@byok-sdk/core 0.18.0 → 0.19.0

package/dist/device-assertion.d.ts

@@ -52,16 +52,40 @@ export declare const DEVICE_ASSERTION_SCHEMA_ID = "byok-device-assertion-v1";
  * Domain separation prefix, prepended to the canonical claim bytes before
  * signing.
  *
- * Must remain mutually NON-PREFIX with the other two things this same Ed25519
+ * Must remain mutually NON-PREFIX with the other three things this same Ed25519
  * device key signs — `byok-nonce-v1\n` (challenge/token renewal, see
- * `@byok-sdk/client`'s `device-keys.ts`) and `byok-device-proof-v1\n`
- * (`attestation.ts`) — so no signature over one domain can ever be reinterpreted
- * as a signature over another. `packages/core/src/__tests__/device-assertion.test.ts`
- * asserts the three-way non-prefix property directly; that assertion is the
- * falsifier for this whole design, not a nicety.
+ * `@byok-sdk/client`'s `device-keys.ts`), `byok-device-proof-v1\n`
+ * (`attestation.ts`), and `byok-task-assertion-v1\n` ({@link
+ * TASK_ASSERTION_DOMAIN_PREFIX}) — so no signature over one domain can ever be
+ * reinterpreted as a signature over another.
+ * `packages/core/src/__tests__/device-assertion.test.ts` asserts the property
+ * across the three core-owned prefixes and
+ * `packages/client/src/__tests__/device-assertion-broker.test.ts` across all
+ * four; those assertions are the falsifier for this whole design, not a nicety.
  */
 export declare const DEVICE_ASSERTION_DOMAIN_PREFIX = "byok-device-assertion-v1\n";
 export declare const DEVICE_ASSERTION_VERSION = 1;
+/**
+ * Envelope schema id of the task-scoped assertion (contract §8.1), kept beside
+ * the device one so the two are read — and reviewed — together.
+ */
+export declare const TASK_ASSERTION_SCHEMA_ID = "byok-task-assertion-v1";
+/**
+ * Domain separation prefix for `byok-task-assertion-v1`.
+ *
+ * Joins the mutually NON-PREFIX set the ONE Ed25519 device key signs under:
+ * `byok-nonce-v1\n`, `byok-device-proof-v1\n`,
+ * `byok-device-assertion-v1\n`, and this. Contract §8.1 requires the old and
+ * new envelopes to be non-interchangeable, and domain separation is the half of
+ * that which holds even when both envelopes parse: a device-lane signature can
+ * never be reinterpreted as a task-lane one, because the signed bytes differ in
+ * their first line. The four-way falsifier lives in
+ * `packages/client/src/__tests__/device-assertion-broker.test.ts` (the only
+ * suite that can import the real nonce domain); the three core-owned prefixes
+ * are cross-checked in `packages/core/src/__tests__/device-assertion.test.ts`.
+ */
+export declare const TASK_ASSERTION_DOMAIN_PREFIX = "byok-task-assertion-v1\n";
+export declare const TASK_ASSERTION_VERSION = 1;
 /** Signature algorithms this envelope version admits. */
 export declare const DEVICE_ASSERTION_ALGORITHMS: readonly ['ed25519'];
 export type DeviceAssertionAlgorithm = (typeof DEVICE_ASSERTION_ALGORITHMS)[number];
@@ -236,8 +260,21 @@ export interface DeviceAssertionExpectedBinding {
     readonly productId: string;
     readonly audience: string;
 }
+/**
+ * The envelope kinds that share one replay authority.
+ *
+ * A closed union with no default: contract §8.2(2) requires the replay key to
+ * carry an envelope-kind discriminator so the same `jti` presented as a device
+ * assertion and as a task assertion occupies two key slots and neither lane can
+ * burn the other's. A defaulted or optional field would reintroduce exactly the
+ * collision the discriminator exists to prevent, so every caller states its
+ * lane and a caller that forgets does not compile.
+ */
+export type DeviceAssertionReplaySchemaId = typeof DEVICE_ASSERTION_SCHEMA_ID | typeof TASK_ASSERTION_SCHEMA_ID;
 /** One replay key. Every field is derived from verified claims/current authority. */
 export interface DeviceAssertionReplayConsumeInput {
+    /** Which signed envelope kind produced this key. Required; never inferred, never defaulted. */
+    readonly schema: DeviceAssertionReplaySchemaId;
     readonly tenantId: TenantId;
     readonly issuer: string;
     readonly productId: string;
@@ -262,8 +299,13 @@ export interface AuthenticateDeviceAssertionDeps {
     readonly now: Date;
     readonly maxLifetimeMs?: number;
 }
-/** Audit-safe result of a consumed assertion; no credential or signature is retained. */
-export interface AuthenticatedDeviceAssertion {
+/**
+ * What both lanes' results carry: the current-authority principal plus the
+ * audit fields of the credential that was spent. Never a name a caller holds —
+ * a value is always one lane or the other, and {@link AuthenticatedAssertion}
+ * is the union to accept when a consumer genuinely serves both.
+ */
+interface AuthenticatedAssertionBase {
     readonly device: DevicePrincipal;
     readonly issuer: string;
     readonly audience: string;
@@ -271,6 +313,20 @@ export interface AuthenticatedDeviceAssertion {
     readonly issuedAt: string;
     readonly expiresAt: string;
 }
+/**
+ * Audit-safe result of a consumed DEVICE assertion; no credential or signature
+ * is retained.
+ *
+ * `lane` is the discriminator contract §8.1 requires the result to carry. The
+ * two lanes have zero interchange, so a consumer that serves only one of them
+ * has to be able to say which — and "which fields are present" is not that
+ * statement: a structural check drifts the moment either claim set grows, and
+ * an extension relationship would make a task credential satisfy every
+ * device-lane type check for free.
+ */
+export interface AuthenticatedDeviceAssertion extends AuthenticatedAssertionBase {
+    readonly lane: 'device';
+}
 /**
  * Authenticate one device assertion and atomically consume its JTI.
  *
@@ -279,3 +335,180 @@ export interface AuthenticatedDeviceAssertion {
  * availability error without ever degrading to signature-only acceptance.
  */
 export declare function authenticateDeviceAssertion(input: unknown, deps: AuthenticateDeviceAssertionDeps): Promise<AuthenticatedDeviceAssertion | undefined>;
+/**
+ * The task-scoped assertion: a separate envelope, NOT a device assertion with
+ * extra claims.
+ *
+ * Contract §8.1 fixes the property this section exists to hold: the old and new
+ * envelopes are not interchangeable in either direction. Three independent
+ * mechanisms carry it, and none of them is "the verifier remembers to check":
+ *
+ * 1. **Different signed bytes.** {@link TASK_ASSERTION_DOMAIN_PREFIX} is
+ *    non-prefix with every other domain this device key signs under, so a
+ *    signature made in one lane cannot be reinterpreted in another even if the
+ *    claim sets were made to coincide.
+ * 2. **Different strict schemas.** `schema` is a literal and `protected` is a
+ *    `strictObject`, so a device envelope fails
+ *    {@link parseTaskAssertionEnvelope} on its missing `taskId`/`agentRef`/
+ *    `toolsetId` and a task envelope fails
+ *    {@link parseDeviceAssertionEnvelope} on those same claims being unknown.
+ * 3. **Different replay keys.** {@link DeviceAssertionReplayConsumeInput}
+ *    carries a required `schema` segment (§8.2(2)), so the two lanes' ledgers
+ *    are distinguishable and neither can burn the other's `jti`.
+ *
+ * What is deliberately NOT duplicated: `jti`/signature encodings, the audience
+ * byte bound, {@link DEVICE_ASSERTION_MAX_TTL_MS}, the window rule and the
+ * device-row rule are the SAME validators the device lane uses, referenced not
+ * copied. Contract §8.1: the task lane inherits the SDK's existing limits and
+ * does not define a second, looser set.
+ *
+ * The claim set carries no caller identity for the reason stated at the top of
+ * this file — under one UID every process can reach the control socket, so a
+ * self-reported "who asked" is synthesized authority. The task/AgentRef binding
+ * here is authority precisely because the daemon signs it after checking its
+ * own local registry, not because a caller sent it.
+ */
+/** Bound on each AgentRef scalar, in UTF-8 bytes. Mirrors `AGENT_REF_MAX_BYTES` in `@byok-sdk/protocol`. */
+export declare const TASK_ASSERTION_AGENT_REF_MAX_BYTES = 160;
+/** Bound on `toolsetId`. Mirrors the `ToolsetIdSchema` bound in `@byok-sdk/protocol`. */
+export declare const TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH = 128;
+/** The frozen offer's Agent identity. Same shape and same rules as the SDK's `AgentRefSchema`. */
+export declare const TaskAssertionAgentRefSchema: z.ZodObject<{
+    agentId: z.ZodString;
+    profileRevision: z.ZodString;
+}, z.core.$strict>;
+export type TaskAssertionAgentRef = z.infer<typeof TaskAssertionAgentRefSchema>;
+/**
+ * The signed task claim set: the device claim set plus the three bindings that
+ * make the assertion task-scoped, every member required for the same reason the
+ * device claims are.
+ */
+export declare const TaskAssertionClaimsSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    issuer: z.ZodString;
+    productId: z.ZodString;
+    deviceId: z.ZodString;
+    audience: z.ZodString;
+    jti: z.ZodString;
+    issuedAt: z.ZodISODateTime;
+    expiresAt: z.ZodISODateTime;
+    taskId: z.ZodString;
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    toolsetId: z.ZodString;
+}, z.core.$strict>;
+export type TaskAssertionClaims = z.infer<typeof TaskAssertionClaimsSchema>;
+export declare const TaskAssertionEnvelopeV1Schema: z.ZodObject<{
+    schema: z.ZodLiteral<"byok-task-assertion-v1">;
+    algorithm: z.ZodEnum<{
+        ed25519: "ed25519";
+    }>;
+    protected: z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        issuer: z.ZodString;
+        productId: z.ZodString;
+        deviceId: z.ZodString;
+        audience: z.ZodString;
+        jti: z.ZodString;
+        issuedAt: z.ZodISODateTime;
+        expiresAt: z.ZodISODateTime;
+        taskId: z.ZodString;
+        agentRef: z.ZodObject<{
+            agentId: z.ZodString;
+            profileRevision: z.ZodString;
+        }, z.core.$strict>;
+        toolsetId: z.ZodString;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+export type TaskAssertionEnvelopeV1 = z.infer<typeof TaskAssertionEnvelopeV1Schema>;
+/**
+ * Parses a task envelope fail-closed. A device assertion is not a degraded task
+ * assertion and is rejected here, not tolerated (§8.1: task lane zero fallback).
+ *
+ * @throws {ByokCoreError} code `assertion_envelope_invalid`.
+ */
+export declare function parseTaskAssertionEnvelope(input: unknown): TaskAssertionEnvelopeV1;
+/**
+ * Projects task claims into the exact JSON object that gets canonicalized.
+ *
+ * Built field by field, like the device projection, and covering EVERY claim —
+ * contract §8.1 requires the canonical projection to include all added claims,
+ * so an unsigned `taskId`, `agentRef` or `toolsetId` would be a claim a verifier
+ * reads but no signature covers.
+ */
+export declare function taskAssertionCanonicalClaims(claims: TaskAssertionClaims): JsonObject;
+/** Canonical JSON text of the task claim set, without the domain prefix. */
+export declare function taskAssertionCanonicalJson(claims: TaskAssertionClaims): string;
+/**
+ * The exact bytes a daemon signs and a verifier reconstructs:
+ * `byok-task-assertion-v1\n` followed by the canonical claim JSON, UTF-8
+ * encoded.
+ *
+ * Frozen by `src/__tests__/golden/task-assertion-v1.canonical.json`.
+ */
+export declare function taskAssertionSigningInput(claims: TaskAssertionClaims): Uint8Array;
+/**
+ * Verifies a task assertion and returns its claims, or `undefined`.
+ *
+ * The twin of {@link verifyDeviceAssertion}, with the same
+ * collapse-to-`undefined` discipline, the same injected row lookup, and the
+ * same window and ceiling rules ({@link assertionWindowAdmits},
+ * {@link resolveMaxLifetimeMs}) — and a schema this function will not widen: a
+ * `byok-device-assertion-v1` envelope is rejected at the parse step.
+ *
+ * What the caller MUST still do, exactly as in the device lane: compare
+ * `issuer`/`productId`/`audience` against its own deployment, burn the `jti`
+ * under this envelope's `schema` segment, and check that `taskId`/`agentRef`/
+ * `toolsetId` belong to the frozen offer (§8.2(2)) — the last of which is Host
+ * authority that core cannot hold.
+ */
+export declare function verifyTaskAssertion(input: unknown, deps: DeviceAssertionVerifyDeps): Promise<TaskAssertionClaims | undefined>;
+/**
+ * Audit-safe result of a consumed TASK assertion; no credential or signature is
+ * retained.
+ *
+ * Deliberately NOT an extension of {@link AuthenticatedDeviceAssertion}. It was
+ * one, and that was the same mistake in the type system that §8.1 forbids on
+ * the wire: an extension is assignable to the thing it extends, so every
+ * consumer written for device authority would have accepted a task credential
+ * silently, with no fallback ever written down. The two results share
+ * {@link AuthenticatedAssertionBase} and differ in `lane`, so a consumer that
+ * must accept exactly one of them compares one field, and a consumer that must
+ * accept either says so with {@link AuthenticatedAssertion}.
+ */
+export interface AuthenticatedTaskAssertion extends AuthenticatedAssertionBase {
+    readonly lane: 'task';
+    readonly taskId: string;
+    readonly agentRef: TaskAssertionAgentRef;
+    readonly toolsetId: string;
+}
+/**
+ * Either lane's result, discriminated by `lane`.
+ *
+ * For the consumer that genuinely serves both (an audit projection, a ledger
+ * writer). A consumer that serves ONE lane must name that lane's type instead —
+ * this union exists so "both" is stated on purpose, not reached by accident.
+ */
+export type AuthenticatedAssertion = AuthenticatedDeviceAssertion | AuthenticatedTaskAssertion;
+/**
+ * Authenticate one task assertion and atomically consume its JTI under the
+ * `byok-task-assertion-v1` replay segment.
+ *
+ * Identical in shape and failure discipline to
+ * {@link authenticateDeviceAssertion}: every invalid state collapses to
+ * `undefined`, and a replay-store operational failure REJECTS rather than
+ * degrading to signature-only acceptance (§8.2(2): an unavailable replay store
+ * fails, it does not downgrade authentication).
+ *
+ * Consumption is the last step, after every binding comparison, so a rejected
+ * assertion never burns a key — the "reject before side effects" ordering AC11
+ * requires. The frozen-offer check (`taskId`/`agentRef`/`toolsetId` belong to
+ * this Execution) is deliberately NOT here: that authority lives in the Host,
+ * and a core function that accepted it as an argument would be inviting a
+ * caller to synthesize it.
+ */
+export declare function authenticateTaskAssertion(input: unknown, deps: AuthenticateDeviceAssertionDeps): Promise<AuthenticatedTaskAssertion | undefined>;
+export {};

package/dist/index.d.ts

@@ -39,7 +39,8 @@ export { CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHOD
 export { DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, canonicalizeJson, canonicalizeJsonBytes, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, parseDeviceProofEnvelope, } from './attestation';
 export type { DeviceProofAlgorithm, DeviceProofEnvelopeV1, DeviceProofProtectedClaims, DeviceProofVerifier, DeviceProofVerifyInput, JsonObject, JsonPrimitive, JsonValue, } from './attestation';
 export { authenticateDeviceAssertion, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, parseDeviceAssertionEnvelope, verifyDeviceAssertion, } from './device-assertion';
-export type { AuthenticateDeviceAssertionDeps, AuthenticatedDeviceAssertion, DeviceAssertionAlgorithm, DeviceAssertionAuthorityRow, DeviceAssertionClaims, DeviceAssertionDeviceRow, DeviceAssertionEnvelopeV1, DeviceAssertionExpectedBinding, DeviceAssertionReplayConsumeInput, DeviceAssertionReplayAuthority, DeviceAssertionVerifier, DeviceAssertionVerifyDeps, DeviceAssertionVerifyInput, } from './device-assertion';
+export { authenticateTaskAssertion, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, parseTaskAssertionEnvelope, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, verifyTaskAssertion, } from './device-assertion';
+export type { AuthenticateDeviceAssertionDeps, AuthenticatedAssertion, AuthenticatedDeviceAssertion, AuthenticatedTaskAssertion, DeviceAssertionAlgorithm, DeviceAssertionAuthorityRow, DeviceAssertionClaims, DeviceAssertionDeviceRow, DeviceAssertionEnvelopeV1, DeviceAssertionExpectedBinding, DeviceAssertionReplayConsumeInput, DeviceAssertionReplayAuthority, DeviceAssertionReplaySchemaId, DeviceAssertionVerifier, DeviceAssertionVerifyDeps, DeviceAssertionVerifyInput, TaskAssertionAgentRef, TaskAssertionClaims, TaskAssertionEnvelopeV1, } from './device-assertion';
 export { NONCE_SIGNING_DOMAIN, nonceSigningBytes } from './pairing';
 export { IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryMailboxStore, InMemoryDeviceAssertionReplayAuthority, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, createInMemoryCoreStores, createInMemoryCoreCompositionWithClock, createMutableClock, } from './in-memory/index';
 export type { InMemoryCoreComposition, InMemoryCoreOptions } from './in-memory/index';

package/dist/index.js

@@ -746,6 +746,9 @@ function deviceProofSigningInput(claims) {
 var DEVICE_ASSERTION_SCHEMA_ID = "byok-device-assertion-v1";
 var DEVICE_ASSERTION_DOMAIN_PREFIX = "byok-device-assertion-v1\n";
 var DEVICE_ASSERTION_VERSION = 1;
+var TASK_ASSERTION_SCHEMA_ID = "byok-task-assertion-v1";
+var TASK_ASSERTION_DOMAIN_PREFIX = "byok-task-assertion-v1\n";
+var TASK_ASSERTION_VERSION = 1;
 var DEVICE_ASSERTION_ALGORITHMS = ["ed25519"];
 var DEVICE_ASSERTION_DEFAULT_TTL_MS = 12e4;
 var DEVICE_ASSERTION_MAX_TTL_MS = 3e5;
@@ -755,6 +758,9 @@ var SIGNATURE_PATTERN = /^[A-Za-z0-9_-]{86}$/;
 function utf8ByteLength(value) {
   return new TextEncoder().encode(value).length;
 }
+var ASSERTION_AUDIENCE = z.string().min(1).refine((value) => utf8ByteLength(value) <= DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, {
+  message: `audience must be at most ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
+});
 var DeviceAssertionClaimsSchema = z.strictObject({
   version: z.literal(DEVICE_ASSERTION_VERSION),
   /** The paired server's origin, normalized (`new URL(serverUrl).origin`). */
@@ -763,9 +769,7 @@ var DeviceAssertionClaimsSchema = z.strictObject({
   /** The device row this assertion claims to be. A lookup key, never authority — the row is the authority. */
   deviceId: z.string().min(1),
   /** Exactly one audience, compared with `===` by every verifier. Never an array, never a prefix. */
-  audience: z.string().min(1).refine((value) => utf8ByteLength(value) <= DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, {
-    message: `audience must be at most ${DEVICE_ASSERTION_AUDIENCE_MAX_BYTES} UTF-8 bytes`
-  }),
+  audience: ASSERTION_AUDIENCE,
   /** 128-bit CSPRNG token, base64url unpadded. The verifier burns it; the signer never reuses one. */
   jti: z.string().regex(JTI_PATTERN),
   issuedAt: z.iso.datetime(),
@@ -821,11 +825,26 @@ function isUsableDeviceRow(row) {
   const key = row.publicKeyJwkX;
   return typeof key === "string" && EDDSA_JWK_X_PATTERN.test(key);
 }
-async function verifyDeviceAssertion(input, deps) {
-  const maxLifetimeMs = deps.maxLifetimeMs ?? DEVICE_ASSERTION_MAX_TTL_MS;
+function resolveMaxLifetimeMs(requested) {
+  const maxLifetimeMs = requested ?? DEVICE_ASSERTION_MAX_TTL_MS;
   if (!Number.isSafeInteger(maxLifetimeMs) || maxLifetimeMs <= 0 || maxLifetimeMs > DEVICE_ASSERTION_MAX_TTL_MS) {
     return void 0;
   }
+  return maxLifetimeMs;
+}
+function assertionWindowAdmits(claims, now, maxLifetimeMs) {
+  const issuedAt = parseInstant(claims.issuedAt);
+  const expiresAt = parseInstant(claims.expiresAt);
+  if (issuedAt === void 0 || expiresAt === void 0) return false;
+  if (expiresAt <= issuedAt) return false;
+  if (expiresAt - issuedAt > maxLifetimeMs) return false;
+  const instant = now.getTime();
+  if (!Number.isFinite(instant)) return false;
+  return instant >= issuedAt && instant < expiresAt;
+}
+async function verifyDeviceAssertion(input, deps) {
+  const maxLifetimeMs = resolveMaxLifetimeMs(deps.maxLifetimeMs);
+  if (maxLifetimeMs === void 0) return void 0;
   let envelope;
   try {
     envelope = parseDeviceAssertionEnvelope(input);
@@ -835,14 +854,7 @@ async function verifyDeviceAssertion(input, deps) {
   const claims = envelope.protected;
   const row = await deps.lookupDevice(claims.deviceId);
   if (!isUsableDeviceRow(row)) return void 0;
-  const issuedAt = parseInstant(claims.issuedAt);
-  const expiresAt = parseInstant(claims.expiresAt);
-  if (issuedAt === void 0 || expiresAt === void 0) return void 0;
-  if (expiresAt <= issuedAt) return void 0;
-  if (expiresAt - issuedAt > maxLifetimeMs) return void 0;
-  const now = deps.now.getTime();
-  if (!Number.isFinite(now)) return void 0;
-  if (now < issuedAt || now >= expiresAt) return void 0;
+  if (!assertionWindowAdmits(claims, deps.now, maxLifetimeMs)) return void 0;
   const verified = await deps.verifier.verify({
     algorithm: envelope.algorithm,
     // The row's key, never an envelope-supplied one.
@@ -882,6 +894,7 @@ async function authenticateDeviceAssertion(input, deps) {
     return void 0;
   }
   const consumed = await deps.replay.consume({
+    schema: DEVICE_ASSERTION_SCHEMA_ID,
     tenantId: authorityRow.tenantId,
     issuer: claims.issuer,
     productId: authorityRow.productId,
@@ -892,6 +905,7 @@ async function authenticateDeviceAssertion(input, deps) {
   });
   if (!consumed) return void 0;
   return {
+    lane: "device",
     device: {
       kind: "device",
       tenantId: authorityRow.tenantId,
@@ -905,6 +919,162 @@ async function authenticateDeviceAssertion(input, deps) {
     expiresAt: claims.expiresAt
   };
 }
+var TASK_ASSERTION_AGENT_REF_MAX_BYTES = 160;
+var TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH = 128;
+var AGENT_REF_VALUE = z.string().min(1).max(TASK_ASSERTION_AGENT_REF_MAX_BYTES).refine((value) => utf8ByteLength(value) <= TASK_ASSERTION_AGENT_REF_MAX_BYTES, {
+  message: `AgentRef values must not exceed ${TASK_ASSERTION_AGENT_REF_MAX_BYTES} UTF-8 bytes`
+}).regex(/^[^\u0000-\u001f\u007f\r\n]+$/u, "AgentRef values must not contain control characters");
+var WINDOWS_RESERVED_AGENT_SEGMENT = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
+var TaskAssertionAgentRefSchema = z.object({
+  agentId: AGENT_REF_VALUE.regex(/^[^\\/:<>"|?*]+$/u, "agentId must be one portable pathname segment").refine((value) => value !== "." && value !== "..", "agentId must not be a dot segment").refine(
+    (value) => !/[. ]$/u.test(value) && !WINDOWS_RESERVED_AGENT_SEGMENT.test(value),
+    "agentId must be a portable Windows-safe pathname segment"
+  ),
+  /**
+   * From the FROZEN offer. Contract §8.1 forbids substituting the current
+   * revision read from a working directory's `profile.json`; this module
+   * cannot enforce that (it never reads a file) — the signer's contract does.
+   */
+  profileRevision: AGENT_REF_VALUE
+}).strict();
+var TOOLSET_ID_VALUE = z.string().min(1).max(TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH).regex(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u, "toolset ids must be lowercase logical identifiers");
+var TASK_ID_VALUE = z.string().min(1);
+var TaskAssertionClaimsSchema = z.strictObject({
+  version: z.literal(TASK_ASSERTION_VERSION),
+  /** The paired server's origin, normalized (`new URL(serverUrl).origin`). */
+  issuer: z.string().min(1),
+  productId: z.string().min(1),
+  /** The device row this assertion claims to be. A lookup key, never authority. */
+  deviceId: z.string().min(1),
+  /** Exactly one audience, compared with `===`. Participates in the replay key (§8.2(2)). */
+  audience: ASSERTION_AUDIENCE,
+  /** Same 128-bit CSPRNG token shape the device lane uses; burned once per `schema` segment. */
+  jti: z.string().regex(JTI_PATTERN),
+  issuedAt: z.iso.datetime(),
+  expiresAt: z.iso.datetime(),
+  /** The only execution locator (§8.1). No attemptId is minted beside it. */
+  taskId: TASK_ID_VALUE,
+  /** The frozen offer's Agent identity, at the SDK's full AgentRef strength. */
+  agentRef: TaskAssertionAgentRefSchema,
+  /** The frozen toolset this invocation belongs to (the wire's `toolset` field). */
+  toolsetId: TOOLSET_ID_VALUE
+});
+var TaskAssertionEnvelopeV1Schema = z.strictObject({
+  schema: z.literal(TASK_ASSERTION_SCHEMA_ID),
+  algorithm: z.enum(DEVICE_ASSERTION_ALGORITHMS),
+  protected: TaskAssertionClaimsSchema,
+  /** Raw 64-byte Ed25519 signature, base64url unpadded — the device lane's encoding, unchanged. */
+  signature: z.string().regex(SIGNATURE_PATTERN)
+});
+function parseTaskAssertionEnvelope(input) {
+  const result = TaskAssertionEnvelopeV1Schema.safeParse(input);
+  if (!result.success) {
+    throw new ByokCoreError(
+      "assertion_envelope_invalid",
+      `Invalid task assertion envelope: ${result.error.issues.map((issue) => `${issue.path.join(".") || "<root>"}: ${issue.message}`).join("; ")}`,
+      { cause: result.error }
+    );
+  }
+  return result.data;
+}
+function taskAssertionCanonicalClaims(claims) {
+  const canonical = {
+    version: claims.version,
+    issuer: claims.issuer,
+    productId: claims.productId,
+    deviceId: claims.deviceId,
+    audience: claims.audience,
+    jti: claims.jti,
+    issuedAt: claims.issuedAt,
+    expiresAt: claims.expiresAt,
+    taskId: claims.taskId,
+    agentRef: {
+      agentId: claims.agentRef.agentId,
+      profileRevision: claims.agentRef.profileRevision
+    },
+    toolsetId: claims.toolsetId
+  };
+  return canonical;
+}
+function taskAssertionCanonicalJson(claims) {
+  return canonicalizeJson(taskAssertionCanonicalClaims(claims));
+}
+function taskAssertionSigningInput(claims) {
+  return new TextEncoder().encode(
+    TASK_ASSERTION_DOMAIN_PREFIX + taskAssertionCanonicalJson(claims)
+  );
+}
+async function verifyTaskAssertion(input, deps) {
+  const maxLifetimeMs = resolveMaxLifetimeMs(deps.maxLifetimeMs);
+  if (maxLifetimeMs === void 0) return void 0;
+  let envelope;
+  try {
+    envelope = parseTaskAssertionEnvelope(input);
+  } catch {
+    return void 0;
+  }
+  const claims = envelope.protected;
+  const row = await deps.lookupDevice(claims.deviceId);
+  if (!isUsableDeviceRow(row)) return void 0;
+  if (!assertionWindowAdmits(claims, deps.now, maxLifetimeMs)) return void 0;
+  const verified = await deps.verifier.verify({
+    algorithm: envelope.algorithm,
+    publicKey: row.publicKeyJwkX,
+    signature: envelope.signature,
+    signingInput: taskAssertionSigningInput(claims)
+  });
+  if (!verified) return void 0;
+  return claims;
+}
+async function authenticateTaskAssertion(input, deps) {
+  if (!isNonEmptyExactString(deps.expected.issuer) || !isNonEmptyExactString(deps.expected.productId) || !isNonEmptyExactString(deps.expected.audience) || utf8ByteLength(deps.expected.audience) > DEVICE_ASSERTION_AUDIENCE_MAX_BYTES) {
+    return void 0;
+  }
+  let authorityRow;
+  const claims = await verifyTaskAssertion(input, {
+    verifier: deps.verifier,
+    lookupDevice: async (deviceId) => {
+      const row = await deps.lookupDevice(deviceId);
+      if (!isAuthorityRow(row, deviceId)) return void 0;
+      authorityRow = row;
+      return { publicKeyJwkX: row.publicKeyJwkX, revoked: row.revoked };
+    },
+    now: deps.now,
+    ...deps.maxLifetimeMs === void 0 ? {} : { maxLifetimeMs: deps.maxLifetimeMs }
+  });
+  if (claims === void 0 || authorityRow === void 0) return void 0;
+  if (claims.issuer !== deps.expected.issuer || claims.productId !== deps.expected.productId || claims.audience !== deps.expected.audience || authorityRow.productId !== deps.expected.productId || authorityRow.deviceId !== claims.deviceId) {
+    return void 0;
+  }
+  const consumed = await deps.replay.consume({
+    schema: TASK_ASSERTION_SCHEMA_ID,
+    tenantId: authorityRow.tenantId,
+    issuer: claims.issuer,
+    productId: authorityRow.productId,
+    deviceId: authorityRow.deviceId,
+    audience: claims.audience,
+    jti: claims.jti,
+    expiresAt: claims.expiresAt
+  });
+  if (!consumed) return void 0;
+  return {
+    lane: "task",
+    device: {
+      kind: "device",
+      tenantId: authorityRow.tenantId,
+      productId: authorityRow.productId,
+      deviceId: authorityRow.deviceId
+    },
+    issuer: claims.issuer,
+    audience: claims.audience,
+    jti: claims.jti,
+    issuedAt: claims.issuedAt,
+    expiresAt: claims.expiresAt,
+    taskId: claims.taskId,
+    agentRef: claims.agentRef,
+    toolsetId: claims.toolsetId
+  };
+}
 
 // src/pairing.ts
 var NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
@@ -2013,6 +2183,7 @@ function replayKey(input) {
     input.productId,
     input.deviceId,
     input.audience,
+    input.schema,
     input.jti
   ]);
 }
@@ -2063,6 +2234,6 @@ function createInMemoryCoreCompositionWithClock() {
   return { stores: createInMemoryCoreStores({ clock }).stores, clock };
 }
 
-export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SkillPackFileSchema, SkillPackManifestSchema, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, assertCanonicalTimestamp, assertCapability, authenticateDeviceAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseSkillFrontmatter, parseSkillPackManifest, principalTenant, skillPackContentHashInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion };
+export { BOARD_STATUSES, BOARD_TRANSITIONS, ByokCoreError, CANONICAL_TIMESTAMP_PATTERN, CAPABILITY_DECLARATION_SCHEMA_ID, CAPABILITY_NAME_PATTERN, CONTENT_HASH_PATTERN, CORE_ERROR_CODES, CORE_NON_COMPOSITION_PORT_NAMES, CORE_PORT_INTERFACES, CORE_PORT_METHODS, CORE_STORE_NAMES, CapabilityDeclarationSchema, CoreConflictError, DEVICE_ASSERTION_ALGORITHMS, DEVICE_ASSERTION_AUDIENCE_MAX_BYTES, DEVICE_ASSERTION_DEFAULT_TTL_MS, DEVICE_ASSERTION_DOMAIN_PREFIX, DEVICE_ASSERTION_MAX_TTL_MS, DEVICE_ASSERTION_SCHEMA_ID, DEVICE_ASSERTION_VERSION, DEVICE_PROOF_ALGORITHMS, DEVICE_PROOF_DOMAIN_PREFIX, DEVICE_PROOF_HEADER, DEVICE_PROOF_SCHEMA_ID, DEVICE_PROOF_VERSION, DeviceAssertionClaimsSchema, DeviceAssertionEnvelopeV1Schema, DeviceProofEnvelopeV1Schema, DeviceProofProtectedClaimsSchema, IN_MEMORY_CLOCK_EPOCH, InMemoryBoardStore, InMemoryDeviceAssertionReplayAuthority, InMemoryMailboxStore, InMemoryObjectStore, InMemoryPresenceStore, InMemoryQuotaStore, InMemorySkillPackStore, InMemoryTruthStore, MAILBOX_MESSAGE_STATES, NONCE_SIGNING_DOMAIN, OBJECT_KEY_PREFIX_PATTERN, OBJECT_STATES, OBJECT_STATE_TRANSITIONS, PRESENCE_LEVELS, PRINCIPAL_KINDS, SKILL_FRONTMATTER_FIELDS, SKILL_PACK_DESCRIPTION_MAX_LENGTH, SKILL_PACK_ENTRY_PATH, SKILL_PACK_FILE_MAX_BYTES, SKILL_PACK_FILE_PATH_MAX_LENGTH, SKILL_PACK_FILE_PATH_PATTERN, SKILL_PACK_FORBIDDEN_FIELDS, SKILL_PACK_MANIFEST_SCHEMA_ID, SKILL_PACK_MAX_BYTES, SKILL_PACK_MAX_FILES, SKILL_PACK_NAME_MAX_LENGTH, SKILL_PACK_NAME_PATTERN, SKILL_PACK_REJECTIONS, SKILL_PACK_VERSION_PATTERN, STORAGE_ERROR_CODES, STORAGE_ERROR_HTTP_STATUS, STORAGE_RESERVATION_STATES, STORAGE_WRITE_KINDS, STORAGE_WRITE_POSTURES, SkillPackFileSchema, SkillPackManifestSchema, TASK_ASSERTION_AGENT_REF_MAX_BYTES, TASK_ASSERTION_DOMAIN_PREFIX, TASK_ASSERTION_SCHEMA_ID, TASK_ASSERTION_TOOLSET_ID_MAX_LENGTH, TASK_ASSERTION_VERSION, TENANT_ID_MAX_LENGTH, TENANT_KEY_SEPARATOR, TRUTH_RECORD_KINDS, TaskAssertionAgentRefSchema, TaskAssertionClaimsSchema, TaskAssertionEnvelopeV1Schema, assertCanonicalTimestamp, assertCapability, authenticateDeviceAssertion, authenticateTaskAssertion, canonicalizeJson, canonicalizeJsonBytes, checkSkillPackEntry, checkSkillPackFileContent, checkSkillPackManifest, contentHash, createInMemoryCoreCompositionWithClock, createInMemoryCoreStores, createMutableClock, deviceAssertionCanonicalClaims, deviceAssertionCanonicalJson, deviceAssertionSigningInput, deviceProofCanonicalClaims, deviceProofCanonicalJson, deviceProofSigningInput, hasCapability, isCanonicalTimestamp, isContentHash, isControlPlanePrincipal, isCoreConflictError, isCoreError, isDevicePrincipal, isLegalBoardTransition, isLegalObjectTransition, isSkillPackPathSafe, isTenantId, nonceSigningBytes, objectKeyPrefix, parseCapabilityDeclaration, parseDeviceAssertionEnvelope, parseDeviceProofEnvelope, parseSkillFrontmatter, parseSkillPackManifest, parseTaskAssertionEnvelope, principalTenant, skillPackContentHashInput, taskAssertionCanonicalClaims, taskAssertionCanonicalJson, taskAssertionSigningInput, tenantId, tenantKey, tenantObjectKey, verifyDeviceAssertion, verifyTaskAssertion };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map