@byok-sdk/cloud 0.1.0

package/dist/index.js

@@ -0,0 +1,2419 @@
+import { BOARD_STATUSES, PRESENCE_LEVELS, CapabilityDeclarationSchema, hasCapability, isTenantId, tenantId, principalTenant, parseDeviceProofEnvelope, deviceProofSigningInput, contentHash, parseCapabilityDeclaration, ByokCoreError, tenantKey, createInMemoryCoreStores, assertCapability, isCoreConflictError, isCoreError, TRUTH_RECORD_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS } from '@byok-sdk/core';
+export { isTenantId, tenantId } from '@byok-sdk/core';
+import { AgentEventOrUnknownSchema, DAEMON_TO_SERVER_TYPES, encodeEnvelope, createEnvelope, PairRequestSchema, ChallengeRequestSchema, TokenRequestSchema, decodeEnvelope, MessagesSendRequestSchema, CreateBlobRequestSchema } from '@byok-sdk/protocol';
+import { z } from 'zod';
+import { Hono } from 'hono';
+
+// src/index.ts
+
+// src/crypto/web-crypto.ts
+var PAIRING_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
+var HEX_DIGITS = "0123456789abcdef";
+function base64UrlEncode(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function base64UrlDecode(value) {
+  const padded = value.replaceAll("-", "+").replaceAll("_", "/");
+  try {
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.charCodeAt(index);
+    return bytes;
+  } catch {
+    return void 0;
+  }
+}
+function toHex(bytes) {
+  let out = "";
+  for (const byte of bytes) {
+    out += HEX_DIGITS[byte >> 4 & 15];
+    out += HEX_DIGITS[byte & 15];
+  }
+  return out;
+}
+function subtle() {
+  const webCrypto = globalThis.crypto;
+  if (webCrypto?.subtle === void 0) {
+    throw new Error("@byok-sdk/cloud requires a WebCrypto implementation on globalThis.crypto");
+  }
+  return webCrypto.subtle;
+}
+function createWebCrypto() {
+  return {
+    randomUuid() {
+      return globalThis.crypto.randomUUID();
+    },
+    randomToken(byteLength) {
+      return base64UrlEncode(globalThis.crypto.getRandomValues(new Uint8Array(byteLength)));
+    },
+    randomPairingCode(length) {
+      const bytes = globalThis.crypto.getRandomValues(new Uint8Array(length));
+      let out = "";
+      for (const byte of bytes) {
+        out += PAIRING_CODE_ALPHABET[byte % PAIRING_CODE_ALPHABET.length];
+      }
+      return out;
+    },
+    async verifyEd25519(publicKeyBase64Url, message, signature) {
+      const signatureBytes = base64UrlDecode(signature);
+      if (signatureBytes === void 0) return false;
+      try {
+        const key = await subtle().importKey(
+          "jwk",
+          { kty: "OKP", crv: "Ed25519", x: publicKeyBase64Url },
+          { name: "Ed25519" },
+          false,
+          ["verify"]
+        );
+        const messageBytes = typeof message === "string" ? new TextEncoder().encode(message) : message;
+        return await subtle().verify({ name: "Ed25519" }, key, signatureBytes, messageBytes);
+      } catch {
+        return false;
+      }
+    },
+    async hmacSha256(secret, message) {
+      const key = await subtle().importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+      const signature = await subtle().sign("HMAC", key, new TextEncoder().encode(message));
+      return base64UrlEncode(new Uint8Array(signature));
+    },
+    async sha256(data) {
+      const digest = await subtle().digest("SHA-256", data);
+      return `sha256:${toHex(new Uint8Array(digest))}`;
+    },
+    timingSafeEqual(left, right) {
+      const leftBytes = base64UrlDecode(left);
+      const rightBytes = base64UrlDecode(right);
+      if (leftBytes === void 0 || rightBytes === void 0) return false;
+      if (leftBytes.length !== rightBytes.length) return false;
+      let diff = 0;
+      for (let index = 0; index < leftBytes.length; index += 1) {
+        diff |= (leftBytes[index] ?? 0) ^ (rightBytes[index] ?? 0);
+      }
+      return diff === 0;
+    }
+  };
+}
+
+// src/auth/tokens.ts
+var ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
+function encodeSegment(value) {
+  return base64UrlEncode(new TextEncoder().encode(JSON.stringify(value)));
+}
+function createHmacTokenSigner(secret, clock) {
+  async function signingKey(usage) {
+    return globalThis.crypto.subtle.importKey("raw", secret, { name: "HMAC", hash: "SHA-256" }, false, [usage]);
+  }
+  async function signature(signingInput) {
+    const key = await signingKey("sign");
+    const bytes = await globalThis.crypto.subtle.sign("HMAC", key, new TextEncoder().encode(signingInput));
+    return base64UrlEncode(new Uint8Array(bytes));
+  }
+  return {
+    async sign(claims, expiresInSeconds) {
+      const issuedAt = Math.floor(clock.now().getTime() / 1e3);
+      const header = encodeSegment({ alg: "HS256", typ: "JWT" });
+      const payload = encodeSegment({
+        deviceId: claims.deviceId,
+        tenantId: claims.tenantId,
+        productId: claims.productId,
+        iat: issuedAt,
+        exp: issuedAt + expiresInSeconds
+      });
+      const signingInput = `${header}.${payload}`;
+      return `${signingInput}.${await signature(signingInput)}`;
+    },
+    async verify(token) {
+      const parts = token.split(".");
+      if (parts.length !== 3) return void 0;
+      const [header, payload, provided] = parts;
+      const key = await signingKey("verify");
+      const providedBytes = base64UrlDecode(provided);
+      if (providedBytes === void 0) return void 0;
+      const ok = await globalThis.crypto.subtle.verify(
+        "HMAC",
+        key,
+        providedBytes,
+        new TextEncoder().encode(`${header}.${payload}`)
+      );
+      if (!ok) return void 0;
+      const headerBytes = base64UrlDecode(header);
+      const payloadBytes = base64UrlDecode(payload);
+      if (headerBytes === void 0 || payloadBytes === void 0) return void 0;
+      let decodedHeader;
+      let decodedPayload;
+      try {
+        decodedHeader = JSON.parse(new TextDecoder().decode(headerBytes));
+        decodedPayload = JSON.parse(new TextDecoder().decode(payloadBytes));
+      } catch {
+        return void 0;
+      }
+      const alg = decodedHeader?.alg;
+      if (alg !== "HS256") return void 0;
+      const { deviceId, tenantId: tenantId4, productId, exp } = decodedPayload;
+      if (typeof deviceId !== "string" || typeof tenantId4 !== "string" || typeof productId !== "string") {
+        return void 0;
+      }
+      if (typeof exp !== "number" || clock.now().getTime() / 1e3 >= exp) return void 0;
+      return { deviceId, tenantId: tenantId4, productId };
+    }
+  };
+}
+
+// src/auth/verify.ts
+var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
+function verifyNonceSignature(crypto, devicePublicKey, nonce, signature) {
+  return crypto.verifyEd25519(devicePublicKey, NONCE_SIGNING_DOMAIN + nonce, signature);
+}
+
+// src/auth/plane.ts
+var PAIRING_CODE_TTL_MS = 10 * 60 * 1e3;
+var PAIRING_CODE_LENGTH = 8;
+var DEVICE_IDENTITY_PROOF_KEY_ID = "identity";
+var DEVICE_IDENTITY_PROOF_KEY_EPOCH = 0;
+function createAuthPlane(deps) {
+  const { stores, crypto, clock, tokenSigner } = deps;
+  const ttlSeconds = deps.accessTokenTtlSeconds ?? ACCESS_TOKEN_TTL_SECONDS;
+  return {
+    async createPairingCode(tenant, input) {
+      const expiresAt = new Date(clock.now().getTime() + (input.ttlMs ?? PAIRING_CODE_TTL_MS)).toISOString();
+      return stores.pairingCodes.issue(tenant, {
+        code: crypto.randomPairingCode(PAIRING_CODE_LENGTH),
+        productId: input.productId,
+        expiresAt
+      });
+    },
+    async redeemAndRegister(input) {
+      const claims = await stores.pairingCodes.redeem(input.pairingCode);
+      if (claims === void 0) return void 0;
+      return stores.devices.register(claims.tenantId, {
+        productId: claims.productId,
+        deviceId: `dev_${crypto.randomUuid()}`,
+        deviceName: input.deviceName,
+        devicePublicKey: input.devicePublicKey,
+        proofKeyId: DEVICE_IDENTITY_PROOF_KEY_ID,
+        proofKeyEpoch: DEVICE_IDENTITY_PROOF_KEY_EPOCH
+      });
+    },
+    async resolveDevice(deviceId) {
+      const device = await stores.devices.resolveByDeviceId(deviceId);
+      if (device === void 0 || device.revoked) return void 0;
+      return device;
+    },
+    issueNonce(device) {
+      return stores.nonces.issue(device.tenantId, device.deviceId);
+    },
+    validateNonce(device, nonce) {
+      return stores.nonces.validate(device.tenantId, device.deviceId, nonce);
+    },
+    consumeNonce(device, nonce) {
+      return stores.nonces.markUsed(device.tenantId, nonce);
+    },
+    verifySignature(device, nonce, signature) {
+      return verifyNonceSignature(crypto, device.devicePublicKey, nonce, signature);
+    },
+    async mintAccessToken(device) {
+      const accessToken = await tokenSigner.sign(
+        { deviceId: device.deviceId, tenantId: device.tenantId, productId: device.productId },
+        ttlSeconds
+      );
+      return {
+        accessToken,
+        expiresAt: new Date(clock.now().getTime() + ttlSeconds * 1e3).toISOString()
+      };
+    }
+  };
+}
+var CLOUD_CAPABILITIES = {
+  /** `GET /byok/events` long-poll receive (§8). */
+  eventsLongPoll: "events.longpoll",
+  /** `POST /byok/messages` batched send (§8.2). */
+  messagesBatch: "messages.batch",
+  /** The three bearer-authed blob routes: reserve/grant, explicit finalize, committed-only download (§7). */
+  blobsPresigned: "blobs.presigned",
+  /**
+   * The two presigned `/byok/blobs/:id/content` routes — cloud carrying the
+   * bytes itself.
+   *
+   * Split out of `blobs.presigned` because it was one capability describing two
+   * separable facts. A composition whose bytes live in object storage mints
+   * grants (`blobs.presigned`) but has no byte-proxy path at all, and saying so
+   * by declaration is ADR-010's whole posture: a client reads what a deployment
+   * serves, it never probes a `/content` route and interprets the status code.
+   *
+   * Spelled all-lowercase because core's declaration schema pins capability
+   * names to `/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/` — the same reason the sibling
+   * above reads `events.longpoll` and not `events.longPoll`.
+   */
+  blobsContentProxy: "blobs.contentproxy",
+  /** Board list/claim/unclaim/status routes. Polling is first-class under this declaration. */
+  boardCoordination: "board.coordination",
+  /** Additional SSE transport for the same board read model. */
+  boardSse: "board.sse",
+  /** Device-scoped five-level presence publication. */
+  presenceHints: "presence.hints",
+  /** Bounded task activity batch publication. */
+  activityTail: "activity.tail",
+  /** Request-bound device proof record manifest/read/write surface (S6). */
+  truthRecords: "truth.records"
+};
+var CapabilitiesResponseSchema = CapabilityDeclarationSchema;
+function fullCapabilityDeclaration(version = 1, options = {}) {
+  return {
+    schema: "byok-capabilities-v1",
+    version,
+    capabilities: Object.values(CLOUD_CAPABILITIES).filter(
+      (capability) => capability !== CLOUD_CAPABILITIES.truthRecords || options.includeTruthRecords === true
+    )
+  };
+}
+function declares(declaration, capability) {
+  return hasCapability(declaration, capability);
+}
+
+// src/errors.ts
+var CLOUD_ERROR_CODES = {
+  /** A pairing code that is unknown, expired, or already redeemed (§6.1). */
+  pairing_code_invalid: "pairing_code_invalid",
+  /** The composition handed a device row whose tenant is not a mintable `TenantId`. */
+  device_tenant_invalid: "device_tenant_invalid",
+  /**
+   * The mailbox assigned a row `seq` that disagrees with the delivery `seq`
+   * baked into the enqueued envelope. Loud rather than silent: those two
+   * numbers ARE the daemon's redelivery cursor, and a composition whose
+   * mailbox numbers rows differently from `DeviceSequenceStore` would
+   * mis-deliver every subsequent poll.
+   */
+  mailbox_seq_mismatch: "mailbox_seq_mismatch",
+  /** A capability declaration the host supplied that core refused. */
+  capability_declaration_invalid: "capability_declaration_invalid",
+  /**
+   * The declaration names a capability this composition cannot serve, so the
+   * deployment would publish a surface it does not have (ADR-010).
+   *
+   * Construction-time and fatal. A client learns what a deployment supports by
+   * READING the declaration and is entitled to act on it without probing, so a
+   * declaration that over-states is not a degraded deployment — it is a
+   * deployment whose one honest interface lies.
+   */
+  capability_over_declared: "capability_over_declared",
+  /** Host-supplied board labels or coordination input exceeded the explicit contract. */
+  coordination_input_invalid: "coordination_input_invalid",
+  /** A progress/activity batch exceeded the configured event or byte ceiling. */
+  activity_batch_too_large: "activity_batch_too_large"
+};
+var ByokCloudError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "ByokCloudError";
+    this.code = code;
+  }
+};
+function isCloudError(value, code) {
+  if (!(value instanceof ByokCloudError)) return false;
+  return code === void 0 || value.code === code;
+}
+
+// src/coordination.ts
+var DEFAULT_BOARD_CHANNEL_MAX_BYTES = 128;
+var DEFAULT_BOARD_TITLE_MAX_BYTES = 512;
+var DEFAULT_ACTIVITY_MAX_EVENTS = 50;
+var DEFAULT_ACTIVITY_MAX_BYTES = 64 * 1024;
+var DEFAULT_ACTIVITY_CAPACITY = 50;
+var DEFAULT_ACTIVITY_TTL_MS = 10 * 6e4;
+var DEFAULT_PRESENCE_TTL_MS = 9e4;
+var DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS = 5e3;
+var DEFAULT_PRESENCE_DETAIL_MAX_BYTES = 512;
+var encoder = new TextEncoder();
+var DEFAULT_ACTIVITY_BOUNDS = {
+  maxEvents: DEFAULT_ACTIVITY_MAX_EVENTS,
+  maxBytes: DEFAULT_ACTIVITY_MAX_BYTES,
+  capacity: DEFAULT_ACTIVITY_CAPACITY,
+  ttlMs: DEFAULT_ACTIVITY_TTL_MS
+};
+function assertBoardLabels(channel, title, limits) {
+  if (channel.length === 0 || encoder.encode(channel).length > limits.channelMaxBytes) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Board channel must contain 1..${limits.channelMaxBytes} UTF-8 bytes.`
+    );
+  }
+  if (title.length === 0 || encoder.encode(title).length > limits.titleMaxBytes) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Board title must contain 1..${limits.titleMaxBytes} UTF-8 bytes.`
+    );
+  }
+}
+function activityDetails(events, dropped, bounds) {
+  if (!Number.isSafeInteger(dropped) || dropped < 0) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      "Activity dropped must be a non-negative integer."
+    );
+  }
+  if (events.length === 0 || events.length > bounds.maxEvents) {
+    throw new ByokCloudError(
+      "activity_batch_too_large",
+      `Activity batch must contain 1..${bounds.maxEvents} events.`
+    );
+  }
+  const encoded = JSON.stringify(events);
+  if (encoder.encode(encoded).length > bounds.maxBytes) {
+    throw new ByokCloudError(
+      "activity_batch_too_large",
+      `Activity batch exceeds ${bounds.maxBytes} UTF-8 bytes.`
+    );
+  }
+  return events.map((event) => JSON.stringify(event));
+}
+async function appendActivityEvents(activity, input, bounds) {
+  return activity.append({
+    taskId: input.taskId,
+    details: activityDetails(input.events, input.dropped, bounds),
+    dropped: input.dropped,
+    ttlMs: bounds.ttlMs,
+    capacity: bounds.capacity
+  });
+}
+function extractBearerToken(header) {
+  if (header === void 0) return void 0;
+  const match = /^Bearer\s+(.+)$/i.exec(header);
+  return match?.[1];
+}
+async function authenticateBearer(header, deps) {
+  const token = extractBearerToken(header);
+  if (token === void 0) return void 0;
+  const claims = await deps.tokenSigner.verify(token);
+  if (claims === void 0) return void 0;
+  if (!isTenantId(claims.tenantId)) return void 0;
+  const device = await deps.devices.get(tenantId(claims.tenantId), claims.deviceId);
+  if (device === void 0 || device.revoked) return void 0;
+  if (device.productId !== claims.productId) return void 0;
+  return {
+    kind: "device",
+    tenantId: device.tenantId,
+    productId: device.productId,
+    deviceId: device.deviceId
+  };
+}
+function tenantStoresFor(principal, root) {
+  const tenant = principalTenant(principal);
+  const { core, cloud } = root;
+  return {
+    tenant,
+    principal,
+    mailbox: {
+      append: (input) => core.mailbox.append(tenant, input),
+      readAfter: (query) => core.mailbox.readAfter(tenant, query),
+      advanceCursor: (input) => core.mailbox.advanceCursor(tenant, input),
+      readCursor: (deviceId) => core.mailbox.readCursor(tenant, deviceId)
+    },
+    board: {
+      create: (input) => core.board.create(tenant, input),
+      get: (itemId) => core.board.get(tenant, itemId),
+      list: (query) => core.board.list(tenant, query),
+      claim: (input) => core.board.claim(tenant, input),
+      unclaim: (input) => core.board.unclaim(tenant, input),
+      updateStatus: (input) => core.board.updateStatus(tenant, input)
+    },
+    presence: {
+      publish: (input) => core.presence.publish(tenant, input),
+      read: (deviceId) => core.presence.read(tenant, deviceId),
+      list: () => core.presence.list(tenant)
+    },
+    activity: {
+      append: (input) => core.activity.append(tenant, input),
+      read: (taskId) => core.activity.read(tenant, taskId)
+    },
+    devices: {
+      get: (deviceId) => cloud.devices.get(tenant, deviceId),
+      list: () => cloud.devices.list(tenant),
+      revoke: (deviceId) => cloud.devices.revoke(tenant, deviceId)
+    },
+    tasks: {
+      open: (input) => cloud.tasks.open(tenant, input),
+      get: (taskId) => cloud.tasks.get(tenant, taskId),
+      claim: (input) => cloud.tasks.claim(tenant, input),
+      recordStatus: (input) => cloud.tasks.recordStatus(tenant, input)
+    },
+    dedup: {
+      checkAndRecord: (deviceId, envelopeId) => cloud.dedup.checkAndRecord(tenant, deviceId, envelopeId)
+    },
+    receipts: {
+      record: (input) => cloud.receipts.record(tenant, input),
+      get: (key) => cloud.receipts.get(tenant, key)
+    },
+    blobs: {
+      createUpload: (reservation) => cloud.blobs.createUpload(tenant, reservation),
+      observeUpload: (blobId, reservation) => cloud.blobs.observeUpload(tenant, blobId, reservation),
+      getDownloadUrl: (blobId) => cloud.blobs.getDownloadUrl(tenant, blobId)
+    },
+    quota: {
+      readReservation: (reservationId) => core.quota.readReservation(tenant, reservationId),
+      reserve: (input) => core.quota.reserve(tenant, input),
+      finalizeReservation: (input) => core.quota.finalizeReservation(tenant, input),
+      abortReservation: (reservationId) => core.quota.abortReservation(tenant, reservationId)
+    },
+    sequence: {
+      next: (deviceId) => cloud.sequence.next(tenant, deviceId)
+    },
+    rateLimiter: {
+      consume: (deviceId) => cloud.rateLimiter.consume(tenant, deviceId)
+    }
+  };
+}
+
+// src/handlers/shared.ts
+async function readJsonBody(c) {
+  try {
+    return await c.req.json();
+  } catch {
+    return void 0;
+  }
+}
+async function authenticateDevice(c, deps) {
+  const device = await authenticateBearer(c.req.header("authorization"), deps.bearer);
+  if (device === void 0) return void 0;
+  return { device, stores: tenantStoresFor(device, deps.root) };
+}
+
+// src/handlers/blobs.ts
+var BLOB_RESERVATION_TTL_MS = 15 * 60 * 1e3;
+var SignedUrlQuerySchema = z.object({
+  sig: z.string().min(1),
+  exp: z.coerce.number().finite()
+});
+function createBlobHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const parsed = CreateBlobRequestSchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "size, contentType, and contentHash are required" }, 400);
+    if (parsed.data.size > deps.maxBlobSizeBytes) {
+      return c.json({ error: `blob exceeds max size of ${deps.maxBlobSizeBytes} bytes` }, 413);
+    }
+    const reservationId = idempotencyKey(c);
+    if (reservationId === void 0) {
+      return c.json({ error: "Idempotency-Key header is required" }, 400);
+    }
+    try {
+      const reservation = await authenticated.stores.quota.reserve({
+        reservationId,
+        kind: "object",
+        expectedBytes: BigInt(parsed.data.size),
+        contentHash: contentHash(parsed.data.contentHash),
+        contentType: parsed.data.contentType,
+        ttlMs: BLOB_RESERVATION_TTL_MS
+      });
+      try {
+        const { blobId, uploadUrl } = await authenticated.stores.blobs.createUpload(reservation);
+        const response = { blobId, uploadUrl };
+        return c.json(response, 200);
+      } catch (error) {
+        await authenticated.stores.quota.abortReservation(reservationId).catch(() => void 0);
+        const rendered = renderStorageError(c, error);
+        if (rendered !== void 0) return rendered;
+        throw error;
+      }
+    } catch (error) {
+      const rendered = renderStorageError(c, error);
+      if (rendered !== void 0) return rendered;
+      throw error;
+    }
+  };
+}
+function finalizeBlobHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const reservationId = idempotencyKey(c);
+    if (reservationId === void 0) {
+      return c.json({ error: "Idempotency-Key header is required" }, 400);
+    }
+    try {
+      const reservation = await authenticated.stores.quota.readReservation(reservationId);
+      if (reservation === void 0) {
+        return c.json({ error: "storage_reservation_not_found" }, 404);
+      }
+      const blobId = c.req.param("id") ?? "";
+      const observed = await authenticated.stores.blobs.observeUpload(
+        blobId,
+        reservation
+      );
+      if (observed === void 0) {
+        await authenticated.stores.quota.abortReservation(reservationId);
+        return c.json({ error: "storage_integrity_mismatch" }, 422);
+      }
+      await authenticated.stores.quota.finalizeReservation({
+        reservationId,
+        ...observed
+      });
+      return c.body(null, 204);
+    } catch (error) {
+      const rendered = renderStorageError(c, error);
+      if (rendered !== void 0) return rendered;
+      throw error;
+    }
+  };
+}
+function blobDownloadUrlHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const downloadUrl = await authenticated.stores.blobs.getDownloadUrl(c.req.param("id") ?? "");
+    if (downloadUrl === void 0) return c.json({ error: "blob not found" }, 404);
+    const response = { downloadUrl };
+    return c.json(response, 200);
+  };
+}
+function blobUploadContentHandler(deps) {
+  return async (c) => {
+    const blobId = c.req.param("id") ?? "";
+    const query = SignedUrlQuerySchema.safeParse({ sig: c.req.query("sig"), exp: c.req.query("exp") });
+    if (!query.success || !await deps.contentProxy.verifySignedUrl(blobId, "put", query.data.sig, query.data.exp)) {
+      return c.json({ error: "invalid or expired signature" }, 401);
+    }
+    const result = await deps.contentProxy.writeContent(blobId, new Uint8Array(await c.req.arrayBuffer()));
+    if (!result.ok) return c.json({ error: result.reason }, 422);
+    return c.body(null, 204);
+  };
+}
+function blobDownloadContentHandler(deps) {
+  return async (c) => {
+    const blobId = c.req.param("id") ?? "";
+    const query = SignedUrlQuerySchema.safeParse({ sig: c.req.query("sig"), exp: c.req.query("exp") });
+    if (!query.success || !await deps.contentProxy.verifySignedUrl(blobId, "get", query.data.sig, query.data.exp)) {
+      return c.json({ error: "invalid or expired signature" }, 401);
+    }
+    const content = await deps.contentProxy.readContent(blobId);
+    if (content === void 0) return c.json({ error: "blob not found" }, 404);
+    return c.body(new Uint8Array(content.data), 200, { "content-type": content.contentType });
+  };
+}
+function idempotencyKey(c) {
+  const value = c.req.header("Idempotency-Key");
+  if (value === void 0 || value.length === 0 || value.length > 200) return void 0;
+  return value;
+}
+function renderStorageError(c, error) {
+  if (!isCoreError(error)) return void 0;
+  if (STORAGE_ERROR_CODES.includes(error.code)) {
+    const code = error.code;
+    return c.json({ error: code }, STORAGE_ERROR_HTTP_STATUS[code]);
+  }
+  if (error.code === "storage_reservation_not_found" || error.code === "object_not_found") {
+    return c.json({ error: error.code }, 404);
+  }
+  if (error.code === "storage_entitlement_missing" || error.code === "object_state_invalid") {
+    return c.json({ error: error.code }, 409);
+  }
+  if (error.code === "content_hash_invalid") {
+    return c.json({ error: error.code }, 400);
+  }
+  return void 0;
+}
+
+// src/handlers/capabilities.ts
+function capabilitiesHandler(deps) {
+  return async (c) => c.json(deps.declaration, 200);
+}
+function pairHandler(deps) {
+  return async (c) => {
+    const parsed = PairRequestSchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) {
+      return c.json({ error: "pairingCode, deviceName, and devicePublicKey are required strings" }, 400);
+    }
+    const device = await deps.auth.redeemAndRegister(parsed.data);
+    if (device === void 0) return c.json({ error: "invalid pairing code" }, 401);
+    const { accessToken, expiresAt } = await deps.auth.mintAccessToken(device);
+    const response = { deviceId: device.deviceId, accessToken, refreshHint: expiresAt };
+    return c.json(response, 200);
+  };
+}
+function challengeHandler(deps) {
+  return async (c) => {
+    const parsed = ChallengeRequestSchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "deviceId is required" }, 400);
+    const device = await deps.auth.resolveDevice(parsed.data.deviceId);
+    if (device === void 0) return c.json({ error: "unknown or revoked device" }, 401);
+    const response = { nonce: await deps.auth.issueNonce(device) };
+    return c.json(response, 200);
+  };
+}
+function tokenHandler(deps) {
+  return async (c) => {
+    const parsed = TokenRequestSchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "deviceId, nonce, and signature are required" }, 400);
+    const { deviceId, nonce, signature } = parsed.data;
+    const device = await deps.auth.resolveDevice(deviceId);
+    if (device === void 0) return c.json({ error: "unknown or revoked device" }, 401);
+    if (!await deps.auth.validateNonce(device, nonce)) {
+      return c.json({ error: "invalid, expired, or already-used nonce" }, 401);
+    }
+    if (!await deps.auth.verifySignature(device, nonce, signature)) {
+      return c.json({ error: "invalid signature" }, 401);
+    }
+    await deps.auth.consumeNonce(device, nonce);
+    const { accessToken, expiresAt } = await deps.auth.mintAccessToken(device);
+    const response = { accessToken, expiresAt };
+    return c.json(response, 200);
+  };
+}
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function eventsHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const { device, stores } = authenticated;
+    const cursorRaw = c.req.query("cursor");
+    let cursor = 0;
+    if (cursorRaw !== void 0) {
+      const parsedCursor = Number(cursorRaw);
+      if (!Number.isInteger(parsedCursor) || parsedCursor < 0) return c.json({ error: "invalid cursor" }, 400);
+      cursor = parsedCursor;
+    }
+    const acked = await stores.mailbox.readCursor(device.deviceId);
+    if (cursor > acked.ackedSeq) {
+      await stores.mailbox.advanceCursor({ deviceId: device.deviceId, ackedSeq: cursor });
+    }
+    const attempts = Math.max(1, Math.ceil(deps.longPollHoldMs / deps.longPollIntervalMs));
+    for (let attempt = 0; attempt < attempts; attempt += 1) {
+      const page = await stores.mailbox.readAfter({
+        deviceId: device.deviceId,
+        afterSeq: cursor,
+        limit: deps.pageLimit
+      });
+      if (page.messages.length > 0) {
+        const events = page.messages.map((message) => decodeEnvelope(message.body));
+        const response2 = { events, cursor: page.nextSeq };
+        return c.json(response2, 200);
+      }
+      if (attempt < attempts - 1) await sleep(deps.longPollIntervalMs);
+    }
+    const response = { events: [], cursor };
+    return c.json(response, 200);
+  };
+}
+async function projectTerminalToReview(board, taskId) {
+  const item = await board.get(taskId);
+  if (item === void 0 || item.status !== "in_progress") return;
+  try {
+    await board.updateStatus({
+      itemId: taskId,
+      expectedStatus: "in_progress",
+      status: "in_review"
+    });
+  } catch (caught) {
+    if (isCoreConflictError(caught)) return;
+    throw caught;
+  }
+}
+
+// src/inbound.ts
+function terminalReceiptKey(taskId) {
+  return `task:${taskId}:terminal`;
+}
+async function handleInboundEnvelope(stores, deviceId, envelope, activityBounds = DEFAULT_ACTIVITY_BOUNDS) {
+  if (!await stores.rateLimiter.consume(deviceId)) return "rate_limited";
+  if (!DAEMON_TO_SERVER_TYPES.includes(envelope.type)) return "rejected";
+  const taskId = envelope.task_id;
+  if (taskId === void 0) return "rejected";
+  const attempt = await stores.tasks.get(taskId);
+  if (attempt?.ownerDeviceId !== void 0 && attempt.ownerDeviceId !== deviceId) return "rejected";
+  if (envelope.type === "task.progress" && envelope.payload.events.length > 0) {
+    try {
+      activityDetails(envelope.payload.events, 0, activityBounds);
+    } catch (caught) {
+      if (isCloudError(caught, "activity_batch_too_large") || isCloudError(caught, "coordination_input_invalid")) {
+        return "rejected";
+      }
+      throw caught;
+    }
+  }
+  if (await stores.dedup.checkAndRecord(deviceId, envelope.id)) return "duplicate";
+  await applyLifecycle(stores, deviceId, taskId, envelope, activityBounds);
+  return "accepted";
+}
+async function applyLifecycle(stores, deviceId, taskId, envelope, activityBounds) {
+  switch (envelope.type) {
+    case "task.claim":
+      await stores.tasks.claim({ taskId, deviceId });
+      return;
+    case "task.started":
+      await stores.tasks.recordStatus({ taskId, status: "running" });
+      return;
+    case "task.decline":
+      await stores.tasks.recordStatus({ taskId, status: "failed" });
+      return;
+    case "task.progress":
+      if (envelope.payload.events.length > 0) {
+        await appendActivityEvents(
+          stores.activity,
+          { taskId, events: envelope.payload.events, dropped: 0 },
+          activityBounds
+        );
+      }
+      return;
+    case "task.complete":
+      await recordTerminal(stores, taskId, envelope, "complete");
+      return;
+    case "task.fail":
+      await recordTerminal(stores, taskId, envelope, "failed");
+      return;
+    case "task.cancelled":
+      await recordTerminal(stores, taskId, envelope, "cancelled");
+      return;
+    default:
+      return;
+  }
+}
+async function recordTerminal(stores, taskId, envelope, status) {
+  const { created } = await stores.receipts.record({
+    key: terminalReceiptKey(taskId),
+    body: encodeEnvelope(envelope)
+  });
+  if (!created) return;
+  await stores.tasks.recordStatus({ taskId, status });
+  await projectTerminalToReview(stores.board, taskId);
+}
+
+// src/handlers/messages.ts
+function messagesHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const { device, stores } = authenticated;
+    const parsed = MessagesSendRequestSchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "messages must be an array of envelopes" }, 400);
+    let accepted = 0;
+    let rejected = 0;
+    for (const envelope of parsed.data.messages) {
+      const outcome = await handleInboundEnvelope(
+        stores,
+        device.deviceId,
+        envelope,
+        deps.activityBounds
+      );
+      if (outcome === "rate_limited") return c.json({ error: "rate limit exceeded" }, 429);
+      if (outcome === "rejected") rejected += 1;
+      else accepted += 1;
+    }
+    const response = rejected > 0 ? { accepted, rejected } : { accepted };
+    return c.json(response, 200);
+  };
+}
+var DEFAULT_BOARD_PAGE_LIMIT = 50;
+var DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS = 5e3;
+var DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS = 15e3;
+var DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS = 12e4;
+var ClaimBodySchema = z.object({ expectedStatus: z.enum(BOARD_STATUSES).optional() });
+var StatusBodySchema = z.object({
+  expectedStatus: z.enum(BOARD_STATUSES),
+  status: z.enum(BOARD_STATUSES)
+});
+function parseNonNegativeInteger(value) {
+  if (value === void 0) return 0;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : void 0;
+}
+function parsePositiveInteger(value, fallback) {
+  if (value === void 0) return fallback;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : void 0;
+}
+function boardQuery(c, pageLimit) {
+  const afterSeq = parseNonNegativeInteger(c.req.query("since"));
+  const limit = parsePositiveInteger(c.req.query("limit"), pageLimit);
+  const statusRaw = c.req.query("status");
+  if (afterSeq === void 0 || limit === void 0 || limit > pageLimit) return void 0;
+  if (statusRaw !== void 0 && !BOARD_STATUSES.includes(statusRaw)) {
+    return void 0;
+  }
+  return {
+    afterSeq,
+    limit,
+    ...c.req.query("channel") === void 0 ? {} : { channel: c.req.query("channel") },
+    ...statusRaw === void 0 ? {} : { status: statusRaw }
+  };
+}
+function boardListHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const query = boardQuery(c, deps.pageLimit);
+    if (query === void 0) return c.json({ error: "invalid board query" }, 400);
+    return c.json(await authenticated.stores.board.list(query), 200);
+  };
+}
+function boardClaimHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const parsed = ClaimBodySchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "invalid claim body" }, 400);
+    const itemId = c.req.param("id");
+    if (itemId === void 0 || itemId.length === 0) return c.json({ error: "invalid board item id" }, 400);
+    try {
+      const item = await authenticated.stores.board.claim({
+        itemId,
+        holderId: authenticated.device.deviceId,
+        ...parsed.data.expectedStatus === void 0 ? {} : { expectedStatus: parsed.data.expectedStatus }
+      });
+      return c.json(item, 200);
+    } catch (caught) {
+      return boardFailure(c, caught);
+    }
+  };
+}
+function boardUnclaimHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const itemId = c.req.param("id");
+    if (itemId === void 0 || itemId.length === 0) return c.json({ error: "invalid board item id" }, 400);
+    try {
+      return c.json(
+        await authenticated.stores.board.unclaim({
+          itemId,
+          holderId: authenticated.device.deviceId
+        }),
+        200
+      );
+    } catch (caught) {
+      return boardFailure(c, caught);
+    }
+  };
+}
+function boardStatusHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const parsed = StatusBodySchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "invalid status body" }, 400);
+    const itemId = c.req.param("id");
+    if (itemId === void 0 || itemId.length === 0) return c.json({ error: "invalid board item id" }, 400);
+    if (parsed.data.status === "done") {
+      return c.json({ error: "done requires host review acceptance" }, 403);
+    }
+    try {
+      return c.json(
+        await authenticated.stores.board.updateStatus({
+          itemId,
+          expectedStatus: parsed.data.expectedStatus,
+          status: parsed.data.status,
+          holderId: authenticated.device.deviceId
+        }),
+        200
+      );
+    } catch (caught) {
+      return boardFailure(c, caught);
+    }
+  };
+}
+function boardStreamHandler(deps) {
+  return async (c) => {
+    const firstAuth = await authenticateDevice(c, deps);
+    if (firstAuth === void 0) return c.json({ error: "unauthorized" }, 401);
+    const query = boardQuery(c, deps.pageLimit);
+    if (query === void 0) return c.json({ error: "invalid board query" }, 400);
+    const querySince = query.afterSeq ?? 0;
+    const headerRaw = c.req.header("last-event-id");
+    const headerSince = headerRaw === void 0 ? void 0 : parseNonNegativeInteger(headerRaw);
+    if (headerRaw !== void 0 && headerSince === void 0) {
+      return c.json({ error: "invalid Last-Event-ID" }, 400);
+    }
+    if (headerSince !== void 0 && c.req.query("since") !== void 0 && headerSince !== querySince) {
+      return c.json({ error: "conflicting stream cursors" }, 400);
+    }
+    let stopped = false;
+    const stopController = new AbortController();
+    const signal = c.req.raw.signal;
+    const stream = new ReadableStream({
+      start(controller) {
+        const onAbort = () => {
+          stopped = true;
+          stopController.abort();
+          closeController(controller);
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        void pumpBoardStream(
+          controller,
+          c,
+          deps,
+          { ...query, afterSeq: headerSince ?? querySince },
+          () => stopped || signal.aborted,
+          stopController.signal
+        ).finally(() => {
+          stopped = true;
+          stopController.abort();
+          signal.removeEventListener("abort", onAbort);
+          closeController(controller);
+        });
+      },
+      cancel() {
+        stopped = true;
+        stopController.abort();
+      }
+    });
+    return new Response(stream, {
+      status: 200,
+      headers: {
+        "cache-control": "no-cache, no-transform",
+        connection: "keep-alive",
+        "content-type": "text/event-stream; charset=utf-8"
+      }
+    });
+  };
+}
+async function pumpBoardStream(controller, c, deps, initialQuery, isStopped, stopSignal) {
+  let cursor = initialQuery.afterSeq ?? 0;
+  let lastHeartbeat = performance.now();
+  let lastReconcile = performance.now();
+  while (!isStopped()) {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return;
+    const page = await authenticated.stores.board.list({ ...initialQuery, afterSeq: cursor });
+    for (const item of page.items) {
+      enqueue(controller, `event: board
+id: ${item.boardSeq}
+data: ${JSON.stringify(item)}
+
+`);
+      cursor = item.boardSeq;
+    }
+    if (page.hasMore) continue;
+    const now = performance.now();
+    if (now - lastReconcile >= deps.reconciliationIntervalMs) {
+      enqueue(controller, `event: reconcile
+data: ${JSON.stringify({ since: 0 })}
+
+`);
+      lastReconcile = now;
+    }
+    if (now - lastHeartbeat >= deps.heartbeatIntervalMs) {
+      enqueue(controller, ": heartbeat\n\n");
+      lastHeartbeat = now;
+    }
+    await abortableSleep(deps.queryIntervalMs, stopSignal);
+  }
+}
+function enqueue(controller, value) {
+  try {
+    controller.enqueue(new TextEncoder().encode(value));
+  } catch {
+  }
+}
+function closeController(controller) {
+  try {
+    controller.close();
+  } catch {
+  }
+}
+async function abortableSleep(ms, signal) {
+  if (signal.aborted) return;
+  await new Promise((resolve) => {
+    let timer;
+    const finish = () => {
+      if (timer !== void 0) clearTimeout(timer);
+      signal.removeEventListener("abort", finish);
+      resolve();
+    };
+    timer = setTimeout(finish, ms);
+    signal.addEventListener("abort", finish, { once: true });
+    if (signal.aborted) finish();
+  });
+}
+function boardFailure(c, caught) {
+  if (isCoreConflictError(caught)) {
+    const holder = caught.current.assignee;
+    return c.json(
+      {
+        error: caught.code,
+        current: caught.current,
+        observedAt: caught.observedAt,
+        ...holder === void 0 ? {} : { holder: { ...holder, observedAt: caught.observedAt } }
+      },
+      409
+    );
+  }
+  if (isCoreError(caught, "board_item_not_found")) return c.json({ error: caught.code }, 404);
+  if (isCoreError(caught, "board_not_held")) return c.json({ error: caught.code }, 409);
+  throw caught;
+}
+var PresenceBodySchema = z.object({
+  level: z.enum(PRESENCE_LEVELS),
+  detail: z.string().optional()
+});
+var ActivityBodySchema = z.object({
+  taskId: z.string().min(1).max(200),
+  events: z.array(AgentEventOrUnknownSchema),
+  dropped: z.number().int().nonnegative()
+});
+function presencePublishHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const parsed = PresenceBodySchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "invalid presence body" }, 400);
+    if (parsed.data.detail !== void 0 && new TextEncoder().encode(parsed.data.detail).length > deps.detailMaxBytes) {
+      return c.json({ error: "presence detail too large" }, 413);
+    }
+    try {
+      return c.json(
+        await authenticated.stores.presence.publish({
+          deviceId: authenticated.device.deviceId,
+          level: parsed.data.level,
+          ...parsed.data.detail === void 0 ? {} : { detail: parsed.data.detail },
+          ttlMs: deps.ttlMs,
+          minimumIntervalMs: deps.minimumIntervalMs
+        }),
+        200
+      );
+    } catch (caught) {
+      if (isCoreError(caught, "hint_rate_limited")) {
+        return c.json({ error: caught.code }, 429);
+      }
+      throw caught;
+    }
+  };
+}
+function activityAppendHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const parsed = ActivityBodySchema.safeParse(await readJsonBody(c));
+    if (!parsed.success) return c.json({ error: "invalid activity body" }, 400);
+    try {
+      return c.json(
+        await appendActivityEvents(authenticated.stores.activity, parsed.data, deps.bounds),
+        200
+      );
+    } catch (caught) {
+      if (isCloudError(caught, "activity_batch_too_large")) {
+        return c.json({ error: caught.code }, 413);
+      }
+      if (isCloudError(caught, "coordination_input_invalid")) {
+        return c.json({ error: caught.code }, 400);
+      }
+      throw caught;
+    }
+  };
+}
+var DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS = 6e4;
+var MAX_DEVICE_PROOF_CLOCK_SKEW_MS = 5 * 6e4;
+var DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS = 5 * 6e4;
+var MAX_DEVICE_PROOF_MAX_LIFETIME_MS = 15 * 6e4;
+function validBound(value, maximum) {
+  return Number.isSafeInteger(value) && value >= 0 && value <= maximum;
+}
+function parseInstant(value) {
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+function timeBindingIsValid(envelope, now, clockSkewMs, maxLifetimeMs) {
+  const issuedAt = parseInstant(envelope.protected.issuedAt);
+  if (issuedAt === void 0) return false;
+  if (issuedAt < now - clockSkewMs || issuedAt > now + clockSkewMs) return false;
+  const expiry = envelope.protected.expiresAt;
+  if (expiry === void 0) return true;
+  const expiresAt = parseInstant(expiry);
+  if (expiresAt === void 0 || expiresAt < issuedAt) return false;
+  if (expiresAt - issuedAt > maxLifetimeMs) return false;
+  return now <= expiresAt + clockSkewMs;
+}
+async function authenticateDeviceProof(input, request, deps) {
+  const clockSkewMs = deps.clockSkewMs ?? DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS;
+  const maxLifetimeMs = deps.maxLifetimeMs ?? DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS;
+  if (!validBound(clockSkewMs, MAX_DEVICE_PROOF_CLOCK_SKEW_MS)) return void 0;
+  if (!validBound(maxLifetimeMs, MAX_DEVICE_PROOF_MAX_LIFETIME_MS)) return void 0;
+  let envelope;
+  try {
+    envelope = parseDeviceProofEnvelope(input);
+  } catch {
+    return void 0;
+  }
+  const claims = envelope.protected;
+  if (claims.operation !== request.operation || claims.resource !== request.resource) {
+    return void 0;
+  }
+  if (claims.operationId !== void 0) return void 0;
+  if (claims.method !== request.method || claims.path !== request.path) return void 0;
+  if (claims.bodySize !== request.body.byteLength) return void 0;
+  if (await deps.crypto.sha256(request.body) !== claims.bodySha256) return void 0;
+  if (!isTenantId(claims.tenantId)) return void 0;
+  const row = await deps.devices.get(tenantId(claims.tenantId), claims.deviceId);
+  if (row === void 0 || row.revoked) return void 0;
+  if (row.productId !== claims.productId) return void 0;
+  if (row.proofKeyId !== claims.keyId || row.proofKeyEpoch !== claims.keyEpoch) {
+    return void 0;
+  }
+  if (!timeBindingIsValid(envelope, deps.clock.now().getTime(), clockSkewMs, maxLifetimeMs)) {
+    return void 0;
+  }
+  const verified = await deps.crypto.verifyEd25519(
+    row.devicePublicKey,
+    deviceProofSigningInput(claims),
+    envelope.signature
+  );
+  if (!verified) return void 0;
+  return {
+    device: {
+      kind: "device",
+      tenantId: row.tenantId,
+      productId: row.productId,
+      deviceId: row.deviceId
+    },
+    requestId: claims.requestId,
+    operation: claims.operation,
+    resource: claims.resource,
+    bodySha256: claims.bodySha256,
+    bodySize: BigInt(claims.bodySize),
+    keyId: row.proofKeyId,
+    keyEpoch: row.proofKeyEpoch
+  };
+}
+var TRUTH_RECORD_CAPABILITY = "truth.records";
+var TRUTH_INLINE_CONTENT_TYPE = "application/vnd.byok.truth+utf8";
+var TRUTH_REQUEST_ID_MAX_LENGTH = 120;
+var TRUTH_RECORD_KEY_MAX_LENGTH = 200;
+var TRUTH_LABEL_MAX_LENGTH = 200;
+var TRUTH_BATCH_MAX_RECORDS = 32;
+var TRUTH_MANIFEST_MAX_LIMIT = 100;
+var CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+var RECORD_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+var TruthRecordKeySchema = z.string().min(1).max(TRUTH_RECORD_KEY_MAX_LENGTH).regex(RECORD_KEY_PATTERN).refine((value) => value !== "." && value !== "..");
+var TruthBodyInputSchema = z.discriminatedUnion("kind", [
+  z.strictObject({
+    kind: z.literal("inline"),
+    content: z.string(),
+    contentHash: z.string().regex(CONTENT_HASH_PATTERN)
+  }),
+  z.strictObject({
+    kind: z.literal("object"),
+    contentHash: z.string().regex(CONTENT_HASH_PATTERN),
+    byteSize: z.number().int().nonnegative().safe()
+  })
+]);
+var SnapshotCandidateSchema = z.strictObject({
+  kind: z.enum(["profile", "memory"]),
+  recordKey: TruthRecordKeySchema,
+  expectedRev: z.number().int().nonnegative().safe(),
+  body: TruthBodyInputSchema,
+  label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional()
+});
+var TruthWriteRequestSchema = z.strictObject({
+  expectedRev: z.number().int().nonnegative().safe().optional(),
+  body: TruthBodyInputSchema,
+  label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),
+  snapshots: z.array(SnapshotCandidateSchema).max(TRUTH_BATCH_MAX_RECORDS - 1).optional()
+});
+var TruthRecordMetadataSchema = z.strictObject({
+  kind: z.enum(["task.terminal", "profile", "memory"]),
+  recordKey: TruthRecordKeySchema,
+  rev: z.number().int().positive().safe(),
+  contentHash: z.string().regex(CONTENT_HASH_PATTERN),
+  byteSize: z.number().int().nonnegative().safe(),
+  label: z.string().max(TRUTH_LABEL_MAX_LENGTH).optional(),
+  updatedAt: z.string().datetime({ offset: true })
+});
+var TruthCommitResponseSchema = z.strictObject({
+  primary: TruthRecordMetadataSchema,
+  snapshots: z.array(TruthRecordMetadataSchema).max(TRUTH_BATCH_MAX_RECORDS - 1)
+});
+function truthRecordMetadata(record) {
+  const byteSize = Number(record.byteSize);
+  if (!Number.isSafeInteger(byteSize)) throw new Error("truth record byte size exceeds JSON range");
+  return {
+    kind: record.kind,
+    recordKey: record.recordKey,
+    rev: record.rev,
+    contentHash: record.contentHash,
+    byteSize,
+    ...record.label === void 0 ? {} : { label: record.label },
+    updatedAt: record.writtenAt
+  };
+}
+function truthManifestMetadata(entry) {
+  const byteSize = Number(entry.byteSize);
+  if (!Number.isSafeInteger(byteSize)) throw new Error("truth manifest byte size exceeds JSON range");
+  return {
+    kind: entry.kind,
+    recordKey: entry.recordKey,
+    rev: entry.rev,
+    contentHash: entry.contentHash,
+    byteSize,
+    ...entry.label === void 0 ? {} : { label: entry.label },
+    updatedAt: entry.updatedAt
+  };
+}
+
+// src/truth/errors.ts
+var TruthCommitError = class extends Error {
+  code;
+  current;
+  constructor(code, message, current) {
+    super(message);
+    this.name = "TruthCommitError";
+    this.code = code;
+    this.current = current;
+  }
+};
+function isTruthCommitError(value) {
+  return value instanceof TruthCommitError;
+}
+
+// src/handlers/truth.ts
+var DEVICE_PROOF_HEADER = "x-byok-device-proof";
+var DEFAULT_MAX_TRUTH_REQUEST_BYTES = 2 * 1024 * 1024;
+var MAX_DEVICE_PROOF_HEADER_BYTES = 16 * 1024;
+var EMPTY_BODY = new Uint8Array();
+var RECORD_PREFIX_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]*$/;
+function truthManifestHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateTruthRequest(c, deps, {
+      body: EMPTY_BODY,
+      operation: "truth.list",
+      resource: "records"
+    });
+    if (authenticated === void 0) return unauthorized(c);
+    const query = manifestQuery(c);
+    if (query === void 0) return c.json({ error: "invalid truth manifest query" }, 400);
+    const records = await deps.truth.listManifest(principalTenant(authenticated.device), query);
+    return c.json({ records: records.map(truthManifestMetadata) }, 200);
+  };
+}
+function truthGetHandler(deps) {
+  return async (c) => {
+    const resource = rawRecordResource(c);
+    const authenticated = await authenticateTruthRequest(c, deps, {
+      body: EMPTY_BODY,
+      operation: "truth.read",
+      resource
+    });
+    if (authenticated === void 0) return unauthorized(c);
+    const selector = recordSelector(c);
+    if (selector === void 0) return c.json({ error: "invalid truth record selector" }, 400);
+    const record = await deps.truth.getRecord(principalTenant(authenticated.device), selector);
+    if (record === void 0) return c.json({ error: "truth_record_not_found" }, 404);
+    const metadata = truthRecordMetadata(record);
+    if (record.body.kind === "inline") {
+      return c.json({ ...metadata, body: { kind: "inline", content: record.body.body } }, 200);
+    }
+    const downloadUrl = await deps.objectDownloads.getDownloadUrl(
+      principalTenant(authenticated.device),
+      record.body.hash
+    );
+    if (downloadUrl === void 0) return c.json({ error: "object_not_found" }, 404);
+    return c.json({ ...metadata, body: { kind: "object", downloadUrl } }, 200);
+  };
+}
+function truthPutHandler(deps) {
+  return async (c) => {
+    const body = await readBoundedBody(c, deps.maxRequestBytes);
+    if (body === "too_large") return c.json({ error: "truth request body too large" }, 413);
+    if (body === void 0) return c.json({ error: "invalid truth request body" }, 400);
+    const authenticated = await authenticateTruthRequest(c, deps, {
+      body,
+      operation: "truth.write",
+      resource: rawRecordResource(c)
+    });
+    if (authenticated === void 0) return unauthorized(c);
+    const selector = recordSelector(c);
+    if (selector === void 0) return c.json({ error: "invalid truth record selector" }, 400);
+    const parsedJson = parseJsonBytes(body);
+    const parsed = TruthWriteRequestSchema.safeParse(parsedJson);
+    if (!parsed.success) return c.json({ error: "invalid truth write request" }, 400);
+    const writes = prepareWrites(selector.kind, selector.recordKey, parsed.data);
+    if (writes === void 0) return c.json({ error: "invalid truth write model" }, 400);
+    const input = {
+      deviceId: authenticated.device.deviceId,
+      requestId: authenticated.requestId,
+      operation: authenticated.operation,
+      resource: authenticated.resource,
+      proofBodySha256: authenticated.bodySha256,
+      proofBodySize: authenticated.bodySize,
+      writes
+    };
+    try {
+      const result = await deps.truth.commit(principalTenant(authenticated.device), input);
+      return c.json(result.response, 200, { "x-byok-replayed": result.replayed ? "true" : "false" });
+    } catch (caught) {
+      return truthFailure(c, caught);
+    }
+  };
+}
+function recordSelector(c) {
+  const kind = c.req.param("kind");
+  const recordKey = c.req.param("key");
+  if (!TRUTH_RECORD_KINDS.includes(kind)) return void 0;
+  const parsedKey = TruthRecordKeySchema.safeParse(recordKey);
+  if (!parsedKey.success) return void 0;
+  return { kind, recordKey: parsedKey.data };
+}
+function rawRecordResource(c) {
+  return `${c.req.param("kind") ?? ""}/${c.req.param("key") ?? ""}`;
+}
+function manifestQuery(c) {
+  const url = new URL(c.req.url);
+  for (const key of url.searchParams.keys()) {
+    if (key !== "kind" && key !== "prefix" && key !== "limit" || url.searchParams.getAll(key).length !== 1) {
+      return void 0;
+    }
+  }
+  const kind = url.searchParams.get("kind") ?? void 0;
+  if (kind !== void 0 && !TRUTH_RECORD_KINDS.includes(kind)) return void 0;
+  const keyPrefix = url.searchParams.get("prefix") ?? void 0;
+  if (keyPrefix !== void 0 && (keyPrefix.length === 0 || keyPrefix.length > 200 || !RECORD_PREFIX_PATTERN.test(keyPrefix))) {
+    return void 0;
+  }
+  const limitRaw = url.searchParams.get("limit") ?? void 0;
+  const limit = limitRaw === void 0 ? TRUTH_MANIFEST_MAX_LIMIT : Number(limitRaw);
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > TRUTH_MANIFEST_MAX_LIMIT) return void 0;
+  return {
+    ...kind === void 0 ? {} : { kind },
+    ...keyPrefix === void 0 ? {} : { keyPrefix },
+    limit
+  };
+}
+function prepareWrites(kind, recordKey, request) {
+  if (kind === "task.terminal") {
+    if (request.expectedRev !== void 0) return void 0;
+  } else if (request.expectedRev === void 0 || request.snapshots !== void 0) {
+    return void 0;
+  }
+  const primary = prepareWrite(kind, recordKey, request.body, request.expectedRev, request.label);
+  const snapshots = (request.snapshots ?? []).map(
+    (snapshot) => prepareWrite(
+      snapshot.kind,
+      snapshot.recordKey,
+      snapshot.body,
+      snapshot.expectedRev,
+      snapshot.label
+    )
+  );
+  return [primary, ...snapshots];
+}
+function prepareWrite(kind, recordKey, input, expectedRev, label) {
+  const hash = contentHash(input.contentHash);
+  const body = input.kind === "inline" ? { kind: "inline", body: input.content } : { kind: "object", hash };
+  const byteSize = input.kind === "inline" ? BigInt(new TextEncoder().encode(input.content).byteLength) : BigInt(input.byteSize);
+  if (kind === "task.terminal") {
+    return { kind, recordKey, contentHash: hash, byteSize, body, ...label === void 0 ? {} : { label } };
+  }
+  if (expectedRev === void 0) throw new Error("snapshot expectedRev was not validated");
+  return {
+    kind,
+    recordKey,
+    expectedRev,
+    contentHash: hash,
+    byteSize,
+    body,
+    ...label === void 0 ? {} : { label }
+  };
+}
+async function authenticateTruthRequest(c, deps, request) {
+  const proof = decodeProofHeader(c.req.header(DEVICE_PROOF_HEADER));
+  if (proof === void 0) return void 0;
+  const url = new URL(c.req.url);
+  return authenticateDeviceProof(
+    proof,
+    {
+      method: c.req.method,
+      path: `${url.pathname}${url.search}`,
+      operation: request.operation,
+      resource: request.resource,
+      body: request.body
+    },
+    deps.proof
+  );
+}
+function decodeProofHeader(value) {
+  if (value === void 0 || value.length === 0 || value.length > MAX_DEVICE_PROOF_HEADER_BYTES) {
+    return void 0;
+  }
+  if (!/^[A-Za-z0-9_-]+$/.test(value) || value.length % 4 === 1) return void 0;
+  try {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat((4 - value.length % 4) % 4);
+    const binary = atob(padded);
+    const bytes = Uint8Array.from(binary, (character) => character.charCodeAt(0));
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    return void 0;
+  }
+}
+async function readBoundedBody(c, maximum) {
+  const length = c.req.header("content-length");
+  if (length !== void 0) {
+    const parsed = Number(length);
+    if (!Number.isSafeInteger(parsed) || parsed < 0) return void 0;
+    if (parsed > maximum) return "too_large";
+  }
+  try {
+    const bytes = new Uint8Array(await c.req.arrayBuffer());
+    return bytes.byteLength > maximum ? "too_large" : bytes;
+  } catch {
+    return void 0;
+  }
+}
+function parseJsonBytes(bytes) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    return void 0;
+  }
+}
+function unauthorized(c) {
+  return c.json({ error: "unauthorized" }, 401);
+}
+function truthFailure(c, caught) {
+  if (isCoreConflictError(caught)) {
+    const current = caught.current === void 0 ? null : truthRecordMetadata(caught.current);
+    return c.json({ error: caught.code, current, observedAt: caught.observedAt }, 409);
+  }
+  if (isTruthCommitError(caught)) {
+    return c.json({ error: caught.code, ...caught.current === void 0 ? {} : { current: caught.current } }, 409);
+  }
+  if (isCoreError(caught)) {
+    if (STORAGE_ERROR_CODES.includes(caught.code)) {
+      const code = caught.code;
+      return c.json({ error: code }, STORAGE_ERROR_HTTP_STATUS[code]);
+    }
+    if (caught.code === "storage_entitlement_missing" || caught.code === "object_state_invalid") {
+      return c.json({ error: caught.code }, 409);
+    }
+    if (caught.code === "content_hash_invalid") return c.json({ error: caught.code }, 400);
+  }
+  throw caught;
+}
+var ROUTE_CLASSES = ["device", "proof", "presigned", "public"];
+var ROUTE_METHODS = ["GET", "POST", "PUT"];
+function routeKey(route) {
+  return `${route.method} ${route.path}`;
+}
+var CloudRouteRegistry = class {
+  #app = new Hono();
+  #routes = [];
+  register(descriptor, handler) {
+    if (!ROUTE_CLASSES.includes(descriptor.class)) {
+      throw new Error(`Route ${routeKey(descriptor)} has no valid isolation class`);
+    }
+    if (!ROUTE_METHODS.includes(descriptor.method)) {
+      throw new Error(`Route ${routeKey(descriptor)} uses an unsupported method`);
+    }
+    if (this.#routes.some((existing) => routeKey(existing) === routeKey(descriptor))) {
+      throw new Error(`Route ${routeKey(descriptor)} is already registered`);
+    }
+    this.#routes.push(descriptor);
+    this.#app.on(descriptor.method, descriptor.path, handler);
+  }
+  /** The inventory, in registration order. */
+  get routes() {
+    return this.#routes;
+  }
+  /** What the router actually mounted, read back off Hono itself — the other half of the I1 comparison. */
+  get mounted() {
+    return this.#app.routes.map((route) => ({ method: route.method, path: route.path }));
+  }
+  get fetch() {
+    return this.#app.fetch;
+  }
+};
+
+// src/cloud.ts
+var DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;
+var DEFAULT_LONG_POLL_HOLD_MS = 5e4;
+var DEFAULT_LONG_POLL_INTERVAL_MS = 250;
+var DEFAULT_EVENTS_PAGE_LIMIT = 50;
+function createByokCloud(options) {
+  const declaration = parseDeclaration(options.capabilities);
+  assertNoOverDeclaration(
+    declaration,
+    options.blobContentProxy,
+    options.truthCommitter,
+    options.truthObjectDownloads
+  );
+  const root = { core: options.core, cloud: options.cloud };
+  const auth = createAuthPlane({
+    stores: options.cloud,
+    crypto: options.crypto,
+    clock: options.clock,
+    tokenSigner: options.tokenSigner,
+    ...options.accessTokenTtlSeconds !== void 0 ? { accessTokenTtlSeconds: options.accessTokenTtlSeconds } : {}
+  });
+  const deviceRouteDeps = {
+    root,
+    bearer: { tokenSigner: options.tokenSigner, devices: options.cloud.devices }
+  };
+  const registry = new CloudRouteRegistry();
+  const activityBounds = {
+    maxEvents: options.activityMaxEvents ?? DEFAULT_ACTIVITY_MAX_EVENTS,
+    maxBytes: options.activityMaxBytes ?? DEFAULT_ACTIVITY_MAX_BYTES,
+    capacity: options.activityCapacity ?? DEFAULT_ACTIVITY_CAPACITY,
+    ttlMs: options.activityTtlMs ?? DEFAULT_ACTIVITY_TTL_MS
+  };
+  registry.register({ method: "POST", path: "/byok/pair", class: "public" }, pairHandler({ auth }));
+  registry.register({ method: "POST", path: "/byok/challenge", class: "public" }, challengeHandler({ auth }));
+  registry.register({ method: "POST", path: "/byok/token", class: "public" }, tokenHandler({ auth }));
+  registry.register(
+    { method: "GET", path: "/byok/capabilities", class: "public" },
+    capabilitiesHandler({ declaration })
+  );
+  if (declares(declaration, CLOUD_CAPABILITIES.eventsLongPoll)) {
+    registry.register(
+      { method: "GET", path: "/byok/events", class: "device" },
+      eventsHandler({
+        ...deviceRouteDeps,
+        longPollHoldMs: options.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS,
+        longPollIntervalMs: options.longPollIntervalMs ?? DEFAULT_LONG_POLL_INTERVAL_MS,
+        pageLimit: options.eventsPageLimit ?? DEFAULT_EVENTS_PAGE_LIMIT
+      })
+    );
+  }
+  if (declares(declaration, CLOUD_CAPABILITIES.messagesBatch)) {
+    registry.register(
+      { method: "POST", path: "/byok/messages", class: "device" },
+      messagesHandler({ ...deviceRouteDeps, activityBounds })
+    );
+  }
+  if (declares(declaration, CLOUD_CAPABILITIES.boardCoordination)) {
+    const boardDeps = {
+      ...deviceRouteDeps,
+      pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT
+    };
+    registry.register({ method: "GET", path: "/byok/board", class: "device" }, boardListHandler(boardDeps));
+    registry.register(
+      { method: "POST", path: "/byok/board/:id/claim", class: "device" },
+      boardClaimHandler(deviceRouteDeps)
+    );
+    registry.register(
+      { method: "POST", path: "/byok/board/:id/unclaim", class: "device" },
+      boardUnclaimHandler(deviceRouteDeps)
+    );
+    registry.register(
+      { method: "POST", path: "/byok/board/:id/status", class: "device" },
+      boardStatusHandler(deviceRouteDeps)
+    );
+  }
+  if (declares(declaration, CLOUD_CAPABILITIES.boardSse)) {
+    registry.register(
+      { method: "GET", path: "/byok/board/stream", class: "device" },
+      boardStreamHandler({
+        ...deviceRouteDeps,
+        pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT,
+        queryIntervalMs: options.boardStreamQueryIntervalMs ?? DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS,
+        heartbeatIntervalMs: options.boardStreamHeartbeatIntervalMs ?? DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS,
+        reconciliationIntervalMs: options.boardStreamReconciliationIntervalMs ?? DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS
+      })
+    );
+  }
+  if (declares(declaration, CLOUD_CAPABILITIES.presenceHints)) {
+    registry.register(
+      { method: "PUT", path: "/byok/presence", class: "device" },
+      presencePublishHandler({
+        ...deviceRouteDeps,
+        ttlMs: options.presenceTtlMs ?? DEFAULT_PRESENCE_TTL_MS,
+        minimumIntervalMs: options.presenceMinimumIntervalMs ?? DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS,
+        detailMaxBytes: options.presenceDetailMaxBytes ?? DEFAULT_PRESENCE_DETAIL_MAX_BYTES
+      })
+    );
+  }
+  if (declares(declaration, CLOUD_CAPABILITIES.activityTail)) {
+    registry.register(
+      { method: "POST", path: "/byok/activity", class: "device" },
+      activityAppendHandler({ ...deviceRouteDeps, bounds: activityBounds })
+    );
+  }
+  const truthCommitter = options.truthCommitter;
+  const truthObjectDownloads = options.truthObjectDownloads;
+  if (truthCommitter !== void 0 && truthObjectDownloads !== void 0 && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {
+    const truthDeps = {
+      proof: {
+        devices: options.cloud.devices,
+        crypto: options.crypto,
+        clock: options.clock
+      },
+      truth: truthCommitter,
+      objectDownloads: truthObjectDownloads,
+      maxRequestBytes: options.maxTruthRequestBytes ?? DEFAULT_MAX_TRUTH_REQUEST_BYTES
+    };
+    registry.register(
+      { method: "GET", path: "/byok/records", class: "proof" },
+      truthManifestHandler(truthDeps)
+    );
+    registry.register(
+      { method: "GET", path: "/byok/records/:kind/:key", class: "proof" },
+      truthGetHandler(truthDeps)
+    );
+    registry.register(
+      { method: "PUT", path: "/byok/records/:kind/:key", class: "proof" },
+      truthPutHandler(truthDeps)
+    );
+  }
+  if (declares(declaration, CLOUD_CAPABILITIES.blobsPresigned)) {
+    const blobDeps = {
+      ...deviceRouteDeps,
+      maxBlobSizeBytes: options.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES
+    };
+    registry.register({ method: "POST", path: "/byok/blobs", class: "device" }, createBlobHandler(blobDeps));
+    registry.register({ method: "POST", path: "/byok/blobs/:id/finalize", class: "device" }, finalizeBlobHandler(blobDeps));
+    registry.register({ method: "GET", path: "/byok/blobs/:id/url", class: "device" }, blobDownloadUrlHandler(blobDeps));
+  }
+  const contentProxy = options.blobContentProxy;
+  if (contentProxy !== void 0 && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {
+    const contentDeps = { contentProxy };
+    registry.register(
+      { method: "PUT", path: "/byok/blobs/:id/content", class: "presigned" },
+      blobUploadContentHandler(contentDeps)
+    );
+    registry.register(
+      { method: "GET", path: "/byok/blobs/:id/content", class: "presigned" },
+      blobDownloadContentHandler(contentDeps)
+    );
+  }
+  const operatorId = options.operatorId ?? "host";
+  function controlPlane(tenant) {
+    return { kind: "control-plane", tenantId: tenant, operatorId };
+  }
+  return {
+    fetch: registry.fetch,
+    routes: registry.routes,
+    mountedRoutes: registry.mounted,
+    capabilities: declaration,
+    createPairingCode(tenant, input) {
+      return auth.createPairingCode(tenant, input);
+    },
+    async enqueueOffer(tenant, deviceId, input) {
+      const stores = tenantStoresFor(controlPlane(tenant), root);
+      const taskId = input.taskId ?? `task_${options.crypto.randomUuid()}`;
+      const seq = await stores.sequence.next(deviceId);
+      const envelope = createEnvelope("task.offer", input.payload, { taskId, seq });
+      const body = encodeEnvelope(envelope);
+      const bytes = new TextEncoder().encode(body);
+      const message = await stores.mailbox.append({
+        deviceId,
+        body,
+        bodyHash: contentHash(await options.crypto.sha256(bytes)),
+        byteSize: BigInt(bytes.length),
+        messageId: envelope.id
+      });
+      if (message.seq !== seq) {
+        throw new ByokCloudError(
+          "mailbox_seq_mismatch",
+          `Mailbox numbered this offer ${message.seq} while the delivery sequence allocated ${seq}; the daemon's redelivery cursor would be wrong.`
+        );
+      }
+      const attempt = await stores.tasks.open({ taskId, deviceId });
+      return { taskId, seq, envelope, attempt };
+    },
+    readTaskAttempt(tenant, taskId) {
+      return tenantStoresFor(controlPlane(tenant), root).tasks.get(taskId);
+    },
+    readTerminalReceipt(tenant, taskId) {
+      return tenantStoresFor(controlPlane(tenant), root).receipts.get(terminalReceiptKey(taskId));
+    },
+    listDevices(tenant) {
+      return tenantStoresFor(controlPlane(tenant), root).devices.list();
+    },
+    revokeDevice(tenant, deviceId) {
+      return tenantStoresFor(controlPlane(tenant), root).devices.revoke(deviceId);
+    },
+    createBoardItem(tenant, input) {
+      assertBoardLabels(input.channel, input.title, {
+        channelMaxBytes: options.boardChannelMaxBytes ?? DEFAULT_BOARD_CHANNEL_MAX_BYTES,
+        titleMaxBytes: options.boardTitleMaxBytes ?? DEFAULT_BOARD_TITLE_MAX_BYTES
+      });
+      return tenantStoresFor(controlPlane(tenant), root).board.create(input);
+    },
+    listBoardItems(tenant, query) {
+      return tenantStoresFor(controlPlane(tenant), root).board.list(query);
+    },
+    acceptBoardItem(tenant, itemId) {
+      return tenantStoresFor(controlPlane(tenant), root).board.updateStatus({
+        itemId,
+        expectedStatus: "in_review",
+        status: "done"
+      });
+    },
+    listPresence(tenant) {
+      return tenantStoresFor(controlPlane(tenant), root).presence.list();
+    },
+    readActivity(tenant, taskId) {
+      return tenantStoresFor(controlPlane(tenant), root).activity.read(taskId);
+    }
+  };
+}
+function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, truthObjectDownloads) {
+  if (declares(declaration, CLOUD_CAPABILITIES.boardSse) && !declares(declaration, CLOUD_CAPABILITIES.boardCoordination)) {
+    throw new ByokCloudError(
+      "capability_over_declared",
+      `${CLOUD_CAPABILITIES.boardSse} requires ${CLOUD_CAPABILITIES.boardCoordination}; without polling, reconciliation and declared fallback cannot be served.`
+    );
+  }
+  if (contentProxy === void 0 && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {
+    throw new ByokCloudError(
+      "capability_over_declared",
+      `This deployment declares ${CLOUD_CAPABILITIES.blobsContentProxy} but was given no BlobContentProxy, so both /byok/blobs/:id/content routes would be published and unserved.`
+    );
+  }
+  if (truthCommitter === void 0 && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {
+    throw new ByokCloudError(
+      "capability_over_declared",
+      `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no atomic TruthCommitter.`
+    );
+  }
+  if (truthObjectDownloads === void 0 && declares(declaration, CLOUD_CAPABILITIES.truthRecords)) {
+    throw new ByokCloudError(
+      "capability_over_declared",
+      `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no content-hash keyed TruthObjectDownloads authority.`
+    );
+  }
+}
+function parseDeclaration(declaration) {
+  try {
+    return parseCapabilityDeclaration(declaration);
+  } catch (cause) {
+    throw new ByokCloudError(
+      "capability_declaration_invalid",
+      "The capability declaration this deployment was configured with is not a valid ADR-010 declaration.",
+      { cause }
+    );
+  }
+}
+
+// src/stores/in-memory/rate-limiter.ts
+var AllowAllRateLimiter = class {
+  async consume(_tenant, _deviceId) {
+    return true;
+  }
+};
+var BLOB_URL_TTL_MS = 15 * 60 * 1e3;
+var SIGNING_SECRET_BYTES = 32;
+var InMemoryBlobRegistry = class {
+  blobs = /* @__PURE__ */ new Map();
+  reservationBlobs = /* @__PURE__ */ new Map();
+  clock;
+  crypto;
+  secret;
+  urlTtlMs;
+  constructor(clock, crypto, options) {
+    this.clock = clock;
+    this.crypto = crypto;
+    this.secret = globalThis.crypto.getRandomValues(new Uint8Array(SIGNING_SECRET_BYTES));
+    this.urlTtlMs = options.urlTtlMs ?? BLOB_URL_TTL_MS;
+  }
+  async signUrl(blobId, action) {
+    const exp = this.clock.now().getTime() + this.urlTtlMs;
+    const sig = await this.computeSig(blobId, action, exp);
+    return `/byok/blobs/${blobId}/content?sig=${sig}&exp=${exp}`;
+  }
+  computeSig(blobId, action, exp) {
+    return this.crypto.hmacSha256(this.secret, `${blobId}:${action}:${exp}`);
+  }
+};
+var InMemoryCloudBlobStore = class {
+  #registry;
+  #objects;
+  constructor(registry, objects) {
+    this.#registry = registry;
+    this.#objects = objects;
+  }
+  async createUpload(tenant, reservation) {
+    assertReservedObject(tenant, reservation);
+    const reservationKey = `${tenant}\0${reservation.reservationId}`;
+    const existingBlobId = this.#registry.reservationBlobs.get(reservationKey);
+    if (existingBlobId !== void 0) {
+      const manifest = await this.#objects.get(tenant, reservation.contentHash);
+      if (manifest?.state === "committed") {
+        throw new ByokCoreError(
+          "object_state_invalid",
+          `Object ${reservation.contentHash} is already committed and immutable.`
+        );
+      }
+      return { blobId: existingBlobId, uploadUrl: await this.#registry.signUrl(existingBlobId, "put") };
+    }
+    const entry = await this.#objects.putManifest(tenant, {
+      hash: reservation.contentHash,
+      byteSize: reservation.expectedBytes,
+      contentType: reservation.contentType
+    });
+    if (entry.byteSize !== reservation.expectedBytes || entry.contentType !== reservation.contentType) {
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Object ${reservation.contentHash} already binds a different storage declaration.`
+      );
+    }
+    if (entry.state === "committed") {
+      throw new ByokCoreError(
+        "object_state_invalid",
+        `Object ${reservation.contentHash} is already committed and immutable.`
+      );
+    }
+    const blobId = `blob_${this.#registry.crypto.randomUuid()}`;
+    this.#registry.blobs.set(blobId, {
+      tenantId: tenant,
+      reservationId: reservation.reservationId,
+      contentHash: reservation.contentHash,
+      byteSize: reservation.expectedBytes,
+      contentType: reservation.contentType,
+      uploaded: false
+    });
+    this.#registry.reservationBlobs.set(reservationKey, blobId);
+    return { blobId, uploadUrl: await this.#registry.signUrl(blobId, "put") };
+  }
+  async observeUpload(tenant, blobId, reservation) {
+    const record = this.#registry.blobs.get(blobId);
+    if (record === void 0 || record.tenantId !== tenant || reservation.tenantId !== tenant || record.reservationId !== reservation.reservationId || record.contentHash !== reservation.contentHash || !record.uploaded) {
+      return void 0;
+    }
+    return {
+      observedByteSize: BigInt(record.data?.length ?? 0),
+      observedContentType: record.contentType
+    };
+  }
+  async getDownloadUrl(tenant, blobId) {
+    const record = this.#registry.blobs.get(blobId);
+    if (record === void 0 || record.tenantId !== tenant || !record.uploaded) return void 0;
+    const manifest = await this.#objects.get(tenant, record.contentHash);
+    if (manifest?.state !== "committed") return void 0;
+    return this.#registry.signUrl(blobId, "get");
+  }
+};
+var InMemoryBlobContentProxy = class {
+  #registry;
+  constructor(registry) {
+    this.#registry = registry;
+  }
+  async verifySignedUrl(blobId, action, sig, exp) {
+    if (!Number.isFinite(exp) || this.#registry.clock.now().getTime() > exp) return false;
+    const expected = await this.#registry.computeSig(blobId, action, exp);
+    return this.#registry.crypto.timingSafeEqual(expected, sig);
+  }
+  async writeContent(blobId, data) {
+    const record = this.#registry.blobs.get(blobId);
+    if (record === void 0) return { ok: false, reason: "unknown blobId" };
+    if (BigInt(data.length) !== record.byteSize) {
+      return { ok: false, reason: `size mismatch: declared ${String(record.byteSize)}, received ${data.length}` };
+    }
+    const actualHash = await this.#registry.crypto.sha256(data);
+    if (actualHash !== record.contentHash) {
+      return { ok: false, reason: "contentHash mismatch" };
+    }
+    record.data = data;
+    record.uploaded = true;
+    return { ok: true };
+  }
+  async readContent(blobId) {
+    const record = this.#registry.blobs.get(blobId);
+    if (record === void 0 || !record.uploaded || record.data === void 0) return void 0;
+    return { data: record.data, contentType: record.contentType };
+  }
+};
+function createInMemoryBlobs(clock, crypto, objects, options = {}) {
+  const registry = new InMemoryBlobRegistry(clock, crypto, options);
+  return {
+    blobs: new InMemoryCloudBlobStore(registry, objects),
+    contentProxy: new InMemoryBlobContentProxy(registry)
+  };
+}
+function assertReservedObject(tenant, reservation) {
+  if (reservation.tenantId === tenant && reservation.kind === "object" && reservation.state === "reserved" && reservation.expectedBytes >= 0n) {
+    return;
+  }
+  throw new ByokCoreError(
+    "storage_integrity_mismatch",
+    "An upload grant requires a reserved object reservation owned by this tenant."
+  );
+}
+var InMemoryDeviceDirectory = class {
+  #byTenant = /* @__PURE__ */ new Map();
+  #byDeviceId = /* @__PURE__ */ new Map();
+  async register(tenant, input) {
+    const record = {
+      tenantId: tenant,
+      productId: input.productId,
+      deviceId: input.deviceId,
+      deviceName: input.deviceName,
+      devicePublicKey: input.devicePublicKey,
+      proofKeyId: input.proofKeyId,
+      proofKeyEpoch: input.proofKeyEpoch,
+      revoked: false
+    };
+    const key = tenantKey(tenant, record.deviceId);
+    this.#byTenant.set(key, record);
+    this.#byDeviceId.set(record.deviceId, key);
+    return record;
+  }
+  async get(tenant, deviceId) {
+    return this.#byTenant.get(tenantKey(tenant, deviceId));
+  }
+  async revoke(tenant, deviceId) {
+    const key = tenantKey(tenant, deviceId);
+    const record = this.#byTenant.get(key);
+    if (record === void 0) return;
+    this.#byTenant.set(key, { ...record, revoked: true });
+  }
+  async list(tenant) {
+    const prefix = tenantKey(tenant, "");
+    return [...this.#byTenant.entries()].filter(([key]) => key.startsWith(prefix)).map(([, record]) => record);
+  }
+  async resolveByDeviceId(deviceId) {
+    const key = this.#byDeviceId.get(deviceId);
+    return key === void 0 ? void 0 : this.#byTenant.get(key);
+  }
+};
+var InMemoryDeviceSequenceStore = class {
+  #next = /* @__PURE__ */ new Map();
+  async next(tenant, deviceId) {
+    const key = tenantKey(tenant, deviceId);
+    const seq = this.#next.get(key) ?? 1;
+    this.#next.set(key, seq + 1);
+    return seq;
+  }
+};
+var DEDUP_RING_CAPACITY = 1024;
+var InMemoryInboundDedupStore = class {
+  #rings = /* @__PURE__ */ new Map();
+  #capacity;
+  constructor(capacity = DEDUP_RING_CAPACITY) {
+    this.#capacity = capacity;
+  }
+  async checkAndRecord(tenant, deviceId, envelopeId) {
+    const key = tenantKey(tenant, deviceId);
+    let ring = this.#rings.get(key);
+    if (ring === void 0) {
+      ring = /* @__PURE__ */ new Set();
+      this.#rings.set(key, ring);
+    }
+    if (ring.has(envelopeId)) return true;
+    ring.add(envelopeId);
+    if (ring.size > this.#capacity) {
+      const oldest = ring.values().next().value;
+      if (oldest !== void 0) ring.delete(oldest);
+    }
+    return false;
+  }
+};
+var NONCE_TTL_MS = 5 * 60 * 1e3;
+var NONCE_BYTES = 24;
+var InMemoryNonceStore = class {
+  #nonces = /* @__PURE__ */ new Map();
+  #clock;
+  #crypto;
+  #ttlMs;
+  constructor(clock, crypto, ttlMs = NONCE_TTL_MS) {
+    this.#clock = clock;
+    this.#crypto = crypto;
+    this.#ttlMs = ttlMs;
+  }
+  /** Number of records currently held (post-sweep). Test-facing only. */
+  get size() {
+    return this.#nonces.size;
+  }
+  async issue(tenant, deviceId) {
+    const nowMs = this.#clock.now().getTime();
+    for (const [nonce2, record] of this.#nonces) {
+      if (record.used || record.expiresAtMs <= nowMs) this.#nonces.delete(nonce2);
+    }
+    const nonce = this.#crypto.randomToken(NONCE_BYTES);
+    this.#nonces.set(nonce, {
+      owner: tenantKey(tenant, deviceId),
+      expiresAtMs: nowMs + this.#ttlMs,
+      used: false
+    });
+    return nonce;
+  }
+  async validate(tenant, deviceId, nonce) {
+    const record = this.#nonces.get(nonce);
+    if (record === void 0) return false;
+    if (record.used) return false;
+    if (record.owner !== tenantKey(tenant, deviceId)) return false;
+    return this.#clock.now().getTime() <= record.expiresAtMs;
+  }
+  async markUsed(tenant, nonce) {
+    const record = this.#nonces.get(nonce);
+    if (record === void 0) return;
+    if (!record.owner.startsWith(tenantKey(tenant, ""))) return;
+    record.used = true;
+  }
+};
+
+// src/stores/in-memory/pairing-codes.ts
+var InMemoryPairingCodeStore = class {
+  #codes = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async issue(tenant, input) {
+    this.#codes.set(input.code, {
+      claims: { tenantId: tenant, productId: input.productId },
+      expiresAtMs: new Date(input.expiresAt).getTime(),
+      used: false
+    });
+    return { code: input.code, expiresAt: input.expiresAt };
+  }
+  async redeem(code) {
+    const record = this.#codes.get(code);
+    if (record === void 0) return void 0;
+    if (record.used) return void 0;
+    if (this.#clock.now().getTime() > record.expiresAtMs) return void 0;
+    record.used = true;
+    return record.claims;
+  }
+};
+var InMemoryRequestReceiptStore = class {
+  #receipts = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async record(tenant, input) {
+    const key = tenantKey(tenant, input.key);
+    const existing = this.#receipts.get(key);
+    if (existing !== void 0) return { receipt: existing, created: false };
+    const receipt = {
+      tenantId: tenant,
+      key: input.key,
+      body: input.body,
+      recordedAt: this.#clock.now().toISOString()
+    };
+    this.#receipts.set(key, receipt);
+    return { receipt, created: true };
+  }
+  async get(tenant, key) {
+    return this.#receipts.get(tenantKey(tenant, key));
+  }
+};
+var InMemoryProofRequestReceiptStore = class {
+  #receipts = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async record(tenant, input) {
+    const key = tenantKey(tenant, input.deviceId, input.requestId);
+    const existing = this.#receipts.get(key);
+    if (existing !== void 0) return { receipt: existing, created: false };
+    const receipt = {
+      tenantId: tenant,
+      ...input,
+      recordedAt: this.#clock.now().toISOString()
+    };
+    this.#receipts.set(key, receipt);
+    return { receipt, created: true };
+  }
+  async get(tenant, deviceId, requestId) {
+    return this.#receipts.get(tenantKey(tenant, deviceId, requestId));
+  }
+};
+var InMemoryTaskAttemptStore = class {
+  #attempts = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async open(tenant, input) {
+    const key = tenantKey(tenant, input.taskId);
+    const existing = this.#attempts.get(key);
+    if (existing !== void 0) return existing;
+    const attempt = {
+      tenantId: tenant,
+      taskId: input.taskId,
+      deviceId: input.deviceId,
+      status: "offered",
+      updatedAt: this.#now()
+    };
+    this.#attempts.set(key, attempt);
+    return attempt;
+  }
+  async get(tenant, taskId) {
+    return this.#attempts.get(tenantKey(tenant, taskId));
+  }
+  async claim(tenant, input) {
+    const key = tenantKey(tenant, input.taskId);
+    const existing = this.#attempts.get(key);
+    if (existing === void 0) return void 0;
+    if (existing.ownerDeviceId !== void 0) return existing;
+    const claimed = {
+      ...existing,
+      ownerDeviceId: input.deviceId,
+      status: "claimed",
+      updatedAt: this.#now()
+    };
+    this.#attempts.set(key, claimed);
+    return claimed;
+  }
+  async recordStatus(tenant, input) {
+    const key = tenantKey(tenant, input.taskId);
+    const existing = this.#attempts.get(key);
+    if (existing === void 0) return void 0;
+    const updated = { ...existing, status: input.status, updatedAt: this.#now() };
+    this.#attempts.set(key, updated);
+    return updated;
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/stores/in-memory/index.ts
+function createInMemoryCloudStores(clock, crypto, objects) {
+  const blobs = createInMemoryBlobs(clock, crypto, objects);
+  return {
+    stores: {
+      devices: new InMemoryDeviceDirectory(),
+      pairingCodes: new InMemoryPairingCodeStore(clock),
+      nonces: new InMemoryNonceStore(clock, crypto),
+      dedup: new InMemoryInboundDedupStore(),
+      tasks: new InMemoryTaskAttemptStore(clock),
+      receipts: new InMemoryRequestReceiptStore(clock),
+      proofReceipts: new InMemoryProofRequestReceiptStore(clock),
+      sequence: new InMemoryDeviceSequenceStore(),
+      blobs: blobs.blobs,
+      rateLimiter: new AllowAllRateLimiter()
+    },
+    blobContentProxy: blobs.contentProxy
+  };
+}
+
+// src/composition/in-memory.ts
+var TOKEN_SECRET_BYTES = 32;
+function systemClock() {
+  return { now: () => /* @__PURE__ */ new Date() };
+}
+function createInMemoryByokCloud(options = {}) {
+  const clock = options.clock ?? systemClock();
+  const crypto = options.crypto ?? createWebCrypto();
+  const core = createInMemoryCoreStores({ clock }).stores;
+  const { stores, blobContentProxy } = createInMemoryCloudStores(clock, crypto, core.objects);
+  const tokenSigner = options.tokenSigner ?? createHmacTokenSigner(globalThis.crypto.getRandomValues(new Uint8Array(TOKEN_SECRET_BYTES)), clock);
+  const cloud = createByokCloud({
+    core,
+    cloud: stores,
+    // This composition has nowhere else to put bytes, so it supplies the proxy
+    // and `fullCapabilityDeclaration()` declares `blobs.contentproxy`. That
+    // pairing is what keeps hosted-in-memory behavior identical to what it was
+    // before the port narrowed.
+    blobContentProxy,
+    crypto,
+    tokenSigner,
+    clock,
+    capabilities: options.capabilities ?? fullCapabilityDeclaration(),
+    ...options.truthCommitter === void 0 ? {} : { truthCommitter: options.truthCommitter },
+    ...options.truthObjectDownloads === void 0 ? {} : { truthObjectDownloads: options.truthObjectDownloads },
+    ...options.operatorId !== void 0 ? { operatorId: options.operatorId } : {},
+    ...options.maxBlobSizeBytes !== void 0 ? { maxBlobSizeBytes: options.maxBlobSizeBytes } : {},
+    ...options.longPollHoldMs !== void 0 ? { longPollHoldMs: options.longPollHoldMs } : {},
+    ...options.longPollIntervalMs !== void 0 ? { longPollIntervalMs: options.longPollIntervalMs } : {},
+    ...options.eventsPageLimit !== void 0 ? { eventsPageLimit: options.eventsPageLimit } : {},
+    ...options.accessTokenTtlSeconds !== void 0 ? { accessTokenTtlSeconds: options.accessTokenTtlSeconds } : {},
+    ...options.boardPageLimit === void 0 ? {} : { boardPageLimit: options.boardPageLimit },
+    ...options.boardStreamQueryIntervalMs === void 0 ? {} : { boardStreamQueryIntervalMs: options.boardStreamQueryIntervalMs },
+    ...options.boardStreamHeartbeatIntervalMs === void 0 ? {} : { boardStreamHeartbeatIntervalMs: options.boardStreamHeartbeatIntervalMs },
+    ...options.boardStreamReconciliationIntervalMs === void 0 ? {} : { boardStreamReconciliationIntervalMs: options.boardStreamReconciliationIntervalMs },
+    ...options.boardChannelMaxBytes === void 0 ? {} : { boardChannelMaxBytes: options.boardChannelMaxBytes },
+    ...options.boardTitleMaxBytes === void 0 ? {} : { boardTitleMaxBytes: options.boardTitleMaxBytes },
+    ...options.presenceTtlMs === void 0 ? {} : { presenceTtlMs: options.presenceTtlMs },
+    ...options.presenceMinimumIntervalMs === void 0 ? {} : { presenceMinimumIntervalMs: options.presenceMinimumIntervalMs },
+    ...options.presenceDetailMaxBytes === void 0 ? {} : { presenceDetailMaxBytes: options.presenceDetailMaxBytes },
+    ...options.activityMaxEvents === void 0 ? {} : { activityMaxEvents: options.activityMaxEvents },
+    ...options.activityMaxBytes === void 0 ? {} : { activityMaxBytes: options.activityMaxBytes },
+    ...options.activityCapacity === void 0 ? {} : { activityCapacity: options.activityCapacity },
+    ...options.activityTtlMs === void 0 ? {} : { activityTtlMs: options.activityTtlMs },
+    ...options.maxTruthRequestBytes === void 0 ? {} : { maxTruthRequestBytes: options.maxTruthRequestBytes }
+  });
+  return { cloud, core, stores, blobContentProxy, clock, crypto };
+}
+var BoardFeedItemSchema = z.object({
+  tenantId: z.string(),
+  itemId: z.string(),
+  channel: z.string(),
+  title: z.string(),
+  status: z.enum(BOARD_STATUSES),
+  assignee: z.object({ holderId: z.string(), heldSince: z.string() }).optional(),
+  boardSeq: z.number().int().nonnegative(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var BoardFeedPageSchema = z.object({
+  items: z.array(BoardFeedItemSchema),
+  nextSeq: z.number().int().nonnegative(),
+  hasMore: z.boolean()
+});
+var BoardFeedRetryableError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = "BoardFeedRetryableError";
+  }
+};
+var BoardFeedStoppedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "BoardFeedStoppedError";
+  }
+};
+var BoardFeedClient = class {
+  mode;
+  #base;
+  #accessToken;
+  #fetch;
+  #idleWatchdogMs;
+  constructor(options) {
+    assertCapability(options.capabilities, CLOUD_CAPABILITIES.boardCoordination);
+    this.mode = hasCapability(options.capabilities, CLOUD_CAPABILITIES.boardSse) ? "sse" : "poll";
+    this.#base = new URL(options.baseUrl);
+    this.#accessToken = options.accessToken;
+    this.#fetch = options.fetch ?? globalThis.fetch;
+    this.#idleWatchdogMs = options.idleWatchdogMs ?? 3e4;
+  }
+  async readOnce(afterSeq, signal) {
+    if (!Number.isSafeInteger(afterSeq) || afterSeq < 0) {
+      throw new TypeError("afterSeq must be a non-negative safe integer.");
+    }
+    return this.mode === "sse" ? this.#readSseOnce(afterSeq, signal) : this.#readPollOnce(afterSeq, signal);
+  }
+  async #readPollOnce(afterSeq, signal) {
+    const url = new URL("/byok/board", this.#base);
+    url.searchParams.set("since", String(afterSeq));
+    const response = await this.#fetch(url, {
+      headers: { authorization: `Bearer ${this.#accessToken}` },
+      ...signal === void 0 ? {} : { signal }
+    });
+    assertBoardResponse(response, "poll");
+    return { type: "poll", page: BoardFeedPageSchema.parse(await response.json()) };
+  }
+  async #readSseOnce(afterSeq, signal) {
+    const url = new URL("/byok/board/stream", this.#base);
+    const response = await this.#fetch(url, {
+      headers: {
+        accept: "text/event-stream",
+        authorization: `Bearer ${this.#accessToken}`,
+        "last-event-id": String(afterSeq)
+      },
+      ...signal === void 0 ? {} : { signal }
+    });
+    assertBoardResponse(response, "SSE");
+    if (response.body === null) throw new BoardFeedRetryableError("Board SSE response had no body.");
+    const reader = response.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = "";
+    try {
+      while (true) {
+        const chunk = await readWithWatchdog(reader, this.#idleWatchdogMs);
+        if (chunk.done) throw new BoardFeedRetryableError("Board SSE ended before the next event.");
+        buffer += decoder.decode(chunk.value, { stream: true }).replaceAll("\r\n", "\n");
+        let boundary = buffer.indexOf("\n\n");
+        while (boundary >= 0) {
+          const frame = buffer.slice(0, boundary);
+          buffer = buffer.slice(boundary + 2);
+          const parsed = parseSseFrame(frame);
+          if (parsed !== void 0) return parsed;
+          boundary = buffer.indexOf("\n\n");
+        }
+      }
+    } finally {
+      await reader.cancel().catch(() => void 0);
+    }
+  }
+};
+function assertBoardResponse(response, transport) {
+  if (response.status === 401) {
+    throw new BoardFeedStoppedError("Board credential is no longer valid.");
+  }
+  if (response.ok) return;
+  if (response.status >= 500) {
+    throw new BoardFeedRetryableError(`Board ${transport} failed with HTTP ${response.status}.`);
+  }
+  throw new BoardFeedStoppedError(
+    `Board ${transport} failed permanently with HTTP ${response.status}.`
+  );
+}
+async function readWithWatchdog(reader, timeoutMs) {
+  let timer;
+  try {
+    return await Promise.race([
+      reader.read(),
+      new Promise((_, reject) => {
+        timer = setTimeout(
+          () => reject(new BoardFeedRetryableError("Board SSE idle watchdog expired.")),
+          timeoutMs
+        );
+      })
+    ]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+function parseSseFrame(frame) {
+  if (frame.length === 0 || frame.startsWith(":")) return void 0;
+  let event = "message";
+  const data = [];
+  for (const line of frame.split("\n")) {
+    if (line.startsWith("event:")) event = line.slice("event:".length).trimStart();
+    if (line.startsWith("data:")) data.push(line.slice("data:".length).trimStart());
+  }
+  if (event === "reconcile") return { type: "reconcile" };
+  if (event !== "board") return void 0;
+  if (data.length === 0) throw new SyntaxError("Board SSE board event had no data.");
+  return { type: "board", item: BoardFeedItemSchema.parse(JSON.parse(data.join("\n"))) };
+}
+
+// src/stores/ports.ts
+var TASK_ATTEMPT_STATUSES = [
+  "offered",
+  "claimed",
+  "running",
+  "complete",
+  "failed",
+  "cancelled"
+];
+var CLOUD_STORE_NAMES = [
+  "devices",
+  "pairingCodes",
+  "nonces",
+  "dedup",
+  "tasks",
+  "receipts",
+  "proofReceipts",
+  "sequence",
+  "blobs",
+  "rateLimiter"
+];
+
+// src/stores/ports-contract.ts
+var CLOUD_PORT_METHODS = {
+  devices: ["register", "get", "revoke", "list", "resolveByDeviceId"],
+  pairingCodes: ["issue", "redeem"],
+  nonces: ["issue", "validate", "markUsed"],
+  dedup: ["checkAndRecord"],
+  tasks: ["open", "get", "claim", "recordStatus"],
+  receipts: ["record", "get"],
+  proofReceipts: ["record", "get"],
+  sequence: ["next"],
+  // Three methods, not six: the byte-proxy trio moved to `BlobContentProxy`,
+  // which is a composition input rather than a port and therefore has no row
+  // in this table (docs/researches/s4a-dataplane-design.md §6).
+  blobs: ["createUpload", "observeUpload", "getDownloadUrl"],
+  rateLimiter: ["consume"]
+};
+var CLOUD_PORT_INTERFACES = {
+  devices: "DeviceDirectory",
+  pairingCodes: "PairingCodeStore",
+  nonces: "NonceStore",
+  dedup: "InboundDedupStore",
+  tasks: "TaskAttemptStore",
+  receipts: "RequestReceiptStore",
+  proofReceipts: "ProofRequestReceiptStore",
+  sequence: "DeviceSequenceStore",
+  blobs: "CloudBlobStore",
+  rateLimiter: "InboundRateLimiter"
+};
+
+export { ACCESS_TOKEN_TTL_SECONDS, AllowAllRateLimiter, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, DEVICE_PROOF_HEADER, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryDeviceSequenceStore, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_SIGNING_DOMAIN, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, authenticateBearer, authenticateDeviceProof, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, verifyNonceSignature };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map