@byok-sdk/cloud 0.4.0 → 0.4.2

package/dist/index.js

@@ -1,6 +1,6 @@
 import { BOARD_STATUSES, PRESENCE_LEVELS, CapabilityDeclarationSchema, NONCE_SIGNING_DOMAIN, hasCapability, isTenantId, tenantId, principalTenant, parseDeviceProofEnvelope, deviceProofSigningInput, parseCapabilityDeclaration, ByokCoreError, tenantKey, createInMemoryCoreStores, assertCapability, contentHash, isCoreConflictError, isCoreError, DEVICE_PROOF_HEADER, TRUTH_RECORD_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS } from '@byok-sdk/core';
 export { DEVICE_PROOF_HEADER, NONCE_SIGNING_DOMAIN, isTenantId, tenantId } from '@byok-sdk/core';
-import { ConfiguredToolsetsSchema, AgentEventOrUnknownSchema, DAEMON_TO_SERVER_TYPES, encodeEnvelope, decodeEnvelope, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_BOARD_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, createEnvelope, PairRequestSchema, ChallengeRequestSchema, TokenRequestSchema, MessagesSendRequestSchema, CreateBlobRequestSchema, byokBlobContentPath } from '@byok-sdk/protocol';
+import { AgentEventOrUnknownSchema, ConfiguredToolsetsSchema, DAEMON_TO_SERVER_TYPES, encodeEnvelope, decodeEnvelope, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_BOARD_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, createEnvelope, PairRequestSchema, ChallengeRequestSchema, TokenRequestSchema, MessagesSendRequestSchema, CreateBlobRequestSchema, byokBlobContentPath } from '@byok-sdk/protocol';
 import { z } from 'zod';
 import { Hono } from 'hono';
 
@@ -332,12 +332,79 @@ function isCloudError(value, code) {
   return code === void 0 || value.code === code;
 }
 
+// src/activity.ts
+var DEFAULT_ACTIVITY_CAPACITY = 50;
+var ActivityTaskIdSchema = z.string().min(1).max(200);
+var SourceEnvelopeIdSchema = z.string().max(200).regex(/\S/, "sourceEnvelopeId must not be blank");
+var ActivityAppendRequestSchema = z.object({
+  taskId: ActivityTaskIdSchema,
+  sourceEnvelopeId: SourceEnvelopeIdSchema,
+  batchSeq: z.number().int().nonnegative(),
+  events: z.array(AgentEventOrUnknownSchema).min(1),
+  dropped: z.number().int().nonnegative()
+});
+var TimelineEventSchema = z.object({
+  taskId: ActivityTaskIdSchema,
+  sourceEnvelopeId: SourceEnvelopeIdSchema,
+  batchSeq: z.number().int().nonnegative(),
+  eventIndex: z.number().int().nonnegative(),
+  receivedAt: z.iso.datetime(),
+  event: AgentEventOrUnknownSchema
+});
+function validateActivityAppend(input) {
+  if (!Number.isFinite(input.ttlMs) || input.ttlMs <= 0) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Activity ttl must be a positive number of milliseconds, received ${String(input.ttlMs)}.`
+    );
+  }
+  const capacity = input.capacity ?? DEFAULT_ACTIVITY_CAPACITY;
+  if (!Number.isSafeInteger(capacity) || capacity <= 0) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Activity capacity must be a positive integer, received ${String(capacity)}.`
+    );
+  }
+  const parsed = ActivityAppendRequestSchema.safeParse(input);
+  if (!parsed.success) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      "Activity batches require stable source identity, order, at least one valid event, and a non-negative dropped count."
+    );
+  }
+  return capacity;
+}
+function projectTimelineEvents(input, receivedAt) {
+  return input.events.map(
+    (event, eventIndex) => TimelineEventSchema.parse({
+      taskId: input.taskId,
+      sourceEnvelopeId: input.sourceEnvelopeId,
+      batchSeq: input.batchSeq,
+      eventIndex,
+      receivedAt,
+      event
+    })
+  );
+}
+function parseTimelineEvents(value) {
+  return z.array(TimelineEventSchema).parse(value);
+}
+function compareTimelineEvents(left, right) {
+  return left.batchSeq - right.batchSeq || left.eventIndex - right.eventIndex;
+}
+function activityCursor(entries) {
+  const last = entries.at(-1);
+  return last === void 0 ? void 0 : { batchSeq: last.batchSeq, eventIndex: last.eventIndex };
+}
+function activityTailKey(tenant, taskId) {
+  return tenantKey(tenant, taskId);
+}
+
 // src/coordination.ts
 var DEFAULT_BOARD_CHANNEL_MAX_BYTES = 128;
 var DEFAULT_BOARD_TITLE_MAX_BYTES = 512;
 var DEFAULT_ACTIVITY_MAX_EVENTS = 50;
 var DEFAULT_ACTIVITY_MAX_BYTES = 64 * 1024;
-var DEFAULT_ACTIVITY_CAPACITY = 50;
 var DEFAULT_ACTIVITY_TTL_MS = 10 * 6e4;
 var DEFAULT_PRESENCE_TTL_MS = 9e4;
 var DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS = 5e3;
@@ -363,7 +430,7 @@ function assertBoardLabels(channel, title, limits) {
     );
   }
 }
-function activityDetails(events, dropped, bounds) {
+function validateActivityEvents(events, dropped, bounds) {
   if (!Number.isSafeInteger(dropped) || dropped < 0) {
     throw new ByokCloudError(
       "coordination_input_invalid",
@@ -383,12 +450,18 @@ function activityDetails(events, dropped, bounds) {
       `Activity batch exceeds ${bounds.maxBytes} UTF-8 bytes.`
     );
   }
-  return events.map((event) => JSON.stringify(event));
+}
+function validateActivityBatch(input, bounds) {
+  validateActivityEvents(input.events, input.dropped, bounds);
+  validateActivityAppend({ ...input, ttlMs: bounds.ttlMs, capacity: bounds.capacity });
 }
 async function appendActivityEvents(activity, input, bounds) {
+  validateActivityBatch(input, bounds);
   return activity.append({
     taskId: input.taskId,
-    details: activityDetails(input.events, input.dropped, bounds),
+    sourceEnvelopeId: input.sourceEnvelopeId,
+    batchSeq: input.batchSeq,
+    events: input.events,
     dropped: input.dropped,
     ttlMs: bounds.ttlMs,
     capacity: bounds.capacity
@@ -441,8 +514,12 @@ function tenantStoresFor(principal, root) {
       list: () => core.presence.list(tenant)
     },
     activity: {
-      append: (input) => core.activity.append(tenant, input),
-      read: (taskId) => core.activity.read(tenant, taskId)
+      append: (input) => cloud.activity.append(tenant, input),
+      read: (taskId) => cloud.activity.read(tenant, taskId)
+    },
+    approvals: {
+      append: (input) => cloud.approvals.append(tenant, input),
+      read: (taskId) => cloud.approvals.read(tenant, taskId)
     },
     devices: {
       get: (deviceId) => cloud.devices.get(tenant, deviceId),
@@ -675,6 +752,7 @@ function tokenHandler(deps) {
     return c.json(response, 200);
   };
 }
+var CLOUD_PROTOCOL_CAPABILITIES = ["result-document"];
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -703,15 +781,92 @@ function eventsHandler(deps) {
       });
       if (page.messages.length > 0) {
         const events = page.messages.map((message) => decodeEnvelope(message.body));
-        const response2 = { events, cursor: page.nextSeq };
+        const response2 = {
+          events,
+          cursor: page.nextSeq,
+          capabilities: CLOUD_PROTOCOL_CAPABILITIES
+        };
         return c.json(response2, 200);
       }
       if (attempt < attempts - 1) await sleep(deps.longPollIntervalMs);
     }
-    const response = { events: [], cursor };
+    const response = {
+      events: [],
+      cursor,
+      capabilities: CLOUD_PROTOCOL_CAPABILITIES
+    };
     return c.json(response, 200);
   };
 }
+var DEFAULT_APPROVAL_TIMELINE_CAPACITY = 50;
+var DEFAULT_APPROVAL_TIMELINE_TTL_MS = 10 * 60 * 1e3;
+var APPROVAL_SUMMARY_MAX_BYTES = 16 * 1024;
+var NonBlankIdSchema = z.string().max(200).regex(/\S/, "value must not be blank");
+var TaskIdSchema = z.string().min(1).max(200);
+var ApprovalTimelineEventSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("approval_requested"),
+    summary: z.string(),
+    approvalId: NonBlankIdSchema.optional()
+  }),
+  z.object({
+    type: z.literal("approval_resolved"),
+    approvalId: NonBlankIdSchema,
+    decision: z.enum(["approve", "reject"]),
+    resolvedBy: z.enum(["local"]),
+    at: z.iso.datetime({ offset: true })
+  })
+]);
+var ApprovalObservationSchema = z.object({
+  taskId: TaskIdSchema,
+  sourceEnvelopeId: NonBlankIdSchema,
+  revision: z.number().int().positive(),
+  receivedAt: z.iso.datetime(),
+  event: ApprovalTimelineEventSchema
+});
+function validateApprovalTimelineAppend(input) {
+  const capacity = input.capacity ?? DEFAULT_APPROVAL_TIMELINE_CAPACITY;
+  const ttlMs = input.ttlMs ?? DEFAULT_APPROVAL_TIMELINE_TTL_MS;
+  if (!Number.isSafeInteger(capacity) || capacity <= 0) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Approval timeline capacity must be a positive integer, received ${String(capacity)}.`
+    );
+  }
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Approval timeline ttl must be a positive number of milliseconds, received ${String(ttlMs)}.`
+    );
+  }
+  const parsed = z.object({
+    taskId: TaskIdSchema,
+    sourceEnvelopeId: NonBlankIdSchema,
+    event: ApprovalTimelineEventSchema
+  }).safeParse(input);
+  if (!parsed.success) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      "Approval observations require stable source identity and a valid native lifecycle event."
+    );
+  }
+  if (parsed.data.event.type === "approval_requested" && new TextEncoder().encode(parsed.data.event.summary).byteLength > APPROVAL_SUMMARY_MAX_BYTES) {
+    throw new ByokCloudError(
+      "coordination_input_invalid",
+      `Approval summary exceeds ${APPROVAL_SUMMARY_MAX_BYTES} UTF-8 bytes.`
+    );
+  }
+  return { capacity, ttlMs, event: parsed.data.event };
+}
+function approvalTimelineKey(tenant, taskId) {
+  return tenantKey(tenant, taskId);
+}
+function parseApprovalObservations(value) {
+  return z.array(ApprovalObservationSchema).parse(value);
+}
+function approvalTimelineCursor(entries) {
+  return entries.at(-1)?.revision;
+}
 async function projectTerminalToReview(board, taskId) {
   const item = await board.get(taskId);
   if (item === void 0 || item.status !== "in_progress") return;
@@ -740,7 +895,16 @@ async function handleInboundEnvelope(stores, deviceId, envelope, activityBounds
   if (attempt?.ownerDeviceId !== void 0 && attempt.ownerDeviceId !== deviceId) return "rejected";
   if (envelope.type === "task.progress" && envelope.payload.events.length > 0) {
     try {
-      activityDetails(envelope.payload.events, 0, activityBounds);
+      validateActivityBatch(
+        {
+          taskId,
+          sourceEnvelopeId: envelope.id,
+          batchSeq: envelope.payload.seq,
+          events: envelope.payload.events,
+          dropped: 0
+        },
+        activityBounds
+      );
     } catch (caught) {
       if (isCloudError(caught, "activity_batch_too_large") || isCloudError(caught, "coordination_input_invalid")) {
         return "rejected";
@@ -748,6 +912,15 @@ async function handleInboundEnvelope(stores, deviceId, envelope, activityBounds
       throw caught;
     }
   }
+  const approvalInput = approvalTimelineAppendInput(taskId, envelope);
+  if (approvalInput !== void 0) {
+    try {
+      validateApprovalTimelineAppend(approvalInput);
+    } catch (caught) {
+      if (isCloudError(caught, "coordination_input_invalid")) return "rejected";
+      throw caught;
+    }
+  }
   if (await stores.dedup.checkAndRecord(deviceId, envelope.id)) return "duplicate";
   await applyLifecycle(stores, deviceId, taskId, envelope, activityBounds);
   return "accepted";
@@ -767,11 +940,23 @@ async function applyLifecycle(stores, deviceId, taskId, envelope, activityBounds
       if (envelope.payload.events.length > 0) {
         await appendActivityEvents(
           stores.activity,
-          { taskId, events: envelope.payload.events, dropped: 0 },
+          {
+            taskId,
+            sourceEnvelopeId: envelope.id,
+            batchSeq: envelope.payload.seq,
+            events: envelope.payload.events,
+            dropped: 0
+          },
           activityBounds
         );
       }
       return;
+    case "task.await_approval":
+      await stores.approvals.append(approvalTimelineAppendInput(taskId, envelope));
+      return;
+    case "task.approval_resolved":
+      await stores.approvals.append(approvalTimelineAppendInput(taskId, envelope));
+      return;
     case "task.complete":
       await recordTerminal(stores, taskId, envelope, "complete");
       return;
@@ -785,6 +970,34 @@ async function applyLifecycle(stores, deviceId, taskId, envelope, activityBounds
       return;
   }
 }
+function approvalTimelineAppendInput(taskId, envelope) {
+  switch (envelope.type) {
+    case "task.await_approval":
+      return {
+        taskId,
+        sourceEnvelopeId: envelope.id,
+        event: {
+          type: "approval_requested",
+          summary: envelope.payload.summary,
+          ...envelope.payload.approvalId === void 0 ? {} : { approvalId: envelope.payload.approvalId }
+        }
+      };
+    case "task.approval_resolved":
+      return {
+        taskId,
+        sourceEnvelopeId: envelope.id,
+        event: {
+          type: "approval_resolved",
+          approvalId: envelope.payload.approvalId,
+          decision: envelope.payload.decision,
+          resolvedBy: envelope.payload.resolvedBy,
+          at: envelope.payload.at
+        }
+      };
+    default:
+      return void 0;
+  }
+}
 async function recordTerminal(stores, taskId, envelope, status) {
   const { created } = await stores.receipts.record({
     key: terminalReceiptKey(taskId),
@@ -1063,11 +1276,6 @@ var PresenceBodySchema = z.object({
   detail: z.string().optional(),
   configuredToolsets: ConfiguredToolsetsSchema.optional()
 });
-var ActivityBodySchema = z.object({
-  taskId: z.string().min(1).max(200),
-  events: z.array(AgentEventOrUnknownSchema),
-  dropped: z.number().int().nonnegative()
-});
 function presencePublishHandler(deps) {
   return async (c) => {
     const authenticated = await authenticateDevice(c, deps);
@@ -1101,7 +1309,7 @@ function activityAppendHandler(deps) {
   return async (c) => {
     const authenticated = await authenticateDevice(c, deps);
     if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
-    const parsed = ActivityBodySchema.safeParse(await readJsonBody(c));
+    const parsed = ActivityAppendRequestSchema.safeParse(await readJsonBody(c));
     if (!parsed.success) return c.json({ error: "invalid activity body" }, 400);
     try {
       return c.json(
@@ -1873,6 +2081,9 @@ function createByokCloud(options) {
     },
     readActivity(tenant, taskId) {
       return tenantStoresFor(controlPlane(tenant), root).activity.read(taskId);
+    },
+    readApprovalTimeline(tenant, taskId) {
+      return tenantStoresFor(controlPlane(tenant), root).approvals.read(taskId);
     }
   };
 }
@@ -2287,11 +2498,130 @@ var InMemoryTaskAttemptStore = class {
   }
 };
 
+// src/stores/in-memory/activity.ts
+var InMemoryActivityStore = class {
+  constructor(clock) {
+    this.clock = clock;
+  }
+  clock;
+  #tails = /* @__PURE__ */ new Map();
+  async append(tenant, input) {
+    const capacity = validateActivityAppend(input);
+    const now = this.clock.now();
+    const receivedAt = now.toISOString();
+    const key = activityTailKey(tenant, input.taskId);
+    const existing = this.#tails.get(key);
+    const live = existing !== void 0 && receivedAt < existing.expiresAt ? existing : void 0;
+    const incoming = projectTimelineEvents(input, receivedAt);
+    for (const next of incoming) {
+      const collision = live?.entries.find(
+        (entry) => entry.batchSeq === next.batchSeq && entry.eventIndex === next.eventIndex && entry.sourceEnvelopeId !== next.sourceEnvelopeId
+      );
+      if (collision !== void 0) {
+        throw new ByokCloudError(
+          "coordination_input_invalid",
+          `Activity order key (${next.batchSeq}, ${next.eventIndex}) already belongs to another source envelope.`
+        );
+      }
+    }
+    const allEntries = [...live?.entries ?? [], ...incoming].sort(compareTimelineEvents);
+    const evicted = Math.max(allEntries.length - capacity, 0);
+    const entries = allEntries.slice(evicted);
+    const cursor = activityCursor(entries);
+    const tail = {
+      tenantId: tenant,
+      taskId: input.taskId,
+      entries,
+      ...cursor === void 0 ? {} : { cursor },
+      dropped: (live?.dropped ?? 0) + input.dropped + evicted,
+      capacity,
+      expiresAt: new Date(now.getTime() + input.ttlMs).toISOString()
+    };
+    this.#tails.set(key, tail);
+    return tail;
+  }
+  async read(tenant, taskId) {
+    const key = activityTailKey(tenant, taskId);
+    const tail = this.#tails.get(key);
+    if (tail === void 0) return void 0;
+    if (this.clock.now().toISOString() >= tail.expiresAt) {
+      this.#tails.delete(key);
+      return void 0;
+    }
+    return tail;
+  }
+};
+
+// src/stores/in-memory/approval-timeline.ts
+var InMemoryApprovalTimelineStore = class {
+  constructor(clock) {
+    this.clock = clock;
+  }
+  clock;
+  #tails = /* @__PURE__ */ new Map();
+  async append(tenant, input) {
+    const { capacity, ttlMs, event } = validateApprovalTimelineAppend(input);
+    const now = this.clock.now();
+    const receivedAt = now.toISOString();
+    const key = approvalTimelineKey(tenant, input.taskId);
+    const existing = this.#tails.get(key);
+    const live = existing !== void 0 && receivedAt < existing.expiresAt ? existing : void 0;
+    if (live !== void 0) {
+      const duplicate = live.entries.find(
+        (entry) => entry.sourceEnvelopeId === input.sourceEnvelopeId
+      );
+      if (duplicate !== void 0) {
+        if (JSON.stringify(duplicate.event) !== JSON.stringify(event)) {
+          throw new ByokCloudError(
+            "coordination_input_invalid",
+            "Approval source envelope identity already belongs to another lifecycle event."
+          );
+        }
+        return live;
+      }
+    }
+    const revision = (live?.cursor ?? 0) + 1;
+    const observation = ApprovalObservationSchema.parse({
+      taskId: input.taskId,
+      sourceEnvelopeId: input.sourceEnvelopeId,
+      revision,
+      receivedAt,
+      event
+    });
+    const allEntries = [...live?.entries ?? [], observation];
+    const evicted = Math.max(allEntries.length - capacity, 0);
+    const entries = allEntries.slice(evicted);
+    const tail = {
+      tenantId: tenant,
+      taskId: input.taskId,
+      entries,
+      cursor: approvalTimelineCursor(entries),
+      dropped: (live?.dropped ?? 0) + evicted,
+      capacity,
+      expiresAt: new Date(now.getTime() + ttlMs).toISOString()
+    };
+    this.#tails.set(key, tail);
+    return tail;
+  }
+  async read(tenant, taskId) {
+    const key = approvalTimelineKey(tenant, taskId);
+    const tail = this.#tails.get(key);
+    if (tail === void 0) return void 0;
+    if (this.clock.now().toISOString() >= tail.expiresAt) {
+      this.#tails.delete(key);
+      return void 0;
+    }
+    return tail;
+  }
+};
+
 // src/stores/in-memory/index.ts
 function createInMemoryCloudStores(clock, crypto, objects) {
   const blobs = createInMemoryBlobs(clock, crypto, objects);
   return {
     stores: {
+      activity: new InMemoryActivityStore(clock),
+      approvals: new InMemoryApprovalTimelineStore(clock),
       devices: new InMemoryDeviceDirectory(),
       pairingCodes: new InMemoryPairingCodeStore(clock),
       nonces: new InMemoryNonceStore(clock, crypto),
@@ -2500,6 +2830,8 @@ var TASK_ATTEMPT_STATUSES = [
   "cancelled"
 ];
 var CLOUD_STORE_NAMES = [
+  "activity",
+  "approvals",
   "devices",
   "pairingCodes",
   "nonces",
@@ -2513,6 +2845,8 @@ var CLOUD_STORE_NAMES = [
 
 // src/stores/ports-contract.ts
 var CLOUD_PORT_METHODS = {
+  activity: ["append", "read"],
+  approvals: ["append", "read"],
   devices: ["register", "get", "revoke", "list", "resolveByDeviceId"],
   pairingCodes: ["issue", "redeem"],
   nonces: ["issue", "validate", "markUsed"],
@@ -2527,6 +2861,8 @@ var CLOUD_PORT_METHODS = {
   rateLimiter: ["consume"]
 };
 var CLOUD_PORT_INTERFACES = {
+  activity: "ActivityStore",
+  approvals: "ApprovalTimelineStore",
   devices: "DeviceDirectory",
   pairingCodes: "PairingCodeStore",
   nonces: "NonceStore",
@@ -2538,6 +2874,6 @@ var CLOUD_PORT_INTERFACES = {
   rateLimiter: "InboundRateLimiter"
 };
 
-export { ACCESS_TOKEN_TTL_SECONDS, AllowAllRateLimiter, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEFAULT_SKILL_PACK_PAGE_LIMIT, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, authenticateBearer, authenticateDeviceProof, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, projectTerminalResult, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, verifyNonceSignature };
+export { ACCESS_TOKEN_TTL_SECONDS, APPROVAL_SUMMARY_MAX_BYTES, ActivityAppendRequestSchema, AllowAllRateLimiter, ApprovalObservationSchema, ApprovalTimelineEventSchema, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_APPROVAL_TIMELINE_CAPACITY, DEFAULT_APPROVAL_TIMELINE_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEFAULT_SKILL_PACK_PAGE_LIMIT, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, InMemoryActivityStore, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TimelineEventSchema, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, activityCursor, approvalTimelineCursor, authenticateBearer, authenticateDeviceProof, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, parseApprovalObservations, parseTimelineEvents, projectTerminalResult, projectTimelineEvents, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, validateActivityAppend, validateApprovalTimelineAppend, verifyNonceSignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map