@byok-sdk/cloud 0.8.1 → 0.9.0-rc.1

package/dist/index.js

@@ -1,6 +1,6 @@
 import { BOARD_STATUSES, CapabilityDeclarationSchema, NONCE_SIGNING_DOMAIN, hasCapability, isTenantId, tenantId, principalTenant, parseDeviceProofEnvelope, deviceProofSigningInput, contentHash, parseCapabilityDeclaration, ByokCoreError, tenantKey, PRESENCE_LEVELS, createInMemoryCoreStores, authenticateDeviceAssertion, assertCapability, isCoreConflictError, isCoreError, DEVICE_PROOF_HEADER, TRUTH_RECORD_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS } from '@byok-sdk/core';
 export { DEVICE_PROOF_HEADER, NONCE_SIGNING_DOMAIN, isTenantId, tenantId } from '@byok-sdk/core';
-import { AgentEventOrUnknownSchema, PROTOCOL_VERSION, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, encodeEnvelope, AgentHomeProjectionCompletionRequestSchema, decodeEnvelope, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, createEnvelope, AgentHomeProjectionPayloadSchema, AgentContentReadPayloadSchema, AGENT_EGRESS_POLICY_CAPABILITY, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferForAgentPayloadSchema, STRICT_AGENT_ONLY_CAPABILITY, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, PairRequestSchema, PairResponseSchema, ChallengeRequestSchema, TokenRequestSchema, MessagesSendRequestSchema, PresencePublishRequestSchema, CreateBlobRequestSchema, byokBlobContentPath, AgentEgressAckPayloadSchema, AgentContentReceiptPayloadSchema } from '@byok-sdk/protocol';
+import { AgentEventOrUnknownSchema, PROTOCOL_VERSION, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, encodeEnvelope, AgentHomeProjectionCompletionRequestSchema, decodeEnvelope, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_AGENT_MEMORY_PROJECTIONS_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, createEnvelope, AgentHomeProjectionPayloadSchema, AgentContentReadPayloadSchema, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, TaskOfferForAgentWithEgressFreshPayloadSchema, AgentMessageServerContextSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferForAgentPayloadSchema, AgentMemoryProjectionMutationSchema, AgentMemoryProjectionReceiptSchema, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AgentMemoryProjectionEraseResultSchema, STRICT_AGENT_ONLY_CAPABILITY, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, PairRequestSchema, PairResponseSchema, ChallengeRequestSchema, TokenRequestSchema, AgentMemoryProjectionCommitRequestSchema, agentMemoryProjectionBase64UrlByteLength, MessagesSendRequestSchema, PresencePublishRequestSchema, CreateBlobRequestSchema, byokBlobContentPath, AgentEgressAckPayloadSchema, AgentContentReceiptPayloadSchema } from '@byok-sdk/protocol';
 import { z } from 'zod';
 import { Hono } from 'hono';
 
@@ -265,7 +265,9 @@ var CLOUD_CAPABILITIES = {
    * a `SkillPackStore` is refused at construction rather than publishing two
    * routes it would then 404.
    */
-  skillPacks: "skills.pack"
+  skillPacks: "skills.pack",
+  /** Optional, one-way redacted Agent-memory snapshot mutation route. */
+  agentMemoryProjection: "agent.memory.projection"
 };
 var CapabilitiesResponseSchema = CapabilityDeclarationSchema;
 function fullCapabilityDeclaration(version = 1, options = {}) {
@@ -275,6 +277,9 @@ function fullCapabilityDeclaration(version = 1, options = {}) {
     capabilities: Object.values(CLOUD_CAPABILITIES).filter((capability) => {
       if (capability === CLOUD_CAPABILITIES.truthRecords) return options.includeTruthRecords === true;
       if (capability === CLOUD_CAPABILITIES.skillPacks) return options.includeSkillPacks === true;
+      if (capability === CLOUD_CAPABILITIES.agentMemoryProjection) {
+        return options.includeAgentMemoryProjection === true;
+      }
       return true;
     })
   };
@@ -339,7 +344,23 @@ var CLOUD_ERROR_CODES = {
   /** A task-free completion did not exactly echo its immutable desired projection binding. */
   agent_home_projection_receipt_mismatch: "agent_home_projection_receipt_mismatch",
   /** A receipt-store row at the projection namespace violated the frozen projection schema. */
-  agent_home_projection_receipt_invalid: "agent_home_projection_receipt_invalid"
+  agent_home_projection_receipt_invalid: "agent_home_projection_receipt_invalid",
+  /** A hosted Agent-memory mutation did not match the durable task/device/AgentRef binding. */
+  agent_memory_projection_task_mismatch: "agent_memory_projection_task_mismatch",
+  /** The embedder-owned grant/consent authority denied a hosted memory mutation. */
+  agent_memory_projection_authorization_denied: "agent_memory_projection_authorization_denied",
+  /** A redacted snapshot's decoded bytes did not match its declared hash or byte count. */
+  agent_memory_projection_hash_mismatch: "agent_memory_projection_hash_mismatch",
+  /** A writer epoch/source sequence already names a different immutable projection mutation. */
+  agent_memory_projection_replay_mismatch: "agent_memory_projection_replay_mismatch",
+  /** A hosted memory mutation came from an older writer epoch. */
+  agent_memory_projection_stale_epoch: "agent_memory_projection_stale_epoch",
+  /** A server-side erase fence prevents a deleted writer epoch from re-entering. */
+  agent_memory_projection_erased_epoch: "agent_memory_projection_erased_epoch",
+  /** A prior erase reached the protocol writer-epoch ceiling and cannot mint a later writer. */
+  agent_memory_projection_epoch_exhausted: "agent_memory_projection_epoch_exhausted",
+  /** A hosted memory mutation skipped or reset a required source sequence. */
+  agent_memory_projection_sequence_gap: "agent_memory_projection_sequence_gap"
 };
 var ByokCloudError = class extends Error {
   code;
@@ -600,6 +621,63 @@ async function readJsonBody(c) {
     return void 0;
   }
 }
+async function readBoundedJsonBody(c, maximum) {
+  const declaredLength = c.req.header("content-length");
+  if (declaredLength !== void 0) {
+    const parsedLength = parseContentLength(declaredLength);
+    if (parsedLength !== void 0 && parsedLength > BigInt(maximum)) {
+      return { body: void 0, tooLarge: true };
+    }
+  }
+  const stream = c.req.raw.body;
+  if (stream === null) return { body: void 0, tooLarge: false };
+  const reader = stream.getReader();
+  const chunks = [];
+  let total = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      if (value.byteLength > maximum - total) {
+        try {
+          await reader.cancel();
+        } catch {
+        }
+        return { body: void 0, tooLarge: true };
+      }
+      if (value.byteLength === 0) continue;
+      chunks.push(value);
+      total += value.byteLength;
+    }
+  } catch {
+    return { body: void 0, tooLarge: false };
+  } finally {
+    reader.releaseLock();
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return { body: parseJsonBytes(bytes), tooLarge: false };
+}
+function parseContentLength(value) {
+  const normalized = value.trim();
+  if (!/^\d+$/u.test(normalized)) return void 0;
+  try {
+    return BigInt(normalized);
+  } catch {
+    return void 0;
+  }
+}
+function parseJsonBytes(bytes) {
+  try {
+    return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  } catch {
+    return void 0;
+  }
+}
 async function authenticateDevice(c, deps) {
   const device = await authenticateBearer(c.req.header("authorization"), deps.bearer);
   if (device === void 0) return void 0;
@@ -958,6 +1036,45 @@ async function projectTerminalToReview(board, taskId) {
 }
 
 // src/inbound.ts
+async function handleAgentMessagePublish(stores, deviceId, taskId, payload, consume) {
+  const device = await stores.devices.get(deviceId);
+  const attempt = await stores.tasks.get(taskId);
+  const binding = await stores.receipts.get(`agent-message-offer:${deviceId}:${taskId}`);
+  if (device === void 0 || device.revoked || !hasCapabilities(device.capabilities, [AGENT_MESSAGE_EGRESS_CAPABILITY]) || attempt === void 0 || attempt.deviceId !== deviceId || binding === void 0 || !sameAgentRef(attempt.agentRef, payload.agentRef)) return { outcome: "rejected" };
+  let frozen;
+  try {
+    frozen = JSON.parse(binding.body);
+  } catch {
+    return { outcome: "rejected" };
+  }
+  if (!sameAgentRef(frozen.agentRef, payload.agentRef) || frozen.context === void 0 || frozen.requirement?.contract !== payload.contract || frozen.sessionRef !== void 0 && frozen.sessionRef !== payload.sessionRef || frozen.requirement.contentType !== payload.contentType || typeof frozen.requirement.maxBytes !== "number" || payload.byteCount > frozen.requirement.maxBytes) return { outcome: "rejected" };
+  const taskMessageKey = `agent-message-task:${deviceId}:${taskId}`;
+  const taskMessageBody = JSON.stringify(payload);
+  const lockedTaskMessage = await stores.receipts.record({ key: taskMessageKey, body: taskMessageBody });
+  if (!lockedTaskMessage.created && lockedTaskMessage.receipt.body !== taskMessageBody) return { outcome: "rejected" };
+  const receiptKey2 = `agent-message:${deviceId}:${payload.messageId}`;
+  const previous = await stores.receipts.get(receiptKey2);
+  if (previous !== void 0) {
+    const decoded = JSON.parse(previous.body);
+    if (JSON.stringify(decoded.payload) !== JSON.stringify(payload)) return { outcome: "rejected" };
+    return { outcome: "duplicate", disposition: decoded.disposition };
+  }
+  const decision = consume === void 0 ? { outcome: "held", reasonCode: "consumer_unavailable" } : await consume({ tenant: stores.tenant, deviceId, taskId, context: frozen.context, payload });
+  const disposition = {
+    agentRef: payload.agentRef,
+    sessionRef: payload.sessionRef,
+    contract: payload.contract,
+    messageId: payload.messageId,
+    cursor: payload.cursor,
+    contentHash: payload.contentHash,
+    outcome: decision.outcome,
+    receiptId: crypto.randomUUID(),
+    ...decision.reasonCode === void 0 ? {} : { reasonCode: decision.reasonCode }
+  };
+  const recorded = await stores.receipts.record({ key: receiptKey2, body: JSON.stringify({ payload, disposition }) });
+  if (!recorded.created && recorded.receipt.body !== JSON.stringify({ payload, disposition })) return { outcome: "rejected" };
+  return { outcome: "accepted", disposition };
+}
 function terminalReceiptKey(taskId) {
   return `task:${taskId}:terminal`;
 }
@@ -1210,13 +1327,23 @@ function messagesHandler(deps) {
     let accepted = 0;
     let rejected = 0;
     for (const envelope of parsed.data.messages) {
-      const outcome = await handleInboundEnvelope(
+      const messageResult = envelope.type === "agent.message.publish" ? await handleAgentMessagePublish(
+        stores,
+        device.deviceId,
+        envelope.task_id,
+        envelope.payload,
+        deps.agentMessage?.consume
+      ) : void 0;
+      const outcome = messageResult?.outcome ?? await handleInboundEnvelope(
         stores,
         device.deviceId,
         envelope,
         deps.activityBounds
       );
       if (outcome === "rate_limited") return c.json({ error: "rate limit exceeded" }, 429);
+      if (envelope.type === "agent.message.publish" && messageResult?.disposition !== void 0) {
+        await deps.appendAgentMessageDisposition(stores, device.deviceId, envelope.task_id, messageResult.disposition);
+      }
       if (envelope.type === "agent.egress.reliable" && (outcome === "accepted" || outcome === "duplicate")) {
         const record = await stores.egress.get(device.deviceId, envelope.payload.eventId);
         if (record === void 0) {
@@ -1263,6 +1390,36 @@ function agentHomeProjectionCompletionHandler(deps) {
     }
   };
 }
+var DEFAULT_MAX_AGENT_MEMORY_PROJECTION_REQUEST_BYTES = 1 * 1024 * 1024;
+function agentMemoryProjectionHandler(deps) {
+  return async (c) => {
+    const authenticated = await authenticateDevice(c, deps);
+    if (authenticated === void 0) return c.json({ error: "unauthorized" }, 401);
+    const body = await readBoundedJsonBody(c, DEFAULT_MAX_AGENT_MEMORY_PROJECTION_REQUEST_BYTES);
+    if (body.tooLarge) return c.json({ error: "Agent-memory projection request body too large" }, 413);
+    const parsed = AgentMemoryProjectionCommitRequestSchema.safeParse(body.body);
+    if (!parsed.success) return c.json({ error: "invalid Agent-memory projection mutation" }, 422);
+    if (agentMemoryProjectionBase64UrlByteLength(parsed.data.snapshot.redactedBytes) === void 0) {
+      return c.json({ error: "invalid Agent-memory projection mutation" }, 422);
+    }
+    const decoded = base64UrlDecode(parsed.data.snapshot.redactedBytes);
+    if (decoded === void 0 || decoded.byteLength !== parsed.data.snapshot.redactedByteCount) {
+      return c.json({ error: "invalid Agent-memory projection mutation" }, 422);
+    }
+    try {
+      return c.json(
+        await deps.commit(authenticated.stores, authenticated.device.deviceId, parsed.data, decoded),
+        200
+      );
+    } catch (error) {
+      if (isCloudError(error, "agent_memory_projection_authorization_denied") || isCloudError(error, "agent_memory_projection_task_mismatch") || isCloudError(error, "agent_memory_projection_replay_mismatch") || isCloudError(error, "agent_memory_projection_stale_epoch") || isCloudError(error, "agent_memory_projection_erased_epoch") || isCloudError(error, "agent_memory_projection_epoch_exhausted") || isCloudError(error, "agent_memory_projection_sequence_gap")) return c.json({ error: error.code }, 409);
+      if (isCloudError(error, "agent_memory_projection_hash_mismatch")) {
+        return c.json({ error: error.code }, 422);
+      }
+      throw error;
+    }
+  };
+}
 var DEFAULT_BOARD_PAGE_LIMIT = 50;
 var DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS = 5e3;
 var DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS = 15e3;
@@ -1809,7 +1966,7 @@ function truthPutHandler(deps) {
     if (authenticated === void 0) return unauthorized2(c);
     const selector = recordSelector(c);
     if (selector === void 0) return c.json({ error: "invalid truth record selector" }, 400);
-    const parsedJson = parseJsonBytes(body);
+    const parsedJson = parseJsonBytes2(body);
     const parsed = TruthWriteRequestSchema.safeParse(parsedJson);
     if (!parsed.success) return c.json({ error: "invalid truth write request" }, 400);
     const writes = prepareWrites(selector.kind, selector.recordKey, parsed.data);
@@ -1944,7 +2101,7 @@ async function readBoundedBody(c, maximum) {
     return void 0;
   }
 }
-function parseJsonBytes(bytes) {
+function parseJsonBytes2(bytes) {
   try {
     return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
   } catch {
@@ -2188,7 +2345,9 @@ function createByokCloud(options) {
     options.blobContentProxy,
     options.truthCommitter,
     options.truthObjectDownloads,
-    options.skillPacks
+    options.skillPacks,
+    options.agentMemoryProjectionAuthorizer,
+    options.agentMemoryProjectionStore
   );
   const root = { core: options.core, cloud: options.cloud };
   const auth = createAuthPlane({
@@ -2216,6 +2375,15 @@ function createByokCloud(options) {
     { method: "GET", path: BYOK_CAPABILITIES_PATH, class: "public" },
     capabilitiesHandler({ declaration })
   );
+  if (declares(declaration, CLOUD_CAPABILITIES.agentMemoryProjection)) {
+    registry.register(
+      { method: "POST", path: BYOK_AGENT_MEMORY_PROJECTIONS_PATH, class: "device" },
+      agentMemoryProjectionHandler({
+        ...deviceRouteDeps,
+        commit: (stores, deviceId, mutation, redactedBytes) => commitAgentMemoryProjectionFromStores(stores, deviceId, mutation, redactedBytes)
+      })
+    );
+  }
   if (declares(declaration, CLOUD_CAPABILITIES.eventsLongPoll)) {
     registry.register(
       { method: "GET", path: BYOK_EVENTS_PATH, class: "device" },
@@ -2234,7 +2402,9 @@ function createByokCloud(options) {
         ...deviceRouteDeps,
         activityBounds,
         appendReliableEgressAck: enqueueReliableEgressAck,
-        appendContentReceiptAck: enqueueContentReceiptAck
+        appendContentReceiptAck: enqueueContentReceiptAck,
+        agentMessage: options.agentMessage,
+        appendAgentMessageDisposition: enqueueAgentMessageDisposition
       })
     );
   }
@@ -2360,7 +2530,7 @@ function createByokCloud(options) {
   function controlPlane(tenant) {
     return { kind: "control-plane", tenantId: tenant, operatorId };
   }
-  async function enqueueTaskEnvelope(tenant, deviceId, requestedTaskId, agentRef, buildEnvelope) {
+  async function enqueueTaskEnvelope(tenant, deviceId, requestedTaskId, agentRef, buildEnvelope, beforeMailbox) {
     const stores = tenantStoresFor(controlPlane(tenant), root);
     const taskId = requestedTaskId ?? `task_${options.crypto.randomUuid()}`;
     const messageId = options.crypto.randomUuid();
@@ -2380,6 +2550,7 @@ function createByokCloud(options) {
     }
     let message;
     try {
+      await beforeMailbox?.(stores, taskId);
       message = await stores.mailbox.append({
         deviceId,
         messageId,
@@ -2506,6 +2677,54 @@ function createByokCloud(options) {
       receipt
     );
   }
+  async function commitAgentMemoryProjectionFromStores(stores, deviceId, mutationInput, redactedBytes) {
+    const mutation = AgentMemoryProjectionCommitRequestSchema.parse(mutationInput);
+    const attempt = await stores.tasks.get(mutation.taskId);
+    if (attempt === void 0 || attempt.deviceId !== deviceId || !sameAgentRef2(mutation.agentRef, attempt.agentRef)) {
+      throw new ByokCloudError(
+        "agent_memory_projection_task_mismatch",
+        "The Agent-memory projection does not match an exact task/device/AgentRef binding."
+      );
+    }
+    const authorizer = options.agentMemoryProjectionAuthorizer;
+    const store = options.agentMemoryProjectionStore;
+    if (authorizer === void 0 || store === void 0) {
+      throw new ByokCloudError(
+        "agent_capability_missing",
+        "Hosted Agent-memory projection requires both an authorizer and a projection store."
+      );
+    }
+    const authorization = await authorizer.authorize({
+      tenantId: stores.tenant,
+      deviceId,
+      taskId: mutation.taskId,
+      agentRef: mutation.agentRef,
+      sessionRef: mutation.sessionRef,
+      runtimeId: mutation.runtimeId,
+      grantRef: mutation.grantRef,
+      writerEpoch: mutation.writerEpoch,
+      policyRevision: mutation.policyRevision
+    });
+    if (authorization.outcome !== "authorized") {
+      throw new ByokCloudError(
+        "agent_memory_projection_authorization_denied",
+        `The Agent-memory projection grant was denied: ${authorization.reasonCode}`
+      );
+    }
+    return store.commit({ tenantId: stores.tenant, deviceId, mutation, redactedBytes });
+  }
+  async function eraseAgentMemoryProjection(tenant, agentId) {
+    const authorizer = options.agentMemoryProjectionAuthorizer;
+    const store = options.agentMemoryProjectionStore;
+    if (authorizer === void 0 || store === void 0) {
+      throw new ByokCloudError(
+        "agent_capability_missing",
+        "Hosted Agent-memory projection is not configured for this deployment."
+      );
+    }
+    await authorizer.revoke({ tenantId: tenant, agentId });
+    return store.erase({ tenantId: tenant, agentId });
+  }
   async function enqueueReliableEgressAck(stores, record) {
     const payload = AgentEgressAckPayloadSchema.parse({
       agentRef: record.payload.agentRef,
@@ -2573,6 +2792,25 @@ function createByokCloud(options) {
       );
     }
   }
+  async function enqueueAgentMessageDisposition(stores, deviceId, taskId, payload) {
+    const message = await stores.mailbox.append({
+      deviceId,
+      messageId: `agent-message-disposition:${payload.receiptId}`,
+      materialize: async (seq) => {
+        const body = encodeEnvelope(createEnvelope("agent.message.disposition", payload, {
+          id: payload.receiptId,
+          taskId,
+          seq
+        }));
+        const bytes = new TextEncoder().encode(body);
+        return { body, bodyHash: contentHash(await options.crypto.sha256(bytes)), byteSize: BigInt(bytes.length) };
+      }
+    });
+    const decoded = decodeEnvelope(message.body);
+    if (decoded.type !== "agent.message.disposition" || decoded.seq !== message.seq) {
+      throw new ByokCloudError("mailbox_receipt_mismatch", "Agent message disposition mailbox readback mismatched.");
+    }
+  }
   return {
     fetch: registry.fetch,
     routes: registry.routes,
@@ -2602,7 +2840,10 @@ function createByokCloud(options) {
       );
     },
     async enqueueAgentOffer(tenant, deviceId, input) {
-      await assertAgentCapabilities(tenant, deviceId, [AGENT_HOME_CONTRACT_CAPABILITY]);
+      await assertAgentCapabilities(tenant, deviceId, [
+        AGENT_HOME_CONTRACT_CAPABILITY,
+        ...input.payload.terminalProjection === void 0 ? [] : [TERMINAL_PROJECTION_SELECTION_CAPABILITY]
+      ]);
       const payload = TaskOfferForAgentPayloadSchema.parse(input.payload);
       return enqueueTaskEnvelope(
         tenant,
@@ -2616,32 +2857,60 @@ function createByokCloud(options) {
       await assertAgentCapabilities(tenant, deviceId, [
         AGENT_HOME_CONTRACT_CAPABILITY,
         AGENT_EGRESS_POLICY_CAPABILITY,
-        AGENT_EGRESS_RELIABLE_ACK_CAPABILITY
+        AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+        ...input.payload.messageEgress === void 0 ? [] : [AGENT_MESSAGE_EGRESS_CAPABILITY],
+        ...input.payload.terminalProjection === void 0 ? [] : [TERMINAL_PROJECTION_SELECTION_CAPABILITY]
       ]);
       const payload = TaskOfferForAgentWithEgressPayloadSchema.parse(input.payload);
-      return enqueueTaskEnvelope(
+      if (payload.messageEgress === void 0 && input.agentMessageContext !== void 0) {
+        throw new Error("agentMessageContext requires messageEgress");
+      }
+      const messageContext = payload.messageEgress === void 0 ? void 0 : AgentMessageServerContextSchema.parse(input.agentMessageContext);
+      const enqueued = await enqueueTaskEnvelope(
         tenant,
         deviceId,
         input.taskId,
         payload.agentRef,
-        (taskId, seq, messageId) => createEnvelope("task.offer_for_agent_with_egress", payload, { id: messageId, taskId, seq })
+        (taskId, seq, messageId) => createEnvelope("task.offer_for_agent_with_egress", payload, { id: messageId, taskId, seq }),
+        payload.messageEgress === void 0 ? void 0 : async (stores, taskId) => {
+          const body = JSON.stringify({ agentRef: payload.agentRef, sessionRef: payload.sessionRef, requirement: payload.messageEgress, context: messageContext });
+          const recorded = await stores.receipts.record({ key: `agent-message-offer:${deviceId}:${taskId}`, body });
+          if (!recorded.created && recorded.receipt.body !== body) {
+            throw new ByokCloudError("agent_content_request_mismatch", `Task ${taskId} already has a different Agent message context.`);
+          }
+        }
       );
+      return enqueued;
     },
     async enqueueFreshAgentEgressOffer(tenant, deviceId, input) {
       await assertAgentCapabilities(tenant, deviceId, [
         AGENT_HOME_CONTRACT_CAPABILITY,
         AGENT_EGRESS_POLICY_CAPABILITY,
         AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
-        AGENT_EGRESS_FRESH_SESSION_CAPABILITY
+        AGENT_EGRESS_FRESH_SESSION_CAPABILITY,
+        ...input.payload.messageEgress === void 0 ? [] : [AGENT_MESSAGE_EGRESS_CAPABILITY],
+        ...input.payload.terminalProjection === void 0 ? [] : [TERMINAL_PROJECTION_SELECTION_CAPABILITY]
       ]);
       const payload = TaskOfferForAgentWithEgressFreshPayloadSchema.parse(input.payload);
-      return enqueueTaskEnvelope(
+      if (payload.messageEgress === void 0 && input.agentMessageContext !== void 0) {
+        throw new Error("agentMessageContext requires messageEgress");
+      }
+      const messageContext = payload.messageEgress === void 0 ? void 0 : AgentMessageServerContextSchema.parse(input.agentMessageContext);
+      const enqueued = await enqueueTaskEnvelope(
         tenant,
         deviceId,
         input.taskId,
         payload.agentRef,
-        (taskId, seq, messageId) => createEnvelope("task.offer_for_agent_with_egress_fresh", payload, { id: messageId, taskId, seq })
+        (taskId, seq, messageId) => createEnvelope("task.offer_for_agent_with_egress_fresh", payload, { id: messageId, taskId, seq }),
+        payload.messageEgress === void 0 ? void 0 : async (stores, taskId) => {
+          const body = JSON.stringify({ agentRef: payload.agentRef, requirement: payload.messageEgress, context: messageContext });
+          const recorded = await stores.receipts.record({ key: `agent-message-offer:${deviceId}:${taskId}`, body });
+          if (!recorded.created && recorded.receipt.body !== body) {
+            throw new ByokCloudError("agent_content_request_mismatch", `Task ${taskId} already has a different Agent message context.`);
+          }
+        }
       );
+      return enqueued;
     },
     async enqueueAgentContentRead(tenant, deviceId, input) {
       const payload = AgentContentReadPayloadSchema.parse(input.payload);
@@ -2722,6 +2991,7 @@ function createByokCloud(options) {
     },
     getAgentHomeProjectionStatus,
     completeAgentHomeProjection,
+    eraseAgentMemoryProjection,
     async cancelTask(tenant, taskId, reason) {
       const stores = tenantStoresFor(controlPlane(tenant), root);
       const proposedMessageId = options.crypto.randomUuid();
@@ -2822,7 +3092,7 @@ function createByokCloud(options) {
     }
   };
 }
-function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, truthObjectDownloads, skillPacks) {
+function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, truthObjectDownloads, skillPacks, agentMemoryProjectionAuthorizer, agentMemoryProjectionStore) {
   if (declares(declaration, CLOUD_CAPABILITIES.boardSse) && !declares(declaration, CLOUD_CAPABILITIES.boardCoordination)) {
     throw new ByokCloudError(
       "capability_over_declared",
@@ -2853,6 +3123,12 @@ function assertNoOverDeclaration(declaration, contentProxy, truthCommitter, trut
       `This deployment declares ${CLOUD_CAPABILITIES.skillPacks} but was given no SkillPackStore, so both /byok/skill-packs routes would be published and unserved.`
     );
   }
+  if (declares(declaration, CLOUD_CAPABILITIES.agentMemoryProjection) && (agentMemoryProjectionAuthorizer === void 0 || agentMemoryProjectionStore === void 0)) {
+    throw new ByokCloudError(
+      "capability_over_declared",
+      `This deployment declares ${CLOUD_CAPABILITIES.agentMemoryProjection} but was given no complete AgentMemoryProjectionAuthorizer/AgentMemoryProjectionStore pair.`
+    );
+  }
 }
 function parseDeclaration(declaration) {
   try {
@@ -3606,10 +3882,15 @@ function createInMemoryByokCloud(options = {}) {
     crypto: crypto2,
     tokenSigner,
     clock,
-    capabilities: options.capabilities ?? fullCapabilityDeclaration(),
+    capabilities: options.capabilities ?? fullCapabilityDeclaration(void 0, {
+      includeAgentMemoryProjection: options.agentMemoryProjectionAuthorizer !== void 0 && options.agentMemoryProjectionStore !== void 0
+    }),
     ...options.truthCommitter === void 0 ? {} : { truthCommitter: options.truthCommitter },
     ...options.truthObjectDownloads === void 0 ? {} : { truthObjectDownloads: options.truthObjectDownloads },
     ...options.operatorId !== void 0 ? { operatorId: options.operatorId } : {},
+    ...options.agentMessage === void 0 ? {} : { agentMessage: options.agentMessage },
+    ...options.agentMemoryProjectionAuthorizer === void 0 ? {} : { agentMemoryProjectionAuthorizer: options.agentMemoryProjectionAuthorizer },
+    ...options.agentMemoryProjectionStore === void 0 ? {} : { agentMemoryProjectionStore: options.agentMemoryProjectionStore },
     ...options.maxBlobSizeBytes !== void 0 ? { maxBlobSizeBytes: options.maxBlobSizeBytes } : {},
     ...options.longPollHoldMs !== void 0 ? { longPollHoldMs: options.longPollHoldMs } : {},
     ...options.longPollIntervalMs !== void 0 ? { longPollIntervalMs: options.longPollIntervalMs } : {},
@@ -3634,6 +3915,187 @@ function createInMemoryByokCloud(options = {}) {
   });
   return { cloud, core, stores, blobContentProxy, clock, crypto: crypto2 };
 }
+function agentKey(tenantId4, agentId) {
+  return `${tenantId4}\0${agentId}`;
+}
+function permitKey(input) {
+  return JSON.stringify([
+    input.tenantId,
+    input.deviceId,
+    input.taskId,
+    input.agentRef.agentId,
+    input.agentRef.profileRevision,
+    input.sessionRef,
+    input.runtimeId,
+    input.grantRef,
+    input.writerEpoch,
+    input.policyRevision
+  ]);
+}
+function receiptKey(input) {
+  const { mutation } = input;
+  return `${agentKey(input.tenantId, mutation.agentRef.agentId)}\0${mutation.writerEpoch}\0${mutation.sourceSeq}`;
+}
+function sameMutationReceipt(receipt, input) {
+  const { mutation } = input;
+  return receipt.tenantId === input.tenantId && receipt.deviceId === input.deviceId && receipt.taskId === mutation.taskId && receipt.agentRef.agentId === mutation.agentRef.agentId && receipt.agentRef.profileRevision === mutation.agentRef.profileRevision && receipt.sessionRef === mutation.sessionRef && receipt.runtimeId === mutation.runtimeId && receipt.grantRef === mutation.grantRef && receipt.writerEpoch === mutation.writerEpoch && receipt.sourceSeq === mutation.sourceSeq && receipt.mutationId === mutation.mutationId && receipt.policyRevision === mutation.policyRevision && receipt.redactedHash === mutation.snapshot.redactedHash && receipt.redactedByteCount === mutation.snapshot.redactedByteCount;
+}
+var InMemoryAgentMemoryProjectionStore = class {
+  #clock;
+  #crypto;
+  #heads = /* @__PURE__ */ new Map();
+  #snapshots = /* @__PURE__ */ new Map();
+  #receipts = /* @__PURE__ */ new Map();
+  /** Minimum legal future epoch after server-side erasure; contains no body. */
+  #eraseFences = /* @__PURE__ */ new Map();
+  #mutationTails = /* @__PURE__ */ new Map();
+  constructor(clock, crypto2) {
+    this.#clock = clock;
+    this.#crypto = crypto2;
+  }
+  async commit(input) {
+    const mutation = AgentMemoryProjectionMutationSchema.parse(input.mutation);
+    if (input.redactedBytes.byteLength !== mutation.snapshot.redactedByteCount) {
+      throw new ByokCloudError(
+        "agent_memory_projection_hash_mismatch",
+        "Decoded redacted snapshot bytes do not match redactedByteCount."
+      );
+    }
+    const hash = await this.#crypto.sha256(input.redactedBytes);
+    if (hash !== mutation.snapshot.redactedHash) {
+      throw new ByokCloudError(
+        "agent_memory_projection_hash_mismatch",
+        "Decoded redacted snapshot bytes do not match redactedHash."
+      );
+    }
+    const exactInput = { ...input, mutation };
+    const key = agentKey(input.tenantId, mutation.agentRef.agentId);
+    return this.#mutate(key, () => {
+      const prior = this.#receipts.get(receiptKey(exactInput));
+      if (prior !== void 0) {
+        if (!sameMutationReceipt(prior, exactInput)) {
+          throw new ByokCloudError(
+            "agent_memory_projection_replay_mismatch",
+            "A memory projection epoch and source sequence already names a different immutable mutation."
+          );
+        }
+        return AgentMemoryProjectionReceiptSchema.parse({ ...prior, outcome: "idempotent" });
+      }
+      const fence = this.#eraseFences.get(key);
+      if (fence !== void 0 && mutation.writerEpoch < fence) {
+        throw new ByokCloudError("agent_memory_projection_erased_epoch", "The memory projection writerEpoch was erased and cannot be replayed.");
+      }
+      const head = this.#heads.get(key);
+      if (head === void 0) {
+        if (mutation.sourceSeq !== 1) {
+          throw new ByokCloudError(
+            "agent_memory_projection_sequence_gap",
+            "The first memory projection mutation must use sourceSeq 1."
+          );
+        }
+      } else if (mutation.writerEpoch < head.writerEpoch) {
+        throw new ByokCloudError("agent_memory_projection_stale_epoch", "The memory projection writerEpoch is stale.");
+      } else if (mutation.writerEpoch > head.writerEpoch) {
+        if (mutation.sourceSeq !== 1) {
+          throw new ByokCloudError(
+            "agent_memory_projection_sequence_gap",
+            "A new memory projection writerEpoch must start at sourceSeq 1."
+          );
+        }
+      } else if (mutation.sourceSeq !== head.sourceSeq + 1) {
+        throw new ByokCloudError(
+          "agent_memory_projection_sequence_gap",
+          "A memory projection mutation must advance sourceSeq exactly by one."
+        );
+      }
+      const recordedAt = this.#clock.now().toISOString();
+      const metering = {
+        meteringReceiptId: this.#crypto.randomUuid(),
+        acceptedRedactedBytes: mutation.snapshot.redactedByteCount,
+        recordedAt
+      };
+      const receipt = AgentMemoryProjectionReceiptSchema.parse({
+        outcome: "accepted",
+        tenantId: input.tenantId,
+        deviceId: input.deviceId,
+        taskId: mutation.taskId,
+        agentRef: mutation.agentRef,
+        sessionRef: mutation.sessionRef,
+        runtimeId: mutation.runtimeId,
+        grantRef: mutation.grantRef,
+        writerEpoch: mutation.writerEpoch,
+        sourceSeq: mutation.sourceSeq,
+        mutationId: mutation.mutationId,
+        policyRevision: mutation.policyRevision,
+        redactedHash: mutation.snapshot.redactedHash,
+        redactedByteCount: mutation.snapshot.redactedByteCount,
+        metering
+      });
+      this.#snapshots.set(key, {
+        redactedBytes: input.redactedBytes.slice(),
+        redactedHash: mutation.snapshot.redactedHash,
+        redactedByteCount: mutation.snapshot.redactedByteCount
+      });
+      this.#heads.set(key, { writerEpoch: mutation.writerEpoch, sourceSeq: mutation.sourceSeq });
+      this.#receipts.set(receiptKey(exactInput), receipt);
+      return receipt;
+    });
+  }
+  async erase(input) {
+    const key = agentKey(input.tenantId, input.agentId);
+    return this.#mutate(key, () => {
+      const priorHeadEpoch = this.#heads.get(key)?.writerEpoch ?? 0;
+      const nextWriterEpoch = Math.max(this.#eraseFences.get(key) ?? 1, priorHeadEpoch + 1);
+      if (nextWriterEpoch > AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE) {
+        throw new ByokCloudError("agent_memory_projection_epoch_exhausted", "The memory projection writerEpoch cannot advance after erase.");
+      }
+      this.#heads.delete(key);
+      this.#snapshots.delete(key);
+      const prefix = `${key}\0`;
+      for (const receiptKeyValue of this.#receipts.keys()) {
+        if (receiptKeyValue.startsWith(prefix)) this.#receipts.delete(receiptKeyValue);
+      }
+      this.#eraseFences.set(key, nextWriterEpoch);
+      return AgentMemoryProjectionEraseResultSchema.parse({ nextWriterEpoch });
+    });
+  }
+  async #mutate(key, operation) {
+    const previous = this.#mutationTails.get(key) ?? Promise.resolve();
+    const result = previous.then(operation);
+    const tail = result.then(() => void 0, () => void 0);
+    this.#mutationTails.set(key, tail);
+    try {
+      return await result;
+    } finally {
+      if (this.#mutationTails.get(key) === tail) this.#mutationTails.delete(key);
+    }
+  }
+};
+var InMemoryAgentMemoryProjectionAuthorizer = class {
+  #grants = /* @__PURE__ */ new Map();
+  /** Highest host-issued epoch observed for each tenant/Agent authority. */
+  #highestEpochs = /* @__PURE__ */ new Map();
+  grant(input) {
+    const key = agentKey(input.tenantId, input.agentRef.agentId);
+    const highestEpoch = this.#highestEpochs.get(key);
+    if (highestEpoch !== void 0 && input.writerEpoch < highestEpoch) return;
+    if (highestEpoch === void 0 || input.writerEpoch > highestEpoch) {
+      for (const [grantKey, grant] of this.#grants) {
+        if (grant.tenantId === input.tenantId && grant.agentRef.agentId === input.agentRef.agentId && grant.writerEpoch < input.writerEpoch) this.#grants.delete(grantKey);
+      }
+      this.#highestEpochs.set(key, input.writerEpoch);
+    }
+    this.#grants.set(permitKey(input), { ...input, agentRef: { ...input.agentRef } });
+  }
+  async authorize(input) {
+    return this.#grants.has(permitKey(input)) ? { outcome: "authorized" } : { outcome: "denied", reasonCode: "grant_not_authorized" };
+  }
+  async revoke(input) {
+    for (const [key, grant] of this.#grants) {
+      if (grant.tenantId === input.tenantId && grant.agentRef.agentId === input.agentId) this.#grants.delete(key);
+    }
+  }
+};
 function authenticateHostedDeviceAssertion(input, deps) {
   return authenticateDeviceAssertion(input, {
     verifier: {
@@ -3852,6 +4314,6 @@ var CLOUD_PORT_INTERFACES = {
   rateLimiter: "InboundRateLimiter"
 };
 
-export { ACCESS_TOKEN_TTL_SECONDS, AGENT_HOME_CONTRACT_CAPABILITY, APPROVAL_SUMMARY_MAX_BYTES, ActivityAppendRequestSchema, AllowAllRateLimiter, ApprovalObservationSchema, ApprovalTimelineEventSchema, BLOB_READ_ERROR_CODES, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_APPROVAL_TIMELINE_CAPACITY, DEFAULT_APPROVAL_TIMELINE_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEFAULT_SKILL_PACK_PAGE_LIMIT, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, InMemoryActivityStore, InMemoryAgentEgressStore, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, InMemoryTaskCancellationStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TimelineEventSchema, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, activityCursor, agentHomeProjectionCompletionKey, agentHomeProjectionRequestKey, approvalTimelineCursor, authenticateBearer, authenticateDeviceProof, authenticateHostedDeviceAssertion, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, parseApprovalObservations, parseTimelineEvents, projectTerminalResult, projectTimelineEvents, readAgentHomeProjectionStatus, recordAgentHomeProjectionCompletion, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, validateActivityAppend, validateApprovalTimelineAppend, verifyNonceSignature };
+export { ACCESS_TOKEN_TTL_SECONDS, AGENT_HOME_CONTRACT_CAPABILITY, APPROVAL_SUMMARY_MAX_BYTES, ActivityAppendRequestSchema, AllowAllRateLimiter, ApprovalObservationSchema, ApprovalTimelineEventSchema, BLOB_READ_ERROR_CODES, BLOB_URL_TTL_MS, BoardFeedClient, BoardFeedRetryableError, BoardFeedStoppedError, ByokCloudError, CLOUD_CAPABILITIES, CLOUD_ERROR_CODES, CLOUD_PORT_INTERFACES, CLOUD_PORT_METHODS, CLOUD_STORE_NAMES, CapabilitiesResponseSchema, CloudRouteRegistry, DEDUP_RING_CAPACITY, DEFAULT_ACTIVITY_BOUNDS, DEFAULT_ACTIVITY_CAPACITY, DEFAULT_ACTIVITY_MAX_BYTES, DEFAULT_ACTIVITY_MAX_EVENTS, DEFAULT_ACTIVITY_TTL_MS, DEFAULT_APPROVAL_TIMELINE_CAPACITY, DEFAULT_APPROVAL_TIMELINE_TTL_MS, DEFAULT_BOARD_CHANNEL_MAX_BYTES, DEFAULT_BOARD_PAGE_LIMIT, DEFAULT_BOARD_STREAM_HEARTBEAT_INTERVAL_MS, DEFAULT_BOARD_STREAM_QUERY_INTERVAL_MS, DEFAULT_BOARD_STREAM_RECONCILIATION_INTERVAL_MS, DEFAULT_BOARD_TITLE_MAX_BYTES, DEFAULT_DEVICE_PROOF_CLOCK_SKEW_MS, DEFAULT_DEVICE_PROOF_MAX_LIFETIME_MS, DEFAULT_EVENTS_PAGE_LIMIT, DEFAULT_LONG_POLL_HOLD_MS, DEFAULT_LONG_POLL_INTERVAL_MS, DEFAULT_MAX_BLOB_SIZE_BYTES, DEFAULT_MAX_TRUTH_REQUEST_BYTES, DEFAULT_PRESENCE_DETAIL_MAX_BYTES, DEFAULT_PRESENCE_MINIMUM_INTERVAL_MS, DEFAULT_PRESENCE_TTL_MS, DEFAULT_SKILL_PACK_PAGE_LIMIT, DEVICE_IDENTITY_PROOF_KEY_EPOCH, DEVICE_IDENTITY_PROOF_KEY_ID, InMemoryActivityStore, InMemoryAgentEgressStore, InMemoryAgentMemoryProjectionAuthorizer, InMemoryAgentMemoryProjectionStore, InMemoryBlobContentProxy, InMemoryCloudBlobStore, InMemoryDeviceDirectory, InMemoryInboundDedupStore, InMemoryNonceStore, InMemoryPairingCodeStore, InMemoryProofRequestReceiptStore, InMemoryRequestReceiptStore, InMemoryTaskAttemptStore, InMemoryTaskCancellationStore, MAX_DEVICE_PROOF_CLOCK_SKEW_MS, MAX_DEVICE_PROOF_HEADER_BYTES, MAX_DEVICE_PROOF_MAX_LIFETIME_MS, NONCE_TTL_MS, PAIRING_CODE_TTL_MS, ROUTE_CLASSES, ROUTE_METHODS, TASK_ATTEMPT_STATUSES, TRUTH_BATCH_MAX_RECORDS, TRUTH_INLINE_CONTENT_TYPE, TRUTH_LABEL_MAX_LENGTH, TRUTH_MANIFEST_MAX_LIMIT, TRUTH_RECORD_CAPABILITY, TRUTH_RECORD_KEY_MAX_LENGTH, TRUTH_REQUEST_ID_MAX_LENGTH, TimelineEventSchema, TruthBodyInputSchema, TruthCommitError, TruthCommitResponseSchema, TruthRecordKeySchema, TruthRecordMetadataSchema, TruthWriteRequestSchema, activityCursor, agentHomeProjectionCompletionKey, agentHomeProjectionRequestKey, approvalTimelineCursor, authenticateBearer, authenticateDeviceProof, authenticateHostedDeviceAssertion, createAuthPlane, createByokCloud, createHmacTokenSigner, createInMemoryBlobs, createInMemoryByokCloud, createInMemoryCloudStores, createWebCrypto, declares, extractBearerToken, fullCapabilityDeclaration, handleInboundEnvelope, isCloudError, isTruthCommitError, parseApprovalObservations, parseTimelineEvents, projectTerminalResult, projectTimelineEvents, readAgentHomeProjectionStatus, recordAgentHomeProjectionCompletion, routeKey, tenantStoresFor, terminalReceiptKey, truthManifestMetadata, truthRecordMetadata, validateActivityAppend, validateApprovalTimelineAppend, verifyNonceSignature };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map