@byok-sdk/client 0.11.0 → 0.13.0

package/dist/daemon/auth-manager.d.ts

@@ -9,6 +9,15 @@ import type { DeviceCredentialStore, InMemoryDeviceCredentialStore } from './dev
 export declare class DeviceRevokedError extends Error {
     constructor(message?: string);
 }
+/**
+ * Thrown when the local AuthManager deadline or shutdown cancels its own
+ * in-flight request. This is deliberately distinct from `DeviceRevokedError`:
+ * only an actual challenge/token HTTP 401 is server authority for revocation.
+ */
+export declare class AuthRequestAbortedError extends Error {
+    readonly reason: 'deadline' | 'stopped';
+    constructor(reason: 'deadline' | 'stopped');
+}
 export interface AuthManagerOptions {
     serverUrl: string;
     store: DeviceStore;
@@ -23,6 +32,8 @@ export interface AuthManagerOptions {
      * permission to supersede this machine's prior active device rows.
      */
     machineId?: () => Promise<string | undefined>;
+    /** Upper bound for one pair/challenge/token fetch plus its response-body read. */
+    authRequestDeadlineMs?: number;
     /** Called once revocation is detected, so a caller (ConnectionManager) can stop retrying and surface the state instead of looping. */
     onRevoked?: () => void;
 }
@@ -42,7 +53,10 @@ export declare class AuthManager {
     private stopped;
     private pairing;
     private credentialMutationTail;
+    /** The sole cancellation authority for the request currently inside the serialized credential mutation. */
+    private activeRequest;
     private readonly credentials;
+    private readonly requestDeadlineMs;
     constructor(opts: AuthManagerOptions);
     get deviceId(): string | undefined;
     isRevoked(): boolean;
@@ -62,6 +76,12 @@ export declare class AuthManager {
     /** Always throws — `never` return type lets call sites use `if (x === 401) this.markRevoked();` without an explicit `return`/`throw` of their own. */
     private markRevoked;
     private scheduleProactiveRenewal;
+    /**
+     * Bounds one complete auth exchange rather than fetch alone. Keeping the
+     * controller active through `json()`/`text()` makes a non-cooperative or
+     * partial response body cancellable by the same authority that owns fetch.
+     */
+    private runRequest;
     private runCredentialMutation;
     /** Read the current paired authority afresh; metadata without its OS secret is re-pair required. */
     private loadRecord;

package/dist/daemon/blob-client.d.ts

@@ -1,9 +1,25 @@
 import type { BlobRef } from '@byok-sdk/protocol';
 import type { AuthManager } from './auth-manager';
+export type BlobRequestAbortReason = 'deadline' | 'cancelled';
+/** A blob request/body read did not complete before its deadline or its owner cancelled it. */
+export declare class BlobRequestAbortedError extends Error {
+    readonly reason: BlobRequestAbortReason;
+    constructor(reason: BlobRequestAbortReason);
+}
+export interface BlobClientOptions {
+    /** Bound for each individual HTTP request and response-body read. Default: 15 seconds. */
+    requestDeadlineMs?: number;
+    /** Daemon lifecycle authority; aborting it stops all in-flight blob I/O. */
+    signal?: AbortSignal;
+}
+export interface BlobRequestOptions {
+    /** Task lifecycle authority; aborting it stops this transfer before finalization. */
+    signal?: AbortSignal;
+}
 /** Seam `TaskRunner` depends on, so tests can substitute a fake without spinning up real HTTP endpoints. */
 export interface BlobResolver {
-    resolveInstruction(blobRef: BlobRef): Promise<string>;
-    uploadArtifact(content: string | Uint8Array, contentType: string, options?: {
+    resolveInstruction(blobRef: BlobRef, options?: BlobRequestOptions): Promise<string>;
+    uploadArtifact(content: string | Uint8Array, contentType: string, options?: BlobRequestOptions & {
         readonly idempotencyKey?: string;
     }): Promise<BlobRef>;
 }
@@ -16,11 +32,13 @@ export declare class BlobClient implements BlobResolver {
     #private;
     private readonly serverUrl;
     private readonly auth;
-    constructor(serverUrl: string, auth: AuthManager);
+    private readonly options;
+    private readonly requestDeadlineMs;
+    constructor(serverUrl: string, auth: AuthManager, options?: BlobClientOptions);
     /** `blobRef` -> `GET /byok/blobs/:id/url` -> fetch the presigned download URL -> text content. Always resolves fresh rather than trusting any inlined `BlobRef.url`, per docs/protocol.md §7. */
-    resolveInstruction(blobRef: BlobRef): Promise<string>;
-    /** `POST /byok/blobs` (declares size/contentType/contentHash) -> PUT the bytes to the presigned upload URL -> a `BlobRef` for `task.artifact.blobRef`. */
-    uploadArtifact(content: string | Uint8Array, contentType: string, options?: {
+    resolveInstruction(blobRef: BlobRef, options?: BlobRequestOptions): Promise<string>;
+    /** `POST /byok/blobs` -> PUT the bytes to the presigned URL -> finalize into a `BlobRef`. */
+    uploadArtifact(content: string | Uint8Array, contentType: string, options?: BlobRequestOptions & {
         readonly idempotencyKey?: string;
     }): Promise<BlobRef>;
 }

package/dist/daemon/connection-manager.d.ts

@@ -2,17 +2,19 @@ import { type CapabilityFlag, type Envelope, type RuntimeInfo, type ToolsetId }
 import { AuthManager } from './auth-manager';
 import type { CursorStore } from './cursor-store';
 import { type FleetJitter } from './deterministic-jitter';
-import { type BackoffOptions, type ConnectionState, type LivenessOptions } from './ws-transport';
-export type { ConnectionState } from './ws-transport';
+import { ReplayCursorTooOldError } from './replay-cursor';
+export { ReplayCursorTooOldError } from './replay-cursor';
+/** The lifecycle of the daemon's one long-poll connection. */
+export type ConnectionState = 'connecting' | 'open' | 'closed' | 'revoked';
 export interface ConnectionManagerOptions {
     serverUrl: string;
     deviceId: string;
     productId: string;
     capabilities: CapabilityFlag[];
-    /** U4a Local Agent release version; passed unchanged to both transports. */
+    /** U4a Local Agent release version, sent unchanged in `conn.hello`. */
     clientVersion?: string;
     runtimes: RuntimeInfo[];
-    /** Reads current sorted logical IDs from the validated local registry for every WS hello. */
+    /** Reads current sorted logical IDs from the validated local registry for every `conn.hello`. */
     getConfiguredToolsets?: () => readonly ToolsetId[];
     auth: AuthManager;
     cursorStore: CursorStore;
@@ -23,46 +25,35 @@ export interface ConnectionManagerOptions {
      */
     onEnvelope: (envelope: Envelope) => void | Promise<void>;
     onStateChange?: (state: ConnectionState) => void;
-    backoff?: BackoffOptions;
-    liveness?: LivenessOptions;
-    /** Consecutive never-acked WS connect failures before falling back to long-poll (protocol §8). Default 3. */
-    wsFailureThreshold?: number;
-    /** While long-polling, how often to retry establishing WS (protocol §8, "e.g. every 5 min"). Default 5 minutes. */
-    wsRetryIntervalMs?: number;
     /** Backoff between failed long-poll HTTP attempts. Default 2s. */
     longPollRetryDelayMs?: number;
     /** Minimum delay before the next long-poll request after an empty (no-events) response. Default 250ms. */
     longPollIdleDelayMs?: number;
     fleetJitter?: FleetJitter;
     onOperationalOutcome?: (outcome: 'success' | 'failure', source: 'reconnect' | 'upload') => void;
+    onTerminalError?: (error: ReplayCursorTooOldError) => void;
+}
+export interface RejectedOutboundEnvelope {
+    readonly envelope: Envelope;
+    readonly reason: 'inbound_rejected';
 }
 /**
- * Owns the daemon's one logical connection to the server, which may be
- * backed by either transport the wire protocol defines: WS (the normal
- * path) or long-poll (protocol §8's fallback for environments where an
- * outbound WSS connection isn't viable). Both funnel every received
- * envelope through the same cursor-dedupe/persistence logic (protocol §9),
- * so redelivery is safe regardless of which transport happens to deliver a
- * given envelope — including during the brief overlap window when handing
- * off between them.
+ * Owns the daemon's one authenticated long-poll connection to the server.
+ * Every received envelope passes through the same cursor-dedupe/persistence
+ * logic (protocol §9), so redelivery remains safe after an HTTP retry or a
+ * daemon restart.
  *
  * `send()` (Design B, finding N4) pushes onto a single shared outbox this
- * class owns and drains through whichever transport is currently active —
- * WS raw-sends while acked, `POST /byok/messages` while long-polling
- * (finding F6, long-poll is a full transport, not receive-only; see
- * docs/protocol.md §8) — so a transport switch mid-flight never strands a
- * queued envelope. See `drainOutbox`.
+ * class owns and drains through `POST /byok/messages`; long-poll is a full
+ * bidirectional transport, not a receive-only path. See `drainOutbox`.
  */
 export declare class ConnectionManager {
     private readonly opts;
     private readonly fleetJitter;
-    private readonly ws;
     private readonly longPoll;
-    private mode;
-    private consecutiveFailures;
-    private wsRetryTimer;
-    private wsProbeSequence;
     private uploadRetryAttempt;
+    private started;
+    private connected;
     private cursor;
     /**
      * Finding F3 (at-most-once redelivery): the lowest `task.*` envelope `seq`
@@ -84,10 +75,9 @@ export declare class ConnectionManager {
      * (see `advanceCursor`) — that semantics is unchanged. `deliveredSeq`
      * advances eagerly, the instant a `task.*` envelope is admitted past
      * dedup (see `deliver`/`noteDelivered`), independent of whether its
-     * handler has even started, let alone succeeded. It exists so a
-     * long-poll re-query (`LongPollClient`'s `getCursor`) doesn't re-pull an
-     * envelope that's already been delivered once and is still in flight —
-     * `handleOffer` is NOT idempotent and must never be re-pulled while a
+     * handler has even started, let alone succeeded. It exists so a repeated
+     * read at the durable cursor does not re-dispatch an envelope already in
+     * flight — `handleOffer` must not start a second adapter session while a
      * first attempt is still running. On WS this same field is written the
      * same way, but since a live WS connection only ever pushes a given `seq`
      * once, it never has an observable effect there beyond mirroring
@@ -98,18 +88,18 @@ export declare class ConnectionManager {
     /** Finding F3: serializes `onEnvelope` calls into a per-connection FIFO — one envelope's handler always fully settles before the next one starts. */
     private processingChain;
     /**
-     * Design B (finding N4): the ONE outbound queue both transports drain
-     * from — holds `Envelope` OBJECTS, never re-encoded/rebuilt strings, so a
+     * Design B (finding N4): the ONE outbound queue holds `Envelope` OBJECTS,
+     * never re-encoded/rebuilt strings, so a
      * resend after a failed send attempt is byte-identical to the original
      * (same `id`), which is what lets the server's per-(deviceId,id) dedup
      * (Wave 1) recognize it as a safe no-op retry rather than a second
-     * application (protocol §9). A transport switch (long-poll <-> WS) never
-     * touches this queue — see `drainOutbox` — so nothing queued while one
-     * transport was active is ever stranded when the other takes over.
+     * application (protocol §9).
      */
     private readonly outbox;
+    /** Terminally rejected outbound envelopes, retained as a bounded observable quarantine. */
+    private readonly rejectedOutboundEnvelopes;
     /**
-     * Finding F5(b): how many envelopes `drainOutbox`'s long-poll branch has
+     * Finding F5(b): how many envelopes `drainOutbox` has
      * currently spliced OUT of `this.outbox` for an in-flight (not yet
      * confirmed delivered) `postBatch` call — 0 the rest of the time. See
      * `outboxLength`'s own doc comment for why this needs to be tracked
@@ -119,6 +109,7 @@ export declare class ConnectionManager {
     private draining;
     private stopped;
     private revoked;
+    private terminalError;
     private settledWaiters;
     private pendingCursorSave;
     /**
@@ -161,33 +152,12 @@ export declare class ConnectionManager {
      */
     private cancelPendingDrainRetry;
     /**
-     * The capabilities the CURRENT transport's server advertised — untyped
-     * `string[]` for forward compatibility. WS populates it from `conn.ack`;
-     * long-poll populates it from each successful events response. Empty until
-     * the active transport supplies an advertisement.
-     *
-     * Finding R2 (cross-model re-review — was P1): strictly PER-CONNECTION,
-     * not per-daemon-lifetime. Cleared to `[]` the instant the acked WS
-     * connection ends for ANY reason — an ordinary disconnect (`onWsOutcome`'s
-     * `acked` branch), `stop()`, or a transport switch to long-poll
-     * (`enterLongPoll`) — and only repopulated by a fresh advertisement from
-     * the transport that is still current.
-     * The previous version of this doc comment claimed long-poll mode simply
-     * "stays at whatever the last real WS `conn.ack` said" — that was the bug:
-     * a daemon that once learned e.g. `approval_resolved` from an earlier WS
-     * session kept believing it applied to whatever it's connected to NOW,
-     * even after a disconnect/degrade where nothing has actually confirmed
-     * that's still true (a reconnect could land on a DIFFERENT server behind a
-     * load balancer). Concretely, `TaskRunner.sendApprovalResolved` gates
-     * `task.approval_resolved` on this list — sending it to a server that
-     * doesn't actually understand it over the long-poll path would get a
-     * batch-level 400 from `MessagesSendRequestSchema` (protocol §8.2), which
-     * `drainOutbox`'s retry-the-same-batch-forever loop then head-of-line
-     * blocks EVERY envelope queued behind it on, permanently. Clearing this
-     * eagerly means that gate reliably fails closed (falls back to the
-     * pre-existing implicit-resume inference, unconditionally — see
-     * `sendApprovalResolved`'s own doc comment) the moment the connection that
-     * advertised the capability is no longer the one actually in use.
+     * The capabilities the current server response advertised — untyped
+     * `string[]` for forward compatibility. An advertisement is scoped to the
+     * current long-poll response stream and is cleared after an HTTP failure,
+     * terminal shutdown, or revocation. This keeps capability-gated outbound
+     * messages fail-closed until the current server has explicitly advertised
+     * support.
      */
     private serverCapabilities;
     constructor(opts: ConnectionManagerOptions);
@@ -198,17 +168,10 @@ export declare class ConnectionManager {
      * `drainOutbox`.
      */
     send(envelope: Envelope): void;
+    /** Publish a fresh local configuration snapshot while this daemon is running. */
+    refreshHello(): void;
     /**
-     * Design B (finding N4): drain the shared outbox through whichever
-     * transport is currently active, re-checking `this.mode` fresh on every
-     * iteration so a transport switch mid-drain is picked up immediately
-     * rather than fighting a stale decision made before the switch.
-     *
-     * WS: a synchronous, one-at-a-time `sendNow` per envelope while open+
-     * acked; stops (without dropping anything — the remainder stays queued)
-     * the moment it isn't, and is re-invoked once `onAcked` fires.
-     *
-     * Long-poll: POSTs the outbox in chunks of at most
+     * POSTs the outbox through long-poll in chunks of at most
      * `MAX_MESSAGES_PER_BATCH` (finding P1) — the server hard-caps a single
      * `/byok/messages` batch there (`MessagesSendRequestSchema`, protocol
      * §8.2) and 400s the WHOLE request if it's exceeded, which — before this
@@ -220,14 +183,9 @@ export declare class ConnectionManager {
      * failure that SAME chunk is unshifted back (order-preserving, same
      * Envelope objects/ids — never rebuilt, so a retry is exactly the resend
      * Wave 1's server-side dedup expects) and retried after a short backoff,
-     * re-reading `this.mode` each time so a WS recovery that happens
-     * mid-retry is honored on the very next loop iteration instead of only
-     * after this attempt's backoff chain gives up.
-     *
      * Re-entrancy is guarded by `draining`: a call arriving while a drain is
      * already in progress just returns — the in-progress loop's own
-     * `while (this.outbox.length > 0)` check will pick up anything newly
-     * pushed (or left over after a mode switch) on its very next iteration.
+     * `while (this.outbox.length > 0)` check picks up anything newly pushed.
      */
     private drainOutbox;
     /**
@@ -237,35 +195,29 @@ export declare class ConnectionManager {
      * in-flight wait immediately instead of leaving `drainOutbox` parked here
      * for up to the rest of the delay before it next checks `this.revoked` —
      * and (b) unref'd, so the timer never keeps the Node process alive by
-     * itself while nothing else (a live long-poll GET, an open WS connection)
-     * legitimately is.
+     * itself while nothing else (such as the live long-poll GET) legitimately is.
      */
     private drainRetryDelay;
-    isTransportDegraded(): boolean;
     /**
-     * The capabilities the CURRENT transport's server advertised: from
-     * `conn.ack` on WS, or the latest successful `GET /byok/events` response
-     * on long-poll. Empty before either transport has supplied its current
-     * advertisement, and cleared across disconnect/switch boundaries.
+     * The capabilities the latest successful `GET /byok/events` response
+     * advertised. Empty before a successful response and after a failed one.
      */
     getServerCapabilities(): readonly string[];
+    getTerminalError(): ReplayCursorTooOldError | undefined;
     isConnected(): boolean;
     isRevoked(): boolean;
     /**
-     * Resolves once the connection has settled — either a working, acked WS
-     * connection, or the long-poll fallback taking over (protocol §8). This
-     * lets `daemon.start()` return promptly even when WS is unavailable from
-     * the very first attempt, rather than hanging until a WS `conn.ack` that
-     * may never come.
+     * Resolves after the first successful long-poll response establishes the
+     * authenticated connection.
      *
      * Rejects with {@link DeviceRevokedError} — instead of hanging until
      * `timeoutMs` — if the device turns out to be revoked while settling (or
      * already was): a cold `daemon.start()` against an already-revoked device
      * must fail fast, not surface a generic timeout (protocol §6.3).
      */
-    waitForAck(timeoutMs?: number): Promise<void>;
+    waitForConnection(timeoutMs?: number): Promise<void>;
     /**
-     * Stops both transports and waits for every in-flight envelope handler
+     * Stops the long-poll transport and waits for every in-flight envelope handler
      * (the F3 FIFO chain) and the most recent cursor write to actually land on
      * disk — otherwise a `stop()` racing a just-processed envelope's
      * persistence could lose that cursor advance, or leave a handler running
@@ -274,14 +226,14 @@ export declare class ConnectionManager {
      * Finding F5(b) (cross-model adversarial review): `drainTimeoutMs`, when
      * passed, bounds how long this waits for the shared outbox (`this.outbox`
      * — Design B) to actually finish draining BEFORE flipping `this.stopped`
-     * and closing the transports. Before this fix, `stop()` set `stopped`
+     * and stopping the transport. Before this fix, `stop()` set `stopped`
      * synchronously and never waited for `drainOutbox` at all: an envelope
      * `send()` had just pushed moments earlier (e.g. `TaskRunner.shutdownTask`'s
      * own `task.fail`, sent right before `create-daemon.ts`'s
      * `performControlShutdown` calls this) could still be sitting UNSENT in
      * `this.outbox` — mid long-poll retry backoff, or simply not yet picked up
      * by the fire-and-forget `drainOutbox()` `send()` kicked off — and this
-     * method would happily proceed to `stopped = true` / `ws.close()` regardless,
+     * method would happily proceed to `stopped = true` regardless,
      * after which NOTHING ever drains it again: silently lost, even though
      * `TaskRunner` believed it had been sent. `drainTimeoutMs` omitted (the
      * default) preserves the EXACT prior behavior for every other existing
@@ -312,6 +264,8 @@ export declare class ConnectionManager {
      * for the one case (a hung POST) this finding exists to catch honestly.
      */
     outboxLength(): number;
+    /** A bounded terminal quarantine for operator inspection; these entries are never retried. */
+    rejectedOutbox(): readonly RejectedOutboundEnvelope[];
     /**
      * Finding F5(b): polls {@link outboxLength} (not `this.outbox.length`
      * alone — see that method's own doc comment for why a spliced-out,
@@ -319,15 +273,14 @@ export declare class ConnectionManager {
      * a single `drainOutbox()` promise directly — a drain in progress can
      * itself loop through multiple retry/backoff cycles (`drainRetryDelay`)
      * while the server is unreachable, and a fresh, INDEPENDENT
-     * `drainOutbox()` call can also be triggered concurrently (`send()`, a
-     * mode switch's own `void this.drainOutbox()`) — polling the one thing
+     * `drainOutbox()` call can also be triggered concurrently (`send()`) —
+     * polling the one thing
      * that actually matters (is anything still undelivered) can never go
      * stale the way capturing one specific in-flight promise reference
      * could. Kicks off one more `drainOutbox()` attempt itself first
      * (harmless no-op if one is already running — see its own re-entrancy
-     * guard) in case nothing is currently actively retrying (e.g. WS just
-     * dropped and long-poll hasn't taken over yet), so this bounded wait
-     * isn't just passively hoping something else happens to be making
+     * guard) in case nothing is currently actively retrying, so this bounded
+     * wait isn't just passively hoping something else happens to be making
      * progress.
      */
     private waitForOutboxDrained;
@@ -354,9 +307,10 @@ export declare class ConnectionManager {
      */
     private deliver;
     /**
-     * Design A: the watermark `deliver()` dedupes inbound `task.*` envelopes
-     * against, and the same value `LongPollClient` queries the next
-     * `GET /byok/events` cursor with (see the constructor). Normally this is
+     * The local watermark `deliver()` dedupes inbound `task.*` envelopes
+     * against. It is deliberately NOT the long-poll query cursor: that query
+     * is the kernel acknowledgement and uses only the successfully processed
+     * `cursor` (see the constructor). Normally this local watermark is
      * `deliveredSeq` — which is always >= `cursor` (every envelope that
      * reaches `advanceCursor` already passed through `noteDelivered` first,
      * see `deliver`) — so this is the literal `max(cursor, deliveredSeq)` the
@@ -372,11 +326,9 @@ export declare class ConnectionManager {
      * whose outcome wasn't known yet. No separate "reset deliveredSeq on
      * reconnect" step is needed for this to be correct — collapsing to
      * `cursor` exactly while stalled already produces the right answer on
-     * every redelivery path (long-poll re-query AND a WS reconnect's
-     * backlog replay alike), and NOT resetting it unconditionally on every
-     * reconnect is what lets `deliveredSeq` keep doing its job of not
-     * re-pulling/re-dispatching something already in flight across a
-     * reconnect that happens to land while a handler is still running.
+     * every long-poll retry path. NOT resetting it unconditionally on every
+     * retry lets `deliveredSeq` keep doing its job of not re-dispatching
+     * something already in flight while a handler is still running.
      */
     private dedupWatermark;
     /** Design A: eagerly advance the in-memory delivery watermark — called for every `task.*` envelope `deliver()` admits past dedup, regardless of transport or of whether its handler has even started yet. */
@@ -385,9 +337,8 @@ export declare class ConnectionManager {
     /**
      * M4 Phase 4 (version-negotiation drill fix): `LongPollClient` calls this
      * for a batch entry it could not parse into a known `Envelope` at all (an
-     * unrecognized message type — mirrors `ws-transport.ts`'s identical
-     * per-frame tolerance, see `long-poll-transport.ts`'s own doc comment on
-     * `parseLooseEventsPollResponse`) but which still carried a numeric,
+     * unrecognized message type (see `long-poll-transport.ts`'s own doc
+     * comment on `parseLooseEventsPollResponse`) but which still carried a numeric,
      * task-class envelope-level `seq` (the caller only invokes this for a
      * `task.`-prefixed type — see `long-poll-transport.ts`'s own
      * `extractSkippableSeq`; `conn.*`-shaped or type-less entries never reach
@@ -427,7 +378,7 @@ export declare class ConnectionManager {
      * `noteDelivered` (the eager, in-memory watermark) stays UNCHAINED —
      * called immediately, unconditionally, regardless of `stalledAtSeq` —
      * matching `deliver()`'s own eager, unconditional call for a real
-     * envelope: its only job is "don't re-pull something already handed off,"
+     * envelope: its only job is "don't re-dispatch something already handed off,"
      * independent of outcome, and that property does not depend on FIFO
      * ordering the way the DURABLE cursor does.
      *
@@ -485,18 +436,10 @@ export declare class ConnectionManager {
      */
     private noteValidationFailure;
     private advanceCursor;
-    /**
-     * Fires the moment a connection attempt reaches `conn.ack` — independent
-     * of whether/when it later closes. This is the ONLY place that can
-     * reliably detect "WS is back up" while long-polling: a healthy
-     * connection stays open indefinitely, so it never reaches `onWsOutcome`
-     * (which is close-only) at all.
-     */
-    private onAcked;
-    private onWsOutcome;
+    private quarantineRejectedOutbound;
     private notifySettled;
-    private enterLongPoll;
-    private exitLongPoll;
-    private scheduleWsProbe;
+    private noteConnected;
+    private noteDisconnected;
+    private enterReplayCursorTooOld;
     private enterRevoked;
 }

package/dist/daemon/control-protocol.d.ts

@@ -5,6 +5,7 @@ import type { StoragePressureState } from './journal/storage-policy';
 import type { OperationalHealthSnapshot } from './operational-health';
 import type { LocalAgentReleaseIdentity } from '../release-identity';
 import type { McpToolsetConfig, McpToolsetRegistryStatus } from '../types';
+import type { AgentHomeExecutionStatus } from '../agent-home';
 /**
  * M4 Phase 2: shared local-IPC contract between the daemon's control server
  * (`control-server.ts`) and the CLI's control client (`bin/control-client.ts`)
@@ -252,7 +253,7 @@ export interface ControlStatusResult {
     uptimeMs: number;
     paired: boolean;
     deviceId?: string;
-    /** The connection state machine's own current value (`ws-transport.ts`'s `ConnectionState`) — e.g. `'open'`, `'degraded'` (long-poll fallback), `'revoked'`, `'closed'`, `'connecting'`. */
+    /** The connection state machine's current value: `'open'`, `'revoked'`, `'closed'`, or `'connecting'`. */
     transport: string;
     activeTasks: ControlActiveTask[];
     runtimeIds: string[];
@@ -276,6 +277,12 @@ export interface ControlStatusResult {
     operationalHealth: OperationalHealthSnapshot;
     /** Redacted content-addressed status from the daemon's single local registry. */
     toolsets: McpToolsetRegistryStatus;
+    /**
+     * WP0: per-canonical-Agent-home execution serialization, counts only —
+     * see {@link AgentHomeExecutionStatus}. Absent only for an older control
+     * peer that predates the cap.
+     */
+    agentHomeExecution?: AgentHomeExecutionStatus;
 }
 export interface ToolsetsReloadParams {
     expectedRevision: string;

package/dist/daemon/create-daemon.d.ts

@@ -1,10 +1,9 @@
 import type { AgentEgressPolicy, RuntimeId } from '@byok-sdk/protocol';
 import type { PermissionPolicy } from '@byok-sdk/protocol';
 import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
-import { type AgentHomeProjection } from '../agent-home';
+import { type AgentHomeExecutionStatus, type AgentHomeProjection } from '../agent-home';
 import type { AgentRef } from '../agent-home';
 import { type LocalAgentReleaseIdentity } from '../release-identity';
-import type { BackoffOptions, LivenessOptions } from './ws-transport';
 import { type OperationalHealthSnapshot } from './operational-health';
 import { type DaemonEventListener, type DaemonTaskInfo, type Unsubscribe } from './observer';
 import { GitWorkspaceManager } from './git-workspace';
@@ -91,6 +90,8 @@ export interface DaemonConfig {
     productName: string;
     productId: string;
     serverUrl: string;
+    /** Bounds one AuthManager pair/challenge/token exchange, including response-body reads. */
+    authRequestDeadlineMs?: number;
     deviceName?: string;
     /**
      * Optional override for the client-hashed physical machine identity sent
@@ -130,6 +131,26 @@ export interface DaemonConfig {
      * after the SDK-owned Agent home has passed construction-time preflight.
      */
     strictAgentOnly?: boolean;
+    /**
+     * WP0: how many Attempts this daemon lets execute CONCURRENTLY in one
+     * canonical Agent home, across every lane and every session. Default
+     * {@link DEFAULT_MAX_CONCURRENT_MUTABLE_SESSIONS_PER_AGENT_HOME} (1).
+     *
+     * The canonical home is every Agent session's cwd, so each concurrent
+     * Attempt in it is another writer of the same `MEMORY.md`, `notes/` and
+     * `.git`. At the default, a second offer for a home that already has an
+     * active Attempt is declined retryably before adapter preparation, the
+     * claim, or any process side effect — the busy-home contract downstream
+     * hosts already depend on.
+     *
+     * Raising it above 1 is an explicit host choice that re-enables the
+     * 0.12.0 concurrent-session behaviour, including its co-writing exposure;
+     * the SDK never falls back to it on its own. Validated up front, the same
+     * way `maxTaskOutputBytes` is: a positive safe integer, so `0`, a negative
+     * number, `NaN` and a non-integer are construction errors rather than a
+     * silently reinterpreted "unlimited".
+     */
+    maxConcurrentMutableSessionsPerAgentHome?: number;
     /**
      * Explicit Agent-local/cloud egress selection. Omission still enforces the
      * SDK metadata/status projection, but does not advertise or admit the new
@@ -255,7 +276,7 @@ export interface DaemonConfig {
     /**
      * M5: explicit escape hatch for `url.ts`'s `assertServerUrlAllowed` — see
      * that function's own doc comment for the full allow/deny rule. Default
-     * (unset/`false`): a `serverUrl` using plaintext `ws:`/`http:` is only
+     * (unset/`false`): a `serverUrl` using plaintext `http:` is only
      * accepted when its host is loopback (`localhost`/`*.localhost`,
      * `127.0.0.0/8`, `::1`); anything else over plaintext throws a typed
      * `InsecureServerUrlError` from `pair()`/`start()` below, BEFORE any
@@ -266,7 +287,7 @@ export interface DaemonConfig {
      * server) — doing so also logs a loud `console.warn` (see
      * `checkServerUrl`, this file) every time it actually changes the
      * outcome. Never overrides an unsupported scheme (anything other than
-     * `http:`/`https:`/`ws:`/`wss:`), which is refused unconditionally.
+     * `http:`/`https:`), which is refused unconditionally.
      */
     dangerouslyAllowInsecureRemote?: boolean;
     /**
@@ -473,8 +494,6 @@ export interface DaemonStatus {
     localAgentRelease: Readonly<LocalAgentReleaseIdentity>;
     paired: boolean;
     connected: boolean;
-    /** True once the connection has fallen back to long-poll (protocol §8) — transport info only (finding F6): long-poll is a full transport, so work still proceeds normally while this holds; outbound envelopes POST to /byok/messages instead of going out over WS. */
-    degraded: boolean;
     /** True once the server has revoked this device (401 on challenge/token, protocol §6.3). The only recourse is calling `pair()` again — the daemon does not keep retrying on its own. */
     revoked: boolean;
     deviceId?: string;
@@ -487,6 +506,8 @@ export interface DaemonStatus {
     toolsets: McpToolsetRegistryStatus;
     /** Content-free egress lane watermarks and typed last-drop facts. */
     egress: AgentEgressStatus;
+    /** WP0: per-canonical-Agent-home execution serialization — see {@link AgentHomeExecutionStatus}. */
+    agentHomeExecution: AgentHomeExecutionStatus;
 }
 export interface Daemon {
     /** Pairing result is intentionally credential-blind. */
@@ -536,10 +557,8 @@ export interface Daemon {
     /** M3-2a: same as {@link approve} but rejects — see that method's doc comment. */
     reject(taskId: string, reason?: string): Promise<void>;
 }
-/** Internal seam so tests can substitute stub adapters / faster backoff+batch+liveness+long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
+/** Internal seam so tests can substitute stub adapters / faster batch and long-poll timing. `createDaemonWithAdapters` (which takes this) is also the real entry point for products supplying a hand-built adapter set `createDaemon` can't construct on its own — e.g. custom adapter options, or an adapter that REPLACES a bundled runtime's implementation under the same id. Honest limit: an adapter id outside `pi`/`claude`/`codex` cannot pass wire validation today — `RuntimeIdSchema` (`@byok-sdk/protocol`) is a closed `z.enum(['pi', 'claude', 'codex'])`, and `isRuntimeId` filtering below (see `detectRuntimes`) drops any detected adapter outside that set before it ever reaches a wire-visible field. A genuinely fourth/namespaced runtime id is a future protocol change, not something this seam enables today. */
 export interface DaemonOverrides {
-    backoff?: BackoffOptions;
-    liveness?: LivenessOptions;
     /** M4 Phase 3: overrides `TaskRunner`'s default out-of-band approval wait (`DEFAULT_APPROVAL_TIMEOUT_MS`, 10 minutes) before an unanswered `requestApproval` force-resolves as a fail-closed rejection. */
     approvalTimeoutMs?: number;
     /** Finding F5: overrides for the control-socket shutdown path's own bounded waits — see `TaskRunner.shutdownTask`'s and `ConnectionManager.stop`'s own doc comments. Both default to 5s; neither affects an ordinary (non-shutdown-RPC) `daemon.stop()` call. */
@@ -550,10 +569,6 @@ export interface DaemonOverrides {
         outboxDrainTimeoutMs?: number;
     };
     longPoll?: {
-        /** Consecutive never-acked WS connect failures before falling back to long-poll. Default 3. */
-        wsFailureThreshold?: number;
-        /** While long-polling, how often to retry establishing WS. Default 5 minutes. */
-        wsRetryIntervalMs?: number;
         /** Backoff between failed long-poll HTTP attempts. Default 2s. */
         retryDelayMs?: number;
         /** Minimum delay before the next long-poll request after an empty (no-events) response — avoids busy-looping against a server that responds instantly. Default 250ms. */

package/dist/daemon/device-credential-store.d.ts

@@ -16,6 +16,18 @@ export interface DeviceMetadata {
  * from one pairing response with metadata from another.
  */
 export type DeviceRecord = DeviceMetadata & DeviceCredentials;
+/**
+ * The one durable authority allowed before a first pairing response is
+ * received. It keeps the generated key immutable across a lost response, so
+ * an exact server-side retry can prove the same public-key binding.
+ */
+export interface FirstPairingAttempt {
+    readonly kind: 'first-pairing-attempt-v1';
+    readonly deviceName: string;
+    readonly devicePublicKey: string;
+    readonly devicePrivateKeyPem: string;
+    readonly machineId?: string;
+}
 export interface DeviceCommandResult {
     readonly exitCode: number;
     readonly stdout: string;
@@ -44,6 +56,8 @@ export declare class DeviceCredentialStore {
     #private;
     constructor(options: DeviceCredentialStoreOptions);
     read(): Promise<DeviceRecord | undefined>;
+    readFirstPairingAttempt(): Promise<FirstPairingAttempt | undefined>;
+    saveFirstPairingAttempt(attempt: FirstPairingAttempt): Promise<void>;
     replace(record: DeviceRecord): Promise<void>;
     /** Returns true only after the sole secret authority is confirmed absent. */
     clear(): Promise<boolean>;
@@ -52,6 +66,8 @@ export declare class DeviceCredentialStore {
 export declare class InMemoryDeviceCredentialStore {
     #private;
     read(): Promise<DeviceRecord | undefined>;
+    readFirstPairingAttempt(): Promise<FirstPairingAttempt | undefined>;
+    saveFirstPairingAttempt(attempt: FirstPairingAttempt): Promise<void>;
     replace(record: DeviceRecord): Promise<void>;
     clear(): Promise<boolean>;
 }