@byok-sdk/protocol 0.21.0 → 0.23.0

package/dist/input-preparation.d.ts

@@ -36,7 +36,7 @@ import { z } from 'zod';
  * below. See `INPUT_PREPARATION_VERSION` in the client for what each version
  * changed.
  */
-export declare const INPUT_PREPARATION_WIRE_VERSION: 6;
+export declare const INPUT_PREPARATION_WIRE_VERSION: 8;
 /**
  * Capability required before a task-free remote input preparation — or a
  * prepared Execution — is admitted: `agent-input-preparation-v<N>`, where
@@ -59,7 +59,7 @@ export declare const INPUT_PREPARATION_WIRE_VERSION: 6;
  * devices as a pair is the operator precondition for the cut (`docs/spec.md`,
  * bounded admission); nothing here parses an older receipt.
  */
-export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v6";
+export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v8";
 /** The preparation surface uses the package-wide lowercase `sha256:<hex>` transport form. */
 export declare const InputPreparationContentHashSchema: z.ZodString;
 /**
@@ -98,6 +98,13 @@ export declare const InputPreparationPermissionModeSchema: z.ZodEnum<{
     readonly: "readonly";
 }>;
 export type InputPreparationPermissionMode = z.infer<typeof InputPreparationPermissionModeSchema>;
+/** Explicit prepared SDK memory selection; never defaulted. */
+export declare const PreparedAgentMemoryModeSchema: z.ZodEnum<{
+    none: "none";
+    read: "read";
+    "read-write": "read-write";
+}>;
+export type PreparedAgentMemoryMode = z.infer<typeof PreparedAgentMemoryModeSchema>;
 /**
  * The canonical Host source snapshot this input was assembled from. Both
  * values are Host authority carried verbatim so the receipt binds the exact
@@ -296,77 +303,9 @@ export declare const InputPreparationSelectionSchema: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type InputPreparationSelection = z.infer<typeof InputPreparationSelectionSchema>;
-export declare const InputPreparationContextFileSchema: z.ZodObject<{
-    path: z.ZodString;
-    content: z.ZodString;
-}, z.core.$strict>;
-/**
- * The three documentation locations the native prompt renderer names.
- *
- * The wire field names are this SDK's own and do not track upstream Pi's
- * (`readme`/`docs`/`examples`): the contract a Host integrates against is this
- * one, and renaming a frozen wire field because a runtime renamed a parameter
- * would be a breaking change to every Host for no gain. The device adapter maps
- * these onto whatever the pinned runtime calls them.
- */
-export declare const InputPreparationDocsPathsSchema: z.ZodObject<{
-    readmePath: z.ZodString;
-    docsPath: z.ZodString;
-    examplesPath: z.ZodString;
-}, z.core.$strict>;
-/**
- * One skill the system prompt renders, stated as the closed set of fields the
- * renderer actually reads.
- *
- * Not a preformatted string: the native renderer owns the skill block's
- * markup, and a Host-rendered one would be a second renderer that could drift
- * from what a live session emits. Loader bookkeeping the prompt never reads
- * (`baseDir`, source info) is deliberately absent — the Host cannot know it and
- * the device must never invent it.
- */
-export declare const InputPreparationSkillSchema: z.ZodObject<{
-    name: z.ZodString;
-    description: z.ZodString;
-    filePath: z.ZodString;
-    disableModelInvocation: z.ZodBoolean;
-}, z.core.$strict>;
-export type InputPreparationSkill = z.infer<typeof InputPreparationSkillSchema>;
-/**
- * Explicit, already-authorized inputs for the native system prompt renderer.
- *
- * `toolSnippets` is PROMPT TEXT the Host authored — it is not the
- * model-visible tool schemas, which the device observes locally and the Host
- * never states (see this module's rule 1). `toolGuidelines` is the same kind of
- * value one level down: the guideline bullets a tool contributes, keyed by tool
- * name and bounded exactly like `toolSnippets` and `promptGuidelines`.
- *
- * `selectedTools` is deliberately absent for the same reason one level up: the
- * native contract requires that list to equal the model-visible manifest
- * exactly, so a Host stating it would be stating the manifest. The device
- * fills it from its own assembled tool surface.
- */
+/** Complete Host-authored prompt. No Pi renderer or device-local input is consulted. */
 export declare const InputPreparationPromptSnapshotSchema: z.ZodObject<{
-    customPrompt: z.ZodOptional<z.ZodString>;
-    appendSystemPrompt: z.ZodOptional<z.ZodString>;
-    cwd: z.ZodString;
-    toolSnippets: z.ZodRecord<z.ZodString, z.ZodString>;
-    toolGuidelines: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
-    promptGuidelines: z.ZodArray<z.ZodString>;
-    contextFiles: z.ZodArray<z.ZodObject<{
-        path: z.ZodString;
-        content: z.ZodString;
-    }, z.core.$strict>>;
-    skills: z.ZodArray<z.ZodObject<{
-        name: z.ZodString;
-        description: z.ZodString;
-        filePath: z.ZodString;
-        disableModelInvocation: z.ZodBoolean;
-    }, z.core.$strict>>;
-    docsPaths: z.ZodObject<{
-        readmePath: z.ZodString;
-        docsPath: z.ZodString;
-        examplesPath: z.ZodString;
-    }, z.core.$strict>;
+    systemPrompt: z.ZodString;
 }, z.core.$strict>;
 /**
  * One model-visible user message. Text-only: multimodal content and any extra
@@ -423,27 +362,7 @@ export type InputPreparationMessage = z.infer<typeof InputPreparationMessageSche
  */
 export declare const InputPreparationContextDocumentSchema: z.ZodObject<{
     prompt: z.ZodObject<{
-        customPrompt: z.ZodOptional<z.ZodString>;
-        appendSystemPrompt: z.ZodOptional<z.ZodString>;
-        cwd: z.ZodString;
-        toolSnippets: z.ZodRecord<z.ZodString, z.ZodString>;
-        toolGuidelines: z.ZodRecord<z.ZodString, z.ZodArray<z.ZodString>>;
-        promptGuidelines: z.ZodArray<z.ZodString>;
-        contextFiles: z.ZodArray<z.ZodObject<{
-            path: z.ZodString;
-            content: z.ZodString;
-        }, z.core.$strict>>;
-        skills: z.ZodArray<z.ZodObject<{
-            name: z.ZodString;
-            description: z.ZodString;
-            filePath: z.ZodString;
-            disableModelInvocation: z.ZodBoolean;
-        }, z.core.$strict>>;
-        docsPaths: z.ZodObject<{
-            readmePath: z.ZodString;
-            docsPath: z.ZodString;
-            examplesPath: z.ZodString;
-        }, z.core.$strict>;
+        systemPrompt: z.ZodString;
     }, z.core.$strict>;
     messages: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         role: z.ZodLiteral<"user">;
@@ -513,9 +432,10 @@ export type InputPreparationReadinessReason = z.infer<typeof InputPreparationRea
 export declare const InputPreparationRuntimeIdentitySchema: z.ZodObject<{
     packageName: z.ZodString;
     packageVersion: z.ZodString;
-    upstreamBase: z.ZodString;
+    tarballIntegrity: z.ZodString;
+    provenanceDigest: z.ZodString;
+    closureDigest: z.ZodString;
     upstreamCommit: z.ZodString;
-    forkBuild: z.ZodNumber;
     envelopeFormat: z.ZodString;
     requestFormat: z.ZodString;
     compilerVersion: z.ZodNumber;
@@ -728,6 +648,11 @@ export declare const InputPreparationArtifactSummarySchema: z.ZodObject<{
 }, z.core.$strict>;
 /** The immutable binding a receipt carries and a later consumer must re-present. */
 export declare const InputPreparationBindingSchema: z.ZodObject<{
+    agentMemory: z.ZodEnum<{
+        none: "none";
+        read: "read";
+        "read-write": "read-write";
+    }>;
     scopeId: z.ZodString;
     deviceId: z.ZodString;
     agentRef: z.ZodString;
@@ -751,9 +676,10 @@ export declare const InputPreparationBindingSchema: z.ZodObject<{
     runtime: z.ZodObject<{
         packageName: z.ZodString;
         packageVersion: z.ZodString;
-        upstreamBase: z.ZodString;
+        tarballIntegrity: z.ZodString;
+        provenanceDigest: z.ZodString;
+        closureDigest: z.ZodString;
         upstreamCommit: z.ZodString;
-        forkBuild: z.ZodNumber;
         envelopeFormat: z.ZodString;
         requestFormat: z.ZodString;
         compilerVersion: z.ZodNumber;
@@ -787,6 +713,11 @@ export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
         reserved: "reserved";
     }>;
     binding: z.ZodObject<{
+        agentMemory: z.ZodEnum<{
+            none: "none";
+            read: "read";
+            "read-write": "read-write";
+        }>;
         scopeId: z.ZodString;
         deviceId: z.ZodString;
         agentRef: z.ZodString;
@@ -810,9 +741,10 @@ export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
         runtime: z.ZodObject<{
             packageName: z.ZodString;
             packageVersion: z.ZodString;
-            upstreamBase: z.ZodString;
+            tarballIntegrity: z.ZodString;
+            provenanceDigest: z.ZodString;
+            closureDigest: z.ZodString;
             upstreamCommit: z.ZodString;
-            forkBuild: z.ZodNumber;
             envelopeFormat: z.ZodString;
             requestFormat: z.ZodString;
             compilerVersion: z.ZodNumber;

package/dist/messages.d.ts

@@ -737,6 +737,11 @@ export declare const TaskOfferPreparedPayloadSchema: z.ZodObject<{
         requestDigest: z.ZodString;
         artifactDigest: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
+    agentMemory: z.ZodEnum<{
+        none: "none";
+        read: "read";
+        "read-write": "read-write";
+    }>;
     egressPolicy: z.ZodObject<{
         policyRevision: z.ZodString;
         activity: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -1038,6 +1043,11 @@ export type AgentHomeProjectionPayload = z.infer<typeof AgentHomeProjectionPaylo
  * in the artifact binding; it is not a grant, and it authorizes nothing.
  */
 export declare const AgentInputPreparationPayloadSchema: z.ZodObject<{
+    agentMemory: z.ZodEnum<{
+        none: "none";
+        read: "read";
+        "read-write": "read-write";
+    }>;
     requestId: z.ZodUUID;
     agentRef: z.ZodObject<{
         agentId: z.ZodString;
@@ -2247,6 +2257,11 @@ declare const TASK_OFFER_PAYLOAD_SCHEMAS: {
             requestDigest: z.ZodString;
             artifactDigest: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
+        agentMemory: z.ZodEnum<{
+            none: "none";
+            read: "read";
+            "read-write": "read-write";
+        }>;
         egressPolicy: z.ZodObject<{
             policyRevision: z.ZodString;
             activity: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -2774,6 +2789,11 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
             requestDigest: z.ZodString;
             artifactDigest: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>;
+        agentMemory: z.ZodEnum<{
+            none: "none";
+            read: "read";
+            "read-write": "read-write";
+        }>;
         egressPolicy: z.ZodObject<{
             policyRevision: z.ZodString;
             activity: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -3067,6 +3087,11 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
         projection: z.ZodType<import("./agent-home-projection").AgentHomeProjectionValue, unknown, z.core.$ZodTypeInternals<import("./agent-home-projection").AgentHomeProjectionValue, unknown>>;
     }, z.core.$strict>;
     readonly 'agent.input.preparation': z.ZodObject<{
+        agentMemory: z.ZodEnum<{
+            none: "none";
+            read: "read";
+            "read-write": "read-write";
+        }>;
         requestId: z.ZodUUID;
         agentRef: z.ZodObject<{
             agentId: z.ZodString;
@@ -3184,6 +3209,9 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
             ruledResidualKeys: z.ZodArray<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>;
+    readonly 'provider.provisioning.available': z.ZodObject<{
+        requestId: z.ZodUUID;
+    }, z.core.$strict>;
     readonly 'task.approve': z.ZodObject<{
         approvalId: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
@@ -3425,7 +3453,7 @@ export declare const MESSAGE_TYPES: MessageType[];
  * (`envelope.ts`) to decide which branches require envelope `seq` (M1
  * redelivery cursor).
  */
-export declare const SERVER_TO_DAEMON_TYPES: readonly ["conn.ack", "task.offer", "task.offer_with_toolsets", "task.offer_for_agent", "task.offer_for_agent_with_egress", "task.offer_for_agent_with_egress_fresh", "task.offer_prepared", "agent.egress.ack", "agent.message.disposition", "agent.content.read", "agent.home.projection", "agent.input.preparation", "task.approve", "task.reject", "task.cancel", "task.steer"];
+export declare const SERVER_TO_DAEMON_TYPES: readonly ["conn.ack", "task.offer", "task.offer_with_toolsets", "task.offer_for_agent", "task.offer_for_agent_with_egress", "task.offer_for_agent_with_egress_fresh", "task.offer_prepared", "agent.egress.ack", "agent.message.disposition", "agent.content.read", "agent.home.projection", "agent.input.preparation", "provider.provisioning.available", "task.approve", "task.reject", "task.cancel", "task.steer"];
 /**
  * Message types the daemon sends to the server — the flip side of
  * {@link SERVER_TO_DAEMON_TYPES}. `conn.hello` is deliberately excluded: it's

package/dist/provider-provisioning.d.ts

@@ -0,0 +1,372 @@
+import { z } from 'zod';
+/**
+ * Sealed provider provisioning — the wire half.
+ *
+ * A Host provisions a device-local provider profile (and its API key) without
+ * the key ever crossing this SDK's wire. The ciphertext, its configuration and
+ * the device's pull of both travel over the HOST's own authenticated device
+ * routes; this package defines only:
+ *
+ * - the task-free server -> daemon notice `provider.provisioning.available`,
+ *   whose payload is exactly `{ requestId }` (see `messages.ts`);
+ * - the device capability that gates that notice;
+ * - the credential-free completion a device reports and the durable readback a
+ *   Host returns for it;
+ * - the device-proof operation name a device signs when it registers its
+ *   provider-secret sealing key.
+ *
+ * Notice-and-fetch is the point: the daemon journals mailbox rows before they
+ * are acknowledged and a mailbox never deletes an unacknowledged row, so a
+ * ciphertext carried inside the envelope would outlive the provisioning window
+ * in two places. The strict one-field payload makes that unrepresentable.
+ *
+ * Audiences, route paths and product names are Host vocabulary and stay out of
+ * this package.
+ */
+/** Device capability required before a Host may enqueue `provider.provisioning.available`. */
+export declare const PROVIDER_PROVISIONING_CAPABILITY: 'provider-provisioning.v1';
+/**
+ * Device-proof `operation` for the signed claim that registers the device's
+ * provider-secret sealing public key (`{ keyId, epoch, publicJwk }`).
+ */
+export declare const PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION: 'provider-secret-sealing-key.register';
+/**
+ * Server -> daemon: a provisioning request is waiting for this device.
+ *
+ * `.strict()` and exactly one field. There is deliberately no configuration,
+ * no ciphertext, no provider identity and no Agent identity: the device fetches
+ * all of that from the Host under its own device authentication, so a mailbox
+ * row or journal line never holds more than an opaque request id.
+ */
+export declare const ProviderProvisioningAvailablePayloadSchema: z.ZodObject<{
+    requestId: z.ZodUUID;
+}, z.core.$strict>;
+export type ProviderProvisioningAvailablePayload = z.infer<typeof ProviderProvisioningAvailablePayloadSchema>;
+export declare const PROVIDER_PROVISIONING_OPERATIONS: readonly ['configure', 'update_model', 'replace_secret', 'delete'];
+export declare const ProviderProvisioningOperationSchema: z.ZodEnum<{
+    configure: "configure";
+    delete: "delete";
+    replace_secret: "replace_secret";
+    update_model: "update_model";
+}>;
+export type ProviderProvisioningOperation = z.infer<typeof ProviderProvisioningOperationSchema>;
+/** PostgreSQL BIGINT maximum, carried as decimal text to avoid JavaScript precision loss. */
+export declare const PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM: '9223372036854775807';
+/**
+ * Non-secret, monotonic per-profile operation generation. It is bound into the
+ * sealed request's associated data and into the device's local state, so an
+ * older generation is always refused. Canonical positive decimal text.
+ */
+export declare const ProviderProvisioningOperationGenerationSchema: z.ZodString;
+export type ProviderProvisioningOperationGeneration = z.infer<typeof ProviderProvisioningOperationGenerationSchema>;
+/**
+ * SHA-256 of the canonical non-secret operation the device evaluated. Two
+ * completions for one request id are the same result only when this digest
+ * (and the rest of the completion) is identical. Pinned to `@byok-sdk/core`
+ * `providerProvisioningRequestDigest(request)` (the value `@byok-sdk/keys`
+ * returns as `result.requestDigest`); see docs/protocol.md §2.3.
+ */
+export declare const ProviderProvisioningOperationDigestSchema: z.ZodString;
+export type ProviderProvisioningOperationDigest = z.infer<typeof ProviderProvisioningOperationDigestSchema>;
+/**
+ * Closed rejection set. Codes name a failed check, never a value: no plaintext,
+ * no ciphertext, no OS error detail. `local_commit_interrupted` also covers a
+ * request that finds the same or another operation still pending locally.
+ *
+ * `request_expired` and `sealing_key_rotated` may also be decided by the Host
+ * before the device ever completes the request (see
+ * {@link PROVIDER_PROVISIONING_HOST_TERMINAL_CODES}).
+ */
+export declare const PROVIDER_PROVISIONING_REJECTION_CODES: readonly ['request_invalid', 'request_conflict', 'request_expired', 'request_not_yet_valid', 'request_window_invalid', 'sealing_key_rotated', 'enrollment_mismatch', 'agent_not_placed', 'config_digest_mismatch', 'operation_generation_stale', 'profile_changed', 'profile_not_found', 'credential_scope_mismatch', 'provider_kind_unsupported', 'pi_model_invalid', 'capabilities_invalid', 'seal_open_failed', 'secret_invalid', 'local_commit_interrupted', 'secret_store_unavailable'];
+export declare const ProviderProvisioningRejectionCodeSchema: z.ZodEnum<{
+    agent_not_placed: "agent_not_placed";
+    capabilities_invalid: "capabilities_invalid";
+    config_digest_mismatch: "config_digest_mismatch";
+    credential_scope_mismatch: "credential_scope_mismatch";
+    enrollment_mismatch: "enrollment_mismatch";
+    local_commit_interrupted: "local_commit_interrupted";
+    operation_generation_stale: "operation_generation_stale";
+    pi_model_invalid: "pi_model_invalid";
+    profile_changed: "profile_changed";
+    profile_not_found: "profile_not_found";
+    provider_kind_unsupported: "provider_kind_unsupported";
+    request_conflict: "request_conflict";
+    request_expired: "request_expired";
+    request_invalid: "request_invalid";
+    request_not_yet_valid: "request_not_yet_valid";
+    request_window_invalid: "request_window_invalid";
+    seal_open_failed: "seal_open_failed";
+    sealing_key_rotated: "sealing_key_rotated";
+    secret_invalid: "secret_invalid";
+    secret_store_unavailable: "secret_store_unavailable";
+}>;
+export type ProviderProvisioningRejectionCode = z.infer<typeof ProviderProvisioningRejectionCodeSchema>;
+/** Rejections a Host may record on its own authority, without a device completion. */
+export declare const PROVIDER_PROVISIONING_HOST_TERMINAL_CODES: readonly ["request_expired", "sealing_key_rotated"];
+/**
+ * Credential-free projection of the device's provider status after an applied
+ * operation. It reports WHETHER a secret is configured, never the secret, and
+ * carries no endpoint or auth material: those stay device-local.
+ */
+export declare const ProviderProvisioningProviderStatusSchema: z.ZodObject<{
+    profileRef: z.ZodString;
+    providerKind: z.ZodString;
+    modelId: z.ZodString;
+    capabilities: z.ZodArray<z.ZodEnum<{
+        "image-input": "image-input";
+    }>>;
+    secretConfigured: z.ZodBoolean;
+}, z.core.$strict>;
+export type ProviderProvisioningProviderStatus = z.infer<typeof ProviderProvisioningProviderStatusSchema>;
+/**
+ * Closed outcome set of the device's one post-apply check of the stored key
+ * against its vendor. It is a HINT for the Host UI, never a readiness input:
+ * a saved key is not a validated key, and a network failure does not block
+ * provisioning.
+ *
+ * - `credential_rejected`: the vendor explicitly refused the credential.
+ * - `rate_limited`, `quota_or_billing`, `model_not_permitted`: the credential
+ *   was accepted but the call could not be served for that reason.
+ * - `provider_error`: the vendor answered with an error that is none of the
+ *   classes above.
+ * - `unreachable`, `timeout`: no vendor answer within the device's bounds.
+ * - `not_run`: no check was made (for example `delete`, or an endpoint without
+ *   credential auth).
+ *
+ * No vendor text, status body or error detail crosses this boundary.
+ */
+export declare const PROVIDER_PROVISIONING_KEY_CHECK_RESULTS: readonly ['ok', 'credential_rejected', 'rate_limited', 'quota_or_billing', 'model_not_permitted', 'provider_error', 'unreachable', 'timeout', 'not_run'];
+export declare const ProviderProvisioningKeyCheckResultSchema: z.ZodEnum<{
+    credential_rejected: "credential_rejected";
+    model_not_permitted: "model_not_permitted";
+    not_run: "not_run";
+    ok: "ok";
+    provider_error: "provider_error";
+    quota_or_billing: "quota_or_billing";
+    rate_limited: "rate_limited";
+    timeout: "timeout";
+    unreachable: "unreachable";
+}>;
+export type ProviderProvisioningKeyCheckResult = z.infer<typeof ProviderProvisioningKeyCheckResultSchema>;
+export declare const ProviderProvisioningKeyCheckSchema: z.ZodObject<{
+    result: z.ZodEnum<{
+        credential_rejected: "credential_rejected";
+        model_not_permitted: "model_not_permitted";
+        not_run: "not_run";
+        ok: "ok";
+        provider_error: "provider_error";
+        quota_or_billing: "quota_or_billing";
+        rate_limited: "rate_limited";
+        timeout: "timeout";
+        unreachable: "unreachable";
+    }>;
+}, z.core.$strict>;
+export type ProviderProvisioningKeyCheck = z.infer<typeof ProviderProvisioningKeyCheckSchema>;
+/**
+ * The terminal, credential-free result of one provisioning request, reported
+ * by the device to the Host.
+ *
+ * `applied` carries the post-operation status and exact binding — both absent
+ * (`null`) for `delete` and only for `delete`. `configure` and
+ * `replace_secret` write a secret, so an applied result for either must report
+ * `secretConfigured: true`. `replace_secret` leaves the profile revision and
+ * hash unchanged; the binding it reports is the same exact binding as before.
+ * Every applied result carries the required `keyCheck` hint; a `delete` has no
+ * key left to check and must report `not_run`.
+ */
+export declare const ProviderProvisioningCompletionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    requestId: z.ZodUUID;
+    operation: z.ZodEnum<{
+        configure: "configure";
+        delete: "delete";
+        replace_secret: "replace_secret";
+        update_model: "update_model";
+    }>;
+    operationGeneration: z.ZodString;
+    operationDigest: z.ZodString;
+    outcome: z.ZodLiteral<"applied">;
+    providerStatus: z.ZodNullable<z.ZodObject<{
+        profileRef: z.ZodString;
+        providerKind: z.ZodString;
+        modelId: z.ZodString;
+        capabilities: z.ZodArray<z.ZodEnum<{
+            "image-input": "image-input";
+        }>>;
+        secretConfigured: z.ZodBoolean;
+    }, z.core.$strict>>;
+    binding: z.ZodNullable<z.ZodObject<{
+        profileRef: z.ZodString;
+        profileRevision: z.ZodString;
+        profileHash: z.ZodString;
+        modelId: z.ZodString;
+        requiredCapabilities: z.ZodArray<z.ZodEnum<{
+            "image-input": "image-input";
+        }>>;
+    }, z.core.$strict>>;
+    keyCheck: z.ZodObject<{
+        result: z.ZodEnum<{
+            credential_rejected: "credential_rejected";
+            model_not_permitted: "model_not_permitted";
+            not_run: "not_run";
+            ok: "ok";
+            provider_error: "provider_error";
+            quota_or_billing: "quota_or_billing";
+            rate_limited: "rate_limited";
+            timeout: "timeout";
+            unreachable: "unreachable";
+        }>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    requestId: z.ZodUUID;
+    operation: z.ZodEnum<{
+        configure: "configure";
+        delete: "delete";
+        replace_secret: "replace_secret";
+        update_model: "update_model";
+    }>;
+    operationGeneration: z.ZodString;
+    operationDigest: z.ZodString;
+    outcome: z.ZodLiteral<"rejected">;
+    code: z.ZodEnum<{
+        agent_not_placed: "agent_not_placed";
+        capabilities_invalid: "capabilities_invalid";
+        config_digest_mismatch: "config_digest_mismatch";
+        credential_scope_mismatch: "credential_scope_mismatch";
+        enrollment_mismatch: "enrollment_mismatch";
+        local_commit_interrupted: "local_commit_interrupted";
+        operation_generation_stale: "operation_generation_stale";
+        pi_model_invalid: "pi_model_invalid";
+        profile_changed: "profile_changed";
+        profile_not_found: "profile_not_found";
+        provider_kind_unsupported: "provider_kind_unsupported";
+        request_conflict: "request_conflict";
+        request_expired: "request_expired";
+        request_invalid: "request_invalid";
+        request_not_yet_valid: "request_not_yet_valid";
+        request_window_invalid: "request_window_invalid";
+        seal_open_failed: "seal_open_failed";
+        sealing_key_rotated: "sealing_key_rotated";
+        secret_invalid: "secret_invalid";
+        secret_store_unavailable: "secret_store_unavailable";
+    }>;
+}, z.core.$strict>], "outcome">;
+export type ProviderProvisioningCompletion = z.infer<typeof ProviderProvisioningCompletionSchema>;
+/**
+ * How the Host's durable record relates to the completion it was handed:
+ *
+ * - `recorded`: this completion became the request's first terminal fact.
+ * - `idempotent`: an identical completion (same operation digest and result)
+ *   was already recorded; the stored result is returned and nothing is
+ *   rewritten.
+ * - `conflict`: a different completion (different operation digest or result)
+ *   is already recorded; the stored one is returned unchanged.
+ * - `host_terminal`: the Host had already terminated the request on its own
+ *   authority ({@link PROVIDER_PROVISIONING_HOST_TERMINAL_CODES}), for example
+ *   because it expired before the device fetched it.
+ */
+export declare const PROVIDER_PROVISIONING_DISPOSITIONS: readonly ['recorded', 'idempotent', 'conflict', 'host_terminal'];
+export declare const ProviderProvisioningDispositionSchema: z.ZodEnum<{
+    conflict: "conflict";
+    host_terminal: "host_terminal";
+    idempotent: "idempotent";
+    recorded: "recorded";
+}>;
+export type ProviderProvisioningDisposition = z.infer<typeof ProviderProvisioningDispositionSchema>;
+/**
+ * The Host's durable terminal readback for one provisioning request.
+ *
+ * `completion` is the terminal fact the Host has STORED, which on `conflict`
+ * is not the one the device submitted. Every readback is terminal — there is
+ * no `pending` — so a daemon that holds one may acknowledge the notice: an
+ * expired, rotated, rejected or conflicting request is a deterministic end
+ * state that no redelivery can change.
+ */
+export declare const ProviderProvisioningReadbackSchema: z.ZodObject<{
+    tenantId: z.ZodString;
+    deviceId: z.ZodString;
+    requestId: z.ZodUUID;
+    disposition: z.ZodEnum<{
+        conflict: "conflict";
+        host_terminal: "host_terminal";
+        idempotent: "idempotent";
+        recorded: "recorded";
+    }>;
+    completion: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        requestId: z.ZodUUID;
+        operation: z.ZodEnum<{
+            configure: "configure";
+            delete: "delete";
+            replace_secret: "replace_secret";
+            update_model: "update_model";
+        }>;
+        operationGeneration: z.ZodString;
+        operationDigest: z.ZodString;
+        outcome: z.ZodLiteral<"applied">;
+        providerStatus: z.ZodNullable<z.ZodObject<{
+            profileRef: z.ZodString;
+            providerKind: z.ZodString;
+            modelId: z.ZodString;
+            capabilities: z.ZodArray<z.ZodEnum<{
+                "image-input": "image-input";
+            }>>;
+            secretConfigured: z.ZodBoolean;
+        }, z.core.$strict>>;
+        binding: z.ZodNullable<z.ZodObject<{
+            profileRef: z.ZodString;
+            profileRevision: z.ZodString;
+            profileHash: z.ZodString;
+            modelId: z.ZodString;
+            requiredCapabilities: z.ZodArray<z.ZodEnum<{
+                "image-input": "image-input";
+            }>>;
+        }, z.core.$strict>>;
+        keyCheck: z.ZodObject<{
+            result: z.ZodEnum<{
+                credential_rejected: "credential_rejected";
+                model_not_permitted: "model_not_permitted";
+                not_run: "not_run";
+                ok: "ok";
+                provider_error: "provider_error";
+                quota_or_billing: "quota_or_billing";
+                rate_limited: "rate_limited";
+                timeout: "timeout";
+                unreachable: "unreachable";
+            }>;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        requestId: z.ZodUUID;
+        operation: z.ZodEnum<{
+            configure: "configure";
+            delete: "delete";
+            replace_secret: "replace_secret";
+            update_model: "update_model";
+        }>;
+        operationGeneration: z.ZodString;
+        operationDigest: z.ZodString;
+        outcome: z.ZodLiteral<"rejected">;
+        code: z.ZodEnum<{
+            agent_not_placed: "agent_not_placed";
+            capabilities_invalid: "capabilities_invalid";
+            config_digest_mismatch: "config_digest_mismatch";
+            credential_scope_mismatch: "credential_scope_mismatch";
+            enrollment_mismatch: "enrollment_mismatch";
+            local_commit_interrupted: "local_commit_interrupted";
+            operation_generation_stale: "operation_generation_stale";
+            pi_model_invalid: "pi_model_invalid";
+            profile_changed: "profile_changed";
+            profile_not_found: "profile_not_found";
+            provider_kind_unsupported: "provider_kind_unsupported";
+            request_conflict: "request_conflict";
+            request_expired: "request_expired";
+            request_invalid: "request_invalid";
+            request_not_yet_valid: "request_not_yet_valid";
+            request_window_invalid: "request_window_invalid";
+            seal_open_failed: "seal_open_failed";
+            sealing_key_rotated: "sealing_key_rotated";
+            secret_invalid: "secret_invalid";
+            secret_store_unavailable: "secret_store_unavailable";
+        }>;
+    }, z.core.$strict>], "outcome">;
+    completedAt: z.ZodISODateTime;
+}, z.core.$strict>;
+export type ProviderProvisioningReadback = z.infer<typeof ProviderProvisioningReadbackSchema>;

package/dist/version.d.ts

@@ -107,5 +107,5 @@ export declare const STRICT_AGENT_ONLY_CAPABILITY: 'strict-agent-only';
  * cannot accidentally execute the instruction without the required tools.
  */
 export declare const CUSTOM_HARNESS_CAPABILITY: 'custom-harness';
-export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'result-document', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v6", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead"];
+export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'result-document', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v8", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1"];
 export type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/protocol",
-  "version": "0.21.0",
+  "version": "0.23.0",
   "description": "BYOK SDK wire protocol: envelope schema, message types, and codec helpers",
   "type": "module",
   "license": "MIT",