@byok-sdk/server 0.11.0 → 0.12.0

package/dist/index.js

@@ -1,16 +1,16 @@
+import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, RESULT_DOCUMENT_MAX_BYTES, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentRefSchema, AgentEgressPolicySchema, AgentMessageEgressRequirementSchema, TerminalProjectionSelectionSchema, AgentMessageServerContextSchema, DispatchSelectionSchema, RequiredToolsetsSchema, STRICT_AGENT_ONLY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, AgentContentReadPayloadSchema, AgentHomeProjectionPayloadSchema, AGENT_HOME_PROJECTION_CAPABILITY, AgentHomeProjectionReadbackSchema, AgentHomeProjectionCompletionRequestSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, PairResponseSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, PairResponseTenantIdSchema, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { randomBytes, randomUUID, timingSafeEqual, createHmac, createHash, createPublicKey, verify } from 'crypto';
 import { nonceSigningBytes } from '@byok-sdk/core';
 import { jwtVerify, SignJWT } from 'jose';
-import { mkdir, writeFile, readFile } from 'fs/promises';
+import { mkdir, writeFile, readFile, rename } from 'fs/promises';
 import { mkdtempSync, mkdirSync, existsSync, chmodSync } from 'fs';
 import { tmpdir } from 'os';
 import path, { dirname } from 'path';
-import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, AgentRefSchema, AgentEgressPolicySchema, AgentMessageEgressRequirementSchema, TerminalProjectionSelectionSchema, AgentMessageServerContextSchema, DispatchSelectionSchema, RequiredToolsetsSchema, STRICT_AGENT_ONLY_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, TERMINAL_PROJECTION_SELECTION_CAPABILITY, AgentContentReadPayloadSchema, AgentHomeProjectionPayloadSchema, AGENT_HOME_PROJECTION_CAPABILITY, AgentHomeProjectionReadbackSchema, AgentHomeProjectionCompletionRequestSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, PairResponseSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, PairResponseTenantIdSchema, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { Hono } from 'hono';
 import { WebSocketServer } from 'ws';
 import { createRequire } from 'module';
 
-// src/auth.ts
+// src/index.ts
 var ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
 var NONCE_TTL_MS = 5 * 60 * 1e3;
 function createHmacTokenSigner(secret = randomBytes(32)) {
@@ -208,34 +208,46 @@ function sha256Hex(data) {
 var LocalDiskBlobStore = class {
   secret = randomBytes(32);
   directory;
+  metadataPath;
   urlTtlMs;
   blobs = /* @__PURE__ */ new Map();
   ready;
+  metadataWriteTail = Promise.resolve();
   constructor(opts = {}) {
     this.directory = opts.directory ?? mkdtempSync(path.join(tmpdir(), "byok-blobs-"));
+    this.metadataPath = path.join(this.directory, "metadata.json");
     this.urlTtlMs = opts.urlTtlMs ?? DEFAULT_URL_TTL_MS;
-    this.ready = mkdir(this.directory, { recursive: true }).then(() => void 0);
+    this.ready = mkdir(this.directory, { recursive: true }).then(() => this.loadMetadata());
   }
-  async createUpload(input, requestedBlobId) {
+  async createUpload(tenantId, input, requestedBlobId) {
     await this.ready;
     const blobId = requestedBlobId ?? `blob_${randomUUID()}`;
     const existing = this.blobs.get(blobId);
     if (existing !== void 0) {
-      if (existing.meta.size !== input.size || existing.meta.contentType !== input.contentType || existing.meta.contentHash !== input.contentHash) {
+      if (existing.tenantId !== tenantId || existing.meta.size !== input.size || existing.meta.contentType !== input.contentType || existing.meta.contentHash !== input.contentHash) {
         throw new BlobDeclarationConflictError(blobId);
       }
       return { blobId, uploadUrl: this.signUrl(blobId, "put") };
     }
-    this.blobs.set(blobId, { meta: input, uploaded: false });
+    this.blobs.set(blobId, { tenantId, meta: input, uploaded: false });
+    await this.persistMetadata();
     return { blobId, uploadUrl: this.signUrl(blobId, "put") };
   }
-  async getDownloadUrl(blobId) {
+  async getDownloadUrl(tenantId, blobId) {
+    await this.ready;
     const record = this.blobs.get(blobId);
-    if (!record?.uploaded) return void 0;
+    if (!record?.uploaded || record.tenantId !== tenantId) return void 0;
     return this.signUrl(blobId, "get");
   }
-  async exists(blobId) {
-    return this.blobs.get(blobId)?.uploaded ?? false;
+  async exists(tenantId, blobId) {
+    await this.ready;
+    const record = this.blobs.get(blobId);
+    return record?.tenantId === tenantId && record.uploaded;
+  }
+  async getUploadReservation(blobId) {
+    await this.ready;
+    const record = this.blobs.get(blobId);
+    return record === void 0 ? void 0 : { size: record.meta.size };
   }
   verifySignedUrl(blobId, action, sig, exp) {
     if (!Number.isFinite(exp) || Date.now() > exp) return false;
@@ -259,9 +271,11 @@ var LocalDiskBlobStore = class {
     }
     await writeFile(this.pathFor(blobId), data);
     record.uploaded = true;
+    await this.persistMetadata();
     return { ok: true };
   }
   async readContent(blobId) {
+    await this.ready;
     const record = this.blobs.get(blobId);
     if (!record?.uploaded) return void 0;
     const data = await readFile(this.pathFor(blobId));
@@ -270,6 +284,41 @@ var LocalDiskBlobStore = class {
   pathFor(blobId) {
     return path.join(this.directory, blobId);
   }
+  async loadMetadata() {
+    let raw;
+    try {
+      raw = await readFile(this.metadataPath, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return;
+      throw error;
+    }
+    const parsed = JSON.parse(raw);
+    if (!isBlobMetadataDocument(parsed)) {
+      throw new Error("invalid LocalDiskBlobStore metadata document");
+    }
+    for (const entry of parsed.blobs) {
+      this.blobs.set(entry.blobId, {
+        tenantId: entry.tenantId,
+        meta: entry.meta,
+        uploaded: entry.uploaded
+      });
+    }
+    this.secret = Buffer.from(parsed.signingSecret, "base64url");
+  }
+  async persistMetadata() {
+    const write = this.metadataWriteTail.then(async () => {
+      const metadata = {
+        version: 1,
+        signingSecret: this.secret.toString("base64url"),
+        blobs: [...this.blobs.entries()].map(([blobId, record]) => ({ blobId, ...record }))
+      };
+      const temporaryPath = `${this.metadataPath}.${randomUUID()}.tmp`;
+      await writeFile(temporaryPath, JSON.stringify(metadata), "utf8");
+      await rename(temporaryPath, this.metadataPath);
+    });
+    this.metadataWriteTail = write.catch(() => void 0);
+    await write;
+  }
   computeSig(blobId, action, exp) {
     return createHmac("sha256", this.secret).update(`${blobId}:${action}:${exp}`).digest("base64url");
   }
@@ -279,6 +328,21 @@ var LocalDiskBlobStore = class {
     return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;
   }
 };
+function isBlobMetadataDocument(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const document = value;
+  if (document.version !== 1 || typeof document.signingSecret !== "string" || !Array.isArray(document.blobs)) return false;
+  const signingSecret = Buffer.from(document.signingSecret, "base64url");
+  if (signingSecret.length !== 32) return false;
+  return document.blobs.every((entry) => {
+    if (typeof entry !== "object" || entry === null) return false;
+    const candidate = entry;
+    if (typeof candidate.blobId !== "string" || typeof candidate.tenantId !== "string" || typeof candidate.uploaded !== "boolean") return false;
+    if (typeof candidate.meta !== "object" || candidate.meta === null) return false;
+    const meta = candidate.meta;
+    return typeof meta.size === "number" && Number.isSafeInteger(meta.size) && meta.size >= 0 && typeof meta.contentType === "string" && typeof meta.contentHash === "string";
+  });
+}
 
 // src/event-queue.ts
 var AsyncEventQueue = class {
@@ -567,6 +631,16 @@ var AgentHomeProjectionCompletionError = class extends Error {
   }
   code;
 };
+var ReplayGapError = class extends Error {
+  constructor(cursor, recoverableFrom) {
+    super(`cursor_too_old: cursor ${String(cursor)} is older than recoverable sequence ${String(recoverableFrom)}`);
+    this.cursor = cursor;
+    this.recoverableFrom = recoverableFrom;
+    this.name = "ReplayGapError";
+  }
+  cursor;
+  recoverableFrom;
+};
 var ConnectionHub = class {
   constructor(taskStore, devices, taskLeaseMs, rateLimiter = new RateLimiter(), agentMessage) {
     this.taskStore = taskStore;
@@ -584,6 +658,7 @@ var ConnectionHub = class {
   rateLimiter;
   agentMessage;
   connections = /* @__PURE__ */ new Map();
+  connectionEpochs = /* @__PURE__ */ new Map();
   outboxes = /* @__PURE__ */ new Map();
   /** Idempotency window per device (N3) — recent inbound envelope ids, capped at {@link DEDUP_RING_CAPACITY}. */
   dedupRings = /* @__PURE__ */ new Map();
@@ -661,8 +736,11 @@ var ConnectionHub = class {
    */
   registerConnection(deviceId, ws, runtimes, capabilities, configuredToolsets, clientVersion) {
     const at = (/* @__PURE__ */ new Date()).toISOString();
+    const prior = this.connections.get(deviceId);
+    const epoch = this.nextConnectionEpoch(deviceId);
     this.connections.set(deviceId, {
       ws,
+      epoch,
       connected: true,
       lastSeen: at,
       clientVersion,
@@ -672,6 +750,15 @@ var ConnectionHub = class {
     });
     this.serverEvents.push({ kind: "device.connected", deviceId, at });
     this.settleLongPollWaiter(deviceId);
+    if (prior?.ws && prior.ws !== ws) {
+      prior.ws.close(1e3, "superseded by newer websocket connection");
+    }
+    return epoch;
+  }
+  /** True only while this exact WS registration remains the device authority. */
+  isCurrentConnection(deviceId, ws, epoch) {
+    const connection = this.connections.get(deviceId);
+    return connection?.connected === true && connection.ws === ws && connection.epoch === epoch;
   }
   sendConnAck(deviceId, capabilities) {
     this.sendToDevice(
@@ -692,6 +779,7 @@ var ConnectionHub = class {
    * non-terminal task. Called after `conn.ack` (step 2), per the spec.
    */
   redeliverAfterReconnect(deviceId, cursor) {
+    this.assertReplayAvailable(deviceId, cursor);
     const conn = this.connections.get(deviceId);
     if (!conn?.ws || !conn.connected) return;
     for (const envelope of this.collectRelevant(deviceId, cursor)) {
@@ -752,6 +840,7 @@ var ConnectionHub = class {
   forgetDevice(deviceId) {
     const conn = this.connections.get(deviceId);
     this.connections.delete(deviceId);
+    this.connectionEpochs.delete(deviceId);
     this.outboxes.delete(deviceId);
     this.dedupRings.delete(deviceId);
     this.rateLimitEventEmittedFor.delete(deviceId);
@@ -770,19 +859,25 @@ var ConnectionHub = class {
    * {@link ConnectionState}).
    */
   async pollEvents(deviceId, cursor, holdMs) {
+    this.assertReplayAvailable(deviceId, cursor);
     this.takeOverAsLongPoll(deviceId);
     this.settleLongPollWaiter(deviceId);
     const immediate = this.collectRelevant(deviceId, cursor);
     if (immediate.length > 0) {
       return { events: immediate, cursor: this.currentCursor(deviceId) };
     }
-    return new Promise((resolve) => {
+    return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         this.longPollWaiters.delete(deviceId);
-        resolve({ events: [], cursor: this.currentCursor(deviceId) });
+        try {
+          this.assertReplayAvailable(deviceId, cursor);
+          resolve({ events: [], cursor: this.currentCursor(deviceId) });
+        } catch (error) {
+          reject(error);
+        }
       }, holdMs);
       timer.unref?.();
-      this.longPollWaiters.set(deviceId, { cursor, resolve, timer });
+      this.longPollWaiters.set(deviceId, { cursor, resolve, reject, timer });
     });
   }
   /** Make long-poll this device's active transport, closing any live WS ("last one wins", §8). */
@@ -793,6 +888,7 @@ var ConnectionHub = class {
     if (conn?.ws) {
       const ws = conn.ws;
       this.connections.set(deviceId, {
+        epoch: this.nextConnectionEpoch(deviceId),
         connected: true,
         lastSeen: at,
         runtimes: conn.runtimes,
@@ -801,7 +897,7 @@ var ConnectionHub = class {
       });
       ws.close(1e3, "superseded by long-poll connection");
     } else if (!conn) {
-      this.connections.set(deviceId, { connected: true, lastSeen: at });
+      this.connections.set(deviceId, { epoch: this.nextConnectionEpoch(deviceId), connected: true, lastSeen: at });
     } else {
       conn.connected = true;
       conn.lastSeen = at;
@@ -817,7 +913,12 @@ var ConnectionHub = class {
     if (!waiter) return;
     this.longPollWaiters.delete(deviceId);
     clearTimeout(waiter.timer);
-    waiter.resolve({ events: this.collectRelevant(deviceId, waiter.cursor), cursor: this.currentCursor(deviceId) });
+    try {
+      this.assertReplayAvailable(deviceId, waiter.cursor);
+      waiter.resolve({ events: this.collectRelevant(deviceId, waiter.cursor), cursor: this.currentCursor(deviceId) });
+    } catch (error) {
+      waiter.reject(error);
+    }
   }
   // ---------------------------------------------------------------------
   // inbound envelopes from a connected daemon
@@ -939,7 +1040,6 @@ var ConnectionHub = class {
     if (binding === void 0 || record === void 0 || record.deviceId !== deviceId || binding.deviceId !== deviceId || !sameAgentRef(binding.agentRef, payload.agentRef) || binding.sessionRef !== void 0 && binding.sessionRef !== payload.sessionRef || binding.requirement.contract !== payload.contract || binding.requirement.contentType !== payload.contentType || payload.byteCount > binding.requirement.maxBytes) return "rejected";
     const taskPayload = this.agentMessageTaskPayloads.get(taskId);
     if (taskPayload !== void 0 && JSON.stringify(taskPayload) !== JSON.stringify(payload)) return "rejected";
-    if (taskPayload === void 0) this.agentMessageTaskPayloads.set(taskId, payload);
     const key = `${deviceId}\0${payload.messageId}`;
     const previous = this.agentMessageReceipts.get(key);
     if (previous !== void 0) {
@@ -947,6 +1047,9 @@ var ConnectionHub = class {
       this.sendAgentMessageDisposition(deviceId, taskId, previous.disposition);
       return "duplicate";
     }
+    if (isTerminal(record.state)) return "rejected";
+    if (taskPayload !== void 0) return "rejected";
+    this.agentMessageTaskPayloads.set(taskId, payload);
     const decision = this.agentMessage?.consume({ deviceId, taskId, context: binding.context, payload }) ?? { outcome: "held", reasonCode: "consumer_unavailable" };
     const disposition = {
       agentRef: payload.agentRef,
@@ -2172,7 +2275,12 @@ var ConnectionHub = class {
     const redeliverThroughTerminal = type === "task.cancel" || type === "task.reject";
     const redeliverWithoutTask = type === "agent.egress.ack" || type === "agent.content.read" || type === "agent.home.projection" || type === "agent.message.disposition";
     outbox.ring.push({ seq, taskId, envelope, redeliverThroughTerminal, redeliverWithoutTask });
-    if (outbox.ring.length > OUTBOX_RING_CAPACITY) outbox.ring.shift();
+    if (outbox.ring.length > OUTBOX_RING_CAPACITY) {
+      const evicted = outbox.ring.shift();
+      if (evicted !== void 0 && this.isRecoverableEntry(evicted)) {
+        outbox.recoverableFrom = Math.max(outbox.recoverableFrom, evicted.seq + 1);
+      }
+    }
     this.deliverToDevice(deviceId, envelope);
     return envelope;
   }
@@ -2199,6 +2307,26 @@ var ConnectionHub = class {
       (entry) => entry.seq > cursor && (entry.taskId === void 0 ? entry.redeliverWithoutTask === true : !this.isTaskTerminal(entry.taskId) || entry.redeliverThroughTerminal)
     ).map((entry) => entry.envelope);
   }
+  /**
+   * A caller at `recoverableFrom - 1` can still receive the first retained
+   * control. Anything earlier would be a partial tail and must fail closed.
+   */
+  assertReplayAvailable(deviceId, cursor, pendingOutbound = 0) {
+    const outbox = this.outboxes.get(deviceId);
+    if (outbox === void 0) return;
+    let recoverableFrom = outbox.recoverableFrom;
+    const evictions = Math.max(0, outbox.ring.length + pendingOutbound - OUTBOX_RING_CAPACITY);
+    for (let index = 0; index < evictions; index++) {
+      const evicted = outbox.ring[index];
+      if (evicted !== void 0 && this.isRecoverableEntry(evicted)) {
+        recoverableFrom = Math.max(recoverableFrom, evicted.seq + 1);
+      }
+    }
+    if (cursor < recoverableFrom - 1) throw new ReplayGapError(cursor, recoverableFrom);
+  }
+  isRecoverableEntry(entry) {
+    return entry.redeliverWithoutTask === true || entry.taskId !== void 0 && (!this.isTaskTerminal(entry.taskId) || entry.redeliverThroughTerminal === true);
+  }
   isTaskTerminal(taskId) {
     const record = this.taskStore.get(taskId);
     return !record || isTerminal(record.state);
@@ -2211,11 +2339,16 @@ var ConnectionHub = class {
   getOrCreateOutbox(deviceId) {
     let outbox = this.outboxes.get(deviceId);
     if (!outbox) {
-      outbox = { nextSeq: 1, ring: [] };
+      outbox = { nextSeq: 1, recoverableFrom: 1, ring: [] };
       this.outboxes.set(deviceId, outbox);
     }
     return outbox;
   }
+  nextConnectionEpoch(deviceId) {
+    const epoch = (this.connectionEpochs.get(deviceId) ?? 0) + 1;
+    this.connectionEpochs.set(deviceId, epoch);
+    return epoch;
+  }
   // ---------------------------------------------------------------------
   // read-only accessors backing the public `machines` / `tasks` API
   // ---------------------------------------------------------------------
@@ -2301,6 +2434,12 @@ var PairingCodeInvalidError = class extends Error {
     this.name = "PairingCodeInvalidError";
   }
 };
+var PairingAttemptConflictError = class extends Error {
+  constructor() {
+    super("pairing code is already bound to a different pairing attempt");
+    this.name = "PairingAttemptConflictError";
+  }
+};
 var PairingManager = class {
   codes = /* @__PURE__ */ new Map();
   /**
@@ -2340,6 +2479,46 @@ var PairingManager = class {
     record.used = true;
     return record.claims;
   }
+  /**
+   * Bind a code to one exact pairing request, returning any completion that a
+   * prior response/token failure left recoverable. This mutation is entirely
+   * synchronous: the HTTP route cannot yield between binding, registration,
+   * and completion recording, so concurrent requests have one winner.
+   */
+  beginPairingAttempt(code, binding) {
+    const record = this.codes.get(code);
+    if (!record) throw new PairingCodeInvalidError("unknown code");
+    if (Date.now() > record.expiresAt) throw new PairingCodeInvalidError("code expired");
+    validatePairingAttemptBinding(binding);
+    if (record.attempt !== void 0) {
+      if (!samePairingAttemptBinding(record.attempt.binding, binding)) throw new PairingAttemptConflictError();
+      return { claims: record.claims, completion: record.attempt.completion };
+    }
+    if (record.used) throw new PairingCodeInvalidError("code already used");
+    record.used = true;
+    record.attempt = { binding: { ...binding } };
+    return { claims: record.claims };
+  }
+  /** Record the one device identity a bound pairing attempt completed as. */
+  completePairingAttempt(code, binding, completion) {
+    const record = this.codes.get(code);
+    if (!record?.attempt || !samePairingAttemptBinding(record.attempt.binding, binding)) {
+      throw new PairingAttemptConflictError();
+    }
+    const expected = {
+      deviceId: completion.deviceId,
+      tenantId: record.claims.tenantId,
+      productId: record.claims.productId,
+      deviceName: binding.deviceName,
+      devicePublicKey: binding.devicePublicKey
+    };
+    if (record.attempt.completion !== void 0) {
+      if (!samePairingCompletion(record.attempt.completion, expected)) throw new PairingAttemptConflictError();
+      return record.attempt.completion;
+    }
+    record.attempt.completion = expected;
+    return expected;
+  }
 };
 function validatePairingCodeClaims(claims) {
   if (typeof claims !== "object" || claims === null) {
@@ -2355,6 +2534,17 @@ function validatePairingCodeClaims(claims) {
   }
   return { tenantId: tenantResult.data, productId };
 }
+function validatePairingAttemptBinding(binding) {
+  if (typeof binding !== "object" || binding === null || typeof binding.deviceName !== "string" || binding.deviceName.length === 0 || typeof binding.devicePublicKey !== "string" || binding.devicePublicKey.length === 0) {
+    throw new TypeError("pairing attempt requires a non-empty deviceName and devicePublicKey");
+  }
+}
+function samePairingAttemptBinding(left, right) {
+  return left.deviceName === right.deviceName && left.devicePublicKey === right.devicePublicKey;
+}
+function samePairingCompletion(left, right) {
+  return left.deviceId === right.deviceId && left.tenantId === right.tenantId && left.productId === right.productId && left.deviceName === right.deviceName && left.devicePublicKey === right.devicePublicKey;
+}
 
 // src/http.ts
 async function readJsonBody(c) {
@@ -2364,6 +2554,34 @@ async function readJsonBody(c) {
     return void 0;
   }
 }
+function declaredLengthExceeds(value, limit) {
+  if (value === void 0 || !/^(?:0|[1-9]\d*)$/.test(value)) return false;
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed > limit;
+}
+async function readBoundedUpload(c, limit) {
+  const body = c.req.raw.body;
+  if (body === null) return { kind: "ok", data: Buffer.alloc(0) };
+  const reader = body.getReader();
+  const target = Buffer.allocUnsafe(limit);
+  let received = 0;
+  try {
+    while (true) {
+      const { done, value } = await reader.read();
+      if (done) return { kind: "ok", data: target.subarray(0, received) };
+      if (received + value.byteLength > limit) {
+        void reader.cancel().catch(() => void 0);
+        return { kind: "too_large" };
+      }
+      target.set(value, received);
+      received += value.byteLength;
+    }
+  } catch {
+    return { kind: "read_error" };
+  } finally {
+    reader.releaseLock();
+  }
+}
 function buildHonoApp(deps) {
   const app = new Hono();
   const serverStartedAtMs = Date.now();
@@ -2376,24 +2594,32 @@ function buildHonoApp(deps) {
       return c.json({ error: "pairingCode, deviceName, and devicePublicKey are required strings" }, 400);
     }
     const { pairingCode, deviceName, devicePublicKey } = parsed.data;
-    let claims;
+    const binding = { deviceName, devicePublicKey };
+    let attempt;
     try {
-      claims = deps.pairing.redeemPairingCode(pairingCode);
+      attempt = deps.pairing.beginPairingAttempt(pairingCode, binding);
     } catch (err) {
       if (err instanceof PairingCodeInvalidError) {
         return c.json({ error: err.message }, 401);
       }
+      if (err instanceof PairingAttemptConflictError) {
+        return c.json({ error: "pairing_attempt_conflict" }, 409);
+      }
       throw err;
     }
-    const deviceId = generateDeviceId();
-    deps.devices.register({
-      tenantId: claims.tenantId,
-      productId: claims.productId,
-      deviceId,
-      deviceName,
-      devicePublicKey
-    });
-    const device = deps.devices.get(claims.tenantId, deviceId);
+    let completion = attempt.completion;
+    if (completion === void 0) {
+      const candidate = {
+        tenantId: attempt.claims.tenantId,
+        productId: attempt.claims.productId,
+        deviceId: generateDeviceId(),
+        deviceName,
+        devicePublicKey
+      };
+      deps.devices.register(candidate);
+      completion = deps.pairing.completePairingAttempt(pairingCode, binding, candidate);
+    }
+    const device = deps.devices.get(completion.tenantId, completion.deviceId);
     if (device === void 0) {
       throw new Error("paired device row was not persisted");
     }
@@ -2459,7 +2685,7 @@ function buildHonoApp(deps) {
     }
     const blobId = reservationBlobId(principal.tenantId, reservationId);
     try {
-      const created = await deps.blobStore.createUpload(parsed.data, blobId);
+      const created = await deps.blobStore.createUpload(principal.tenantId, parsed.data, blobId);
       const response = created;
       return c.json(response, 200);
     } catch (error) {
@@ -2480,7 +2706,7 @@ function buildHonoApp(deps) {
     if (reservationBlobId(principal.tenantId, reservationId) !== blobId) {
       return c.json({ error: "storage_integrity_mismatch" }, 422);
     }
-    if (!await deps.blobStore.exists(blobId)) {
+    if (!await deps.blobStore.exists(principal.tenantId, blobId)) {
       return c.json({ error: "storage_reservation_not_found" }, 404);
     }
     return c.body(null, 204);
@@ -2488,7 +2714,7 @@ function buildHonoApp(deps) {
   app.get(BYOK_BLOB_URL_ROUTE, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
     if (!principal) return c.json({ error: "unauthorized" }, 401);
-    const downloadUrl = await deps.blobStore.getDownloadUrl(c.req.param("id"));
+    const downloadUrl = await deps.blobStore.getDownloadUrl(principal.tenantId, c.req.param("id"));
     if (!downloadUrl) return c.json({ error: "blob not found" }, 404);
     const response = { downloadUrl };
     return c.json(response, 200);
@@ -2499,8 +2725,18 @@ function buildHonoApp(deps) {
     if (!sig || exp === void 0 || !deps.blobStore.verifySignedUrl(blobId, "put", sig, exp)) {
       return c.json({ error: "invalid or expired signature" }, 401);
     }
-    const data = Buffer.from(await c.req.arrayBuffer());
-    const result = await deps.blobStore.writeContent(blobId, data);
+    const reservation = await deps.blobStore.getUploadReservation(blobId);
+    if (reservation === void 0) return c.json({ error: "blob not found" }, 404);
+    if (reservation.size > deps.maxBlobSizeBytes) {
+      return c.json({ error: `blob exceeds max size of ${deps.maxBlobSizeBytes} bytes` }, 413);
+    }
+    if (declaredLengthExceeds(c.req.header("content-length"), reservation.size)) {
+      return c.json({ error: "upload body exceeds reservation" }, 413);
+    }
+    const body = await readBoundedUpload(c, reservation.size);
+    if (body.kind === "too_large") return c.json({ error: "upload body exceeds reservation" }, 413);
+    if (body.kind === "read_error") return c.json({ error: "failed to read upload body" }, 400);
+    const result = await deps.blobStore.writeContent(blobId, body.data);
     if (!result.ok) return c.json({ error: result.reason }, 422);
     return c.body(null, 204);
   });
@@ -2524,9 +2760,16 @@ function buildHonoApp(deps) {
       if (!Number.isInteger(parsedCursor) || parsedCursor < 0) return c.json({ error: "invalid cursor" }, 400);
       cursor = parsedCursor;
     }
-    const result = await deps.hub.pollEvents(principal.deviceId, cursor, deps.longPollHoldMs);
-    const response = { ...result, capabilities: [...CAPABILITY_FLAGS] };
-    return c.json(response, 200);
+    try {
+      const result = await deps.hub.pollEvents(principal.deviceId, cursor, deps.longPollHoldMs);
+      const response = { ...result, capabilities: [...CAPABILITY_FLAGS] };
+      return c.json(response, 200);
+    } catch (error) {
+      if (error instanceof ReplayGapError) {
+        return c.json({ error: "cursor_too_old", recoverableFrom: error.recoverableFrom }, 409);
+      }
+      throw error;
+    }
   });
   app.post(BYOK_MESSAGES_PATH, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
@@ -2716,8 +2959,14 @@ function toDecodable(data) {
   if (data instanceof ArrayBuffer) return new Uint8Array(data);
   return data;
 }
+function rawDataByteLength(data) {
+  if (typeof data === "string") return Buffer.byteLength(data);
+  if (Array.isArray(data)) return data.reduce((total, part) => total + part.byteLength, 0);
+  return data.byteLength;
+}
 function attachWebSocket(server, deps) {
-  const wss = new WebSocketServer({ noServer: true });
+  const wss = new WebSocketServer({ noServer: true, maxPayload: deps.maxPayloadBytes });
+  let pendingHelloConnections = 0;
   server.on("upgrade", (req, socket, head) => {
     if (!matchesWsPath(req.url ?? "")) return;
     void (async () => {
@@ -2726,17 +2975,44 @@ function attachWebSocket(server, deps) {
         rejectUpgrade(socket, 401, "Unauthorized");
         return;
       }
-      wss.handleUpgrade(req, socket, head, (ws) => {
-        handleConnection(ws, principal, deps);
-      });
+      if (pendingHelloConnections >= deps.maxPendingWebSockets) {
+        rejectUpgrade(socket, 503, "WebSocket hello admission limit reached");
+        return;
+      }
+      pendingHelloConnections++;
+      let released = false;
+      const releasePendingHello = () => {
+        if (released) return;
+        released = true;
+        pendingHelloConnections--;
+      };
+      try {
+        wss.handleUpgrade(req, socket, head, (ws) => {
+          handleConnection(ws, principal, deps, releasePendingHello);
+        });
+      } catch {
+        releasePendingHello();
+        socket.destroy();
+      }
     })();
   });
 }
-function handleConnection(ws, principal, deps) {
+function handleConnection(ws, principal, deps, releasePendingHello) {
   const { deviceId } = principal;
   let helloReceived = false;
+  let epoch;
   let heartbeat;
+  const helloDeadline = setTimeout(() => {
+    if (!helloReceived) ws.close(1008, "hello_timeout");
+  }, deps.helloTimeoutMs);
+  helloDeadline.unref?.();
+  const clearHelloDeadline = () => clearTimeout(helloDeadline);
+  ws.on("error", () => void 0);
   ws.once("message", (data) => {
+    if (rawDataByteLength(data) > deps.maxPayloadBytes) {
+      ws.close(1009, "payload_too_large");
+      return;
+    }
     let envelope;
     try {
       envelope = decodeEnvelope(toDecodable(data));
@@ -2765,8 +3041,16 @@ function handleConnection(ws, principal, deps) {
       ws.close(1002, "deviceId does not match authenticated token");
       return;
     }
+    if (payload.cursor !== void 0) {
+      try {
+        deps.hub.assertReplayAvailable(deviceId, payload.cursor, 1);
+      } catch {
+        ws.close(1008, "cursor_too_old");
+        return;
+      }
+    }
     helloReceived = true;
-    deps.hub.registerConnection(
+    epoch = deps.hub.registerConnection(
       deviceId,
       ws,
       payload.runtimes,
@@ -2774,12 +3058,19 @@ function handleConnection(ws, principal, deps) {
       payload.configuredToolsets,
       payload.clientVersion
     );
+    clearHelloDeadline();
+    releasePendingHello();
     deps.hub.sendConnAck(deviceId, SUPPORTED_CAPABILITIES);
     if (payload.cursor !== void 0) {
       deps.hub.redeliverAfterReconnect(deviceId, payload.cursor);
     }
     heartbeat = startHeartbeat(ws, { intervalMs: deps.heartbeatIntervalMs });
     ws.on("message", (msgData) => {
+      if (epoch === void 0 || !deps.hub.isCurrentConnection(deviceId, ws, epoch)) return;
+      if (rawDataByteLength(msgData) > deps.maxPayloadBytes) {
+        ws.close(1009, "payload_too_large");
+        return;
+      }
       let msg;
       try {
         msg = decodeEnvelope(toDecodable(msgData));
@@ -2787,12 +3078,16 @@ function handleConnection(ws, principal, deps) {
         console.warn(`[byok/server] dropping unparsable frame from device ${deviceId}:`, err);
         return;
       }
-      deps.hub.handleInbound(deviceId, msg);
+      if (deps.hub.isCurrentConnection(deviceId, ws, epoch)) {
+        deps.hub.handleInbound(deviceId, msg);
+      }
     });
   });
   ws.on("close", () => {
+    clearHelloDeadline();
+    releasePendingHello();
     heartbeat?.stop();
-    if (helloReceived) {
+    if (helloReceived && epoch !== void 0) {
       deps.hub.handleDisconnect(deviceId, ws);
     }
   });
@@ -3133,6 +3428,7 @@ CREATE TABLE IF NOT EXISTS meta (
 );
 CREATE TABLE IF NOT EXISTS blobs (
   blob_id      TEXT PRIMARY KEY,
+  tenant_id    TEXT NOT NULL,
   size         INTEGER NOT NULL,
   content_type TEXT NOT NULL,
   content_hash TEXT NOT NULL,
@@ -3149,6 +3445,12 @@ function toBuffer(value) {
   const view = value;
   return Buffer.from(view.buffer, view.byteOffset, view.byteLength);
 }
+function ensureTenantOwnershipColumn(db) {
+  const columns = db.prepare("PRAGMA table_info(blobs)").all();
+  if (!columns.some((column) => column.name === "tenant_id")) {
+    db.exec("ALTER TABLE blobs ADD COLUMN tenant_id TEXT");
+  }
+}
 function loadOrCreateSigningSecret(db, generateCandidate = () => randomBytes(32)) {
   const selectStmt = db.prepare("SELECT value FROM meta WHERE key = ?");
   const existing = selectStmt.get(SIGNING_SECRET_META_KEY);
@@ -3177,17 +3479,18 @@ var SqliteBlobStore = class {
     this.db = openSqliteDatabase(opts.path);
     try {
       this.db.exec(SCHEMA2);
+      ensureTenantOwnershipColumn(this.db);
       secureSqliteFilePermissions(opts.path);
       this.urlTtlMs = opts.urlTtlMs ?? DEFAULT_URL_TTL_MS2;
       this.secret = opts.signingKey ?? loadOrCreateSigningSecret(this.db);
       this.insertBlobStmt = this.db.prepare(
-        `INSERT INTO blobs (blob_id, size, content_type, content_hash, uploaded, data)
-         VALUES (?, ?, ?, ?, 0, NULL)`
+        `INSERT INTO blobs (blob_id, tenant_id, size, content_type, content_hash, uploaded, data)
+         VALUES (?, ?, ?, ?, ?, 0, NULL)`
       );
       this.selectBlobStmt = this.db.prepare(
-        "SELECT size, content_type, content_hash, uploaded, data FROM blobs WHERE blob_id = ?"
+        "SELECT tenant_id, size, content_type, content_hash, uploaded, data FROM blobs WHERE blob_id = ?"
       );
-      this.selectUploadedStmt = this.db.prepare("SELECT uploaded FROM blobs WHERE blob_id = ?");
+      this.selectUploadedStmt = this.db.prepare("SELECT tenant_id, uploaded FROM blobs WHERE blob_id = ?");
       this.writeContentStmt = this.db.prepare("UPDATE blobs SET data = ?, uploaded = 1 WHERE blob_id = ?");
     } catch (error) {
       closeSqliteDatabaseAfterInitializationFailure(
@@ -3197,26 +3500,30 @@ var SqliteBlobStore = class {
       );
     }
   }
-  async createUpload(input, requestedBlobId) {
+  async createUpload(tenantId, input, requestedBlobId) {
     const blobId = requestedBlobId ?? `blob_${randomUUID()}`;
     const existing = this.selectBlobStmt.get(blobId);
     if (existing !== void 0) {
-      if (existing.size !== input.size || existing.content_type !== input.contentType || existing.content_hash !== input.contentHash) {
+      if (existing.tenant_id !== tenantId || existing.size !== input.size || existing.content_type !== input.contentType || existing.content_hash !== input.contentHash) {
         throw new BlobDeclarationConflictError(blobId);
       }
       return { blobId, uploadUrl: this.signUrl(blobId, "put") };
     }
-    this.insertBlobStmt.run(blobId, input.size, input.contentType, input.contentHash);
+    this.insertBlobStmt.run(blobId, tenantId, input.size, input.contentType, input.contentHash);
     return { blobId, uploadUrl: this.signUrl(blobId, "put") };
   }
-  async getDownloadUrl(blobId) {
+  async getDownloadUrl(tenantId, blobId) {
     const row = this.selectUploadedStmt.get(blobId);
-    if (!row?.uploaded) return void 0;
+    if (!row?.uploaded || row.tenant_id !== tenantId) return void 0;
     return this.signUrl(blobId, "get");
   }
-  async exists(blobId) {
+  async exists(tenantId, blobId) {
     const row = this.selectUploadedStmt.get(blobId);
-    return Boolean(row?.uploaded);
+    return row?.tenant_id === tenantId && Boolean(row.uploaded);
+  }
+  async getUploadReservation(blobId) {
+    const row = this.selectBlobStmt.get(blobId);
+    return row === void 0 ? void 0 : { size: row.size };
   }
   verifySignedUrl(blobId, action, sig, exp) {
     if (!Number.isFinite(exp) || Date.now() > exp) return false;
@@ -3265,6 +3572,9 @@ var SqliteBlobStore = class {
 var DEFAULT_MAX_BLOB_SIZE_BYTES = 100 * 1024 * 1024;
 var DEFAULT_LONG_POLL_HOLD_MS = 5e4;
 var DEFAULT_TASK_LEASE_MS = 30 * 6e4;
+var DEFAULT_WEBSOCKET_HELLO_TIMEOUT_MS = 5e3;
+var DEFAULT_MAX_PENDING_WEBSOCKETS = 32;
+var DEFAULT_MAX_WEBSOCKET_PAYLOAD_BYTES = RESULT_DOCUMENT_MAX_BYTES + 64 * 1024;
 function createByokServer(opts) {
   const pairing = new PairingManager();
   const devices = new DeviceRegistry();
@@ -3274,6 +3584,18 @@ function createByokServer(opts) {
   const maxBlobSizeBytes = opts.maxBlobSizeBytes ?? DEFAULT_MAX_BLOB_SIZE_BYTES;
   const longPollHoldMs = opts.longPollHoldMs ?? DEFAULT_LONG_POLL_HOLD_MS;
   const taskLeaseMs = opts.taskLeaseMs ?? DEFAULT_TASK_LEASE_MS;
+  const webSocketHelloTimeoutMs = positiveSafeInteger(
+    opts.webSocketHelloTimeoutMs ?? DEFAULT_WEBSOCKET_HELLO_TIMEOUT_MS,
+    "webSocketHelloTimeoutMs"
+  );
+  const maxPendingWebSockets = positiveSafeInteger(
+    opts.maxPendingWebSockets ?? DEFAULT_MAX_PENDING_WEBSOCKETS,
+    "maxPendingWebSockets"
+  );
+  const maxWebSocketPayloadBytes = positiveSafeInteger(
+    opts.maxWebSocketPayloadBytes ?? DEFAULT_MAX_WEBSOCKET_PAYLOAD_BYTES,
+    "maxWebSocketPayloadBytes"
+  );
   const rateLimiter = new RateLimiter(opts.rateLimit);
   const taskStore = opts.taskStore ?? new InMemoryTaskStore();
   const hub = new ConnectionHub(taskStore, devices, taskLeaseMs, rateLimiter, opts.agentMessage);
@@ -3301,7 +3623,10 @@ function createByokServer(opts) {
         tokenSigner,
         hub,
         productId: opts.productId,
-        heartbeatIntervalMs: opts.heartbeatIntervalMs
+        heartbeatIntervalMs: opts.heartbeatIntervalMs,
+        helloTimeoutMs: webSocketHelloTimeoutMs,
+        maxPendingWebSockets,
+        maxPayloadBytes: maxWebSocketPayloadBytes
       });
     },
     pairing: {
@@ -3338,7 +3663,11 @@ function createByokServer(opts) {
     stats: () => hub.stats()
   };
 }
+function positiveSafeInteger(value, name) {
+  if (!Number.isSafeInteger(value) || value <= 0) throw new TypeError(`${name} must be a positive safe integer`);
+  return value;
+}
 
-export { AgentHomeProjectionCompletionError, IllegalTaskTransitionError, InMemoryTaskStore, LocalDiskBlobStore, PairingCodeInvalidError, SqliteBlobStore, SqliteTaskStore, SqliteUnavailableError, StaleApprovalError, SteerRejectedError, createByokServer, createHmacTokenSigner };
+export { AgentHomeProjectionCompletionError, IllegalTaskTransitionError, InMemoryTaskStore, LocalDiskBlobStore, PairingAttemptConflictError, PairingCodeInvalidError, SqliteBlobStore, SqliteTaskStore, SqliteUnavailableError, StaleApprovalError, SteerRejectedError, createByokServer, createHmacTokenSigner };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map