@byok-sdk/client 0.1.0

package/dist/types.d.ts

@@ -0,0 +1,178 @@
+import type { AgentEvent, PermissionPolicy, TaskOfferPayload } from '@byok-sdk/protocol';
+import type { RuntimeEnvironmentRequirements } from './daemon/environment';
+export type { RuntimeEnvironmentRequirements } from './daemon/environment';
+export interface GitWorkspaceConfig {
+    mode: 'local-checkpoints';
+}
+/**
+ * Result of probing whether a runtime is usable on this machine. `authPresent`
+ * is computed without ever reading the runtime's own credential storage (see
+ * the credential-isolation rule on {@link RuntimeAdapter}) — it only reflects
+ * whether a recognized environment variable name is set.
+ */
+export interface RuntimeDetectResult {
+    present: boolean;
+    version?: string;
+    authPresent?: boolean;
+}
+/** What a runtime adapter can do, advertised so the daemon can pick/validate adapters. */
+export interface RuntimeCapabilities {
+    steer: boolean;
+    resume: boolean;
+    /**
+     * Whether this adapter can genuinely pause a running session on
+     * `needs_approval` and resume it from an out-of-band decision — i.e.
+     * whether {@link Session.resolveApproval} really resolves rather than
+     * throwing. This is the ONLY source of truth for the wire's
+     * `RuntimeInfo.capabilities.approvalInteractive` (`daemon/
+     * create-daemon.ts`'s `toRuntimeInfoCapabilities`); the daemon no longer
+     * hardcodes a value.
+     *
+     * Required, deliberately: a new adapter (or a test fake) that forgets to
+     * declare it fails to compile rather than silently defaulting to a claim
+     * it cannot back.
+     */
+    approvalInteractive: boolean;
+    /** Subset of {@link PermissionPolicy}'s `mode` values this adapter can express without widening. */
+    permissionModes: string[];
+}
+/**
+ * M4 Phase 3: the out-of-band approval channel `TaskRunner` (`daemon/
+ * task-runner.ts`) hands to an adapter's `start()` via `TaskContext
+ * .approvalChannel`, for a runtime whose approval mechanism genuinely needs
+ * to reach back into the daemon from OUTSIDE the adapter's own process — the
+ * claude adapter's concrete case: `claude`'s `--permission-prompt-tool`
+ * resolves a pending permission entirely inside a SEPARATE MCP-server child
+ * process claude itself spawns (see `bin/byok-approval-mcp.ts`), which has
+ * no in-process handle to this task's `Session` at all and must instead call
+ * back into the SAME daemon over its control socket. `storeDir`/`productId`
+ * are exactly what that out-of-process helper needs to find and authenticate
+ * against this daemon's control socket (`daemon/control-protocol.ts`
+ * `controlEndpointPath`/`controlTokenPath`); `taskId` is how its request gets
+ * correlated back to THIS task once it arrives. `resolve()` is the
+ * daemon-side counterpart: it resolves the single most-recently-registered
+ * pending approval for this task (via `TaskRunner.requestApproval`'s own
+ * `ApprovalRegistry` entry — see `daemon/approvals.ts`), and rejects if none
+ * is currently pending, mirroring `Session.resolveApproval`'s own
+ * no-notion-of-approval-pending fail-closed contract one level up.
+ *
+ * Optional and adapter-agnostic on purpose: only an adapter whose runtime
+ * genuinely supports an out-of-band pause (claude, today) ever reads this;
+ * every other adapter (pi, codex) ignores it exactly as before this field
+ * existed.
+ */
+export interface ApprovalChannel {
+    taskId: string;
+    storeDir: string;
+    productId: string;
+    /** Default wait (ms) before the daemon force-resolves an unanswered approval request as a fail-closed rejection — see `TaskRunner.requestApproval`. */
+    timeoutMs: number;
+    /** Resolve the single currently-pending out-of-band approval for this task. Rejects if none is pending right now. */
+    resolve(approved: boolean, reason?: string): Promise<void>;
+}
+/**
+ * Per-task execution context handed to {@link RuntimeAdapter.start}. `policy`
+ * is the already fail-closed-checked *effective* policy (offer policy merged
+ * against the daemon's configured ceiling) — the adapter must obey this, not
+ * whatever the raw task offer's own `policy` field said.
+ */
+export interface TaskContext {
+    workspaceDir: string;
+    policy: PermissionPolicy;
+    env: NodeJS.ProcessEnv;
+    /** Prepared local checkpoint repository metadata; absent for legacy plain workspaces. */
+    gitWorkspace?: {
+        workspaceId: string;
+        baseline?: string;
+    };
+    /** M4 Phase 3 — see {@link ApprovalChannel}. Optional/adapter-agnostic: unset for every adapter that never requests an out-of-band approval. */
+    approvalChannel?: ApprovalChannel;
+}
+/**
+ * A running (or resumable) unit of work on a runtime. One `Session` maps to
+ * one underlying runtime process/session for the lifetime of a task.
+ */
+export interface Session {
+    /** Opaque runtime session id, reported back to the server via `task.complete.sessionRef`. */
+    sessionRef: string;
+    /** Normalized events for this session; the daemon batches these into `task.progress`. */
+    events: AsyncIterable<AgentEvent>;
+    /** Inject steering text into a running turn (mid-stream). */
+    steer(text: string): Promise<void>;
+    /** Send a new instruction on the same session after it has gone idle. */
+    followUp(task: TaskOfferPayload): Promise<void>;
+    /** Best-effort abort of the current turn (used for `task.cancel`). */
+    interrupt(): Promise<void>;
+    /** Tear down the underlying runtime process/session. Idempotent. */
+    close(): Promise<void>;
+    /**
+     * Resolve a session paused on `needs_approval` (protocol §5). The
+     * server's own state has already moved by the time this is called (§4 —
+     * `task.approve`/`task.reject` are best-effort notifications, not
+     * requests awaiting a reply): `approved: true` must make the session
+     * resume producing events (`task.progress` continuing is the proof);
+     * `approved: false` means the caller will immediately follow up with
+     * `interrupt()` + `close()` and report `task.fail` — an adapter that has
+     * no notion of `needs_approval` at all (i.e. never emits one) should
+     * throw a descriptive error here rather than silently no-op, since a
+     * caller receiving `task.approve`/`task.reject` for one of its tasks
+     * implies something upstream expected approval support that isn't there.
+     */
+    resolveApproval(approved: boolean, reason?: string): Promise<void>;
+}
+/**
+ * Uniform seam every concrete runtime (pi now; claude/codex in M2) implements.
+ *
+ * Credential-isolation rule: an adapter spawns only the runtime's official
+ * binary. It never reads, proxies, or forwards that runtime's own credential
+ * storage (OAuth tokens, API keys on disk, `~/.claude`, `~/.codex`, `~/.pi`
+ * auth state, etc). Presence checks are limited to environment variable
+ * *names* (see {@link RuntimeDetectResult.authPresent}).
+ *
+ * M5: separately, {@link RuntimeAdapter.environmentRequirements} below
+ * declares which environment variable NAMES (never values inspected here
+ * either) this adapter's runtime needs forwarded into its own spawned
+ * process — see that method's own doc comment and `daemon/environment.ts`.
+ */
+export interface RuntimeAdapter {
+    id: string;
+    detect(): Promise<RuntimeDetectResult>;
+    capabilities(): RuntimeCapabilities;
+    start(task: TaskOfferPayload, ctx: TaskContext): Promise<Session>;
+    /**
+     * M5: declares which environment variable names (exact, or `*`-suffixed
+     * prefix) this runtime's own CLI needs beyond the always-included
+     * platform baseline (`daemon/environment.ts`'s `buildRuntimeEnv`) —
+     * `task-runner.ts` builds each task's `TaskContext.env` from this instead
+     * of ever handing a spawned agent the daemon's raw `process.env` again.
+     * Optional and fail-closed by omission: an adapter that doesn't implement
+     * this gets the platform baseline ONLY, never an implicit "everything."
+     */
+    environmentRequirements?(): RuntimeEnvironmentRequirements;
+}
+/**
+ * Thrown by `RuntimeAdapter.start` when the task can never succeed on this
+ * adapter as offered — an unsupported `PermissionPolicy` (fail-closed) or an
+ * instruction shape the adapter can't handle (e.g. a blob-ref in M0) — as
+ * opposed to a transient/environmental failure (spawn error, missing
+ * credentials) that might succeed on a later retry. The daemon uses this
+ * distinction to set `task.fail`'s `retryable` flag correctly instead of
+ * treating every `start()` failure the same way.
+ */
+export declare class PolicyUnsupportedError extends Error {
+    constructor(message: string);
+}
+/**
+ * Thrown by {@link Session.steer} on an adapter whose runtime has no
+ * mid-turn steering channel at all (`capabilities().steer === false`) — a
+ * permanent property of the runtime, never a transient failure. Typed
+ * rather than a bare `Error` so the daemon can classify an inbound
+ * `task.steer` for such a runtime as non-retryable (record + ack, cursor
+ * advances) instead of stalling the cursor on it forever, without matching
+ * on message strings.
+ */
+export declare class SteerUnsupportedError extends Error {
+    /** The `RuntimeAdapter.id` that cannot steer (e.g. `claude`, `codex`). */
+    readonly runtimeId: string;
+    constructor(runtimeId: string, message: string);
+}

package/dist/util/async-queue.d.ts

@@ -0,0 +1,45 @@
+/**
+ * A minimal push/pull async queue: producers call `push`/`end`, consumers
+ * `for await` over the queue itself. Shared by the pi RPC client's event
+ * stream, the claude/codex adapters' own event streams, and test fixtures
+ * (stub sessions) so all of them get the same order-preserving semantics
+ * without duplicating it.
+ *
+ * M4 hardening: this used to be genuinely back-pressure-free — an unbounded
+ * internal `buffered` array, so a producer that outpaces its consumer (a
+ * runaway/misbehaving runtime adapter, or simply nobody ever reading
+ * `session.events`) could grow it without limit. Bounded now: `capacity`
+ * (default {@link DEFAULT_ASYNC_QUEUE_CAPACITY}) caps how many items may sit
+ * in `buffered` unconsumed. On overflow this fails fast rather than either of
+ * the two worse alternatives — silently dropping the newest/oldest event (a
+ * consumer would never know its view of the stream has a hole in it) or
+ * blocking `push()` (every producer in this codebase calls `push()`
+ * synchronously from an I/O callback; blocking there would stall reading the
+ * underlying process/socket entirely). Instead, once `capacity` is exceeded,
+ * the queue transitions into a permanent error state: every pending and
+ * future consumer `next()` call rejects with an {@link AsyncQueueOverflowError}
+ * naming the capacity, and all further `push()` calls are silently ignored
+ * (mirrors the pre-existing `ended` no-op precedent — once terminal, always
+ * terminal). The error state is checked before `ended`, so it wins even if
+ * `end()` is called afterward — a caller must learn the stream broke, not
+ * see a quiet, ordinary completion.
+ */
+export declare class AsyncQueueOverflowError extends Error {
+    readonly capacity: number;
+    constructor(capacity: number);
+}
+/** Default `capacity` (see {@link AsyncQueue}'s own doc comment) when the constructor isn't given one — generous for every producer in this codebase (adapter event streams a consumer reads turn-by-turn), while still catching a genuinely runaway/unconsumed stream instead of growing forever. */
+export declare const DEFAULT_ASYNC_QUEUE_CAPACITY = 10000;
+export declare class AsyncQueue<T> implements AsyncIterable<T> {
+    private readonly capacity;
+    private readonly buffered;
+    private readonly waiters;
+    private ended;
+    private failure;
+    constructor(capacity?: number);
+    push(item: T): void;
+    end(): void;
+    /** Transitions the queue into its permanent overflow state: rejects every currently-pending waiter and, from then on, every `next()` call (checked ahead of `ended` — see the class doc comment on why the error must win). */
+    private fail;
+    [Symbol.asyncIterator](): AsyncIterator<T>;
+}

package/dist/util/atomic-write.d.ts

@@ -0,0 +1,86 @@
+/** Options for {@link atomicWriteFile}. */
+export interface AtomicWriteOptions {
+    /**
+     * POSIX file mode (e.g. `0o600`) to apply to the written file. Applied to
+     * the temp file at creation (via `fs.open`'s own `mode` argument, which
+     * *is* honored there since the temp file is always freshly created — see
+     * point 3 below) and re-asserted with an explicit `chmod` both right
+     * after and again once more after the rename. Omit to leave the file at
+     * the platform's default create mode.
+     */
+    mode?: number;
+    /**
+     * fsync(2) the temp file's contents before renaming it onto the target,
+     * then fsync the published target and, on POSIX, its parent directory after
+     * the rename. Windows' `FlushFileBuffers` requires a writable file handle
+     * and has no directory-flush surface through Node/libuv, so that platform
+     * flushes the target through `r+` and relies on the atomic rename for the
+     * directory entry. Off by default: this is the strongest platform-native
+     * durability form needed by state whose directory entry itself is
+     * load-bearing (for example the operational-health run marker). It is not
+     * needed for the core no-torn-read guarantee, which comes from rename.
+     */
+    fsync?: boolean;
+}
+/**
+ * Write `data` to `filePath` such that:
+ *
+ * 1. **No torn reads.** A concurrent reader opening `filePath` at any point
+ *    during the write either sees the file's prior complete contents or the
+ *    new complete contents — never a truncated/partial write. A bare
+ *    `fs.writeFile` does NOT give you this: it truncates the target in
+ *    place before writing the new bytes, so a reader racing it can observe
+ *    (or fail to `JSON.parse`) a half-written file. This helper instead
+ *    writes to a private temp file in the same directory as `filePath`
+ *    (same directory is required for the rename below to be atomic — it
+ *    must stay on one filesystem) and `fs.rename`s it onto the target;
+ *    POSIX guarantees that rename-onto-an-existing-path is an atomic
+ *    directory-entry swap.
+ * 2. **No corruption on crash.** If the process dies between the write and
+ *    the rename, `filePath` is untouched — the half-written data only ever
+ *    existed at the temp path. This does not, by itself, order two
+ *    concurrent writers deterministically — the last rename to land wins,
+ *    silently, with no lost-update detection. Callers that need that on
+ *    top of atomicity (e.g. an in-memory map persisted across many
+ *    concurrent callers) still need their own serialization, the way
+ *    `session-workspace-store.ts`'s own per-instance queue does.
+ * 3. **Mode preserved across a replace.** POSIX rename replaces the target
+ *    path's directory entry wholesale — the resulting file's mode is the
+ *    temp file's mode, not whatever the previously-existing target's mode
+ *    was. Passing `{ mode }` sets that on the temp file before the rename
+ *    so callers like `DeviceStore` (0600, holds a private key) get a
+ *    guaranteed mode on every write, not just the one that first creates
+ *    the file.
+ * 4. **Works on win32 — without ever risking the live target.** POSIX
+ *    `rename(2)` atomically replaces an existing `filePath` in one step.
+ *    Windows' rename (`MoveFileEx` under libuv) can refuse to replace an
+ *    existing target — most commonly `EPERM`, and on some Node/libuv
+ *    versions `EEXIST` — when something transient (an antivirus scanner or
+ *    search indexer briefly holding a read handle open on the destination
+ *    is the usual culprit) is touching it. An earlier version of this
+ *    helper "fixed" that by `unlink`-ing the stale target and retrying the
+ *    rename once — which is exactly backwards for a helper whose whole job
+ *    is protecting `filePath` from ever being left corrupt or missing: if
+ *    the retried rename ALSO failed (the lock wasn't transient after all),
+ *    the catch block deleted the temp file too, leaving `filePath` gone
+ *    entirely — worse than the torn write this helper exists to prevent,
+ *    and fatal for a caller like `DeviceStore` (the device's JWT + private
+ *    key live at that path with no other copy). Fixed: `renameOnto` below
+ *    NEVER unlinks `targetPath`. On `EPERM`/`EEXIST` it retries the plain
+ *    rename with a few short, bounded backoff waits (the lock is normally
+ *    gone within milliseconds); if every attempt still fails, it throws
+ *    with `filePath` left completely untouched — the caller keeps the
+ *    last-good file on disk instead of losing it, at the cost of that one
+ *    write not landing. Still strictly better than the plain
+ *    `fs.writeFile` this replaces, which truncates the live file in place
+ *    unconditionally (so a crash or a racing reader can see a torn file on
+ *    every platform, every time) rather than only failing-safe on one
+ *    platform under a transient lock.
+ *
+ * The caller is responsible for ensuring the parent directory of `filePath`
+ * already exists (e.g. via `fs.mkdir(dir, { recursive: true })`) — this
+ * helper does not create it, mirroring `DeviceStore`/`CursorStore`/
+ * `SessionWorkspaceStore`, which all do that themselves with their own
+ * directory mode.
+ */
+export declare function atomicWriteFile(filePath: string, data: string | Uint8Array, options?: AtomicWriteOptions): Promise<void>;

package/dist/util/secure-dir.d.ts

@@ -0,0 +1,124 @@
+import { type Runner } from '../lifecycle/exec-runner';
+/**
+ * Pure command-construction seam (finding F7) — kept separate from the
+ * actual `icacls` invocation below so it's unit-testable on ANY host OS,
+ * not just win32 (this whole SDK is developed on darwin/linux — see
+ * `templates/service/winsw/smoke-test.mjs`'s own header comment on the
+ * identical constraint for WinSW itself).
+ *
+ * Removes inherited ACEs (`/inheritance:r`) and grants FULL CONTROL,
+ * recursively (`(OI)(CI)F` — Object Inherit, Container Inherit, Full
+ * control — so anything created under `dir` afterward inherits the SAME
+ * restriction without needing to be re-ACL'd individually) to exactly
+ * three principals:
+ *
+ * - the current user, via `os.userInfo().username` — deliberately NOT the
+ *   `%USERNAME%` environment variable a hand-typed reference command might
+ *   use: an env var can be stale, unset, or (in an unusual but real
+ *   embedding) spoofed by whatever set up this process's environment;
+ *   querying the OS directly cannot be. This one genuinely has to be a
+ *   NAME (icacls has no "current user" SID shorthand), but it's the
+ *   account's real name, not a translated built-in label.
+ * - `SYSTEM` and `Administrators` — both needed for a Windows-SERVICE
+ *   topology, where the daemon runs as `SYSTEM` (a WinSW-installed
+ *   service's default account) while an operator's interactive CLI
+ *   invocation runs as a normal user against the SAME `storeDir` — see
+ *   `control-protocol.ts`'s `controlPipeName` doc comment for the
+ *   identical service-account rationale on the pipe-naming side. Finding
+ *   R4: referenced by their WELL-KNOWN SIDs ({@link SYSTEM_SID} /
+ *   {@link ADMINISTRATORS_SID}), not the display names `SYSTEM`/
+ *   `Administrators` — those two names are LOCALIZED (e.g. a
+ *   French-language Windows renders the Administrators group as
+ *   "Administrateurs"), so `icacls ... /grant Administrators:...` would
+ *   silently fail to resolve (and thus fail the whole hardening step) on
+ *   any non-English install. The SIDs themselves are invariant across
+ *   every locale/edition; `icacls` accepts SID form directly when prefixed
+ *   with `*` (its own documented syntax).
+ *
+ * Returns a plain ARGV array with NO manually-embedded quote characters —
+ * this is meant for `child_process.execFile`'s array form (this codebase's
+ * own established convention for every external command it ever runs; see
+ * `lifecycle/exec-runner.ts`'s `defaultRunner`), which is never a shell and
+ * so has no shell-quoting hazard for a `dir`/username containing spaces —
+ * Node's own Windows argv encoding (used internally by `execFile`/`spawn`
+ * when given an array) already quotes/escapes each element correctly
+ * regardless of embedded whitespace. Hand-rolling literal `"` characters
+ * into an array element bound for that API would risk DOUBLE-quoting
+ * instead of fixing anything — the icacls reference command sometimes
+ * quoted as `"%USERNAME%":(OI)(CI)F` is a shell/cmd.exe-level concern that
+ * simply does not apply once argv is passed as an array with no shell
+ * involved.
+ */
+export declare function buildIcaclsArgs(dir: string, username: string): string[];
+/** Restrictive ACL for one already-created file; no inheritance flags because the target cannot contain children. */
+export declare function buildIcaclsFileArgs(filePath: string, username: string): string[];
+export interface EnsureSecureDirOptions {
+    /** DI for tests — see `lifecycle/exec-runner.ts`'s identical `Runner` seam. Defaults to `defaultRunner` (real `execFile`, never a shell). */
+    run?: Runner;
+    /** DI for tests — lets the win32 branch below be exercised (with a fake `run`) from any host OS, mirroring `control-protocol.ts`'s `controlEndpointPath` platform-override convention. Defaults to `process.platform`. */
+    platform?: NodeJS.Platform;
+}
+/**
+ * Finding R4 (cross-model re-review — F7 residual): thrown by
+ * {@link ensureSecureDir} on win32 when `icacls` either could not be run at
+ * all (e.g. missing binary, or a restricted service account lacking
+ * permission to spawn it) or ran and exited non-zero (e.g. it couldn't
+ * resolve a principal, or was itself denied). This directory's contents —
+ * `device.json` (an Ed25519 private key + access token) or `control.token`
+ * (the control socket's HMAC secret) — would otherwise be protected by
+ * nothing but the OS's own default ACL, typically readable by any local
+ * user; see `docs/security.md`'s own note on why this is now fail-closed
+ * rather than a logged-and-ignored warning. See {@link ensureSecureDir}'s
+ * own doc comment for how each caller (`DeviceStore.save`,
+ * `control-server.ts`'s `startControlServer`) reacts to this.
+ */
+export declare class SecureDirHardeningError extends Error {
+    readonly dir: string;
+    constructor(dir: string, reason: string);
+}
+export declare class SecureFileHardeningError extends Error {
+    readonly filePath: string;
+    constructor(filePath: string, reason: string);
+}
+/**
+ * Creates (if needed) and secures `dir`: POSIX `{mode: 0o700}` plus a
+ * best-effort `chmod` re-assertion on every platform (unchanged from
+ * before this fix — this is what actually restricts access on
+ * darwin/linux), PLUS — win32 only — a restrictive DACL via `icacls` (see
+ * `buildIcaclsArgs`'s own doc comment for exactly what it grants/removes).
+ *
+ * Finding R4 (cross-model re-review): the win32 `icacls` step is now
+ * FAIL-CLOSED — it used to be best-effort (logged via `console.warn`,
+ * never thrown), which meant a host where `icacls` genuinely can't run
+ * (missing binary, a locked-down service account) would silently create
+ * `storeDir` with NO Windows-side ACL protection at all and carry on as if
+ * nothing were wrong. Now it THROWS {@link SecureDirHardeningError}
+ * instead, on both failure shapes (the spawn itself failing, or `icacls`
+ * running and exiting non-zero). Each real caller already has (or gets,
+ * via this fix) an appropriate reaction:
+ *
+ * - `control-server.ts`'s `startControlServer` calls this as the very
+ *   FIRST thing, before any socket/pipe exists — a thrown error here
+ *   propagates out of `startControlServer` with nothing to clean up (no
+ *   F9-style orphan-listener risk), straight into `create-daemon.ts`'s
+ *   `start()`'s EXISTING "any non-`AnotherControlServerRunningError` bind
+ *   failure degrades non-fatally" catch block: logs a loud
+ *   `console.warn` naming the reason (this error's own message) and
+ *   continues the rest of the daemon WITHOUT a control socket — the
+ *   correct "graceful path" for a control-IPC-layer failure, unchanged
+ *   code, already exactly right once this function starts throwing.
+ * - `DeviceStore.save()` calls this before ever writing `device.json` —
+ *   a thrown error here propagates directly out of `AuthManager.pair()`
+ *   (called during `pair()`, before any credential is persisted) as a
+ *   clear, typed, actionable rejection — pairing simply fails rather than
+ *   silently leaving an unprotected device keypair/access token on disk.
+ *
+ * Non-win32 (darwin/linux) behavior is completely unchanged — the POSIX
+ * `mkdir`/`chmod` calls above are the only enforcement there, and never
+ * throw on their own best-effort `chmod` failure (that one stays
+ * genuinely benign — an `EPERM` against a directory this process doesn't
+ * own — see the inline comment on it).
+ */
+export declare function ensureSecureDir(dir: string, opts?: EnsureSecureDirOptions): Promise<void>;
+/** Re-asserts 0600 on POSIX and a non-inherited owner/SYSTEM/Admin DACL on Windows. */
+export declare function ensureSecureFile(filePath: string, opts?: EnsureSecureDirOptions): Promise<void>;

package/package.json

@@ -0,0 +1,66 @@
+{
+  "name": "@byok-sdk/client",
+  "version": "0.1.0",
+  "description": "BYOK SDK client daemon: runs on the end user's machine, pairs with a SaaS server, and drives a local coding-agent runtime",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ancienttwo/byok-sdk.git",
+    "directory": "packages/client"
+  },
+  "bugs": {
+    "url": "https://github.com/Ancienttwo/byok-sdk/issues"
+  },
+  "homepage": "https://github.com/Ancienttwo/byok-sdk#readme",
+  "engines": {
+    "node": ">=20"
+  },
+  "sideEffects": false,
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "byok-agent": "./dist/bin/byok-agent.js",
+    "byok-approval-mcp": "./dist/bin/byok-approval-mcp.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "ws": "^8.21.1",
+    "@byok-sdk/core": "0.1.0",
+    "@byok-sdk/protocol": "0.1.0"
+  },
+  "optionalDependencies": {
+    "@earendil-works/pi-coding-agent": "^0.74.2"
+  },
+  "devDependencies": {
+    "@types/ws": "^8.18.1",
+    "@hono/node-server": "^2.0.10",
+    "@byok-sdk/server": "0.1.0"
+  },
+  "scripts": {
+    "build": "tsup && tsc -p tsconfig.build.json",
+    "dev": "tsup --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "typecheck": "tsc --noEmit",
+    "smoke:adapters": "node scripts/adapter-task-smoke.mjs",
+    "audit:adapter-task-smoke": "node scripts/adapter-task-smoke.mjs",
+    "audit:credentials": "node scripts/linux-credential-audit.mjs",
+    "clean": "rm -rf dist"
+  }
+}