@byok-sdk/client 0.6.0 → 0.7.0

package/dist/daemon/agent-egress-controller.d.ts

@@ -0,0 +1,79 @@
+import type { AgentEvent } from '@byok-sdk/protocol';
+import type { AgentRef } from '../agent-home';
+import { type AgentEgressDropReason, type AgentEgressDropReceipt, type AgentEgressPolicy, type AgentEgressStatus } from './agent-egress-policy';
+import { type AgentReliableAck, type AgentContentReceiptWithoutReliableIdentity, type AgentReliableEgressRecord } from './agent-egress-spool';
+import { type AgentEgressSanitizer } from './agent-egress-sanitizer';
+export interface AgentEgressControllerOptions {
+    readonly policy: Readonly<AgentEgressPolicy>;
+    /** Authenticated tenant identity, never accepted from an egress event. */
+    readonly tenantId?: string;
+    readonly sanitizer?: AgentEgressSanitizer;
+}
+export interface AgentEgressProgressInput {
+    readonly agentRef?: AgentRef;
+    readonly taskId: string;
+    readonly events: readonly AgentEvent[];
+    readonly serverCapabilities: readonly string[];
+}
+export interface AgentEgressReliableInput {
+    readonly homeDir: string;
+    readonly agentRef: AgentRef;
+    readonly payload: unknown;
+    readonly sessionRef: string;
+    readonly taskId?: string;
+    readonly eventId?: string;
+}
+export interface AgentEgressContentReceiptInput {
+    readonly homeDir: string;
+    readonly agentRef: AgentRef;
+    /** The content-free payload before the spool supplies stable event/cursor identity. */
+    readonly payload: AgentContentReceiptWithoutReliableIdentity;
+    readonly taskId?: string;
+}
+export type AgentEgressReliableAppendResult = Readonly<{
+    ok: true;
+    record: AgentReliableEgressRecord;
+}> | Readonly<{
+    ok: false;
+    reason: AgentEgressDropReason;
+}>;
+/**
+ * The one daemon-owned policy consumer. Reliable and latest-value retain
+ * distinct types and stores; retries are sends, and only exact acknowledgments
+ * retire durable records.
+ */
+export declare class AgentEgressController {
+    private readonly options;
+    private readonly latest;
+    private readonly spools;
+    private readonly latestStatus;
+    private readonly reliableStatus;
+    private readonly drops;
+    private active;
+    constructor(options: AgentEgressControllerOptions);
+    get policy(): Readonly<AgentEgressPolicy>;
+    /** Permanently fail closed after its authenticated enrollment is replaced. */
+    deactivate(): void;
+    status(): AgentEgressStatus;
+    dropReceipts(): readonly AgentEgressDropReceipt[];
+    noteTransportDrop(reason: AgentEgressDropReason, agentRef?: AgentRef): void;
+    /** Project before TaskRunner builds a `task.progress` envelope. */
+    projectLatestValue(input: AgentEgressProgressInput): readonly AgentEvent[];
+    appendReliable(input: AgentEgressReliableInput): Promise<AgentEgressReliableAppendResult>;
+    /**
+     * Content decisions are reliable facts too. They never enter the generic
+     * egress payload authority: the spool persists their exact protocol payload
+     * with `wireType: agent.content.receipt` before any transport attempt.
+     */
+    appendContentReceipt(input: AgentEgressContentReceiptInput): Promise<AgentEgressReliableAppendResult>;
+    /** Retires only the record whose full Agent/tenant/revision/id/cursor tuple matches. */
+    acknowledge(ack: AgentReliableAck): Promise<boolean>;
+    /** Re-open every existing Agent-local spool before retrying stable records after restart. */
+    recover(agentsRoot: string): Promise<void>;
+    reliableRecords(): readonly AgentReliableEgressRecord[];
+    /** Missing ack capability holds records in their reliable lane; it never makes them lossy. */
+    retryableReliableRecords(serverCapabilities: readonly string[]): readonly AgentReliableEgressRecord[];
+    private spoolFor;
+    private tenantPendingBytes;
+    private noteDrop;
+}

package/dist/daemon/agent-egress-policy.d.ts

@@ -0,0 +1,36 @@
+import { type AgentEgressDropReason, type AgentEgressPolicy, type AgentEvent } from '@byok-sdk/protocol';
+export type { AgentEgressDropReason, AgentEgressPolicy } from '@byok-sdk/protocol';
+export interface AgentEgressDropReceipt {
+    lane: 'latest-value' | 'reliable';
+    reason: AgentEgressDropReason;
+    agentId?: string;
+    tenantId?: string;
+    eventId?: string;
+    occurredAt: string;
+}
+export interface AgentEgressLaneStatus {
+    pendingEvents: number;
+    pendingBytes: number;
+    replaced: number;
+    dropped: number;
+    lastDropReason?: AgentEgressDropReason;
+}
+export interface AgentEgressStatus {
+    policyRevision: string;
+    latestValue: AgentEgressLaneStatus;
+    reliable: AgentEgressLaneStatus;
+}
+/** Safe policy selected only when the host has not opted into content. */
+export declare const DEFAULT_AGENT_EGRESS_POLICY: Readonly<AgentEgressPolicy>;
+export declare class AgentEgressPolicyError extends Error {
+    constructor(message: string);
+}
+/** Resolve/validate once at construction; unknown policy shapes never become an implicit default. */
+export declare function resolveAgentEgressPolicy(policy: AgentEgressPolicy | undefined): Readonly<AgentEgressPolicy>;
+/**
+ * Default activity projection. Every retained string is SDK-authored; no
+ * runtime trajectory, tool, prompt, environment, argv, path, or credential
+ * value survives this transformation.
+ */
+export declare function metadataStatusEvent(event: AgentEvent): AgentEvent;
+export declare function eventBytes(event: AgentEvent): number;

package/dist/daemon/agent-egress-sanitizer.d.ts

@@ -0,0 +1,38 @@
+import { type Envelope } from '@byok-sdk/protocol';
+import { type AgentEgressDropReason, type AgentEgressPolicy } from './agent-egress-policy';
+export interface AgentEgressSanitizerContext {
+    readonly lane: 'latest-value' | 'reliable';
+    readonly policyRevision: string;
+    readonly envelopeType?: string;
+    readonly agentId?: string;
+    readonly tenantId?: string;
+}
+/**
+ * Optional named host redaction hook for an explicitly contentful policy.
+ * It receives the SDK-projected value, never a second raw wire
+ * representation. Throwing/refusing drops the event; callers never receive
+ * an original-payload fallback.
+ */
+export type AgentEgressSanitizer = (value: unknown, context: AgentEgressSanitizerContext) => unknown;
+export declare class AgentEgressSanitizationError extends Error {
+    readonly reason: AgentEgressDropReason;
+    constructor(message: string, reason?: AgentEgressDropReason);
+}
+export type SanitizedEnvelope = Readonly<{
+    ok: true;
+    envelope: Envelope;
+}> | Readonly<{
+    ok: false;
+    reason: AgentEgressDropReason;
+}>;
+/**
+ * The one envelope-boundary sanitizer used before either transport sees an
+ * envelope. It parses the final value through the frozen protocol so a
+ * broken custom sanitizer also fails locally, before WS bytes or long-poll
+ * JSON can be created.
+ */
+export declare function sanitizeEgressEnvelope(envelope: Envelope, policy: Readonly<AgentEgressPolicy>, sanitizer: AgentEgressSanitizer | undefined, context?: Omit<AgentEgressSanitizerContext, 'lane' | 'policyRevision' | 'envelopeType'> & {
+    lane?: 'latest-value' | 'reliable';
+}): SanitizedEnvelope;
+/** Sanitizes a reliable payload before it is hashed/appended, never after. */
+export declare function sanitizeReliablePayload(payload: unknown, policy: Readonly<AgentEgressPolicy>, sanitizer: AgentEgressSanitizer | undefined, context?: Omit<AgentEgressSanitizerContext, 'lane' | 'policyRevision'>): unknown;

package/dist/daemon/agent-egress-spool.d.ts

@@ -0,0 +1,116 @@
+import { type AgentContentReceiptPayload } from '@byok-sdk/protocol';
+import type { AgentRef } from '../agent-home';
+import { type AgentEgressPolicy, type AgentEgressDropReason } from './agent-egress-policy';
+export declare const AGENT_EGRESS_DIRECTORY: string;
+export declare const AGENT_RELIABLE_SPOOL_FILENAME = "reliable-v1.jsonl";
+/** A spool row's intended envelope type, never inferred from its payload. */
+export declare const AGENT_RELIABLE_WIRE_TYPES: readonly ['agent.egress.reliable', 'agent.content.receipt'];
+export type AgentReliableWireType = (typeof AGENT_RELIABLE_WIRE_TYPES)[number];
+type OmitReliableIdentity<T> = T extends unknown ? Omit<T, 'eventId' | 'cursor'> : never;
+export type AgentContentReceiptWithoutReliableIdentity = OmitReliableIdentity<AgentContentReceiptPayload>;
+export interface AgentReliableEgressRecord {
+    readonly schema: 1;
+    readonly wireType: AgentReliableWireType;
+    readonly agentRef: AgentRef;
+    readonly tenantId: string;
+    readonly policyRevision: string;
+    readonly eventId: string;
+    readonly cursor: number;
+    readonly payload: unknown;
+    readonly payloadHash: string;
+    readonly byteCount: number;
+    readonly createdAt: string;
+    readonly sessionRef?: string;
+    readonly taskId?: string;
+}
+export interface AgentReliableAppendInput {
+    readonly agentRef: AgentRef;
+    readonly tenantId: string;
+    readonly policyRevision: string;
+    readonly payload: unknown;
+    readonly sessionRef?: string;
+    readonly taskId?: string;
+    readonly eventId?: string;
+    readonly createdAt?: string;
+}
+/**
+ * Content receipts use the existing durable spool but retain their own wire
+ * type and validated receipt payload. The request id is the stable event id:
+ * a retried local read cannot mint a competing receipt identity.
+ */
+export interface AgentContentReceiptAppendInput {
+    readonly agentRef: AgentRef;
+    readonly tenantId: string;
+    readonly policyRevision: string;
+    readonly sessionRef: string;
+    readonly payload: AgentContentReceiptWithoutReliableIdentity;
+    readonly taskId?: string;
+}
+export interface AgentReliableAck {
+    readonly agentRef: AgentRef;
+    readonly tenantId: string;
+    readonly sessionRef: string;
+    readonly policyRevision: string;
+    readonly eventId: string;
+    readonly cursor: number;
+}
+export declare class AgentReliableSpoolError extends Error {
+    constructor(message: string);
+}
+export declare class AgentReliableQuotaError extends AgentReliableSpoolError {
+    readonly reason: Extract<AgentEgressDropReason, 'quota_exceeded' | 'backpressure'>;
+    constructor(reason: Extract<AgentEgressDropReason, 'quota_exceeded' | 'backpressure'>, message: string);
+}
+/**
+ * Per-Agent durable append-before-send log. It is deliberately separate from
+ * the inbound task journal: its only truth is outbound reliable egress
+ * pending/exact-ack state.
+ */
+export declare class AgentReliableSpool {
+    readonly homeDir: string;
+    readonly spoolPath: string;
+    private readonly pending;
+    private nextCursor;
+    private logEntries;
+    private writeTail;
+    private constructor();
+    static open(homeDir: string): Promise<AgentReliableSpool>;
+    get pendingEvents(): number;
+    get pendingBytes(): number;
+    records(): readonly AgentReliableEgressRecord[];
+    append(input: AgentReliableAppendInput, policy: Readonly<AgentEgressPolicy>, tenantPendingBytes: number): Promise<AgentReliableEgressRecord>;
+    /**
+     * Append one complete, protocol-validated content receipt before its first
+     * send. `eventId` is fixed to `requestId`; the durable spool alone allocates
+     * the positive cursor, then validates the final payload before fsync.
+     */
+    appendContentReceipt(input: AgentContentReceiptAppendInput, policy: Readonly<AgentEgressPolicy>, tenantPendingBytes: number): Promise<AgentReliableEgressRecord>;
+    /** Exact matching ack is the only transition which retires a record. */
+    acknowledge(ack: AgentReliableAck): Promise<boolean>;
+    private load;
+    private appendEntry;
+    private compact;
+    private exclusive;
+}
+export interface LatestValueRecord {
+    readonly agentRef: AgentRef;
+    readonly tenantId: string;
+    readonly event: import('@byok-sdk/protocol').AgentEvent;
+    readonly byteCount: number;
+    readonly updatedAt: string;
+}
+/** In-memory latest-value state; it is never replayed as durable history. */
+export declare class AgentLatestValueState {
+    private readonly recordsByAgent;
+    offer(record: Omit<LatestValueRecord, 'byteCount' | 'updatedAt'>, policy: Readonly<AgentEgressPolicy>): Readonly<{
+        accepted: true;
+        replaced: boolean;
+        record: LatestValueRecord;
+    }> | Readonly<{
+        accepted: false;
+        reason: Extract<AgentEgressDropReason, 'quota_exceeded' | 'backpressure'>;
+    }>;
+    get pendingEvents(): number;
+    get pendingBytes(): number;
+}
+export {};

package/dist/daemon/agent-session-handoff-store.d.ts

@@ -0,0 +1,82 @@
+import { type AgentRef } from '../agent-home';
+export type AgentTerminalCause = 'complete' | 'failed' | 'cancelled';
+export interface AgentSessionHandoff {
+    readonly agentRef: AgentRef;
+    /** Task that created the native runtime session. */
+    readonly taskId: string;
+    readonly sessionRef: string;
+    readonly runtimeId: string;
+    /** Canonical Agent home and runtime cwd; these are intentionally one value. */
+    readonly cwd: string;
+    readonly leaseId: string;
+    readonly terminalCause?: AgentTerminalCause;
+    readonly terminalReason?: string;
+    readonly updatedAt: string;
+}
+export interface AgentSessionHandoffMatch {
+    readonly agentRef: AgentRef;
+    readonly sessionRef: string;
+    readonly runtimeId: string;
+    readonly cwd: string;
+}
+export interface AgentTaskTerminalEvidence {
+    readonly agentRef: AgentRef;
+    readonly taskId: string;
+    readonly runtimeId: string;
+    /** Canonical Agent home and sealed runtime cwd. */
+    readonly cwd: string;
+    readonly leaseId: string;
+    /** Present when adapter start succeeded but handoff persistence failed. */
+    readonly sessionRef?: string;
+    readonly terminalCause: 'failed';
+    readonly terminalReason: string;
+    readonly updatedAt: string;
+}
+export interface AgentTaskTerminalMatch {
+    readonly agentRef: AgentRef;
+    readonly taskId: string;
+    readonly runtimeId: string;
+    readonly cwd: string;
+}
+export declare class AgentSessionHandoffStoreError extends Error {
+    constructor(message: string);
+}
+export declare class AgentSessionHandoffCorruptError extends AgentSessionHandoffStoreError {
+    constructor(message: string);
+}
+export declare class AgentSessionHandoffMismatchError extends AgentSessionHandoffStoreError {
+    constructor(message: string);
+}
+/**
+ * Durable, fail-closed session evidence stored inside the canonical Agent
+ * home. Each session gets one hash-addressed append-only JSONL ledger under
+ * `.byok/runtime-sessions/`; session text never becomes a pathname. Unlike
+ * the legacy SessionWorkspaceStore, corrupt bytes are never interpreted as a
+ * missing mapping.
+ */
+export declare class AgentSessionHandoffStore {
+    private readonly queues;
+    get(expected: AgentSessionHandoffMatch): Promise<AgentSessionHandoff | undefined>;
+    /** Append-only readback for audit/recovery; every historical terminal remains visible. */
+    history(expected: AgentSessionHandoffMatch): Promise<readonly AgentSessionHandoff[]>;
+    /** Exact identity check used before a strict Agent resume is admitted. */
+    requireMatch(expected: AgentSessionHandoffMatch): Promise<AgentSessionHandoff>;
+    /** Append-only, fsynced write. The caller awaits this before task.started. */
+    record(input: Omit<AgentSessionHandoff, 'updatedAt' | 'terminalCause' | 'terminalReason'>): Promise<AgentSessionHandoff>;
+    /** Records the first terminal cause without changing the exact handoff identity. */
+    recordTerminal(expected: AgentSessionHandoffMatch, cause: AgentTerminalCause, reason?: string): Promise<AgentSessionHandoff>;
+    /**
+     * Persists a claimed Agent task failure that happened before an active
+     * session handoff existed. Callers await the fsync before sending
+     * `task.fail`, so cloud state can never outrun the Agent-local evidence.
+     */
+    recordTaskTerminal(input: Omit<AgentTaskTerminalEvidence, 'updatedAt' | 'terminalCause'>): Promise<AgentTaskTerminalEvidence>;
+    getTaskTerminal(expectedInput: AgentTaskTerminalMatch): Promise<AgentTaskTerminalEvidence | undefined>;
+    private filePath;
+    private taskTerminalFilePath;
+    private enqueue;
+    private load;
+    private loadAll;
+    private loadTaskTerminal;
+    private append;
+}

package/dist/daemon/blob-client.d.ts

@@ -3,7 +3,9 @@ import type { AuthManager } from './auth-manager';
 /** Seam `TaskRunner` depends on, so tests can substitute a fake without spinning up real HTTP endpoints. */
 export interface BlobResolver {
     resolveInstruction(blobRef: BlobRef): Promise<string>;
-    uploadArtifact(content: string | Uint8Array, contentType: string): Promise<BlobRef>;
+    uploadArtifact(content: string | Uint8Array, contentType: string, options?: {
+        readonly idempotencyKey?: string;
+    }): Promise<BlobRef>;
 }
 /**
  * HTTP-side blob transfer (protocol §7): resolving an instruction `blobRef`
@@ -18,5 +20,7 @@ export declare class BlobClient implements BlobResolver {
     /** `blobRef` -> `GET /byok/blobs/:id/url` -> fetch the presigned download URL -> text content. Always resolves fresh rather than trusting any inlined `BlobRef.url`, per docs/protocol.md §7. */
     resolveInstruction(blobRef: BlobRef): Promise<string>;
     /** `POST /byok/blobs` (declares size/contentType/contentHash) -> PUT the bytes to the presigned upload URL -> a `BlobRef` for `task.artifact.blobRef`. */
-    uploadArtifact(content: string | Uint8Array, contentType: string): Promise<BlobRef>;
+    uploadArtifact(content: string | Uint8Array, contentType: string, options?: {
+        readonly idempotencyKey?: string;
+    }): Promise<BlobRef>;
 }

package/dist/daemon/connection-manager.d.ts

@@ -12,8 +12,8 @@ export interface ConnectionManagerOptions {
     /** U4a Local Agent release version; passed unchanged to both transports. */
     clientVersion?: string;
     runtimes: RuntimeInfo[];
-    /** Sorted logical IDs from the validated local registry; executable definitions stay local. */
-    configuredToolsets?: readonly ToolsetId[];
+    /** Reads current sorted logical IDs from the validated local registry for every WS hello. */
+    getConfiguredToolsets?: () => readonly ToolsetId[];
     auth: AuthManager;
     cursorStore: CursorStore;
     /**

package/dist/daemon/control-protocol.d.ts

@@ -4,6 +4,7 @@ import type { StorageCategory } from './journal/journal';
 import type { StoragePressureState } from './journal/storage-policy';
 import type { OperationalHealthSnapshot } from './operational-health';
 import type { LocalAgentReleaseIdentity } from '../release-identity';
+import type { McpToolsetConfig, McpToolsetRegistryStatus } from '../types';
 /**
  * M4 Phase 2: shared local-IPC contract between the daemon's control server
  * (`control-server.ts`) and the CLI's control client (`bin/control-client.ts`)
@@ -273,7 +274,15 @@ export interface ControlStatusResult {
     storage?: ControlStorageStatus;
     /** Local lifecycle/retry budget. This is not the transport state above. */
     operationalHealth: OperationalHealthSnapshot;
+    /** Redacted content-addressed status from the daemon's single local registry. */
+    toolsets: McpToolsetRegistryStatus;
 }
+export interface ToolsetsReloadParams {
+    expectedRevision: string;
+    mcpToolsets: Record<string, McpToolsetConfig>;
+}
+/** Shape-only parser; executable definition validation remains registry-owned. */
+export declare function parseToolsetsReloadParams(value: unknown): ToolsetsReloadParams | undefined;
 export interface ApprovalsListResult {
     approvals: PendingApproval[];
 }

package/dist/daemon/create-daemon.d.ts

@@ -1,6 +1,8 @@
-import type { RuntimeId } from '@byok-sdk/protocol';
+import type { AgentEgressPolicy, RuntimeId } from '@byok-sdk/protocol';
 import type { PermissionPolicy } from '@byok-sdk/protocol';
-import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig } from '../types';
+import type { RuntimeAdapter, GitWorkspaceConfig, McpToolsetConfig, McpToolsetObservation, McpToolsetRegistryStatus, McpToolsetReloadReceipt } from '../types';
+import { type AgentHomeProjection } from '../agent-home';
+import type { AgentRef } from '../agent-home';
 import { type LocalAgentReleaseIdentity } from '../release-identity';
 import type { BackoffOptions, LivenessOptions } from './ws-transport';
 import { type OperationalHealthSnapshot } from './operational-health';
@@ -13,6 +15,10 @@ import { type JournalOpenFaultSeam } from './journal/sqlite-support';
 import { LocalStoragePressureEngine, type LocalStoragePolicyInput } from './journal/storage-policy';
 import { type ResultDocumentExtractor } from './task-runner';
 import { type ProgressBatcherOptions } from './progress-batcher';
+import { type AgentEgressReliableAppendResult } from './agent-egress-controller';
+import { type AgentEgressStatus } from './agent-egress-policy';
+import { type AgentEgressSanitizer } from './agent-egress-sanitizer';
+import { type AgentContentReadRoot } from './agent-content-read';
 /**
  * Optional white-label product display info — purely opaque passthrough
  * (never interpreted, validated, or rendered by the daemon itself). Carried
@@ -56,13 +62,6 @@ export interface HostedJournalConfig {
      * to a closed set instead of a re-interpretation of an existing config.
      */
     mode: 'sqlite';
-    /**
-     * The tenant every journal row on this device is scoped to (§12.7.2's
-     * minimum fact set opens with tenant/product/device). Required: a hosted
-     * daemon that cannot say which tenant its durable evidence belongs to has
-     * evidence nobody can act on.
-     */
-    tenantId: string;
     /** Bound on waiting for the journal's write lock, ms. Defaults to the journal's own bound. */
     busyTimeoutMs?: number;
     /** Per-record byte bound. Defaults to the journal's own bound; oversized records are refused, never truncated. */
@@ -91,7 +90,27 @@ export interface DaemonConfig {
     serverUrl: string;
     deviceName?: string;
     workspaceRoot: string;
-    /** Disabled by default. Enables local-only Git checkpoint repositories. */
+    /**
+     * Strict Agent execution boundary. The host selects one absolute branded
+     * storage root; the SDK alone composes `agents/<agentId>`, initializes the
+     * durable home, and binds it as runtime cwd. `projection` may write opaque,
+     * redacted host content into the canonical home supplied by the SDK.
+     */
+    agentHome?: {
+        hostStorageRoot: string;
+        projection?: AgentHomeProjection;
+    };
+    /**
+     * Explicit Agent-local/cloud egress selection. Omission still enforces the
+     * SDK metadata/status projection, but does not advertise or admit the new
+     * policy/reliable protocol surface.
+     */
+    agentEgress?: AgentEgressConfig;
+    /**
+     * Disabled by default. Enables local-only Git checkpoint repositories for
+     * legacy task workspaces. Mutually exclusive with `agentHome`: strict Agent
+     * execution has one canonical workspace authority.
+     */
     gitWorkspace?: GitWorkspaceConfig;
     /** Disabled by default. Enables the durable local task journal — see {@link HostedJournalConfig}. */
     hostedJournal?: HostedJournalConfig;
@@ -320,6 +339,43 @@ export interface DaemonConfig {
      */
     deviceAssertion?: DeviceAssertionConfig;
 }
+export interface AgentEgressConfig {
+    /** Exact policy the daemon is willing to consume from an Agent offer. */
+    policy: AgentEgressPolicy;
+    /** Named redaction hook for explicit contentful trajectory only. */
+    sanitizer?: AgentEgressSanitizer;
+    /**
+     * Device-local additions required to make one server-selected transfer
+     * policy executable. These values only supplement `policy.transfers`: a
+     * locally configured surface never enables a server-disabled transfer, and
+     * cannot widen its maxBytes or MIME authority.
+     */
+    contentRead?: AgentContentReadConfig;
+}
+/** Local root and text handling authority for one independently-gated surface. */
+export interface AgentContentReadSurfaceConfig {
+    readonly root: AgentContentReadRoot;
+    readonly maxTextBytes: number;
+    readonly textMimeTypes: readonly string[];
+    readonly sensitiveNames?: readonly string[];
+}
+/**
+ * Host-local portions of the content-read contract. The audit ledger has no
+ * host path option: SDK composition fixes it per Agent home.
+ */
+export interface AgentContentReadConfig {
+    readonly workspace?: AgentContentReadSurfaceConfig;
+    readonly transcript?: AgentContentReadSurfaceConfig;
+    readonly artifact?: AgentContentReadSurfaceConfig;
+    readonly runtimeAllowlistedRoots?: readonly string[];
+}
+export interface AgentReliableEgressInput {
+    agentRef: AgentRef;
+    sessionRef: string;
+    payload: unknown;
+    taskId?: string;
+    eventId?: string;
+}
 /**
  * Plan `device-assertion-broker`. Two fields, both about what this daemon will
  * refuse.
@@ -383,12 +439,22 @@ export interface DaemonStatus {
     branding?: DaemonBranding;
     /** Local lifecycle/retry budget, separate from transport fallback state. */
     operationalHealth: OperationalHealthSnapshot;
+    /** Redacted, content-addressed device-local MCP registry status. */
+    toolsets: McpToolsetRegistryStatus;
+    /** Content-free egress lane watermarks and typed last-drop facts. */
+    egress: AgentEgressStatus;
 }
 export interface Daemon {
     pair(pairingCode: string): Promise<DeviceRecord>;
     start(): Promise<void>;
     stop(): Promise<void>;
     status(): DaemonStatus;
+    /** Append one sanitized reliable record before its first transport attempt. */
+    publishReliableAgentEgress?(input: AgentReliableEgressInput): Promise<AgentEgressReliableAppendResult>;
+    /** Atomically replace the local registry when its current revision matches. */
+    reloadMcpToolsets(mcpToolsets: Record<string, McpToolsetConfig> | undefined, expectedRevision: string): McpToolsetReloadReceipt;
+    /** Record one explicit host-owned lifecycle observation for a configured toolset. */
+    reportMcpToolsetObservation(toolsetId: string, expectedDefinitionRevision: string, observation: McpToolsetObservation): void;
     /**
      * M3-2a: local observability — subscribe to live `DaemonEvent`s (task
      * feed, connection/pairing state changes, runtime-detection results) as

package/dist/daemon/long-poll-transport.d.ts

@@ -1,5 +1,33 @@
 import { type Envelope } from '@byok-sdk/protocol';
 import { AuthManager } from './auth-manager';
+import { type TransportEndpoint } from './url';
+/**
+ * A long-poll request failed in a way that today told the caller only
+ * `false`/"retry in 2s" — this names WHICH of the transport's two routes it
+ * was and what the server said, so a stuck fallback loop is diagnosable
+ * without a packet capture.
+ *
+ * Scope (review finding — honest attribution): this type represents ONLY an
+ * actual route request/response cycle failing. Anything that happens BEFORE
+ * the request exists — in practice credential acquisition
+ * (`AuthManager.getValidAccessToken`) — is not a route failure and is never
+ * reported as one; neither is {@link DeviceRevokedError}, which is a device
+ * lifecycle fact rather than something the route did. See
+ * `LongPollClient.loop`/`postBatch` for where that boundary is drawn.
+ *
+ * `status` is the HTTP status of the response the route produced, INCLUDING
+ * the case where the response arrived intact and its body then failed to read
+ * or parse (a 200 whose payload is malformed is still a 200 — the parse error
+ * rides in `cause`). `undefined` means no response was ever produced: the
+ * `fetch` itself rejected (DNS/TLS/connection failure, abort). The underlying
+ * error is kept in `cause` rather than flattened into the message, so nothing
+ * about the original failure is lost.
+ */
+export declare class LongPollRouteError extends Error {
+    readonly endpoint: TransportEndpoint;
+    readonly status: number | undefined;
+    constructor(endpoint: TransportEndpoint, status: number | undefined, cause: unknown);
+}
 export interface LongPollClientOptions {
     serverUrl: string;
     auth: AuthManager;
@@ -131,7 +159,39 @@ export declare class LongPollClient {
      * eviction bookkeeping for a case this unlikely.
      */
     private readonly warnedValidationFailureSeqs;
+    /**
+     * `path:status` keys this loop has already warned about — same one-warn-per-key
+     * discipline (and same rare-path soft-cap reset) as
+     * {@link warnedValidationFailureSeqs}, and for the same reason: an
+     * unreachable or misconfigured route fails again every `retryDelayMs` (2s
+     * by default) for as long as the fallback is engaged, so an unguarded warn
+     * would bury every other line in the log within a minute. Keyed by route
+     * AND status so a route that starts failing differently (503 -> 401) still
+     * warns once for the new condition.
+     */
+    private readonly warnedRouteFailures;
+    /**
+     * Both routes this transport can fail against, built once (see
+     * {@link describeEndpoint} for why constructing them in one place is what
+     * keeps credentials out of every diagnostic derived from them).
+     */
+    private readonly eventsEndpoint;
+    private readonly messagesEndpoint;
     constructor(opts: LongPollClientOptions);
+    /**
+     * One warn per `path:status`, carrying the typed {@link LongPollRouteError}
+     * as the second argument so a caller inspecting the log (or a test) reads
+     * the route off the error rather than re-parsing the message.
+     */
+    private warnRouteFailure;
+    /**
+     * {@link DeviceRevokedError} is a device lifecycle fact, not a route
+     * failure: it stops this loop outright (retrying cannot help) and is
+     * deliberately reported through `onRevoked` ONLY — never additionally as a
+     * {@link LongPollRouteError}. Returns whether the error was that case, so
+     * each call site can skip its route-failure warn for it.
+     */
+    private noteRevoked;
     start(): void;
     stop(): void;
     /**

package/dist/daemon/presence-publisher.d.ts

@@ -57,8 +57,8 @@ export declare function assertPresenceHeartbeatCadence(cadence: {
 export interface PresencePublisherOptions {
     serverUrl: string;
     auth: AuthManager;
-    /** Sorted logical IDs only. Executable MCP definitions and credentials remain device-local. */
-    configuredToolsets?: readonly ToolsetId[];
+    /** Reads current sorted logical IDs only; executable definitions and credentials remain device-local. */
+    getConfiguredToolsets?: () => readonly ToolsetId[];
     /** U4a Local Agent release version; never inferred from the host package. */
     clientVersion?: string;
     /** The same runtime/auth snapshot sent in `conn.hello`. */

package/dist/daemon/store.d.ts

@@ -1,6 +1,8 @@
 import { type EnsureSecureDirOptions } from '../util/secure-dir';
 export interface DeviceRecord {
     deviceId: string;
+    /** Opaque tenant binding returned by the authenticated pairing response. */
+    tenantId: string;
     /** Current access token (JWT), renewed via challenge/token without re-pairing (protocol §6.2). */
     accessToken: string;
     /** ISO-8601 expiry for `accessToken` (our best knowledge of it — see auth-manager.ts for how this is derived after `/byok/pair`, which reports no explicit expiry itself). */
@@ -10,6 +12,13 @@ export interface DeviceRecord {
     /** Ed25519 public key, base64url — re-sent verbatim on a post-revocation re-pair (protocol §6.3). */
     devicePublicKey: string;
 }
+/**
+ * A durable enrollment record cannot be used by any steady-state path. Only
+ * the explicit pair operation may replace it with a fresh authenticated row.
+ */
+export declare class DeviceRecordRePairRequiredError extends Error {
+    constructor();
+}
 /**
  * Persists the device identity issued by `pair()` — deviceId, current
  * access token + its expiry, and the device's own Ed25519 keypair. This is