@byok-sdk/core 0.2.0 → 0.3.0

package/dist/index.js

@@ -13,6 +13,12 @@ var CORE_ERROR_CODES = {
   // device proof (§12.6.3)
   proof_envelope_invalid: "proof_envelope_invalid",
   proof_canonicalization_failed: "proof_canonicalization_failed",
+  // device assertion (plan device-assertion-broker) — deliberately its own
+  // code rather than reusing `proof_envelope_invalid`: the two envelopes are
+  // non-interchangeable by design, and one shared "envelope was bad" code is
+  // exactly how a log stops being able to say which authentication surface was
+  // probed.
+  assertion_envelope_invalid: "assertion_envelope_invalid",
   // mailbox (§12.7.3)
   mailbox_message_not_found: "mailbox_message_not_found",
   mailbox_cursor_regression: "mailbox_cursor_regression",
@@ -33,6 +39,7 @@ var CORE_ERROR_CODES = {
   hint_ttl_invalid: "hint_ttl_invalid",
   hint_rate_limited: "hint_rate_limited",
   // object manifest (§12.7.4, §12.7.8)
+  object_key_prefix_invalid: "object_key_prefix_invalid",
   object_not_found: "object_not_found",
   object_state_invalid: "object_state_invalid",
   // storage entitlement / usage / reservation (§12.7.6-12.7.7)
@@ -43,7 +50,10 @@ var CORE_ERROR_CODES = {
   storage_quota_exceeded: "storage_quota_exceeded",
   storage_reservation_expired: "storage_reservation_expired",
   storage_integrity_mismatch: "storage_integrity_mismatch",
-  storage_write_suspended: "storage_write_suspended"
+  storage_write_suspended: "storage_write_suspended",
+  // skill packs (plan `skill-pack-delivery-channel`)
+  skill_pack_manifest_invalid: "skill_pack_manifest_invalid",
+  skill_pack_frontmatter_invalid: "skill_pack_frontmatter_invalid"
 };
 var ByokCoreError = class extends Error {
   code;
@@ -179,9 +189,20 @@ function contentHash(value) {
 function isContentHash(value) {
   return typeof value === "string" && CONTENT_HASH_PATTERN.test(value);
 }
-function tenantObjectKey(tenant, hash) {
+var OBJECT_KEY_PREFIX_PATTERN = /^[a-z0-9][a-z0-9._-]*(\/[a-z0-9][a-z0-9._-]*)*$/;
+function objectKeyPrefix(value) {
+  if (!OBJECT_KEY_PREFIX_PATTERN.test(value)) {
+    throw new ByokCoreError(
+      "object_key_prefix_invalid",
+      `Object key prefix must match ${OBJECT_KEY_PREFIX_PATTERN.source}, received ${JSON.stringify(value)}.`
+    );
+  }
+  return value;
+}
+function tenantObjectKey(tenant, hash, prefix) {
   const hex = hash.slice("sha256:".length);
-  return `tenants/${tenant}/objects/sha256/${hex}`;
+  const key = `tenants/${tenant}/objects/sha256/${hex}`;
+  return prefix === void 0 ? key : `${prefix}/${key}`;
 }
 var OBJECT_STATES = ["pending", "committed", "delete_pending", "deleted"];
 var OBJECT_STATE_TRANSITIONS = {
@@ -259,6 +280,248 @@ function assertCapability(declaration, capability) {
     );
   }
 }
+var SKILL_PACK_MANIFEST_SCHEMA_ID = "byok-skill-pack-v1";
+var SKILL_PACK_NAME_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+var SKILL_PACK_NAME_MAX_LENGTH = 64;
+var SKILL_PACK_DESCRIPTION_MAX_LENGTH = 1024;
+var SKILL_PACK_VERSION_PATTERN = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+var SKILL_PACK_FILE_PATH_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*(\/[A-Za-z0-9][A-Za-z0-9._-]*)*$/;
+var SKILL_PACK_FILE_PATH_MAX_LENGTH = 200;
+var SKILL_PACK_ENTRY_PATH = "SKILL.md";
+var SKILL_PACK_FILE_MAX_BYTES = 262144;
+var SKILL_PACK_MAX_BYTES = 1048576;
+var SKILL_PACK_MAX_FILES = 64;
+var SKILL_PACK_FORBIDDEN_FIELDS = [
+  "exec",
+  "command",
+  "entrypoint",
+  "run",
+  "script",
+  "shell",
+  "env",
+  "environment",
+  "credential",
+  "credentials",
+  "secret",
+  "secrets",
+  "token",
+  "apiKey",
+  "api_key",
+  "allowedTools",
+  "allowed-tools",
+  "hooks",
+  "preinstall",
+  "postinstall"
+];
+var ContentHashSchema = z.string().regex(CONTENT_HASH_PATTERN).transform((value) => contentHash(value));
+var SkillPackFileSchema = z.strictObject({
+  path: z.string().min(1).max(SKILL_PACK_FILE_PATH_MAX_LENGTH).regex(SKILL_PACK_FILE_PATH_PATTERN),
+  contentHash: ContentHashSchema,
+  byteSize: z.number().int().nonnegative().max(SKILL_PACK_FILE_MAX_BYTES)
+});
+var SkillPackManifestSchema = z.strictObject({
+  schema: z.literal(SKILL_PACK_MANIFEST_SCHEMA_ID),
+  name: z.string().min(1).max(SKILL_PACK_NAME_MAX_LENGTH).regex(SKILL_PACK_NAME_PATTERN),
+  version: z.string().regex(SKILL_PACK_VERSION_PATTERN),
+  description: z.string().min(1).max(SKILL_PACK_DESCRIPTION_MAX_LENGTH),
+  files: z.array(SkillPackFileSchema).min(1).max(SKILL_PACK_MAX_FILES),
+  contentHash: ContentHashSchema
+});
+function parseSkillPackManifest(input) {
+  if (typeof input === "object" && input !== null) {
+    const present = SKILL_PACK_FORBIDDEN_FIELDS.filter(
+      (field) => Object.prototype.hasOwnProperty.call(input, field)
+    );
+    if (present.length > 0) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `A skill pack manifest carries no executable or credential surface; refusing ${present.map((field) => JSON.stringify(field)).join(", ")}.`
+      );
+    }
+  }
+  const result = SkillPackManifestSchema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError(
+      "skill_pack_manifest_invalid",
+      `Invalid skill pack manifest: ${result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: result.error }
+    );
+  }
+  return result.data;
+}
+function skillPackContentHashInput(manifest) {
+  const rows = [...manifest.files].sort((left, right) => left.path < right.path ? -1 : left.path > right.path ? 1 : 0).map((file) => `${file.path}
+${file.contentHash}
+${file.byteSize}
+`);
+  return [
+    `${SKILL_PACK_MANIFEST_SCHEMA_ID}
+`,
+    `${manifest.name}
+`,
+    `${manifest.version}
+`,
+    `${manifest.description.length}
+`,
+    `${manifest.description}
+`,
+    `${manifest.files.length}
+`,
+    ...rows
+  ].join("");
+}
+var SKILL_PACK_REJECTIONS = [
+  "path-unsafe",
+  "duplicate-path",
+  "entry-missing",
+  "file-count-over-cap",
+  "file-over-cap",
+  "pack-over-cap",
+  "size-mismatch",
+  "hash-mismatch",
+  "name-mismatch"
+];
+function isSkillPackPathSafe(path) {
+  return path.length > 0 && path.length <= SKILL_PACK_FILE_PATH_MAX_LENGTH && SKILL_PACK_FILE_PATH_PATTERN.test(path);
+}
+function checkSkillPackManifest(manifest) {
+  if (manifest.files.length > SKILL_PACK_MAX_FILES) {
+    return {
+      ok: false,
+      reason: "file-count-over-cap",
+      detail: `${manifest.files.length} files exceeds the ${SKILL_PACK_MAX_FILES} file limit.`
+    };
+  }
+  const seen = /* @__PURE__ */ new Set();
+  let bytes = 0;
+  for (const file of manifest.files) {
+    if (!isSkillPackPathSafe(file.path)) {
+      return { ok: false, reason: "path-unsafe", detail: `${JSON.stringify(file.path)} is not a safe relative path.` };
+    }
+    if (seen.has(file.path)) {
+      return { ok: false, reason: "duplicate-path", detail: `${JSON.stringify(file.path)} is declared twice.` };
+    }
+    seen.add(file.path);
+    if (file.byteSize > SKILL_PACK_FILE_MAX_BYTES) {
+      return {
+        ok: false,
+        reason: "file-over-cap",
+        detail: `${JSON.stringify(file.path)} declares ${file.byteSize} bytes, over the ${SKILL_PACK_FILE_MAX_BYTES} byte per-file limit.`
+      };
+    }
+    bytes += file.byteSize;
+  }
+  if (!seen.has(SKILL_PACK_ENTRY_PATH)) {
+    return {
+      ok: false,
+      reason: "entry-missing",
+      detail: `A skill pack must carry ${SKILL_PACK_ENTRY_PATH}.`
+    };
+  }
+  if (bytes > SKILL_PACK_MAX_BYTES) {
+    return {
+      ok: false,
+      reason: "pack-over-cap",
+      detail: `${bytes} declared bytes exceeds the ${SKILL_PACK_MAX_BYTES} byte pack limit.`
+    };
+  }
+  return { ok: true, bytes };
+}
+function checkSkillPackFileContent(declared, observed) {
+  if (!isSkillPackPathSafe(declared.path)) {
+    return { ok: false, reason: "path-unsafe", detail: `${JSON.stringify(declared.path)} is not a safe relative path.` };
+  }
+  if (observed.byteSize > SKILL_PACK_FILE_MAX_BYTES) {
+    return {
+      ok: false,
+      reason: "file-over-cap",
+      detail: `${JSON.stringify(declared.path)} delivered ${observed.byteSize} bytes, over the ${SKILL_PACK_FILE_MAX_BYTES} byte per-file limit.`
+    };
+  }
+  if (observed.byteSize !== declared.byteSize) {
+    return {
+      ok: false,
+      reason: "size-mismatch",
+      detail: `${JSON.stringify(declared.path)} declared ${declared.byteSize} bytes and delivered ${observed.byteSize}.`
+    };
+  }
+  if (observed.contentHash !== declared.contentHash) {
+    return {
+      ok: false,
+      reason: "hash-mismatch",
+      detail: `${JSON.stringify(declared.path)} declared ${declared.contentHash} and delivered ${observed.contentHash}.`
+    };
+  }
+  return { ok: true, bytes: observed.byteSize };
+}
+var SKILL_FRONTMATTER_FIELDS = ["name", "description"];
+var FRONTMATTER_DELIMITER = "---";
+var FRONTMATTER_LINE_PATTERN = /^([A-Za-z][A-Za-z0-9_-]*):[ \t]*(.*)$/;
+function unquote(value) {
+  const trimmed = value.trim();
+  if (trimmed.length >= 2) {
+    const first = trimmed[0];
+    const last = trimmed[trimmed.length - 1];
+    if (first === '"' && last === '"' || first === "'" && last === "'") {
+      const inner = trimmed.slice(1, -1);
+      return inner.includes(first) ? void 0 : inner;
+    }
+  }
+  return trimmed;
+}
+function parseSkillFrontmatter(text) {
+  const reject = (message) => {
+    throw new ByokCoreError("skill_pack_frontmatter_invalid", message);
+  };
+  const lines = text.split("\n");
+  if (lines[0]?.trimEnd() !== FRONTMATTER_DELIMITER) {
+    reject(`A skill file must open with a ${FRONTMATTER_DELIMITER} frontmatter delimiter.`);
+  }
+  const closing = lines.findIndex((line, index) => index > 0 && line.trimEnd() === FRONTMATTER_DELIMITER);
+  if (closing < 0) reject(`The frontmatter block is not closed by a ${FRONTMATTER_DELIMITER} line.`);
+  const fields = /* @__PURE__ */ new Map();
+  for (const line of lines.slice(1, closing)) {
+    if (line.trim().length === 0) continue;
+    const match = FRONTMATTER_LINE_PATTERN.exec(line);
+    if (match === null) reject(`Frontmatter line ${JSON.stringify(line)} is not a \`key: value\` pair.`);
+    const key = match[1];
+    if (!SKILL_FRONTMATTER_FIELDS.includes(key)) {
+      reject(
+        `Frontmatter key ${JSON.stringify(key)} is not one of ${SKILL_FRONTMATTER_FIELDS.join(", ")}; a skill declares no tools, hooks, or environment.`
+      );
+    }
+    if (fields.has(key)) reject(`Frontmatter key ${JSON.stringify(key)} is declared twice.`);
+    const value = unquote(match[2]);
+    if (value === void 0 || value.length === 0) {
+      reject(`Frontmatter key ${JSON.stringify(key)} has no usable value.`);
+    }
+    fields.set(key, value);
+  }
+  const name = fields.get("name");
+  const description = fields.get("description");
+  if (name === void 0) reject("Frontmatter is missing `name`.");
+  if (description === void 0) reject("Frontmatter is missing `description`.");
+  if (name.length > SKILL_PACK_NAME_MAX_LENGTH || !SKILL_PACK_NAME_PATTERN.test(name)) {
+    reject(
+      `Frontmatter \`name\` must match ${SKILL_PACK_NAME_PATTERN.source} and be at most ${SKILL_PACK_NAME_MAX_LENGTH} characters.`
+    );
+  }
+  if (description.length > SKILL_PACK_DESCRIPTION_MAX_LENGTH) {
+    reject(`Frontmatter \`description\` exceeds ${SKILL_PACK_DESCRIPTION_MAX_LENGTH} characters.`);
+  }
+  return { name, description };
+}
+function checkSkillPackEntry(manifest, entryText) {
+  const frontmatter = parseSkillFrontmatter(entryText);
+  if (frontmatter.name !== manifest.name) {
+    return {
+      ok: false,
+      reason: "name-mismatch",
+      detail: `${SKILL_PACK_ENTRY_PATH} declares ${JSON.stringify(frontmatter.name)} but the manifest declares ${JSON.stringify(manifest.name)}.`
+    };
+  }
+  return { ok: true, bytes: new TextEncoder().encode(entryText).length };
+}
 
 // src/stores.ts
 var CORE_STORE_NAMES = [
@@ -268,10 +531,12 @@ var CORE_STORE_NAMES = [
   "presence",
   "activity",
   "objects",
-  "quota"
+  "quota",
+  "skillPacks"
 ];
 
 // src/ports-contract.ts
+var CORE_NON_COMPOSITION_PORT_NAMES = [];
 var CORE_PORT_METHODS = {
   mailbox: ["append", "readAfter", "advanceCursor", "readCursor", "collectRetired"],
   board: ["create", "get", "list", "claim", "unclaim", "updateStatus"],
@@ -299,7 +564,8 @@ var CORE_PORT_METHODS = {
     "abortReservation",
     "expireReservations",
     "applyMailboxDelta"
-  ]
+  ],
+  skillPacks: ["publish", "get", "list", "readFile"]
 };
 var CORE_PORT_INTERFACES = {
   mailbox: "MailboxStore",
@@ -308,12 +574,14 @@ var CORE_PORT_INTERFACES = {
   presence: "PresenceStore",
   activity: "ActivityStore",
   objects: "ObjectStore",
-  quota: "QuotaStore"
+  quota: "QuotaStore",
+  skillPacks: "SkillPackStore"
 };
 var DEVICE_PROOF_SCHEMA_ID = "byok-device-proof-v1";
 var DEVICE_PROOF_DOMAIN_PREFIX = "byok-device-proof-v1\n";
 var DEVICE_PROOF_VERSION = 1;
 var DEVICE_PROOF_ALGORITHMS = ["ed25519"];
+var DEVICE_PROOF_HEADER = "x-byok-device-proof";
 var BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
 var HTTP_METHOD_PATTERN = /^[A-Z]+$/;
 function canonicalizationFailure(path, reason) {
@@ -478,6 +746,122 @@ function deviceProofSigningInput(claims) {
     DEVICE_PROOF_DOMAIN_PREFIX + deviceProofCanonicalJson(claims)
   );
 }
+var DEVICE_ASSERTION_SCHEMA_ID = "byok-device-assertion-v1";
+var DEVICE_ASSERTION_DOMAIN_PREFIX = "byok-device-assertion-v1\n";
+var DEVICE_ASSERTION_VERSION = 1;
+var DEVICE_ASSERTION_ALGORITHMS = ["ed25519"];
+var DEVICE_ASSERTION_DEFAULT_TTL_MS = 12e4;
+var DEVICE_ASSERTION_MAX_TTL_MS = 3e5;
+var DEVICE_ASSERTION_AUDIENCE_MAX_BYTES = 256;
+var JTI_PATTERN = /^[A-Za-z0-9_-]{22}$/;
+var SIGNATURE_PATTERN = /^[A-Za-z0-9_-]{86}$/;
+function utf8ByteLength(value) {
+  return new TextEncoder().encode(value).length;
+}
+var DeviceAssertionClaimsSchema = z.strictObject({
+  version: z.literal(DEVICE_ASSERTION_VERSION),
+  /** The paired server's origin, normalized (`new URL(serverUrl).origin`). */
+  issuer: z.string().min(1),
+  productId: z.string().min(1),
+  /** The device row this assertion claims to be. A lookup key, never authority — the row is the authority. */
+  deviceId: z.string().min(1),
+  /** Exactly one audience, compared with `===` by every verifier. Never an array, never a prefix. */
+  audience: z.string().min(1).refine((value) => utf8ByteLength(value) <= DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, {
+    message: `audience must be at most ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
+  }),
+  /** 128-bit CSPRNG token, base64url unpadded. The verifier burns it; the signer never reuses one. */
+  jti: z.string().regex(JTI_PATTERN),
+  issuedAt: z.iso.datetime(),
+  expiresAt: z.iso.datetime()
+});
+var DeviceAssertionEnvelopeV1Schema = z.strictObject({
+  schema: z.literal(DEVICE_ASSERTION_SCHEMA_ID),
+  algorithm: z.enum(DEVICE_ASSERTION_ALGORITHMS),
+  protected: DeviceAssertionClaimsSchema,
+  /** Raw 64-byte Ed25519 signature, base64url unpadded. */
+  signature: z.string().regex(SIGNATURE_PATTERN)
+});
+function parseDeviceAssertionEnvelope(input) {
+  const result = DeviceAssertionEnvelopeV1Schema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError(
+      "assertion_envelope_invalid",
+      `Invalid device assertion envelope: ${result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: result.error }
+    );
+  }
+  return result.data;
+}
+function deviceAssertionCanonicalClaims(claims) {
+  const canonical = {
+    version: claims.version,
+    issuer: claims.issuer,
+    productId: claims.productId,
+    deviceId: claims.deviceId,
+    audience: claims.audience,
+    jti: claims.jti,
+    issuedAt: claims.issuedAt,
+    expiresAt: claims.expiresAt
+  };
+  return canonical;
+}
+function deviceAssertionCanonicalJson(claims) {
+  return canonicalizeJson(deviceAssertionCanonicalClaims(claims));
+}
+function deviceAssertionSigningInput(claims) {
+  return new TextEncoder().encode(
+    DEVICE_ASSERTION_DOMAIN_PREFIX + deviceAssertionCanonicalJson(claims)
+  );
+}
+function parseInstant(value) {
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) ? parsed : void 0;
+}
+var EDDSA_JWK_X_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+function isUsableDeviceRow(row) {
+  if (row === null || typeof row !== "object") return false;
+  if (row.revoked !== false) return false;
+  const key = row.publicKeyJwkX;
+  return typeof key === "string" && EDDSA_JWK_X_PATTERN.test(key);
+}
+async function verifyDeviceAssertion(input, deps) {
+  const maxLifetimeMs = deps.maxLifetimeMs ?? DEVICE_ASSERTION_MAX_TTL_MS;
+  if (!Number.isSafeInteger(maxLifetimeMs) || maxLifetimeMs <= 0 || maxLifetimeMs > DEVICE_ASSERTION_MAX_TTL_MS) {
+    return void 0;
+  }
+  let envelope;
+  try {
+    envelope = parseDeviceAssertionEnvelope(input);
+  } catch {
+    return void 0;
+  }
+  const claims = envelope.protected;
+  const row = await deps.lookupDevice(claims.deviceId);
+  if (!isUsableDeviceRow(row)) return void 0;
+  const issuedAt = parseInstant(claims.issuedAt);
+  const expiresAt = parseInstant(claims.expiresAt);
+  if (issuedAt === void 0 || expiresAt === void 0) return void 0;
+  if (expiresAt <= issuedAt) return void 0;
+  if (expiresAt - issuedAt > maxLifetimeMs) return void 0;
+  const now = deps.now.getTime();
+  if (!Number.isFinite(now)) return void 0;
+  if (now < issuedAt || now >= expiresAt) return void 0;
+  const verified = await deps.verifier.verify({
+    algorithm: envelope.algorithm,
+    // The row's key, never an envelope-supplied one.
+    publicKey: row.publicKeyJwkX,
+    signature: envelope.signature,
+    signingInput: deviceAssertionSigningInput(claims)
+  });
+  if (!verified) return void 0;
+  return claims;
+}
+
+// src/pairing.ts
+var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
+function nonceSigningBytes(nonce) {
+  return new TextEncoder().encode(NONCE_SIGNING_DOMAIN + nonce);
+}
 
 // src/in-memory/presence.ts
 function assertTtl(ttlMs) {
@@ -810,23 +1194,30 @@ var InMemoryMailboxStore = class {
   }
   async append(tenant, input) {
     const device = this.#device(tenant, input.deviceId);
-    const existing = device.byMessageId.get(input.messageId);
-    if (existing !== void 0) return existing;
-    const message = {
-      tenantId: tenant,
-      deviceId: input.deviceId,
-      seq: device.nextSeq,
-      messageId: input.messageId,
-      body: input.body,
-      bodyHash: input.bodyHash,
-      byteSize: input.byteSize,
-      state: "pending",
-      appendedAt: this.#now()
-    };
-    device.nextSeq += 1;
-    device.messages.push(message);
-    device.byMessageId.set(message.messageId, message);
-    return message;
+    const appended = device.mutationTail.then(async () => {
+      const existing = device.byMessageId.get(input.messageId);
+      if (existing !== void 0) return existing;
+      const seq = device.nextSeq;
+      const materialized = await input.materialize(seq);
+      const message = {
+        tenantId: tenant,
+        deviceId: input.deviceId,
+        seq,
+        messageId: input.messageId,
+        ...materialized,
+        state: "pending",
+        appendedAt: this.#now()
+      };
+      device.nextSeq += 1;
+      device.messages.push(message);
+      device.byMessageId.set(message.messageId, message);
+      return message;
+    });
+    device.mutationTail = appended.then(
+      () => void 0,
+      () => void 0
+    );
+    return appended;
   }
   async readAfter(tenant, query) {
     const device = this.#devices.get(tenantKey(tenant, query.deviceId));
@@ -847,23 +1238,30 @@ var InMemoryMailboxStore = class {
   }
   async advanceCursor(tenant, input) {
     const device = this.#device(tenant, input.deviceId);
-    if (input.ackedSeq < device.ackedSeq) {
-      throw new CoreConflictError(
-        "mailbox_cursor_regression",
-        `Cursor for device ${input.deviceId} is at ${device.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
-        this.#cursorState(tenant, input.deviceId, device),
-        this.#now()
-      );
-    }
-    device.ackedSeq = input.ackedSeq;
-    device.cursorUpdatedAt = this.#now();
-    for (const [index, message] of device.messages.entries()) {
-      if (message.state === "pending" && message.seq <= input.ackedSeq) {
-        device.messages[index] = { ...message, state: "acked" };
-        device.byMessageId.set(message.messageId, device.messages[index]);
+    const advanced = device.mutationTail.then(() => {
+      if (input.ackedSeq < device.ackedSeq) {
+        throw new CoreConflictError(
+          "mailbox_cursor_regression",
+          `Cursor for device ${input.deviceId} is at ${device.ackedSeq}; refusing to move it back to ${input.ackedSeq}.`,
+          this.#cursorState(tenant, input.deviceId, device),
+          this.#now()
+        );
       }
-    }
-    return this.#cursorState(tenant, input.deviceId, device);
+      device.ackedSeq = input.ackedSeq;
+      device.cursorUpdatedAt = this.#now();
+      for (const [index, message] of device.messages.entries()) {
+        if (message.state === "pending" && message.seq <= input.ackedSeq) {
+          device.messages[index] = { ...message, state: "acked" };
+          device.byMessageId.set(message.messageId, device.messages[index]);
+        }
+      }
+      return this.#cursorState(tenant, input.deviceId, device);
+    });
+    device.mutationTail = advanced.then(
+      () => void 0,
+      () => void 0
+    );
+    return advanced;
   }
   async readCursor(tenant, deviceId) {
     const device = this.#devices.get(tenantKey(tenant, deviceId));
@@ -911,6 +1309,7 @@ var InMemoryMailboxStore = class {
       nextSeq: 1,
       ackedSeq: 0,
       cursorUpdatedAt: this.#now(),
+      mutationTail: Promise.resolve(),
       messages: [],
       byMessageId: /* @__PURE__ */ new Map()
     };
@@ -1360,6 +1759,89 @@ var InMemoryQuotaStore = class {
   }
 };
 
+// src/in-memory/skill-pack.ts
+var DEFAULT_LIST_LIMIT3 = 50;
+var InMemorySkillPackStore = class {
+  #packs = /* @__PURE__ */ new Map();
+  async publish(tenant, input) {
+    const { manifest } = input;
+    const structural = checkSkillPackManifest(manifest);
+    if (!structural.ok) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `Refusing to publish ${JSON.stringify(manifest.name)}: ${structural.reason} \u2014 ${structural.detail}`
+      );
+    }
+    const contents = /* @__PURE__ */ new Map();
+    for (const file of input.files) {
+      if (contents.has(file.path)) {
+        throw new ByokCoreError(
+          "skill_pack_manifest_invalid",
+          `Refusing to publish ${JSON.stringify(manifest.name)}: ${JSON.stringify(file.path)} was supplied twice.`
+        );
+      }
+      contents.set(file.path, file.content);
+    }
+    for (const declared of manifest.files) {
+      const content = contents.get(declared.path);
+      if (content === void 0) {
+        throw new ByokCoreError(
+          "skill_pack_manifest_invalid",
+          `Refusing to publish ${JSON.stringify(manifest.name)}: ${JSON.stringify(declared.path)} is declared but was not supplied.`
+        );
+      }
+      const bytes = new TextEncoder().encode(content).length;
+      if (bytes !== declared.byteSize) {
+        throw new ByokCoreError(
+          "skill_pack_manifest_invalid",
+          `Refusing to publish ${JSON.stringify(manifest.name)}: ${JSON.stringify(declared.path)} declares ${declared.byteSize} bytes and supplies ${bytes}.`
+        );
+      }
+    }
+    if (contents.size !== manifest.files.length) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `Refusing to publish ${JSON.stringify(manifest.name)}: ${contents.size} files were supplied for ${manifest.files.length} declared rows.`
+      );
+    }
+    const entry = checkSkillPackEntry(manifest, contents.get(SKILL_PACK_ENTRY_PATH));
+    if (!entry.ok) {
+      throw new ByokCoreError(
+        "skill_pack_manifest_invalid",
+        `Refusing to publish ${JSON.stringify(manifest.name)}: ${entry.reason} \u2014 ${entry.detail}`
+      );
+    }
+    this.#packs.set(tenantKey(tenant, manifest.name), { manifest, contents });
+    return manifest;
+  }
+  async get(tenant, name) {
+    return this.#packs.get(tenantKey(tenant, name))?.manifest;
+  }
+  async list(tenant, query) {
+    const prefix = tenantKey(tenant, "");
+    const manifests = [];
+    for (const [key, pack] of this.#packs.entries()) {
+      if (!key.startsWith(prefix)) continue;
+      manifests.push(pack.manifest);
+    }
+    manifests.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+    return manifests.slice(0, query.limit ?? DEFAULT_LIST_LIMIT3);
+  }
+  async readFile(tenant, name, path) {
+    const pack = this.#packs.get(tenantKey(tenant, name));
+    if (pack === void 0) return void 0;
+    const declared = pack.manifest.files.find((file) => file.path === path);
+    const content = pack.contents.get(path);
+    if (declared === void 0 || content === void 0) return void 0;
+    return {
+      path: declared.path,
+      contentHash: declared.contentHash,
+      byteSize: declared.byteSize,
+      content
+    };
+  }
+};
+
 // src/in-memory/truth.ts
 var DEFAULT_MANIFEST_LIMIT = 100;
 var InMemoryTruthStore = class {
@@ -1484,7 +1966,8 @@ function createInMemoryCoreStores(options = {}) {
     presence: new InMemoryPresenceStore(clock),
     activity: new InMemoryActivityStore(clock),
     objects,
-    quota: new InMemoryQuotaStore(clock, objects)
+    quota: new InMemoryQuotaStore(clock, objects),
+    skillPacks: new InMemorySkillPackStore()
   };
   return { stores, clock };
 }
@@ -1493,6 +1976,6 @@ function createInMemoryCoreCompositionWithClock() {
   return { stores: createInMemoryCoreStores({ clock }).stores, clock };
 }
 
-export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEFAULT_ACTIVITY_CAPACITY, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryActivityStore, InMemoryBoardStore, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, assertCanonicalTimestamp, assertCapability, canonicalizeJson, canonicalizeJsonBytes, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isTenantId, parseCapabilityDeclaration, parseDeviceProofEnvelope, principalTenant, tenantId, tenantKey, tenantObjectKey };
+export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEFAULT_ACTIVITY_CAPACITY, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryActivityStore, InMemoryBoardStore, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SkillPackFileSchema, SkillPackManifestSchema, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, assertCanonicalTimestamp, assertCapability, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseSkillFrontmatter, parseSkillPackManifest, principalTenant, skillPackContentHashInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map