.
+ *
+ * The reference server runs this gate inside a live `ConnectionHub`; here it
+ * is a pure function over a tenant-closed facade, so the same order holds with
+ * no connection, no session, and no cross-request state:
+ *
+ * 0. **rate limit** — one token per inbound envelope, debited BEFORE anything
+ *    else, so a flood of garbage-typed envelopes costs the same budget as a
+ *    flood of well-formed ones. S3a's reference limiter allows everything; the
+ *    seam is what matters at this position.
+ * 1. **type-allow** — only `DAEMON_TO_SERVER_TYPES` may pass. A server ->
+ *    daemon type arriving inbound, or anything unrecognized, is rejected
+ *    before it is dispatched or counted accepted.
+ * 2. **ownership** — an envelope for a task already owned by a DIFFERENT
+ *    device is dropped, never force-failed: force-failing on an authz mismatch
+ *    would let an attacker who merely guesses a `taskId` kill the real owner's
+ *    task. A task with no owner yet, or that this tenant does not have at all,
+ *    is not rejected here — the store's own no-op-on-missing behavior covers
+ *    the latter, and it covers it per tenant, so a guessed id from another
+ *    tenant writes nothing anywhere.
+ * 3. **dedup** — an envelope id already seen from this device is a no-op. The
+ *    wire is at-least-once (§9); this makes processing at-most-once.
+ * 4. **apply** — the lifecycle write.
+ *
+ * A duplicate is still a wire-level success (§8.2): it just did not re-run
+ * anything. Only `rejected`/`rate_limited` are excluded from `accepted`.
+ */
+import { type Envelope } from '@byok-sdk/protocol';
+import { type ActivityBounds } from './coordination';
+import type { TenantStores } from './tenant-stores';
+export type InboundOutcome = 'accepted' | 'duplicate' | 'rejected' | 'rate_limited';
+/** Receipt key a task's terminal is recorded under — the idempotency seam S3b's journal will share. */
+export declare function terminalReceiptKey(taskId: string): string;
+export declare function handleInboundEnvelope(stores: TenantStores, deviceId: string, envelope: Envelope, activityBounds?: ActivityBounds): Promise<InboundOutcome>;

package/dist/index.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `@byok-sdk/cloud` — the hosted device surface.
+ *
+ * Cloud sits BESIDE `@byok-sdk/server`, not above it (§12.1): `cloud → core +
+ * protocol`, and never `cloud → server`. The self-hosted embedded coordinator
+ * stays the self-hosted option; this package serves the same frozen v1 device
+ * wire contract statelessly, over `@byok-sdk/core` ports plus the cloud-local auth
+ * and task ports in `stores/ports.ts`.
+ *
+ * `src/__tests__/constraints.test.ts` asserts the properties this export list
+ * implies: no `@byok-sdk/server` import, no `node:` import, no module-level
+ * mutable state, no session/Running map, and no route mounted outside the I1
+ * registry.
+ */
+export { isTenantId, tenantId } from '@byok-sdk/core';
+export type { TenantId } from '@byok-sdk/core';
+export { createByokCloud } from './cloud';
+export type { ByokCloud, ByokCloudOptions, EnqueueOfferInput, EnqueuedOffer } from './cloud';
+export { DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, } from './cloud';
+export { DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, } from './handlers/board';
+export { createInMemoryByokCloud } from './composition/in-memory';
+export type { InMemoryByokCloud, InMemoryByokCloudOptions } from './composition/in-memory';
+export { ByokCloudError, CLOUD_ERROR_CODES, isCloudError } from './errors';
+export type { CloudErrorCode } from './errors';
+export { CLOUD_CAPABILITIES, CapabilitiesResponseSchema, declares, fullCapabilityDeclaration, } from './capabilities';
+export type { CapabilitiesResponse, CloudCapability, FullCapabilityDeclarationOptions, } from './capabilities';
+export { CloudRouteRegistry, ROUTE_CLASSES, ROUTE_METHODS, routeKey } from './router/registry';
+export type { CloudRouteHandler, RouteClass, RouteDescriptor, RouteMethod } from './router/registry';
+export { ACCESS_TOKEN_TTL_SECONDS, createHmacTokenSigner } from './auth/tokens';
+export type { AccessTokenClaims, TokenSigner } from './auth/tokens';
+export { NONCE_SIGNING_DOMAIN, verifyNonceSignature } from './auth/verify';
+export { authenticateBearer, extractBearerToken } from './auth/bearer';
+export type { BearerAuthDeps } from './auth/bearer';
+export { DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, authenticateDeviceProof, } from './auth/device-proof';
+export type { AuthenticatedDeviceProof, DeviceProofAuthDeps, DeviceProofRequestBinding, } from './auth/device-proof';
+export { DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, PAIRING_CODE_TTL_MS, createAuthPlane, } from './auth/plane';
+export type { AuthPlane, AuthPlaneDeps, MintedAccessToken, PairInput } from './auth/plane';
+export { createWebCrypto } from './crypto/web-crypto';
+export type { CloudCrypto } from './crypto/port';
+export { handleInboundEnvelope, terminalReceiptKey } from './inbound';
+export type { InboundOutcome } from './inbound';
+export { tenantStoresFor } from './tenant-stores';
+export type { TenantBoundActivity, TenantBoundBoard, CloudRootStores, TenantBoundBlobs, TenantBoundDedup, TenantBoundDevices, TenantBoundMailbox, TenantBoundPresence, TenantBoundQuota, TenantBoundRateLimiter, TenantBoundReceipts, TenantBoundSequence, TenantBoundTaskAttempts, TenantStores, } from './tenant-stores';
+export { DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, } from './coordination';
+export type { ActivityBounds } from './coordination';
+export { BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError } from './coordination-client';
+export type { BoardFeedClientOptions, BoardFeedItem, BoardFeedMode, BoardFeedPage, BoardFeedRead, } from './coordination-client';
+export { TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TruthBodyInputSchema, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, truthManifestMetadata, truthRecordMetadata, } from './truth/contract';
+export { DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEVICE_PROOF_HEADER, MAX_DEVICE_PROOF_HEADER_BYTES, } from './handlers/truth';
+export type { PreparedTruthWrite, TruthBodyInput, TruthCommitInput, TruthCommitResponse, TruthCommitResult, TruthCommitter, TruthObjectDownloads, TruthRecordMetadata, TruthWriteRequest, } from './truth/contract';
+export { TruthCommitError, isTruthCommitError } from './truth/errors';
+export type { TruthCommitErrorCode } from './truth/errors';
+export { CLOUD_STORE_NAMES, TASK_ATTEMPT_STATUSES } from './stores/ports';
+export { CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS } from './stores/ports-contract';
+export type { BlobContent, BlobContentProxy, BlobDeclaration, BlobObservation, BlobWriteResult, CloudBlobStore, CloudStoreName, CloudStores, DeviceDirectory, DeviceRecord, DeviceRegistration, DeviceSequenceStore, InboundDedupStore, InboundRateLimiter, NonceStore, PairingCodeClaims, PairingCodeInfo, PairingCodeIssueInput, PairingCodeStore, ProofRequestReceipt, ProofRequestReceiptInput, ProofRequestReceiptStore, RequestReceipt, RequestReceiptStore, TaskAttempt, TaskAttemptStatus, TaskAttemptStore, } from './stores/ports';
+export { AllowAllRateLimiter, BLOB_URL_TTL_MS, DEDUP_RING_CAPACITY, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryDeviceSequenceStore, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryRequestReceiptStore, InMemoryProofRequestReceiptStore, InMemoryTaskAttemptStore, NONCE_TTL_MS, createInMemoryBlobs, createInMemoryCloudStores, } from './stores/in-memory/index';
+export type { InMemoryBlobStoreOptions, InMemoryBlobs, InMemoryCloudComposition, } from './stores/in-memory/index';