@byok-sdk/client 0.8.0 → 0.8.1

package/dist/daemon/store.d.ts

@@ -1,17 +1,32 @@
 import { type EnsureSecureDirOptions } from '../util/secure-dir';
-export interface DeviceRecord {
-    deviceId: string;
-    /** Opaque tenant binding returned by the authenticated pairing response. */
-    tenantId: string;
-    /** Current access token (JWT), renewed via challenge/token without re-pairing (protocol §6.2). */
-    accessToken: string;
-    /** ISO-8601 expiry for `accessToken` (our best knowledge of it — see auth-manager.ts for how this is derived after `/byok/pair`, which reports no explicit expiry itself). */
-    expiresAt: string;
-    /** Ed25519 private key, PKCS8 PEM. Never leaves this device. Stored as a 0600 file; OS keychain integration is deferred (tracked as a future roadmap item, not promised for any specific milestone). */
-    devicePrivateKeyPem: string;
-    /** Ed25519 public key, base64url — re-sent verbatim on a post-revocation re-pair (protocol §6.3). */
-    devicePublicKey: string;
+import { DeviceCredentialStore, InMemoryDeviceCredentialStore, type DeviceMetadata } from './device-credential-store';
+export type { DeviceMetadata, DeviceRecord } from './device-credential-store';
+/**
+ * Non-secret projection of an authenticated device enrollment. This is the
+ * complete permitted `device.json` shape. The complete record, including
+ * these authenticated metadata fields and secret bytes, lives atomically in
+ * DeviceCredentialStore; this file is only its deterministic projection.
+ *
+ * Internal only: the package root exposes DeviceEnrollment/status, never this
+ * storage record.
+ */
+/** Public credential-blind result of explicit pairing. */
+export interface DeviceEnrollment {
+    readonly deviceId: string;
+}
+export interface DeviceEnrollmentStatusOptions {
+    productId: string;
+    storeDir?: string;
 }
+/** Credential-blind cold read model for host setup and diagnostics. */
+export type DeviceEnrollmentStatus = {
+    state: 'unpaired';
+} | {
+    state: 'paired';
+    deviceId: string;
+} | {
+    state: 're_pair_required';
+};
 /**
  * A durable enrollment record cannot be used by any steady-state path. Only
  * the explicit pair operation may replace it with a fresh authenticated row.
@@ -20,17 +35,17 @@ export declare class DeviceRecordRePairRequiredError extends Error {
     constructor();
 }
 /**
- * Persists the device identity issued by `pair()` — deviceId, current
- * access token + its expiry, and the device's own Ed25519 keypair. This is
- * the ONLY credential material the daemon itself ever holds — never a
- * runtime's own credentials (see the credential-isolation rule on
- * `RuntimeAdapter`). Stored 0600 under `storeDir` (default
- * `~/.byok/<productId>/`); OS keychain storage is deferred (tracked as a
- * future roadmap item, not promised for any specific milestone).
+ * Persists only bounded non-secret enrollment projection. The paired bearer
+ * token and private key are never accepted here and are owned by the internal
+ * OS DeviceCredentialStore.
  */
 export declare class DeviceStore {
     private readonly secureDirOptions?;
+    /** Process-local keyed doubles preserve restart semantics in isolated tests. */
+    private static readonly testCredentials;
     private readonly filePath;
+    /** Internal test seam. Product construction always supplies productId and gets an OS store. */
+    readonly credentials: DeviceCredentialStore | InMemoryDeviceCredentialStore;
     /**
      * `secureDirOptions` is a test-only DI seam (mirrors `EnsureSecureDirOptions`'s
      * own `run`/`platform` overrides) — every real caller omits it, getting
@@ -41,7 +56,7 @@ export declare class DeviceStore {
      * ACL-unprotected credential") is verifiable from a real `darwin`/`linux`
      * CI/dev machine, not just asserted.
      */
-    constructor(storeDir: string, secureDirOptions?: EnsureSecureDirOptions | undefined);
+    constructor(storeDir: string, secureDirOptions?: EnsureSecureDirOptions | undefined, productId?: string);
     static defaultDir(productId: string): string;
     /**
      * Resolve the one store pathname every daemon/CLI component must share.
@@ -50,14 +65,20 @@ export declare class DeviceStore {
      * cwd to pin a quarantine directory inode.
      */
     static resolveDir(productId: string, configured?: string): string;
-    load(): Promise<DeviceRecord | undefined>;
+    load(): Promise<DeviceMetadata | undefined>;
     /**
      * Read and remove the exact bounded, no-follow device record under the
      * caller's mutation lease. The hard-link guard keeps the inspected inode
      * identifiable until the synchronous pathname check and unlink complete.
      */
-    remove(): Promise<DeviceRecord | undefined>;
-    save(record: DeviceRecord): Promise<void>;
-    clear(): Promise<void>;
+    remove(): Promise<DeviceMetadata | undefined>;
+    save(record: DeviceMetadata): Promise<void>;
     private openBounded;
 }
+/**
+ * Read the canonical device store without projecting credential or tenant
+ * material. A legacy/tampered record remains distinct from an absent record so
+ * hosts can require explicit re-pair instead of silently changing semantics.
+ * Filesystem and pathname-safety failures intentionally remain errors.
+ */
+export declare function readDeviceEnrollmentStatus(options: DeviceEnrollmentStatusOptions): Promise<DeviceEnrollmentStatus>;

package/dist/daemon/task-runner.d.ts

@@ -195,6 +195,8 @@ export interface TaskRunnerDeps {
     workspaceRoot: string;
     /** Strict Agent offer authority. Absent means legacy offers never resolve an Agent home. */
     agentHome?: AgentHomeManager;
+    /** Local authority: legacy offers are declined after journal/dedup/cancel precedence. */
+    strictAgentOnly?: boolean;
     /** Exact host-selected policy accepted by `task.offer_for_agent_with_egress`. */
     agentEgressPolicy?: Readonly<AgentEgressPolicy>;
     /** Always-present projection/sanitizer consumer; it defaults to metadata-only. */
@@ -479,6 +481,12 @@ export declare class TaskRunner {
      * cancellation intent.
      */
     private readonly finishedTaskIds;
+    /**
+     * Bounded local receive dedup for strict legacy declines. A decline is not a
+     * task terminal receipt, so it must never enter `finishedTaskIds`; retaining
+     * it separately keeps replay idempotent without claiming or finishing work.
+     */
+    private readonly strictDeclinedTaskIds;
     /**
      * M4 Phase 2 (daemon control socket `shutdown` RPC): set once by
      * {@link stopAcceptingOffers}, checked at the very top of `handleOffer` —
@@ -1019,6 +1027,7 @@ export declare class TaskRunner {
     private reserveSemanticTerminal;
     /** M3-B: bounded insert for `finishedTaskIds` — see its class-level doc comment and `MAX_TRACKED_TASK_IDS`. Evicts the oldest (first-inserted) entry once over cap, same idiom as `ConnectionHub.checkAndRecordDuplicate` (packages/server/src/hub.ts). */
     private addFinishedTaskId;
+    private addStrictDeclinedTaskId;
     /** `reuseDir`, when set (a known sessionRef's recorded workspace), is used verbatim instead of a fresh `workspaceRoot/<taskId>` directory — `mkdir recursive` is idempotent either way, so ensuring-exists is safe to do unconditionally. */
     private resolveWorkspaceDir;
     /**

package/dist/index.d.ts

@@ -4,6 +4,8 @@ export { AgentHomeError, AgentRefValidationError, AgentHomeResolutionError, Agen
 export { AgentSessionHandoffStore, AgentSessionHandoffStoreError, AgentSessionHandoffCorruptError, AgentSessionHandoffMismatchError, } from './daemon/agent-session-handoff-store';
 export type { AgentSessionHandoff, AgentSessionHandoffMatch, AgentTaskTerminalEvidence, AgentTaskTerminalMatch, AgentTerminalCause, } from './daemon/agent-session-handoff-store';
 export type { AgentHomeResolution, AgentHomeProjection, AgentHomeProjectionInput, AgentHomeProjectionApplyInput, AgentHomeProjectionFunction, AgentHomeProjectionApplyFunction, AgentHomeLease, AgentHomeBinding, } from './agent-home';
+export { localStateRelocation, LocalStateRelocationError, LocalStateRelocationBusyError, LocalStateRelocationIntegrityError, } from './local-state-relocation';
+export type { LocalStateRelocationInput, LocalStateRelocationLease, } from './local-state-relocation';
 export { PolicyUnsupportedError, SteerUnsupportedError, freezeRuntimeAdapterDescriptor, sealRuntimeOperationManifest } from './types';
 export type { RuntimeEnvironmentRequirements } from './daemon/environment';
 export { resolveLocalAgentReleaseIdentity } from './release-identity';
@@ -39,10 +41,8 @@ export { SqliteLocalTaskJournal, JOURNAL_DB_FILENAME, JOURNAL_QUARANTINE_DIRNAME
 export type { SqliteLocalTaskJournalOptions } from './daemon/journal/sqlite-journal';
 export { LocalStoragePressureEngine, LocalStoragePolicyError, LocalStorageEmergencyError, resolveLocalStoragePolicy, computePressureState, cleanupOrderFor, cleanupEligibleAt, createFilesystemCleanupExecutor, createStatfsFreeBytesProvider, JOURNAL_TASK_REF_PREFIX, DEFAULT_SOFT_BUDGET_RATIO, DEFAULT_HARD_BUDGET_RATIO, DEFAULT_ACK_CRITICAL_RESERVE_BYTES, DEFAULT_CLEANUP_BATCH_LIMIT, DEFAULT_INCREMENTAL_VACUUM_PAGES, DEFAULT_NORMAL_COMPACTION_INTERVAL_MS, DEFAULT_PRESSURE_COMPACTION_INTERVAL_MS, DEFAULT_RETENTION_MS, DEFAULT_LOG_ROTATION, } from './daemon/journal/storage-policy';
 export type { LocalStoragePolicy, LocalStoragePolicyInput, LocalStoragePressureEngineOptions, LogRotationPolicy, CompactionPolicy, StoragePressureState, StoragePressureEvent, StorageMeasurement, StorageStatusSnapshot, StorageTickResult, CleanupExecutor, CleanupExecution, TimerLike, } from './daemon/journal/storage-policy';
-export type { DeviceRecord } from './daemon/store';
-export { AuthManager, DeviceRevokedError } from './daemon/auth-manager';
-export { StoredDeviceProofSigner } from './daemon/device-proof-signer';
-export type { DeviceProofRequest, DeviceProofSigner, StoredDeviceProofSignerOptions, } from './daemon/device-proof-signer';
+export { readDeviceEnrollmentStatus } from './daemon/store';
+export type { DeviceEnrollment, DeviceEnrollmentStatus, DeviceEnrollmentStatusOptions, } from './daemon/store';
 /**
  * Plan `skill-pack-delivery-channel`: the device half of the `skills.pack`
  * channel. The install pipeline and the two read APIs are public because the