@byok-sdk/core 0.26.1 → 0.27.0

package/dist/index.js

@@ -2,6 +2,8 @@ import { z } from 'zod';
 
 // src/errors.ts
 var CORE_ERROR_CODES = {
+  retention_input_invalid: "retention_input_invalid",
+  retention_collect_failed: "retention_collect_failed",
   // identity + content addressing
   tenant_id_invalid: "tenant_id_invalid",
   content_hash_invalid: "content_hash_invalid",
@@ -544,10 +546,18 @@ var CORE_STORE_NAMES = [
 // src/ports-contract.ts
 var CORE_NON_COMPOSITION_PORT_NAMES = [];
 var CORE_PORT_METHODS = {
-  mailbox: ["append", "readAfter", "recordDelivery", "advanceCursor", "readCursor", "collectRetired"],
+  mailbox: [
+    "append",
+    "readUsage",
+    "readAfter",
+    "recordDelivery",
+    "advanceCursor",
+    "readCursor",
+    "collectExpired"
+  ],
   board: ["create", "get", "list", "claim", "unclaim", "updateStatus"],
   truth: ["writeTerminal", "writeSnapshot", "getRecord", "listManifest"],
-  presence: ["publish", "read", "list"],
+  presence: ["publish", "read", "list", "collectExpired"],
   objects: [
     "putManifest",
     "commit",
@@ -556,7 +566,8 @@ var CORE_PORT_METHODS = {
     "addReference",
     "removeReference",
     "markDeletePending",
-    "markDeleted"
+    "markDeleted",
+    "collectExpired"
   ],
   quota: [
     "readEntitlement",
@@ -567,8 +578,7 @@ var CORE_PORT_METHODS = {
     "reserve",
     "finalizeReservation",
     "abortReservation",
-    "expireReservations",
-    "applyMailboxDelta"
+    "collectExpired"
   ],
   skillPacks: ["publish", "get", "list", "readFile"]
 };
@@ -1671,6 +1681,98 @@ function nonceSigningBytes(nonce) {
   return new TextEncoder().encode(NONCE_SIGNING_DOMAIN + nonce);
 }
 
+// src/in-memory/storage-ledger.ts
+var InMemoryStorageLedger = class {
+  constructor(clock) {
+    this.clock = clock;
+  }
+  clock;
+  #usage = /* @__PURE__ */ new Map();
+  #reservations = /* @__PURE__ */ new Map();
+  #committed = /* @__PURE__ */ new Map();
+  readReservation(key) {
+    return this.#reservations.get(key);
+  }
+  writeReservation(key, record) {
+    this.#reservations.set(key, record);
+  }
+  deleteReservation(key) {
+    this.#reservations.delete(key);
+  }
+  reservations() {
+    return this.#reservations.entries();
+  }
+  readUsage(tenant) {
+    let usage = this.#usage.get(tenant);
+    if (usage === void 0) {
+      usage = { committedObjectBytes: 0n, committedInlineBytes: 0n, reservedBytes: 0n, objectCount: 0n, updatedAt: this.clock.now().toISOString() };
+      this.#usage.set(tenant, usage);
+    }
+    return usage;
+  }
+  writeUsage(tenant, usage) {
+    this.#usage.set(tenant, usage);
+  }
+  isCounted(tenant, hash) {
+    return this.#committed.get(tenant)?.has(hash) === true;
+  }
+  recordCommitted(tenant, reservation) {
+    let hashes = this.#committed.get(tenant);
+    if (hashes === void 0) {
+      hashes = /* @__PURE__ */ new Map();
+      this.#committed.set(tenant, hashes);
+    }
+    hashes.set(reservation.contentHash, { kind: reservation.kind, bytes: reservation.expectedBytes });
+  }
+  hasReservedObject(tenant, hash) {
+    for (const { reservation } of this.#reservations.values()) {
+      if (reservation.tenantId === tenant && reservation.kind === "object" && reservation.contentHash === hash && reservation.state === "reserved") return true;
+    }
+    return false;
+  }
+  reservedObjectHashes(tenant) {
+    return [...this.#reservations.values()].filter(({ reservation }) => reservation.tenantId === tenant && reservation.kind === "object" && reservation.state === "reserved").map(({ reservation }) => reservation.contentHash);
+  }
+  prepareCollectedObjectRelease(tenant, hash, byteSize, now) {
+    const hashes = this.#committed.get(tenant);
+    const accounted = hashes?.get(hash);
+    if (accounted === void 0 || accounted.kind === "inline") return { releasedBytes: 0n, commit: () => {
+    } };
+    const usage = this.#usage.get(tenant);
+    if (usage === void 0 || accounted.bytes !== byteSize || usage.committedObjectBytes < accounted.bytes || usage.objectCount < 1n) {
+      throw new ByokCoreError("storage_integrity_mismatch", "Collected object accounting does not match the storage ledger.");
+    }
+    return { releasedBytes: accounted.bytes, commit: () => {
+      hashes.delete(hash);
+      this.writeUsage(tenant, { ...usage, committedObjectBytes: usage.committedObjectBytes - accounted.bytes, objectCount: usage.objectCount - 1n, updatedAt: now });
+    } };
+  }
+  releaseCollectedObject(tenant, hash, byteSize, now) {
+    const release = this.prepareCollectedObjectRelease(tenant, hash, byteSize, now);
+    release.commit();
+    return release.releasedBytes;
+  }
+};
+
+// src/retention.ts
+function assertCollectExpiredInput(input) {
+  assertCanonicalTimestamp(input.now, "now");
+  if (!Number.isSafeInteger(input.limit) || input.limit <= 0) {
+    throw new ByokCoreError("retention_input_invalid", "collectExpired limit must be a positive safe integer.");
+  }
+}
+var CollectExpiredFailure = class extends ByokCoreError {
+  constructor(committed, failedRows, more, options) {
+    super("retention_collect_failed", "Retention collection did not complete.", options);
+    this.committed = committed;
+    this.failedRows = failedRows;
+    this.more = more;
+  }
+  committed;
+  failedRows;
+  more;
+};
+
 // src/in-memory/presence.ts
 function assertTtl(ttlMs) {
   if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
@@ -1755,6 +1857,20 @@ var InMemoryPresenceStore = class {
     live.sort((left, right) => left.deviceId.localeCompare(right.deviceId));
     return live;
   }
+  async collectExpired(tenant, input) {
+    assertCollectExpiredInput(input);
+    let removed = 0, more = false;
+    for (const [key, hint] of this.#hints) {
+      if (hint.tenantId !== tenant || hint.expiresAt > input.now) continue;
+      if (removed === input.limit) {
+        more = true;
+        break;
+      }
+      this.#hints.delete(key);
+      removed++;
+    }
+    return { removed, expired: 0, releasedBytes: 0n, more };
+  }
   #isExpired(expiresAt) {
     return this.#clock.now().toISOString() >= expiresAt;
   }
@@ -1954,16 +2070,29 @@ var DEFAULT_READ_LIMIT = 50;
 var InMemoryMailboxStore = class {
   #devices = /* @__PURE__ */ new Map();
   #clock;
-  constructor(clock) {
+  #quota;
+  /** The mailbox reads its limit from quota; quota never reads the mailbox. */
+  constructor(clock, quota) {
     this.#clock = clock;
+    this.#quota = quota;
   }
   async append(tenant, input) {
     const device = this.#device(tenant, input.deviceId);
     const appended = device.mutationTail.then(async () => {
       const existing = device.byMessageId.get(input.messageId);
       if (existing !== void 0) return existing;
+      const limit = input.admission === "cancellation" ? void 0 : await this.#mailboxLimit(tenant);
       const seq = device.nextSeq;
       const materialized = await input.materialize(seq);
+      if (limit !== void 0) {
+        const used = this.#usedBytes(tenant);
+        if (used + materialized.byteSize > limit) {
+          throw new ByokCoreError(
+            "storage_quota_exceeded",
+            `Mailbox would reach ${String(used + materialized.byteSize)} bytes, over the limit of ${String(limit)} bytes.`
+          );
+        }
+      }
       const message = {
         tenantId: tenant,
         deviceId: input.deviceId,
@@ -1984,6 +2113,9 @@ var InMemoryMailboxStore = class {
     );
     return appended;
   }
+  async readUsage(tenant) {
+    return { bytes: this.#usedBytes(tenant) };
+  }
   async readAfter(tenant, query) {
     const device = this.#devices.get(tenantKey(tenant, query.deviceId));
     const limit = query.limit ?? DEFAULT_READ_LIMIT;
@@ -2061,33 +2193,69 @@ var InMemoryMailboxStore = class {
     }
     return this.#cursorState(tenant, deviceId, device);
   }
-  async collectRetired(tenant, input) {
+  async collectExpired(tenant, input) {
+    assertCollectExpiredInput(input);
     assertCanonicalTimestamp(input.ackedBefore, "ackedBefore");
     assertCanonicalTimestamp(input.expireUnackedBefore, "expireUnackedBefore");
-    let deletedCount = 0;
-    let expiredCount = 0;
-    let releasedBytes = 0n;
-    for (const [key, device] of this.#devices.entries()) {
-      if (!key.startsWith(tenantKey(tenant, ""))) continue;
-      if (input.deviceId !== void 0 && key !== tenantKey(tenant, input.deviceId)) continue;
-      for (let index = device.messages.length - 1; index >= 0; index -= 1) {
-        const message = device.messages[index];
-        if (message.state === "acked" && message.appendedAt < input.ackedBefore) {
-          device.messages.splice(index, 1);
-          device.byMessageId.delete(message.messageId);
-          deletedCount += 1;
-          releasedBytes += message.byteSize;
-          continue;
-        }
-        if (message.state === "pending" && message.appendedAt < input.expireUnackedBefore) {
-          const expired = { ...message, state: "expired" };
-          device.messages[index] = expired;
-          device.byMessageId.set(expired.messageId, expired);
-          expiredCount += 1;
+    let removed = 0, expired = 0, more = false;
+    try {
+      phases: for (const phase of ["acked", "pending"]) {
+        for (const [key, device] of this.#devices) {
+          if (!key.startsWith(tenantKey(tenant, ""))) continue;
+          const collected = device.mutationTail.then(() => {
+            for (let index = 0; index < device.messages.length; ) {
+              const message = device.messages[index];
+              const cutoff = phase === "acked" ? input.ackedBefore : input.expireUnackedBefore;
+              if (message.state !== phase || message.appendedAt >= cutoff) {
+                index++;
+                continue;
+              }
+              if (removed + expired === input.limit) {
+                more = true;
+                return;
+              }
+              if (phase === "acked") {
+                device.messages.splice(index, 1);
+                device.byMessageId.delete(message.messageId);
+                removed++;
+              } else {
+                const retired = { ...message, state: "expired" };
+                device.messages[index] = retired;
+                device.byMessageId.set(retired.messageId, retired);
+                expired++;
+                index++;
+              }
+            }
+          });
+          device.mutationTail = collected.then(() => void 0, () => void 0);
+          await collected;
+          if (more) break phases;
         }
       }
+    } catch (cause) {
+      throw new CollectExpiredFailure({ removed, expired, releasedBytes: 0n }, 0, void 0, { cause });
+    }
+    return { removed, expired, releasedBytes: 0n, more };
+  }
+  async #mailboxLimit(tenant) {
+    const entitlement = await this.#quota.readEntitlement(tenant);
+    if (entitlement === void 0) {
+      throw new ByokCoreError(
+        "storage_entitlement_missing",
+        "No storage entitlement has been issued for this tenant."
+      );
     }
-    return { deletedCount, expiredCount, releasedBytes };
+    return entitlement.mailboxLimitBytes;
+  }
+  /** Every retained row of the tenant, in any state, on any device. */
+  #usedBytes(tenant) {
+    const prefix = tenantKey(tenant, "");
+    let bytes = 0n;
+    for (const [key, device] of this.#devices.entries()) {
+      if (!key.startsWith(prefix)) continue;
+      for (const message of device.messages) bytes += message.byteSize;
+    }
+    return bytes;
   }
   #device(tenant, deviceId) {
     if (deviceId.length === 0) {
@@ -2141,12 +2309,18 @@ var InMemoryMailboxStore = class {
 // src/in-memory/blob.ts
 var DEFAULT_LIST_LIMIT2 = 100;
 var InMemoryObjectStore = class {
+  constructor(clock, maintenance) {
+    this.maintenance = maintenance;
+    this.#clock = clock;
+    if (maintenance === void 0 || maintenance.ledger === void 0 || typeof maintenance.bytes?.deleteObject !== "function") {
+      throw new ByokCoreError("retention_input_invalid", "ObjectStore requires its shared ledger and an explicit byte authority.");
+    }
+  }
+  maintenance;
   #manifest = /* @__PURE__ */ new Map();
   #references = /* @__PURE__ */ new Map();
   #clock;
-  constructor(clock) {
-    this.#clock = clock;
-  }
+  #deleteCursor = /* @__PURE__ */ new Map();
   async putManifest(tenant, input) {
     const key = tenantKey(tenant, input.hash);
     const existing = this.#manifest.get(key);
@@ -2236,6 +2410,46 @@ var InMemoryObjectStore = class {
     const entry = this.#require(tenant, hash);
     return this.#transition(tenant, entry, "deleted");
   }
+  async collectExpired(tenant, input) {
+    assertCollectExpiredInput(input);
+    assertCanonicalTimestamp(input.orphanBefore, "orphanBefore");
+    const eligible = (entry) => entry.tenantId === tenant && entry.refCount === 0 && !this.maintenance.ledger.hasReservedObject(tenant, entry.hash) && (entry.state === "delete_pending" || (entry.state === "pending" || entry.state === "committed") && entry.updatedAt < input.orphanBefore);
+    let removed = 0, releasedBytes = 0n, more = false, visited = 0, failures = 0;
+    let firstFailure;
+    const cursor = this.#deleteCursor.get(tenant) ?? "";
+    const entries = [...this.#manifest.values()].filter(eligible);
+    const pending = entries.filter((entry) => entry.state === "delete_pending").sort((a, b) => a.hash.localeCompare(b.hash));
+    const first = pending.filter((entry) => entry.hash > cursor).slice(0, input.limit);
+    const fresh = entries.filter((entry) => entry.state !== "delete_pending").sort((a, b) => a.updatedAt.localeCompare(b.updatedAt) || a.hash.localeCompare(b.hash)).slice(0, input.limit - first.length);
+    const wrapped = pending.filter((entry) => entry.hash <= cursor).slice(0, input.limit - first.length - fresh.length);
+    const candidates = [...first, ...fresh, ...wrapped];
+    more = entries.length > candidates.length;
+    for (const candidate of candidates) {
+      if (visited++ === input.limit) {
+        more = true;
+        break;
+      }
+      const entry = this.#manifest.get(tenantKey(tenant, candidate.hash));
+      if (!eligible(entry)) continue;
+      const pending2 = entry.state === "delete_pending" ? entry : { ...entry, state: "delete_pending", deletePendingAt: input.now, updatedAt: input.now };
+      this.#manifest.set(tenantKey(tenant, entry.hash), pending2);
+      try {
+        const release = this.maintenance.ledger.prepareCollectedObjectRelease(tenant, entry.hash, entry.byteSize, input.now);
+        this.maintenance.bytes.deleteObject(tenant, entry.hash);
+        release.commit();
+        const released = release.releasedBytes;
+        this.#manifest.set(tenantKey(tenant, entry.hash), { ...pending2, state: "deleted", updatedAt: input.now });
+        removed++;
+        releasedBytes += released;
+      } catch (cause) {
+        failures++;
+        firstFailure ??= cause;
+      }
+    }
+    this.#deleteCursor.set(tenant, wrapped.at(-1)?.hash ?? first.at(-1)?.hash ?? "");
+    if (failures > 0) throw new CollectExpiredFailure({ removed, expired: 0, releasedBytes }, failures, true, { cause: firstFailure });
+    return { removed, expired: 0, releasedBytes, more };
+  }
   #transition(tenant, entry, next) {
     if (!isLegalObjectTransition(entry.state, next)) {
       throw new ByokCoreError(
@@ -2282,16 +2496,15 @@ var InMemoryObjectStore = class {
 var WARNING_NUMERATOR = 80n;
 var WARNING_DENOMINATOR = 100n;
 var InMemoryQuotaStore = class {
-  #entitlements = /* @__PURE__ */ new Map();
-  #usage = /* @__PURE__ */ new Map();
-  #reservations = /* @__PURE__ */ new Map();
-  #committedHashes = /* @__PURE__ */ new Map();
-  #clock;
-  #objects;
-  constructor(clock, objects) {
+  constructor(clock, objects, ledger) {
+    this.ledger = ledger;
     this.#clock = clock;
     this.#objects = objects;
   }
+  ledger;
+  #entitlements = /* @__PURE__ */ new Map();
+  #clock;
+  #objects;
   async readEntitlement(tenant) {
     return this.#entitlements.get(tenant);
   }
@@ -2338,13 +2551,13 @@ var InMemoryQuotaStore = class {
     };
   }
   async readReservation(tenant, reservationId) {
-    return this.#reservations.get(tenantKey(tenant, reservationId))?.reservation;
+    return this.ledger.readReservation(tenantKey(tenant, reservationId))?.reservation;
   }
   async reserve(tenant, input) {
     const entitlement = this.#requireEntitlement(tenant);
-    await this.expireReservations(tenant);
+    await Array.from(this.#expireReservations(tenant));
     const key = tenantKey(tenant, input.reservationId);
-    const existing = this.#reservations.get(key);
+    const existing = this.ledger.readReservation(key);
     if (existing !== void 0) {
       if (existing.reservation.state === "reserved") {
         if (existing.reservation.kind !== input.kind || existing.reservation.expectedBytes !== input.expectedBytes || existing.reservation.contentHash !== input.contentHash || existing.reservation.contentType !== input.contentType) {
@@ -2393,7 +2606,7 @@ var InMemoryQuotaStore = class {
       createdAt: now,
       expiresAt: new Date(this.#clock.now().getTime() + input.ttlMs).toISOString()
     };
-    this.#reservations.set(key, { reservation, deduplicated: false });
+    this.ledger.writeReservation(key, { reservation, deduplicated: false });
     this.#setUsage(tenant, { ...usage, reservedBytes: usage.reservedBytes + input.expectedBytes });
     return reservation;
   }
@@ -2447,11 +2660,10 @@ var InMemoryQuotaStore = class {
         throw error;
       }
     }
-    const hashes = this.#hashesOf(tenant);
-    const deduplicated = hashes.has(reservation.contentHash);
+    const deduplicated = this.ledger.isCounted(tenant, reservation.contentHash);
     const settled = this.#settle(tenant, key, record, "committed", deduplicated);
     if (!deduplicated) {
-      hashes.add(reservation.contentHash);
+      this.ledger.recordCommitted(tenant, reservation);
       const current = this.#usageOf(tenant);
       this.#setUsage(tenant, {
         ...current,
@@ -2468,41 +2680,59 @@ var InMemoryQuotaStore = class {
     if (record.reservation.state !== "reserved") return record.reservation;
     return this.#settle(tenant, key, record, "aborted");
   }
-  async expireReservations(tenant) {
+  *#expireReservations(tenant, now = this.#now(), limit = Number.MAX_SAFE_INTEGER) {
     const prefix = tenantKey(tenant, "");
-    const now = this.#now();
-    const expired = [];
-    for (const [key, record] of [...this.#reservations.entries()]) {
-      if (!key.startsWith(prefix)) continue;
-      if (record.reservation.state !== "reserved") continue;
-      if (now < record.reservation.expiresAt) continue;
-      expired.push(this.#settle(tenant, key, record, "expired"));
+    let expired = 0;
+    for (const [key, record] of this.ledger.reservations()) {
+      if (!key.startsWith(prefix) || record.reservation.state !== "reserved" || now < record.reservation.expiresAt) continue;
+      yield this.#settle(tenant, key, record, "expired", false, now);
+      if (++expired === limit) return;
     }
-    return expired;
   }
-  async applyMailboxDelta(tenant, input) {
-    const entitlement = this.#requireEntitlement(tenant);
-    const usage = this.#usageOf(tenant);
-    const next = usage.mailboxBytes + input.deltaBytes;
-    if (input.deltaBytes > 0n && next > entitlement.mailboxLimitBytes) {
-      throw new ByokCoreError(
-        "storage_quota_exceeded",
-        `Mailbox would reach ${String(next)} bytes, over the limit of ${String(entitlement.mailboxLimitBytes)} bytes.`
-      );
+  async collectExpired(tenant, input) {
+    assertCollectExpiredInput(input);
+    assertCanonicalTimestamp(input.settledBefore, "settledBefore");
+    let expired = 0, releasedBytes = 0n, removed = 0, more = false;
+    try {
+      for (const reservation of this.#expireReservations(tenant, input.now, input.limit)) {
+        expired++;
+        releasedBytes += reservation.expectedBytes;
+      }
+    } catch (cause) {
+      throw new CollectExpiredFailure({ removed, expired, releasedBytes }, 1, true, { cause });
     }
-    this.#setUsage(tenant, { ...usage, mailboxBytes: next < 0n ? 0n : next });
-    return this.#usageOf(tenant);
+    const prefix = tenantKey(tenant, "");
+    try {
+      for (const [key, record] of this.ledger.reservations()) {
+        if (!key.startsWith(prefix)) continue;
+        const row = record.reservation;
+        const shouldExpire = row.state === "reserved" && row.expiresAt <= input.now;
+        const shouldRemove = (row.state === "expired" || row.state === "aborted") && row.settledAt !== void 0 && row.settledAt < input.settledBefore;
+        if (!shouldExpire && !shouldRemove) continue;
+        if (shouldExpire || removed + expired === input.limit) {
+          more = true;
+          continue;
+        }
+        this.ledger.deleteReservation(key);
+        removed++;
+      }
+    } catch (cause) {
+      throw new CollectExpiredFailure({ removed, expired, releasedBytes }, 0, void 0, { cause });
+    }
+    return { removed, expired, releasedBytes, more };
   }
-  #settle(tenant, key, record, state, deduplicated = false) {
+  #settle(tenant, key, record, state, deduplicated = false, settledAt = this.#now()) {
     const settled = {
       ...record.reservation,
       state,
-      settledAt: this.#now()
+      settledAt
     };
-    this.#reservations.set(key, { reservation: settled, deduplicated });
     const usage = this.#usageOf(tenant);
-    const released = usage.reservedBytes - record.reservation.expectedBytes;
-    this.#setUsage(tenant, { ...usage, reservedBytes: released < 0n ? 0n : released });
+    if (usage.reservedBytes < record.reservation.expectedBytes) {
+      throw new ByokCoreError("storage_integrity_mismatch", "Reservation settlement would underflow reserved usage.");
+    }
+    this.ledger.writeReservation(key, { reservation: settled, deduplicated });
+    this.#setUsage(tenant, { ...usage, reservedBytes: usage.reservedBytes - record.reservation.expectedBytes });
     return settled;
   }
   #posture(entitlement, usage, graceActive) {
@@ -2520,28 +2750,10 @@ var InMemoryQuotaStore = class {
     return usage.committedObjectBytes + usage.committedInlineBytes + usage.reservedBytes;
   }
   #usageOf(tenant) {
-    const existing = this.#usage.get(tenant);
-    if (existing !== void 0) return existing;
-    const empty = {
-      committedObjectBytes: 0n,
-      committedInlineBytes: 0n,
-      reservedBytes: 0n,
-      mailboxBytes: 0n,
-      objectCount: 0n,
-      updatedAt: this.#now()
-    };
-    this.#usage.set(tenant, empty);
-    return empty;
+    return this.ledger.readUsage(tenant);
   }
   #setUsage(tenant, usage) {
-    this.#usage.set(tenant, { ...usage, updatedAt: this.#now() });
-  }
-  #hashesOf(tenant) {
-    const existing = this.#committedHashes.get(tenant);
-    if (existing !== void 0) return existing;
-    const created = /* @__PURE__ */ new Set();
-    this.#committedHashes.set(tenant, created);
-    return created;
+    this.ledger.writeUsage(tenant, { ...usage, updatedAt: this.#now() });
   }
   #requireEntitlement(tenant) {
     const entitlement = this.#entitlements.get(tenant);
@@ -2554,7 +2766,7 @@ var InMemoryQuotaStore = class {
     return entitlement;
   }
   #requireReservation(tenant, reservationId) {
-    const record = this.#reservations.get(tenantKey(tenant, reservationId));
+    const record = this.ledger.readReservation(tenantKey(tenant, reservationId));
     if (record === void 0) {
       throw new ByokCoreError(
         "storage_reservation_not_found",
@@ -2786,43 +2998,45 @@ var InMemoryDeviceAssertionReplayAuthority = class {
     this.#expiresAtByKey.set(key, expiresAt);
     return true;
   }
-  /** Delete at most `limit` keys whose assertion lifetime ended at or before `before`. */
-  async deleteExpired(before, limit) {
-    const cutoff = before.getTime();
-    if (!Number.isFinite(cutoff) || !Number.isSafeInteger(limit) || limit <= 0) {
-      throw new Error("device assertion replay cleanup bounds are invalid");
-    }
-    let deleted = 0;
+  async collectExpired(tenant, input) {
+    assertCollectExpiredInput(input);
+    const cutoff = Date.parse(input.now);
+    let removed = 0, more = false;
     for (const [key, expiresAt] of this.#expiresAtByKey) {
-      if (expiresAt > cutoff) continue;
+      if (JSON.parse(key)[0] !== tenant || expiresAt > cutoff) continue;
+      if (removed === input.limit) {
+        more = true;
+        break;
+      }
       this.#expiresAtByKey.delete(key);
-      deleted += 1;
-      if (deleted === limit) break;
+      removed++;
     }
-    return deleted;
+    return { removed, expired: 0, releasedBytes: 0n, more };
   }
 };
 
 // src/in-memory/index.ts
-function createInMemoryCoreStores(options = {}) {
+function createInMemoryCoreStores(options) {
   const clock = options.clock ?? createMutableClock();
-  const objects = new InMemoryObjectStore(clock);
+  const ledger = new InMemoryStorageLedger(clock);
+  const objects = new InMemoryObjectStore(clock, { ledger, bytes: options.objectBytes });
+  const quota = new InMemoryQuotaStore(clock, objects, ledger);
   const stores = {
-    mailbox: new InMemoryMailboxStore(clock),
+    mailbox: new InMemoryMailboxStore(clock, quota),
     board: new InMemoryBoardStore(clock),
     truth: new InMemoryTruthStore(clock),
     presence: new InMemoryPresenceStore(clock),
     objects,
-    quota: new InMemoryQuotaStore(clock, objects),
+    quota,
     skillPacks: new InMemorySkillPackStore()
   };
   return { stores, clock };
 }
-function createInMemoryCoreCompositionWithClock() {
+function createInMemoryCoreCompositionWithClock(objectBytes) {
   const clock = createMutableClock();
-  return { stores: createInMemoryCoreStores({ clock }).stores, clock };
+  return { stores: createInMemoryCoreStores({ clock, objectBytes }).stores, clock };
 }
 
-export { AGENT_MEMORY_INTENT_DIGEST_VERSION, BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, PROVIDER_PROVISIONING_MAX_TTL_MS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_REQUEST_VERSION, PROVIDER_PROVISIONING_SECRET_OPERATIONS, PROVIDER_SECRET_HPKE_INFO, PROVIDER_SECRET_HPKE_SUITE, PROVIDER_SECRET_MAX_BYTES, PROVIDER_SECRET_MAX_PADDED_BYTES, PROVIDER_SECRET_PAD_BLOCK_BYTES, ProviderProvisioningConfigV1Schema, ProviderProvisioningExpectedProfileSchema, ProviderProvisioningHeaderV1Schema, ProviderProvisioningIdentityRevisionSchema, ProviderProvisioningRequestV1Schema, SEALING_KEY_ID_LENGTH, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SealedProviderSecretV1Schema, SealingKeyClaimV1Schema, SealingKeyIdSchema, SealingPublicJwkSchema, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, agentMemoryIntentOperationDigest, assertCanonicalTimestamp, assertCapability, assertProviderProvisioningConfigDigest, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deriveSealingKeyId, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, openProviderProvisioningSecret, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseProviderProvisioningRequest, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, providerProvisioningConfigDigest, providerProvisioningRequestDigest, providerSecretAadBytes, sealProviderProvisioningRequest, sealingKeyClaimCanonicalBytes, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
+export { AGENT_MEMORY_INTENT_DIGEST_VERSION, BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CollectExpiredFailure, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryStorageLedger, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, PROVIDER_PROVISIONING_MAX_TTL_MS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_REQUEST_VERSION, PROVIDER_PROVISIONING_SECRET_OPERATIONS, PROVIDER_SECRET_HPKE_INFO, PROVIDER_SECRET_HPKE_SUITE, PROVIDER_SECRET_MAX_BYTES, PROVIDER_SECRET_MAX_PADDED_BYTES, PROVIDER_SECRET_PAD_BLOCK_BYTES, ProviderProvisioningConfigV1Schema, ProviderProvisioningExpectedProfileSchema, ProviderProvisioningHeaderV1Schema, ProviderProvisioningIdentityRevisionSchema, ProviderProvisioningRequestV1Schema, SEALING_KEY_ID_LENGTH, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SealedProviderSecretV1Schema, SealingKeyClaimV1Schema, SealingKeyIdSchema, SealingPublicJwkSchema, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, agentMemoryIntentOperationDigest, assertCanonicalTimestamp, assertCapability, assertCollectExpiredInput, assertProviderProvisioningConfigDigest, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deriveSealingKeyId, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, openProviderProvisioningSecret, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseProviderProvisioningRequest, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, providerProvisioningConfigDigest, providerProvisioningRequestDigest, providerSecretAadBytes, sealProviderProvisioningRequest, sealingKeyClaimCanonicalBytes, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map