@byok-sdk/cloud 0.2.0 → 0.4.0

package/dist/index.js

@@ -1,6 +1,6 @@
-import { BOARD_STATUSES, PRESENCE_LEVELS, CapabilityDeclarationSchema, hasCapability, isTenantId, tenantId, principalTenant, parseDeviceProofEnvelope, deviceProofSigningInput, contentHash, parseCapabilityDeclaration, ByokCoreError, tenantKey, createInMemoryCoreStores, assertCapability, isCoreConflictError, isCoreError, TRUTH_RECORD_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS } from '@byok-sdk/core';
-export { isTenantId, tenantId } from '@byok-sdk/core';
-import { AgentEventOrUnknownSchema, DAEMON_TO_SERVER_TYPES, encodeEnvelope, createEnvelope, PairRequestSchema, ChallengeRequestSchema, TokenRequestSchema, decodeEnvelope, MessagesSendRequestSchema, CreateBlobRequestSchema } from '@byok-sdk/protocol';
+import { BOARD_STATUSES, PRESENCE_LEVELS, CapabilityDeclarationSchema, NONCE_SIGNING_DOMAIN, hasCapability, isTenantId, tenantId, principalTenant, parseDeviceProofEnvelope, deviceProofSigningInput, parseCapabilityDeclaration, ByokCoreError, tenantKey, createInMemoryCoreStores, assertCapability, contentHash, isCoreConflictError, isCoreError, DEVICE_PROOF_HEADER, TRUTH_RECORD_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS } from '@byok-sdk/core';
+export { DEVICE_PROOF_HEADER, NONCE_SIGNING_DOMAIN, isTenantId, tenantId } from '@byok-sdk/core';
+import { ConfiguredToolsetsSchema, AgentEventOrUnknownSchema, DAEMON_TO_SERVER_TYPES, encodeEnvelope, decodeEnvelope, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_BOARD_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, createEnvelope, PairRequestSchema, ChallengeRequestSchema, TokenRequestSchema, MessagesSendRequestSchema, CreateBlobRequestSchema, byokBlobContentPath } from '@byok-sdk/protocol';
 import { z } from 'zod';
 import { Hono } from 'hono';
 
@@ -160,9 +160,6 @@ function createHmacTokenSigner(secret, clock) {
     }
   };
 }
-
-// src/auth/verify.ts
-var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
 function verifyNonceSignature(crypto, devicePublicKey, nonce, signature) {
   return crypto.verifyEd25519(devicePublicKey, NONCE_SIGNING_DOMAIN + nonce, signature);
 }
@@ -256,16 +253,30 @@ var CLOUD_CAPABILITIES = {
   /** Bounded task activity batch publication. */
   activityTail: "activity.tail",
   /** Request-bound device proof record manifest/read/write surface (S6). */
-  truthRecords: "truth.records"
+  truthRecords: "truth.records",
+  /**
+   * Tenant-scoped skill pack distribution: the manifest list plus the per-file
+   * content route a paired device installs from.
+   *
+   * Hosted HTTP on purpose. A pack is DECLARATIVE CONTENT a device pulls after
+   * reading this declaration — not a message — so `@byok-sdk/protocol` gains
+   * nothing from it and the frozen v1 envelope stays untouched. Composition-
+   * bound like `truth.records`: a deployment that declares it without supplying
+   * a `SkillPackStore` is refused at construction rather than publishing two
+   * routes it would then 404.
+   */
+  skillPacks: "skills.pack"
 };
 var CapabilitiesResponseSchema = CapabilityDeclarationSchema;
 function fullCapabilityDeclaration(version = 1, options = {}) {
   return {
     schema: "byok-capabilities-v1",
     version,
-    capabilities: Object.values(CLOUD_CAPABILITIES).filter(
-      (capability) => capability !== CLOUD_CAPABILITIES.truthRecords || options.includeTruthRecords === true
-    )
+    capabilities: Object.values(CLOUD_CAPABILITIES).filter((capability) => {
+      if (capability === CLOUD_CAPABILITIES.truthRecords) return options.includeTruthRecords === true;
+      if (capability === CLOUD_CAPABILITIES.skillPacks) return options.includeSkillPacks === true;
+      return true;
+    })
   };
 }
 function declares(declaration, capability) {
@@ -279,11 +290,9 @@ var CLOUD_ERROR_CODES = {
   /** The composition handed a device row whose tenant is not a mintable `TenantId`. */
   device_tenant_invalid: "device_tenant_invalid",
   /**
-   * The mailbox assigned a row `seq` that disagrees with the delivery `seq`
-   * baked into the enqueued envelope. Loud rather than silent: those two
-   * numbers ARE the daemon's redelivery cursor, and a composition whose
-   * mailbox numbers rows differently from `DeviceSequenceStore` would
-   * mis-deliver every subsequent poll.
+   * The mailbox committed a row `seq` that disagrees with the delivery `seq`
+   * its body factory baked into the envelope. Loud rather than silent: those
+   * two numbers ARE the daemon's redelivery cursor.
    */
   mailbox_seq_mismatch: "mailbox_seq_mismatch",
   /** A capability declaration the host supplied that core refused. */
@@ -300,6 +309,13 @@ var CLOUD_ERROR_CODES = {
   capability_over_declared: "capability_over_declared",
   /** Host-supplied board labels or coordination input exceeded the explicit contract. */
   coordination_input_invalid: "coordination_input_invalid",
+  /**
+   * A terminal receipt whose stored body is not a terminal envelope — either
+   * undecodable or a non-terminal type. Whatever wrote that row broke the
+   * receipt-store contract, so the typed read model fails closed instead of
+   * projecting a best-effort shape.
+   */
+  terminal_receipt_unreadable: "terminal_receipt_unreadable",
   /** A progress/activity batch exceeded the configured event or byte ceiling. */
   activity_batch_too_large: "activity_batch_too_large"
 };
@@ -457,9 +473,6 @@ function tenantStoresFor(principal, root) {
       finalizeReservation: (input) => core.quota.finalizeReservation(tenant, input),
       abortReservation: (reservationId) => core.quota.abortReservation(tenant, reservationId)
     },
-    sequence: {
-      next: (deviceId) => cloud.sequence.next(tenant, deviceId)
-    },
     rateLimiter: {
       consume: (deviceId) => cloud.rateLimiter.consume(tenant, deviceId)
     }
@@ -1047,7 +1060,8 @@ function boardFailure(c, caught) {
 }
 var PresenceBodySchema = z.object({
   level: z.enum(PRESENCE_LEVELS),
-  detail: z.string().optional()
+  detail: z.string().optional(),
+  configuredToolsets: ConfiguredToolsetsSchema.optional()
 });
 var ActivityBodySchema = z.object({
   taskId: z.string().min(1).max(200),
@@ -1069,6 +1083,7 @@ function presencePublishHandler(deps) {
           deviceId: authenticated.device.deviceId,
           level: parsed.data.level,
           ...parsed.data.detail === void 0 ? {} : { detail: parsed.data.detail },
+          ...parsed.data.configuredToolsets === void 0 ? {} : { configuredToolsets: parsed.data.configuredToolsets },
           ttlMs: deps.ttlMs,
           minimumIntervalMs: deps.minimumIntervalMs
         }),
@@ -1104,6 +1119,33 @@ function activityAppendHandler(deps) {
     }
   };
 }
+var DEFAULT_SKILL_PACK_PAGE_LIMIT = 50;
+function skillPackListHandler(deps) {
+  return async (c) => {
+    const device = await authenticateBearer(c.req.header("authorization"), deps.bearer);
+    if (device === void 0) return unauthorized(c);
+    const packs = await deps.skillPacks.list(principalTenant(device), { limit: deps.pageLimit });
+    return c.json({ packs }, 200);
+  };
+}
+function skillPackFileHandler(deps) {
+  return async (c) => {
+    const device = await authenticateBearer(c.req.header("authorization"), deps.bearer);
+    if (device === void 0) return unauthorized(c);
+    const name = c.req.param("name");
+    const path = c.req.param("path");
+    if (name === void 0 || path === void 0) return notFound(c);
+    const file = await deps.skillPacks.readFile(principalTenant(device), name, path);
+    if (file === void 0) return notFound(c);
+    return c.json(file, 200);
+  };
+}
+function unauthorized(c) {
+  return c.json({ error: "unauthorized" }, 401);
+}
+function notFound(c) {
+  return c.json({ error: "skill_pack_not_found" }, 404);
+}
 var DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS = 6e4;
 var MAX_DEVICE_PROOF_CLOCK_SKEW_MS = 5 * 6e4;
 var DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS = 5 * 6e4;
@@ -1268,7 +1310,6 @@ function isTruthCommitError(value) {
 }
 
 // src/handlers/truth.ts
-var DEVICE_PROOF_HEADER = "x-byok-device-proof";
 var DEFAULT_MAX_TRUTH_REQUEST_BYTES = 2 * 1024 * 1024;
 var MAX_DEVICE_PROOF_HEADER_BYTES = 16 * 1024;
 var EMPTY_BODY = new Uint8Array();
@@ -1280,7 +1321,7 @@ function truthManifestHandler(deps) {
       operation: "truth.list",
       resource: "records"
     });
-    if (authenticated === void 0) return unauthorized(c);
+    if (authenticated === void 0) return unauthorized2(c);
     const query = manifestQuery(c);
     if (query === void 0) return c.json({ error: "invalid truth manifest query" }, 400);
     const records = await deps.truth.listManifest(principalTenant(authenticated.device), query);
@@ -1295,7 +1336,7 @@ function truthGetHandler(deps) {
       operation: "truth.read",
       resource
     });
-    if (authenticated === void 0) return unauthorized(c);
+    if (authenticated === void 0) return unauthorized2(c);
     const selector = recordSelector(c);
     if (selector === void 0) return c.json({ error: "invalid truth record selector" }, 400);
     const record = await deps.truth.getRecord(principalTenant(authenticated.device), selector);
@@ -1322,7 +1363,7 @@ function truthPutHandler(deps) {
       operation: "truth.write",
       resource: rawRecordResource(c)
     });
-    if (authenticated === void 0) return unauthorized(c);
+    if (authenticated === void 0) return unauthorized2(c);
     const selector = recordSelector(c);
     if (selector === void 0) return c.json({ error: "invalid truth record selector" }, 400);
     const parsedJson = parseJsonBytes(body);
@@ -1467,7 +1508,7 @@ function parseJsonBytes(bytes) {
     return void 0;
   }
 }
-function unauthorized(c) {
+function unauthorized2(c) {
   return c.json({ error: "unauthorized" }, 401);
 }
 function truthFailure(c, caught) {
@@ -1523,6 +1564,50 @@ var CloudRouteRegistry = class {
     return this.#app.fetch;
   }
 };
+function projectTerminalResult(taskId, receipt) {
+  let envelope;
+  try {
+    envelope = decodeEnvelope(receipt.body);
+  } catch (cause) {
+    throw new ByokCloudError(
+      "terminal_receipt_unreadable",
+      `The terminal receipt for task ${taskId} holds a body that is not a decodable envelope.`,
+      { cause }
+    );
+  }
+  switch (envelope.type) {
+    case "task.complete":
+      return {
+        taskId,
+        state: "complete",
+        summary: envelope.payload.summary,
+        sessionRef: envelope.payload.sessionRef,
+        ...envelope.payload.artifactRefs !== void 0 ? { artifactRefs: envelope.payload.artifactRefs } : {},
+        ...envelope.payload.document !== void 0 ? { document: envelope.payload.document } : {},
+        recordedAt: receipt.recordedAt
+      };
+    case "task.fail":
+      return {
+        taskId,
+        state: "failed",
+        reason: envelope.payload.reason,
+        ...envelope.payload.retryable !== void 0 ? { retryable: envelope.payload.retryable } : {},
+        recordedAt: receipt.recordedAt
+      };
+    case "task.cancelled":
+      return {
+        taskId,
+        state: "cancelled",
+        ...envelope.payload.reason !== void 0 ? { reason: envelope.payload.reason } : {},
+        recordedAt: receipt.recordedAt
+      };
+    default:
+      throw new ByokCloudError(
+        "terminal_receipt_unreadable",
+        `The terminal receipt for task ${taskId} holds a ${envelope.type} envelope, which is not a terminal type.`
+      );
+  }
+}
 
 // src/cloud.ts
 var DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;
@@ -1535,7 +1620,8 @@ function createByokCloud(options) {
     declaration,
     options.blobContentProxy,
     options.truthCommitter,
-    options.truthObjectDownloads
+    options.truthObjectDownloads,
+    options.skillPacks
   );
   const root = { core: options.core, cloud: options.cloud };
   const auth = createAuthPlane({
@@ -1556,16 +1642,16 @@ function createByokCloud(options) {
     capacity: options.activityCapacity ?? DEFAULT_ACTIVITY_CAPACITY,
     ttlMs: options.activityTtlMs ?? DEFAULT_ACTIVITY_TTL_MS
   };
-  registry.register({ method: "POST", path: "/byok/pair", class: "public" }, pairHandler({ auth }));
-  registry.register({ method: "POST", path: "/byok/challenge", class: "public" }, challengeHandler({ auth }));
-  registry.register({ method: "POST", path: "/byok/token", class: "public" }, tokenHandler({ auth }));
+  registry.register({ method: "POST", path: BYOK_PAIR_PATH, class: "public" }, pairHandler({ auth }));
+  registry.register({ method: "POST", path: BYOK_CHALLENGE_PATH, class: "public" }, challengeHandler({ auth }));
+  registry.register({ method: "POST", path: BYOK_TOKEN_PATH, class: "public" }, tokenHandler({ auth }));
   registry.register(
-    { method: "GET", path: "/byok/capabilities", class: "public" },
+    { method: "GET", path: BYOK_CAPABILITIES_PATH, class: "public" },
     capabilitiesHandler({ declaration })
   );
   if (declares(declaration, CLOUD_CAPABILITIES.eventsLongPoll)) {
     registry.register(
-      { method: "GET", path: "/byok/events", class: "device" },
+      { method: "GET", path: BYOK_EVENTS_PATH, class: "device" },
       eventsHandler({
         ...deviceRouteDeps,
         longPollHoldMs: options.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS,
@@ -1576,7 +1662,7 @@ function createByokCloud(options) {
   }
   if (declares(declaration, CLOUD_CAPABILITIES.messagesBatch)) {
     registry.register(
-      { method: "POST", path: "/byok/messages", class: "device" },
+      { method: "POST", path: BYOK_MESSAGES_PATH, class: "device" },
       messagesHandler({ ...deviceRouteDeps, activityBounds })
     );
   }
@@ -1585,23 +1671,23 @@ function createByokCloud(options) {
       ...deviceRouteDeps,
       pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT
     };
-    registry.register({ method: "GET", path: "/byok/board", class: "device" }, boardListHandler(boardDeps));
+    registry.register({ method: "GET", path: BYOK_BOARD_PATH, class: "device" }, boardListHandler(boardDeps));
     registry.register(
-      { method: "POST", path: "/byok/board/:id/claim", class: "device" },
+      { method: "POST", path: BYOK_BOARD_CLAIM_ROUTE, class: "device" },
       boardClaimHandler(deviceRouteDeps)
     );
     registry.register(
-      { method: "POST", path: "/byok/board/:id/unclaim", class: "device" },
+      { method: "POST", path: BYOK_BOARD_UNCLAIM_ROUTE, class: "device" },
       boardUnclaimHandler(deviceRouteDeps)
     );
     registry.register(
-      { method: "POST", path: "/byok/board/:id/status", class: "device" },
+      { method: "POST", path: BYOK_BOARD_STATUS_ROUTE, class: "device" },
       boardStatusHandler(deviceRouteDeps)
     );
   }
   if (declares(declaration, CLOUD_CAPABILITIES.boardSse)) {
     registry.register(
-      { method: "GET", path: "/byok/board/stream", class: "device" },
+      { method: "GET", path: BYOK_BOARD_STREAM_PATH, class: "device" },
       boardStreamHandler({
         ...deviceRouteDeps,
         pageLimit: options.boardPageLimit ?? DEFAULT_BOARD_PAGE_LIMIT,
@@ -1613,7 +1699,7 @@ function createByokCloud(options) {
   }
   if (declares(declaration, CLOUD_CAPABILITIES.presenceHints)) {
     registry.register(
-      { method: "PUT", path: "/byok/presence", class: "device" },
+      { method: "PUT", path: BYOK_PRESENCE_PATH, class: "device" },
       presencePublishHandler({
         ...deviceRouteDeps,
         ttlMs: options.presenceTtlMs ?? DEFAULT_PRESENCE_TTL_MS,
@@ -1624,7 +1710,7 @@ function createByokCloud(options) {
   }
   if (declares(declaration, CLOUD_CAPABILITIES.activityTail)) {
     registry.register(
-      { method: "POST", path: "/byok/activity", class: "device" },
+      { method: "POST", path: BYOK_ACTIVITY_PATH, class: "device" },
       activityAppendHandler({ ...deviceRouteDeps, bounds: activityBounds })
     );
   }
@@ -1642,36 +1728,52 @@ function createByokCloud(options) {
       maxRequestBytes: options.maxTruthRequestBytes ?? DEFAULT_MAX_TRUTH_REQUEST_BYTES
     };
     registry.register(
-      { method: "GET", path: "/byok/records", class: "proof" },
+      { method: "GET", path: BYOK_RECORDS_PATH, class: "proof" },
       truthManifestHandler(truthDeps)
     );
     registry.register(
-      { method: "GET", path: "/byok/records/:kind/:key", class: "proof" },
+      { method: "GET", path: BYOK_RECORD_ROUTE, class: "proof" },
       truthGetHandler(truthDeps)
     );
     registry.register(
-      { method: "PUT", path: "/byok/records/:kind/:key", class: "proof" },
+      { method: "PUT", path: BYOK_RECORD_ROUTE, class: "proof" },
       truthPutHandler(truthDeps)
     );
   }
+  const skillPacks = options.skillPacks;
+  if (skillPacks !== void 0 && declares(declaration, CLOUD_CAPABILITIES.skillPacks)) {
+    const skillPackDeps = {
+      bearer: deviceRouteDeps.bearer,
+      skillPacks,
+      pageLimit: options.skillPackPageLimit ?? DEFAULT_SKILL_PACK_PAGE_LIMIT
+    };
+    registry.register(
+      { method: "GET", path: BYOK_SKILL_PACKS_PATH, class: "device" },
+      skillPackListHandler(skillPackDeps)
+    );
+    registry.register(
+      { method: "GET", path: BYOK_SKILL_PACK_FILE_ROUTE, class: "device" },
+      skillPackFileHandler(skillPackDeps)
+    );
+  }
   if (declares(declaration, CLOUD_CAPABILITIES.blobsPresigned)) {
     const blobDeps = {
       ...deviceRouteDeps,
       maxBlobSizeBytes: options.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES
     };
-    registry.register({ method: "POST", path: "/byok/blobs", class: "device" }, createBlobHandler(blobDeps));
-    registry.register({ method: "POST", path: "/byok/blobs/:id/finalize", class: "device" }, finalizeBlobHandler(blobDeps));
-    registry.register({ method: "GET", path: "/byok/blobs/:id/url", class: "device" }, blobDownloadUrlHandler(blobDeps));
+    registry.register({ method: "POST", path: BYOK_BLOBS_PATH, class: "device" }, createBlobHandler(blobDeps));
+    registry.register({ method: "POST", path: BYOK_BLOB_FINALIZE_ROUTE, class: "device" }, finalizeBlobHandler(blobDeps));
+    registry.register({ method: "GET", path: BYOK_BLOB_URL_ROUTE, class: "device" }, blobDownloadUrlHandler(blobDeps));
   }
   const contentProxy = options.blobContentProxy;
   if (contentProxy !== void 0 && declares(declaration, CLOUD_CAPABILITIES.blobsContentProxy)) {
     const contentDeps = { contentProxy };
     registry.register(
-      { method: "PUT", path: "/byok/blobs/:id/content", class: "presigned" },
+      { method: "PUT", path: BYOK_BLOB_CONTENT_ROUTE, class: "presigned" },
       blobUploadContentHandler(contentDeps)
     );
     registry.register(
-      { method: "GET", path: "/byok/blobs/:id/content", class: "presigned" },
+      { method: "GET", path: BYOK_BLOB_CONTENT_ROUTE, class: "presigned" },
       blobDownloadContentHandler(contentDeps)
     );
   }
@@ -1679,6 +1781,34 @@ function createByokCloud(options) {
   function controlPlane(tenant) {
     return { kind: "control-plane", tenantId: tenant, operatorId };
   }
+  async function enqueueTaskEnvelope(tenant, deviceId, requestedTaskId, buildEnvelope) {
+    const stores = tenantStoresFor(controlPlane(tenant), root);
+    const taskId = requestedTaskId ?? `task_${options.crypto.randomUuid()}`;
+    const messageId = options.crypto.randomUuid();
+    const message = await stores.mailbox.append({
+      deviceId,
+      messageId,
+      materialize: async (seq) => {
+        const envelope2 = buildEnvelope(taskId, seq, messageId);
+        const body = encodeEnvelope(envelope2);
+        const bytes = new TextEncoder().encode(body);
+        return {
+          body,
+          bodyHash: contentHash(await options.crypto.sha256(bytes)),
+          byteSize: BigInt(bytes.length)
+        };
+      }
+    });
+    const envelope = decodeEnvelope(message.body);
+    if (envelope.seq !== message.seq) {
+      throw new ByokCloudError(
+        "mailbox_seq_mismatch",
+        `Mailbox stored offer seq ${String(envelope.seq)} at row ${message.seq}; the daemon's redelivery cursor would be wrong.`
+      );
+    }
+    const attempt = await stores.tasks.open({ taskId, deviceId });
+    return { taskId, seq: message.seq, envelope, attempt };
+  }
   return {
     fetch: registry.fetch,
     routes: registry.routes,
@@ -1688,27 +1818,20 @@ function createByokCloud(options) {
       return auth.createPairingCode(tenant, input);
     },
     async enqueueOffer(tenant, deviceId, input) {
-      const stores = tenantStoresFor(controlPlane(tenant), root);
-      const taskId = input.taskId ?? `task_${options.crypto.randomUuid()}`;
-      const seq = await stores.sequence.next(deviceId);
-      const envelope = createEnvelope("task.offer", input.payload, { taskId, seq });
-      const body = encodeEnvelope(envelope);
-      const bytes = new TextEncoder().encode(body);
-      const message = await stores.mailbox.append({
+      return enqueueTaskEnvelope(
+        tenant,
         deviceId,
-        body,
-        bodyHash: contentHash(await options.crypto.sha256(bytes)),
-        byteSize: BigInt(bytes.length),
-        messageId: envelope.id
-      });
-      if (message.seq !== seq) {
-        throw new ByokCloudError(
-          "mailbox_seq_mismatch",
-          `Mailbox numbered this offer ${message.seq} while the delivery sequence allocated ${seq}; the daemon's redelivery cursor would be wrong.`
-        );
-      }
-      const attempt = await stores.tasks.open({ taskId, deviceId });
-      return { taskId, seq, envelope, attempt };
+        input.taskId,
+        (taskId, seq, messageId) => createEnvelope("task.offer", input.payload, { id: messageId, taskId, seq })
+      );
+    },
+    async enqueueToolsetOffer(tenant, deviceId, input) {
+      return enqueueTaskEnvelope(
+        tenant,
+        deviceId,
+        input.taskId,
+        (taskId, seq, messageId) => createEnvelope("task.offer_with_toolsets", input.payload, { id: messageId, taskId, seq })
+      );
     },
     readTaskAttempt(tenant, taskId) {
       return tenantStoresFor(controlPlane(tenant), root).tasks.get(taskId);
@@ -1716,6 +1839,12 @@ function createByokCloud(options) {
     readTerminalReceipt(tenant, taskId) {
       return tenantStoresFor(controlPlane(tenant), root).receipts.get(terminalReceiptKey(taskId));
     },
+    async readTaskResult(tenant, taskId) {
+      const receipt = await tenantStoresFor(controlPlane(tenant), root).receipts.get(
+        terminalReceiptKey(taskId)
+      );
+      return receipt === void 0 ? void 0 : projectTerminalResult(taskId, receipt);
+    },
     listDevices(tenant) {
       return tenantStoresFor(controlPlane(tenant), root).devices.list();
     },
@@ -1747,7 +1876,7 @@ function createByokCloud(options) {
     }
   };
 }
-function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, truthObjectDownloads) {
+function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, truthObjectDownloads, skillPacks) {
   if (declares(declaration, CLOUD_CAPABILITIES.boardSse) && !declares(declaration, CLOUD_CAPABILITIES.boardCoordination)) {
     throw new ByokCloudError(
       "capability_over_declared",
@@ -1772,6 +1901,12 @@ function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, trut
       `This deployment declares ${CLOUD_CAPABILITIES.truthRecords} but was given no content-hash keyed TruthObjectDownloads authority.`
     );
   }
+  if (skillPacks === void 0 && declares(declaration, CLOUD_CAPABILITIES.skillPacks)) {
+    throw new ByokCloudError(
+      "capability_over_declared",
+      `This deployment declares ${CLOUD_CAPABILITIES.skillPacks} but was given no SkillPackStore, so both /byok/skill-packs routes would be published and unserved.`
+    );
+  }
 }
 function parseDeclaration(declaration) {
   try {
@@ -1809,7 +1944,7 @@ var InMemoryBlobRegistry = class {
   async signUrl(blobId, action) {
     const exp = this.clock.now().getTime() + this.urlTtlMs;
     const sig = await this.computeSig(blobId, action, exp);
-    return `/byok/blobs/${blobId}/content?sig=${sig}&exp=${exp}`;
+    return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;
   }
   computeSig(blobId, action, exp) {
     return this.crypto.hmacSha256(this.secret, `${blobId}:${action}:${exp}`);
@@ -1966,15 +2101,6 @@ var InMemoryDeviceDirectory = class {
     return key === void 0 ? void 0 : this.#byTenant.get(key);
   }
 };
-var InMemoryDeviceSequenceStore = class {
-  #next = /* @__PURE__ */ new Map();
-  async next(tenant, deviceId) {
-    const key = tenantKey(tenant, deviceId);
-    const seq = this.#next.get(key) ?? 1;
-    this.#next.set(key, seq + 1);
-    return seq;
-  }
-};
 var DEDUP_RING_CAPACITY = 1024;
 var InMemoryInboundDedupStore = class {
   #rings = /* @__PURE__ */ new Map();
@@ -2173,7 +2299,6 @@ function createInMemoryCloudStores(clock, crypto, objects) {
       tasks: new InMemoryTaskAttemptStore(clock),
       receipts: new InMemoryRequestReceiptStore(clock),
       proofReceipts: new InMemoryProofRequestReceiptStore(clock),
-      sequence: new InMemoryDeviceSequenceStore(),
       blobs: blobs.blobs,
       rateLimiter: new AllowAllRateLimiter()
     },
@@ -2225,7 +2350,9 @@ function createInMemoryByokCloud(options = {}) {
     ...options.activityMaxBytes === void 0 ? {} : { activityMaxBytes: options.activityMaxBytes },
     ...options.activityCapacity === void 0 ? {} : { activityCapacity: options.activityCapacity },
     ...options.activityTtlMs === void 0 ? {} : { activityTtlMs: options.activityTtlMs },
-    ...options.maxTruthRequestBytes === void 0 ? {} : { maxTruthRequestBytes: options.maxTruthRequestBytes }
+    ...options.maxTruthRequestBytes === void 0 ? {} : { maxTruthRequestBytes: options.maxTruthRequestBytes },
+    ...options.skillPacks === void 0 ? {} : { skillPacks: options.skillPacks },
+    ...options.skillPackPageLimit === void 0 ? {} : { skillPackPageLimit: options.skillPackPageLimit }
   });
   return { cloud, core, stores, blobContentProxy, clock, crypto };
 }
@@ -2278,7 +2405,7 @@ var BoardFeedClient = class {
     return this.mode === "sse" ? this.#readSseOnce(afterSeq, signal) : this.#readPollOnce(afterSeq, signal);
   }
   async #readPollOnce(afterSeq, signal) {
-    const url = new URL("/byok/board", this.#base);
+    const url = new URL(BYOK_BOARD_PATH, this.#base);
     url.searchParams.set("since", String(afterSeq));
     const response = await this.#fetch(url, {
       headers: { authorization: `Bearer ${this.#accessToken}` },
@@ -2288,7 +2415,7 @@ var BoardFeedClient = class {
     return { type: "poll", page: BoardFeedPageSchema.parse(await response.json()) };
   }
   async #readSseOnce(afterSeq, signal) {
-    const url = new URL("/byok/board/stream", this.#base);
+    const url = new URL(BYOK_BOARD_STREAM_PATH, this.#base);
     const response = await this.#fetch(url, {
       headers: {
         accept: "text/event-stream",
@@ -2380,7 +2507,6 @@ var CLOUD_STORE_NAMES = [
   "tasks",
   "receipts",
   "proofReceipts",
-  "sequence",
   "blobs",
   "rateLimiter"
 ];
@@ -2394,7 +2520,6 @@ var CLOUD_PORT_METHODS = {
   tasks: ["open", "get", "claim", "recordStatus"],
   receipts: ["record", "get"],
   proofReceipts: ["record", "get"],
-  sequence: ["next"],
   // Three methods, not six: the byte-proxy trio moved to `BlobContentProxy`,
   // which is a composition input rather than a port and therefore has no row
   // in this table (docs/researches/s4a-dataplane-design.md §6).
@@ -2409,11 +2534,10 @@ var CLOUD_PORT_INTERFACES = {
   tasks: "TaskAttemptStore",
   receipts: "RequestReceiptStore",
   proofReceipts: "ProofRequestReceiptStore",
-  sequence: "DeviceSequenceStore",
   blobs: "CloudBlobStore",
   rateLimiter: "InboundRateLimiter"
 };
 
-export { ACCESS_TOKEN_TTL_SECONDS, AllowAllRateLimiter, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, DEVICE_PROOF_HEADER, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryDeviceSequenceStore, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_SIGNING_DOMAIN, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, authenticateBearer, authenticateDeviceProof, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, verifyNonceSignature };
+export { ACCESS_TOKEN_TTL_SECONDS, AllowAllRateLimiter, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEFAULT_SKILL_PACK_PAGE_LIMIT, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, authenticateBearer, authenticateDeviceProof, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, projectTerminalResult, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, verifyNonceSignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map