@byok-sdk/server 0.2.0 → 0.3.0

package/README.md

@@ -7,4 +7,20 @@ stores over the frozen v1 protocol.
 Use `@byok-sdk/cloud` plus `@byok-sdk/cloud-postgres` for the durable hosted
 composition.
 
+Toolset-aware dispatch names logical device-local MCP toolsets; it never sends
+their commands or credentials:
+
+```ts
+const task = await server.dispatch({
+  deviceId,
+  instruction: 'Find five qualified prospects and draft follow-ups.',
+  runtime: 'claude',
+  policy: { mode: 'auto' },
+  requiredToolsets: ['salesko.prospecting'],
+});
+```
+
+The self-hosted coordinator rejects this call before task creation unless the
+live device advertises `toolset-selection`.
+
 MIT licensed. Node.js 22.19.0 or newer.

package/dist/auth.d.ts

@@ -16,14 +16,19 @@ export declare const ACCESS_TOKEN_TTL_SECONDS: number;
  * another, and an attacker who can get a device to sign anything shaped like
  * a nonce holds a token-renewal credential.
  *
- * The client signs the same literal (`packages/client/src/daemon/device-keys.ts`).
+ * The literal lives in `@byok-sdk/core` (`src/pairing.ts`) and the client signs
+ * the same binding (`packages/client/src/daemon/device-keys.ts`) — it used to
+ * be three copies, each commented as byte-identical to the other two, which is
+ * an agreement that holds only until someone edits one. Re-exported here so
+ * this module's public surface is unchanged.
+ *
  * There is deliberately no dual mode: a raw, unprefixed nonce signature is
  * simply invalid here, with no flag, fallback, or grace window that would
  * make the old encoding acceptable again. Because the four packages have no
  * published compatibility contract yet, the recovery path for a device on
  * the old encoding is a re-pair, not a server-side shim.
  */
-export declare const NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
+export { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';
 /**
  * S1: server-local tenant identifier. A plain string alias for now — S2 moves
  * the branded/shared form into `@byok-sdk/core`, which does not exist yet, and
@@ -133,16 +138,23 @@ export declare class NonceStore {
 }
 /**
  * The ONLY nonce-signature check on this server (§6.2): the signed message is
- * {@link NONCE_SIGNING_DOMAIN} followed by the nonce. Applying the domain here
- * rather than at the call site is the point — there is one place that decides
- * what a device signature over a nonce means, so no route can be written that
- * accepts the undomained form.
+ * core's `nonceSigningBytes` — the domain followed by the nonce. Applying the
+ * domain here rather than at the call site is the point — there is one place
+ * that decides what a device signature over a nonce means, so no route can be
+ * written that accepts the undomained form.
  */
 export declare function verifyNonceSignature(devicePublicKey: string, nonce: string, signature: string): boolean;
 export declare function extractBearerToken(header: string | undefined): string | undefined;
 export interface AuthDeps {
     tokenSigner: TokenSigner;
     devices: DeviceRegistry;
+    /**
+     * The product THIS server instance serves (`createByokServer`'s
+     * `productId`). Part of authentication, not of routing: a device row paired
+     * into another product is not a principal here at all — see
+     * {@link authenticateBearer}.
+     */
+    productId: string;
 }
 /**
  * S1: the authenticated principal every authed surface works with. Built from
@@ -163,9 +175,19 @@ export interface AuthenticatedDevice {
  * S1 shape: the token's `(tenantId, deviceId)` are LOOKUP KEYS into the
  * registry, and the row that comes back is the authority. A token for a
  * device that no longer exists, one whose tenant does not own that device,
- * one whose product disagrees with the row, and one for a revoked device all
- * fail identically here and are indistinguishable to the caller — there is
- * deliberately no "which of those was it" signal to hand back, so no route
- * can turn a 401 into a cross-tenant existence oracle.
+ * one whose product disagrees with the row, one whose row belongs to a
+ * different product than this instance serves, and one for a revoked device
+ * all fail identically here and are indistinguishable to the caller — there
+ * is deliberately no "which of those was it" signal to hand back, so no route
+ * can turn a 401 into a cross-tenant (or cross-product) existence oracle.
+ *
+ * The last two checks are different facts and both are needed. Row vs claims
+ * says "the token belongs to this row"; row vs instance says "this row
+ * belongs to the product this server serves" — a single server can mint
+ * pairing codes for any product (`createPairingCode` takes the claims per
+ * code), so a row from another product is a real row holding a real token
+ * and is still not a principal here. `conn.hello`'s own product checks
+ * (`ws-server.ts`) validate the client's ANNOUNCEMENT, which is a third fact
+ * and stays where it is.
  */
 export declare function authenticateBearer(header: string | undefined, deps: AuthDeps): Promise<AuthenticatedDevice | undefined>;

package/dist/hub.d.ts

@@ -29,7 +29,7 @@ import type { ByokServerEvent, DispatchInput, HubStats, MachineInfo, TaskHandle,
  * handlers below no longer carry their own device-mismatch checks.
  *
  * Outbound delivery (M1, §1.2/§9): every server -> daemon envelope
- * (`conn.ack`, `task.offer/approve/reject/cancel/steer`) gets a fresh
+ * (`conn.ack`, either task offer, `task.approve/reject/cancel/steer`) gets a fresh
  * per-device monotonic `seq` and is retained in a capped ring buffer
  * ({@link OUTBOX_RING_CAPACITY} entries) so it can be redelivered — in `seq`
  * order, skipping anything whose task has since reached a terminal state —

package/dist/index.js

@@ -1,18 +1,18 @@
 import { randomBytes, randomUUID, timingSafeEqual, createHmac, createHash, createPublicKey, verify } from 'crypto';
+import { nonceSigningBytes } from '@byok-sdk/core';
 import { jwtVerify, SignJWT } from 'jose';
 import { mkdir, writeFile, readFile } from 'fs/promises';
 import { mkdtempSync, mkdirSync, existsSync, chmodSync } from 'fs';
 import { tmpdir } from 'os';
 import path, { dirname } from 'path';
+import { CAPABILITY_FLAGS, byokBlobContentPath, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, RequiredToolsetsSchema, createEnvelope, TASK_STATES, BYOK_PAIR_PATH, PairRequestSchema, BYOK_CHALLENGE_PATH, ChallengeRequestSchema, BYOK_TOKEN_PATH, TokenRequestSchema, BYOK_BLOBS_PATH, CreateBlobRequestSchema, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, MessagesSendRequestSchema, decodeEnvelope, BYOK_WS_PATH } from '@byok-sdk/protocol';
 import { Hono } from 'hono';
-import { CAPABILITY_FLAGS, canTransition, PROTOCOL_VERSION, encodeEnvelope, DAEMON_TO_SERVER_TYPES, createEnvelope, TASK_STATES, PairRequestSchema, ChallengeRequestSchema, TokenRequestSchema, CreateBlobRequestSchema, MessagesSendRequestSchema, decodeEnvelope } from '@byok-sdk/protocol';
 import { WebSocketServer } from 'ws';
 import { createRequire } from 'module';
 
 // src/auth.ts
 var ACCESS_TOKEN_TTL_SECONDS = 60 * 60;
 var NONCE_TTL_MS = 5 * 60 * 1e3;
-var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
 function createHmacTokenSigner(secret = randomBytes(32)) {
   return {
     async sign(claims, expiresInSeconds) {
@@ -143,13 +143,13 @@ function verifyEd25519Signature(devicePublicKey, message, signature) {
       key: { kty: "OKP", crv: "Ed25519", x: devicePublicKey },
       format: "jwk"
     });
-    return verify(null, Buffer.from(message, "utf8"), keyObject, Buffer.from(signature, "base64url"));
+    return verify(null, message, keyObject, Buffer.from(signature, "base64url"));
   } catch {
     return false;
   }
 }
 function verifyNonceSignature(devicePublicKey, nonce, signature) {
-  return verifyEd25519Signature(devicePublicKey, NONCE_SIGNING_DOMAIN + nonce, signature);
+  return verifyEd25519Signature(devicePublicKey, nonceSigningBytes(nonce), signature);
 }
 function extractBearerToken(header) {
   if (!header) return void 0;
@@ -164,6 +164,7 @@ async function authenticateBearer(header, deps) {
   const device = deps.devices.get(claims.tenantId, claims.deviceId);
   if (!device || device.revoked) return void 0;
   if (device.productId !== claims.productId) return void 0;
+  if (device.productId !== deps.productId) return void 0;
   return { deviceId: device.deviceId, tenantId: device.tenantId, productId: device.productId };
 }
 var BlobDeclarationConflictError = class extends Error {
@@ -247,7 +248,7 @@ var LocalDiskBlobStore = class {
   signUrl(blobId, action) {
     const exp = Date.now() + this.urlTtlMs;
     const sig = this.computeSig(blobId, action, exp);
-    return `/byok/blobs/${blobId}/content?sig=${sig}&exp=${exp}`;
+    return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;
   }
 };
 var PAIRING_CODE_ALPHABET = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789";
@@ -342,7 +343,7 @@ function buildHonoApp(deps) {
   if (deps.healthzRoute) {
     app.get("/healthz", (c) => c.json({ ok: true, uptimeMs: Date.now() - serverStartedAtMs }, 200));
   }
-  app.post("/byok/pair", async (c) => {
+  app.post(BYOK_PAIR_PATH, async (c) => {
     const parsed = PairRequestSchema.safeParse(await readJsonBody(c));
     if (!parsed.success) {
       return c.json({ error: "pairingCode, deviceName, and devicePublicKey are required strings" }, 400);
@@ -373,7 +374,7 @@ function buildHonoApp(deps) {
     const response = { deviceId, accessToken, refreshHint: expiresAt };
     return c.json(response, 200);
   });
-  app.post("/byok/challenge", async (c) => {
+  app.post(BYOK_CHALLENGE_PATH, async (c) => {
     const parsed = ChallengeRequestSchema.safeParse(await readJsonBody(c));
     if (!parsed.success) return c.json({ error: "deviceId is required" }, 400);
     const { deviceId } = parsed.data;
@@ -385,7 +386,7 @@ function buildHonoApp(deps) {
     const response = { nonce };
     return c.json(response, 200);
   });
-  app.post("/byok/token", async (c) => {
+  app.post(BYOK_TOKEN_PATH, async (c) => {
     const parsed = TokenRequestSchema.safeParse(await readJsonBody(c));
     if (!parsed.success) return c.json({ error: "deviceId, nonce, and signature are required" }, 400);
     const { deviceId, nonce, signature } = parsed.data;
@@ -408,7 +409,7 @@ function buildHonoApp(deps) {
     const response = { accessToken, expiresAt };
     return c.json(response, 200);
   });
-  app.post("/byok/blobs", async (c) => {
+  app.post(BYOK_BLOBS_PATH, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
     if (!principal) return c.json({ error: "unauthorized" }, 401);
     const parsed = CreateBlobRequestSchema.safeParse(await readJsonBody(c));
@@ -432,7 +433,7 @@ function buildHonoApp(deps) {
       throw error;
     }
   });
-  app.post("/byok/blobs/:id/finalize", async (c) => {
+  app.post(BYOK_BLOB_FINALIZE_ROUTE, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
     if (!principal) return c.json({ error: "unauthorized" }, 401);
     const reservationId = c.req.header("idempotency-key");
@@ -448,7 +449,7 @@ function buildHonoApp(deps) {
     }
     return c.body(null, 204);
   });
-  app.get("/byok/blobs/:id/url", async (c) => {
+  app.get(BYOK_BLOB_URL_ROUTE, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
     if (!principal) return c.json({ error: "unauthorized" }, 401);
     const downloadUrl = await deps.blobStore.getDownloadUrl(c.req.param("id"));
@@ -456,7 +457,7 @@ function buildHonoApp(deps) {
     const response = { downloadUrl };
     return c.json(response, 200);
   });
-  app.put("/byok/blobs/:id/content", async (c) => {
+  app.put(BYOK_BLOB_CONTENT_ROUTE, async (c) => {
     const blobId = c.req.param("id");
     const { sig, exp } = signedUrlParams(c.req.query("sig"), c.req.query("exp"));
     if (!sig || exp === void 0 || !deps.blobStore.verifySignedUrl(blobId, "put", sig, exp)) {
@@ -467,7 +468,7 @@ function buildHonoApp(deps) {
     if (!result.ok) return c.json({ error: result.reason }, 422);
     return c.body(null, 204);
   });
-  app.get("/byok/blobs/:id/content", async (c) => {
+  app.get(BYOK_BLOB_CONTENT_ROUTE, async (c) => {
     const blobId = c.req.param("id");
     const { sig, exp } = signedUrlParams(c.req.query("sig"), c.req.query("exp"));
     if (!sig || exp === void 0 || !deps.blobStore.verifySignedUrl(blobId, "get", sig, exp)) {
@@ -477,7 +478,7 @@ function buildHonoApp(deps) {
     if (!content) return c.json({ error: "blob not found" }, 404);
     return c.body(new Uint8Array(content.data), 200, { "content-type": content.contentType });
   });
-  app.get("/byok/events", async (c) => {
+  app.get(BYOK_EVENTS_PATH, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
     if (!principal) return c.json({ error: "unauthorized" }, 401);
     const cursorRaw = c.req.query("cursor");
@@ -491,7 +492,7 @@ function buildHonoApp(deps) {
     const response = result;
     return c.json(response, 200);
   });
-  app.post("/byok/messages", async (c) => {
+  app.post(BYOK_MESSAGES_PATH, async (c) => {
     const principal = await authenticateBearer(c.req.header("authorization"), deps);
     if (!principal) return c.json({ error: "unauthorized" }, 401);
     const parsed = MessagesSendRequestSchema.safeParse(await readJsonBody(c));
@@ -1274,7 +1275,17 @@ var ConnectionHub = class {
       state: "Complete",
       summary: payload.summary,
       sessionRef: payload.sessionRef,
-      artifactRefs: payload.artifactRefs
+      artifactRefs: payload.artifactRefs,
+      // additive-minor (`task.complete.document`): projected verbatim, the
+      // same way `summary`/`artifactRefs` are. Nothing to validate or
+      // measure here — the payload only got this far because
+      // `TaskCompletePayloadSchema`'s own refinement already enforced
+      // JSON-serializability and `RESULT_DOCUMENT_MAX_BYTES` at the inbound
+      // boundary, and re-checking would make this a second authority for a
+      // rule the wire already owns. Stays `undefined` for the two cases that
+      // never carry one: a daemon with no extractor configured, and a
+      // pre-`result-document` daemon build.
+      document: payload.document
     };
     this.applyOrFail(taskId, "Complete", { result, sessionRef: payload.sessionRef });
   }
@@ -1658,19 +1669,38 @@ var ConnectionHub = class {
   // dispatch() and the TaskHandle it returns
   // ---------------------------------------------------------------------
   async dispatch(input) {
+    const dispatchSelection = input.dispatchSelection === void 0 ? void 0 : DispatchSelectionSchema.parse(input.dispatchSelection);
+    const requiredToolsets = input.requiredToolsets === void 0 ? void 0 : RequiredToolsetsSchema.parse(input.requiredToolsets);
     const deviceId = input.deviceId ?? this.pickFirstConnectedDevice();
     if (!deviceId || !this.connections.get(deviceId)?.connected) {
       throw new Error(
         deviceId ? `device ${deviceId} is not connected` : "no connected device to dispatch to (M0 does not queue tasks until a device connects)"
       );
     }
+    if (dispatchSelection !== void 0 && !(this.getDeviceCapabilities(deviceId)?.includes("dispatch-selection") ?? false)) {
+      throw new Error(
+        `device ${deviceId} did not advertise dispatch-selection capability; refusing authoritative provider/model dispatch`
+      );
+    }
+    if (requiredToolsets !== void 0 && !(this.getDeviceCapabilities(deviceId)?.includes("toolset-selection") ?? false)) {
+      throw new Error(
+        `device ${deviceId} did not advertise toolset-selection capability; refusing a task whose semantics require local MCP tools`
+      );
+    }
+    if (dispatchSelection !== void 0 && input.runtime !== void 0 && input.runtime !== dispatchSelection.runtimeId) {
+      throw new Error(
+        `dispatch runtime ${input.runtime} does not match dispatchSelection.runtimeId ${dispatchSelection.runtimeId}`
+      );
+    }
     const taskId = generateTaskId();
     const policy = input.policy ?? DEFAULT_POLICY;
+    const runtime = dispatchSelection?.runtimeId ?? input.runtime;
     const record = this.taskStore.create({
       taskId,
       instruction: input.instruction,
-      runtime: input.runtime,
+      runtime,
       policy,
+      requiredToolsets,
       deviceId,
       sessionRef: input.sessionRef
     });
@@ -1682,17 +1712,23 @@ var ConnectionHub = class {
     this.runtimes.set(taskId, { queue, resolveResult, result });
     queue.push({ kind: "state", state: record.state, at: record.createdAt });
     this.serverEvents.push({ kind: "task.created", taskId, at: record.createdAt });
-    this.sendToDevice(
-      deviceId,
-      "task.offer",
-      {
-        instruction: input.instruction,
-        policy,
-        runtime: input.runtime,
-        sessionRef: input.sessionRef
-      },
-      { taskId, sessionRef: input.sessionRef }
-    );
+    const commonOffer = {
+      instruction: input.instruction,
+      policy,
+      runtime,
+      dispatchSelection,
+      sessionRef: input.sessionRef
+    };
+    if (requiredToolsets === void 0) {
+      this.sendToDevice(deviceId, "task.offer", commonOffer, { taskId, sessionRef: input.sessionRef });
+    } else {
+      this.sendToDevice(
+        deviceId,
+        "task.offer_with_toolsets",
+        { ...commonOffer, requiredToolsets },
+        { taskId, sessionRef: input.sessionRef }
+      );
+    }
     return this.buildTaskHandle(taskId);
   }
   buildTaskHandle(taskId) {
@@ -2008,6 +2044,7 @@ var InMemoryTaskStore = class {
       instruction: input.instruction,
       runtime: input.runtime,
       policy: input.policy,
+      requiredToolsets: input.requiredToolsets,
       deviceId: input.deviceId,
       sessionRef: input.sessionRef,
       createdAt: now,
@@ -2101,7 +2138,7 @@ function startHeartbeat(ws, opts = {}) {
 }
 
 // src/ws-server.ts
-var WS_PATH = "/byok/ws";
+var WS_PATH = BYOK_WS_PATH;
 var SUPPORTED_CAPABILITIES = [...CAPABILITY_FLAGS];
 function matchesWsPath(url) {
   return url.split("?")[0] === WS_PATH;
@@ -2199,6 +2236,14 @@ function handleConnection(ws, principal, deps) {
     }
   });
 }
+function closeSqliteDatabaseAfterInitializationFailure(db, initializationError, message, close = (database) => database.close()) {
+  try {
+    close(db);
+  } catch (closeError) {
+    throw new AggregateError([initializationError, closeError], message);
+  }
+  throw initializationError;
+}
 var SqliteUnavailableError = class extends Error {
   constructor(cause) {
     super(
@@ -2238,16 +2283,27 @@ function loadSqliteModule() {
 var DEFAULT_BUSY_TIMEOUT_MS = 5e3;
 var SECURE_FILE_MODE = 384;
 var SECURE_DIR_MODE = 448;
-function openSqliteDatabase(path2, options) {
+function openSqliteDatabase(path2, options, faults) {
   const { DatabaseSync } = loadSqliteModule();
   if (path2 !== ":memory:") {
     mkdirSync(dirname(path2), { recursive: true, mode: SECURE_DIR_MODE });
   }
   const db = new DatabaseSync(path2, { timeout: DEFAULT_BUSY_TIMEOUT_MS, ...options });
-  if (path2 !== ":memory:") {
-    db.exec("PRAGMA journal_mode = WAL;");
+  try {
+    faults?.onStep?.("after-open");
+    if (path2 !== ":memory:") {
+      db.exec("PRAGMA journal_mode = WAL;");
+      faults?.onStep?.("after-wal");
+    }
+    return db;
+  } catch (error) {
+    closeSqliteDatabaseAfterInitializationFailure(
+      db,
+      error,
+      "SQLite open initialization failed and its native handle could not be closed",
+      faults?.close
+    );
   }
-  return db;
 }
 function secureSqliteFilePermissions(dbPath) {
   if (dbPath === ":memory:") return;
@@ -2265,6 +2321,7 @@ CREATE TABLE IF NOT EXISTS tasks (
   state               TEXT NOT NULL,
   instruction         TEXT NOT NULL,
   runtime             TEXT,
+  required_toolsets_json TEXT,
   policy_json         TEXT NOT NULL,
   device_id           TEXT,
   session_ref         TEXT,
@@ -2279,6 +2336,7 @@ CREATE TABLE IF NOT EXISTS tasks (
 var ADDITIVE_COLUMNS = [
   { name: "pending_approval_id", ddl: "ALTER TABLE tasks ADD COLUMN pending_approval_id TEXT" },
   { name: "claimed_runtime", ddl: "ALTER TABLE tasks ADD COLUMN claimed_runtime TEXT" },
+  { name: "required_toolsets_json", ddl: "ALTER TABLE tasks ADD COLUMN required_toolsets_json TEXT" },
   // S0 (GAP-002): the claim-time `RuntimeCapabilities` snapshot, stored as
   // the JSON text of that closed, protocol-validated object (same idiom as
   // `policy_json`/`result_json` above — no column-per-flag, so a future
@@ -2311,12 +2369,14 @@ function ensureAdditiveColumns(db) {
 }
 function rowToRecord(row) {
   const resultJson = row.result_json;
+  const requiredToolsetsJson = row.required_toolsets_json;
   const claimedRuntimeCapabilitiesJson = row.claimed_runtime_capabilities_json;
   return {
     taskId: row.task_id,
     state: row.state,
     instruction: row.instruction,
     runtime: row.runtime ?? void 0,
+    requiredToolsets: requiredToolsetsJson ? JSON.parse(requiredToolsetsJson) : void 0,
     policy: JSON.parse(row.policy_json),
     deviceId: row.device_id ?? void 0,
     sessionRef: row.session_ref ?? void 0,
@@ -2335,28 +2395,37 @@ var SqliteTaskStore = class {
   selectStmt;
   selectAllStmt;
   updatePendingApprovalIdStmt;
+  closed = false;
   constructor(opts) {
     this.db = openSqliteDatabase(opts.path);
-    this.db.exec(SCHEMA);
-    ensureAdditiveColumns(this.db);
-    secureSqliteFilePermissions(opts.path);
-    this.insertStmt = this.db.prepare(
-      `INSERT INTO tasks
-         (task_id, state, instruction, runtime, policy_json, device_id, session_ref, created_at, updated_at, result_json)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    );
-    this.updateStmt = this.db.prepare(
-      `UPDATE tasks SET
-         state = ?, instruction = ?, runtime = ?, policy_json = ?, device_id = ?,
-         session_ref = ?, created_at = ?, updated_at = ?, result_json = ?, pending_approval_id = ?,
-         claimed_runtime = ?, claimed_runtime_capabilities_json = ?
-       WHERE task_id = ? AND state = ?`
-    );
-    this.selectStmt = this.db.prepare("SELECT * FROM tasks WHERE task_id = ?");
-    this.selectAllStmt = this.db.prepare("SELECT * FROM tasks ORDER BY rowid ASC");
-    this.updatePendingApprovalIdStmt = this.db.prepare(
-      "UPDATE tasks SET pending_approval_id = ?, updated_at = ? WHERE task_id = ? AND state = 'AwaitApproval'"
-    );
+    try {
+      this.db.exec(SCHEMA);
+      ensureAdditiveColumns(this.db);
+      secureSqliteFilePermissions(opts.path);
+      this.insertStmt = this.db.prepare(
+        `INSERT INTO tasks
+           (task_id, state, instruction, runtime, required_toolsets_json, policy_json, device_id, session_ref, created_at, updated_at, result_json)
+         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+      );
+      this.updateStmt = this.db.prepare(
+        `UPDATE tasks SET
+           state = ?, instruction = ?, runtime = ?, required_toolsets_json = ?, policy_json = ?, device_id = ?,
+           session_ref = ?, created_at = ?, updated_at = ?, result_json = ?, pending_approval_id = ?,
+           claimed_runtime = ?, claimed_runtime_capabilities_json = ?
+         WHERE task_id = ? AND state = ?`
+      );
+      this.selectStmt = this.db.prepare("SELECT * FROM tasks WHERE task_id = ?");
+      this.selectAllStmt = this.db.prepare("SELECT * FROM tasks ORDER BY rowid ASC");
+      this.updatePendingApprovalIdStmt = this.db.prepare(
+        "UPDATE tasks SET pending_approval_id = ?, updated_at = ? WHERE task_id = ? AND state = 'AwaitApproval'"
+      );
+    } catch (error) {
+      closeSqliteDatabaseAfterInitializationFailure(
+        this.db,
+        error,
+        "SqliteTaskStore initialization failed and its native handle could not be closed"
+      );
+    }
   }
   create(input) {
     const now = (/* @__PURE__ */ new Date()).toISOString();
@@ -2365,6 +2434,7 @@ var SqliteTaskStore = class {
       state: "Offered",
       instruction: input.instruction,
       runtime: input.runtime,
+      requiredToolsets: input.requiredToolsets,
       policy: input.policy,
       deviceId: input.deviceId,
       sessionRef: input.sessionRef,
@@ -2376,6 +2446,7 @@ var SqliteTaskStore = class {
       record.state,
       record.instruction,
       record.runtime ?? null,
+      record.requiredToolsets ? JSON.stringify(record.requiredToolsets) : null,
       JSON.stringify(record.policy),
       record.deviceId ?? null,
       record.sessionRef ?? null,
@@ -2433,6 +2504,7 @@ var SqliteTaskStore = class {
         updated.state,
         updated.instruction,
         updated.runtime ?? null,
+        updated.requiredToolsets ? JSON.stringify(updated.requiredToolsets) : null,
         JSON.stringify(updated.policy),
         updated.deviceId ?? null,
         updated.sessionRef ?? null,
@@ -2481,7 +2553,9 @@ var SqliteTaskStore = class {
    * instance against the same file, or on process shutdown.
    */
   close() {
+    if (this.closed) return;
     this.db.close();
+    this.closed = true;
   }
 };
 var SCHEMA2 = `
@@ -2530,21 +2604,30 @@ var SqliteBlobStore = class {
   selectBlobStmt;
   selectUploadedStmt;
   writeContentStmt;
+  closed = false;
   constructor(opts) {
     this.db = openSqliteDatabase(opts.path);
-    this.db.exec(SCHEMA2);
-    secureSqliteFilePermissions(opts.path);
-    this.urlTtlMs = opts.urlTtlMs ?? DEFAULT_URL_TTL_MS2;
-    this.secret = opts.signingKey ?? loadOrCreateSigningSecret(this.db);
-    this.insertBlobStmt = this.db.prepare(
-      `INSERT INTO blobs (blob_id, size, content_type, content_hash, uploaded, data)
-       VALUES (?, ?, ?, ?, 0, NULL)`
-    );
-    this.selectBlobStmt = this.db.prepare(
-      "SELECT size, content_type, content_hash, uploaded, data FROM blobs WHERE blob_id = ?"
-    );
-    this.selectUploadedStmt = this.db.prepare("SELECT uploaded FROM blobs WHERE blob_id = ?");
-    this.writeContentStmt = this.db.prepare("UPDATE blobs SET data = ?, uploaded = 1 WHERE blob_id = ?");
+    try {
+      this.db.exec(SCHEMA2);
+      secureSqliteFilePermissions(opts.path);
+      this.urlTtlMs = opts.urlTtlMs ?? DEFAULT_URL_TTL_MS2;
+      this.secret = opts.signingKey ?? loadOrCreateSigningSecret(this.db);
+      this.insertBlobStmt = this.db.prepare(
+        `INSERT INTO blobs (blob_id, size, content_type, content_hash, uploaded, data)
+         VALUES (?, ?, ?, ?, 0, NULL)`
+      );
+      this.selectBlobStmt = this.db.prepare(
+        "SELECT size, content_type, content_hash, uploaded, data FROM blobs WHERE blob_id = ?"
+      );
+      this.selectUploadedStmt = this.db.prepare("SELECT uploaded FROM blobs WHERE blob_id = ?");
+      this.writeContentStmt = this.db.prepare("UPDATE blobs SET data = ?, uploaded = 1 WHERE blob_id = ?");
+    } catch (error) {
+      closeSqliteDatabaseAfterInitializationFailure(
+        this.db,
+        error,
+        "SqliteBlobStore initialization failed and its native handle could not be closed"
+      );
+    }
   }
   async createUpload(input, requestedBlobId) {
     const blobId = requestedBlobId ?? `blob_${randomUUID()}`;
@@ -2596,7 +2679,9 @@ var SqliteBlobStore = class {
   }
   /** Close the underlying database connection — see `SqliteTaskStore.close`'s doc comment; same rationale. */
   close() {
+    if (this.closed) return;
     this.db.close();
+    this.closed = true;
   }
   computeSig(blobId, action, exp) {
     return createHmac("sha256", this.secret).update(`${blobId}:${action}:${exp}`).digest("base64url");
@@ -2604,7 +2689,7 @@ var SqliteBlobStore = class {
   signUrl(blobId, action) {
     const exp = Date.now() + this.urlTtlMs;
     const sig = this.computeSig(blobId, action, exp);
-    return `/byok/blobs/${blobId}/content?sig=${sig}&exp=${exp}`;
+    return `${byokBlobContentPath(blobId)}?sig=${sig}&exp=${exp}`;
   }
 };
 
@@ -2629,6 +2714,11 @@ function createByokServer(opts) {
     devices,
     nonces,
     tokenSigner,
+    // S1: the product this instance serves is part of `authenticateBearer`'s
+    // decision (`auth.ts`), not just of the WS hello gate — so every
+    // bearer-authed route gets the same instance-equality guarantee the WS
+    // upgrade already had transitively.
+    productId: opts.productId,
     blobStore,
     maxBlobSizeBytes,
     longPollHoldMs,