@byok-sdk/protocol 0.26.1 → 0.27.0-rc.2

package/dist/index.js

@@ -1,6 +1,8 @@
 import { z } from 'zod';
+import { Validator } from '@cfworker/json-schema';
 
-// src/agent-egress.ts
+// src/capability-constants.ts
+var INPUT_PREPARATION_WIRE_VERSION = 9;
 var AGENT_EGRESS_POLICY_CAPABILITY = "agent-egress-policy";
 var AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = "agent-egress-reliable-ack";
 var AGENT_EGRESS_FRESH_SESSION_CAPABILITY = "agent-egress-fresh-session";
@@ -8,6 +10,593 @@ var AGENT_MESSAGE_EGRESS_CAPABILITY = "agent-message-egress";
 var AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = "agent-content-workspace-read";
 var AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = "agent-content-transcript-read";
 var AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = "agent-content-artifact-read";
+var AGENT_HOME_PROJECTION_CAPABILITY = "agent-home-projection";
+var TERMINAL_PROJECTION_SELECTION_CAPABILITY = "terminal-projection-selection";
+var HOST_MCP_TASK_CONTEXT_CAPABILITY = "host-mcp-task-context";
+var PROVIDER_PROFILE_BINDING_CAPABILITY = "provider-profile-binding";
+var PROVIDER_PROVISIONING_CAPABILITY = "provider-provisioning.v1";
+var AGENT_MEMORY_INTENT_CAPABILITY = "agent-memory-intent.v1";
+var AGENT_MEMORY_PROJECTION_CAPABILITY = "agent.memory.projection";
+var AGENT_INPUT_PREPARATION_CAPABILITY = `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}`;
+var PREPARED_AGENT_MEMORY_MODES = ["none", "read", "read-write"];
+function isPreparedAgentMemoryMode(value) {
+  return typeof value === "string" && PREPARED_AGENT_MEMORY_MODES.some((mode) => mode === value);
+}
+
+// src/version.ts
+var MAILBOX_READ_AHEAD_MAX_SEQS = 4096;
+var MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
+var PROTOCOL_VERSION = 3;
+var STRICT_AGENT_ONLY_CAPABILITY = "strict-agent-only";
+var AGENT_HOME_READERS_CAPABILITY = "agent-home-readers";
+var CUSTOM_HARNESS_CAPABILITY = "custom-harness";
+var CAPABILITY_FLAGS = [
+  "steer",
+  "blob-upload",
+  "interactive-approval",
+  "approval_resolved",
+  "approval-targeting",
+  "dispatch-selection",
+  PROVIDER_PROFILE_BINDING_CAPABILITY,
+  "toolset-selection",
+  "agent-home-contract",
+  AGENT_HOME_READERS_CAPABILITY,
+  STRICT_AGENT_ONLY_CAPABILITY,
+  AGENT_EGRESS_POLICY_CAPABILITY,
+  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+  AGENT_MESSAGE_EGRESS_CAPABILITY,
+  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,
+  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
+  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,
+  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,
+  AGENT_HOME_PROJECTION_CAPABILITY,
+  AGENT_INPUT_PREPARATION_CAPABILITY,
+  TERMINAL_PROJECTION_SELECTION_CAPABILITY,
+  HOST_MCP_TASK_CONTEXT_CAPABILITY,
+  CUSTOM_HARNESS_CAPABILITY,
+  MAILBOX_READ_AHEAD_CAPABILITY,
+  PROVIDER_PROVISIONING_CAPABILITY,
+  AGENT_MEMORY_INTENT_CAPABILITY
+];
+
+// src/task-state.ts
+var TASK_STATES = [
+  "Offered",
+  "Claimed",
+  "Running",
+  "AwaitApproval",
+  "Complete",
+  "Failed",
+  "Cancelled"
+];
+var TASK_TRANSITIONS = {
+  Offered: ["Claimed", "Cancelled", "Failed"],
+  Claimed: ["Running", "Failed", "Cancelled"],
+  Running: ["AwaitApproval", "Complete", "Failed", "Cancelled"],
+  AwaitApproval: ["Running", "Failed", "Cancelled"],
+  Complete: [],
+  Failed: [],
+  Cancelled: []
+};
+function canTransition(from, to) {
+  return TASK_TRANSITIONS[from].includes(to);
+}
+
+// src/wire-additions.ts
+var AGENT_OFFER_FIELDS = (surface) => [
+  { kind: "envelope", rule: "gated", surface, field: "dispatchSelection", capability: "dispatch-selection", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface, field: "requiredToolsets", capability: "toolset-selection", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface, field: "terminalProjection", capability: "terminal-projection-selection", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface, field: "homeAccess", capability: "agent-home-readers", advertisedBy: "device" }
+];
+var EGRESS_OFFER_FIELDS = (surface) => [
+  { kind: "envelope", rule: "gated", surface, field: "messageEgress", capability: "agent-message-egress", advertisedBy: "device" },
+  ...AGENT_OFFER_FIELDS(surface)
+];
+var WIRE_ADDITIONS = Object.freeze([
+  // Server to daemon: offers.
+  { kind: "envelope", rule: "gated", surface: "task.offer", field: "harnessId", capability: "custom-harness", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_with_toolsets", field: "harnessId", capability: "custom-harness", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent", capability: "agent-home-contract", advertisedBy: "device" },
+  ...AGENT_OFFER_FIELDS("task.offer_for_agent"),
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", capability: "agent-home-contract", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", capability: "agent-egress-policy", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", capability: "agent-egress-reliable-ack", advertisedBy: "device" },
+  ...EGRESS_OFFER_FIELDS("task.offer_for_agent_with_egress"),
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-home-contract", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-egress-policy", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-egress-reliable-ack", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-egress-fresh-session", advertisedBy: "device" },
+  ...EGRESS_OFFER_FIELDS("task.offer_for_agent_with_egress_fresh"),
+  { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-home-contract", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-input-preparation-v9", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-egress-policy", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-egress-reliable-ack", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-egress-fresh-session", advertisedBy: "device" },
+  ...EGRESS_OFFER_FIELDS("task.offer_prepared"),
+  // Server to daemon: Agent control messages.
+  { kind: "envelope", rule: "gated", surface: "agent.content.read", capability: "agent-home-contract", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.content.read", capability: "agent-egress-policy", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.content.read", capability: "agent-egress-reliable-ack", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.content.read", field: "surface", value: "workspace", capability: "agent-content-workspace-read", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.content.read", field: "surface", value: "transcript", capability: "agent-content-transcript-read", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.content.read", field: "surface", value: "artifact", capability: "agent-content-artifact-read", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.home.projection", capability: "agent-home-contract", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.home.projection", capability: "agent-home-projection", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.input.preparation", capability: "agent-home-contract", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.input.preparation", capability: "agent-input-preparation-v9", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "provider.provisioning.available", capability: "provider-provisioning.v1", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "agent.memory.intent.available", capability: "agent-memory-intent.v1", advertisedBy: "device" },
+  // Daemon to server.
+  { kind: "envelope", rule: "gated", surface: "task.approval_resolved", capability: "approval_resolved", advertisedBy: "server" }
+]);
+function requiredReceiverCapabilities(type, payload) {
+  const fields = payload !== null && typeof payload === "object" ? payload : {};
+  const required = [];
+  for (const entry of WIRE_ADDITIONS) {
+    if (entry.kind !== "envelope" || entry.rule !== "gated" || entry.surface !== type) continue;
+    if (entry.field !== void 0) {
+      const value = fields[entry.field];
+      if (value === void 0) continue;
+      if (entry.value !== void 0 && value !== entry.value) continue;
+    }
+    if (!required.includes(entry.capability)) required.push(entry.capability);
+  }
+  return required;
+}
+var CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
+var BlobRefSchema = z.object({
+  blobId: z.string(),
+  contentHash: z.string().regex(CONTENT_HASH_RE, 'contentHash must be "sha256:<64 lowercase hex>"'),
+  size: z.number().int().nonnegative(),
+  contentType: z.string(),
+  url: z.string().optional()
+});
+var ProviderProfileRefSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u, "provider profile refs must be lowercase portable identifiers");
+var ProviderProfileRevisionSchema = z.string().regex(/^(?:0|[1-9][0-9]{0,19})$/u, "provider profile revision must be canonical decimal");
+var ProviderProfileHashSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u, "provider profile hash must be lowercase sha256");
+var PROVIDER_MODEL_CAPABILITIES = ["image-input"];
+var ProviderModelCapabilitySchema = z.enum(PROVIDER_MODEL_CAPABILITIES);
+var ProviderProfileBindingSchema = z.object({
+  profileRef: ProviderProfileRefSchema,
+  profileRevision: ProviderProfileRevisionSchema,
+  profileHash: ProviderProfileHashSchema,
+  modelId: z.string().min(1).max(160).regex(/^[^\u0000\r\n]+$/u),
+  requiredCapabilities: z.array(ProviderModelCapabilitySchema).max(8)
+}).strict().superRefine((binding, ctx) => {
+  if (new Set(binding.requiredCapabilities).size !== binding.requiredCapabilities.length) {
+    ctx.addIssue({ code: "custom", path: ["requiredCapabilities"], message: "duplicate provider capability" });
+  }
+});
+var PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION = "provider-secret-sealing-key.register";
+var ProviderProvisioningAvailablePayloadSchema = z.object({
+  requestId: z.uuid()
+}).strict();
+var PROVIDER_PROVISIONING_OPERATIONS = ["configure", "update_model", "replace_secret", "delete"];
+var ProviderProvisioningOperationSchema = z.enum(PROVIDER_PROVISIONING_OPERATIONS);
+var PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM = "9223372036854775807";
+var ProviderProvisioningOperationGenerationSchema = z.string().regex(/^[1-9][0-9]{0,18}$/u, "operationGeneration must be a canonical positive decimal string").refine(
+  (value) => value.length < PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM.length || value <= PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM,
+  `operationGeneration must not exceed ${PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM}`
+);
+var ProviderProvisioningOperationDigestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u, "operationDigest must be lowercase sha256");
+var PROVIDER_PROVISIONING_REJECTION_CODES = [
+  "request_invalid",
+  "request_conflict",
+  "request_expired",
+  "request_not_yet_valid",
+  "request_window_invalid",
+  "sealing_key_rotated",
+  "enrollment_mismatch",
+  "agent_not_placed",
+  "config_digest_mismatch",
+  "operation_generation_stale",
+  "profile_changed",
+  "profile_not_found",
+  "credential_scope_mismatch",
+  "provider_kind_unsupported",
+  "pi_model_invalid",
+  "capabilities_invalid",
+  "seal_open_failed",
+  "secret_invalid",
+  "local_commit_interrupted",
+  "secret_store_unavailable"
+];
+var ProviderProvisioningRejectionCodeSchema = z.enum(PROVIDER_PROVISIONING_REJECTION_CODES);
+var PROVIDER_PROVISIONING_HOST_TERMINAL_CODES = ["request_expired", "sealing_key_rotated"];
+var ProviderProvisioningProviderStatusSchema = z.object({
+  profileRef: ProviderProfileRefSchema,
+  providerKind: z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u, "providerKind must be a lowercase portable identifier"),
+  modelId: z.string().min(1).max(160).regex(/^[^\u0000\r\n]+$/u),
+  capabilities: z.array(ProviderModelCapabilitySchema).max(8),
+  secretConfigured: z.boolean()
+}).strict().superRefine((status, ctx) => {
+  if (new Set(status.capabilities).size !== status.capabilities.length) {
+    ctx.addIssue({ code: "custom", path: ["capabilities"], message: "duplicate provider capability" });
+  }
+});
+var PROVIDER_PROVISIONING_KEY_CHECK_RESULTS = [
+  "ok",
+  "credential_rejected",
+  "rate_limited",
+  "quota_or_billing",
+  "model_not_permitted",
+  "provider_error",
+  "unreachable",
+  "timeout",
+  "not_run"
+];
+var ProviderProvisioningKeyCheckResultSchema = z.enum(PROVIDER_PROVISIONING_KEY_CHECK_RESULTS);
+var ProviderProvisioningKeyCheckSchema = z.object({
+  result: ProviderProvisioningKeyCheckResultSchema
+}).strict();
+var completionIdentity = {
+  requestId: z.uuid(),
+  operation: ProviderProvisioningOperationSchema,
+  operationGeneration: ProviderProvisioningOperationGenerationSchema,
+  operationDigest: ProviderProvisioningOperationDigestSchema
+};
+var AppliedCompletionSchema = z.object({
+  outcome: z.literal("applied"),
+  ...completionIdentity,
+  providerStatus: ProviderProvisioningProviderStatusSchema.nullable(),
+  binding: ProviderProfileBindingSchema.nullable(),
+  keyCheck: ProviderProvisioningKeyCheckSchema
+}).strict();
+var RejectedCompletionSchema = z.object({
+  outcome: z.literal("rejected"),
+  ...completionIdentity,
+  code: ProviderProvisioningRejectionCodeSchema
+}).strict();
+var ProviderProvisioningCompletionSchema = z.discriminatedUnion("outcome", [AppliedCompletionSchema, RejectedCompletionSchema]).superRefine((completion, ctx) => {
+  if (completion.outcome !== "applied") return;
+  const { operation, providerStatus, binding } = completion;
+  if (operation === "delete") {
+    if (completion.keyCheck.result !== "not_run") {
+      ctx.addIssue({ code: "custom", path: ["keyCheck", "result"], message: "an applied delete must report keyCheck not_run" });
+    }
+    if (providerStatus !== null) {
+      ctx.addIssue({ code: "custom", path: ["providerStatus"], message: "an applied delete reports no provider status" });
+    }
+    if (binding !== null) {
+      ctx.addIssue({ code: "custom", path: ["binding"], message: "an applied delete reports no binding" });
+    }
+    return;
+  }
+  if (providerStatus === null) {
+    ctx.addIssue({ code: "custom", path: ["providerStatus"], message: `an applied ${operation} must report provider status` });
+  }
+  if (binding === null) {
+    ctx.addIssue({ code: "custom", path: ["binding"], message: `an applied ${operation} must report its exact binding` });
+  }
+  if (providerStatus === null || binding === null) return;
+  if (providerStatus.profileRef !== binding.profileRef) {
+    ctx.addIssue({ code: "custom", path: ["binding", "profileRef"], message: "binding profileRef must equal providerStatus profileRef" });
+  }
+  if (providerStatus.modelId !== binding.modelId) {
+    ctx.addIssue({ code: "custom", path: ["binding", "modelId"], message: "binding modelId must equal providerStatus modelId" });
+  }
+  if ((operation === "configure" || operation === "replace_secret") && !providerStatus.secretConfigured) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["providerStatus", "secretConfigured"],
+      message: `an applied ${operation} must report a configured secret`
+    });
+  }
+});
+var PROVIDER_PROVISIONING_DISPOSITIONS = ["recorded", "idempotent", "conflict", "host_terminal"];
+var ProviderProvisioningDispositionSchema = z.enum(PROVIDER_PROVISIONING_DISPOSITIONS);
+var ProviderProvisioningReadbackSchema = z.object({
+  tenantId: z.string().min(1),
+  deviceId: z.string().min(1),
+  requestId: z.uuid(),
+  disposition: ProviderProvisioningDispositionSchema,
+  completion: ProviderProvisioningCompletionSchema,
+  completedAt: z.iso.datetime({ offset: true })
+}).strict().superRefine((readback, ctx) => {
+  if (readback.completion.requestId !== readback.requestId) {
+    ctx.addIssue({ code: "custom", path: ["completion", "requestId"], message: "completion requestId must equal readback requestId" });
+  }
+  if (readback.disposition === "host_terminal" && (readback.completion.outcome !== "rejected" || !PROVIDER_PROVISIONING_HOST_TERMINAL_CODES.includes(readback.completion.code))) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["completion"],
+      message: `a host_terminal readback must carry a rejected completion with one of: ${PROVIDER_PROVISIONING_HOST_TERMINAL_CODES.join(", ")}`
+    });
+  }
+});
+
+// src/plain-json.ts
+function isSameJsonData(a, b) {
+  if (a === null || b === null) return a === b;
+  const typeOfA = typeof a;
+  if (typeOfA !== typeof b) return false;
+  if (typeOfA !== "object") {
+    return a === b;
+  }
+  const aIsArray = Array.isArray(a);
+  if (aIsArray !== Array.isArray(b)) return false;
+  if (aIsArray) {
+    const arrayA = a;
+    const arrayB = b;
+    if (arrayA.length !== arrayB.length) return false;
+    for (let index = 0; index < arrayA.length; index += 1) {
+      if (!isSameJsonData(arrayA[index], arrayB[index])) return false;
+    }
+    return true;
+  }
+  const objectA = a;
+  const objectB = b;
+  const keysA = Object.keys(objectA);
+  const keysB = Object.keys(objectB);
+  if (keysA.length === 0) {
+    const prototypeA = Object.getPrototypeOf(objectA);
+    if (prototypeA !== Object.prototype && prototypeA !== null) return false;
+  }
+  if (keysA.length !== keysB.length) return false;
+  for (const key of keysA) {
+    if (!Object.prototype.hasOwnProperty.call(objectB, key)) return false;
+    if (!isSameJsonData(objectA[key], objectB[key])) return false;
+  }
+  return true;
+}
+function jsonDepthExceeds(value, limit) {
+  const stack = [{ node: value, depth: 0 }];
+  while (stack.length > 0) {
+    const { node, depth } = stack.pop();
+    if (node === null || typeof node !== "object") continue;
+    const next = depth + 1;
+    if (next > limit) return true;
+    const children = Array.isArray(node) ? node : Object.values(node);
+    for (const child of children) stack.push({ node: child, depth: next });
+  }
+  return false;
+}
+function canonicalizePlainJson(value, maxBytes, maxDepth) {
+  let json;
+  try {
+    json = JSON.stringify(value);
+  } catch {
+    return { ok: false, reason: "not-serializable" };
+  }
+  if (json === void 0) return { ok: false, reason: "not-serializable" };
+  const bytes = new TextEncoder().encode(json).length;
+  if (bytes > maxBytes) return { ok: false, reason: "over-cap", bytes };
+  const canonical = JSON.parse(json);
+  if (maxDepth !== void 0 && jsonDepthExceeds(canonical, maxDepth)) return { ok: false, reason: "too-deep", bytes };
+  if (!isSameJsonData(value, canonical)) return { ok: false, reason: "not-plain-json" };
+  return { ok: true, bytes, canonical };
+}
+
+// src/result-schema.ts
+var RESULT_SCHEMA_MAX_BYTES = 16384;
+var RESULT_OUTCOME_MAX_BYTES = 65536;
+var RESULT_SCHEMA_MAX_DEPTH = 32;
+var RESULT_JSON_MAX_DEPTH = 128;
+var RESULT_ISSUES_MAX_COUNT = 20;
+var RESULT_ISSUES_MAX_BYTES = 4096;
+var ISSUE_STRING_MAX_LENGTH = 128;
+var RESULT_SCHEMA_KEYWORDS = Object.freeze([
+  "type",
+  "properties",
+  "required",
+  "additionalProperties",
+  "items",
+  "enum",
+  "const",
+  "oneOf",
+  "minLength",
+  "maxLength",
+  "minItems",
+  "maxItems",
+  "minimum",
+  "maximum",
+  "description"
+]);
+var RESULT_SCHEMA_INSTANCE_TYPES = Object.freeze([
+  "object",
+  "array",
+  "string",
+  "number",
+  "integer",
+  "boolean",
+  "null"
+]);
+var KEYWORDS = new Set(RESULT_SCHEMA_KEYWORDS);
+var INSTANCE_TYPES = new Set(RESULT_SCHEMA_INSTANCE_TYPES);
+var encoder = new TextEncoder();
+function cut(value) {
+  return value.length <= ISSUE_STRING_MAX_LENGTH ? value : `${value.slice(0, ISSUE_STRING_MAX_LENGTH - 1)}\u2026`;
+}
+var IssueSink = class {
+  issues = [];
+  truncated = false;
+  bytes = 2;
+  // "[]"
+  add(pointer, keyword, message) {
+    const issue = { pointer: cut(pointer), keyword: cut(keyword), message: cut(message) };
+    const size = encoder.encode(JSON.stringify(issue)).length + (this.issues.length === 0 ? 0 : 1);
+    if (this.issues.length >= RESULT_ISSUES_MAX_COUNT || this.bytes + size > RESULT_ISSUES_MAX_BYTES) {
+      this.truncated = true;
+      return;
+    }
+    this.issues.push(issue);
+    this.bytes += size;
+  }
+  get empty() {
+    return this.issues.length === 0 && !this.truncated;
+  }
+};
+function pointerTo(base, token) {
+  return `${base}/${String(token).replace(/~/g, "~0").replace(/\//g, "~1")}`;
+}
+function isObject(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isNonNegativeInteger(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+}
+var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u;
+function hasLoneSurrogate(value) {
+  const stack = [value];
+  while (stack.length > 0) {
+    const node = stack.pop();
+    if (typeof node === "string") {
+      if (LONE_SURROGATE.test(node)) return true;
+    } else if (Array.isArray(node)) {
+      for (const member of node) stack.push(member);
+    } else if (node !== null && typeof node === "object") {
+      for (const [key, member] of Object.entries(node)) {
+        if (LONE_SURROGATE.test(key)) return true;
+        stack.push(member);
+      }
+    }
+  }
+  return false;
+}
+function canonicalDocument(value, maxBytes) {
+  const check = canonicalizePlainJson(value, maxBytes, RESULT_JSON_MAX_DEPTH);
+  if (check.ok && hasLoneSurrogate(check.canonical)) return { ok: false, reason: "not-plain-json" };
+  return check;
+}
+function documentFailure(check, what, maxBytes) {
+  const sink = new IssueSink();
+  switch (check.reason) {
+    case "not-serializable":
+      sink.add("", check.reason, `${what} is not JSON-serializable`);
+      return { ok: false, reason: check.reason, issues: sink.issues, truncated: false };
+    case "not-plain-json":
+      sink.add("", check.reason, `${what} is not plain JSON data in well-formed Unicode`);
+      return { ok: false, reason: check.reason, issues: sink.issues, truncated: false };
+    case "over-cap":
+      sink.add("", check.reason, `${what} is ${check.bytes} bytes as canonical JSON (UTF-8); the cap is ${maxBytes}`);
+      return { ok: false, reason: check.reason, bytes: check.bytes, issues: sink.issues, truncated: false };
+    case "too-deep":
+      sink.add("", check.reason, `${what} nests JSON containers deeper than ${RESULT_JSON_MAX_DEPTH}`);
+      return { ok: false, reason: check.reason, bytes: check.bytes, issues: sink.issues, truncated: false };
+  }
+}
+function checkSubschema(node, pointer, depth, sink) {
+  if (!isObject(node)) {
+    sink.add(pointer, "schema", "a subschema must be a JSON object");
+    return;
+  }
+  if (depth > RESULT_SCHEMA_MAX_DEPTH) {
+    sink.add(pointer, "depth", `subschemas nest deeper than ${RESULT_SCHEMA_MAX_DEPTH} levels`);
+    return;
+  }
+  for (const key of Object.keys(node)) {
+    if (!KEYWORDS.has(key)) sink.add(pointerTo(pointer, key), key, "keyword is outside the result schema subset");
+  }
+  if (depth === 0 && node.type !== "object") {
+    sink.add(pointerTo(pointer, "type"), "type", "the root schema must declare type: 'object'");
+  }
+  if (Object.hasOwn(node, "type")) {
+    const type = node.type;
+    const valid = typeof type === "string" ? INSTANCE_TYPES.has(type) : Array.isArray(type) && type.length > 0 && type.every((member) => typeof member === "string" && INSTANCE_TYPES.has(member)) && new Set(type).size === type.length;
+    if (!valid) sink.add(pointerTo(pointer, "type"), "type", "must be a JSON type name or a non-empty array of unique type names");
+  }
+  if (Object.hasOwn(node, "properties")) {
+    const properties = node.properties;
+    const at = pointerTo(pointer, "properties");
+    if (!isObject(properties)) sink.add(at, "properties", "must be an object of subschemas");
+    else for (const [name, subschema] of Object.entries(properties)) checkSubschema(subschema, pointerTo(at, name), depth + 1, sink);
+  }
+  if (Object.hasOwn(node, "required")) {
+    const required = node.required;
+    if (!Array.isArray(required) || !required.every((name) => typeof name === "string") || new Set(required).size !== required.length) {
+      sink.add(pointerTo(pointer, "required"), "required", "must be an array of unique property names");
+    }
+  }
+  if (Object.hasOwn(node, "additionalProperties") && node.additionalProperties !== false) {
+    sink.add(pointerTo(pointer, "additionalProperties"), "additionalProperties", "only additionalProperties: false is allowed");
+  }
+  if (Object.hasOwn(node, "items")) {
+    if (!isObject(node.items)) sink.add(pointerTo(pointer, "items"), "items", "must be one subschema object");
+    else checkSubschema(node.items, pointerTo(pointer, "items"), depth + 1, sink);
+  }
+  if (Object.hasOwn(node, "enum") && (!Array.isArray(node.enum) || node.enum.length === 0)) {
+    sink.add(pointerTo(pointer, "enum"), "enum", "must be a non-empty array");
+  }
+  if (Object.hasOwn(node, "oneOf")) {
+    const oneOf = node.oneOf;
+    const at = pointerTo(pointer, "oneOf");
+    if (!Array.isArray(oneOf) || oneOf.length === 0) sink.add(at, "oneOf", "must be a non-empty array of subschemas");
+    else oneOf.forEach((subschema, index) => checkSubschema(subschema, pointerTo(at, index), depth + 1, sink));
+  }
+  for (const keyword of ["minLength", "maxLength", "minItems", "maxItems"]) {
+    if (Object.hasOwn(node, keyword) && !isNonNegativeInteger(node[keyword])) {
+      sink.add(pointerTo(pointer, keyword), keyword, "must be a non-negative integer");
+    }
+  }
+  for (const keyword of ["minimum", "maximum"]) {
+    if (Object.hasOwn(node, keyword) && typeof node[keyword] !== "number") {
+      sink.add(pointerTo(pointer, keyword), keyword, "must be a number");
+    }
+  }
+  if (Object.hasOwn(node, "description") && typeof node.description !== "string") {
+    sink.add(pointerTo(pointer, "description"), "description", "must be a string");
+  }
+}
+function checkResultSchema(schema) {
+  const document = canonicalDocument(schema, RESULT_SCHEMA_MAX_BYTES);
+  if (!document.ok) return documentFailure(document, "the result schema", RESULT_SCHEMA_MAX_BYTES);
+  const sink = new IssueSink();
+  checkSubschema(document.canonical, "", 0, sink);
+  if (!sink.empty) return { ok: false, reason: "not-subset", bytes: document.bytes, issues: sink.issues, truncated: sink.truncated };
+  return { ok: true, bytes: document.bytes, canonical: document.canonical };
+}
+function withoutPrototypes(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (Array.isArray(value)) return value.map(withoutPrototypes);
+  const copy = /* @__PURE__ */ Object.create(null);
+  for (const [key, member] of Object.entries(value)) {
+    Object.defineProperty(copy, key, { value: withoutPrototypes(member), enumerable: true, writable: true, configurable: true });
+  }
+  return copy;
+}
+function fragmentToPointer(location) {
+  return decodeURI(location.startsWith("#") ? location.slice(1) : location);
+}
+function validateResultOutcome(schema, outcome) {
+  const admitted = checkResultSchema(schema);
+  if (!admitted.ok) {
+    return { ok: false, reason: "schema-not-admitted", bytes: admitted.bytes, issues: admitted.issues, truncated: admitted.truncated };
+  }
+  const document = canonicalDocument(outcome, RESULT_OUTCOME_MAX_BYTES);
+  if (!document.ok) return documentFailure(document, "the outcome", RESULT_OUTCOME_MAX_BYTES);
+  const validator = new Validator(withoutPrototypes(admitted.canonical), "2020-12", true);
+  const result = validator.validate(withoutPrototypes(document.canonical));
+  if (result.valid) return { ok: true, bytes: document.bytes, canonical: document.canonical };
+  const sink = new IssueSink();
+  for (const unit of result.errors) sink.add(fragmentToPointer(unit.instanceLocation), unit.keyword, unit.error);
+  return { ok: false, reason: "schema-mismatch", bytes: document.bytes, issues: sink.issues, truncated: sink.truncated };
+}
+
+// src/terminal-projection.ts
+var TerminalProjectionContractSchema = z.string().min(1).max(128).regex(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u, "terminal projection contracts must be opaque lowercase ids");
+var ResultDocumentSchemaSchema = z.custom().superRefine((value, ctx) => {
+  const check = checkResultSchema(value);
+  if (check.ok) return;
+  for (const issue of check.issues) {
+    ctx.addIssue({
+      code: "custom",
+      message: `result schema ${check.reason} at '${issue.pointer}' (${issue.keyword}): ${issue.message}`,
+      params: { reason: check.reason, pointer: issue.pointer, keyword: issue.keyword }
+    });
+  }
+  if (check.truncated) {
+    ctx.addIssue({ code: "custom", message: "result schema issues truncated", params: { reason: check.reason, truncated: true } });
+  }
+});
+var TerminalProjectionSelectionSchema = z.discriminatedUnion("mode", [
+  z.object({ mode: z.literal("none") }).strict(),
+  z.object({
+    mode: z.literal("result-document"),
+    contract: TerminalProjectionContractSchema,
+    schema: ResultDocumentSchemaSchema
+  }).strict()
+]);
 var POLICY_REVISION = z.string().min(1).max(160).regex(/^[^\u0000-\u001f\u007f\r\n]+$/u, "policyRevision must not contain control characters");
 var POSITIVE_LIMIT = z.number().int().positive().max(2147483647);
 var AGENT_MESSAGE_MAX_BYTES = 256 * 1024;
@@ -92,31 +681,14 @@ var AgentContentReadDenialReasonSchema = z.enum([
 ]);
 var AgentEgressContentHashSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u, "contentHash must be a lowercase SHA-256 digest");
 var AgentEgressPolicyRevisionSchema = POLICY_REVISION;
-var AGENT_HOME_PROJECTION_CAPABILITY = "agent-home-projection";
-var AGENT_HOME_PROJECTION_MAX_BYTES = 64 * 1024;
-var AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM = "9223372036854775807";
-var AgentHomeProjectionProfileRevisionSchema = z.string().regex(/^[1-9][0-9]{0,18}$/u, "profileRevision must be a canonical positive decimal string").refine(
-  (value) => value.length < AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM.length || value <= AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM,
-  `profileRevision must not exceed PostgreSQL BIGINT maximum ${AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM}`
-);
-var AgentHomeProjectionHashSchema = AgentEgressContentHashSchema;
-var AgentHomeProjectionOutcomeSchema = z.enum(["applied", "idempotent", "stale", "conflict"]);
-var AgentHomeProjectionValueSchema = z.json().refine(
-  (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= AGENT_HOME_PROJECTION_MAX_BYTES,
-  `projection must not exceed ${AGENT_HOME_PROJECTION_MAX_BYTES} UTF-8 JSON bytes`
-);
-
-// src/input-preparation-version.ts
-var INPUT_PREPARATION_WIRE_VERSION = 9;
 
 // src/input-preparation.ts
-var AGENT_INPUT_PREPARATION_CAPABILITY = `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}`;
 var InputPreparationContentHashSchema = AgentEgressContentHashSchema;
 var OPAQUE_ID = z.string().min(1).max(512).regex(/^[^\u0000-\u001f\u007f]+$/u, "control identifiers must not contain control characters");
 var OPAQUE_TEXT = z.string().min(1).max(2048).regex(/^[^\u0000-\u001f\u007f]+$/u, "control text must not contain control characters");
 var InputPreparationPolicyRevisionSchema = OPAQUE_ID;
 var InputPreparationProfileIdSchema = OPAQUE_ID;
-var PreparedAgentMemoryModeSchema = z.enum(["none", "read", "read-write"]);
+var PreparedAgentMemoryModeSchema = z.enum(PREPARED_AGENT_MEMORY_MODES);
 var InputPreparationSourceSchema = z.object({ revision: OPAQUE_ID, digest: OPAQUE_ID }).strict();
 var InputPreparationModelCostSchema = z.object({
   input: z.number().finite(),
@@ -317,6 +889,7 @@ var InputPreparationArtifactSummarySchema = z.object({
   toolNames: z.array(OPAQUE_ID)
 }).strict();
 var InputPreparationBindingSchema = z.object({
+  terminalProjection: TerminalProjectionSelectionSchema.optional(),
   agentMemory: PreparedAgentMemoryModeSchema,
   scopeId: OPAQUE_ID,
   deviceId: OPAQUE_ID,
@@ -325,261 +898,86 @@ var InputPreparationBindingSchema = z.object({
   profileRevision: OPAQUE_ID,
   source: InputPreparationSourceSchema,
   target: InputPreparationCounterTargetSchema,
-  policyRevision: OPAQUE_ID,
-  runtime: InputPreparationRuntimeIdentitySchema,
-  requestDigest: OPAQUE_ID,
-  /**
-   * The Host's accounting ruling this preparation was requested under,
-   * copied verbatim. Absent when the request named none — never filled in,
-   * and never narrowed to one the device would have chosen.
-   */
-  accountingPolicyRef: InputPreparationAccountingPolicyRefSchema.optional()
-}).strict();
-var InputPreparationReceiptSummarySchema = z.object({
-  reference: OPAQUE_ID,
-  state: InputPreparationStateSchema,
-  binding: InputPreparationBindingSchema,
-  artifact: InputPreparationArtifactSummarySchema.optional(),
-  counter: InputPreparationCounterEvidenceSchema.optional(),
-  ready: z.boolean(),
-  readinessReasons: z.array(InputPreparationReadinessReasonSchema).max(16),
-  detail: OPAQUE_ID.optional(),
-  artifactExpiresAt: z.iso.datetime({ offset: true })
-}).strict().superRefine((value, ctx) => {
-  if (value.ready !== (value.readinessReasons.length === 0)) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["ready"],
-      message: "ready must be true exactly when readinessReasons is empty"
-    });
-  }
-});
-var InputPreparationReferenceSchema = OPAQUE_ID;
-var InputPreparationOfferBindingSchema = z.object({
-  reference: InputPreparationReferenceSchema,
-  /** `InputPreparationBindingSchema.requestDigest`, as the receipt reported it. */
-  requestDigest: OPAQUE_ID,
-  /** `InputPreparationArtifactSummarySchema.envelopeDigest`, when the receipt carried one. */
-  artifactDigest: OPAQUE_ID.optional()
-}).strict();
-var InputPreparationRejectionReasonSchema = z.enum([
-  "input_preparation_unconfigured",
-  "bad_request",
-  "authority_unavailable",
-  "scope_denied",
-  "policy_revision_mismatch",
-  "runtime_identity_unavailable",
-  "unsupported_input",
-  "limit_exceeded",
-  "request_conflict",
-  "not_found",
-  "counter_unavailable",
-  "counter_interrupted",
-  "durable_write_failed",
-  "cancelled",
-  "context_unresolvable",
-  "context_hash_mismatch",
-  "toolsets_unobservable",
-  "deadline_elapsed",
-  /**
-   * A repeat of an already-recorded `requestId` arrived after the facts its
-   * executor fingerprints were frozen against changed — a toolset definition
-   * revision or a configured server argv. The recorded receipt is not re-derived and no
-   * server is re-probed; the repeat is refused so the caller mints a new
-   * preparation instead of silently receiving one bound to stale evidence.
-   */
-  "observation_drift",
-  /**
-   * The device compiled the input, then found that the `prompt_prepared` frame
-   * the runtime would have to be handed exceeds the single-frame byte cap that
-   * runtime enforces. The bound belongs to the runtime, not to the operator's
-   * retention policy, so it is decided first and nothing is retained: a
-   * preparation that could never be delivered is not a smaller preparation.
-   */
-  "rpc_frame_too_large",
-  /**
-   * The device's input-preparation lane is off because its durable record log
-   * holds a record from an older record schema version. The rest of the
-   * device runs; this lane refuses until an operator archives that log. No
-   * record is migrated, read forward or deleted.
-   */
-  "input_preparation_record_log_unsupported"
-]);
-var TERMINAL_PROJECTION_SELECTION_CAPABILITY = "terminal-projection-selection";
-var TerminalProjectionContractSchema = z.string().min(1).max(128).regex(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u, "terminal projection contracts must be opaque lowercase ids");
-var TerminalProjectionSelectionSchema = z.discriminatedUnion("mode", [
-  z.object({ mode: z.literal("none") }).strict(),
-  z.object({
-    mode: z.literal("result-document"),
-    contract: TerminalProjectionContractSchema
-  }).strict()
-]);
-
-// src/task-assertion.ts
-var HOST_MCP_TASK_CONTEXT_CAPABILITY = "host-mcp-task-context";
-var PROVIDER_PROFILE_BINDING_CAPABILITY = "provider-profile-binding";
-var ProviderProfileRefSchema = z.string().min(1).max(64).regex(/^[a-z0-9]+(?:[-_][a-z0-9]+)*$/u, "provider profile refs must be lowercase portable identifiers");
-var ProviderProfileRevisionSchema = z.string().regex(/^(?:0|[1-9][0-9]{0,19})$/u, "provider profile revision must be canonical decimal");
-var ProviderProfileHashSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u, "provider profile hash must be lowercase sha256");
-var PROVIDER_MODEL_CAPABILITIES = ["image-input"];
-var ProviderModelCapabilitySchema = z.enum(PROVIDER_MODEL_CAPABILITIES);
-var ProviderProfileBindingSchema = z.object({
-  profileRef: ProviderProfileRefSchema,
-  profileRevision: ProviderProfileRevisionSchema,
-  profileHash: ProviderProfileHashSchema,
-  modelId: z.string().min(1).max(160).regex(/^[^\u0000\r\n]+$/u),
-  requiredCapabilities: z.array(ProviderModelCapabilitySchema).max(8)
-}).strict().superRefine((binding, ctx) => {
-  if (new Set(binding.requiredCapabilities).size !== binding.requiredCapabilities.length) {
-    ctx.addIssue({ code: "custom", path: ["requiredCapabilities"], message: "duplicate provider capability" });
-  }
-});
-var PROVIDER_PROVISIONING_CAPABILITY = "provider-provisioning.v1";
-var PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION = "provider-secret-sealing-key.register";
-var ProviderProvisioningAvailablePayloadSchema = z.object({
-  requestId: z.uuid()
-}).strict();
-var PROVIDER_PROVISIONING_OPERATIONS = ["configure", "update_model", "replace_secret", "delete"];
-var ProviderProvisioningOperationSchema = z.enum(PROVIDER_PROVISIONING_OPERATIONS);
-var PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM = "9223372036854775807";
-var ProviderProvisioningOperationGenerationSchema = z.string().regex(/^[1-9][0-9]{0,18}$/u, "operationGeneration must be a canonical positive decimal string").refine(
-  (value) => value.length < PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM.length || value <= PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM,
-  `operationGeneration must not exceed ${PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM}`
-);
-var ProviderProvisioningOperationDigestSchema = z.string().regex(/^sha256:[0-9a-f]{64}$/u, "operationDigest must be lowercase sha256");
-var PROVIDER_PROVISIONING_REJECTION_CODES = [
-  "request_invalid",
-  "request_conflict",
-  "request_expired",
-  "request_not_yet_valid",
-  "request_window_invalid",
-  "sealing_key_rotated",
-  "enrollment_mismatch",
-  "agent_not_placed",
-  "config_digest_mismatch",
-  "operation_generation_stale",
-  "profile_changed",
-  "profile_not_found",
-  "credential_scope_mismatch",
-  "provider_kind_unsupported",
-  "pi_model_invalid",
-  "capabilities_invalid",
-  "seal_open_failed",
-  "secret_invalid",
-  "local_commit_interrupted",
-  "secret_store_unavailable"
-];
-var ProviderProvisioningRejectionCodeSchema = z.enum(PROVIDER_PROVISIONING_REJECTION_CODES);
-var PROVIDER_PROVISIONING_HOST_TERMINAL_CODES = ["request_expired", "sealing_key_rotated"];
-var ProviderProvisioningProviderStatusSchema = z.object({
-  profileRef: ProviderProfileRefSchema,
-  providerKind: z.string().min(1).max(64).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/u, "providerKind must be a lowercase portable identifier"),
-  modelId: z.string().min(1).max(160).regex(/^[^\u0000\r\n]+$/u),
-  capabilities: z.array(ProviderModelCapabilitySchema).max(8),
-  secretConfigured: z.boolean()
-}).strict().superRefine((status, ctx) => {
-  if (new Set(status.capabilities).size !== status.capabilities.length) {
-    ctx.addIssue({ code: "custom", path: ["capabilities"], message: "duplicate provider capability" });
-  }
-});
-var PROVIDER_PROVISIONING_KEY_CHECK_RESULTS = [
-  "ok",
-  "credential_rejected",
-  "rate_limited",
-  "quota_or_billing",
-  "model_not_permitted",
-  "provider_error",
-  "unreachable",
-  "timeout",
-  "not_run"
-];
-var ProviderProvisioningKeyCheckResultSchema = z.enum(PROVIDER_PROVISIONING_KEY_CHECK_RESULTS);
-var ProviderProvisioningKeyCheckSchema = z.object({
-  result: ProviderProvisioningKeyCheckResultSchema
-}).strict();
-var completionIdentity = {
-  requestId: z.uuid(),
-  operation: ProviderProvisioningOperationSchema,
-  operationGeneration: ProviderProvisioningOperationGenerationSchema,
-  operationDigest: ProviderProvisioningOperationDigestSchema
-};
-var AppliedCompletionSchema = z.object({
-  outcome: z.literal("applied"),
-  ...completionIdentity,
-  providerStatus: ProviderProvisioningProviderStatusSchema.nullable(),
-  binding: ProviderProfileBindingSchema.nullable(),
-  keyCheck: ProviderProvisioningKeyCheckSchema
-}).strict();
-var RejectedCompletionSchema = z.object({
-  outcome: z.literal("rejected"),
-  ...completionIdentity,
-  code: ProviderProvisioningRejectionCodeSchema
+  policyRevision: OPAQUE_ID,
+  runtime: InputPreparationRuntimeIdentitySchema,
+  requestDigest: OPAQUE_ID,
+  /**
+   * The Host's accounting ruling this preparation was requested under,
+   * copied verbatim. Absent when the request named none — never filled in,
+   * and never narrowed to one the device would have chosen.
+   */
+  accountingPolicyRef: InputPreparationAccountingPolicyRefSchema.optional()
 }).strict();
-var ProviderProvisioningCompletionSchema = z.discriminatedUnion("outcome", [AppliedCompletionSchema, RejectedCompletionSchema]).superRefine((completion, ctx) => {
-  if (completion.outcome !== "applied") return;
-  const { operation, providerStatus, binding } = completion;
-  if (operation === "delete") {
-    if (completion.keyCheck.result !== "not_run") {
-      ctx.addIssue({ code: "custom", path: ["keyCheck", "result"], message: "an applied delete must report keyCheck not_run" });
-    }
-    if (providerStatus !== null) {
-      ctx.addIssue({ code: "custom", path: ["providerStatus"], message: "an applied delete reports no provider status" });
-    }
-    if (binding !== null) {
-      ctx.addIssue({ code: "custom", path: ["binding"], message: "an applied delete reports no binding" });
-    }
-    return;
-  }
-  if (providerStatus === null) {
-    ctx.addIssue({ code: "custom", path: ["providerStatus"], message: `an applied ${operation} must report provider status` });
-  }
-  if (binding === null) {
-    ctx.addIssue({ code: "custom", path: ["binding"], message: `an applied ${operation} must report its exact binding` });
-  }
-  if (providerStatus === null || binding === null) return;
-  if (providerStatus.profileRef !== binding.profileRef) {
-    ctx.addIssue({ code: "custom", path: ["binding", "profileRef"], message: "binding profileRef must equal providerStatus profileRef" });
-  }
-  if (providerStatus.modelId !== binding.modelId) {
-    ctx.addIssue({ code: "custom", path: ["binding", "modelId"], message: "binding modelId must equal providerStatus modelId" });
-  }
-  if ((operation === "configure" || operation === "replace_secret") && !providerStatus.secretConfigured) {
-    ctx.addIssue({
-      code: "custom",
-      path: ["providerStatus", "secretConfigured"],
-      message: `an applied ${operation} must report a configured secret`
-    });
-  }
-});
-var PROVIDER_PROVISIONING_DISPOSITIONS = ["recorded", "idempotent", "conflict", "host_terminal"];
-var ProviderProvisioningDispositionSchema = z.enum(PROVIDER_PROVISIONING_DISPOSITIONS);
-var ProviderProvisioningReadbackSchema = z.object({
-  tenantId: z.string().min(1),
-  deviceId: z.string().min(1),
-  requestId: z.uuid(),
-  disposition: ProviderProvisioningDispositionSchema,
-  completion: ProviderProvisioningCompletionSchema,
-  completedAt: z.iso.datetime({ offset: true })
-}).strict().superRefine((readback, ctx) => {
-  if (readback.completion.requestId !== readback.requestId) {
-    ctx.addIssue({ code: "custom", path: ["completion", "requestId"], message: "completion requestId must equal readback requestId" });
-  }
-  if (readback.disposition === "host_terminal" && (readback.completion.outcome !== "rejected" || !PROVIDER_PROVISIONING_HOST_TERMINAL_CODES.includes(readback.completion.code))) {
+var InputPreparationReceiptSummarySchema = z.object({
+  reference: OPAQUE_ID,
+  state: InputPreparationStateSchema,
+  binding: InputPreparationBindingSchema,
+  artifact: InputPreparationArtifactSummarySchema.optional(),
+  counter: InputPreparationCounterEvidenceSchema.optional(),
+  ready: z.boolean(),
+  readinessReasons: z.array(InputPreparationReadinessReasonSchema).max(16),
+  detail: OPAQUE_ID.optional(),
+  artifactExpiresAt: z.iso.datetime({ offset: true })
+}).strict().superRefine((value, ctx) => {
+  if (value.ready !== (value.readinessReasons.length === 0)) {
     ctx.addIssue({
       code: "custom",
-      path: ["completion"],
-      message: `a host_terminal readback must carry a rejected completion with one of: ${PROVIDER_PROVISIONING_HOST_TERMINAL_CODES.join(", ")}`
+      path: ["ready"],
+      message: "ready must be true exactly when readinessReasons is empty"
     });
   }
 });
-var CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
-var BlobRefSchema = z.object({
-  blobId: z.string(),
-  contentHash: z.string().regex(CONTENT_HASH_RE, 'contentHash must be "sha256:<64 lowercase hex>"'),
-  size: z.number().int().nonnegative(),
-  contentType: z.string(),
-  url: z.string().optional()
-});
+var InputPreparationReferenceSchema = OPAQUE_ID;
+var InputPreparationOfferBindingSchema = z.object({
+  reference: InputPreparationReferenceSchema,
+  /** `InputPreparationBindingSchema.requestDigest`, as the receipt reported it. */
+  requestDigest: OPAQUE_ID,
+  /** `InputPreparationArtifactSummarySchema.envelopeDigest`, when the receipt carried one. */
+  artifactDigest: OPAQUE_ID.optional()
+}).strict();
+var InputPreparationRejectionReasonSchema = z.enum([
+  "input_preparation_unconfigured",
+  "bad_request",
+  "authority_unavailable",
+  "scope_denied",
+  "policy_revision_mismatch",
+  "runtime_identity_unavailable",
+  "unsupported_input",
+  "limit_exceeded",
+  "request_conflict",
+  "not_found",
+  "counter_unavailable",
+  "counter_interrupted",
+  "durable_write_failed",
+  "cancelled",
+  "context_unresolvable",
+  "context_hash_mismatch",
+  "toolsets_unobservable",
+  "deadline_elapsed",
+  /**
+   * A repeat of an already-recorded `requestId` arrived after the facts its
+   * executor fingerprints were frozen against changed — a toolset definition
+   * revision or a configured server argv. The recorded receipt is not re-derived and no
+   * server is re-probed; the repeat is refused so the caller mints a new
+   * preparation instead of silently receiving one bound to stale evidence.
+   */
+  "observation_drift",
+  /**
+   * The device compiled the input, then found that the `prompt_prepared` frame
+   * the runtime would have to be handed exceeds the single-frame byte cap that
+   * runtime enforces. The bound belongs to the runtime, not to the operator's
+   * retention policy, so it is decided first and nothing is retained: a
+   * preparation that could never be delivered is not a smaller preparation.
+   */
+  "rpc_frame_too_large",
+  /**
+   * The device's input-preparation lane is off because its durable record log
+   * holds a record from an older record schema version. The rest of the
+   * device runs; this lane refuses until an operator archives that log. No
+   * record is migrated, read forward or deleted.
+   */
+  "input_preparation_record_log_unsupported"
+]);
 var AGENT_EVENT_SPILL_UNSTORED_REASON_MAX_LENGTH = 512;
 var AgentEventSpillSchema = z.object({
   /** Which field of the event was replaced by a preview. */
@@ -661,6 +1059,18 @@ function partitionAgentEvents(events) {
   }
   return { known, unknown };
 }
+var AGENT_HOME_PROJECTION_MAX_BYTES = 64 * 1024;
+var AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM = "9223372036854775807";
+var AgentHomeProjectionProfileRevisionSchema = z.string().regex(/^[1-9][0-9]{0,18}$/u, "profileRevision must be a canonical positive decimal string").refine(
+  (value) => value.length < AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM.length || value <= AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM,
+  `profileRevision must not exceed PostgreSQL BIGINT maximum ${AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM}`
+);
+var AgentHomeProjectionHashSchema = AgentEgressContentHashSchema;
+var AgentHomeProjectionOutcomeSchema = z.enum(["applied", "idempotent", "stale", "conflict"]);
+var AgentHomeProjectionValueSchema = z.json().refine(
+  (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= AGENT_HOME_PROJECTION_MAX_BYTES,
+  `projection must not exceed ${AGENT_HOME_PROJECTION_MAX_BYTES} UTF-8 JSON bytes`
+);
 
 // src/messages.ts
 var MAX_INLINE_BYTES = 64 * 1024;
@@ -1009,7 +1419,8 @@ var TaskStartedPayloadSchema = z.object({});
 var TaskDeclinePayloadSchema = z.object({
   reason: z.string(),
   retryable: z.boolean().optional(),
-  agentRef: AgentRefSchema.optional()
+  agentRef: AgentRefSchema.optional(),
+  code: z.enum(["agent_home_writer_busy", "agent_home_reader_busy"]).optional()
 });
 var TaskProgressPayloadSchema = z.object({
   seq: z.number().int(),
@@ -1028,52 +1439,8 @@ var TaskAwaitApprovalPayloadSchema = z.object({
   approvalId: z.string().optional()
 });
 var RESULT_DOCUMENT_MAX_BYTES = 1048576;
-function isSameJsonData(a, b) {
-  if (a === null || b === null) return a === b;
-  const typeOfA = typeof a;
-  if (typeOfA !== typeof b) return false;
-  if (typeOfA !== "object") {
-    return a === b;
-  }
-  const aIsArray = Array.isArray(a);
-  if (aIsArray !== Array.isArray(b)) return false;
-  if (aIsArray) {
-    const arrayA = a;
-    const arrayB = b;
-    if (arrayA.length !== arrayB.length) return false;
-    for (let index = 0; index < arrayA.length; index += 1) {
-      if (!isSameJsonData(arrayA[index], arrayB[index])) return false;
-    }
-    return true;
-  }
-  const objectA = a;
-  const objectB = b;
-  const keysA = Object.keys(objectA);
-  const keysB = Object.keys(objectB);
-  if (keysA.length === 0) {
-    const prototypeA = Object.getPrototypeOf(objectA);
-    if (prototypeA !== Object.prototype && prototypeA !== null) return false;
-  }
-  if (keysA.length !== keysB.length) return false;
-  for (const key of keysA) {
-    if (!Object.prototype.hasOwnProperty.call(objectB, key)) return false;
-    if (!isSameJsonData(objectA[key], objectB[key])) return false;
-  }
-  return true;
-}
 function checkResultDocument(document) {
-  let json;
-  try {
-    json = JSON.stringify(document);
-  } catch {
-    return { ok: false, reason: "not-serializable" };
-  }
-  if (json === void 0) return { ok: false, reason: "not-serializable" };
-  const bytes = new TextEncoder().encode(json).length;
-  if (bytes > RESULT_DOCUMENT_MAX_BYTES) return { ok: false, reason: "over-cap", bytes };
-  const canonical = JSON.parse(json);
-  if (!isSameJsonData(document, canonical)) return { ok: false, reason: "not-plain-json" };
-  return { ok: true, bytes, canonical };
+  return canonicalizePlainJson(document, RESULT_DOCUMENT_MAX_BYTES);
 }
 var TERMINAL_INFERENCE_USAGE_MAX_TOKENS = 1e9;
 var TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS = 6048e5;
@@ -1255,7 +1622,6 @@ var DAEMON_TO_SERVER_TYPES = [
 ];
 
 // src/agent-memory-intent.ts
-var AGENT_MEMORY_INTENT_CAPABILITY = "agent-memory-intent.v1";
 var AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES = 262144;
 var AGENT_MEMORY_INTENT_PATH_MAX_BYTES = 1024;
 var AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES = 128;
@@ -1267,9 +1633,9 @@ var AgentMemoryIntentApprovalRefSchema = z.string().regex(
   new RegExp(`^[A-Za-z0-9._:-]{1,${AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES}}$`, "u"),
   `approvalRef must be 1..${AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES} characters of [A-Za-z0-9._:-]`
 );
-var LONE_SURROGATE = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u;
+var LONE_SURROGATE2 = /[\uD800-\uDBFF](?![\uDC00-\uDFFF])|(?<![\uD800-\uDBFF])[\uDC00-\uDFFF]/u;
 var utf8 = new TextEncoder();
-var AgentMemoryIntentContentSchema = z.string().refine((value) => !LONE_SURROGATE.test(value), "content must be well-formed Unicode (encodable as UTF-8)").refine(
+var AgentMemoryIntentContentSchema = z.string().refine((value) => !LONE_SURROGATE2.test(value), "content must be well-formed Unicode (encodable as UTF-8)").refine(
   (value) => utf8.encode(value).byteLength <= AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES,
   `content must not exceed ${AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES} UTF-8 bytes`
 );
@@ -1417,44 +1783,6 @@ function agentMemoryIntentFetchResponseSchemaFor(reservation) {
     }
   });
 }
-
-// src/version.ts
-var MAILBOX_READ_AHEAD_MAX_SEQS = 4096;
-var MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
-var PROTOCOL_VERSION = 2;
-var STRICT_AGENT_ONLY_CAPABILITY = "strict-agent-only";
-var AGENT_HOME_READERS_CAPABILITY = "agent-home-readers";
-var CUSTOM_HARNESS_CAPABILITY = "custom-harness";
-var CAPABILITY_FLAGS = [
-  "steer",
-  "blob-upload",
-  "interactive-approval",
-  "approval_resolved",
-  "approval-targeting",
-  "result-document",
-  "dispatch-selection",
-  PROVIDER_PROFILE_BINDING_CAPABILITY,
-  "toolset-selection",
-  "agent-home-contract",
-  AGENT_HOME_READERS_CAPABILITY,
-  STRICT_AGENT_ONLY_CAPABILITY,
-  AGENT_EGRESS_POLICY_CAPABILITY,
-  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
-  AGENT_MESSAGE_EGRESS_CAPABILITY,
-  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,
-  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
-  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,
-  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,
-  AGENT_HOME_PROJECTION_CAPABILITY,
-  AGENT_INPUT_PREPARATION_CAPABILITY,
-  TERMINAL_PROJECTION_SELECTION_CAPABILITY,
-  HOST_MCP_TASK_CONTEXT_CAPABILITY,
-  CUSTOM_HARNESS_CAPABILITY,
-  MAILBOX_READ_AHEAD_CAPABILITY,
-  PROVIDER_PROVISIONING_CAPABILITY,
-  AGENT_MEMORY_INTENT_CAPABILITY
-];
-var AGENT_MEMORY_PROJECTION_CAPABILITY = "agent.memory.projection";
 var AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES = 512 * 1024;
 var AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE = 2147483647;
 var OPAQUE_REFERENCE_MAX_BYTES = 512;
@@ -1524,29 +1852,6 @@ var AgentMemoryProjectionReceiptSchema = z.object({
   metering: AgentMemoryProjectionMeteringReceiptSchema
 }).strict();
 var AgentMemoryProjectionEraseResultSchema = z.object({ nextWriterEpoch: AgentMemoryProjectionWriterEpochSchema }).strict();
-
-// src/task-state.ts
-var TASK_STATES = [
-  "Offered",
-  "Claimed",
-  "Running",
-  "AwaitApproval",
-  "Complete",
-  "Failed",
-  "Cancelled"
-];
-var TASK_TRANSITIONS = {
-  Offered: ["Claimed", "Cancelled", "Failed"],
-  Claimed: ["Running", "Failed", "Cancelled"],
-  Running: ["AwaitApproval", "Complete", "Failed", "Cancelled"],
-  AwaitApproval: ["Running", "Failed", "Cancelled"],
-  Complete: [],
-  Failed: [],
-  Cancelled: []
-};
-function canTransition(from, to) {
-  return TASK_TRANSITIONS[from].includes(to);
-}
 var REQUIRED_TASK_ID = z.string().min(1);
 var OPTIONAL_TASK_ID = REQUIRED_TASK_ID.optional();
 var FORBIDDEN_TASK_ID = z.never().optional();
@@ -1777,16 +2082,36 @@ var EventsPollQuerySchema = z.object({
   /** Last reliably processed seq; the only acknowledgement. Omitted on the first poll. */
   cursor: z.number().int().nonnegative().optional()
 });
+var ActivityIngressSchema = z.object({
+  activityMaxEvents: z.number().int().positive(),
+  activityMaxBytes: z.number().int().min(2)
+});
+var OUTBOUND_REFUSAL_REASONS = ["payload_invalid", "not_permitted", "limit_exceeded", "state_conflict", "unsupported"];
+function isOutboundRefusalCode(value) {
+  return OUTBOUND_REFUSAL_REASONS.includes(value);
+}
+var MessageSendOutcomeSchema = z.object({
+  id: z.uuid(),
+  outcome: z.enum(["accepted", "duplicate", "rejected"]),
+  /** Decodes to an {@link OutboundRefusalReason}; an unrecognized string becomes `unknown`. */
+  reason: z.string().max(64).transform((value) => isOutboundRefusalCode(value) ? value : "unknown").optional()
+});
 var EventsPollResponseSchema = z.object({
-  events: z.array(EnvelopeSchema),
+  /**
+   * Not-yet-decoded entries (#386). This schema decodes the page only; each
+   * entry is decoded on its own with `parseMessage`, so one unknown or invalid
+   * entry stalls its own sequence instead of failing every entry in the page.
+   */
+  events: z.array(z.unknown()),
   cursor: z.number().int(),
   /**
-   * Server capabilities for THIS long-poll response. This is the HTTP
-   * transport's equivalent of `conn.ack.capabilities`: a new daemon treats
-   * absence as no advertised capabilities, so old responders remain
-   * fail-closed for gated daemon -> server fields and messages.
+   * Required in v3: the server capabilities for THIS long-poll response, the
+   * HTTP transport's equivalent of `conn.ack.capabilities`. Each page replaces
+   * the daemon's advertisement; an empty list advertises nothing.
    */
-  capabilities: z.array(z.string()).optional()
+  capabilities: z.array(z.string()),
+  /** Required in v3: the activity limits that apply to new progress pushes. */
+  ingress: ActivityIngressSchema
 });
 var MAX_MESSAGES_PER_BATCH = 256;
 var MessagesSendRequestSchema = z.object({
@@ -1794,7 +2119,10 @@ var MessagesSendRequestSchema = z.object({
 });
 var MessagesSendResponseSchema = z.object({
   accepted: z.number().int().nonnegative(),
-  rejected: z.number().int().nonnegative().optional()
+  rejected: z.number().int().nonnegative().optional(),
+  capabilities: z.array(z.string()).optional(),
+  ingress: ActivityIngressSchema.optional(),
+  outcomes: z.array(MessageSendOutcomeSchema).max(MAX_MESSAGES_PER_BATCH)
 });
 var AgentHomeProjectionCompletionRequestSchema = z.object({
   requestId: z.uuid(),
@@ -1919,6 +2247,6 @@ function byokBlobContentPath(blobId) {
   return `/byok/blobs/${blobId}/content`;
 }
 
-export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EVENT_SPILL_UNSTORED_REASON_MAX_LENGTH, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_HOME_PROJECTION_MAX_BYTES, AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM, AGENT_HOME_READERS_CAPABILITY, AGENT_INPUT_PREPARATION_CAPABILITY, AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES, AGENT_MEMORY_INTENT_CAPABILITY, AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS_BY_RESERVATION, AGENT_MEMORY_INTENT_HOST_TERMINAL_CODES, AGENT_MEMORY_INTENT_OPERATIONS, AGENT_MEMORY_INTENT_PATH_MAX_BYTES, AGENT_MEMORY_INTENT_READBACK_DISPOSITIONS, AGENT_MEMORY_INTENT_REJECTION_CODES, AGENT_MEMORY_INTENT_RESERVATIONS, AGENT_MEMORY_PROJECTION_CAPABILITY, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, AGENT_MESSAGE_EGRESS_CAPABILITY, AGENT_MESSAGE_MAX_BYTES, AGENT_REF_MAX_BYTES, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentContentReadPayloadSchema, AgentContentReadSurfaceSchema, AgentContentReceiptPayloadSchema, AgentEgressAckPayloadSchema, AgentEgressActivityPolicySchema, AgentEgressContentHashSchema, AgentEgressDropReasonSchema, AgentEgressLaneSchema, AgentEgressPolicyRevisionSchema, AgentEgressPolicySchema, AgentEgressReliablePayloadSchema, AgentEventOrUnknownSchema, AgentEventSchema, AgentEventSpillSchema, AgentHomeAccessSchema, AgentHomeProjectionAgentRefSchema, AgentHomeProjectionCompletionRequestSchema, AgentHomeProjectionHashSchema, AgentHomeProjectionOutcomeSchema, AgentHomeProjectionPayloadSchema, AgentHomeProjectionProfileRevisionSchema, AgentHomeProjectionReadbackSchema, AgentHomeProjectionStatusSchema, AgentHomeProjectionValueSchema, AgentInputPreparationPayloadSchema, AgentMemoryIntentApprovalRefSchema, AgentMemoryIntentAvailablePayloadSchema, AgentMemoryIntentCompletionSchema, AgentMemoryIntentContentSchema, AgentMemoryIntentFetchRequestSchema, AgentMemoryIntentFetchResponseSchema, AgentMemoryIntentFileObservationSchema, AgentMemoryIntentHostTerminalCodeSchema, AgentMemoryIntentOperationDigestSchema, AgentMemoryIntentOperationSchema, AgentMemoryIntentPathSchema, AgentMemoryIntentReadbackDispositionSchema, AgentMemoryIntentReadbackSchema, AgentMemoryIntentRejectionCodeSchema, AgentMemoryIntentReservationSchema, AgentMemoryIntentRevisionSchema, AgentMemoryIntentV1Schema, AgentMemoryProjectionCommitRequestSchema, AgentMemoryProjectionCommitResponseSchema, AgentMemoryProjectionEraseResultSchema, AgentMemoryProjectionGrantRefSchema, AgentMemoryProjectionMeteringReceiptSchema, AgentMemoryProjectionMutationSchema, AgentMemoryProjectionReceiptSchema, AgentMemoryProjectionSessionRefSchema, AgentMemoryProjectionSnapshotSchema, AgentMemoryProjectionSourceSeqSchema, AgentMemoryProjectionWriterEpochSchema, AgentMessageContentTypeSchema, AgentMessageContractSchema, AgentMessageDestinationBindingSchema, AgentMessageDispositionPayloadSchema, AgentMessageEgressRequirementSchema, AgentMessageFreshnessCursorSchema, AgentMessagePublishPayloadSchema, AgentMessageServerContextSchema, AgentRefSchema, AgentReliableQuotaPolicySchema, BYOK_ACTIVITY_PATH, BYOK_AGENT_HOME_PROJECTIONS_PATH, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, BYOK_AGENT_MEMORY_PROJECTIONS_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_EVENTS_PATH, BYOK_INPUT_PREPARATIONS_PATH, BYOK_INPUT_PREPARATION_COMPLETION_ROUTE, BYOK_INPUT_PREPARATION_STATUS_ROUTE, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, CUSTOM_HARNESS_CAPABILITY, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, ContentReadPolicySchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, HOST_MCP_TASK_CONTEXT_CAPABILITY, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, INPUT_PREPARATION_WIRE_VERSION, InputPreparationAccountingPolicyRefSchema, InputPreparationArtifactSummarySchema, InputPreparationBindingSchema, InputPreparationCompletionRequestSchema, InputPreparationContentHashSchema, InputPreparationContextDocumentSchema, InputPreparationCounterEvidenceSchema, InputPreparationCounterProviderEvidenceSchema, InputPreparationCounterTargetSchema, InputPreparationHostCanonicalAssistantMessageSchema, InputPreparationMessageSchema, InputPreparationModelCostSchema, InputPreparationModelSchema, InputPreparationOfferBindingSchema, InputPreparationOptionsSchema, InputPreparationPolicyRevisionSchema, InputPreparationProfileIdSchema, InputPreparationProjectionSchema, InputPreparationPromptSnapshotSchema, InputPreparationReadbackSchema, InputPreparationReadinessReasonSchema, InputPreparationReceiptSummarySchema, InputPreparationReferenceSchema, InputPreparationRejectionReasonSchema, InputPreparationResidualKeySchema, InputPreparationResidualValueClassSchema, InputPreparationRuntimeIdentitySchema, InputPreparationSelectionSchema, InputPreparationSourceSchema, InputPreparationStateSchema, InputPreparationStatusQuerySchema, InputPreparationStatusSchema, InputPreparationUserMessageSchema, KNOWN_AGENT_EVENT_TYPES, MAILBOX_READ_AHEAD_CAPABILITY, MAILBOX_READ_AHEAD_MAX_SEQS, MAX_MESSAGES_PER_BATCH, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessagesSendRequestSchema, MessagesSendResponseSchema, PAIR_RESPONSE_TENANT_ID_MAX_LENGTH, PROTOCOL_VERSION, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_BINDING_CAPABILITY, PROVIDER_PROVISIONING_CAPABILITY, PROVIDER_PROVISIONING_DISPOSITIONS, PROVIDER_PROVISIONING_HOST_TERMINAL_CODES, PROVIDER_PROVISIONING_KEY_CHECK_RESULTS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM, PROVIDER_PROVISIONING_REJECTION_CODES, PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION, PairRequestSchema, PairResponseSchema, PairResponseTenantIdSchema, PreparedAgentMemoryModeSchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, ProviderModelCapabilitySchema, ProviderProfileBindingSchema, ProviderProfileHashSchema, ProviderProfileRefSchema, ProviderProfileRevisionSchema, ProviderProvisioningAvailablePayloadSchema, ProviderProvisioningCompletionSchema, ProviderProvisioningDispositionSchema, ProviderProvisioningKeyCheckResultSchema, ProviderProvisioningKeyCheckSchema, ProviderProvisioningOperationDigestSchema, ProviderProvisioningOperationGenerationSchema, ProviderProvisioningOperationSchema, ProviderProvisioningProviderStatusSchema, ProviderProvisioningReadbackSchema, ProviderProvisioningRejectionCodeSchema, RESULT_DOCUMENT_MAX_BYTES, RequiredToolsetsSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SERVER_TO_DAEMON_TYPES, STRICT_AGENT_ONLY_CAPABILITY, TASK_OFFER_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_PROJECTION_SELECTION_CAPABILITY, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferPayloadSchema, TaskOfferPreparedPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalAgentHomeMemoryChangeSchema, TerminalAgentHomeProjectionSchema, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalProjectionContractSchema, TerminalProjectionSelectionSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, agentMemoryIntentFetchResponseSchemaFor, agentMemoryProjectionBase64UrlByteLength, byokAgentHomeProjectionCompletionPath, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokInputPreparationCompletionPath, byokInputPreparationStatusPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isServerToDaemonType, isTaskOfferType, parseMessage, partitionAgentEvents };
+export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EVENT_SPILL_UNSTORED_REASON_MAX_LENGTH, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_HOME_PROJECTION_MAX_BYTES, AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM, AGENT_HOME_READERS_CAPABILITY, AGENT_INPUT_PREPARATION_CAPABILITY, AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES, AGENT_MEMORY_INTENT_CAPABILITY, AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS_BY_RESERVATION, AGENT_MEMORY_INTENT_HOST_TERMINAL_CODES, AGENT_MEMORY_INTENT_OPERATIONS, AGENT_MEMORY_INTENT_PATH_MAX_BYTES, AGENT_MEMORY_INTENT_READBACK_DISPOSITIONS, AGENT_MEMORY_INTENT_REJECTION_CODES, AGENT_MEMORY_INTENT_RESERVATIONS, AGENT_MEMORY_PROJECTION_CAPABILITY, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, AGENT_MESSAGE_EGRESS_CAPABILITY, AGENT_MESSAGE_MAX_BYTES, AGENT_REF_MAX_BYTES, ActivityIngressSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentContentReadPayloadSchema, AgentContentReadSurfaceSchema, AgentContentReceiptPayloadSchema, AgentEgressAckPayloadSchema, AgentEgressActivityPolicySchema, AgentEgressContentHashSchema, AgentEgressDropReasonSchema, AgentEgressLaneSchema, AgentEgressPolicyRevisionSchema, AgentEgressPolicySchema, AgentEgressReliablePayloadSchema, AgentEventOrUnknownSchema, AgentEventSchema, AgentEventSpillSchema, AgentHomeAccessSchema, AgentHomeProjectionAgentRefSchema, AgentHomeProjectionCompletionRequestSchema, AgentHomeProjectionHashSchema, AgentHomeProjectionOutcomeSchema, AgentHomeProjectionPayloadSchema, AgentHomeProjectionProfileRevisionSchema, AgentHomeProjectionReadbackSchema, AgentHomeProjectionStatusSchema, AgentHomeProjectionValueSchema, AgentInputPreparationPayloadSchema, AgentMemoryIntentApprovalRefSchema, AgentMemoryIntentAvailablePayloadSchema, AgentMemoryIntentCompletionSchema, AgentMemoryIntentContentSchema, AgentMemoryIntentFetchRequestSchema, AgentMemoryIntentFetchResponseSchema, AgentMemoryIntentFileObservationSchema, AgentMemoryIntentHostTerminalCodeSchema, AgentMemoryIntentOperationDigestSchema, AgentMemoryIntentOperationSchema, AgentMemoryIntentPathSchema, AgentMemoryIntentReadbackDispositionSchema, AgentMemoryIntentReadbackSchema, AgentMemoryIntentRejectionCodeSchema, AgentMemoryIntentReservationSchema, AgentMemoryIntentRevisionSchema, AgentMemoryIntentV1Schema, AgentMemoryProjectionCommitRequestSchema, AgentMemoryProjectionCommitResponseSchema, AgentMemoryProjectionEraseResultSchema, AgentMemoryProjectionGrantRefSchema, AgentMemoryProjectionMeteringReceiptSchema, AgentMemoryProjectionMutationSchema, AgentMemoryProjectionReceiptSchema, AgentMemoryProjectionSessionRefSchema, AgentMemoryProjectionSnapshotSchema, AgentMemoryProjectionSourceSeqSchema, AgentMemoryProjectionWriterEpochSchema, AgentMessageContentTypeSchema, AgentMessageContractSchema, AgentMessageDestinationBindingSchema, AgentMessageDispositionPayloadSchema, AgentMessageEgressRequirementSchema, AgentMessageFreshnessCursorSchema, AgentMessagePublishPayloadSchema, AgentMessageServerContextSchema, AgentRefSchema, AgentReliableQuotaPolicySchema, BYOK_ACTIVITY_PATH, BYOK_AGENT_HOME_PROJECTIONS_PATH, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, BYOK_AGENT_MEMORY_PROJECTIONS_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_EVENTS_PATH, BYOK_INPUT_PREPARATIONS_PATH, BYOK_INPUT_PREPARATION_COMPLETION_ROUTE, BYOK_INPUT_PREPARATION_STATUS_ROUTE, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, CUSTOM_HARNESS_CAPABILITY, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, ContentReadPolicySchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, HOST_MCP_TASK_CONTEXT_CAPABILITY, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, INPUT_PREPARATION_WIRE_VERSION, InputPreparationAccountingPolicyRefSchema, InputPreparationArtifactSummarySchema, InputPreparationBindingSchema, InputPreparationCompletionRequestSchema, InputPreparationContentHashSchema, InputPreparationContextDocumentSchema, InputPreparationCounterEvidenceSchema, InputPreparationCounterProviderEvidenceSchema, InputPreparationCounterTargetSchema, InputPreparationHostCanonicalAssistantMessageSchema, InputPreparationMessageSchema, InputPreparationModelCostSchema, InputPreparationModelSchema, InputPreparationOfferBindingSchema, InputPreparationOptionsSchema, InputPreparationPolicyRevisionSchema, InputPreparationProfileIdSchema, InputPreparationProjectionSchema, InputPreparationPromptSnapshotSchema, InputPreparationReadbackSchema, InputPreparationReadinessReasonSchema, InputPreparationReceiptSummarySchema, InputPreparationReferenceSchema, InputPreparationRejectionReasonSchema, InputPreparationResidualKeySchema, InputPreparationResidualValueClassSchema, InputPreparationRuntimeIdentitySchema, InputPreparationSelectionSchema, InputPreparationSourceSchema, InputPreparationStateSchema, InputPreparationStatusQuerySchema, InputPreparationStatusSchema, InputPreparationUserMessageSchema, KNOWN_AGENT_EVENT_TYPES, MAILBOX_READ_AHEAD_CAPABILITY, MAILBOX_READ_AHEAD_MAX_SEQS, MAX_MESSAGES_PER_BATCH, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessageSendOutcomeSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, OUTBOUND_REFUSAL_REASONS, PAIR_RESPONSE_TENANT_ID_MAX_LENGTH, PREPARED_AGENT_MEMORY_MODES, PROTOCOL_VERSION, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_BINDING_CAPABILITY, PROVIDER_PROVISIONING_CAPABILITY, PROVIDER_PROVISIONING_DISPOSITIONS, PROVIDER_PROVISIONING_HOST_TERMINAL_CODES, PROVIDER_PROVISIONING_KEY_CHECK_RESULTS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM, PROVIDER_PROVISIONING_REJECTION_CODES, PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION, PairRequestSchema, PairResponseSchema, PairResponseTenantIdSchema, PreparedAgentMemoryModeSchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, ProviderModelCapabilitySchema, ProviderProfileBindingSchema, ProviderProfileHashSchema, ProviderProfileRefSchema, ProviderProfileRevisionSchema, ProviderProvisioningAvailablePayloadSchema, ProviderProvisioningCompletionSchema, ProviderProvisioningDispositionSchema, ProviderProvisioningKeyCheckResultSchema, ProviderProvisioningKeyCheckSchema, ProviderProvisioningOperationDigestSchema, ProviderProvisioningOperationGenerationSchema, ProviderProvisioningOperationSchema, ProviderProvisioningProviderStatusSchema, ProviderProvisioningReadbackSchema, ProviderProvisioningRejectionCodeSchema, RESULT_DOCUMENT_MAX_BYTES, RESULT_ISSUES_MAX_BYTES, RESULT_ISSUES_MAX_COUNT, RESULT_JSON_MAX_DEPTH, RESULT_OUTCOME_MAX_BYTES, RESULT_SCHEMA_INSTANCE_TYPES, RESULT_SCHEMA_KEYWORDS, RESULT_SCHEMA_MAX_BYTES, RESULT_SCHEMA_MAX_DEPTH, RequiredToolsetsSchema, ResultDocumentSchemaSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SERVER_TO_DAEMON_TYPES, STRICT_AGENT_ONLY_CAPABILITY, TASK_OFFER_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_PROJECTION_SELECTION_CAPABILITY, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferPayloadSchema, TaskOfferPreparedPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalAgentHomeMemoryChangeSchema, TerminalAgentHomeProjectionSchema, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalProjectionContractSchema, TerminalProjectionSelectionSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, WIRE_ADDITIONS, agentMemoryIntentFetchResponseSchemaFor, agentMemoryProjectionBase64UrlByteLength, byokAgentHomeProjectionCompletionPath, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokInputPreparationCompletionPath, byokInputPreparationStatusPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, checkResultSchema, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isPreparedAgentMemoryMode, isServerToDaemonType, isTaskOfferType, parseMessage, partitionAgentEvents, requiredReceiverCapabilities, validateResultOutcome };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map