@byok-sdk/protocol 0.26.1 → 0.27.0

package/dist/input-preparation.d.ts

@@ -1,28 +1,4 @@
 import { z } from 'zod';
-export { INPUT_PREPARATION_WIRE_VERSION } from './input-preparation-version';
-/**
- * Capability required before a task-free remote input preparation — or a
- * prepared Execution — is admitted: `agent-input-preparation-v<N>`, where
- * `<N>` is {@link INPUT_PREPARATION_WIRE_VERSION}.
- *
- * The version is IN the token because the relay wire has none. A device
- * declares exactly the one token of the contract it speaks, and a cloud admits
- * exactly the one token of the contract it speaks, so a device and a cloud on
- * different contract versions never exchange a preparation at all: the cloud
- * refuses at enqueue (`agent_capability_missing`, before any receipt or
- * mailbox row) instead of relaying a payload the other side would refuse with
- * a strict-schema 422 and a device would then redeliver forever. There is no
- * dual token and no accepted older one. The retired unversioned token
- * `agent-input-preparation` (versions up to 4) is admitted nowhere.
- *
- * The token gates NEW admissions only. A row enqueued before a version cut is
- * still in flight afterwards, and its completion is accepted only by a cloud
- * on the same version as the device answering it; across the cut it is a 422
- * and a stalled device cursor. Draining in-flight rows and upgrading cloud and
- * devices as a pair is the operator precondition for the cut (`docs/spec.md`,
- * bounded admission); nothing here parses an older receipt.
- */
-export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v9";
 /** The preparation surface uses the package-wide lowercase `sha256:<hex>` transport form. */
 export declare const InputPreparationContentHashSchema: z.ZodString;
 /**
@@ -577,6 +553,13 @@ export declare const InputPreparationArtifactSummarySchema: z.ZodObject<{
 }, z.core.$strict>;
 /** The immutable binding a receipt carries and a later consumer must re-present. */
 export declare const InputPreparationBindingSchema: z.ZodObject<{
+    terminalProjection: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        mode: z.ZodLiteral<"none">;
+    }, z.core.$strict>, z.ZodObject<{
+        mode: z.ZodLiteral<"result-document">;
+        contract: z.ZodString;
+        schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
+    }, z.core.$strict>], "mode">>;
     agentMemory: z.ZodEnum<{
         none: "none";
         read: "read";
@@ -636,6 +619,13 @@ export declare const InputPreparationReceiptSummarySchema: z.ZodObject<{
         reserved: "reserved";
     }>;
     binding: z.ZodObject<{
+        terminalProjection: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+            mode: z.ZodLiteral<"none">;
+        }, z.core.$strict>, z.ZodObject<{
+            mode: z.ZodLiteral<"result-document">;
+            contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
+        }, z.core.$strict>], "mode">>;
         agentMemory: z.ZodEnum<{
             none: "none";
             read: "read";

package/dist/messages.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { type PlainJsonCheck } from './plain-json';
 export declare const RuntimeIdSchema: z.ZodEnum<{
     claude: "claude";
     codex: "codex";
@@ -27,6 +28,7 @@ export declare const RuntimeCapabilitiesSchema: z.ZodObject<{
     resume: z.ZodOptional<z.ZodBoolean>;
     approvalInteractive: z.ZodOptional<z.ZodBoolean>;
     mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+    messageDraft: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 export type RuntimeCapabilities = z.infer<typeof RuntimeCapabilitiesSchema>;
 /**
@@ -47,6 +49,7 @@ export declare const RuntimeInfoSchema: z.ZodObject<{
         resume: z.ZodOptional<z.ZodBoolean>;
         approvalInteractive: z.ZodOptional<z.ZodBoolean>;
         mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+        messageDraft: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type RuntimeInfo = z.infer<typeof RuntimeInfoSchema>;
@@ -61,6 +64,7 @@ export declare const HarnessInfoSchema: z.ZodObject<{
         resume: z.ZodOptional<z.ZodBoolean>;
         approvalInteractive: z.ZodOptional<z.ZodBoolean>;
         mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+        messageDraft: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export type HarnessInfo = z.infer<typeof HarnessInfoSchema>;
@@ -72,6 +76,7 @@ export declare const HarnessInventorySchema: z.ZodArray<z.ZodObject<{
         resume: z.ZodOptional<z.ZodBoolean>;
         approvalInteractive: z.ZodOptional<z.ZodBoolean>;
         mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+        messageDraft: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>;
 }, z.core.$strip>>;
 /** Maximum logical toolsets one daemon may advertise as locally configured. */
@@ -126,6 +131,7 @@ export declare const ConnHelloPayloadSchema: z.ZodObject<{
             resume: z.ZodOptional<z.ZodBoolean>;
             approvalInteractive: z.ZodOptional<z.ZodBoolean>;
             mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+            messageDraft: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>>>;
     harnesses: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -136,6 +142,7 @@ export declare const ConnHelloPayloadSchema: z.ZodObject<{
             resume: z.ZodOptional<z.ZodBoolean>;
             approvalInteractive: z.ZodOptional<z.ZodBoolean>;
             mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+            messageDraft: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>;
     }, z.core.$strip>>>;
     configuredToolsets: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -372,6 +379,7 @@ export declare const TaskOfferForAgentPayloadSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         mode: z.ZodLiteral<"result-document">;
         contract: z.ZodString;
+        schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
     }, z.core.$strict>], "mode">>;
     sessionRef: z.ZodOptional<z.ZodString>;
     limits: z.ZodOptional<z.ZodObject<{
@@ -438,6 +446,7 @@ export declare const TaskOfferForAgentWithEgressPayloadSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         mode: z.ZodLiteral<"result-document">;
         contract: z.ZodString;
+        schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
     }, z.core.$strict>], "mode">>;
     limits: z.ZodOptional<z.ZodObject<{
         maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -541,6 +550,7 @@ export declare const TaskOfferForAgentWithEgressFreshPayloadSchema: z.ZodObject<
     }, z.core.$strict>, z.ZodObject<{
         mode: z.ZodLiteral<"result-document">;
         contract: z.ZodString;
+        schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
     }, z.core.$strict>], "mode">>;
     limits: z.ZodOptional<z.ZodObject<{
         maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -648,6 +658,7 @@ export declare const TaskOfferPreparedPayloadSchema: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         mode: z.ZodLiteral<"result-document">;
         contract: z.ZodString;
+        schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
     }, z.core.$strict>], "mode">>;
     limits: z.ZodOptional<z.ZodObject<{
         maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -730,6 +741,18 @@ export declare const AgentEgressAckPayloadSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type AgentEgressAckPayload = z.infer<typeof AgentEgressAckPayloadSchema>;
 /** Daemon -> server: one Agent-authored message, independent from task activity. */
+/** Display-only text. Offsets count UTF-8 bytes within one revision. */
+export declare const AgentMessageDraftPayloadSchema: z.ZodObject<{
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    revision: z.ZodNumber;
+    offset: z.ZodNumber;
+    text: z.ZodString;
+    overflow: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+export type AgentMessageDraftPayload = z.infer<typeof AgentMessageDraftPayloadSchema>;
 export declare const AgentMessagePublishPayloadSchema: z.ZodObject<{
     agentRef: z.ZodObject<{
         agentId: z.ZodString;
@@ -1203,6 +1226,7 @@ export declare const TaskClaimPayloadSchema: z.ZodObject<{
         resume: z.ZodOptional<z.ZodBoolean>;
         approvalInteractive: z.ZodOptional<z.ZodBoolean>;
         mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+        messageDraft: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type TaskClaimPayload = z.infer<typeof TaskClaimPayloadSchema>;
@@ -1222,7 +1246,7 @@ export type TaskStartedPayload = z.infer<typeof TaskStartedPayloadSchema>;
  * writeup): declining does *not* introduce a new `Declined` terminal state.
  * It maps onto the existing `Failed` state via a new `Offered -> Failed`
  * transition. `reason`/`retryable` intentionally mirror `TaskFailPayload`
- * exactly, because a pre-claim decline and a post-claim failure are the same
+ * semantics, because a pre-claim decline and a post-claim failure are the same
  * outcome from the dispatcher's point of view (this attempt produced no
  * result; here's whether retrying — e.g. offering to a different device —
  * makes sense), and keeping the state machine minimal avoids forking every
@@ -1235,6 +1259,10 @@ export declare const TaskDeclinePayloadSchema: z.ZodObject<{
         agentId: z.ZodString;
         profileRevision: z.ZodString;
     }, z.core.$strict>>;
+    code: z.ZodOptional<z.ZodEnum<{
+        agent_home_reader_busy: "agent_home_reader_busy";
+        agent_home_writer_busy: "agent_home_writer_busy";
+    }>>;
 }, z.core.$strip>;
 export type TaskDeclinePayload = z.infer<typeof TaskDeclinePayloadSchema>;
 /**
@@ -1392,21 +1420,7 @@ export declare const RESULT_DOCUMENT_MAX_BYTES = 1048576;
  * in a failure reason. `canonical` is the CANONICAL SNAPSHOT — the value a
  * sender must actually put on the wire; see {@link checkResultDocument}.
  */
-export type ResultDocumentCheck = {
-    readonly ok: true;
-    readonly bytes: number;
-    readonly canonical: unknown;
-} | {
-    readonly ok: false;
-    readonly reason: 'not-serializable';
-} | {
-    readonly ok: false;
-    readonly reason: 'over-cap';
-    readonly bytes: number;
-} | {
-    readonly ok: false;
-    readonly reason: 'not-plain-json';
-};
+export type ResultDocumentCheck = PlainJsonCheck;
 /**
  * THE single authority for "is this a legal `task.complete.document`", and
  * the one place its canonical form is produced. `TaskCompletePayloadSchema`'s
@@ -1444,7 +1458,7 @@ export type ResultDocumentCheck = {
  *      no `toJSON`, no getters, no prototype, nothing left that can answer
  *      differently a second time.
  *   4. The original must be structurally equal to the snapshot
- *      ({@link isSameJsonData}). Any mismatch means the value was not plain
+ *      (`isSameJsonData`, `plain-json.ts`). Any mismatch means the value was not plain
  *      JSON data, and it is rejected rather than silently transformed.
  *
  * On success the snapshot is returned as `canonical`, and **every sender
@@ -1566,7 +1580,7 @@ export type TerminalAgentHomeMemoryChange = z.infer<typeof TerminalAgentHomeMemo
 /**
  * daemon -> server: task finished successfully.
  *
- * `document` (additive-minor, docs/protocol.md "Freeze rule"): the OPTIONAL
+ * `document` (docs/protocol.md §7.2): the OPTIONAL
  * structured terminal result of the task — one JSON value the product on the
  * other side consumes as the task's actual output, as opposed to `summary`
  * (human-readable prose) or `artifactRefs` (files). Deliberately
@@ -1580,14 +1594,12 @@ export type TerminalAgentHomeMemoryChange = z.infer<typeof TerminalAgentHomeMemo
  * never truncated (see that constant's own doc comment). A sender puts the
  * check's `canonical` snapshot on the wire, never the original object.
  *
- * Unlike `approvalId` on `task.await_approval` above, emitting this field IS
- * gated on a capability flag (`result-document`, `version.ts`): a pre-
- * `result-document` server strips it silently as an unknown key (the
- * tolerant `z.object()` behavior §1 mandates), and silently losing the
- * task's primary structured result is not a tolerable degradation the way
- * losing an observability hint is. So a daemon sends `document` only to a
- * server that advertised the flag, and fails the task loudly otherwise —
- * see `packages/client`'s `task-runner.ts`.
+ * Wire v3: every v3 server keeps this field, so no capability flag gates it
+ * (the v2 `result-document` flag is gone). For a
+ * `terminalProjection.mode: 'result-document'` offer it carries the outcome
+ * the daemon validated against the offer's frozen schema
+ * (`validateResultOutcome`, `result-schema.ts`, at most
+ * `RESULT_OUTCOME_MAX_BYTES`).
  */
 export declare const TaskCompletePayloadSchema: z.ZodObject<{
     harnessId: z.ZodOptional<z.ZodString>;
@@ -1950,6 +1962,7 @@ declare const TASK_OFFER_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         sessionRef: z.ZodOptional<z.ZodString>;
         limits: z.ZodOptional<z.ZodObject<{
@@ -2010,6 +2023,7 @@ declare const TASK_OFFER_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         limits: z.ZodOptional<z.ZodObject<{
             maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -2106,6 +2120,7 @@ declare const TASK_OFFER_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         limits: z.ZodOptional<z.ZodObject<{
             maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -2192,6 +2207,7 @@ declare const TASK_OFFER_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         limits: z.ZodOptional<z.ZodObject<{
             maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -2402,6 +2418,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         sessionRef: z.ZodOptional<z.ZodString>;
         limits: z.ZodOptional<z.ZodObject<{
@@ -2462,6 +2479,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         limits: z.ZodOptional<z.ZodObject<{
             maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -2558,6 +2576,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         limits: z.ZodOptional<z.ZodObject<{
             maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -2644,6 +2663,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
         }, z.core.$strict>, z.ZodObject<{
             mode: z.ZodLiteral<"result-document">;
             contract: z.ZodString;
+            schema: z.ZodCustom<import("./result-schema").ResultSchema, import("./result-schema").ResultSchema>;
         }, z.core.$strict>], "mode">>;
         limits: z.ZodOptional<z.ZodObject<{
             maxDurationMs: z.ZodOptional<z.ZodNumber>;
@@ -2715,6 +2735,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
                 resume: z.ZodOptional<z.ZodBoolean>;
                 approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                 mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                messageDraft: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>>;
         }, z.core.$strip>>>;
         harnesses: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -2725,6 +2746,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
                 resume: z.ZodOptional<z.ZodBoolean>;
                 approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                 mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                messageDraft: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>;
         }, z.core.$strip>>>;
         configuredToolsets: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -2759,6 +2781,16 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
         cursor: z.ZodNumber;
         receiptId: z.ZodUUID;
     }, z.core.$strict>;
+    readonly 'agent.message.draft': z.ZodObject<{
+        agentRef: z.ZodObject<{
+            agentId: z.ZodString;
+            profileRevision: z.ZodString;
+        }, z.core.$strict>;
+        revision: z.ZodNumber;
+        offset: z.ZodNumber;
+        text: z.ZodString;
+        overflow: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>;
     readonly 'agent.message.publish': z.ZodObject<{
         agentRef: z.ZodObject<{
             agentId: z.ZodString;
@@ -3103,6 +3135,7 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
             resume: z.ZodOptional<z.ZodBoolean>;
             approvalInteractive: z.ZodOptional<z.ZodBoolean>;
             mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+            messageDraft: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
     readonly 'task.started': z.ZodObject<{}, z.core.$strip>;
@@ -3113,6 +3146,10 @@ export declare const MESSAGE_PAYLOAD_SCHEMAS: {
             agentId: z.ZodString;
             profileRevision: z.ZodString;
         }, z.core.$strict>>;
+        code: z.ZodOptional<z.ZodEnum<{
+            agent_home_reader_busy: "agent_home_reader_busy";
+            agent_home_writer_busy: "agent_home_writer_busy";
+        }>>;
     }, z.core.$strip>;
     readonly 'task.progress': z.ZodObject<{
         seq: z.ZodNumber;
@@ -3377,5 +3414,5 @@ export declare const SERVER_TO_DAEMON_TYPES: readonly ["conn.ack", "task.offer",
  * or anything unrecognized — is rejected before it's dispatched to any
  * handler or counted `accepted` on the `/byok/messages` wire.
  */
-export declare const DAEMON_TO_SERVER_TYPES: readonly ["task.claim", "task.started", "task.decline", "task.progress", "task.artifact", "task.await_approval", "task.complete", "task.fail", "task.cancelled", "task.approval_resolved", "agent.egress.reliable", "agent.message.publish", "agent.content.receipt"];
+export declare const DAEMON_TO_SERVER_TYPES: readonly ["task.claim", "task.started", "task.decline", "task.progress", "task.artifact", "task.await_approval", "task.complete", "task.fail", "task.cancelled", "task.approval_resolved", "agent.egress.reliable", "agent.message.draft", "agent.message.publish", "agent.content.receipt"];
 export {};

package/dist/plain-json.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Plain-JSON-data canonicalization shared by every bounded JSON channel of
+ * the wire: `task.complete.document` (`checkResultDocument`, messages.ts) and
+ * the result-document schema and outcome (`result-schema.ts`). One rule, one
+ * implementation, so the channels cannot disagree about what "plain JSON
+ * data" means or how its canonical UTF-8 size is measured.
+ *
+ * Zod-free and free of node builtins.
+ */
+/** Outcome of {@link canonicalizePlainJson} without a depth bound. */
+export type PlainJsonCheck = {
+    readonly ok: true;
+    readonly bytes: number;
+    readonly canonical: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: 'not-serializable';
+} | {
+    readonly ok: false;
+    readonly reason: 'over-cap';
+    readonly bytes: number;
+} | {
+    readonly ok: false;
+    readonly reason: 'not-plain-json';
+};
+/** Outcome of {@link canonicalizePlainJson} with a container-nesting bound. */
+export type BoundedPlainJsonCheck = PlainJsonCheck | {
+    readonly ok: false;
+    readonly reason: 'too-deep';
+    readonly bytes: number;
+};
+/**
+ * Container nesting depth of pure JSON data (a `JSON.parse` output), computed
+ * iteratively so no input can exhaust the call stack. A scalar is depth 0,
+ * `{}` and `[]` are depth 1. Stops as soon as `limit` is exceeded.
+ */
+export declare function jsonDepthExceeds(value: unknown, limit: number): boolean;
+/**
+ * Canonicalize `value` as plain JSON data within `maxBytes` canonical UTF-8
+ * bytes:
+ *
+ *   1. `JSON.stringify` must succeed and not return `undefined`.
+ *   2. Its UTF-8 byte length must be at most `maxBytes`.
+ *   3. `JSON.parse` that string: the CANONICAL SNAPSHOT (pure data).
+ *   4. With `maxDepth`, the snapshot's container nesting must be at most
+ *      `maxDepth`. This runs before step 5, so the recursive comparison
+ *      below is bounded by it.
+ *   5. The original must be structurally equal to the snapshot
+ *      (`isSameJsonData`).
+ *
+ * On success a sender uses `canonical`, never the original reference.
+ */
+export declare function canonicalizePlainJson(value: unknown, maxBytes: number): PlainJsonCheck;
+export declare function canonicalizePlainJson(value: unknown, maxBytes: number, maxDepth: number): BoundedPlainJsonCheck;

package/dist/provider-profile-binding.d.ts

@@ -1,6 +1,4 @@
 import { z } from 'zod';
-/** Daemon capability required before an exact local provider profile may be offered. */
-export declare const PROVIDER_PROFILE_BINDING_CAPABILITY: 'provider-profile-binding';
 /** Opaque, portable local profile identity. It is one logical id, never a path. */
 export declare const ProviderProfileRefSchema: z.ZodString;
 export type ProviderProfileRef = z.infer<typeof ProviderProfileRefSchema>;

package/dist/provider-provisioning.d.ts

@@ -23,8 +23,6 @@ import { z } from 'zod';
  * Audiences, route paths and product names are Host vocabulary and stay out of
  * this package.
  */
-/** Device capability required before a Host may enqueue `provider.provisioning.available`. */
-export declare const PROVIDER_PROVISIONING_CAPABILITY: 'provider-provisioning.v1';
 /**
  * Device-proof `operation` for the signed claim that registers the device's
  * provider-secret sealing public key (`{ keyId, epoch, publicJwk }`).

package/dist/result-schema.d.ts

@@ -0,0 +1,95 @@
+/** Maximum canonical JSON UTF-8 size of a result-document schema. */
+export declare const RESULT_SCHEMA_MAX_BYTES = 16384;
+/** Maximum canonical JSON UTF-8 size of a submitted outcome document. */
+export declare const RESULT_OUTCOME_MAX_BYTES = 65536;
+/**
+ * Maximum subschema nesting below the root (each `properties` member, `items`
+ * and `oneOf` branch is one level). With the 16 KiB cap this bounds how much
+ * schema structure one validation walks.
+ */
+export declare const RESULT_SCHEMA_MAX_DEPTH = 32;
+/**
+ * Maximum JSON container nesting of a schema or outcome document, checked
+ * iteratively before any recursive routine runs on it.
+ */
+export declare const RESULT_JSON_MAX_DEPTH = 128;
+/** Maximum number of issues one failed check reports. */
+export declare const RESULT_ISSUES_MAX_COUNT = 20;
+/** Maximum UTF-8 size of the reported issue list, as JSON. */
+export declare const RESULT_ISSUES_MAX_BYTES = 4096;
+export declare const RESULT_SCHEMA_KEYWORDS: readonly ["type", "properties", "required", "additionalProperties", "items", "enum", "const", "oneOf", "minLength", "maxLength", "minItems", "maxItems", "minimum", "maximum", "description"];
+export type ResultSchemaKeyword = (typeof RESULT_SCHEMA_KEYWORDS)[number];
+export declare const RESULT_SCHEMA_INSTANCE_TYPES: readonly ["object", "array", "string", "number", "integer", "boolean", "null"];
+export type ResultSchemaInstanceType = (typeof RESULT_SCHEMA_INSTANCE_TYPES)[number];
+/** A schema inside the admitted subset. Only {@link checkResultSchema} proves a value is one. */
+export interface ResultSchema {
+    readonly type?: ResultSchemaInstanceType | readonly ResultSchemaInstanceType[];
+    readonly properties?: {
+        readonly [name: string]: ResultSchema;
+    };
+    readonly required?: readonly string[];
+    readonly additionalProperties?: false;
+    readonly items?: ResultSchema;
+    readonly enum?: readonly unknown[];
+    readonly const?: unknown;
+    readonly oneOf?: readonly ResultSchema[];
+    readonly minLength?: number;
+    readonly maxLength?: number;
+    readonly minItems?: number;
+    readonly maxItems?: number;
+    readonly minimum?: number;
+    readonly maximum?: number;
+    readonly description?: string;
+}
+/**
+ * One bounded failure detail. `pointer` is an RFC 6901 JSON Pointer into the
+ * checked document: the schema for admission issues, the outcome for
+ * validation issues (`''` is the document root). `keyword` is the JSON Schema
+ * keyword at fault, or a document-level code: `not-serializable`,
+ * `not-plain-json`, `over-cap`, `too-deep` (JSON nesting), `schema` (a
+ * subschema that is not an object) or `depth` (subschema nesting).
+ */
+export interface ResultIssue {
+    readonly pointer: string;
+    readonly keyword: string;
+    readonly message: string;
+}
+/** Document-level failure shared by the schema and outcome checks. */
+export type ResultDocumentFailureReason = 'not-serializable' | 'not-plain-json' | 'over-cap' | 'too-deep';
+interface ResultFailure<Reason extends string> {
+    readonly ok: false;
+    readonly reason: Reason;
+    /** Canonical UTF-8 size, when it was measured. */
+    readonly bytes?: number;
+    /** At least one issue; at most {@link RESULT_ISSUES_MAX_COUNT} and {@link RESULT_ISSUES_MAX_BYTES}. */
+    readonly issues: readonly ResultIssue[];
+    /** True when issues were dropped to respect the caps. */
+    readonly truncated: boolean;
+}
+export type ResultSchemaCheck = {
+    readonly ok: true;
+    readonly bytes: number;
+    readonly canonical: ResultSchema;
+} | ResultFailure<ResultDocumentFailureReason | 'not-subset'>;
+export type ResultOutcomeCheck = {
+    readonly ok: true;
+    readonly bytes: number;
+    readonly canonical: unknown;
+} | ResultFailure<'schema-not-admitted' | ResultDocumentFailureReason | 'schema-mismatch'>;
+/**
+ * The admission guard for a result-document schema. Accepts only plain JSON
+ * data of at most {@link RESULT_SCHEMA_MAX_BYTES} canonical UTF-8 bytes that
+ * lies inside the subset (module comment). On success, `canonical` is the
+ * snapshot every party freezes and validates against.
+ */
+export declare function checkResultSchema(schema: unknown): ResultSchemaCheck;
+/**
+ * Validate one outcome document against a result schema. The guard
+ * ({@link checkResultSchema}) always runs first; a schema it refuses is
+ * `schema-not-admitted` and never reaches the library. The outcome must be
+ * plain JSON data of at most {@link RESULT_OUTCOME_MAX_BYTES} canonical UTF-8
+ * bytes, checked before validation. On success, `canonical` is the snapshot
+ * a sender stages and puts on the wire.
+ */
+export declare function validateResultOutcome(schema: unknown, outcome: unknown): ResultOutcomeCheck;
+export {};

package/dist/task-assertion.d.ts

@@ -26,5 +26,3 @@
  * carries this exact literal, so a name legal in only one of the two channels
  * would leave them naming different things.
  */
-/** Contract §8.1's capability gate for `byok-task-assertion-v1` tool authority. */
-export declare const HOST_MCP_TASK_CONTEXT_CAPABILITY: 'host-mcp-task-context';

package/dist/terminal-projection.d.ts

@@ -1,12 +1,19 @@
 import { z } from 'zod';
-/** Capability required before an offer may select terminal projection behavior. */
-export declare const TERMINAL_PROJECTION_SELECTION_CAPABILITY: 'terminal-projection-selection';
+import { type ResultSchema } from './result-schema';
 export declare const TerminalProjectionContractSchema: z.ZodString;
-/** Offer-scoped authority: explicit bypass or one required structured result. */
+/**
+ * The frozen outcome schema of a result-document offer (wire v3). The value
+ * is kept exactly as sent; {@link checkResultSchema} decides admission, so
+ * every decode (Host submit, server/cloud parse, daemon admission) applies
+ * the one subset guard and reports its capped issues.
+ */
+export declare const ResultDocumentSchemaSchema: z.ZodCustom<ResultSchema, ResultSchema>;
+/** Offer-scoped authority: explicit bypass or one required structured result with its frozen schema. */
 export declare const TerminalProjectionSelectionSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     mode: z.ZodLiteral<"none">;
 }, z.core.$strict>, z.ZodObject<{
     mode: z.ZodLiteral<"result-document">;
     contract: z.ZodString;
+    schema: z.ZodCustom<ResultSchema, ResultSchema>;
 }, z.core.$strict>], "mode">;
 export type TerminalProjectionSelection = z.infer<typeof TerminalProjectionSelectionSchema>;

package/dist/version.d.ts

@@ -2,15 +2,22 @@
 export declare const MAILBOX_READ_AHEAD_MAX_SEQS = 4096;
 export declare const MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
 /**
- * Wire protocol version. Bump on breaking (non-additive) changes to the envelope
- * or message shapes. Additive changes (new optional fields, new message types)
- * do not require a bump — servers negotiate the highest common version and
- * daemons/servers must ignore unknown fields and unknown message types.
+ * Wire protocol version. Every v3 change is a version bump, a gated addition
+ * or a strip-safe addition: see docs/protocol.md "Freeze rule", which is the
+ * one statement of the rule, and `src/wire-additions.ts`, which declares the
+ * receiver-capability gates and additions. No v3 release has been published
+ * yet, so `src/__tests__/compat.test.ts` has no published v3 decoder to prove
+ * additions against; cross-release gates stay unproven until one exists.
  *
- * FROZEN (see docs/protocol.md "Freeze rule"): `PROTOCOL_VERSION` does not
- * bump for additive changes (new optional fields, new message types, new
- * `AgentEvent` variants, new capability flags) — only for a breaking one
- * (changing, removing, or retyping anything that already exists).
+ * v3 makes `schema` required on the `terminalProjection.mode:
+ * 'result-document'` arm (`terminal-projection.ts`, `result-schema.ts`): the
+ * offer freezes the outcome schema, and the outcome reaches the Host only as
+ * `task.complete.document`. That narrows a strict shape, so it is a wire
+ * major. A v2 envelope is rejected; there is no v2 reader and no capability
+ * negotiation between the two result-document shapes. Drain, then upgrade
+ * server and client together. Every addition v2 declared is part of the v3
+ * baseline, and the v2 `result-document` capability flag is gone: every v3
+ * server keeps `task.complete.document`.
  *
  * v2 removed the task offer's `policy` (`PermissionPolicy`), the runtime
  * capability `permissionModes` and the input-preparation `permissionMode`.
@@ -23,18 +30,8 @@ export declare const MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
  * and the readiness reason `executor_identity_unproven`. The SDK does not
  * attest tool executables. The artifact names its counted tools in
  * `toolNames`.
- *
- * IMPORTANT: changing this constant, or changing/removing/retyping any
- * already-frozen schema in this package, requires a DELIBERATE update to the
- * committed golden fixtures in `src/__tests__/golden/` (`v<N>.frozen.json`,
- * `v<N>.envelopes.ndjson`) — see `src/__tests__/freeze-guard.test.ts`, which
- * fails loudly on exactly that kind of drift. A passing freeze-guard run
- * after such a change means either (a) the change was genuinely additive and
- * the golden was regenerated with justification, or (b) this constant was
- * bumped alongside a new golden generation for the new version — never a
- * silent edit to either file to make the test pass.
  */
-export declare const PROTOCOL_VERSION = 2;
+export declare const PROTOCOL_VERSION = 3;
 /** Host declares that this device accepts only Agent-bound offer variants. */
 export declare const STRICT_AGENT_ONLY_CAPABILITY: 'strict-agent-only';
 /**
@@ -89,27 +86,6 @@ export declare const AGENT_HOME_READERS_CAPABILITY: 'agent-home-readers';
  * other flag here, just consumed for observability instead of gating.
  */
 /**
- * `result-document` (additive-minor): a SERVER-advertised flag meaning "I
- * understand the optional `task.complete.document` field" (`messages.ts`).
- * Functionally gating, like `approval_resolved` and unlike
- * `approval-targeting`.
- *
- * This is the N/N-1 answer for that new daemon -> server FIELD. An old
- * server's transport advertisement (`conn.ack.capabilities` on WS or
- * `EventsPollResponse.capabilities` on long-poll) never includes it, and
- * its `TaskCompletePayloadSchema` is a tolerant (non-`.strict()`)
- * `z.object()`, so a `document` sent to it would be silently STRIPPED on
- * parse and vanish without a trace. That is exactly why emission is gated
- * here rather than sent unconditionally the way `approvalId` is: `document`
- * carries the task's primary structured RESULT, so losing it silently is
- * data loss, not a missed observability hint. A new daemon talking to an old
- * server therefore never sends `document` at all, and — if its configured
- * extractor did produce one — reports `task.fail` (retryable: false; the
- * same server will strip it on every retry too) instead of completing the
- * task with its main result quietly deleted (`packages/client`'s
- * `task-runner.ts`). A new server talking to an old daemon is unaffected:
- * the field is optional, and an old daemon simply never sets it.
- *
  * `dispatch-selection` (additive-minor) is a correctness gate for the
  * optional `task.offer.dispatchSelection` control field. An older v1 daemon
  * legally strips unknown optional fields, so a server must never send an
@@ -124,5 +100,5 @@ export declare const AGENT_HOME_READERS_CAPABILITY: 'agent-home-readers';
  * cannot accidentally execute the instruction without the required tools.
  */
 export declare const CUSTOM_HARNESS_CAPABILITY: 'custom-harness';
-export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'result-document', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1"];
+export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", 'agent-message-draft'];
 export type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];