@byok-sdk/core 0.1.0

package/dist/index.js

@@ -0,0 +1,1498 @@
+import { z } from 'zod';
+
+// src/errors.ts
+var CORE_ERROR_CODES = {
+  // identity + content addressing
+  tenant_id_invalid: "tenant_id_invalid",
+  content_hash_invalid: "content_hash_invalid",
+  // caller-supplied instants (see `time.ts`)
+  timestamp_not_canonical: "timestamp_not_canonical",
+  // capability declaration (ADR-010)
+  capability_declaration_invalid: "capability_declaration_invalid",
+  capability_unavailable: "capability_unavailable",
+  // device proof (§12.6.3)
+  proof_envelope_invalid: "proof_envelope_invalid",
+  proof_canonicalization_failed: "proof_canonicalization_failed",
+  // mailbox (§12.7.3)
+  mailbox_message_not_found: "mailbox_message_not_found",
+  mailbox_cursor_regression: "mailbox_cursor_regression",
+  // board coordination (§12.3)
+  board_item_not_found: "board_item_not_found",
+  board_item_exists: "board_item_exists",
+  board_transition_invalid: "board_transition_invalid",
+  board_status_conflict: "board_status_conflict",
+  board_claim_conflict: "board_claim_conflict",
+  board_not_held: "board_not_held",
+  // truth records (§12.3, §12.6.4)
+  truth_record_not_found: "truth_record_not_found",
+  terminal_conflict: "terminal_conflict",
+  truth_revision_conflict: "truth_revision_conflict",
+  // presence + activity hints (§12.3)
+  activity_capacity_invalid: "activity_capacity_invalid",
+  activity_batch_invalid: "activity_batch_invalid",
+  hint_ttl_invalid: "hint_ttl_invalid",
+  hint_rate_limited: "hint_rate_limited",
+  // object manifest (§12.7.4, §12.7.8)
+  object_not_found: "object_not_found",
+  object_state_invalid: "object_state_invalid",
+  // storage entitlement / usage / reservation (§12.7.6-12.7.7)
+  storage_entitlement_missing: "storage_entitlement_missing",
+  storage_entitlement_version_conflict: "storage_entitlement_version_conflict",
+  storage_reservation_not_found: "storage_reservation_not_found",
+  storage_object_too_large: "storage_object_too_large",
+  storage_quota_exceeded: "storage_quota_exceeded",
+  storage_reservation_expired: "storage_reservation_expired",
+  storage_integrity_mismatch: "storage_integrity_mismatch",
+  storage_write_suspended: "storage_write_suspended"
+};
+var ByokCoreError = class extends Error {
+  code;
+  constructor(code, message, options) {
+    super(message, options);
+    this.name = "ByokCoreError";
+    this.code = code;
+  }
+};
+var CoreConflictError = class extends ByokCoreError {
+  current;
+  observedAt;
+  constructor(code, message, current, observedAt, options) {
+    super(code, message, options);
+    this.name = "CoreConflictError";
+    this.current = current;
+    this.observedAt = observedAt;
+  }
+};
+function isCoreError(value, code) {
+  if (!(value instanceof ByokCoreError)) return false;
+  return code === void 0 || value.code === code;
+}
+function isCoreConflictError(value, code) {
+  if (!(value instanceof CoreConflictError)) return false;
+  return code === void 0 || value.code === code;
+}
+
+// src/tenant.ts
+var TENANT_ID_MAX_LENGTH = 200;
+var TENANT_KEY_SEPARATOR = "\0";
+function tenantId(value) {
+  const candidate = value;
+  if (typeof candidate !== "string") {
+    throw new ByokCoreError(
+      "tenant_id_invalid",
+      `Tenant id must be a string, received ${typeof candidate}.`
+    );
+  }
+  if (candidate.length === 0) {
+    throw new ByokCoreError("tenant_id_invalid", "Tenant id must not be empty.");
+  }
+  if (candidate.trim() !== candidate) {
+    throw new ByokCoreError(
+      "tenant_id_invalid",
+      "Tenant id must not have leading or trailing whitespace."
+    );
+  }
+  if (candidate.length > TENANT_ID_MAX_LENGTH) {
+    throw new ByokCoreError(
+      "tenant_id_invalid",
+      `Tenant id must be at most ${TENANT_ID_MAX_LENGTH} characters.`
+    );
+  }
+  if (candidate.includes(TENANT_KEY_SEPARATOR)) {
+    throw new ByokCoreError("tenant_id_invalid", "Tenant id must not contain a NUL character.");
+  }
+  return candidate;
+}
+function isTenantId(value) {
+  if (typeof value !== "string") return false;
+  return value.length > 0 && value.trim() === value && value.length <= TENANT_ID_MAX_LENGTH && !value.includes(TENANT_KEY_SEPARATOR);
+}
+function tenantKey(tenant, ...parts) {
+  return [tenant, ...parts].join(TENANT_KEY_SEPARATOR);
+}
+
+// src/principals.ts
+var PRINCIPAL_KINDS = ["device", "control-plane"];
+function isDevicePrincipal(principal) {
+  return principal.kind === "device";
+}
+function isControlPlanePrincipal(principal) {
+  return principal.kind === "control-plane";
+}
+function principalTenant(principal) {
+  return principal.tenantId;
+}
+
+// src/time.ts
+var CANONICAL_TIMESTAMP_PATTERN = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/;
+function isCanonicalTimestamp(value) {
+  if (typeof value !== "string") return false;
+  if (!CANONICAL_TIMESTAMP_PATTERN.test(value)) return false;
+  const parsed = Date.parse(value);
+  if (!Number.isFinite(parsed)) return false;
+  return new Date(parsed).toISOString() === value;
+}
+function assertCanonicalTimestamp(value, field) {
+  if (!isCanonicalTimestamp(value)) {
+    throw new ByokCoreError(
+      "timestamp_not_canonical",
+      `${field} must be a canonical ISO-8601 UTC instant (YYYY-MM-DDTHH:mm:ss.sssZ), received ${JSON.stringify(value)}.`
+    );
+  }
+  return value;
+}
+
+// src/mailbox.ts
+var MAILBOX_MESSAGE_STATES = ["pending", "acked", "expired"];
+
+// src/board.ts
+var BOARD_STATUSES = ["todo", "in_progress", "in_review", "done", "closed"];
+var BOARD_TRANSITIONS = {
+  todo: ["in_progress", "closed"],
+  in_progress: ["todo", "in_review", "closed"],
+  in_review: ["in_progress", "done", "closed"],
+  done: [],
+  closed: []
+};
+function isLegalBoardTransition(from, to) {
+  return BOARD_TRANSITIONS[from].includes(to);
+}
+
+// src/truth.ts
+var TRUTH_RECORD_KINDS = ["task.terminal", "profile", "memory"];
+
+// src/presence.ts
+var PRESENCE_LEVELS = ["online", "thinking", "working", "error", "offline"];
+var DEFAULT_ACTIVITY_CAPACITY = 50;
+
+// src/blob.ts
+var CONTENT_HASH_PATTERN = /^sha256:[0-9a-f]{64}$/;
+function contentHash(value) {
+  if (!CONTENT_HASH_PATTERN.test(value)) {
+    throw new ByokCoreError(
+      "content_hash_invalid",
+      `Content hash must match ${CONTENT_HASH_PATTERN.source}, received ${JSON.stringify(value)}.`
+    );
+  }
+  return value;
+}
+function isContentHash(value) {
+  return typeof value === "string" && CONTENT_HASH_PATTERN.test(value);
+}
+function tenantObjectKey(tenant, hash) {
+  const hex = hash.slice("sha256:".length);
+  return `tenants/${tenant}/objects/sha256/${hex}`;
+}
+var OBJECT_STATES = ["pending", "committed", "delete_pending", "deleted"];
+var OBJECT_STATE_TRANSITIONS = {
+  pending: ["committed", "delete_pending"],
+  committed: ["delete_pending"],
+  delete_pending: ["deleted", "committed"],
+  deleted: []
+};
+function isLegalObjectTransition(from, to) {
+  return OBJECT_STATE_TRANSITIONS[from].includes(to);
+}
+
+// src/quota.ts
+var STORAGE_WRITE_KINDS = ["object", "inline"];
+var STORAGE_RESERVATION_STATES = [
+  "reserved",
+  "committed",
+  "aborted",
+  "expired"
+];
+var STORAGE_WRITE_POSTURES = ["normal", "warning", "blocked", "suspended"];
+var STORAGE_ERROR_CODES = [
+  "storage_object_too_large",
+  "storage_quota_exceeded",
+  "storage_reservation_expired",
+  "storage_integrity_mismatch",
+  "storage_write_suspended"
+];
+var STORAGE_ERROR_HTTP_STATUS = {
+  storage_object_too_large: 413,
+  storage_quota_exceeded: 507,
+  storage_reservation_expired: 409,
+  storage_integrity_mismatch: 422,
+  storage_write_suspended: 423
+};
+var CAPABILITY_DECLARATION_SCHEMA_ID = "byok-capabilities-v1";
+var CAPABILITY_NAME_PATTERN = /^[a-z0-9]+(?:[._-][a-z0-9]+)*$/;
+var CapabilityDeclarationSchema = z.object({
+  schema: z.literal(CAPABILITY_DECLARATION_SCHEMA_ID),
+  /** Monotonic per deployment. Lets a client cache and detect a rollout. */
+  version: z.number().int().nonnegative(),
+  capabilities: z.array(z.string().regex(CAPABILITY_NAME_PATTERN))
+}).superRefine((declaration, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, name] of declaration.capabilities.entries()) {
+    if (seen.has(name)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["capabilities", index],
+        message: `Duplicate capability ${JSON.stringify(name)}.`
+      });
+    }
+    seen.add(name);
+  }
+});
+function parseCapabilityDeclaration(input) {
+  const result = CapabilityDeclarationSchema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError(
+      "capability_declaration_invalid",
+      `Invalid capability declaration: ${result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: result.error }
+    );
+  }
+  return result.data;
+}
+function hasCapability(declaration, capability) {
+  return declaration.capabilities.includes(capability);
+}
+function assertCapability(declaration, capability) {
+  if (!hasCapability(declaration, capability)) {
+    throw new ByokCoreError(
+      "capability_unavailable",
+      `Capability ${JSON.stringify(capability)} is not declared by this deployment.`
+    );
+  }
+}
+
+// src/stores.ts
+var CORE_STORE_NAMES = [
+  "mailbox",
+  "board",
+  "truth",
+  "presence",
+  "activity",
+  "objects",
+  "quota"
+];
+
+// src/ports-contract.ts
+var CORE_PORT_METHODS = {
+  mailbox: ["append", "readAfter", "advanceCursor", "readCursor", "collectRetired"],
+  board: ["create", "get", "list", "claim", "unclaim", "updateStatus"],
+  truth: ["writeTerminal", "writeSnapshot", "getRecord", "listManifest"],
+  presence: ["publish", "read", "list"],
+  activity: ["append", "read"],
+  objects: [
+    "putManifest",
+    "commit",
+    "get",
+    "list",
+    "addReference",
+    "removeReference",
+    "markDeletePending",
+    "markDeleted"
+  ],
+  quota: [
+    "readEntitlement",
+    "writeEntitlement",
+    "readUsage",
+    "readStatus",
+    "readReservation",
+    "reserve",
+    "finalizeReservation",
+    "abortReservation",
+    "expireReservations",
+    "applyMailboxDelta"
+  ]
+};
+var CORE_PORT_INTERFACES = {
+  mailbox: "MailboxStore",
+  board: "BoardStore",
+  truth: "TruthStore",
+  presence: "PresenceStore",
+  activity: "ActivityStore",
+  objects: "ObjectStore",
+  quota: "QuotaStore"
+};
+var DEVICE_PROOF_SCHEMA_ID = "byok-device-proof-v1";
+var DEVICE_PROOF_DOMAIN_PREFIX = "byok-device-proof-v1\n";
+var DEVICE_PROOF_VERSION = 1;
+var DEVICE_PROOF_ALGORITHMS = ["ed25519"];
+var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
+var HTTP_METHOD_PATTERN = /^[A-Z]+$/;
+function canonicalizationFailure(path, reason) {
+  return new ByokCoreError(
+    "proof_canonicalization_failed",
+    `Cannot canonicalize ${path}: ${reason}`
+  );
+}
+function isPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function canonicalizeValue(value, path, seen) {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "boolean":
+      return value ? "true" : "false";
+    case "string":
+      return JSON.stringify(value);
+    case "number": {
+      if (!Number.isSafeInteger(value)) {
+        throw canonicalizationFailure(
+          path,
+          `only safe integers are canonicalizable, received ${String(value)}`
+        );
+      }
+      return String(value === 0 ? 0 : value);
+    }
+    case "undefined":
+      throw canonicalizationFailure(path, "undefined has no canonical form");
+    case "bigint":
+      throw canonicalizationFailure(path, "bigint is not a JSON type");
+    case "function":
+    case "symbol":
+      throw canonicalizationFailure(path, `${typeof value} is not a JSON type`);
+    case "object":
+      break;
+    default:
+      throw canonicalizationFailure(path, `unsupported type ${typeof value}`);
+  }
+  const objectValue = value;
+  if (seen.has(objectValue)) {
+    throw canonicalizationFailure(path, "circular reference");
+  }
+  seen.add(objectValue);
+  try {
+    if (Array.isArray(objectValue)) {
+      const parts2 = objectValue.map(
+        (entry, index) => canonicalizeValue(entry, `${path}[${index}]`, seen)
+      );
+      return `[${parts2.join(",")}]`;
+    }
+    if (!isPlainObject(objectValue)) {
+      throw canonicalizationFailure(
+        path,
+        "only plain objects and arrays are canonicalizable"
+      );
+    }
+    const keys = Object.keys(objectValue).sort();
+    const record = objectValue;
+    const parts = keys.map((key) => {
+      const encodedKey = JSON.stringify(key);
+      const encodedValue = canonicalizeValue(record[key], `${path}.${key}`, seen);
+      return `${encodedKey}:${encodedValue}`;
+    });
+    return `{${parts.join(",")}}`;
+  } finally {
+    seen.delete(objectValue);
+  }
+}
+function canonicalizeJson(value) {
+  return canonicalizeValue(value, "<root>", /* @__PURE__ */ new Set());
+}
+function canonicalizeJsonBytes(value) {
+  return new TextEncoder().encode(canonicalizeJson(value));
+}
+var DeviceProofProtectedClaimsSchema = z.strictObject({
+  version: z.literal(DEVICE_PROOF_VERSION),
+  tenantId: z.string().min(1),
+  productId: z.string().min(1),
+  deviceId: z.string().min(1),
+  /** Identity of the signing key, resolved against the device row at verify time. */
+  keyId: z.string().min(1),
+  /** Rotation generation. An older epoch is rejected by the verifier, not here. */
+  keyEpoch: z.number().int().nonnegative(),
+  /** Idempotency key: exact replay returns the original result, reuse with a different body is a conflict. */
+  requestId: z.string().min(1),
+  /** Logical operation, e.g. `truth.write`. */
+  operation: z.string().min(1),
+  /** Tenant-scoped resource the operation targets. */
+  resource: z.string().min(1),
+  method: z.string().regex(HTTP_METHOD_PATTERN).optional(),
+  path: z.string().startsWith("/").optional(),
+  operationId: z.string().min(1).optional(),
+  bodySha256: z.string().regex(CONTENT_HASH_PATTERN),
+  /** Bound alongside the hash so a truncation attack cannot hide behind a hash collision claim. */
+  bodySize: z.number().int().nonnegative(),
+  issuedAt: z.iso.datetime(),
+  expiresAt: z.iso.datetime().optional(),
+  nonce: z.string().min(1).optional()
+}).superRefine((claims, ctx) => {
+  const hasRequestLine = claims.method !== void 0 && claims.path !== void 0;
+  const hasOperationId = claims.operationId !== void 0;
+  if (hasRequestLine === hasOperationId) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Claims must carry exactly one request binding: both `method` and `path`, or `operationId`."
+    });
+  }
+  if (!hasRequestLine && (claims.method !== void 0 || claims.path !== void 0)) {
+    ctx.addIssue({
+      code: "custom",
+      message: "`method` and `path` must be supplied together."
+    });
+  }
+});
+var DeviceProofEnvelopeV1Schema = z.strictObject({
+  schema: z.literal(DEVICE_PROOF_SCHEMA_ID),
+  algorithm: z.enum(DEVICE_PROOF_ALGORITHMS),
+  protected: DeviceProofProtectedClaimsSchema,
+  /** base64url, unpadded. */
+  signature: z.string().regex(BASE64URL_PATTERN)
+});
+function parseDeviceProofEnvelope(input) {
+  const result = DeviceProofEnvelopeV1Schema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError(
+      "proof_envelope_invalid",
+      `Invalid device proof envelope: ${result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: result.error }
+    );
+  }
+  return result.data;
+}
+function deviceProofCanonicalClaims(claims) {
+  const canonical = {
+    version: claims.version,
+    tenantId: claims.tenantId,
+    productId: claims.productId,
+    deviceId: claims.deviceId,
+    keyId: claims.keyId,
+    keyEpoch: claims.keyEpoch,
+    requestId: claims.requestId,
+    operation: claims.operation,
+    resource: claims.resource,
+    bodySha256: claims.bodySha256,
+    bodySize: claims.bodySize,
+    issuedAt: claims.issuedAt
+  };
+  if (claims.method !== void 0) canonical["method"] = claims.method;
+  if (claims.path !== void 0) canonical["path"] = claims.path;
+  if (claims.operationId !== void 0) canonical["operationId"] = claims.operationId;
+  if (claims.expiresAt !== void 0) canonical["expiresAt"] = claims.expiresAt;
+  if (claims.nonce !== void 0) canonical["nonce"] = claims.nonce;
+  return canonical;
+}
+function deviceProofCanonicalJson(claims) {
+  return canonicalizeJson(deviceProofCanonicalClaims(claims));
+}
+function deviceProofSigningInput(claims) {
+  return new TextEncoder().encode(
+    DEVICE_PROOF_DOMAIN_PREFIX + deviceProofCanonicalJson(claims)
+  );
+}
+
+// src/in-memory/presence.ts
+function assertTtl(ttlMs) {
+  if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+    throw new ByokCoreError(
+      "hint_ttl_invalid",
+      `Hint ttl must be a positive number of milliseconds, received ${String(ttlMs)}.`
+    );
+  }
+}
+function assertMinimumInterval(minimumIntervalMs) {
+  if (!Number.isFinite(minimumIntervalMs) || minimumIntervalMs < 0) {
+    throw new ByokCoreError(
+      "hint_ttl_invalid",
+      `Hint minimum interval must be a non-negative number of milliseconds, received ${String(minimumIntervalMs)}.`
+    );
+  }
+}
+var InMemoryPresenceStore = class {
+  #hints = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async publish(tenant, input) {
+    assertTtl(input.ttlMs);
+    assertMinimumInterval(input.minimumIntervalMs);
+    const now = this.#clock.now();
+    const key = tenantKey(tenant, input.deviceId);
+    const existing = this.#hints.get(key);
+    if (existing !== void 0 && now.toISOString() < existing.expiresAt && now.getTime() - Date.parse(existing.observedAt) < input.minimumIntervalMs) {
+      throw new ByokCoreError(
+        "hint_rate_limited",
+        `Presence for ${input.deviceId} was published more recently than the configured minimum interval.`
+      );
+    }
+    const hint = {
+      tenantId: tenant,
+      deviceId: input.deviceId,
+      level: input.level,
+      ...input.detail === void 0 ? {} : { detail: input.detail },
+      observedAt: now.toISOString(),
+      expiresAt: new Date(now.getTime() + input.ttlMs).toISOString()
+    };
+    this.#hints.set(key, hint);
+    return hint;
+  }
+  async read(tenant, deviceId) {
+    const key = tenantKey(tenant, deviceId);
+    const hint = this.#hints.get(key);
+    if (hint === void 0) return void 0;
+    if (this.#isExpired(hint.expiresAt)) {
+      this.#hints.delete(key);
+      return void 0;
+    }
+    return hint;
+  }
+  async list(tenant) {
+    const prefix = tenantKey(tenant, "");
+    const live = [];
+    for (const [key, hint] of [...this.#hints.entries()]) {
+      if (!key.startsWith(prefix)) continue;
+      if (this.#isExpired(hint.expiresAt)) {
+        this.#hints.delete(key);
+        continue;
+      }
+      live.push(hint);
+    }
+    live.sort((left, right) => left.deviceId.localeCompare(right.deviceId));
+    return live;
+  }
+  #isExpired(expiresAt) {
+    return this.#clock.now().toISOString() >= expiresAt;
+  }
+};
+var InMemoryActivityStore = class {
+  #tails = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async append(tenant, input) {
+    assertTtl(input.ttlMs);
+    const capacity = input.capacity ?? DEFAULT_ACTIVITY_CAPACITY;
+    if (!Number.isSafeInteger(capacity) || capacity <= 0) {
+      throw new ByokCoreError(
+        "activity_capacity_invalid",
+        `Activity capacity must be a positive integer, received ${String(capacity)}.`
+      );
+    }
+    if (input.details.length === 0 || !Number.isSafeInteger(input.dropped) || input.dropped < 0) {
+      throw new ByokCoreError(
+        "activity_batch_invalid",
+        "Activity batches require at least one detail and a non-negative integer dropped count."
+      );
+    }
+    const now = this.#clock.now();
+    const key = tenantKey(tenant, input.taskId);
+    const existing = this.#tails.get(key);
+    const live = existing !== void 0 && now.toISOString() < existing.expiresAt ? existing : void 0;
+    const appended = input.details.map((detail) => ({
+      at: now.toISOString(),
+      detail
+    }));
+    const entries = [...live?.entries ?? [], ...appended];
+    let dropped = (live?.dropped ?? 0) + input.dropped;
+    while (entries.length > capacity) {
+      entries.shift();
+      dropped += 1;
+    }
+    const tail = {
+      tenantId: tenant,
+      taskId: input.taskId,
+      entries,
+      dropped,
+      capacity,
+      expiresAt: new Date(now.getTime() + input.ttlMs).toISOString()
+    };
+    this.#tails.set(key, tail);
+    return tail;
+  }
+  async read(tenant, taskId) {
+    const key = tenantKey(tenant, taskId);
+    const tail = this.#tails.get(key);
+    if (tail === void 0) return void 0;
+    if (this.#clock.now().toISOString() >= tail.expiresAt) {
+      this.#tails.delete(key);
+      return void 0;
+    }
+    return tail;
+  }
+};
+
+// src/in-memory/board.ts
+var DEFAULT_LIST_LIMIT = 50;
+var InMemoryBoardStore = class {
+  #items = /* @__PURE__ */ new Map();
+  #seqByTenant = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async create(tenant, input) {
+    const key = tenantKey(tenant, input.itemId);
+    if (this.#items.has(key)) {
+      throw new ByokCoreError(
+        "board_item_exists",
+        `Board item ${input.itemId} already exists in this tenant.`
+      );
+    }
+    const now = this.#now();
+    const item = {
+      tenantId: tenant,
+      itemId: input.itemId,
+      channel: input.channel,
+      title: input.title,
+      status: input.status ?? "todo",
+      boardSeq: this.#nextSeq(tenant),
+      createdAt: now,
+      updatedAt: now
+    };
+    this.#items.set(key, item);
+    return item;
+  }
+  async get(tenant, itemId) {
+    return this.#items.get(tenantKey(tenant, itemId));
+  }
+  async list(tenant, query) {
+    const afterSeq = query.afterSeq ?? 0;
+    const limit = query.limit ?? DEFAULT_LIST_LIMIT;
+    const prefix = tenantKey(tenant, "");
+    const matches = [];
+    for (const [key, item] of this.#items.entries()) {
+      if (!key.startsWith(prefix)) continue;
+      if (item.boardSeq <= afterSeq) continue;
+      if (query.channel !== void 0 && item.channel !== query.channel) continue;
+      if (query.status !== void 0 && item.status !== query.status) continue;
+      matches.push(item);
+    }
+    matches.sort((left, right) => left.boardSeq - right.boardSeq);
+    const page = matches.slice(0, limit);
+    return {
+      items: page,
+      nextSeq: page.at(-1)?.boardSeq ?? afterSeq,
+      hasMore: matches.length > page.length
+    };
+  }
+  async claim(tenant, input) {
+    const item = this.#require(tenant, input.itemId);
+    const expectedStatus = input.expectedStatus ?? "todo";
+    if (item.assignee !== void 0) {
+      if (item.assignee.holderId === input.holderId) {
+        if (input.expectedStatus !== void 0 && item.status !== input.expectedStatus) {
+          throw new CoreConflictError(
+            "board_status_conflict",
+            `Board item ${input.itemId} is ${item.status}, not ${input.expectedStatus}.`,
+            item,
+            this.#now()
+          );
+        }
+        return item;
+      }
+      throw new CoreConflictError(
+        "board_claim_conflict",
+        `Board item ${input.itemId} is held by ${item.assignee.holderId}.`,
+        item,
+        this.#now()
+      );
+    }
+    if (item.status !== expectedStatus) {
+      throw new CoreConflictError(
+        "board_status_conflict",
+        `Board item ${input.itemId} is ${item.status}, not ${expectedStatus}.`,
+        item,
+        this.#now()
+      );
+    }
+    if (item.status !== "todo" && item.status !== "in_progress") {
+      throw new CoreConflictError(
+        "board_transition_invalid",
+        `Board item ${input.itemId} cannot be claimed from ${item.status}.`,
+        item,
+        this.#now()
+      );
+    }
+    const now = this.#now();
+    const claimed = {
+      ...item,
+      status: item.status === "todo" ? "in_progress" : item.status,
+      assignee: { holderId: input.holderId, heldSince: now },
+      boardSeq: this.#nextSeq(tenant),
+      updatedAt: now
+    };
+    this.#items.set(tenantKey(tenant, input.itemId), claimed);
+    return claimed;
+  }
+  async unclaim(tenant, input) {
+    const item = this.#require(tenant, input.itemId);
+    if (item.assignee === void 0) {
+      throw new ByokCoreError(
+        "board_not_held",
+        `Board item ${input.itemId} is not held by anyone.`
+      );
+    }
+    if (item.assignee.holderId !== input.holderId) {
+      throw new CoreConflictError(
+        "board_claim_conflict",
+        `Board item ${input.itemId} is held by ${item.assignee.holderId}, not ${input.holderId}.`,
+        item,
+        this.#now()
+      );
+    }
+    const now = this.#now();
+    const released = {
+      tenantId: item.tenantId,
+      itemId: item.itemId,
+      channel: item.channel,
+      title: item.title,
+      status: item.status === "in_progress" ? "todo" : item.status,
+      boardSeq: this.#nextSeq(tenant),
+      createdAt: item.createdAt,
+      updatedAt: now
+    };
+    this.#items.set(tenantKey(tenant, input.itemId), released);
+    return released;
+  }
+  async updateStatus(tenant, input) {
+    const item = this.#require(tenant, input.itemId);
+    if (item.status !== input.expectedStatus) {
+      throw new CoreConflictError(
+        "board_status_conflict",
+        `Board item ${input.itemId} is ${item.status}, not ${input.expectedStatus}.`,
+        item,
+        this.#now()
+      );
+    }
+    if (input.holderId !== void 0 && item.assignee?.holderId !== input.holderId) {
+      throw new CoreConflictError(
+        "board_claim_conflict",
+        `Board item ${input.itemId} is not held by ${input.holderId}.`,
+        item,
+        this.#now()
+      );
+    }
+    if (!isLegalBoardTransition(input.expectedStatus, input.status)) {
+      throw new CoreConflictError(
+        "board_transition_invalid",
+        `${input.expectedStatus} to ${input.status} is not a legal board transition.`,
+        item,
+        this.#now()
+      );
+    }
+    const now = this.#now();
+    const updated = {
+      ...item,
+      status: input.status,
+      boardSeq: this.#nextSeq(tenant),
+      updatedAt: now
+    };
+    this.#items.set(tenantKey(tenant, input.itemId), updated);
+    return updated;
+  }
+  #require(tenant, itemId) {
+    const item = this.#items.get(tenantKey(tenant, itemId));
+    if (item === void 0) {
+      throw new ByokCoreError(
+        "board_item_not_found",
+        `Board item ${itemId} does not exist in this tenant.`
+      );
+    }
+    return item;
+  }
+  #nextSeq(tenant) {
+    const next = (this.#seqByTenant.get(tenant) ?? 0) + 1;
+    this.#seqByTenant.set(tenant, next);
+    return next;
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/in-memory/mailbox.ts
+var DEFAULT_READ_LIMIT = 50;
+var InMemoryMailboxStore = class {
+  #devices = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async append(tenant, input) {
+    const device = this.#device(tenant, input.deviceId);
+    const existing = device.byMessageId.get(input.messageId);
+    if (existing !== void 0) return existing;
+    const message = {
+      tenantId: tenant,
+      deviceId: input.deviceId,
+      seq: device.nextSeq,
+      messageId: input.messageId,
+      body: input.body,
+      bodyHash: input.bodyHash,
+      byteSize: input.byteSize,
+      state: "pending",
+      appendedAt: this.#now()
+    };
+    device.nextSeq += 1;
+    device.messages.push(message);
+    device.byMessageId.set(message.messageId, message);
+    return message;
+  }
+  async readAfter(tenant, query) {
+    const device = this.#devices.get(tenantKey(tenant, query.deviceId));
+    const limit = query.limit ?? DEFAULT_READ_LIMIT;
+    if (device === void 0) {
+      return { messages: [], nextSeq: query.afterSeq, hasMore: false };
+    }
+    const pending = device.messages.filter((message) => message.state === "pending" && message.seq > query.afterSeq).sort((left, right) => left.seq - right.seq);
+    const page = pending.slice(0, limit);
+    const last = page.at(-1);
+    return {
+      messages: page,
+      // Reading is not acknowledging: the returned position is a *read* cursor.
+      // Nothing above was mutated, so an identical call replays the same page.
+      nextSeq: last?.seq ?? query.afterSeq,
+      hasMore: pending.length > page.length
+    };
+  }
+  async advanceCursor(tenant, input) {
+    const device = this.#device(tenant, input.deviceId);
+    if (input.ackedSeq < device.ackedSeq) {
+      throw new CoreConflictError(
+        "mailbox_cursor_regression",
+        `Cursor for device ${input.deviceId} is at ${device.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
+        this.#cursorState(tenant, input.deviceId, device),
+        this.#now()
+      );
+    }
+    device.ackedSeq = input.ackedSeq;
+    device.cursorUpdatedAt = this.#now();
+    for (const [index, message] of device.messages.entries()) {
+      if (message.state === "pending" && message.seq <= input.ackedSeq) {
+        device.messages[index] = { ...message, state: "acked" };
+        device.byMessageId.set(message.messageId, device.messages[index]);
+      }
+    }
+    return this.#cursorState(tenant, input.deviceId, device);
+  }
+  async readCursor(tenant, deviceId) {
+    const device = this.#devices.get(tenantKey(tenant, deviceId));
+    if (device === void 0) {
+      return { tenantId: tenant, deviceId, ackedSeq: 0, updatedAt: this.#now() };
+    }
+    return this.#cursorState(tenant, deviceId, device);
+  }
+  async collectRetired(tenant, input) {
+    assertCanonicalTimestamp(input.ackedBefore, "ackedBefore");
+    assertCanonicalTimestamp(input.expireUnackedBefore, "expireUnackedBefore");
+    let deletedCount = 0;
+    let expiredCount = 0;
+    let releasedBytes = 0n;
+    for (const [key, device] of this.#devices.entries()) {
+      if (!key.startsWith(tenantKey(tenant, ""))) continue;
+      if (input.deviceId !== void 0 && key !== tenantKey(tenant, input.deviceId)) continue;
+      for (let index = device.messages.length - 1; index >= 0; index -= 1) {
+        const message = device.messages[index];
+        if (message.state === "acked" && message.appendedAt < input.ackedBefore) {
+          device.messages.splice(index, 1);
+          device.byMessageId.delete(message.messageId);
+          deletedCount += 1;
+          releasedBytes += message.byteSize;
+          continue;
+        }
+        if (message.state === "pending" && message.appendedAt < input.expireUnackedBefore) {
+          const expired = { ...message, state: "expired" };
+          device.messages[index] = expired;
+          device.byMessageId.set(expired.messageId, expired);
+          expiredCount += 1;
+        }
+      }
+    }
+    return { deletedCount, expiredCount, releasedBytes };
+  }
+  #device(tenant, deviceId) {
+    if (deviceId.length === 0) {
+      throw new ByokCoreError("mailbox_message_not_found", "Device id must not be empty.");
+    }
+    const key = tenantKey(tenant, deviceId);
+    const existing = this.#devices.get(key);
+    if (existing !== void 0) return existing;
+    const created = {
+      nextSeq: 1,
+      ackedSeq: 0,
+      cursorUpdatedAt: this.#now(),
+      messages: [],
+      byMessageId: /* @__PURE__ */ new Map()
+    };
+    this.#devices.set(key, created);
+    return created;
+  }
+  #cursorState(tenant, deviceId, device) {
+    return {
+      tenantId: tenant,
+      deviceId,
+      ackedSeq: device.ackedSeq,
+      updatedAt: device.cursorUpdatedAt
+    };
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/in-memory/blob.ts
+var DEFAULT_LIST_LIMIT2 = 100;
+var InMemoryObjectStore = class {
+  #manifest = /* @__PURE__ */ new Map();
+  #references = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async putManifest(tenant, input) {
+    const key = tenantKey(tenant, input.hash);
+    const existing = this.#manifest.get(key);
+    if (existing !== void 0 && existing.state !== "deleted") return existing;
+    const now = this.#now();
+    const entry = {
+      tenantId: tenant,
+      hash: input.hash,
+      byteSize: input.byteSize,
+      contentType: input.contentType,
+      state: "pending",
+      refCount: 0,
+      createdAt: now,
+      updatedAt: now
+    };
+    this.#manifest.set(key, entry);
+    return entry;
+  }
+  async commit(tenant, input) {
+    const entry = this.#require(tenant, input.hash);
+    if (entry.byteSize !== input.observedByteSize || entry.contentType !== input.observedContentType) {
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Observed object ${input.hash} (${String(input.observedByteSize)} bytes, ${input.observedContentType}) does not match the declared manifest.`
+      );
+    }
+    if (entry.state === "committed") return entry;
+    return this.#transition(tenant, entry, "committed");
+  }
+  async get(tenant, hash) {
+    return this.#manifest.get(tenantKey(tenant, hash));
+  }
+  async list(tenant, query) {
+    if (query.deletePendingBefore !== void 0) {
+      assertCanonicalTimestamp(query.deletePendingBefore, "deletePendingBefore");
+    }
+    const prefix = tenantKey(tenant, "");
+    const matches = [];
+    for (const [key, entry] of this.#manifest.entries()) {
+      if (!key.startsWith(prefix)) continue;
+      if (query.state !== void 0 && entry.state !== query.state) continue;
+      if (query.deletePendingBefore !== void 0) {
+        if (entry.deletePendingAt === void 0) continue;
+        if (entry.deletePendingAt >= query.deletePendingBefore) continue;
+      }
+      matches.push(entry);
+    }
+    matches.sort((left, right) => left.hash.localeCompare(right.hash));
+    return matches.slice(0, query.limit ?? DEFAULT_LIST_LIMIT2);
+  }
+  async addReference(tenant, input) {
+    const entry = this.#require(tenant, input.hash);
+    if (entry.state !== "committed") {
+      throw new ByokCoreError(
+        "object_state_invalid",
+        `Only committed objects can be referenced; ${input.hash} is ${entry.state}.`
+      );
+    }
+    const refKey = tenantKey(tenant, input.hash, input.refKind, input.refId);
+    if (!this.#references.has(refKey)) {
+      this.#references.set(refKey, {
+        tenantId: tenant,
+        hash: input.hash,
+        refKind: input.refKind,
+        refId: input.refId,
+        createdAt: this.#now()
+      });
+    }
+    return this.#recount(tenant, entry);
+  }
+  async removeReference(tenant, input) {
+    const entry = this.#require(tenant, input.hash);
+    this.#references.delete(tenantKey(tenant, input.hash, input.refKind, input.refId));
+    return this.#recount(tenant, entry);
+  }
+  async markDeletePending(tenant, hash) {
+    const entry = this.#require(tenant, hash);
+    if (entry.refCount !== 0) {
+      throw new ByokCoreError(
+        "object_state_invalid",
+        `Object ${hash} still has ${entry.refCount} reference(s).`
+      );
+    }
+    return this.#transition(tenant, entry, "delete_pending");
+  }
+  async markDeleted(tenant, hash) {
+    const entry = this.#require(tenant, hash);
+    return this.#transition(tenant, entry, "deleted");
+  }
+  #transition(tenant, entry, next) {
+    if (!isLegalObjectTransition(entry.state, next)) {
+      throw new ByokCoreError(
+        "object_state_invalid",
+        `${entry.state} to ${next} is not a legal object manifest transition.`
+      );
+    }
+    const now = this.#now();
+    const updated = {
+      ...entry,
+      state: next,
+      updatedAt: now,
+      ...next === "delete_pending" ? { deletePendingAt: now } : {}
+    };
+    this.#manifest.set(tenantKey(tenant, entry.hash), updated);
+    return updated;
+  }
+  #recount(tenant, entry) {
+    const refPrefix = tenantKey(tenant, entry.hash, "");
+    let refCount = 0;
+    for (const key of this.#references.keys()) {
+      if (key.startsWith(refPrefix)) refCount += 1;
+    }
+    const updated = { ...entry, refCount, updatedAt: this.#now() };
+    this.#manifest.set(tenantKey(tenant, entry.hash), updated);
+    return updated;
+  }
+  #require(tenant, hash) {
+    const entry = this.#manifest.get(tenantKey(tenant, hash));
+    if (entry === void 0) {
+      throw new ByokCoreError(
+        "object_not_found",
+        `Object ${hash} has no manifest row in this tenant.`
+      );
+    }
+    return entry;
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/in-memory/quota.ts
+var WARNING_NUMERATOR = 80n;
+var WARNING_DENOMINATOR = 100n;
+var InMemoryQuotaStore = class {
+  #entitlements = /* @__PURE__ */ new Map();
+  #usage = /* @__PURE__ */ new Map();
+  #reservations = /* @__PURE__ */ new Map();
+  #committedHashes = /* @__PURE__ */ new Map();
+  #clock;
+  #objects;
+  constructor(clock, objects) {
+    this.#clock = clock;
+    this.#objects = objects;
+  }
+  async readEntitlement(tenant) {
+    return this.#entitlements.get(tenant);
+  }
+  async writeEntitlement(tenant, input) {
+    if (input.downgradeGraceUntil !== void 0) {
+      assertCanonicalTimestamp(input.downgradeGraceUntil, "downgradeGraceUntil");
+    }
+    const existing = this.#entitlements.get(tenant);
+    if (existing !== void 0 && input.version <= existing.version) {
+      throw new CoreConflictError(
+        "storage_entitlement_version_conflict",
+        `Entitlement is at version ${String(existing.version)}; refusing to apply version ${String(input.version)}.`,
+        existing,
+        this.#now()
+      );
+    }
+    const entitlement = {
+      tenantId: tenant,
+      version: input.version,
+      hardLimitBytes: input.hardLimitBytes,
+      maxObjectBytes: input.maxObjectBytes,
+      maxInlineBytes: input.maxInlineBytes,
+      mailboxLimitBytes: input.mailboxLimitBytes,
+      retentionPolicyId: input.retentionPolicyId,
+      ...input.downgradeGraceUntil === void 0 ? {} : { downgradeGraceUntil: input.downgradeGraceUntil }
+    };
+    this.#entitlements.set(tenant, entitlement);
+    return entitlement;
+  }
+  async readUsage(tenant) {
+    return this.#usageOf(tenant);
+  }
+  async readStatus(tenant) {
+    const entitlement = this.#requireEntitlement(tenant);
+    const usage = this.#usageOf(tenant);
+    const used = this.#usedBytes(usage);
+    const graceActive = entitlement.downgradeGraceUntil !== void 0 && this.#now() < entitlement.downgradeGraceUntil;
+    return {
+      entitlement,
+      usage,
+      posture: this.#posture(entitlement, usage, graceActive),
+      availableBytes: used >= entitlement.hardLimitBytes ? 0n : entitlement.hardLimitBytes - used,
+      graceActive
+    };
+  }
+  async readReservation(tenant, reservationId) {
+    return this.#reservations.get(tenantKey(tenant, reservationId))?.reservation;
+  }
+  async reserve(tenant, input) {
+    const entitlement = this.#requireEntitlement(tenant);
+    await this.expireReservations(tenant);
+    const key = tenantKey(tenant, input.reservationId);
+    const existing = this.#reservations.get(key);
+    if (existing !== void 0) {
+      if (existing.reservation.state === "reserved") {
+        if (existing.reservation.kind !== input.kind || existing.reservation.expectedBytes !== input.expectedBytes || existing.reservation.contentHash !== input.contentHash || existing.reservation.contentType !== input.contentType) {
+          throw new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Reservation ${input.reservationId} already binds a different storage declaration.`
+          );
+        }
+        return existing.reservation;
+      }
+      throw new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} is already ${existing.reservation.state}.`
+      );
+    }
+    const usage = this.#usageOf(tenant);
+    const graceActive = entitlement.downgradeGraceUntil !== void 0 && this.#now() < entitlement.downgradeGraceUntil;
+    if (this.#posture(entitlement, usage, graceActive) === "suspended") {
+      throw new ByokCoreError(
+        "storage_write_suspended",
+        "Tenant is over its hard limit and its downgrade grace has ended; durable writes are suspended."
+      );
+    }
+    const perObjectLimit = input.kind === "object" ? entitlement.maxObjectBytes : entitlement.maxInlineBytes;
+    if (input.expectedBytes > perObjectLimit) {
+      throw new ByokCoreError(
+        "storage_object_too_large",
+        `${String(input.expectedBytes)} bytes exceeds the ${input.kind} limit of ${String(perObjectLimit)} bytes.`
+      );
+    }
+    if (this.#usedBytes(usage) + input.expectedBytes > entitlement.hardLimitBytes) {
+      throw new ByokCoreError(
+        "storage_quota_exceeded",
+        `Reserving ${String(input.expectedBytes)} bytes would exceed the hard limit of ${String(entitlement.hardLimitBytes)} bytes.`
+      );
+    }
+    const now = this.#now();
+    const reservation = {
+      tenantId: tenant,
+      reservationId: input.reservationId,
+      state: "reserved",
+      kind: input.kind,
+      expectedBytes: input.expectedBytes,
+      contentHash: input.contentHash,
+      contentType: input.contentType,
+      createdAt: now,
+      expiresAt: new Date(this.#clock.now().getTime() + input.ttlMs).toISOString()
+    };
+    this.#reservations.set(key, { reservation, deduplicated: false });
+    this.#setUsage(tenant, { ...usage, reservedBytes: usage.reservedBytes + input.expectedBytes });
+    return reservation;
+  }
+  async finalizeReservation(tenant, input) {
+    const key = tenantKey(tenant, input.reservationId);
+    const record = this.#requireReservation(tenant, input.reservationId);
+    const reservation = record.reservation;
+    if (reservation.state === "committed") {
+      return {
+        reservation,
+        usage: this.#usageOf(tenant),
+        deduplicated: record.deduplicated
+      };
+    }
+    if (reservation.state !== "reserved") {
+      throw new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} is ${reservation.state}.`
+      );
+    }
+    if (this.#now() >= reservation.expiresAt) {
+      this.#settle(tenant, key, record, "expired");
+      throw new ByokCoreError(
+        "storage_reservation_expired",
+        `Reservation ${input.reservationId} expired at ${reservation.expiresAt}.`
+      );
+    }
+    if (input.observedByteSize !== reservation.expectedBytes || input.observedContentType !== reservation.contentType) {
+      this.#settle(tenant, key, record, "aborted");
+      throw new ByokCoreError(
+        "storage_integrity_mismatch",
+        `Observed object does not match reservation ${input.reservationId}.`
+      );
+    }
+    if (reservation.kind === "object") {
+      try {
+        await this.#objects.commit(tenant, {
+          hash: reservation.contentHash,
+          observedByteSize: input.observedByteSize,
+          observedContentType: input.observedContentType
+        });
+      } catch (error) {
+        this.#settle(tenant, key, record, "aborted");
+        if (error instanceof ByokCoreError && (error.code === "object_not_found" || error.code === "object_state_invalid")) {
+          throw new ByokCoreError(
+            "storage_integrity_mismatch",
+            `Reservation ${input.reservationId} has no committable object manifest.`,
+            { cause: error }
+          );
+        }
+        throw error;
+      }
+    }
+    const hashes = this.#hashesOf(tenant);
+    const deduplicated = hashes.has(reservation.contentHash);
+    const settled = this.#settle(tenant, key, record, "committed", deduplicated);
+    if (!deduplicated) {
+      hashes.add(reservation.contentHash);
+      const current = this.#usageOf(tenant);
+      this.#setUsage(tenant, {
+        ...current,
+        committedObjectBytes: reservation.kind === "object" ? current.committedObjectBytes + reservation.expectedBytes : current.committedObjectBytes,
+        committedInlineBytes: reservation.kind === "inline" ? current.committedInlineBytes + reservation.expectedBytes : current.committedInlineBytes,
+        objectCount: reservation.kind === "object" ? current.objectCount + 1n : current.objectCount
+      });
+    }
+    return { reservation: settled, usage: this.#usageOf(tenant), deduplicated };
+  }
+  async abortReservation(tenant, reservationId) {
+    const key = tenantKey(tenant, reservationId);
+    const record = this.#requireReservation(tenant, reservationId);
+    if (record.reservation.state !== "reserved") return record.reservation;
+    return this.#settle(tenant, key, record, "aborted");
+  }
+  async expireReservations(tenant) {
+    const prefix = tenantKey(tenant, "");
+    const now = this.#now();
+    const expired = [];
+    for (const [key, record] of [...this.#reservations.entries()]) {
+      if (!key.startsWith(prefix)) continue;
+      if (record.reservation.state !== "reserved") continue;
+      if (now < record.reservation.expiresAt) continue;
+      expired.push(this.#settle(tenant, key, record, "expired"));
+    }
+    return expired;
+  }
+  async applyMailboxDelta(tenant, input) {
+    const entitlement = this.#requireEntitlement(tenant);
+    const usage = this.#usageOf(tenant);
+    const next = usage.mailboxBytes + input.deltaBytes;
+    if (input.deltaBytes > 0n && next > entitlement.mailboxLimitBytes) {
+      throw new ByokCoreError(
+        "storage_quota_exceeded",
+        `Mailbox would reach ${String(next)} bytes, over the limit of ${String(entitlement.mailboxLimitBytes)} bytes.`
+      );
+    }
+    this.#setUsage(tenant, { ...usage, mailboxBytes: next < 0n ? 0n : next });
+    return this.#usageOf(tenant);
+  }
+  #settle(tenant, key, record, state, deduplicated = false) {
+    const settled = {
+      ...record.reservation,
+      state,
+      settledAt: this.#now()
+    };
+    this.#reservations.set(key, { reservation: settled, deduplicated });
+    const usage = this.#usageOf(tenant);
+    const released = usage.reservedBytes - record.reservation.expectedBytes;
+    this.#setUsage(tenant, { ...usage, reservedBytes: released < 0n ? 0n : released });
+    return settled;
+  }
+  #posture(entitlement, usage, graceActive) {
+    const used = this.#usedBytes(usage);
+    if (used >= entitlement.hardLimitBytes) {
+      const graceConfigured = entitlement.downgradeGraceUntil !== void 0;
+      return graceConfigured && !graceActive ? "suspended" : "blocked";
+    }
+    if (entitlement.hardLimitBytes > 0n && used * WARNING_DENOMINATOR >= entitlement.hardLimitBytes * WARNING_NUMERATOR) {
+      return "warning";
+    }
+    return "normal";
+  }
+  #usedBytes(usage) {
+    return usage.committedObjectBytes + usage.committedInlineBytes + usage.reservedBytes;
+  }
+  #usageOf(tenant) {
+    const existing = this.#usage.get(tenant);
+    if (existing !== void 0) return existing;
+    const empty = {
+      committedObjectBytes: 0n,
+      committedInlineBytes: 0n,
+      reservedBytes: 0n,
+      mailboxBytes: 0n,
+      objectCount: 0n,
+      updatedAt: this.#now()
+    };
+    this.#usage.set(tenant, empty);
+    return empty;
+  }
+  #setUsage(tenant, usage) {
+    this.#usage.set(tenant, { ...usage, updatedAt: this.#now() });
+  }
+  #hashesOf(tenant) {
+    const existing = this.#committedHashes.get(tenant);
+    if (existing !== void 0) return existing;
+    const created = /* @__PURE__ */ new Set();
+    this.#committedHashes.set(tenant, created);
+    return created;
+  }
+  #requireEntitlement(tenant) {
+    const entitlement = this.#entitlements.get(tenant);
+    if (entitlement === void 0) {
+      throw new ByokCoreError(
+        "storage_entitlement_missing",
+        "No storage entitlement has been issued for this tenant."
+      );
+    }
+    return entitlement;
+  }
+  #requireReservation(tenant, reservationId) {
+    const record = this.#reservations.get(tenantKey(tenant, reservationId));
+    if (record === void 0) {
+      throw new ByokCoreError(
+        "storage_reservation_not_found",
+        `Reservation ${reservationId} does not exist in this tenant.`
+      );
+    }
+    return record;
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/in-memory/truth.ts
+var DEFAULT_MANIFEST_LIMIT = 100;
+var InMemoryTruthStore = class {
+  #records = /* @__PURE__ */ new Map();
+  #clock;
+  constructor(clock) {
+    this.#clock = clock;
+  }
+  async writeTerminal(tenant, input) {
+    const key = tenantKey(tenant, "task.terminal", input.taskId);
+    const existing = this.#records.get(key);
+    if (existing !== void 0) {
+      if (existing.contentHash === input.contentHash) {
+        return existing;
+      }
+      throw new CoreConflictError(
+        "terminal_conflict",
+        `Task ${input.taskId} already has an immutable terminal record with a different hash.`,
+        existing,
+        this.#now()
+      );
+    }
+    const record = {
+      tenantId: tenant,
+      kind: "task.terminal",
+      recordKey: input.taskId,
+      rev: 1,
+      contentHash: input.contentHash,
+      byteSize: input.byteSize,
+      body: input.body,
+      ...input.label === void 0 ? {} : { label: input.label },
+      ...input.requestId === void 0 ? {} : { requestId: input.requestId },
+      writtenAt: this.#now()
+    };
+    this.#records.set(key, record);
+    return record;
+  }
+  async writeSnapshot(tenant, input) {
+    const key = tenantKey(tenant, input.kind, input.recordKey);
+    const existing = this.#records.get(key);
+    const currentRev = existing?.rev ?? 0;
+    if (input.expectedRev !== currentRev) {
+      throw new CoreConflictError(
+        "truth_revision_conflict",
+        `Record ${input.kind}/${input.recordKey} is at rev ${currentRev}, not ${input.expectedRev}.`,
+        existing,
+        this.#now()
+      );
+    }
+    const record = {
+      tenantId: tenant,
+      kind: input.kind,
+      recordKey: input.recordKey,
+      rev: currentRev + 1,
+      contentHash: input.contentHash,
+      byteSize: input.byteSize,
+      body: input.body,
+      ...input.label === void 0 ? {} : { label: input.label },
+      ...input.requestId === void 0 ? {} : { requestId: input.requestId },
+      writtenAt: this.#now()
+    };
+    this.#records.set(key, record);
+    return record;
+  }
+  async getRecord(tenant, selector) {
+    return this.#records.get(tenantKey(tenant, selector.kind, selector.recordKey));
+  }
+  async listManifest(tenant, query) {
+    const prefix = tenantKey(tenant, "");
+    const entries = [];
+    for (const [key, record] of this.#records.entries()) {
+      if (!key.startsWith(prefix)) continue;
+      if (query.kind !== void 0 && record.kind !== query.kind) continue;
+      if (query.keyPrefix !== void 0 && !record.recordKey.startsWith(query.keyPrefix)) {
+        continue;
+      }
+      entries.push({
+        kind: record.kind,
+        recordKey: record.recordKey,
+        rev: record.rev,
+        contentHash: record.contentHash,
+        byteSize: record.byteSize,
+        ...record.label === void 0 ? {} : { label: record.label },
+        updatedAt: record.writtenAt
+      });
+    }
+    entries.sort(
+      (left, right) => left.kind.localeCompare(right.kind) || left.recordKey.localeCompare(right.recordKey)
+    );
+    return entries.slice(0, query.limit ?? DEFAULT_MANIFEST_LIMIT);
+  }
+  #now() {
+    return this.#clock.now().toISOString();
+  }
+};
+
+// src/in-memory/clock.ts
+var IN_MEMORY_CLOCK_EPOCH = "2026-01-01T00:00:00.000Z";
+function createMutableClock(start = new Date(IN_MEMORY_CLOCK_EPOCH)) {
+  let current = start.getTime();
+  return {
+    now() {
+      return new Date(current);
+    },
+    advance(ms) {
+      current += ms;
+    },
+    set(instant) {
+      current = instant.getTime();
+    }
+  };
+}
+
+// src/in-memory/index.ts
+function createInMemoryCoreStores(options = {}) {
+  const clock = options.clock ?? createMutableClock();
+  const objects = new InMemoryObjectStore(clock);
+  const stores = {
+    mailbox: new InMemoryMailboxStore(clock),
+    board: new InMemoryBoardStore(clock),
+    truth: new InMemoryTruthStore(clock),
+    presence: new InMemoryPresenceStore(clock),
+    activity: new InMemoryActivityStore(clock),
+    objects,
+    quota: new InMemoryQuotaStore(clock, objects)
+  };
+  return { stores, clock };
+}
+function createInMemoryCoreCompositionWithClock() {
+  const clock = createMutableClock();
+  return { stores: createInMemoryCoreStores({ clock }).stores, clock };
+}
+
+export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEFAULT_ACTIVITY_CAPACITY, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryActivityStore, InMemoryBoardStore, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, assertCanonicalTimestamp, assertCapability, canonicalizeJson, canonicalizeJsonBytes, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isTenantId, parseCapabilityDeclaration, parseDeviceProofEnvelope, principalTenant, tenantId, tenantKey, tenantObjectKey };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map