@byok-sdk/protocol 0.24.0 → 0.25.0-rc.2

package/dist/input-preparation-version.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The ONE version of the input-preparation contract, shared by this relay wire
+ * (the `agent.input.preparation` payload and the completion receipt summary)
+ * and by the device-local request, receipt and artifact
+ * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).
+ *
+ * The relay wire carries no version field of its own, so a version change is
+ * made visible where admission actually happens: in the capability token
+ * below. See `INPUT_PREPARATION_VERSION` in the client for what each version
+ * changed.
+ */
+export declare const INPUT_PREPARATION_WIRE_VERSION: 9;

package/dist/input-preparation-version.js

@@ -0,0 +1,6 @@
+// src/input-preparation-version.ts
+var INPUT_PREPARATION_WIRE_VERSION = 9;
+
+export { INPUT_PREPARATION_WIRE_VERSION };
+//# sourceMappingURL=input-preparation-version.js.map
+//# sourceMappingURL=input-preparation-version.js.map

package/dist/input-preparation-version.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/input-preparation-version.ts"],"names":[],"mappings":";AAWO,IAAM,8BAAA,GAAiC","file":"input-preparation-version.js","sourcesContent":["/**\n * The ONE version of the input-preparation contract, shared by this relay wire\n * (the `agent.input.preparation` payload and the completion receipt summary)\n * and by the device-local request, receipt and artifact\n * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).\n *\n * The relay wire carries no version field of its own, so a version change is\n * made visible where admission actually happens: in the capability token\n * below. See `INPUT_PREPARATION_VERSION` in the client for what each version\n * changed.\n */\nexport const INPUT_PREPARATION_WIRE_VERSION = 9 as const;\n"]}

package/dist/input-preparation.d.ts

@@ -1,42 +1,5 @@
 import { z } from 'zod';
-/**
- * Remote authenticated runtime input preparation — the wire half of
- * `docs/researches/runtime-input-preparation-contract.md` §19 (channel shape)
- * and the C07 G4 design decision §17 B.
- *
- * This module owns ONLY the leaf shapes. The server -> device payload lives in
- * `messages.ts` beside every other message payload (so the one inline byte
- * bound `MAX_INLINE_BYTES` stays a single module-local authority), and the two
- * authenticated HTTP bodies live in `http-api.ts`.
- *
- * Three structural rules this surface exists to hold:
- *
- * 1. The request carries NO tools, NO tool executors and NO runtime identity.
- *    Those are LOCAL observations: only the device can honestly say which MCP
- *    toolsets it has, what schemas their servers publish, and which native
- *    package closure is installed. A Host that could state them would be
- *    stating an identity it cannot verify.
- * 2. The receipt summary discloses identities, digests, sizes, counter
- *    evidence and readiness — never D, never P(D), never the snapshot. A
- *    digest proves content identity; it is not a disclosure channel and not a
- *    bearer token (§10.3.4).
- * 3. Every shape here is `.strict()`. This is control data: an unrecognized
- *    field must be REJECTED, not silently stripped, per docs/protocol.md's
- *    freeze-rule asymmetry. Adding a field post-freeze is therefore a
- *    breaking change, exactly like `PermissionPolicySchema`.
- */
-/**
- * The ONE version of the input-preparation contract, shared by this relay wire
- * (the `agent.input.preparation` payload and the completion receipt summary)
- * and by the device-local request, receipt and artifact
- * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).
- *
- * The relay wire carries no version field of its own, so a version change is
- * made visible where admission actually happens: in the capability token
- * below. See `INPUT_PREPARATION_VERSION` in the client for what each version
- * changed.
- */
-export declare const INPUT_PREPARATION_WIRE_VERSION: 8;
+export { INPUT_PREPARATION_WIRE_VERSION } from './input-preparation-version';
 /**
  * Capability required before a task-free remote input preparation — or a
  * prepared Execution — is admitted: `agent-input-preparation-v<N>`, where
@@ -59,7 +22,7 @@ export declare const INPUT_PREPARATION_WIRE_VERSION: 8;
  * devices as a pair is the operator precondition for the cut (`docs/spec.md`,
  * bounded admission); nothing here parses an older receipt.
  */
-export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v8";
+export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v9";
 /** The preparation surface uses the package-wide lowercase `sha256:<hex>` transport form. */
 export declare const InputPreparationContentHashSchema: z.ZodString;
 /**
@@ -78,26 +41,6 @@ export declare const InputPreparationPolicyRevisionSchema: z.ZodString;
  * anything is compiled.
  */
 export declare const InputPreparationProfileIdSchema: z.ZodString;
-/**
- * The permission mode a preparation is compiled FOR.
- *
- * It is the same closed set every task policy uses (`permission.ts`'s
- * `PERMISSION_MODES`), spelled here as its own schema because a preparation
- * carries a mode without carrying a policy: there is no task, no grant and no
- * approval seam on this wire. The mode selects which tools the device's own
- * observation projects into the counted manifest, and nothing else.
- *
- * Declared by the requester rather than inferred by the device: a device that
- * guessed would be counting a manifest the requester never asked for, and a
- * device that defaulted would silently count the widest one.
- */
-export declare const InputPreparationPermissionModeSchema: z.ZodEnum<{
-    auto: "auto";
-    confirm: "confirm";
-    plan: "plan";
-    readonly: "readonly";
-}>;
-export type InputPreparationPermissionMode = z.infer<typeof InputPreparationPermissionModeSchema>;
 /** Explicit prepared SDK memory selection; never defaulted. */
 export declare const PreparedAgentMemoryModeSchema: z.ZodEnum<{
     none: "none";
@@ -400,7 +343,7 @@ export type InputPreparationState = z.infer<typeof InputPreparationStateSchema>;
  * `ready` means the preparation CAN BE CONSUMED — the artifact is intact and
  * unexpired, the native compiler's projection is content-complete, every
  * residual key is ruled by an applicable Host accounting policy, D is text
- * only, every executor identity is attested, and — only when the device has an
+ * only, and — only when the device has an
  * optional counter configured — that count is provider-authoritative and
  * covered. No count is required: the size evidence is
  * `artifact.requestBytes`, the exact byte length of the frozen D. It is
@@ -416,7 +359,6 @@ export declare const InputPreparationReadinessReasonSchema: z.ZodEnum<{
     counter_authority_not_production: "counter_authority_not_production";
     counter_coverage_incomplete: "counter_coverage_incomplete";
     counter_interrupted: "counter_interrupted";
-    executor_identity_unproven: "executor_identity_unproven";
     failed: "failed";
     not_prepared: "not_prepared";
     projection_unknown: "projection_unknown";
@@ -529,16 +471,6 @@ export declare const InputPreparationCounterEvidenceSchema: z.ZodObject<{
     calledAt: z.ZodISODateTime;
     completedAt: z.ZodISODateTime;
 }, z.core.$strict>;
-/**
- * What the device established about the implementation behind ONE
- * model-visible tool: `attested`, or `unavailable:<reason>` naming which of
- * the SDK's closed unavailable reasons applies.
- *
- * A kind, never the identity itself: an install path, a closure digest or a
- * stat tuple is device-local filesystem detail, and a receipt discloses
- * identity facts, not the machine's layout.
- */
-export declare const InputPreparationToolImplementationKindSchema: z.ZodString;
 /**
  * What the native compiler proved about ONE top-level key of D that lies
  * outside P(D).
@@ -601,19 +533,16 @@ export declare const InputPreparationProjectionSchema: z.ZodObject<{
  * launch checkable rather than assumed:
  *
  * - `observationDigest` binds everything the device OBSERVED — the projected
- *   tools, their executor fingerprints, the launch attestation and the
- *   implementation identities — so a launch whose live observation differs is
- *   a different manifest, whatever the schemas say.
+ *   tools and their executor fingerprints — so a launch whose live
+ *   observation differs is a different manifest, whatever the schemas say.
  * - `toolBindingDigest` binds only the facts that can be re-derived WITHOUT
- *   spawning a server: the launch attestation, the toolset definition
- *   revisions and the implementation identities. It is what a replay of an
- *   already-recorded requestId compares against, because re-probing to detect
- *   drift would be the second executor fact the idempotency key exists to
- *   prevent.
- * - `toolImplementationKinds` states, per model-visible tool name, whether the
- *   implementation behind it was attested. It is the evidence behind
- *   `executor_identity_unproven`, so a reader does not have to take that
- *   readiness reason on trust.
+ *   spawning a server: the toolset definition revisions and the configured
+ *   argv. It is what a replay of an already-recorded requestId compares
+ *   against, because re-probing to detect drift would be the second executor
+ *   fact the idempotency key exists to prevent.
+ * - `toolNames` lists the counted model-visible tool names, sorted. A launch
+ *   that registers a different set can name the tool that appeared or
+ *   vanished.
  */
 export declare const InputPreparationArtifactSummarySchema: z.ZodObject<{
     requestDigest: z.ZodString;
@@ -644,7 +573,7 @@ export declare const InputPreparationArtifactSummarySchema: z.ZodObject<{
     }, z.core.$strict>>;
     observationDigest: z.ZodString;
     toolBindingDigest: z.ZodString;
-    toolImplementationKinds: z.ZodRecord<z.ZodString, z.ZodString>;
+    toolNames: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 /** The immutable binding a receipt carries and a later consumer must re-present. */
 export declare const InputPreparationBindingSchema: z.ZodObject<{
@@ -667,12 +596,6 @@ export declare const InputPreparationBindingSchema: z.ZodObject<{
         modelId: z.ZodString;
     }, z.core.$strict>;
     policyRevision: z.ZodString;
-    permissionMode: z.ZodEnum<{
-        auto: "auto";
-        confirm: "confirm";
-        plan: "plan";
-        readonly: "readonly";
-    }>;
     runtime: z.ZodObject<{
         packageName: z.ZodString;
         packageVersion: z.ZodString;
@@ -732,12 +655,6 @@ export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
             modelId: z.ZodString;
         }, z.core.$strict>;
         policyRevision: z.ZodString;
-        permissionMode: z.ZodEnum<{
-            auto: "auto";
-            confirm: "confirm";
-            plan: "plan";
-            readonly: "readonly";
-        }>;
         runtime: z.ZodObject<{
             packageName: z.ZodString;
             packageVersion: z.ZodString;
@@ -789,7 +706,7 @@ export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
         }, z.core.$strict>>;
         observationDigest: z.ZodString;
         toolBindingDigest: z.ZodString;
-        toolImplementationKinds: z.ZodRecord<z.ZodString, z.ZodString>;
+        toolNames: z.ZodArray<z.ZodString>;
     }, z.core.$strict>>;
     counter: z.ZodOptional<z.ZodObject<{
         method: z.ZodString;
@@ -829,7 +746,6 @@ export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
         counter_authority_not_production: "counter_authority_not_production";
         counter_coverage_incomplete: "counter_coverage_incomplete";
         counter_interrupted: "counter_interrupted";
-        executor_identity_unproven: "executor_identity_unproven";
         failed: "failed";
         not_prepared: "not_prepared";
         projection_unknown: "projection_unknown";
@@ -893,11 +809,9 @@ export declare const InputPreparationRejectionReasonSchema: z.ZodEnum<{
     durable_write_failed: "durable_write_failed";
     input_preparation_record_log_unsupported: "input_preparation_record_log_unsupported";
     input_preparation_unconfigured: "input_preparation_unconfigured";
-    launch_boundary_unavailable: "launch_boundary_unavailable";
     limit_exceeded: "limit_exceeded";
     not_found: "not_found";
     observation_drift: "observation_drift";
-    permission_mode_denied: "permission_mode_denied";
     policy_revision_mismatch: "policy_revision_mismatch";
     request_conflict: "request_conflict";
     rpc_frame_too_large: "rpc_frame_too_large";