@byok-sdk/client 0.2.0 → 0.4.0

package/dist/daemon/control-protocol.d.ts

@@ -27,12 +27,20 @@ export declare const HANDSHAKE_TIMEOUT_MS = 3000;
  * time this matters — see `control-server.ts`'s `startControlServer`);
  * falls back, whenever the natural path would risk exceeding {@link
  * UNIX_SOCKET_PATH_SOFT_LIMIT}, to a short, deterministic path nested under
- * a PER-DAEMON PRIVATE subdirectory of `os.tmpdir()` — derived from a hash
- * of `storeDir` alone, so both the daemon and any CLI invocation pointed at
- * the same `storeDir` independently compute the identical fallback path.
+ * a PER-DAEMON PRIVATE subdirectory of {@link CONTROL_SOCKET_FALLBACK_ROOT}
+ * — derived from a hash of `storeDir` alone, so both the daemon and any CLI
+ * invocation pointed at the same `storeDir` independently compute the
+ * identical fallback path.
+ *
+ * That root was `os.tmpdir()` until it was proven to break both halves of
+ * that sentence: it reads `TMPDIR`, so the daemon (under a service manager)
+ * and the CLI (in an operator shell) derived DIFFERENT addresses for one
+ * store, and under a `TMPDIR` nested in the same long tree the fallback came
+ * out LONGER than the path it escaped — `bind()` `EINVAL`, and the daemon
+ * ran on with no control socket at all.
  *
  * Nested one level deep (rather than a bare `<hash>.sock` file directly in
- * the shared, world-traversable `os.tmpdir()`) specifically so
+ * that shared, world-traversable root) specifically so
  * `control-server.ts`'s `bindControlEndpoint` can create+chmod that
  * subdirectory 0700 BEFORE ever binding inside it — the directory's own
  * mode gates traversal into it regardless of the socket file's own
@@ -292,6 +300,75 @@ export interface ApprovalsRequestResult {
     approved: boolean;
     reason?: string;
 }
+/**
+ * Params for `assertion.issue`: a sibling local process (the host's own CLI,
+ * installed alongside this daemon) asking the daemon to mint one short-lived,
+ * audience-scoped device assertion with the paired device key. See
+ * `@byok-sdk/core`'s `device-assertion.ts` for the envelope, and
+ * `create-daemon.ts`'s handler for the six fail-closed gates every call passes
+ * through in a fixed order.
+ *
+ * One field, and nothing else. In particular there is deliberately no caller
+ * identity, no requested TTL, and no requested claim set: every process running
+ * as this UID can reach the control socket, so anything a caller "tells" the
+ * daemon about itself is decoration, and a caller-chosen lifetime is just the
+ * TTL ceiling handed to whoever asks.
+ */
+export interface AssertionIssueParams {
+    audience: string;
+}
+/**
+ * Bound on the `audience` a caller may send, in UTF-8 bytes — mirrors
+ * `@byok-sdk/core`'s `DEVICE_ASSERTION_AUDIENCE_MAX_BYTES`. Restated here rather
+ * than imported so the WIRE bound is checked before anything reaches the claim
+ * schema: this is the frame-level shape gate, and it must reject an oversized
+ * value without that value ever reaching a signer or an audit line.
+ */
+export declare const ASSERTION_AUDIENCE_MAX_BYTES = 256;
+/**
+ * Strict shape check. `undefined` means `bad_request` — a distinct gate from
+ * `audience_denied` (see `create-daemon.ts`): "you sent something that is not a
+ * request" and "you asked for an audience you may not have" are different
+ * facts, and collapsing them would let a caller probe the allowlist by
+ * malforming requests.
+ *
+ * Rejects an unknown key outright rather than ignoring it. A tolerated extra
+ * field is how a future caller comes to believe it can influence the claim set.
+ */
+export declare function parseAssertionIssueParams(value: unknown): AssertionIssueParams | undefined;
+/**
+ * Result of `assertion.issue`. `assertion` is the full signing envelope
+ * (`DeviceAssertionEnvelopeV1`), carried as an opaque JSON value on this wire —
+ * the caller hands it to the host's cloud, which parses and verifies it with
+ * core's own `verifyDeviceAssertion`. `expiresAt` is repeated outside the
+ * envelope purely so a caller can schedule a refresh without parsing claims it
+ * has no business interpreting.
+ */
+export interface AssertionIssueResult {
+    assertion: unknown;
+    expiresAt: string;
+}
+/**
+ * The six `ControlError` codes `assertion.issue` can answer with, in the exact
+ * order the handler checks them (`create-daemon.ts`). Each one is a distinct
+ * refusal with a distinct cause; none of them ever signs anything.
+ *
+ * - `assertion_disabled` — this daemon has no `deviceAssertion` config, or an
+ *   empty audience allowlist. The feature is OFF by default.
+ * - `bad_request` — params were not `{audience: string}` within the byte bound.
+ * - `audience_denied` — the audience is not in the configured allowlist. The
+ *   message never echoes the allowlist: a refusal must not be an enumeration
+ *   oracle.
+ * - `shutting_down` — a shutdown has been requested. Closes the window between
+ *   the shutdown RPC being acknowledged and the control socket actually
+ *   closing, during which a device that is being unpaired could otherwise still
+ *   mint credentials.
+ * - `revoked` — the server has revoked this device.
+ * - `not_paired` — there is no device record on disk (never paired, or already
+ *   cleared).
+ */
+export declare const ASSERTION_ISSUE_ERROR_CODES: readonly ['assertion_disabled', 'bad_request', 'audience_denied', 'shutting_down', 'revoked', 'not_paired'];
+export type AssertionIssueErrorCode = (typeof ASSERTION_ISSUE_ERROR_CODES)[number];
 export type ShutdownReason = 'unpair' | 'operator';
 export interface ShutdownParams {
     reason?: ShutdownReason;

package/dist/daemon/control-server.d.ts

@@ -38,7 +38,24 @@ export interface ControlServerOptions {
 export interface ControlServerHandle {
     /** The bound Unix socket path or Windows pipe name. */
     endpoint: string;
-    /** Stops accepting new connections, destroys every open one, and removes the socket/token files (a Windows pipe leaves no file to remove). Idempotent. */
+    /**
+     * Stops accepting new connections and destroys every open one, WITHOUT
+     * removing the socket/token files. Idempotent, and the first half of
+     * {@link close}.
+     *
+     * Split out from `close()` for `create-daemon.ts`'s shutdown sequence
+     * (plan `shutdown-lease-order`): the socket/token files ARE this daemon's
+     * only external liveness signal (`isControlDaemonGone` in
+     * `bin/control-client.ts` reads "token file gone AND a connect refused"),
+     * so a shutdown must be able to stop serving RPCs, release its
+     * store-mutation lease, and only THEN publish "gone" by removing the
+     * files. Between the two stages a connect is already refused while the
+     * token file still exists — which reads as "still running", the
+     * conservative answer, rather than as "exited while still holding the
+     * lease".
+     */
+    stopServing(): Promise<void>;
+    /** Runs {@link stopServing}, then removes the socket/token files (a Windows pipe leaves no file to remove). Idempotent. */
     close(): Promise<void>;
 }
 /**

package/dist/daemon/create-daemon.d.ts

@@ -1,6 +1,6 @@
 import type { RuntimeId } from '@byok-sdk/protocol';
 import type { PermissionPolicy } from '@byok-sdk/protocol';
-import type { RuntimeAdapter, GitWorkspaceConfig } from '../types';
+import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig } from '../types';
 import type { BackoffOptions, LivenessOptions } from './ws-transport';
 import { type OperationalHealthSnapshot } from './operational-health';
 import { type DaemonEventListener, type DaemonTaskInfo, type Unsubscribe } from './observer';
@@ -10,6 +10,7 @@ import { type DeviceRecord } from './store';
 import { type LocalTaskJournal } from './journal/journal';
 import { type JournalOpenFaultSeam } from './journal/sqlite-support';
 import { LocalStoragePressureEngine, type LocalStoragePolicyInput } from './journal/storage-policy';
+import { type ResultDocumentExtractor } from './task-runner';
 import type { ProgressBatcherOptions } from './progress-batcher';
 /**
  * Optional white-label product display info — purely opaque passthrough
@@ -104,12 +105,18 @@ export interface DaemonConfig {
      * unchanged from M1/M2.
      */
     runtimeAllowlist?: string[];
+    /**
+     * Separate-process Pi BYOK credential boundary. Required only for a
+     * `dispatchSelection` in the BYOK lane; subscription runtimes and legacy
+     * Pi tasks do not invoke it.
+     */
+    piByokLauncher?: import('../adapters/pi/pi-adapter').PiByokLauncherConfig;
     /**
      * M5 batch-3 (workstream 1): explicit auto-select priority order for
      * `TaskRunner.pickAdapter`'s no-explicit-runtime branch (`task-runner.ts`)
      * — tried in listed order; the first candidate that is both PRESENT
      * (`adapter.detect()`) and CAPABLE (declares the offer's
-     * `PermissionPolicy.mode` in its own `capabilities().permissionModes` —
+     * `PermissionPolicy.mode` in its own `descriptor.capabilities.permissionModes` —
      * see `adapterSupportsMode`) wins. Unset defaults to
      * `DEFAULT_RUNTIME_PREFERENCE` (`task-runner.ts`): `['claude', 'codex',
      * 'pi']` — pi LAST, deliberately.
@@ -169,12 +176,19 @@ export interface DaemonConfig {
      * an id with no matching adapter is simply never looked up). `allow`
      * entries are exact variable names or `*`-suffixed prefixes, merged in
      * alongside that runtime adapter's own declared
-     * `environmentRequirements()` — this can never override the hard
+     * `descriptor.environmentRequirements` — this can never override the hard
      * `BYOK_*` deny (see `environment.ts`'s own doc comment).
      */
     runtimeEnvironment?: Record<string, {
         allow?: string[];
     }>;
+    /**
+     * Device-local registry behind wire-level `requiredToolsets` ids. Only
+     * logical ids cross the SaaS wire; MCP executable definitions stay here.
+     * The first slice supports stdio servers (`command` + `args`) only and
+     * deliberately has no task-provided env/header/secret surface.
+     */
+    mcpToolsets?: Record<string, McpToolsetConfig>;
     /**
      * M5: explicit escape hatch for `url.ts`'s `assertServerUrlAllowed` — see
      * that function's own doc comment for the full allow/deny rule. Default
@@ -209,6 +223,48 @@ export interface DaemonConfig {
      * explicitly instead to opt out of enforcement altogether.
      */
     maxTaskOutputBytes?: number;
+    /**
+     * additive-minor (`task.complete.document`): the seam through which this
+     * product turns a finished task's final output text into the STRUCTURED
+     * terminal result the wire carries as `task.complete.document`, and the
+     * server projects into `TaskResult.document`.
+     *
+     * `extract(finalOutput, task)` is called exactly once per task, at the
+     * moment `task.complete` is built, with the same text that becomes
+     * `summary` (the concatenated `progress` events for that task) plus the
+     * task's `taskId`/`sessionRef`. Return `undefined` for "no structured
+     * result this time". Everything about the document's SHAPE is the
+     * product's business — the SDK never inspects, validates, or transforms
+     * it; extraction logic (prompting for JSON, parsing a fenced block,
+     * validating against the product's own schema) is product glue and belongs
+     * in this callback, not in the SDK.
+     *
+     * The SDK enforces exactly two wire rules, via the protocol's own
+     * `checkResultDocument`: the value must be JSON-serializable, and at most
+     * `RESULT_DOCUMENT_MAX_BYTES` (1 MiB) as canonical JSON. Stay under ~512
+     * KiB in practice (docs/protocol.md); a bigger result belongs in an
+     * artifact, not here.
+     *
+     * FAIL-CLOSED, never silent: if the extractor throws, returns a promise
+     * (the seam is synchronous and the runtime enforces it — an unawaited
+     * promise would be encoded as an empty document), produces something
+     * unsendable, or produces a document while the connected server never
+     * advertised the `result-document` capability (an old server would strip
+     * the field on arrival without a word), the task is reported as
+     * `task.fail` with `retryable: false` and a reason prefixed
+     * `result document undeliverable` — see
+     * `RESULT_DOCUMENT_UNDELIVERABLE_REASON_PREFIX` (`task-runner.ts`).
+     * Completing a task while quietly discarding the structured result it
+     * exists to produce is not an option this SDK offers.
+     *
+     * Omitted entirely by default, in which case the completion path is
+     * unchanged in every respect — no extractor call, no capability check, and
+     * a `task.complete` payload byte-identical to the one sent before this
+     * field existed.
+     */
+    resultDocument?: {
+        readonly extract: ResultDocumentExtractor;
+    };
     /**
      * M5 batch-3 (workstream 2): deadline bound on the graceful-shutdown
      * sequence's own wait for `TaskRunner.shutdownActiveTasks` to finish
@@ -221,6 +277,85 @@ export interface DaemonConfig {
      * existed.
      */
     shutdownGraceMs?: number;
+    /**
+     * Cadence for the `online` presence heartbeat (§12.3), when — and only when
+     * — the deployment's capability declaration contains `presence.hints` (see
+     * `capabilities-client.ts`; a deployment that declares nothing, or one this
+     * daemon could not read a declaration from, publishes nothing at all).
+     *
+     * Every field is optional and defaults to `presence-publisher.ts`'s own
+     * constants, which are chosen against the hosted defaults. `ttlMs` and
+     * `minimumIntervalMs` describe THE DEPLOYMENT's hint TTL and publication
+     * throttle as this operator understands them: the daemon never learns either
+     * from the wire, and uses them only to validate `intervalMs` sits strictly
+     * between them — a cadence outside that band is rejected synchronously here,
+     * the same way `maxTaskOutputBytes` is above, rather than degrading into a
+     * rate-limited or flickering hint nobody sees an error for.
+     */
+    presence?: PresenceConfig;
+    /**
+     * Plan `device-assertion-broker`: opt-in local assertion broker — lets a
+     * sibling process on this same machine (typically the host's own CLI,
+     * installed alongside this daemon) ask the daemon, over the already
+     * authenticated control socket, to mint a short-lived audience-scoped
+     * assertion signed with the paired device key. See
+     * {@link DeviceAssertionConfig}.
+     *
+     * OFF by default, and off is expressed two ways that mean the same thing: an
+     * absent section, or a present one with an empty `audiences` list. Both make
+     * `assertion.issue` answer `assertion_disabled` without looking at anything
+     * else. A new local authentication surface does not get to be on because
+     * someone left a config key behind.
+     */
+    deviceAssertion?: DeviceAssertionConfig;
+}
+/**
+ * Plan `device-assertion-broker`. Two fields, both about what this daemon will
+ * refuse.
+ *
+ * Every field is validated synchronously at construction, the same way
+ * `maxTaskOutputBytes` and the presence cadence are — a misconfigured
+ * authentication surface must fail when the daemon is built, not on the first
+ * call that needed it.
+ */
+export interface DeviceAssertionConfig {
+    /**
+     * The EXACT audience strings this daemon will mint for. Matched with
+     * `Set.has` — exact string equality, never a prefix or suffix or subdomain
+     * rule.
+     *
+     * Prefix matching is the classic hole here: an allowlist entry of
+     * `salesko-api` under a `startsWith` rule also admits `salesko-api.evil.com`,
+     * and a suffix rule admits `evil-salesko-api`. There is no configuration
+     * that turns this into a pattern match, because there is no pattern-matching
+     * code to configure.
+     *
+     * An empty list means the feature is off (see
+     * `DaemonConfig.deviceAssertion`). Duplicate entries, empty entries, and
+     * entries over 256 UTF-8 bytes are construction errors — a duplicate is
+     * usually a copy-paste that hid a typo'd second entry, and silently
+     * de-duplicating it would hide it for good.
+     */
+    audiences: string[];
+    /**
+     * Assertion lifetime, ms. Default
+     * `DEVICE_ASSERTION_DEFAULT_TTL_MS` (120s), hard ceiling
+     * `DEVICE_ASSERTION_MAX_TTL_MS` (300s) — both from `@byok-sdk/core`, which
+     * enforces the same ceiling again at verification time, so a daemon patched
+     * to ignore this one still cannot get a longer-lived assertion accepted.
+     *
+     * Deliberately NOT caller-selectable over the control socket: a lifetime a
+     * caller can ask for is a lifetime every caller asks the maximum of.
+     */
+    ttlMs?: number;
+}
+export interface PresenceConfig {
+    /** Heartbeat cadence. Default 30s. */
+    intervalMs?: number;
+    /** The deployment's presence hint TTL. Default 90s (core §12.7.5 suggests 60-120s). */
+    ttlMs?: number;
+    /** The deployment's minimum interval between accepted publications. Default 5s. */
+    minimumIntervalMs?: number;
 }
 export interface DaemonStatus {
     paired: boolean;
@@ -340,7 +475,40 @@ export interface DaemonOverrides {
         pressureEngine?: LocalStoragePressureEngine;
     };
 }
+/**
+ * Plan `device-assertion-broker` (codex round-2 F3): the internal, NON-public
+ * test seam for observing assertion issuance.
+ *
+ * This is NOT reachable through `DaemonConfig`/`DaemonOverrides`, and is NOT
+ * re-exported from the package `index.ts` — a test imports it straight from
+ * this module. That isolation is the point. The earlier `DaemonOverrides.
+ * deviceAssertion.mint` seam replaced the SIGNER, which meant a production
+ * embedder (`DaemonOverrides` is public API) could inject a callback that
+ * received the whole `DeviceRecord` — private key included — and exfiltrate it
+ * or forge claims.
+ *
+ * `onIssued` is a strict OBSERVER, called only AFTER a real, successful sign,
+ * with non-secret metadata ONLY (`jti`, `audience`). It cannot see the private
+ * key, cannot alter the signature, the claims, or the audit event, and cannot
+ * be reached from any public type. A test counts these calls to prove a gate
+ * rejection never reached the signer (a rejection never calls `onIssued`).
+ */
+export interface AssertionIssueProbe {
+    onIssued(meta: {
+        jti: string;
+        audience: string;
+    }): void;
+}
 export declare function createDaemonWithAdapters(config: DaemonConfig, adapters: RuntimeAdapter[], overrides?: DaemonOverrides): Daemon;
+/**
+ * codex round-2 F3: the real builder. Exported from THIS module but NOT from
+ * the package `index.ts`, so the optional `assertionProbe` (an
+ * {@link AssertionIssueProbe} post-sign observer) is reachable only by tests
+ * importing this module directly — never through any public type. The public
+ * `createDaemonWithAdapters` above forwards without it, so production has no
+ * observer and no signer-injection surface at all.
+ */
+export declare function buildDaemonWithAdapters(config: DaemonConfig, adapters: RuntimeAdapter[], overrides?: DaemonOverrides, assertionProbe?: AssertionIssueProbe): Daemon;
 /**
  * Public white-label entry point (M0-M3): the "5-line launcher" — a product
  * only needs a `DaemonConfig`, no hand-built adapter list. The bundled

package/dist/daemon/daemon-owner.d.ts

@@ -11,6 +11,43 @@ interface OwnerRecord {
 export interface DaemonOwnerLease {
     release(): Promise<void>;
 }
+/**
+ * Where this store's lock lives. Keyed by the CANONICAL storeDir alone — not
+ * by product id or OS user — because the store is the resource being
+ * serialized: a symlink alias and its target, or two products pointed at one
+ * store directory, must contend for the same endpoint (see
+ * `acquireDaemonOwner`'s own note on resolving aliases before deriving this).
+ *
+ * POSIX prefers `<storeDir>/mutex.sock`, keeping the lock beside the store
+ * state it guards in a directory `ensureSecureDir` has already made 0700. A
+ * storeDir can be long enough that no address under it fits
+ * {@link UNIX_SOCKET_PATH_SOFT_LIMIT} — a storeDir alone can exceed the whole
+ * `sun_path` budget — so the second candidate drops the storeDir from the path
+ * entirely and carries it as a hash under {@link STORE_MUTEX_FALLBACK_ROOT},
+ * nested one level deep so that directory can be created 0700 BEFORE anything
+ * binds inside it (the nesting convention is `controlSocketPath`'s).
+ *
+ * `controlSocketPath`'s fallback now binds under its own FIXED `/tmp` root
+ * (`control-protocol.ts`'s `CONTROL_SOCKET_FALLBACK_ROOT` — not
+ * `os.tmpdir()`); this mutex must not regress to `os.tmpdir()` for the same
+ * two independent reasons proven by CI job 94334133652. Correctness:
+ * `os.tmpdir()` is environment-derived, and a lock address that differs
+ * between two contending processes admits two writers. Reachability: the
+ * caller may have pointed `TMPDIR` INSIDE the very tree that made the natural
+ * path too long — there, `os.tmpdir()` yields an address LONGER than the one
+ * being escaped (152 bytes vs 126 in that job), so the "fallback" cannot bind
+ * at all. A fixed short root is immune to both.
+ *
+ * win32 has no socket file to place; a named pipe lives in one flat
+ * machine-wide namespace, so the name carries the store hash to keep two
+ * stores from colliding, and no length branch is needed.
+ *
+ * @internal Exported for the regression guard only (never re-exported from
+ * `index.ts`): the crashed-holder recovery path can only be exercised by
+ * planting a stale socket file at the exact address this derives, and a test
+ * recomputing the derivation itself would prove nothing about this one.
+ */
+export declare function storeMutexEndpoint(canonicalStoreDir: string, identity: string, platform?: NodeJS.Platform): string;
 export declare class DaemonOwnerActiveError extends Error {
     readonly role: OwnerRecord['role'] | 'unknown';
     constructor(role: OwnerRecord['role'] | 'unknown');

package/dist/daemon/device-assertion-signer.d.ts

@@ -0,0 +1,41 @@
+import { type DeviceAssertionClaims, type DeviceAssertionEnvelopeV1 } from '@byok-sdk/core';
+import type { DeviceRecord } from './store';
+/**
+ * Mints one device assertion (plan `device-assertion-broker`).
+ *
+ * This module exists so there is exactly ONE place in the client that touches
+ * the device private key for this envelope, and so "the key is never cached"
+ * is a property of a small readable file rather than a claim about a
+ * 2000-line one. Two rules it enforces structurally:
+ *
+ * 1. **No module-level key state.** There is no cache, no memo, no
+ *    module-scope variable of any kind here. The `KeyObject` is created inside
+ *    {@link mintDeviceAssertion} from the record the caller just read off disk
+ *    and becomes unreachable when the function returns — the same
+ *    read-the-store-every-time discipline `StoredDeviceProofSigner` documents,
+ *    for the same reason: clearing `device.json` must remove local signing
+ *    authority immediately, not at the next process restart.
+ * 2. **The caller supplies the record.** This function does not load the
+ *    store, check revocation, or consult an allowlist. All of that is the
+ *    daemon's fail-closed gate sequence (`create-daemon.ts`), and duplicating
+ *    any of it here would create a second, quieter authority on whether an
+ *    assertion may be minted at all.
+ */
+export interface MintDeviceAssertionInput {
+    /** The record just read from disk — never a cached one. */
+    readonly record: DeviceRecord;
+    /** The paired server's normalized origin (`url.ts`'s `toHttpBase` → `origin`). */
+    readonly issuer: string;
+    readonly productId: string;
+    /** Already checked against the configured allowlist by the caller. */
+    readonly audience: string;
+    /** Already range-checked at daemon construction time. */
+    readonly ttlMs: number;
+    readonly now: Date;
+}
+export interface MintedDeviceAssertion {
+    readonly envelope: DeviceAssertionEnvelopeV1;
+    readonly claims: DeviceAssertionClaims;
+    readonly expiresAt: string;
+}
+export declare function mintDeviceAssertion(input: MintDeviceAssertionInput): MintedDeviceAssertion;

package/dist/daemon/device-keys.d.ts

@@ -24,22 +24,24 @@ export declare function exportPrivateKeyPem(privateKey: KeyObject): string;
 export declare function importPrivateKeyPem(pem: string): KeyObject;
 /**
  * S1 (GAP-004): the domain-separation prefix this device signs along with a
- * challenge nonce, byte-identical to the server's own
- * `NONCE_SIGNING_DOMAIN` (`packages/server/src/auth.ts`). The device key is a
- * long-lived identity key that later planes will also sign structured
- * messages with; tagging the domain is what stops a signature made for one of
- * those from being replayable as a token-renewal credential.
+ * challenge nonce. The device key is a long-lived identity key that later
+ * planes will also sign structured messages with; tagging the domain is what
+ * stops a signature made for one of those from being replayable as a
+ * token-renewal credential.
  *
- * Not shared through a package: the two ends agree on a wire constant, and
- * inventing a dependency between server and client to hold one string literal
- * would couple them far harder than the literal does.
+ * The literal itself now lives in `@byok-sdk/core` (`src/pairing.ts`), which
+ * the daemon, the hosted surface, and the reference server all already depend
+ * on. It used to be three copies, each commented as byte-identical to the
+ * others — an agreement that holds only until someone edits one of them.
+ * Re-exported here so this module's public surface is unchanged.
  */
-export declare const NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
+export { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';
 /**
  * Sign a challenge nonce with the device private key: the signed message is
- * {@link NONCE_SIGNING_DOMAIN} followed by `nonce` (UTF-8), and the result is
- * the raw 64-byte Ed25519 signature, base64url-encoded (protocol §6.2). A
- * server on the domain-separated contract rejects the undomained form, so
- * there is no variant of this that omits the prefix.
+ * `NONCE_SIGNING_DOMAIN` followed by `nonce` (UTF-8) — core's
+ * {@link nonceSigningBytes} produces those bytes — and the result is the raw
+ * 64-byte Ed25519 signature, base64url-encoded (protocol §6.2). A server on the
+ * domain-separated contract rejects the undomained form, so there is no variant
+ * of this that omits the prefix.
  */
 export declare function signNonce(privateKey: KeyObject, nonce: string): string;

package/dist/daemon/environment.d.ts

@@ -2,7 +2,7 @@
  * M5: per-runtime environment allowlist for spawned agent child processes.
  *
  * Before this module existed, `task-runner.ts` built every task's
- * `TaskContext.env` as `process.env` verbatim — the daemon's OWN full
+ * `RuntimeOperationStartInput.env` as `process.env` verbatim — the daemon's OWN full
  * environment, unfiltered, handed to whichever runtime CLI (`pi`/`claude`/
  * `codex`) `pickAdapter` selected. Any credential-shaped variable sitting in
  * the daemon's own environment for a completely unrelated reason (an
@@ -20,10 +20,9 @@
  *    behave sanely in a non-interactive shell.
  * 2. Whatever ADDITIONAL names the *specific* runtime adapter about to be
  *    spawned declares it actually needs
- *    (`RuntimeAdapter.environmentRequirements()` — see `../types.ts`). An
- *    adapter that declares nothing at all (doesn't implement the optional
- *    method) gets the platform baseline ONLY — fail-closed by construction,
- *    not by an extra check here.
+ *    (`RuntimeAdapter.descriptor.environmentRequirements` — see
+ *    `../types.ts`). A descriptor that declares no names gets the platform
+ *    baseline only; descriptors are required and frozen before claim.
  * 3. A per-device, per-runtime operator override (`DaemonConfig
  *    .runtimeEnvironment` — see `create-daemon.ts`) — a local escape hatch
  *    for a product/operator that knows it needs one more variable forwarded
@@ -39,8 +38,8 @@
  */
 /**
  * What one runtime adapter declares it needs beyond the always-included
- * platform baseline. Returned from the optional
- * `RuntimeAdapter.environmentRequirements()` method (`../types.ts`).
+ * platform baseline. Declared in the required frozen
+ * `RuntimeAdapter.descriptor.environmentRequirements` (`../types.ts`).
  */
 export interface RuntimeEnvironmentRequirements {
     /**
@@ -69,8 +68,9 @@ export interface BuildRuntimeEnvOptions {
     ambient: NodeJS.ProcessEnv;
     /**
      * The selected runtime adapter's own declared requirements —
-     * `undefined` (no `environmentRequirements()` implementation on that
-     * adapter) means "platform baseline only," fail-closed.
+     * `undefined` means "platform baseline only" for this helper. The public
+     * RuntimeAdapter descriptor always supplies this object before TaskRunner
+     * invokes the helper.
      */
     requirements?: RuntimeEnvironmentRequirements;
     /**

package/dist/daemon/git-workspace.d.ts

@@ -2,6 +2,27 @@ export interface GitWorkspaceConfig {
     mode: 'local-checkpoints';
 }
 export type GitErrorCategory = 'git-unavailable' | 'git-timeout' | 'git-output-limit' | 'git-command-failed' | 'workspace-root-invalid' | 'workspace-root-conflict' | 'workspace-not-owned' | 'repository-root-mismatch' | 'repository-invalid' | 'lease-busy' | 'ledger-invalid';
+/**
+ * Runtime projection of {@link GitErrorCategory}: every union member, once,
+ * in union order — the single source of truth the CLI's stable-output
+ * validators (`bin/format.ts`, `bin/audit-log.ts`, `bin/tasks-view.ts`,
+ * `bin/commands/workspaces.ts`) project from when deciding which category
+ * strings from ledger records are stable enough to render, so those filters
+ * can never drift from the union. The `satisfies` half rejects a string
+ * that isn't a union member; the `AssertExhaustive` proof below rejects a
+ * union member missing from this list — extending either side alone is a
+ * compile error. The runtime half (no duplicates, every consumer projects
+ * exactly this list) is `__tests__/git-category-drift.test.ts`.
+ */
+export declare const GIT_ERROR_CATEGORIES: readonly ["git-unavailable", "git-timeout", "git-output-limit", "git-command-failed", "workspace-root-invalid", "workspace-root-conflict", "workspace-not-owned", "repository-root-mismatch", "repository-invalid", "lease-busy", "ledger-invalid"];
+/**
+ * Runtime projection of `GitWorkspacePhase` (the type itself lives in
+ * `git-workspace-store.ts`; the projection lives here beside
+ * {@link GIT_ERROR_CATEGORIES} so both category/phase single sources ship
+ * from one module) — same exhaustiveness contract, consumed by
+ * `bin/tasks-view.ts`'s phase filter.
+ */
+export declare const GIT_WORKSPACE_PHASES: readonly ["preparing", "active", "completed", "failed", "cancelled", "interrupted", "salvage"];
 export declare class GitWorkspaceError extends Error {
     readonly category: GitErrorCategory;
     constructor(category: GitErrorCategory, message?: string);