@byok-sdk/protocol 0.27.0-rc.2 → 0.28.0

package/dist/agent-egress.d.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+export declare const AGENT_MESSAGE_DRAFT_FRAME_MAX_BYTES: number;
 export declare const AGENT_MESSAGE_MAX_BYTES: number;
 export declare const AgentMessageContractSchema: z.ZodString;
 export declare const AgentMessageContentTypeSchema: z.ZodEnum<{

package/dist/bot-turn-outcome.d.ts

@@ -0,0 +1,252 @@
+import { type ResultSchema } from './result-schema';
+export declare const BOT_TURN_OUTCOME_CONTRACT = "bot-turn-outcome.v1";
+/** Code-point and item caps for Bot turn outcomes. */
+export declare const BOT_TURN_OUTCOME_LIMITS: Readonly<{
+    delegateMaxItems: 2;
+    delegateRequestMaxLength: 1000;
+    cancelDelegationMaxItems: 2;
+    askUserQuestionMaxLength: 400;
+    askUserOptionsMaxItems: 6;
+    askUserOptionIdMaxLength: 24;
+    askUserOptionLabelMaxLength: 80;
+    confirmableActionMaxItems: 1;
+    confirmableSummaryMaxLength: 300;
+    confirmableDraftMaxBytes: 16384;
+    createRoutineMaxItems: 1;
+    updateRoutineMaxItems: 1;
+    cancelRoutineMaxItems: 2;
+    routinePromptMaxLength: 500;
+    postTextMaxLength: 2730;
+    roomCallMembersMaxItems: 4;
+    createBotMaxItems: 3;
+    updateBotMaxItems: 1;
+    deleteBotMaxItems: 1;
+    botNameMaxLength: 40;
+    botRoleMaxLength: 80;
+    botPersonaMaxLength: 300;
+    createRoomMaxItems: 1;
+    updateRoomMaxItems: 1;
+    roomNameMaxLength: 40;
+    roomMembersMaxItems: 12;
+    roomAnnouncementMaxLength: 300;
+    teamNoteMaxLength: 300;
+}>;
+export type NonEmptyIds = readonly [string, ...string[]];
+/** ISO 8601 order, Monday first. Equal to core's list. A server test checks parity. */
+export declare const ROUTINE_DAYS_OF_WEEK: readonly ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
+export type RoutineDayOfWeek = (typeof ROUTINE_DAYS_OF_WEEK)[number];
+export type BotTurnOutcomeSchemaErrorCode = 'not-subset' | 'schema-over-budget' | 'over-budget' | 'draft-over-budget';
+export declare class BotTurnOutcomeSchemaError extends Error {
+    readonly code: BotTurnOutcomeSchemaErrorCode;
+    constructor(code: BotTurnOutcomeSchemaErrorCode, message: string);
+}
+/**
+ * `checked` (default): field types, ranges and enums sit once in the outer
+ * properties; each oneOf branch lists only its allowed names and required
+ * fields, with additionalProperties false. An instance matches exactly one
+ * branch: daysOfWeek and dayOfMonth never appear together; month needs
+ * dayOfMonth. `flat`: the same outer object without the oneOf; the Host then
+ * refuses those two combinations at apply time. Use `flat` only under the
+ * schema budget rule of composeBotTurnOutcomeSchema. Neither form sees
+ * duplicate days, a day the month never has (Apr 31), or Feb 29.
+ */
+export type RoutineScheduleShape = 'checked' | 'flat';
+/**
+ * Every id is a Host-filled enum. New objects use Host-offered localId slots
+ * (e.g. "new_bot_1"), so a same-outcome reference is also an enum member.
+ */
+export declare const botTurnOutcomeFragments: {
+    /** `to` lists this Bot first: delegating to yourself is a continuation. */
+    delegate(o: {
+        to: NonEmptyIds;
+    }): ResultSchema;
+    /** Owner-authorized Main Bot turns only. The Host lists open delegations. */
+    cancelDelegation(o: {
+        delegationIds: NonEmptyIds;
+    }): ResultSchema;
+    askUser(): ResultSchema;
+    /** One branch per Host action; each draft needs a finite bound of at most confirmableDraftMaxBytes. */
+    confirmableAction(o: {
+        actions: readonly [{
+            action: string;
+            draft: ResultSchema;
+        }, ...{
+            action: string;
+            draft: ResultSchema;
+        }[]];
+    }): ResultSchema;
+    /** `targets` only for a Main Bot: the Bot itself first, then team Bots. Omitted means the Bot itself. */
+    createRoutine(o: {
+        localIds: NonEmptyIds;
+        timeZones: NonEmptyIds;
+        targets?: NonEmptyIds;
+        scheduleShape?: RoutineScheduleShape;
+    }): ResultSchema;
+    updateRoutine(o: {
+        routineIds: NonEmptyIds;
+        timeZones: NonEmptyIds;
+        scheduleShape?: RoutineScheduleShape;
+    }): ResultSchema;
+    cancelRoutine(o: {
+        routineIds: NonEmptyIds;
+    }): ResultSchema;
+    /** Room turns only. Exactly one of post or pass. */
+    speech(): ResultSchema;
+    roomCall(o: {
+        members: NonEmptyIds;
+    }): ResultSchema;
+    createBot(o: {
+        localIds: NonEmptyIds;
+        models: NonEmptyIds;
+    }): ResultSchema;
+    updateBot(o: {
+        botIds: NonEmptyIds;
+        models: NonEmptyIds;
+    }): ResultSchema;
+    deleteBot(o: {
+        botIds: NonEmptyIds;
+    }): ResultSchema;
+    /** `members`: team Bot ids plus the create_bot localId slots of this outcome. */
+    createRoom(o: {
+        localIds: NonEmptyIds;
+        members: NonEmptyIds;
+    }): ResultSchema;
+    updateRoom(o: {
+        roomIds: NonEmptyIds;
+        members: NonEmptyIds;
+    }): ResultSchema;
+    teamNote(): ResultSchema;
+};
+export type BotTurnOutcomeKind = 'delegate' | 'cancel_delegation' | 'ask_user' | 'confirmable_action' | 'create_routine' | 'update_routine' | 'cancel_routine' | 'speech' | 'room_call' | 'create_bot' | 'update_bot' | 'delete_bot' | 'create_room' | 'update_room' | 'team_note';
+/**
+ * Host composition: pick fragments, freeze the result in the offer. Refuses a
+ * schema outside the K7 subset ('not-subset'), a schema above
+ * RESULT_SCHEMA_MAX_BYTES ('schema-over-budget'), or one whose largest
+ * instance could exceed RESULT_OUTCOME_MAX_BYTES ('over-budget').
+ *
+ * Schema budget rule, before the offer is frozen: only 'schema-over-budget'
+ * allows the Host to rebuild the routine fragments with scheduleShape 'flat'.
+ * If the schema is still over, the Host blocks the turn with a visible reason
+ * or runs its defined batch selection. It never drops authorized ids from an
+ * enum silently.
+ */
+export declare function composeBotTurnOutcomeSchema(fragments: BotTurnOutcomeFragments, required?: readonly BotTurnOutcomeKind[]): ResultSchema;
+export type BotTurnOutcomeFragments = Partial<Readonly<Record<BotTurnOutcomeKind, ResultSchema>>>;
+export interface DelegateAction {
+    readonly to: string;
+    readonly request: string;
+}
+export interface CancelDelegationAction {
+    readonly delegationId: string;
+}
+export type AskUserAction = {
+    readonly question: string;
+    readonly answerKind: 'text';
+} | {
+    readonly question: string;
+    readonly answerKind: 'single_choice';
+    readonly options: readonly {
+        readonly id: string;
+        readonly label: string;
+    }[];
+};
+export interface ConfirmableAction<Draft = unknown> {
+    readonly action: string;
+    readonly summary: string;
+    readonly draft: Draft;
+}
+/**
+ * No day field: every day. daysOfWeek and dayOfMonth never appear together;
+ * month needs dayOfMonth. Under the 'flat' shape the schema does not enforce
+ * this; the Host narrows to this type only after checkRoutineSchedule passes.
+ */
+export type RoutineScheduleFields = {
+    readonly minute: number;
+    readonly hour: number;
+    readonly tz: string;
+} | {
+    readonly minute: number;
+    readonly hour: number;
+    readonly daysOfWeek: readonly RoutineDayOfWeek[];
+    readonly tz: string;
+} | {
+    readonly minute: number;
+    readonly hour: number;
+    readonly dayOfMonth: number;
+    readonly month?: number;
+    readonly tz: string;
+};
+export interface CreateRoutineAction {
+    readonly localId: string;
+    readonly schedule: RoutineScheduleFields;
+    readonly prompt: string;
+    readonly target?: string;
+}
+export interface UpdateRoutineAction {
+    readonly routineId: string;
+    readonly schedule?: RoutineScheduleFields;
+    readonly prompt?: string;
+}
+export interface CancelRoutineAction {
+    readonly routineId: string;
+}
+export type RoomSpeech = {
+    readonly kind: 'post';
+    readonly text: string;
+} | {
+    readonly kind: 'pass';
+};
+export interface RoomCallAction {
+    readonly members: readonly string[];
+}
+export interface CreateBotAction {
+    readonly localId: string;
+    readonly name: string;
+    readonly role: string;
+    readonly persona: string;
+    readonly model: string;
+}
+export interface UpdateBotAction {
+    readonly botId: string;
+    readonly name?: string;
+    readonly role?: string;
+    readonly persona?: string;
+    readonly model?: string;
+}
+export interface DeleteBotAction {
+    readonly botId: string;
+}
+export interface RoomFields {
+    readonly name: string;
+    readonly members: readonly string[];
+    readonly admin?: string;
+    readonly mode?: 'mention' | 'admin';
+    readonly announcement?: string;
+}
+export interface CreateRoomAction extends RoomFields {
+    readonly localId: string;
+}
+export interface UpdateRoomAction extends Partial<RoomFields> {
+    readonly roomId: string;
+}
+export interface TeamNoteAction {
+    readonly text: string;
+}
+/** Shape of a document that passed a schema composed from these fragments. */
+export interface BotTurnOutcome {
+    readonly delegate?: readonly DelegateAction[];
+    readonly cancel_delegation?: readonly CancelDelegationAction[];
+    readonly ask_user?: AskUserAction;
+    readonly confirmable_action?: readonly ConfirmableAction[];
+    readonly create_routine?: readonly CreateRoutineAction[];
+    readonly update_routine?: readonly UpdateRoutineAction[];
+    readonly cancel_routine?: readonly CancelRoutineAction[];
+    readonly speech?: RoomSpeech;
+    readonly room_call?: RoomCallAction;
+    readonly create_bot?: readonly CreateBotAction[];
+    readonly update_bot?: readonly UpdateBotAction[];
+    readonly delete_bot?: readonly DeleteBotAction[];
+    readonly create_room?: readonly CreateRoomAction[];
+    readonly update_room?: readonly UpdateRoomAction[];
+    readonly team_note?: TeamNoteAction;
+}

package/dist/codec.d.ts

@@ -58,6 +58,10 @@ interface EnvelopeShapeOptions {
         taskId?: string;
         seq: number;
     };
+    'agent.message.draft': {
+        taskId: string;
+        seq?: number;
+    };
     'agent.message.publish': {
         taskId: string;
         seq?: number;

package/dist/constants.js

@@ -53,7 +53,8 @@ var CAPABILITY_FLAGS = [
   CUSTOM_HARNESS_CAPABILITY,
   MAILBOX_READ_AHEAD_CAPABILITY,
   PROVIDER_PROVISIONING_CAPABILITY,
-  AGENT_MEMORY_INTENT_CAPABILITY
+  AGENT_MEMORY_INTENT_CAPABILITY,
+  "agent-message-draft"
 ];
 
 // src/task-state.ts

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/capability-constants.ts","../src/version.ts","../src/task-state.ts"],"names":[],"mappings":";AAWO,IAAM,8BAAA,GAAiC;AAIvC,IAAM,8BAAA,GAAiC;AAEvC,IAAM,oCAAA,GAAuC;AAG7C,IAAM,qCAAA,GAAwC;AAG9C,IAAM,+BAAA,GAAkC;AAExC,IAAM,uCAAA,GAA0C;AAEhD,IAAM,wCAAA,GAA2C;AAEjD,IAAM,sCAAA,GAAyC;AAG/C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,wCAAA,GAA2C;AAGjD,IAAM,gCAAA,GAAmC;AAGzC,IAAM,mCAAA,GAAsC;AAG5C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,kCAAA,GAAqC;AAG3C,IAAM,kCAAA,GACX,4BAA4B,8BAA8B,CAAA;AAGrD,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAQ,MAAA,EAAQ,YAAY;AAEjE,SAAS,0BAA0B,KAAA,EAAuE;AAC/G,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,4BAA4B,IAAA,CAAK,CAAA,IAAA,KAAQ,SAAS,KAAK,CAAA;AAC7F;;;AC5DO,IAAM,2BAAA,GAA8B;AACpC,IAAM,6BAAA,GAAgC;AAgCtC,IAAM,gBAAA,GAAmB;AAGzB,IAAM,4BAAA,GAA+B;AASrC,IAAM,6BAAA,GAAgC;AA2DtC,IAAM,yBAAA,GAA4B;AAElC,IAAM,gBAAA,GAAmB;AAAA,EAC9B,OAAA;AAAA,EACA,aAAA;AAAA,EACA,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,mCAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA,6BAAA;AAAA,EACA,4BAAA;AAAA,EACA,8BAAA;AAAA,EACA,oCAAA;AAAA,EACA,+BAAA;AAAA,EACA,qCAAA;AAAA,EACA,uCAAA;AAAA,EACA,wCAAA;AAAA,EACA,sCAAA;AAAA,EACA,gCAAA;AAAA,EACA,kCAAA;AAAA,EACA,wCAAA;AAAA,EACA,gCAAA;AAAA,EACA,yBAAA;AAAA,EACA,6BAAA;AAAA,EACA,gCAAA;AAAA,EACA;AACF;;;ACtIO,IAAM,WAAA,GAAc;AAAA,EACzB,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAA,GAAsE;AAAA,EACjF,OAAA,EAAS,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,eAAA,EAAiB,UAAA,EAAY,UAAU,WAAW,CAAA;AAAA,EAC5D,aAAA,EAAe,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAChD,UAAU,EAAC;AAAA,EACX,QAAQ,EAAC;AAAA,EACT,WAAW;AACb;AAGO,SAAS,aAAA,CAAc,MAAiB,EAAA,EAAwB;AACrE,EAAA,OAAO,gBAAA,CAAiB,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAC3C","file":"constants.js","sourcesContent":["/**\n * The ONE version of the input-preparation contract, shared by this relay wire\n * (the `agent.input.preparation` payload and the completion receipt summary)\n * and by the device-local request, receipt and artifact\n * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).\n *\n * The relay wire carries no version field of its own, so a version change is\n * made visible where admission actually happens: in the capability token\n * below. See `INPUT_PREPARATION_VERSION` in the client for what each version\n * changed.\n */\nexport const INPUT_PREPARATION_WIRE_VERSION = 9 as const;\n\n\n/** Additive daemon capability names. Server/cloud admission consumes these exactly. */\nexport const AGENT_EGRESS_POLICY_CAPABILITY = 'agent-egress-policy' as const;\n\nexport const AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = 'agent-egress-reliable-ack' as const;\n\n/** Admits the distinct offer whose runtime mints its session only after start. */\nexport const AGENT_EGRESS_FRESH_SESSION_CAPABILITY = 'agent-egress-fresh-session' as const;\n\n/** Admits the distinct Agent-authored message lane; activity policy remains independent. */\nexport const AGENT_MESSAGE_EGRESS_CAPABILITY = 'agent-message-egress' as const;\n\nexport const AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = 'agent-content-workspace-read' as const;\n\nexport const AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = 'agent-content-transcript-read' as const;\n\nexport const AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = 'agent-content-artifact-read' as const;\n\n/** Capability required before a task-free Agent-home projection is admitted. */\nexport const AGENT_HOME_PROJECTION_CAPABILITY = 'agent-home-projection' as const;\n\n/** Capability required before an offer may select terminal projection behavior. */\nexport const TERMINAL_PROJECTION_SELECTION_CAPABILITY = 'terminal-projection-selection' as const;\n\n/** Contract §8.1's capability gate for `byok-task-assertion-v1` tool authority. */\nexport const HOST_MCP_TASK_CONTEXT_CAPABILITY = 'host-mcp-task-context' as const;\n\n/** Daemon capability required before an exact local provider profile may be offered. */\nexport const PROVIDER_PROFILE_BINDING_CAPABILITY = 'provider-profile-binding' as const;\n\n/** Device capability required before a Host may enqueue `provider.provisioning.available`. */\nexport const PROVIDER_PROVISIONING_CAPABILITY = 'provider-provisioning.v1' as const;\n\n/** Device capability required before a Host may enqueue `agent.memory.intent.available`. */\nexport const AGENT_MEMORY_INTENT_CAPABILITY = 'agent-memory-intent.v1' as const;\n\n/** Capability required before the optional hosted Agent-memory projection can be used. */\nexport const AGENT_MEMORY_PROJECTION_CAPABILITY = 'agent.memory.projection' as const;\n\n/** Exact capability of the single input-preparation wire authority. */\nexport const AGENT_INPUT_PREPARATION_CAPABILITY =\n  `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}` as const;\n\n/** Single value authority shared by schema validation and schema-free consumers. */\nexport const PREPARED_AGENT_MEMORY_MODES = ['none', 'read', 'read-write'] as const;\n\nexport function isPreparedAgentMemoryMode(value: unknown): value is (typeof PREPARED_AGENT_MEMORY_MODES)[number] {\n  return typeof value === 'string' && PREPARED_AGENT_MEMORY_MODES.some(mode => mode === value);\n}\n","/** Bounded volatile navigation; only cursor is a durable acknowledgement. */\nexport const MAILBOX_READ_AHEAD_MAX_SEQS = 4096;\nexport const MAILBOX_READ_AHEAD_CAPABILITY = 'mailbox-read-ahead';\n\n/**\n * Wire protocol version. Every v3 change is a version bump, a gated addition\n * or a strip-safe addition: see docs/protocol.md \"Freeze rule\", which is the\n * one statement of the rule, and `src/wire-additions.ts`, which declares the\n * receiver-capability gates and additions. No v3 release has been published\n * yet, so `src/__tests__/compat.test.ts` has no published v3 decoder to prove\n * additions against; cross-release gates stay unproven until one exists.\n *\n * v3 makes `schema` required on the `terminalProjection.mode:\n * 'result-document'` arm (`terminal-projection.ts`, `result-schema.ts`): the\n * offer freezes the outcome schema, and the outcome reaches the Host only as\n * `task.complete.document`. That narrows a strict shape, so it is a wire\n * major. A v2 envelope is rejected; there is no v2 reader and no capability\n * negotiation between the two result-document shapes. Drain, then upgrade\n * server and client together. Every addition v2 declared is part of the v3\n * baseline, and the v2 `result-document` capability flag is gone: every v3\n * server keeps `task.complete.document`.\n *\n * v2 removed the task offer's `policy` (`PermissionPolicy`), the runtime\n * capability `permissionModes` and the input-preparation `permissionMode`.\n * Sessions run without an SDK permission gate; each local agent keeps its\n * own guardrails. A v1 envelope is rejected; there is no v1 reader.\n * v2 also removed the egress policy's `metadata-status` activity mode, its\n * `activity.mode` field and the `sanitizer_rejected` drop reason. Agent\n * egress goes to the Host as the runtime produced it.\n * v2 also removed the input-preparation artifact's `toolImplementationKinds`\n * and the readiness reason `executor_identity_unproven`. The SDK does not\n * attest tool executables. The artifact names its counted tools in\n * `toolNames`.\n */\nexport const PROTOCOL_VERSION = 3;\n\n/** Host declares that this device accepts only Agent-bound offer variants. */\nexport const STRICT_AGENT_ONLY_CAPABILITY = 'strict-agent-only' as const;\n\n/**\n * The device runs `homeAccess: 'memory-reader'` Agent offers: each reader\n * Attempt gets its own run directory under the Agent home, and readers are\n * counted apart from the one writer. The Agent offers are strict, so a host\n * must refuse a reader offer to a device without this flag before it creates\n * the task.\n */\nexport const AGENT_HOME_READERS_CAPABILITY = 'agent-home-readers' as const;\n\n/**\n * Capability flags exchanged during the connection handshake (`conn.hello` /\n * `conn.ack`). Additional flags may be introduced without a protocol version\n * bump; unrecognized flags must be ignored by both sides.\n *\n * `interactive-approval` is RESERVED as of this addition: it gates the\n * (currently unexercised) approval seam — a server must not route an\n * approval-requiring policy to a daemon that hasn't advertised this flag. No\n * bundled runtime adapter emits it yet; that's expected until interactive\n * approval is actually wired up in a later wave.\n *\n * `approval_resolved` (additive-minor): a SERVER-advertised flag meaning\n * \"I understand the `task.approval_resolved` message\" (`messages.ts`). This\n * is the N/N-1 answer for that new daemon -> server message: an old server's\n * `CAPABILITY_FLAGS`/`conn.ack.capabilities` never includes it, so a new\n * daemon talking to an old server never sends `task.approval_resolved` at\n * all (see `packages/client`'s `task-runner.ts`) and falls back to the\n * pre-existing implicit-resume inference\n * (`ConnectionHub.resumeIfImplicitlyApproved`, `packages/server/src/hub.ts`)\n * unconditionally, exactly as before this flag existed. Unlike\n * `interactive-approval`, this one IS exercised the moment both sides\n * support it — there is no reserved/dormant period for it.\n */\n/**\n * `approval-targeting` (M5, additive-minor): unlike `approval_resolved`\n * above, this flag is purely INFORMATIONAL/semantic, not a functional gate.\n * `task.await_approval`/`task.approve`/`task.reject` all carry their new\n * `approvalId` field UNCONDITIONALLY on both sides once each peer is\n * upgraded -- the wire is tolerant (a plain, non-`.strict()` `z.object()`\n * field, `messages.ts`), so no version/capability negotiation is needed just\n * to send it safely; an older peer that doesn't recognize the field simply\n * never reads it. Receivers decide whether to apply exact-match targeting\n * by FIELD PRESENCE on the specific message at hand (does this particular\n * `task.approve`/`task.reject`/`onApprovalResolved` payload carry an\n * `approvalId`, and does a stored one exist to compare it against?), never\n * by checking this flag -- see `ConnectionHub.approveTask`/`rejectTask`/\n * `onApprovalResolved` and `TaskRunner.handleApprove`/`handleReject`\n * (`packages/client`'s `task-runner.ts`). This flag exists only so each side\n * can advertise, and an embedder/operator can observe (`ConnectionHub.\n * getDeviceCapabilities`), whether the OTHER side is new enough to\n * participate in targeting at all -- the same N/N-1-safe shape as every\n * other flag here, just consumed for observability instead of gating.\n */\n/**\n * `dispatch-selection` (additive-minor) is a correctness gate for the\n * optional `task.offer.dispatchSelection` control field. An older v1 daemon\n * legally strips unknown optional fields, so a server must never send an\n * authoritative provider/model selection unless the target connection\n * advertises this flag. Absence means reject before task creation, not send\n * a legacy runtime-only offer that could reach a different provider.\n *\n * `toolset-selection` (additive-minor) means the daemon understands\n * `task.offer_with_toolsets` and can resolve its logical ids against local\n * MCP configuration. The distinct message type is also the N/N-1 safety\n * boundary for long-poll: an older daemon skips it as unknown and therefore\n * cannot accidentally execute the instruction without the required tools.\n */\nexport const CUSTOM_HARNESS_CAPABILITY = 'custom-harness' as const;\n\nexport const CAPABILITY_FLAGS = [\n  'steer',\n  'blob-upload',\n  'interactive-approval',\n  'approval_resolved',\n  'approval-targeting',\n  'dispatch-selection',\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  'toolset-selection',\n  'agent-home-contract',\n  AGENT_HOME_READERS_CAPABILITY,\n  STRICT_AGENT_ONLY_CAPABILITY,\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  CUSTOM_HARNESS_CAPABILITY,\n  MAILBOX_READ_AHEAD_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n] as const;\n\nexport type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];\nimport {\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n} from './capability-constants';\n","export const TASK_STATES = [\n  'Offered',\n  'Claimed',\n  'Running',\n  'AwaitApproval',\n  'Complete',\n  'Failed',\n  'Cancelled',\n] as const;\n\nexport type TaskState = (typeof TASK_STATES)[number];\n\n/**\n * Legal state transitions for a task. `Complete` / `Failed` / `Cancelled` are\n * terminal (no outgoing edges). `Running` and `AwaitApproval` form a loop:\n * the daemon can request approval mid-run and resume once the server\n * approves (or fail/cancel out of the approval wait).\n *\n * `Offered -> Failed` (M1 gap #5, \"Declined vs. Failed\"): a daemon that\n * declines an offer pre-claim (`task.decline`) reports it through the\n * existing `Failed` state rather than a new `Declined` state. A decline and\n * a post-claim failure are the same outcome from the dispatcher's point of\n * view — this attempt produced no result, `reason`/`retryable` say why and\n * whether retrying elsewhere makes sense — so reusing `Failed` keeps the\n * state machine minimal instead of forking every terminal-state consumer\n * into \"Failed or Declined, handle both\". See docs/protocol.md for the full\n * writeup.\n */\nexport const TASK_TRANSITIONS: Readonly<Record<TaskState, readonly TaskState[]>> = {\n  Offered: ['Claimed', 'Cancelled', 'Failed'],\n  Claimed: ['Running', 'Failed', 'Cancelled'],\n  Running: ['AwaitApproval', 'Complete', 'Failed', 'Cancelled'],\n  AwaitApproval: ['Running', 'Failed', 'Cancelled'],\n  Complete: [],\n  Failed: [],\n  Cancelled: [],\n};\n\n/** Whether `from -> to` is a legal transition per {@link TASK_TRANSITIONS}. */\nexport function canTransition(from: TaskState, to: TaskState): boolean {\n  return TASK_TRANSITIONS[from].includes(to);\n}\n"]}
+{"version":3,"sources":["../src/capability-constants.ts","../src/version.ts","../src/task-state.ts"],"names":[],"mappings":";AAWO,IAAM,8BAAA,GAAiC;AAIvC,IAAM,8BAAA,GAAiC;AAEvC,IAAM,oCAAA,GAAuC;AAG7C,IAAM,qCAAA,GAAwC;AAG9C,IAAM,+BAAA,GAAkC;AAExC,IAAM,uCAAA,GAA0C;AAEhD,IAAM,wCAAA,GAA2C;AAEjD,IAAM,sCAAA,GAAyC;AAG/C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,wCAAA,GAA2C;AAGjD,IAAM,gCAAA,GAAmC;AAGzC,IAAM,mCAAA,GAAsC;AAG5C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,kCAAA,GAAqC;AAG3C,IAAM,kCAAA,GACX,4BAA4B,8BAA8B,CAAA;AAGrD,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAQ,MAAA,EAAQ,YAAY;AAEjE,SAAS,0BAA0B,KAAA,EAAuE;AAC/G,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,4BAA4B,IAAA,CAAK,CAAA,IAAA,KAAQ,SAAS,KAAK,CAAA;AAC7F;;;AC5DO,IAAM,2BAAA,GAA8B;AACpC,IAAM,6BAAA,GAAgC;AAgCtC,IAAM,gBAAA,GAAmB;AAGzB,IAAM,4BAAA,GAA+B;AASrC,IAAM,6BAAA,GAAgC;AA2DtC,IAAM,yBAAA,GAA4B;AAElC,IAAM,gBAAA,GAAmB;AAAA,EAC9B,OAAA;AAAA,EACA,aAAA;AAAA,EACA,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,mCAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA,6BAAA;AAAA,EACA,4BAAA;AAAA,EACA,8BAAA;AAAA,EACA,oCAAA;AAAA,EACA,+BAAA;AAAA,EACA,qCAAA;AAAA,EACA,uCAAA;AAAA,EACA,wCAAA;AAAA,EACA,sCAAA;AAAA,EACA,gCAAA;AAAA,EACA,kCAAA;AAAA,EACA,wCAAA;AAAA,EACA,gCAAA;AAAA,EACA,yBAAA;AAAA,EACA,6BAAA;AAAA,EACA,gCAAA;AAAA,EACA,8BAAA;AAAA,EACA;AACF;;;ACvIO,IAAM,WAAA,GAAc;AAAA,EACzB,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAA,GAAsE;AAAA,EACjF,OAAA,EAAS,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,eAAA,EAAiB,UAAA,EAAY,UAAU,WAAW,CAAA;AAAA,EAC5D,aAAA,EAAe,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAChD,UAAU,EAAC;AAAA,EACX,QAAQ,EAAC;AAAA,EACT,WAAW;AACb;AAGO,SAAS,aAAA,CAAc,MAAiB,EAAA,EAAwB;AACrE,EAAA,OAAO,gBAAA,CAAiB,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAC3C","file":"constants.js","sourcesContent":["/**\n * The ONE version of the input-preparation contract, shared by this relay wire\n * (the `agent.input.preparation` payload and the completion receipt summary)\n * and by the device-local request, receipt and artifact\n * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).\n *\n * The relay wire carries no version field of its own, so a version change is\n * made visible where admission actually happens: in the capability token\n * below. See `INPUT_PREPARATION_VERSION` in the client for what each version\n * changed.\n */\nexport const INPUT_PREPARATION_WIRE_VERSION = 9 as const;\n\n\n/** Additive daemon capability names. Server/cloud admission consumes these exactly. */\nexport const AGENT_EGRESS_POLICY_CAPABILITY = 'agent-egress-policy' as const;\n\nexport const AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = 'agent-egress-reliable-ack' as const;\n\n/** Admits the distinct offer whose runtime mints its session only after start. */\nexport const AGENT_EGRESS_FRESH_SESSION_CAPABILITY = 'agent-egress-fresh-session' as const;\n\n/** Admits the distinct Agent-authored message lane; activity policy remains independent. */\nexport const AGENT_MESSAGE_EGRESS_CAPABILITY = 'agent-message-egress' as const;\n\nexport const AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = 'agent-content-workspace-read' as const;\n\nexport const AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = 'agent-content-transcript-read' as const;\n\nexport const AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = 'agent-content-artifact-read' as const;\n\n/** Capability required before a task-free Agent-home projection is admitted. */\nexport const AGENT_HOME_PROJECTION_CAPABILITY = 'agent-home-projection' as const;\n\n/** Capability required before an offer may select terminal projection behavior. */\nexport const TERMINAL_PROJECTION_SELECTION_CAPABILITY = 'terminal-projection-selection' as const;\n\n/** Contract §8.1's capability gate for `byok-task-assertion-v1` tool authority. */\nexport const HOST_MCP_TASK_CONTEXT_CAPABILITY = 'host-mcp-task-context' as const;\n\n/** Daemon capability required before an exact local provider profile may be offered. */\nexport const PROVIDER_PROFILE_BINDING_CAPABILITY = 'provider-profile-binding' as const;\n\n/** Device capability required before a Host may enqueue `provider.provisioning.available`. */\nexport const PROVIDER_PROVISIONING_CAPABILITY = 'provider-provisioning.v1' as const;\n\n/** Device capability required before a Host may enqueue `agent.memory.intent.available`. */\nexport const AGENT_MEMORY_INTENT_CAPABILITY = 'agent-memory-intent.v1' as const;\n\n/** Capability required before the optional hosted Agent-memory projection can be used. */\nexport const AGENT_MEMORY_PROJECTION_CAPABILITY = 'agent.memory.projection' as const;\n\n/** Exact capability of the single input-preparation wire authority. */\nexport const AGENT_INPUT_PREPARATION_CAPABILITY =\n  `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}` as const;\n\n/** Single value authority shared by schema validation and schema-free consumers. */\nexport const PREPARED_AGENT_MEMORY_MODES = ['none', 'read', 'read-write'] as const;\n\nexport function isPreparedAgentMemoryMode(value: unknown): value is (typeof PREPARED_AGENT_MEMORY_MODES)[number] {\n  return typeof value === 'string' && PREPARED_AGENT_MEMORY_MODES.some(mode => mode === value);\n}\n","/** Bounded volatile navigation; only cursor is a durable acknowledgement. */\nexport const MAILBOX_READ_AHEAD_MAX_SEQS = 4096;\nexport const MAILBOX_READ_AHEAD_CAPABILITY = 'mailbox-read-ahead';\n\n/**\n * Wire protocol version. Every v3 change is a version bump, a gated addition\n * or a strip-safe addition: see docs/protocol.md \"Freeze rule\", which is the\n * one statement of the rule, and `src/wire-additions.ts`, which declares the\n * receiver-capability gates and additions. No v3 release has been published\n * yet, so `src/__tests__/compat.test.ts` has no published v3 decoder to prove\n * additions against; cross-release gates stay unproven until one exists.\n *\n * v3 makes `schema` required on the `terminalProjection.mode:\n * 'result-document'` arm (`terminal-projection.ts`, `result-schema.ts`): the\n * offer freezes the outcome schema, and the outcome reaches the Host only as\n * `task.complete.document`. That narrows a strict shape, so it is a wire\n * major. A v2 envelope is rejected; there is no v2 reader and no capability\n * negotiation between the two result-document shapes. Drain, then upgrade\n * server and client together. Every addition v2 declared is part of the v3\n * baseline, and the v2 `result-document` capability flag is gone: every v3\n * server keeps `task.complete.document`.\n *\n * v2 removed the task offer's `policy` (`PermissionPolicy`), the runtime\n * capability `permissionModes` and the input-preparation `permissionMode`.\n * Sessions run without an SDK permission gate; each local agent keeps its\n * own guardrails. A v1 envelope is rejected; there is no v1 reader.\n * v2 also removed the egress policy's `metadata-status` activity mode, its\n * `activity.mode` field and the `sanitizer_rejected` drop reason. Agent\n * egress goes to the Host as the runtime produced it.\n * v2 also removed the input-preparation artifact's `toolImplementationKinds`\n * and the readiness reason `executor_identity_unproven`. The SDK does not\n * attest tool executables. The artifact names its counted tools in\n * `toolNames`.\n */\nexport const PROTOCOL_VERSION = 3;\n\n/** Host declares that this device accepts only Agent-bound offer variants. */\nexport const STRICT_AGENT_ONLY_CAPABILITY = 'strict-agent-only' as const;\n\n/**\n * The device runs `homeAccess: 'memory-reader'` Agent offers: each reader\n * Attempt gets its own run directory under the Agent home, and readers are\n * counted apart from the one writer. The Agent offers are strict, so a host\n * must refuse a reader offer to a device without this flag before it creates\n * the task.\n */\nexport const AGENT_HOME_READERS_CAPABILITY = 'agent-home-readers' as const;\n\n/**\n * Capability flags exchanged during the connection handshake (`conn.hello` /\n * `conn.ack`). Additional flags may be introduced without a protocol version\n * bump; unrecognized flags must be ignored by both sides.\n *\n * `interactive-approval` is RESERVED as of this addition: it gates the\n * (currently unexercised) approval seam — a server must not route an\n * approval-requiring policy to a daemon that hasn't advertised this flag. No\n * bundled runtime adapter emits it yet; that's expected until interactive\n * approval is actually wired up in a later wave.\n *\n * `approval_resolved` (additive-minor): a SERVER-advertised flag meaning\n * \"I understand the `task.approval_resolved` message\" (`messages.ts`). This\n * is the N/N-1 answer for that new daemon -> server message: an old server's\n * `CAPABILITY_FLAGS`/`conn.ack.capabilities` never includes it, so a new\n * daemon talking to an old server never sends `task.approval_resolved` at\n * all (see `packages/client`'s `task-runner.ts`) and falls back to the\n * pre-existing implicit-resume inference\n * (`ConnectionHub.resumeIfImplicitlyApproved`, `packages/server/src/hub.ts`)\n * unconditionally, exactly as before this flag existed. Unlike\n * `interactive-approval`, this one IS exercised the moment both sides\n * support it — there is no reserved/dormant period for it.\n */\n/**\n * `approval-targeting` (M5, additive-minor): unlike `approval_resolved`\n * above, this flag is purely INFORMATIONAL/semantic, not a functional gate.\n * `task.await_approval`/`task.approve`/`task.reject` all carry their new\n * `approvalId` field UNCONDITIONALLY on both sides once each peer is\n * upgraded -- the wire is tolerant (a plain, non-`.strict()` `z.object()`\n * field, `messages.ts`), so no version/capability negotiation is needed just\n * to send it safely; an older peer that doesn't recognize the field simply\n * never reads it. Receivers decide whether to apply exact-match targeting\n * by FIELD PRESENCE on the specific message at hand (does this particular\n * `task.approve`/`task.reject`/`onApprovalResolved` payload carry an\n * `approvalId`, and does a stored one exist to compare it against?), never\n * by checking this flag -- see `ConnectionHub.approveTask`/`rejectTask`/\n * `onApprovalResolved` and `TaskRunner.handleApprove`/`handleReject`\n * (`packages/client`'s `task-runner.ts`). This flag exists only so each side\n * can advertise, and an embedder/operator can observe (`ConnectionHub.\n * getDeviceCapabilities`), whether the OTHER side is new enough to\n * participate in targeting at all -- the same N/N-1-safe shape as every\n * other flag here, just consumed for observability instead of gating.\n */\n/**\n * `dispatch-selection` (additive-minor) is a correctness gate for the\n * optional `task.offer.dispatchSelection` control field. An older v1 daemon\n * legally strips unknown optional fields, so a server must never send an\n * authoritative provider/model selection unless the target connection\n * advertises this flag. Absence means reject before task creation, not send\n * a legacy runtime-only offer that could reach a different provider.\n *\n * `toolset-selection` (additive-minor) means the daemon understands\n * `task.offer_with_toolsets` and can resolve its logical ids against local\n * MCP configuration. The distinct message type is also the N/N-1 safety\n * boundary for long-poll: an older daemon skips it as unknown and therefore\n * cannot accidentally execute the instruction without the required tools.\n */\nexport const CUSTOM_HARNESS_CAPABILITY = 'custom-harness' as const;\n\nexport const CAPABILITY_FLAGS = [\n  'steer',\n  'blob-upload',\n  'interactive-approval',\n  'approval_resolved',\n  'approval-targeting',\n  'dispatch-selection',\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  'toolset-selection',\n  'agent-home-contract',\n  AGENT_HOME_READERS_CAPABILITY,\n  STRICT_AGENT_ONLY_CAPABILITY,\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  CUSTOM_HARNESS_CAPABILITY,\n  MAILBOX_READ_AHEAD_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  'agent-message-draft',\n] as const;\n\nexport type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];\nimport {\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n} from './capability-constants';\n","export const TASK_STATES = [\n  'Offered',\n  'Claimed',\n  'Running',\n  'AwaitApproval',\n  'Complete',\n  'Failed',\n  'Cancelled',\n] as const;\n\nexport type TaskState = (typeof TASK_STATES)[number];\n\n/**\n * Legal state transitions for a task. `Complete` / `Failed` / `Cancelled` are\n * terminal (no outgoing edges). `Running` and `AwaitApproval` form a loop:\n * the daemon can request approval mid-run and resume once the server\n * approves (or fail/cancel out of the approval wait).\n *\n * `Offered -> Failed` (M1 gap #5, \"Declined vs. Failed\"): a daemon that\n * declines an offer pre-claim (`task.decline`) reports it through the\n * existing `Failed` state rather than a new `Declined` state. A decline and\n * a post-claim failure are the same outcome from the dispatcher's point of\n * view — this attempt produced no result, `reason`/`retryable` say why and\n * whether retrying elsewhere makes sense — so reusing `Failed` keeps the\n * state machine minimal instead of forking every terminal-state consumer\n * into \"Failed or Declined, handle both\". See docs/protocol.md for the full\n * writeup.\n */\nexport const TASK_TRANSITIONS: Readonly<Record<TaskState, readonly TaskState[]>> = {\n  Offered: ['Claimed', 'Cancelled', 'Failed'],\n  Claimed: ['Running', 'Failed', 'Cancelled'],\n  Running: ['AwaitApproval', 'Complete', 'Failed', 'Cancelled'],\n  AwaitApproval: ['Running', 'Failed', 'Cancelled'],\n  Complete: [],\n  Failed: [],\n  Cancelled: [],\n};\n\n/** Whether `from -> to` is a legal transition per {@link TASK_TRANSITIONS}. */\nexport function canTransition(from: TaskState, to: TaskState): boolean {\n  return TASK_TRANSITIONS[from].includes(to);\n}\n"]}

package/dist/envelope.d.ts

@@ -43,6 +43,7 @@ export declare const EnvelopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 resume: z.ZodOptional<z.ZodBoolean>;
                 approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                 mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                messageDraft: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>>;
         }, z.core.$strip>>>;
         harnesses: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -53,6 +54,7 @@ export declare const EnvelopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 resume: z.ZodOptional<z.ZodBoolean>;
                 approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                 mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                messageDraft: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>;
         }, z.core.$strip>>>;
         configuredToolsets: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -899,6 +901,7 @@ export declare const EnvelopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
             resume: z.ZodOptional<z.ZodBoolean>;
             approvalInteractive: z.ZodOptional<z.ZodBoolean>;
             mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+            messageDraft: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
@@ -1249,6 +1252,24 @@ export declare const EnvelopeSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         contentHash: z.ZodString;
         byteCount: z.ZodNumber;
     }, z.core.$strict>;
+}, z.core.$strip>, z.ZodObject<{
+    v: z.ZodNumber;
+    id: z.ZodUUID;
+    ts: z.ZodISODateTime;
+    type: z.ZodLiteral<"agent.message.draft">;
+    task_id: z.ZodString;
+    session_ref: z.ZodOptional<z.ZodString>;
+    seq: z.ZodOptional<z.ZodNumber>;
+    payload: z.ZodObject<{
+        agentRef: z.ZodObject<{
+            agentId: z.ZodString;
+            profileRevision: z.ZodString;
+        }, z.core.$strict>;
+        revision: z.ZodNumber;
+        offset: z.ZodNumber;
+        text: z.ZodString;
+        overflow: z.ZodOptional<z.ZodLiteral<true>>;
+    }, z.core.$strict>;
 }, z.core.$strip>, z.ZodObject<{
     v: z.ZodNumber;
     id: z.ZodUUID;

package/dist/http-api.d.ts

@@ -179,6 +179,7 @@ export declare const MessagesSendRequestSchema: z.ZodObject<{
                     resume: z.ZodOptional<z.ZodBoolean>;
                     approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                     mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                    messageDraft: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strip>>;
             }, z.core.$strip>>>;
             harnesses: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -189,6 +190,7 @@ export declare const MessagesSendRequestSchema: z.ZodObject<{
                     resume: z.ZodOptional<z.ZodBoolean>;
                     approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                     mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                    messageDraft: z.ZodOptional<z.ZodBoolean>;
                 }, z.core.$strip>;
             }, z.core.$strip>>>;
             configuredToolsets: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -1035,6 +1037,7 @@ export declare const MessagesSendRequestSchema: z.ZodObject<{
                 resume: z.ZodOptional<z.ZodBoolean>;
                 approvalInteractive: z.ZodOptional<z.ZodBoolean>;
                 mcpToolsets: z.ZodOptional<z.ZodBoolean>;
+                messageDraft: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>>;
         }, z.core.$strip>;
     }, z.core.$strip>, z.ZodObject<{
@@ -1385,6 +1388,24 @@ export declare const MessagesSendRequestSchema: z.ZodObject<{
             contentHash: z.ZodString;
             byteCount: z.ZodNumber;
         }, z.core.$strict>;
+    }, z.core.$strip>, z.ZodObject<{
+        v: z.ZodNumber;
+        id: z.ZodUUID;
+        ts: z.ZodISODateTime;
+        type: z.ZodLiteral<"agent.message.draft">;
+        task_id: z.ZodString;
+        session_ref: z.ZodOptional<z.ZodString>;
+        seq: z.ZodOptional<z.ZodNumber>;
+        payload: z.ZodObject<{
+            agentRef: z.ZodObject<{
+                agentId: z.ZodString;
+                profileRevision: z.ZodString;
+            }, z.core.$strict>;
+            revision: z.ZodNumber;
+            offset: z.ZodNumber;
+            text: z.ZodString;
+            overflow: z.ZodOptional<z.ZodLiteral<true>>;
+        }, z.core.$strict>;
     }, z.core.$strip>, z.ZodObject<{
         v: z.ZodNumber;
         id: z.ZodUUID;

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES, AGENT_MEMORY_INTENT_PATH_MAX_BYT
 export type { AgentMemoryIntentRevision, AgentMemoryIntentOperationDigest, AgentMemoryIntentPath, AgentMemoryIntentApprovalRef, AgentMemoryIntentContent, AgentMemoryIntentOperation, AgentMemoryIntentV1, AgentMemoryIntentHostTerminalCode, AgentMemoryIntentRejectionCode, AgentMemoryIntentFileObservation, AgentMemoryIntentCompletion, AgentMemoryIntentReadbackDisposition, AgentMemoryIntentReadback, AgentMemoryIntentReservation, AgentMemoryIntentFetchRequest, AgentMemoryIntentFetchDisposition, AgentMemoryIntentFetchResponse, } from './agent-memory-intent';
 export { AgentEventSchema, AgentEventSpillSchema, AGENT_EVENT_SPILL_UNSTORED_REASON_MAX_LENGTH, UnknownAgentEventSchema, AgentEventOrUnknownSchema, KNOWN_AGENT_EVENT_TYPES, isKnownAgentEvent, partitionAgentEvents, } from './agent-event';
 export type { AgentEvent, AgentEventSpill, UnknownAgentEvent, AgentEventOrUnknown } from './agent-event';
-export { AgentEgressPolicySchema, AgentEgressActivityPolicySchema, AgentReliableQuotaPolicySchema, ContentReadPolicySchema, AgentEgressLaneSchema, AgentEgressDropReasonSchema, AgentContentReadSurfaceSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentEgressContentHashSchema, AgentEgressPolicyRevisionSchema, AgentMessageContractSchema, AgentMessageContentTypeSchema, AgentMessageDestinationBindingSchema, AgentMessageFreshnessCursorSchema, AgentMessageServerContextSchema, AgentMessageEgressRequirementSchema, AGENT_MESSAGE_MAX_BYTES, } from './agent-egress';
+export { AgentEgressPolicySchema, AgentEgressActivityPolicySchema, AgentReliableQuotaPolicySchema, ContentReadPolicySchema, AgentEgressLaneSchema, AgentEgressDropReasonSchema, AgentContentReadSurfaceSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentEgressContentHashSchema, AgentEgressPolicyRevisionSchema, AgentMessageContractSchema, AgentMessageContentTypeSchema, AgentMessageDestinationBindingSchema, AgentMessageFreshnessCursorSchema, AgentMessageServerContextSchema, AgentMessageEgressRequirementSchema, AGENT_MESSAGE_MAX_BYTES, AGENT_MESSAGE_DRAFT_FRAME_MAX_BYTES, } from './agent-egress';
 export type { AgentEgressPolicy, AgentEgressActivityPolicy, AgentReliableQuotaPolicy, ContentReadPolicy, AgentEgressLane, AgentEgressDropReason, AgentMessageContentType, AgentMessageEgressRequirement, AgentMessageServerContext, AgentContentReadSurface, AgentContentActorKind, AgentContentActor, AgentContentDecodeAs, AgentContentReadDecision, AgentContentReadDenialReason, } from './agent-egress';
 export { AGENT_HOME_PROJECTION_MAX_BYTES, AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM, AgentHomeProjectionProfileRevisionSchema, AgentHomeProjectionHashSchema, AgentHomeProjectionOutcomeSchema, AgentHomeProjectionValueSchema, } from './agent-home-projection';
 export type { AgentHomeProjectionProfileRevision, AgentHomeProjectionHash, AgentHomeProjectionOutcome, AgentHomeProjectionValue, } from './agent-home-projection';
@@ -28,8 +28,8 @@ export { RESULT_SCHEMA_MAX_BYTES, RESULT_OUTCOME_MAX_BYTES, RESULT_SCHEMA_MAX_DE
 export type { ResultSchema, ResultSchemaKeyword, ResultSchemaInstanceType, ResultIssue, ResultDocumentFailureReason, ResultSchemaCheck, ResultOutcomeCheck, } from './result-schema';
 export { TASK_STATES, TASK_TRANSITIONS, canTransition } from './task-state';
 export type { TaskState } from './task-state';
-export { MESSAGE_TYPES, TASK_OFFER_TYPES, isTaskOfferType, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, RuntimeCapabilitiesSchema, AgentRefSchema, AgentHomeProjectionAgentRefSchema, AGENT_REF_MAX_BYTES, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, AgentHomeAccessSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferPreparedPayloadSchema, AgentEgressReliablePayloadSchema, AgentEgressAckPayloadSchema, AgentMessagePublishPayloadSchema, AgentMessageDispositionPayloadSchema, AgentContentReadPayloadSchema, AgentContentReceiptPayloadSchema, AgentHomeProjectionPayloadSchema, AgentMemoryIntentAvailablePayloadSchema, AgentInputPreparationPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalAgentHomeProjectionSchema, TerminalAgentHomeMemoryChangeSchema, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
-export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, AgentRef, AgentHomeProjectionAgentRef, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskOfferForAgentPayload, TaskOfferForAgentWithEgressPayload, TaskOfferForAgentWithEgressFreshPayload, TaskOfferPreparedPayload, AgentEgressReliablePayload, AgentEgressAckPayload, AgentMessagePublishPayload, AgentMessageDispositionPayload, AgentContentReadPayload, AgentContentReceiptPayload, AgentHomeProjectionPayload, AgentMemoryIntentAvailablePayload, AgentInputPreparationPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, TerminalPreparedObservation, TerminalAgentHomeProjection, TerminalAgentHomeMemoryChange, AgentHomeAccess, } from './messages';
+export { MESSAGE_TYPES, TASK_OFFER_TYPES, isTaskOfferType, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, RuntimeCapabilitiesSchema, AgentRefSchema, AgentHomeProjectionAgentRefSchema, AGENT_REF_MAX_BYTES, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, AgentHomeAccessSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferPreparedPayloadSchema, AgentEgressReliablePayloadSchema, AgentEgressAckPayloadSchema, AgentMessagePublishPayloadSchema, AgentMessageDraftPayloadSchema, AgentMessageDispositionPayloadSchema, AgentContentReadPayloadSchema, AgentContentReceiptPayloadSchema, AgentHomeProjectionPayloadSchema, AgentMemoryIntentAvailablePayloadSchema, AgentInputPreparationPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalAgentHomeProjectionSchema, TerminalAgentHomeMemoryChangeSchema, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
+export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, AgentRef, AgentHomeProjectionAgentRef, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskOfferForAgentPayload, TaskOfferForAgentWithEgressPayload, TaskOfferForAgentWithEgressFreshPayload, TaskOfferPreparedPayload, AgentEgressReliablePayload, AgentEgressAckPayload, AgentMessagePublishPayload, AgentMessageDraftPayload, AgentMessageDispositionPayload, AgentContentReadPayload, AgentContentReceiptPayload, AgentHomeProjectionPayload, AgentMemoryIntentAvailablePayload, AgentInputPreparationPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, TerminalPreparedObservation, TerminalAgentHomeProjection, TerminalAgentHomeMemoryChange, AgentHomeAccess, } from './messages';
 export { EnvelopeSchema, isServerToDaemonType } from './envelope';
 export type { Envelope } from './envelope';
 export { ProtocolError, EnvelopeParseError, UnknownMessageTypeError, EnvelopeValidationError, } from './errors';
@@ -41,3 +41,5 @@ export type { TaskOfferType } from './messages';
 export type { HarnessId, HarnessInfo } from './messages';
 export { CUSTOM_HARNESS_CAPABILITY } from './version';
 export { PreparedAgentMemoryModeSchema, type PreparedAgentMemoryMode } from './input-preparation';
+export * from './bot-turn-outcome';
+export { resultOutcomeMaxBytes } from './result-schema';