@byok-sdk/cloud 0.10.2 → 0.12.0

package/dist/auth/plane.d.ts

@@ -13,7 +13,7 @@
  *   claims never sit in handler scope as a tenant a handler could substitute;
  * - a device resolves to a row (the pre-tenant lookup, §6.2's pinned wire
  *   contract), and unknown/revoked collapse to one answer;
- * - nonce issue/validate/consume and token minting take that ROW, so the
+ * - nonce issue/atomic-consume and token minting take that ROW, so the
  *   tenant they act on is the row's, by construction.
  */
 import type { Clock, TenantId } from '@byok-sdk/core';
@@ -52,9 +52,8 @@ export interface AuthPlane {
     /** The pre-tenant device lookup §6.2's wire contract forces. `undefined` for unknown AND revoked alike — no existence oracle. */
     resolveDevice(deviceId: string): Promise<DeviceRecord | undefined>;
     issueNonce(device: DeviceRecord): Promise<string>;
-    validateNonce(device: DeviceRecord, nonce: string): Promise<boolean>;
-    /** Burn the nonce. Called only on a fully verified request (§6.2). */
-    consumeNonce(device: DeviceRecord, nonce: string): Promise<void>;
+    /** Atomically consume the nonce after signature verification (§6.2). */
+    consumeNonceIfValid(device: DeviceRecord, nonce: string): Promise<boolean>;
     /** Domain-separated (`byok-nonce-v1\n`) — see `verify.ts`. A raw signature over the bare nonce is invalid, with no second accepted form. */
     verifySignature(device: DeviceRecord, nonce: string, signature: string): Promise<boolean>;
     mintAccessToken(device: DeviceRecord): Promise<MintedAccessToken>;

package/dist/handlers/blobs.d.ts

@@ -31,6 +31,8 @@ export declare const BLOB_RESERVATION_TTL_MS: number;
  */
 export interface BlobContentRouteDeps {
     readonly contentProxy: BlobContentProxy;
+    /** Absolute ceiling independent of an untrusted Content-Length header. */
+    readonly maxUploadBytes: number;
 }
 export declare function createBlobHandler(deps: BlobRouteDeps): (c: Context) => Promise<Response>;
 export declare function finalizeBlobHandler(deps: BlobRouteDeps): (c: Context) => Promise<Response>;

package/dist/handlers/events.d.ts

@@ -11,9 +11,9 @@
  *   that hands back the same cursor replays the same page forever.
  * - **The ack is monotonic.** A cursor at or below what the device already
  *   acked carries no new information and is not an ack attempt; only a
- *   strictly higher one advances. The store's own
- *   `mailbox_cursor_regression` guard stays the authority on going backwards
- *   (asserted directly in `src/__tests__/mailbox-cursor.test.ts`).
+ *   strictly higher one advances. The store stays the authority on both
+ *   bounds: it rejects regression and refuses any cursor beyond the highest
+ *   one this route recorded immediately before returning it.
  * - **The hold.** An empty poll is held open instead of answered immediately,
  *   so an idle daemon is not a busy-loop. The hold is a bounded re-read, not a
  *   registered waiter: a waiter map is exactly the cross-request state a

package/dist/inbound.d.ts

@@ -40,10 +40,12 @@ export declare function handleAgentMessagePublish(stores: TenantStores, deviceId
 }) => Promise<{
     readonly outcome: 'accepted' | 'held' | 'refused';
     readonly reasonCode?: string;
-}>) | undefined): Promise<{
+}>) | undefined, alreadyDeduplicated: boolean): Promise<{
     readonly outcome: InboundOutcome;
     readonly disposition?: AgentMessageDispositionPayload;
 }>;
+/** Reads only a terminal immutable admission; pending rows have no disposition to acknowledge. */
+export declare function readAgentMessageDisposition(stores: TenantStores, deviceId: string, taskId: string, payload: AgentMessagePublishPayload): Promise<AgentMessageDispositionPayload | undefined>;
 /** Receipt key a task's terminal is recorded under — the idempotency seam S3b's journal will share. */
 export declare function terminalReceiptKey(taskId: string): string;
-export declare function handleInboundEnvelope(stores: TenantStores, deviceId: string, envelope: Envelope, activityBounds?: ActivityBounds): Promise<InboundOutcome>;
+export declare function handleInboundEnvelope(stores: TenantStores, deviceId: string, envelope: Envelope, activityBounds?: ActivityBounds, agentMessageConsume?: Parameters<typeof handleAgentMessagePublish>[4]): Promise<InboundOutcome>;

package/dist/index.d.ts

@@ -63,8 +63,8 @@ export { DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEVICE_PROOF_HEADER, MAX_DEVICE_PROOF_
 export type { PreparedTruthWrite, TruthBodyInput, TruthCommitInput, TruthCommitResponse, TruthCommitResult, TruthCommitter, TruthObjectDownloads, TruthRecordMetadata, TruthWriteRequest, } from './truth/contract';
 export { TruthCommitError, isTruthCommitError } from './truth/errors';
 export type { TruthCommitErrorCode } from './truth/errors';
-export { BLOB_READ_ERROR_CODES, CLOUD_STORE_NAMES, TASK_ATTEMPT_STATUSES } from './stores/ports';
+export { BLOB_READ_ERROR_CODES, CLOUD_STORE_NAMES, TASK_ATTEMPT_STATUSES, } from './stores/ports';
 export { CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS } from './stores/ports-contract';
-export type { BlobContent, BlobContentProxy, BlobDeclaration, BlobObservation, BlobReadErrorCode, BlobReadResult, BlobWriteResult, CloudBlobStore, CloudStoreName, CloudStores, DeviceDirectory, DeviceRecord, DeviceRegistration, InboundDedupStore, InboundRateLimiter, NonceStore, PairingCodeClaims, PairingCodeInfo, PairingCodeIssueInput, PairingCodeStore, ProofRequestReceipt, ProofRequestReceiptInput, ProofRequestReceiptStore, RequestReceipt, RequestReceiptStore, TaskAttempt, TaskAttemptStatus, TaskAttemptStore, AgentRef, AgentEgressRecord, AgentEgressStore, TaskCancellationMutation, TaskCancellationRequest, TaskCancellationStore, } from './stores/ports';
+export type { BlobContent, BlobContentProxy, BlobDeclaration, BlobObservation, BlobReadErrorCode, BlobReadResult, BlobWriteResult, CloudBlobStore, CloudStoreName, CloudStores, DeviceDirectory, DeviceRecord, DeviceRegistration, InboundDedupStore, InboundRateLimiter, NonceStore, PairingCodeClaims, PairingCodeInfo, PairingCodeIssueInput, PairingCodeStore, PairingEnrollment, PairingEnrollmentInput, ProofRequestReceipt, ProofRequestReceiptInput, ProofRequestReceiptStore, RequestReceipt, RequestReceiptStore, TaskAttempt, TaskAttemptStatus, TaskAttemptStore, AgentRef, AgentEgressRecord, AgentEgressStore, AgentMessageAdmission, TaskCancellationMutation, TaskCancellationRequest, TaskCancellationStore, } from './stores/ports';
 export { AllowAllRateLimiter, BLOB_URL_TTL_MS, DEDUP_RING_CAPACITY, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryActivityStore, InMemoryDeviceDirectory, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryRequestReceiptStore, InMemoryAgentEgressStore, InMemoryProofRequestReceiptStore, InMemoryTaskAttemptStore, InMemoryTaskCancellationStore, NONCE_TTL_MS, createInMemoryBlobs, createInMemoryCloudStores, } from './stores/in-memory/index';
 export type { InMemoryBlobStoreOptions, InMemoryBlobs, InMemoryCloudComposition, } from './stores/in-memory/index';