@byok-sdk/protocol 0.30.0 → 0.30.2

package/dist/capability-constants.d.ts

@@ -38,6 +38,8 @@ export declare const AGENT_MEMORY_PROJECTION_CAPABILITY: 'agent.memory.projectio
 export declare const AGENT_MEMORY_SELECTION_CAPABILITY: 'agent-memory-selection';
 /** Device capability required before an ordinary Agent offer may carry `agentMemory: 'read-if-admitted'`. */
 export declare const AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY: 'agent-memory-read-if-admitted';
+/** Device capability required before an ordinary Agent offer may carry `agentMemory: 'read-write-if-admitted'`. */
+export declare const AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY: 'agent-memory-read-write-if-admitted';
 /** Exact capability of the single input-preparation wire authority. */
 export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparation-v9";
 /**
@@ -47,6 +49,24 @@ export declare const AGENT_INPUT_PREPARATION_CAPABILITY: "agent-input-preparatio
  * `WIRE_ADDITIONS`.
  */
 export declare const SEALED_PAYLOAD_CAPABILITY: 'sealed-payload-v1';
+/**
+ * A server advertises it before a device may send a sealed task output that
+ * names its ciphertext blob (`sealed.ciphertextRef`) instead of carrying it
+ * inline. The server then holds the blob for the life of the task.
+ */
+export declare const SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY: 'sealed-output-ciphertext-ref';
+/**
+ * A server advertises it before a device may send `task.fail.failure`, the
+ * machine-readable runtime failure class (#869).
+ */
+export declare const RUNTIME_FAILURE_CLASS_CAPABILITY: 'runtime-failure-class';
+/**
+ * The closed classes of `task.fail.failure.class`: the vendored OAR
+ * `FailureClass` values. `unknown` means the runtime gave no structured
+ * evidence. Single value authority shared by schema validation and
+ * schema-free consumers.
+ */
+export declare const RUNTIME_FAILURE_CLASSES: readonly ['auth', 'quota', 'rate_limited', 'billing', 'model_unavailable', 'input_too_large', 'invalid_request', 'overloaded', 'provider', 'runtime_exited', 'limit_reached', 'output_schema', 'unknown'];
 /** Single value authority shared by schema validation and schema-free consumers. */
 export declare const PREPARED_AGENT_MEMORY_MODES: readonly ['none', 'read', 'read-write'];
 export declare function isPreparedAgentMemoryMode(value: unknown): value is (typeof PREPARED_AGENT_MEMORY_MODES)[number];

package/dist/constants.js

@@ -16,8 +16,26 @@ var AGENT_MEMORY_INTENT_CAPABILITY = "agent-memory-intent.v1";
 var AGENT_MEMORY_PROJECTION_CAPABILITY = "agent.memory.projection";
 var AGENT_MEMORY_SELECTION_CAPABILITY = "agent-memory-selection";
 var AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY = "agent-memory-read-if-admitted";
+var AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY = "agent-memory-read-write-if-admitted";
 var AGENT_INPUT_PREPARATION_CAPABILITY = `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}`;
 var SEALED_PAYLOAD_CAPABILITY = "sealed-payload-v1";
+var SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY = "sealed-output-ciphertext-ref";
+var RUNTIME_FAILURE_CLASS_CAPABILITY = "runtime-failure-class";
+var RUNTIME_FAILURE_CLASSES = [
+  "auth",
+  "quota",
+  "rate_limited",
+  "billing",
+  "model_unavailable",
+  "input_too_large",
+  "invalid_request",
+  "overloaded",
+  "provider",
+  "runtime_exited",
+  "limit_reached",
+  "output_schema",
+  "unknown"
+];
 var PREPARED_AGENT_MEMORY_MODES = ["none", "read", "read-write"];
 function isPreparedAgentMemoryMode(value) {
   return typeof value === "string" && PREPARED_AGENT_MEMORY_MODES.some((mode) => mode === value);
@@ -59,8 +77,11 @@ var CAPABILITY_FLAGS = [
   AGENT_MEMORY_INTENT_CAPABILITY,
   AGENT_MEMORY_SELECTION_CAPABILITY,
   AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY,
+  AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY,
   "agent-message-draft",
-  SEALED_PAYLOAD_CAPABILITY
+  SEALED_PAYLOAD_CAPABILITY,
+  SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY,
+  RUNTIME_FAILURE_CLASS_CAPABILITY
 ];
 
 // src/task-state.ts
@@ -91,6 +112,6 @@ var AGENT_MEMORY_MAX_SNAPSHOT_BYTES = 1024 * 1024;
 var AGENT_MEMORY_MAX_SNAPSHOT_FILES = 128;
 var RUNTIME_IDS = Object.freeze(["pi", "claude", "codex"]);
 
-export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_HOME_READERS_CAPABILITY, AGENT_INPUT_PREPARATION_CAPABILITY, AGENT_MEMORY_INTENT_CAPABILITY, AGENT_MEMORY_MAX_SNAPSHOT_BYTES, AGENT_MEMORY_MAX_SNAPSHOT_FILES, AGENT_MEMORY_PROJECTION_CAPABILITY, AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY, AGENT_MEMORY_SELECTION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, CAPABILITY_FLAGS, CUSTOM_HARNESS_CAPABILITY, HOST_MCP_TASK_CONTEXT_CAPABILITY, INPUT_PREPARATION_WIRE_VERSION, MAILBOX_READ_AHEAD_CAPABILITY, MAILBOX_READ_AHEAD_MAX_SEQS, PREPARED_AGENT_MEMORY_MODES, PROTOCOL_VERSION, PROVIDER_PROFILE_BINDING_CAPABILITY, PROVIDER_PROVISIONING_CAPABILITY, RUNTIME_IDS, SEALED_PAYLOAD_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, TASK_STATES, TASK_TRANSITIONS, TERMINAL_PROJECTION_SELECTION_CAPABILITY, canTransition, isPreparedAgentMemoryMode };
+export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_HOME_READERS_CAPABILITY, AGENT_INPUT_PREPARATION_CAPABILITY, AGENT_MEMORY_INTENT_CAPABILITY, AGENT_MEMORY_MAX_SNAPSHOT_BYTES, AGENT_MEMORY_MAX_SNAPSHOT_FILES, AGENT_MEMORY_PROJECTION_CAPABILITY, AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY, AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY, AGENT_MEMORY_SELECTION_CAPABILITY, AGENT_MESSAGE_EGRESS_CAPABILITY, CAPABILITY_FLAGS, CUSTOM_HARNESS_CAPABILITY, HOST_MCP_TASK_CONTEXT_CAPABILITY, INPUT_PREPARATION_WIRE_VERSION, MAILBOX_READ_AHEAD_CAPABILITY, MAILBOX_READ_AHEAD_MAX_SEQS, PREPARED_AGENT_MEMORY_MODES, PROTOCOL_VERSION, PROVIDER_PROFILE_BINDING_CAPABILITY, PROVIDER_PROVISIONING_CAPABILITY, RUNTIME_FAILURE_CLASSES, RUNTIME_FAILURE_CLASS_CAPABILITY, RUNTIME_IDS, SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY, SEALED_PAYLOAD_CAPABILITY, STRICT_AGENT_ONLY_CAPABILITY, TASK_STATES, TASK_TRANSITIONS, TERMINAL_PROJECTION_SELECTION_CAPABILITY, canTransition, isPreparedAgentMemoryMode };
 //# sourceMappingURL=constants.js.map
 //# sourceMappingURL=constants.js.map

package/dist/constants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/capability-constants.ts","../src/version.ts","../src/task-state.ts","../src/constants.ts"],"names":[],"mappings":";AAWO,IAAM,8BAAA,GAAiC;AAIvC,IAAM,8BAAA,GAAiC;AAEvC,IAAM,oCAAA,GAAuC;AAG7C,IAAM,qCAAA,GAAwC;AAG9C,IAAM,+BAAA,GAAkC;AAExC,IAAM,uCAAA,GAA0C;AAEhD,IAAM,wCAAA,GAA2C;AAEjD,IAAM,sCAAA,GAAyC;AAG/C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,wCAAA,GAA2C;AAGjD,IAAM,gCAAA,GAAmC;AAGzC,IAAM,mCAAA,GAAsC;AAG5C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,kCAAA,GAAqC;AAG3C,IAAM,iCAAA,GAAoC;AAG1C,IAAM,wCAAA,GAA2C;AAGjD,IAAM,kCAAA,GACX,4BAA4B,8BAA8B,CAAA;AAQrD,IAAM,yBAAA,GAA4B;AAGlC,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAQ,MAAA,EAAQ,YAAY;AAEjE,SAAS,0BAA0B,KAAA,EAAuE;AAC/G,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,4BAA4B,IAAA,CAAK,CAAA,IAAA,KAAQ,SAAS,KAAK,CAAA;AAC7F;;;AC1EO,IAAM,2BAAA,GAA8B;AACpC,IAAM,6BAAA,GAAgC;AAgCtC,IAAM,gBAAA,GAAmB;AAGzB,IAAM,4BAAA,GAA+B;AASrC,IAAM,6BAAA,GAAgC;AA2DtC,IAAM,yBAAA,GAA4B;AAElC,IAAM,gBAAA,GAAmB;AAAA,EAC9B,OAAA;AAAA,EACA,aAAA;AAAA,EACA,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,mCAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA,6BAAA;AAAA,EACA,4BAAA;AAAA,EACA,8BAAA;AAAA,EACA,oCAAA;AAAA,EACA,+BAAA;AAAA,EACA,qCAAA;AAAA,EACA,uCAAA;AAAA,EACA,wCAAA;AAAA,EACA,sCAAA;AAAA,EACA,gCAAA;AAAA,EACA,kCAAA;AAAA,EACA,wCAAA;AAAA,EACA,gCAAA;AAAA,EACA,yBAAA;AAAA,EACA,6BAAA;AAAA,EACA,gCAAA;AAAA,EACA,8BAAA;AAAA,EACA,iCAAA;AAAA,EACA,wCAAA;AAAA,EACA,qBAAA;AAAA,EACA;AACF;;;AC1IO,IAAM,WAAA,GAAc;AAAA,EACzB,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAA,GAAsE;AAAA,EACjF,OAAA,EAAS,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,eAAA,EAAiB,UAAA,EAAY,UAAU,WAAW,CAAA;AAAA,EAC5D,aAAA,EAAe,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAChD,UAAU,EAAC;AAAA,EACX,QAAQ,EAAC;AAAA,EACT,WAAW;AACb;AAGO,SAAS,aAAA,CAAc,MAAiB,EAAA,EAAwB;AACrE,EAAA,OAAO,gBAAA,CAAiB,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAC3C;;;ACnCO,IAAM,kCAAkC,IAAA,GAAO;AAE/C,IAAM,+BAAA,GAAkC;AAGxC,IAAM,cAAc,MAAA,CAAO,MAAA,CAAO,CAAC,IAAA,EAAM,QAAA,EAAU,OAAO,CAAU","file":"constants.js","sourcesContent":["/**\n * The ONE version of the input-preparation contract, shared by this relay wire\n * (the `agent.input.preparation` payload and the completion receipt summary)\n * and by the device-local request, receipt and artifact\n * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).\n *\n * The relay wire carries no version field of its own, so a version change is\n * made visible where admission actually happens: in the capability token\n * below. See `INPUT_PREPARATION_VERSION` in the client for what each version\n * changed.\n */\nexport const INPUT_PREPARATION_WIRE_VERSION = 9 as const;\n\n\n/** Additive daemon capability names. Server/cloud admission consumes these exactly. */\nexport const AGENT_EGRESS_POLICY_CAPABILITY = 'agent-egress-policy' as const;\n\nexport const AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = 'agent-egress-reliable-ack' as const;\n\n/** Admits the distinct offer whose runtime mints its session only after start. */\nexport const AGENT_EGRESS_FRESH_SESSION_CAPABILITY = 'agent-egress-fresh-session' as const;\n\n/** Admits the distinct Agent-authored message lane; activity policy remains independent. */\nexport const AGENT_MESSAGE_EGRESS_CAPABILITY = 'agent-message-egress' as const;\n\nexport const AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = 'agent-content-workspace-read' as const;\n\nexport const AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = 'agent-content-transcript-read' as const;\n\nexport const AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = 'agent-content-artifact-read' as const;\n\n/** Capability required before a task-free Agent-home projection is admitted. */\nexport const AGENT_HOME_PROJECTION_CAPABILITY = 'agent-home-projection' as const;\n\n/** Capability required before an offer may select terminal projection behavior. */\nexport const TERMINAL_PROJECTION_SELECTION_CAPABILITY = 'terminal-projection-selection' as const;\n\n/** Contract §8.1's capability gate for `byok-task-assertion-v1` tool authority. */\nexport const HOST_MCP_TASK_CONTEXT_CAPABILITY = 'host-mcp-task-context' as const;\n\n/** Daemon capability required before an exact local provider profile may be offered. */\nexport const PROVIDER_PROFILE_BINDING_CAPABILITY = 'provider-profile-binding' as const;\n\n/** Device capability required before a Host may enqueue `provider.provisioning.available`. */\nexport const PROVIDER_PROVISIONING_CAPABILITY = 'provider-provisioning.v1' as const;\n\n/** Device capability required before a Host may enqueue `agent.memory.intent.available`. */\nexport const AGENT_MEMORY_INTENT_CAPABILITY = 'agent-memory-intent.v1' as const;\n\n/** Capability required before the optional hosted Agent-memory projection can be used. */\nexport const AGENT_MEMORY_PROJECTION_CAPABILITY = 'agent.memory.projection' as const;\n\n/** Device capability required before an ordinary Agent offer may carry `agentMemory`. */\nexport const AGENT_MEMORY_SELECTION_CAPABILITY = 'agent-memory-selection' as const;\n\n/** Device capability required before an ordinary Agent offer may carry `agentMemory: 'read-if-admitted'`. */\nexport const AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY = 'agent-memory-read-if-admitted' as const;\n\n/** Exact capability of the single input-preparation wire authority. */\nexport const AGENT_INPUT_PREPARATION_CAPABILITY =\n  `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}` as const;\n\n/**\n * Sealed payload v1 (#654). A device advertises it before a Host may send it\n * a sealed offer or steer; a server advertises it before a device may send it\n * sealed task output or a sealed decline code. Both gates read\n * `WIRE_ADDITIONS`.\n */\nexport const SEALED_PAYLOAD_CAPABILITY = 'sealed-payload-v1' as const;\n\n/** Single value authority shared by schema validation and schema-free consumers. */\nexport const PREPARED_AGENT_MEMORY_MODES = ['none', 'read', 'read-write'] as const;\n\nexport function isPreparedAgentMemoryMode(value: unknown): value is (typeof PREPARED_AGENT_MEMORY_MODES)[number] {\n  return typeof value === 'string' && PREPARED_AGENT_MEMORY_MODES.some(mode => mode === value);\n}\n","/** Bounded volatile navigation; only cursor is a durable acknowledgement. */\nexport const MAILBOX_READ_AHEAD_MAX_SEQS = 4096;\nexport const MAILBOX_READ_AHEAD_CAPABILITY = 'mailbox-read-ahead';\n\n/**\n * Wire protocol version. Every v3 change is a version bump, a gated addition\n * or a strip-safe addition: see docs/protocol.md \"Freeze rule\", which is the\n * one statement of the rule, and `src/wire-additions.ts`, which declares the\n * receiver-capability gates and additions. No v3 release has been published\n * yet, so `src/__tests__/compat.test.ts` has no published v3 decoder to prove\n * additions against; cross-release gates stay unproven until one exists.\n *\n * v3 makes `schema` required on the `terminalProjection.mode:\n * 'result-document'` arm (`terminal-projection.ts`, `result-schema.ts`): the\n * offer freezes the outcome schema, and the outcome reaches the Host only as\n * `task.complete.document`. That narrows a strict shape, so it is a wire\n * major. A v2 envelope is rejected; there is no v2 reader and no capability\n * negotiation between the two result-document shapes. Drain, then upgrade\n * server and client together. Every addition v2 declared is part of the v3\n * baseline, and the v2 `result-document` capability flag is gone: every v3\n * server keeps `task.complete.document`.\n *\n * v2 removed the task offer's `policy` (`PermissionPolicy`), the runtime\n * capability `permissionModes` and the input-preparation `permissionMode`.\n * Sessions run without an SDK permission gate; each local agent keeps its\n * own guardrails. A v1 envelope is rejected; there is no v1 reader.\n * v2 also removed the egress policy's `metadata-status` activity mode, its\n * `activity.mode` field and the `sanitizer_rejected` drop reason. Agent\n * egress goes to the Host as the runtime produced it.\n * v2 also removed the input-preparation artifact's `toolImplementationKinds`\n * and the readiness reason `executor_identity_unproven`. The SDK does not\n * attest tool executables. The artifact names its counted tools in\n * `toolNames`.\n */\nexport const PROTOCOL_VERSION = 3;\n\n/** Host declares that this device accepts only Agent-bound offer variants. */\nexport const STRICT_AGENT_ONLY_CAPABILITY = 'strict-agent-only' as const;\n\n/**\n * The device runs `homeAccess: 'memory-reader'` Agent offers: each reader\n * Attempt gets its own run directory under the Agent home, and readers are\n * counted apart from the one writer. The Agent offers are strict, so a host\n * must refuse a reader offer to a device without this flag before it creates\n * the task.\n */\nexport const AGENT_HOME_READERS_CAPABILITY = 'agent-home-readers' as const;\n\n/**\n * Capability flags exchanged during the connection handshake (`conn.hello` /\n * `conn.ack`). Additional flags may be introduced without a protocol version\n * bump; unrecognized flags must be ignored by both sides.\n *\n * `interactive-approval` is RESERVED as of this addition: it gates the\n * (currently unexercised) approval seam — a server must not route an\n * approval-requiring policy to a daemon that hasn't advertised this flag. No\n * bundled runtime adapter emits it yet; that's expected until interactive\n * approval is actually wired up in a later wave.\n *\n * `approval_resolved` (additive-minor): a SERVER-advertised flag meaning\n * \"I understand the `task.approval_resolved` message\" (`messages.ts`). This\n * is the N/N-1 answer for that new daemon -> server message: an old server's\n * `CAPABILITY_FLAGS`/`conn.ack.capabilities` never includes it, so a new\n * daemon talking to an old server never sends `task.approval_resolved` at\n * all (see `packages/client`'s `task-runner.ts`) and falls back to the\n * pre-existing implicit-resume inference\n * (`ConnectionHub.resumeIfImplicitlyApproved`, `packages/server/src/hub.ts`)\n * unconditionally, exactly as before this flag existed. Unlike\n * `interactive-approval`, this one IS exercised the moment both sides\n * support it — there is no reserved/dormant period for it.\n */\n/**\n * `approval-targeting` (M5, additive-minor): unlike `approval_resolved`\n * above, this flag is purely INFORMATIONAL/semantic, not a functional gate.\n * `task.await_approval`/`task.approve`/`task.reject` all carry their new\n * `approvalId` field UNCONDITIONALLY on both sides once each peer is\n * upgraded -- the wire is tolerant (a plain, non-`.strict()` `z.object()`\n * field, `messages.ts`), so no version/capability negotiation is needed just\n * to send it safely; an older peer that doesn't recognize the field simply\n * never reads it. Receivers decide whether to apply exact-match targeting\n * by FIELD PRESENCE on the specific message at hand (does this particular\n * `task.approve`/`task.reject`/`onApprovalResolved` payload carry an\n * `approvalId`, and does a stored one exist to compare it against?), never\n * by checking this flag -- see `ConnectionHub.approveTask`/`rejectTask`/\n * `onApprovalResolved` and `TaskRunner.handleApprove`/`handleReject`\n * (`packages/client`'s `task-runner.ts`). This flag exists only so each side\n * can advertise, and an embedder/operator can observe (`ConnectionHub.\n * getDeviceCapabilities`), whether the OTHER side is new enough to\n * participate in targeting at all -- the same N/N-1-safe shape as every\n * other flag here, just consumed for observability instead of gating.\n */\n/**\n * `dispatch-selection` (additive-minor) is a correctness gate for the\n * optional `task.offer.dispatchSelection` control field. An older v1 daemon\n * legally strips unknown optional fields, so a server must never send an\n * authoritative provider/model selection unless the target connection\n * advertises this flag. Absence means reject before task creation, not send\n * a legacy runtime-only offer that could reach a different provider.\n *\n * `toolset-selection` (additive-minor) means the daemon understands\n * `task.offer_with_toolsets` and can resolve its logical ids against local\n * MCP configuration. The distinct message type is also the N/N-1 safety\n * boundary for long-poll: an older daemon skips it as unknown and therefore\n * cannot accidentally execute the instruction without the required tools.\n */\nexport const CUSTOM_HARNESS_CAPABILITY = 'custom-harness' as const;\n\nexport const CAPABILITY_FLAGS = [\n  'steer',\n  'blob-upload',\n  'interactive-approval',\n  'approval_resolved',\n  'approval-targeting',\n  'dispatch-selection',\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  'toolset-selection',\n  'agent-home-contract',\n  AGENT_HOME_READERS_CAPABILITY,\n  STRICT_AGENT_ONLY_CAPABILITY,\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  CUSTOM_HARNESS_CAPABILITY,\n  MAILBOX_READ_AHEAD_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  AGENT_MEMORY_SELECTION_CAPABILITY,\n  AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY,\n  'agent-message-draft',\n  SEALED_PAYLOAD_CAPABILITY,\n] as const;\n\nexport type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];\nimport {\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  AGENT_MEMORY_SELECTION_CAPABILITY,\n  AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n  SEALED_PAYLOAD_CAPABILITY,\n} from './capability-constants';\n","export const TASK_STATES = [\n  'Offered',\n  'Claimed',\n  'Running',\n  'AwaitApproval',\n  'Complete',\n  'Failed',\n  'Cancelled',\n] as const;\n\nexport type TaskState = (typeof TASK_STATES)[number];\n\n/**\n * Legal state transitions for a task. `Complete` / `Failed` / `Cancelled` are\n * terminal (no outgoing edges). `Running` and `AwaitApproval` form a loop:\n * the daemon can request approval mid-run and resume once the server\n * approves (or fail/cancel out of the approval wait).\n *\n * `Offered -> Failed` (M1 gap #5, \"Declined vs. Failed\"): a daemon that\n * declines an offer pre-claim (`task.decline`) reports it through the\n * existing `Failed` state rather than a new `Declined` state. A decline and\n * a post-claim failure are the same outcome from the dispatcher's point of\n * view — this attempt produced no result, `reason`/`retryable` say why and\n * whether retrying elsewhere makes sense — so reusing `Failed` keeps the\n * state machine minimal instead of forking every terminal-state consumer\n * into \"Failed or Declined, handle both\". See docs/protocol.md for the full\n * writeup.\n */\nexport const TASK_TRANSITIONS: Readonly<Record<TaskState, readonly TaskState[]>> = {\n  Offered: ['Claimed', 'Cancelled', 'Failed'],\n  Claimed: ['Running', 'Failed', 'Cancelled'],\n  Running: ['AwaitApproval', 'Complete', 'Failed', 'Cancelled'],\n  AwaitApproval: ['Running', 'Failed', 'Cancelled'],\n  Complete: [],\n  Failed: [],\n  Cancelled: [],\n};\n\n/** Whether `from -> to` is a legal transition per {@link TASK_TRANSITIONS}. */\nexport function canTransition(from: TaskState, to: TaskState): boolean {\n  return TASK_TRANSITIONS[from].includes(to);\n}\n","/** Schema-free protocol values. Import this entry when runtime schemas are unnecessary. */\nexport * from './version';\nexport * from './task-state';\nexport * from './capability-constants';\n\n/** Maximum raw UTF-8 content bytes in one local Host Agent-memory export; no truncation. */\nexport const AGENT_MEMORY_MAX_SNAPSHOT_BYTES = 1024 * 1024;\n/** Maximum memory files in one local Host export, including MEMORY.md. */\nexport const AGENT_MEMORY_MAX_SNAPSHOT_FILES = 128;\n\n/** The frozen wire runtime ids. Any other adapter id is a custom harness (`harnessId`). */\nexport const RUNTIME_IDS = Object.freeze(['pi', 'claude', 'codex'] as const);\n"]}
+{"version":3,"sources":["../src/capability-constants.ts","../src/version.ts","../src/task-state.ts","../src/constants.ts"],"names":[],"mappings":";AAWO,IAAM,8BAAA,GAAiC;AAIvC,IAAM,8BAAA,GAAiC;AAEvC,IAAM,oCAAA,GAAuC;AAG7C,IAAM,qCAAA,GAAwC;AAG9C,IAAM,+BAAA,GAAkC;AAExC,IAAM,uCAAA,GAA0C;AAEhD,IAAM,wCAAA,GAA2C;AAEjD,IAAM,sCAAA,GAAyC;AAG/C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,wCAAA,GAA2C;AAGjD,IAAM,gCAAA,GAAmC;AAGzC,IAAM,mCAAA,GAAsC;AAG5C,IAAM,gCAAA,GAAmC;AAGzC,IAAM,8BAAA,GAAiC;AAGvC,IAAM,kCAAA,GAAqC;AAG3C,IAAM,iCAAA,GAAoC;AAG1C,IAAM,wCAAA,GAA2C;AAGjD,IAAM,8CAAA,GAAiD;AAGvD,IAAM,kCAAA,GACX,4BAA4B,8BAA8B,CAAA;AAQrD,IAAM,yBAAA,GAA4B;AAOlC,IAAM,uCAAA,GAA0C;AAMhD,IAAM,gCAAA,GAAmC;AAQzC,IAAM,uBAAA,GAA0B;AAAA,EACrC,MAAA;AAAA,EAAQ,OAAA;AAAA,EAAS,cAAA;AAAA,EAAgB,SAAA;AAAA,EAAW,mBAAA;AAAA,EAAqB,iBAAA;AAAA,EAAmB,iBAAA;AAAA,EACpF,YAAA;AAAA,EAAc,UAAA;AAAA,EAAY,gBAAA;AAAA,EAAkB,eAAA;AAAA,EAAiB,eAAA;AAAA,EAAiB;AAChF;AAGO,IAAM,2BAAA,GAA8B,CAAC,MAAA,EAAQ,MAAA,EAAQ,YAAY;AAEjE,SAAS,0BAA0B,KAAA,EAAuE;AAC/G,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,4BAA4B,IAAA,CAAK,CAAA,IAAA,KAAQ,SAAS,KAAK,CAAA;AAC7F;;;ACrGO,IAAM,2BAAA,GAA8B;AACpC,IAAM,6BAAA,GAAgC;AAgCtC,IAAM,gBAAA,GAAmB;AAGzB,IAAM,4BAAA,GAA+B;AASrC,IAAM,6BAAA,GAAgC;AA4DtC,IAAM,yBAAA,GAA4B;AAElC,IAAM,gBAAA,GAAmB;AAAA,EAC9B,OAAA;AAAA,EACA,aAAA;AAAA,EACA,sBAAA;AAAA,EACA,mBAAA;AAAA,EACA,oBAAA;AAAA,EACA,oBAAA;AAAA,EACA,mCAAA;AAAA,EACA,mBAAA;AAAA,EACA,qBAAA;AAAA,EACA,6BAAA;AAAA,EACA,4BAAA;AAAA,EACA,8BAAA;AAAA,EACA,oCAAA;AAAA,EACA,+BAAA;AAAA,EACA,qCAAA;AAAA,EACA,uCAAA;AAAA,EACA,wCAAA;AAAA,EACA,sCAAA;AAAA,EACA,gCAAA;AAAA,EACA,kCAAA;AAAA,EACA,wCAAA;AAAA,EACA,gCAAA;AAAA,EACA,yBAAA;AAAA,EACA,6BAAA;AAAA,EACA,gCAAA;AAAA,EACA,8BAAA;AAAA,EACA,iCAAA;AAAA,EACA,wCAAA;AAAA,EACA,8CAAA;AAAA,EACA,qBAAA;AAAA,EACA,yBAAA;AAAA,EACA,uCAAA;AAAA,EACA;AACF;;;AC9IO,IAAM,WAAA,GAAc;AAAA,EACzB,SAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,eAAA;AAAA,EACA,UAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF;AAoBO,IAAM,gBAAA,GAAsE;AAAA,EACjF,OAAA,EAAS,CAAC,SAAA,EAAW,WAAA,EAAa,QAAQ,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAC1C,OAAA,EAAS,CAAC,eAAA,EAAiB,UAAA,EAAY,UAAU,WAAW,CAAA;AAAA,EAC5D,aAAA,EAAe,CAAC,SAAA,EAAW,QAAA,EAAU,WAAW,CAAA;AAAA,EAChD,UAAU,EAAC;AAAA,EACX,QAAQ,EAAC;AAAA,EACT,WAAW;AACb;AAGO,SAAS,aAAA,CAAc,MAAiB,EAAA,EAAwB;AACrE,EAAA,OAAO,gBAAA,CAAiB,IAAI,CAAA,CAAE,QAAA,CAAS,EAAE,CAAA;AAC3C;;;ACnCO,IAAM,kCAAkC,IAAA,GAAO;AAE/C,IAAM,+BAAA,GAAkC;AAGxC,IAAM,cAAc,MAAA,CAAO,MAAA,CAAO,CAAC,IAAA,EAAM,QAAA,EAAU,OAAO,CAAU","file":"constants.js","sourcesContent":["/**\n * The ONE version of the input-preparation contract, shared by this relay wire\n * (the `agent.input.preparation` payload and the completion receipt summary)\n * and by the device-local request, receipt and artifact\n * (`@byok-sdk/client`'s `INPUT_PREPARATION_VERSION`, which is this value).\n *\n * The relay wire carries no version field of its own, so a version change is\n * made visible where admission actually happens: in the capability token\n * below. See `INPUT_PREPARATION_VERSION` in the client for what each version\n * changed.\n */\nexport const INPUT_PREPARATION_WIRE_VERSION = 9 as const;\n\n\n/** Additive daemon capability names. Server/cloud admission consumes these exactly. */\nexport const AGENT_EGRESS_POLICY_CAPABILITY = 'agent-egress-policy' as const;\n\nexport const AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = 'agent-egress-reliable-ack' as const;\n\n/** Admits the distinct offer whose runtime mints its session only after start. */\nexport const AGENT_EGRESS_FRESH_SESSION_CAPABILITY = 'agent-egress-fresh-session' as const;\n\n/** Admits the distinct Agent-authored message lane; activity policy remains independent. */\nexport const AGENT_MESSAGE_EGRESS_CAPABILITY = 'agent-message-egress' as const;\n\nexport const AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = 'agent-content-workspace-read' as const;\n\nexport const AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = 'agent-content-transcript-read' as const;\n\nexport const AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = 'agent-content-artifact-read' as const;\n\n/** Capability required before a task-free Agent-home projection is admitted. */\nexport const AGENT_HOME_PROJECTION_CAPABILITY = 'agent-home-projection' as const;\n\n/** Capability required before an offer may select terminal projection behavior. */\nexport const TERMINAL_PROJECTION_SELECTION_CAPABILITY = 'terminal-projection-selection' as const;\n\n/** Contract §8.1's capability gate for `byok-task-assertion-v1` tool authority. */\nexport const HOST_MCP_TASK_CONTEXT_CAPABILITY = 'host-mcp-task-context' as const;\n\n/** Daemon capability required before an exact local provider profile may be offered. */\nexport const PROVIDER_PROFILE_BINDING_CAPABILITY = 'provider-profile-binding' as const;\n\n/** Device capability required before a Host may enqueue `provider.provisioning.available`. */\nexport const PROVIDER_PROVISIONING_CAPABILITY = 'provider-provisioning.v1' as const;\n\n/** Device capability required before a Host may enqueue `agent.memory.intent.available`. */\nexport const AGENT_MEMORY_INTENT_CAPABILITY = 'agent-memory-intent.v1' as const;\n\n/** Capability required before the optional hosted Agent-memory projection can be used. */\nexport const AGENT_MEMORY_PROJECTION_CAPABILITY = 'agent.memory.projection' as const;\n\n/** Device capability required before an ordinary Agent offer may carry `agentMemory`. */\nexport const AGENT_MEMORY_SELECTION_CAPABILITY = 'agent-memory-selection' as const;\n\n/** Device capability required before an ordinary Agent offer may carry `agentMemory: 'read-if-admitted'`. */\nexport const AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY = 'agent-memory-read-if-admitted' as const;\n\n/** Device capability required before an ordinary Agent offer may carry `agentMemory: 'read-write-if-admitted'`. */\nexport const AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY = 'agent-memory-read-write-if-admitted' as const;\n\n/** Exact capability of the single input-preparation wire authority. */\nexport const AGENT_INPUT_PREPARATION_CAPABILITY =\n  `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}` as const;\n\n/**\n * Sealed payload v1 (#654). A device advertises it before a Host may send it\n * a sealed offer or steer; a server advertises it before a device may send it\n * sealed task output or a sealed decline code. Both gates read\n * `WIRE_ADDITIONS`.\n */\nexport const SEALED_PAYLOAD_CAPABILITY = 'sealed-payload-v1' as const;\n\n/**\n * A server advertises it before a device may send a sealed task output that\n * names its ciphertext blob (`sealed.ciphertextRef`) instead of carrying it\n * inline. The server then holds the blob for the life of the task.\n */\nexport const SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY = 'sealed-output-ciphertext-ref' as const;\n\n/**\n * A server advertises it before a device may send `task.fail.failure`, the\n * machine-readable runtime failure class (#869).\n */\nexport const RUNTIME_FAILURE_CLASS_CAPABILITY = 'runtime-failure-class' as const;\n\n/**\n * The closed classes of `task.fail.failure.class`: the vendored OAR\n * `FailureClass` values. `unknown` means the runtime gave no structured\n * evidence. Single value authority shared by schema validation and\n * schema-free consumers.\n */\nexport const RUNTIME_FAILURE_CLASSES = [\n  'auth', 'quota', 'rate_limited', 'billing', 'model_unavailable', 'input_too_large', 'invalid_request',\n  'overloaded', 'provider', 'runtime_exited', 'limit_reached', 'output_schema', 'unknown',\n] as const;\n\n/** Single value authority shared by schema validation and schema-free consumers. */\nexport const PREPARED_AGENT_MEMORY_MODES = ['none', 'read', 'read-write'] as const;\n\nexport function isPreparedAgentMemoryMode(value: unknown): value is (typeof PREPARED_AGENT_MEMORY_MODES)[number] {\n  return typeof value === 'string' && PREPARED_AGENT_MEMORY_MODES.some(mode => mode === value);\n}\n","/** Bounded volatile navigation; only cursor is a durable acknowledgement. */\nexport const MAILBOX_READ_AHEAD_MAX_SEQS = 4096;\nexport const MAILBOX_READ_AHEAD_CAPABILITY = 'mailbox-read-ahead';\n\n/**\n * Wire protocol version. Every v3 change is a version bump, a gated addition\n * or a strip-safe addition: see docs/protocol.md \"Freeze rule\", which is the\n * one statement of the rule, and `src/wire-additions.ts`, which declares the\n * receiver-capability gates and additions. No v3 release has been published\n * yet, so `src/__tests__/compat.test.ts` has no published v3 decoder to prove\n * additions against; cross-release gates stay unproven until one exists.\n *\n * v3 makes `schema` required on the `terminalProjection.mode:\n * 'result-document'` arm (`terminal-projection.ts`, `result-schema.ts`): the\n * offer freezes the outcome schema, and the outcome reaches the Host only as\n * `task.complete.document`. That narrows a strict shape, so it is a wire\n * major. A v2 envelope is rejected; there is no v2 reader and no capability\n * negotiation between the two result-document shapes. Drain, then upgrade\n * server and client together. Every addition v2 declared is part of the v3\n * baseline, and the v2 `result-document` capability flag is gone: every v3\n * server keeps `task.complete.document`.\n *\n * v2 removed the task offer's `policy` (`PermissionPolicy`), the runtime\n * capability `permissionModes` and the input-preparation `permissionMode`.\n * Sessions run without an SDK permission gate; each local agent keeps its\n * own guardrails. A v1 envelope is rejected; there is no v1 reader.\n * v2 also removed the egress policy's `metadata-status` activity mode, its\n * `activity.mode` field and the `sanitizer_rejected` drop reason. Agent\n * egress goes to the Host as the runtime produced it.\n * v2 also removed the input-preparation artifact's `toolImplementationKinds`\n * and the readiness reason `executor_identity_unproven`. The SDK does not\n * attest tool executables. The artifact names its counted tools in\n * `toolNames`.\n */\nexport const PROTOCOL_VERSION = 3;\n\n/** Host declares that this device accepts only Agent-bound offer variants. */\nexport const STRICT_AGENT_ONLY_CAPABILITY = 'strict-agent-only' as const;\n\n/**\n * The device runs `homeAccess: 'memory-reader'` Agent offers: each reader\n * Attempt gets its own run directory under the Agent home, and readers are\n * counted apart from the one writer. The Agent offers are strict, so a host\n * must refuse a reader offer to a device without this flag before it creates\n * the task.\n */\nexport const AGENT_HOME_READERS_CAPABILITY = 'agent-home-readers' as const;\n\n/**\n * Capability flags. The daemon sends its flags in `conn.hello`; the server\n * sends its own on every long-poll response (`EventsPollResponse`). Additional\n * flags may be introduced without a protocol version bump; unrecognized flags\n * must be ignored by both sides.\n *\n * `interactive-approval` is RESERVED as of this addition: it gates the\n * (currently unexercised) approval seam — a server must not route an\n * approval-requiring policy to a daemon that hasn't advertised this flag. No\n * bundled runtime adapter emits it yet; that's expected until interactive\n * approval is actually wired up in a later wave.\n *\n * `approval_resolved` (additive-minor): a SERVER-advertised flag meaning\n * \"I understand the `task.approval_resolved` message\" (`messages.ts`). This\n * is the N/N-1 answer for that new daemon -> server message: an old server's\n * advertised capabilities never include it, so a new daemon talking to an old\n * server never sends `task.approval_resolved` at all (see `packages/client`'s\n * `task-runner.ts`) and falls back to the pre-existing implicit-resume inference\n * (the `relay.onTaskActivity` hook in `packages/server/src/index.ts`)\n * unconditionally, exactly as before this flag existed. Unlike\n * `interactive-approval`, this one IS exercised the moment both sides\n * support it — there is no reserved/dormant period for it.\n */\n/**\n * `approval-targeting` (M5, additive-minor): unlike `approval_resolved`\n * above, this flag is purely INFORMATIONAL/semantic, not a functional gate.\n * `task.await_approval`/`task.approve`/`task.reject` all carry their new\n * `approvalId` field UNCONDITIONALLY on both sides once each peer is\n * upgraded -- the wire is tolerant (a plain, non-`.strict()` `z.object()`\n * field, `messages.ts`), so no version/capability negotiation is needed just\n * to send it safely; an older peer that doesn't recognize the field simply\n * never reads it. Receivers decide whether to apply exact-match targeting\n * by FIELD PRESENCE on the specific message at hand (does this particular\n * `task.approve`/`task.reject`/`onApprovalResolved` payload carry an\n * `approvalId`, and does a stored one exist to compare it against?), never\n * by checking this flag -- see `approveTask`/`rejectTask` (`@byok-sdk/cloud`)\n * and `TaskRunner.handleApprove`/`handleReject` (`packages/client`'s\n * `task-runner.ts`). This flag exists only so each side can advertise\n * whether the OTHER side is new enough to participate in targeting at all (an\n * embedder could observe it through the old\n * reference server's `ConnectionHub.getDeviceCapabilities`; `@byok-sdk/server`\n * now reads it only internally) -- the same N/N-1-safe shape as every other\n * flag here, just consumed for observability instead of gating.\n */\n/**\n * `dispatch-selection` (additive-minor) is a correctness gate for the\n * optional `task.offer.dispatchSelection` control field. An older v1 daemon\n * legally strips unknown optional fields, so a server must never send an\n * authoritative provider/model selection unless the target connection\n * advertises this flag. Absence means reject before task creation, not send\n * a legacy runtime-only offer that could reach a different provider.\n *\n * `toolset-selection` (additive-minor) means the daemon understands\n * `task.offer_with_toolsets` and can resolve its logical ids against local\n * MCP configuration. The distinct message type is also the N/N-1 safety\n * boundary for long-poll: an older daemon skips it as unknown and therefore\n * cannot accidentally execute the instruction without the required tools.\n */\nexport const CUSTOM_HARNESS_CAPABILITY = 'custom-harness' as const;\n\nexport const CAPABILITY_FLAGS = [\n  'steer',\n  'blob-upload',\n  'interactive-approval',\n  'approval_resolved',\n  'approval-targeting',\n  'dispatch-selection',\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  'toolset-selection',\n  'agent-home-contract',\n  AGENT_HOME_READERS_CAPABILITY,\n  STRICT_AGENT_ONLY_CAPABILITY,\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  CUSTOM_HARNESS_CAPABILITY,\n  MAILBOX_READ_AHEAD_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  AGENT_MEMORY_SELECTION_CAPABILITY,\n  AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY,\n  AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY,\n  'agent-message-draft',\n  SEALED_PAYLOAD_CAPABILITY,\n  SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY,\n  RUNTIME_FAILURE_CLASS_CAPABILITY,\n] as const;\n\nexport type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];\nimport {\n  AGENT_EGRESS_POLICY_CAPABILITY,\n  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,\n  AGENT_EGRESS_FRESH_SESSION_CAPABILITY,\n  AGENT_MESSAGE_EGRESS_CAPABILITY,\n  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,\n  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,\n  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY,\n  AGENT_HOME_PROJECTION_CAPABILITY,\n  TERMINAL_PROJECTION_SELECTION_CAPABILITY,\n  HOST_MCP_TASK_CONTEXT_CAPABILITY,\n  PROVIDER_PROFILE_BINDING_CAPABILITY,\n  PROVIDER_PROVISIONING_CAPABILITY,\n  AGENT_MEMORY_INTENT_CAPABILITY,\n  AGENT_MEMORY_SELECTION_CAPABILITY,\n  AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY,\n  AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY,\n  AGENT_INPUT_PREPARATION_CAPABILITY,\n  SEALED_PAYLOAD_CAPABILITY,\n  SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY,\n  RUNTIME_FAILURE_CLASS_CAPABILITY,\n} from './capability-constants';\n","export const TASK_STATES = [\n  'Offered',\n  'Claimed',\n  'Running',\n  'AwaitApproval',\n  'Complete',\n  'Failed',\n  'Cancelled',\n] as const;\n\nexport type TaskState = (typeof TASK_STATES)[number];\n\n/**\n * Legal state transitions for a task. `Complete` / `Failed` / `Cancelled` are\n * terminal (no outgoing edges). `Running` and `AwaitApproval` form a loop:\n * the daemon can request approval mid-run and resume once the server\n * approves (or fail/cancel out of the approval wait).\n *\n * `Offered -> Failed` (M1 gap #5, \"Declined vs. Failed\"): a daemon that\n * declines an offer pre-claim (`task.decline`) reports it through the\n * existing `Failed` state rather than a new `Declined` state. A decline and\n * a post-claim failure are the same outcome from the dispatcher's point of\n * view — this attempt produced no result, `reason`/`retryable` say why and\n * whether retrying elsewhere makes sense — so reusing `Failed` keeps the\n * state machine minimal instead of forking every terminal-state consumer\n * into \"Failed or Declined, handle both\". See docs/protocol.md for the full\n * writeup.\n */\nexport const TASK_TRANSITIONS: Readonly<Record<TaskState, readonly TaskState[]>> = {\n  Offered: ['Claimed', 'Cancelled', 'Failed'],\n  Claimed: ['Running', 'Failed', 'Cancelled'],\n  Running: ['AwaitApproval', 'Complete', 'Failed', 'Cancelled'],\n  AwaitApproval: ['Running', 'Failed', 'Cancelled'],\n  Complete: [],\n  Failed: [],\n  Cancelled: [],\n};\n\n/** Whether `from -> to` is a legal transition per {@link TASK_TRANSITIONS}. */\nexport function canTransition(from: TaskState, to: TaskState): boolean {\n  return TASK_TRANSITIONS[from].includes(to);\n}\n","/** Schema-free protocol values. Import this entry when runtime schemas are unnecessary. */\nexport * from './version';\nexport * from './task-state';\nexport * from './capability-constants';\n\n/** Maximum raw UTF-8 content bytes in one local Host Agent-memory export; no truncation. */\nexport const AGENT_MEMORY_MAX_SNAPSHOT_BYTES = 1024 * 1024;\n/** Maximum memory files in one local Host export, including MEMORY.md. */\nexport const AGENT_MEMORY_MAX_SNAPSHOT_FILES = 128;\n\n/** The frozen wire runtime ids. Any other adapter id is a custom harness (`harnessId`). */\nexport const RUNTIME_IDS = Object.freeze(['pi', 'claude', 'codex'] as const);\n"]}

package/dist/e2ee-member.d.ts

@@ -17,6 +17,8 @@ export declare const E2EE_MEMBER_CHAIN_ENTRY_MAX_BYTES = 65536;
 export declare const E2EE_MEMBER_CHAIN_READ_MAX_ENTRIES = 256;
 /** The most scope key packages one put accepts. */
 export declare const E2EE_SCOPE_KEY_PACKAGE_PUT_MAX = 256;
+/** The most packages one paged device read returns. */
+export declare const E2EE_SCOPE_KEY_PACKAGE_PAGE_MAX = 16;
 /**
  * The longest scope id, in UTF-16 code units, as for other opaque Host ids.
  * Core sets no maximum, so the scope key package shape (which the parity test
@@ -55,6 +57,7 @@ export declare const E2EE_MEMBER_CHAIN_OPS: readonly ['add', 'remove', 'rotate',
 /**
  * One signed member chain entry. `subject` must be a JSON object; the Host
  * stores the entry as canonical JSON, which refuses any value outside JSON.
+ * A `shred` subject must also be exactly `{ scopeId }`.
  */
 export declare const E2eeMemberChainEntrySchema: z.ZodObject<{
     v: z.ZodLiteral<1>;
@@ -73,9 +76,8 @@ export declare const E2eeMemberChainEntrySchema: z.ZodObject<{
     sig: z.ZodString;
 }, z.core.$strict>;
 export type E2eeMemberChainEntry = z.infer<typeof E2eeMemberChainEntrySchema>;
-/** One scope key wrapped to one member (§7.4). */
-export declare const E2eeScopeKeyPackageSchema: z.ZodObject<{
-    v: z.ZodLiteral<1>;
+/** One scope key wrapped to one member's KEM key of `recipientKemEpoch` (§7.4, §77a). A put takes version 2 only. */
+export declare const E2eeScopeKeyPackageV2Schema: z.ZodObject<{
     tenantId: z.ZodString;
     scopeId: z.ZodString;
     epoch: z.ZodNumber;
@@ -85,7 +87,34 @@ export declare const E2eeScopeKeyPackageSchema: z.ZodObject<{
     enc: z.ZodString;
     ciphertext: z.ZodString;
     sig: z.ZodString;
+    v: z.ZodLiteral<2>;
+    recipientKemEpoch: z.ZodNumber;
 }, z.core.$strict>;
+/** A stored package as a read returns it: version 1 from before `e2ee.member.kem-epoch`, version 2 after. */
+export declare const E2eeScopeKeyPackageSchema: z.ZodUnion<readonly [z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    tenantId: z.ZodString;
+    scopeId: z.ZodString;
+    epoch: z.ZodNumber;
+    keyId: z.ZodString;
+    recipient: z.ZodString;
+    sender: z.ZodString;
+    enc: z.ZodString;
+    ciphertext: z.ZodString;
+    sig: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    tenantId: z.ZodString;
+    scopeId: z.ZodString;
+    epoch: z.ZodNumber;
+    keyId: z.ZodString;
+    recipient: z.ZodString;
+    sender: z.ZodString;
+    enc: z.ZodString;
+    ciphertext: z.ZodString;
+    sig: z.ZodString;
+    v: z.ZodLiteral<2>;
+    recipientKemEpoch: z.ZodNumber;
+}, z.core.$strict>]>;
 export type E2eeScopeKeyPackage = z.infer<typeof E2eeScopeKeyPackageSchema>;
 /** A pairing MAC (§7.2 steps 3 and 4): HMAC-SHA-256 under `pv`, which the Host never holds. */
 export declare const E2eePairingMacSchema: z.ZodString;

package/dist/http-api.d.ts

@@ -160,8 +160,8 @@ export declare const MessagesSendRequestSchema: z.ZodObject<{
 }, z.core.$strip>;
 export type MessagesSendRequest = z.infer<typeof MessagesSendRequestSchema>;
 /**
- * `accepted` counts every envelope `ConnectionHub.handleInbound` returned
- * `'accepted'` *or* `'duplicate'` for — a deduped replay is a wire-level
+ * `accepted` counts every envelope the inbound gate (`@byok-sdk/cloud`'s
+ * `handleInboundEnvelope`) answered `'accepted'` *or* `'duplicate'` for — a deduped replay is a wire-level
  * success even though the business mutation did not run a second time.
  * `rejected` is omitted when zero. `outcomes` is required and correlates
  * exactly one result with each posted envelope; a rejected outcome carries its

package/dist/index.d.ts

@@ -30,8 +30,8 @@ export { RESULT_SCHEMA_MAX_BYTES, RESULT_OUTCOME_MAX_BYTES, RESULT_SCHEMA_MAX_DE
 export type { ResultSchema, ResultSchemaKeyword, ResultSchemaInstanceType, ResultIssue, ResultDocumentFailureReason, ResultSchemaCheck, ResultOutcomeCheck, } from './result-schema';
 export { TASK_STATES, TASK_TRANSITIONS, canTransition } from './task-state';
 export type { TaskState } from './task-state';
-export { MESSAGE_TYPES, TASK_OFFER_TYPES, isTaskOfferType, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, RuntimeCapabilitiesSchema, AgentRefSchema, AgentHomeProjectionAgentRefSchema, AGENT_REF_MAX_BYTES, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, AgentHomeAccessSchema, AgentMemorySelectionSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferPreparedPayloadSchema, AgentEgressReliablePayloadSchema, AgentEgressAckPayloadSchema, AgentMessagePublishPayloadSchema, AgentMessageDraftPayloadSchema, AgentMessageDispositionPayloadSchema, AgentContentReadPayloadSchema, AgentContentReceiptPayloadSchema, AgentHomeProjectionPayloadSchema, AgentMemoryIntentAvailablePayloadSchema, AgentInputPreparationPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalAgentHomeProjectionSchema, TerminalAgentHomeMemoryChangeSchema, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
-export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, AgentRef, AgentHomeProjectionAgentRef, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskOfferForAgentPayload, TaskOfferForAgentWithEgressPayload, TaskOfferForAgentWithEgressFreshPayload, TaskOfferPreparedPayload, TaskOfferSealedPayload, TaskOfferWithToolsetsSealedPayload, TaskOfferForAgentSealedPayload, TaskOfferForAgentWithEgressSealedPayload, TaskOfferForAgentWithEgressFreshSealedPayload, TaskSteerSealedPayload, TaskCompleteSealedPayload, TaskFailSealedPayload, TaskDeclineSealedPayload, TaskCancelledSealedPayload, TaskProgressSealedPayload, TaskArtifactSealedPayload, TaskAwaitApprovalSealedPayload, AgentEgressReliablePayload, AgentEgressAckPayload, AgentMessagePublishPayload, AgentMessageDraftPayload, AgentMessageDispositionPayload, AgentContentReadPayload, AgentContentReceiptPayload, AgentHomeProjectionPayload, AgentMemoryIntentAvailablePayload, AgentInputPreparationPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, TerminalPreparedObservation, TerminalAgentHomeProjection, TerminalAgentHomeMemoryChange, AgentHomeAccess, AgentMemorySelection, } from './messages';
+export { MESSAGE_TYPES, TASK_OFFER_TYPES, isTaskOfferType, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, RuntimeCapabilitiesSchema, AgentRefSchema, AgentHomeProjectionAgentRefSchema, AGENT_REF_MAX_BYTES, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, AgentHomeAccessSchema, AgentMemorySelectionSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferPreparedPayloadSchema, AgentEgressReliablePayloadSchema, AgentEgressAckPayloadSchema, AgentMessagePublishPayloadSchema, AgentMessageDraftPayloadSchema, AgentMessageDispositionPayloadSchema, AgentContentReadPayloadSchema, AgentContentReceiptPayloadSchema, AgentHomeProjectionPayloadSchema, AgentMemoryIntentAvailablePayloadSchema, AgentInputPreparationPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, RuntimeFailureClassSchema, TaskFailureSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalAgentHomeProjectionSchema, TerminalAgentHomeMemoryChangeSchema, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
+export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, AgentRef, AgentHomeProjectionAgentRef, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskOfferForAgentPayload, TaskOfferForAgentWithEgressPayload, TaskOfferForAgentWithEgressFreshPayload, TaskOfferPreparedPayload, TaskOfferSealedPayload, TaskOfferWithToolsetsSealedPayload, TaskOfferForAgentSealedPayload, TaskOfferForAgentWithEgressSealedPayload, TaskOfferForAgentWithEgressFreshSealedPayload, TaskSteerSealedPayload, TaskCompleteSealedPayload, TaskFailSealedPayload, TaskDeclineSealedPayload, TaskCancelledSealedPayload, TaskProgressSealedPayload, TaskArtifactSealedPayload, TaskAwaitApprovalSealedPayload, AgentEgressReliablePayload, AgentEgressAckPayload, AgentMessagePublishPayload, AgentMessageDraftPayload, AgentMessageDispositionPayload, AgentContentReadPayload, AgentContentReceiptPayload, AgentHomeProjectionPayload, AgentMemoryIntentAvailablePayload, AgentInputPreparationPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, RuntimeFailureClass, TaskFailure, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, TerminalPreparedObservation, TerminalAgentHomeProjection, TerminalAgentHomeMemoryChange, AgentHomeAccess, AgentMemorySelection, } from './messages';
 export { EnvelopeSchema, isServerToDaemonType } from './envelope';
 export type { Envelope } from './envelope';
 export { ProtocolError, EnvelopeParseError, UnknownMessageTypeError, EnvelopeValidationError, } from './errors';
@@ -43,7 +43,7 @@ export type { TaskOfferType } from './messages';
 export type { HarnessId, HarnessInfo } from './messages';
 export { CUSTOM_HARNESS_CAPABILITY } from './version';
 export { PreparedAgentMemoryModeSchema, type PreparedAgentMemoryMode } from './input-preparation';
-export { E2EE_MEMBER_CHAIN_APPEND_MAX_ENTRIES, E2EE_MEMBER_CHAIN_APPEND_OPERATION, E2EE_MEMBER_CHAIN_ENTRY_MAX_BYTES, E2EE_MEMBER_CHAIN_OPS, E2EE_MEMBER_CHAIN_READ_MAX_ENTRIES, E2EE_MEMBER_KEY_REGISTER_OPERATION, E2EE_SCOPE_ID_MAX_LENGTH, E2EE_SCOPE_KEY_PACKAGE_PUT_MAX, E2EE_SCOPE_KEY_PACKAGE_PUT_OPERATION, E2eeClientPairingMacSchema, E2eeMemberChainEntrySchema, E2eeMemberKeyBundleSchema, E2eeMemberKeyRegisterRequestSchema, E2eeKeyPackageAvailablePayloadSchema, E2eePairingMacSchema, E2eeScopeKeyPackageSchema, } from './e2ee-member';
+export { E2EE_MEMBER_CHAIN_APPEND_MAX_ENTRIES, E2EE_MEMBER_CHAIN_APPEND_OPERATION, E2EE_MEMBER_CHAIN_ENTRY_MAX_BYTES, E2EE_MEMBER_CHAIN_OPS, E2EE_MEMBER_CHAIN_READ_MAX_ENTRIES, E2EE_MEMBER_KEY_REGISTER_OPERATION, E2EE_SCOPE_ID_MAX_LENGTH, E2EE_SCOPE_KEY_PACKAGE_PAGE_MAX, E2EE_SCOPE_KEY_PACKAGE_PUT_MAX, E2EE_SCOPE_KEY_PACKAGE_PUT_OPERATION, E2eeClientPairingMacSchema, E2eeMemberChainEntrySchema, E2eeMemberKeyBundleSchema, E2eeMemberKeyRegisterRequestSchema, E2eeKeyPackageAvailablePayloadSchema, E2eePairingMacSchema, E2eeScopeKeyPackageSchema, E2eeScopeKeyPackageV2Schema, } from './e2ee-member';
 export type { E2eeClientPairingMac, E2eeKeyPackageAvailablePayload, E2eeMemberChainEntry, E2eeMemberKeyBundle, E2eeMemberKeyRegisterRequest, E2eeScopeKeyPackage, } from './e2ee-member';
 export * from './bot-turn-outcome';
 export { resultOutcomeMaxBytes } from './result-schema';

package/dist/index.js

@@ -19,8 +19,26 @@ var AGENT_MEMORY_INTENT_CAPABILITY = "agent-memory-intent.v1";
 var AGENT_MEMORY_PROJECTION_CAPABILITY = "agent.memory.projection";
 var AGENT_MEMORY_SELECTION_CAPABILITY = "agent-memory-selection";
 var AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY = "agent-memory-read-if-admitted";
+var AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY = "agent-memory-read-write-if-admitted";
 var AGENT_INPUT_PREPARATION_CAPABILITY = `agent-input-preparation-v${INPUT_PREPARATION_WIRE_VERSION}`;
 var SEALED_PAYLOAD_CAPABILITY = "sealed-payload-v1";
+var SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY = "sealed-output-ciphertext-ref";
+var RUNTIME_FAILURE_CLASS_CAPABILITY = "runtime-failure-class";
+var RUNTIME_FAILURE_CLASSES = [
+  "auth",
+  "quota",
+  "rate_limited",
+  "billing",
+  "model_unavailable",
+  "input_too_large",
+  "invalid_request",
+  "overloaded",
+  "provider",
+  "runtime_exited",
+  "limit_reached",
+  "output_schema",
+  "unknown"
+];
 var PREPARED_AGENT_MEMORY_MODES = ["none", "read", "read-write"];
 function isPreparedAgentMemoryMode(value) {
   return typeof value === "string" && PREPARED_AGENT_MEMORY_MODES.some((mode) => mode === value);
@@ -62,8 +80,11 @@ var CAPABILITY_FLAGS = [
   AGENT_MEMORY_INTENT_CAPABILITY,
   AGENT_MEMORY_SELECTION_CAPABILITY,
   AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY,
+  AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY,
   "agent-message-draft",
-  SEALED_PAYLOAD_CAPABILITY
+  SEALED_PAYLOAD_CAPABILITY,
+  SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY,
+  RUNTIME_FAILURE_CLASS_CAPABILITY
 ];
 
 // src/task-state.ts
@@ -157,7 +178,8 @@ var SEALED_SPLIT_TABLE = Object.freeze({
     identity: ["seq"],
     moved: ["events"],
     forbidden: [],
-    digests: { "events[].spill.blob.contentHash": "sealed" }
+    digests: { "events[].spill.blob.contentHash": "sealed" },
+    inlineOnly: true
   },
   "task.artifact_sealed": {
     plainType: "task.artifact",
@@ -174,7 +196,8 @@ var SEALED_SPLIT_TABLE = Object.freeze({
     identity: ["approvalId"],
     moved: ["summary"],
     forbidden: [],
-    digests: {}
+    digests: {},
+    inlineOnly: true
   }
 });
 function isSealedMessageType(type) {
@@ -202,7 +225,9 @@ function sealedRows(plainRows) {
       if (row.field !== void 0 && dropped.includes(row.field.split(/[.[]/u)[0])) return [];
       return [{ ...row, surface }];
     });
-    return [{ kind: "envelope", rule: "gated", surface, capability: "sealed-payload-v1", advertisedBy }, ...inherited];
+    const entry = SEALED_SPLIT_TABLE[surface];
+    const byReference = advertisedBy === "server" && entry.inlineOnly !== true ? [{ kind: "envelope", rule: "gated", surface, field: "sealed.ciphertextRef", capability: "sealed-output-ciphertext-ref", advertisedBy }] : [];
+    return [{ kind: "envelope", rule: "gated", surface, capability: "sealed-payload-v1", advertisedBy }, ...inherited, ...byReference];
   });
 }
 var SEALED_DECLINE_CODE = (value) => ({ kind: "envelope", rule: "gated", surface: "task.decline", field: "code", value, capability: "sealed-payload-v1", advertisedBy: "server" });
@@ -214,12 +239,14 @@ var PLAIN_ROWS = [
   ...AGENT_OFFER_FIELDS("task.offer_for_agent"),
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent", field: "agentMemory", capability: "agent-memory-selection", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent", field: "agentMemory", value: "read-if-admitted", capability: "agent-memory-read-if-admitted", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent", field: "agentMemory", value: "read-write-if-admitted", capability: "agent-memory-read-write-if-admitted", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", capability: "agent-home-contract", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", capability: "agent-egress-policy", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", capability: "agent-egress-reliable-ack", advertisedBy: "device" },
   ...EGRESS_OFFER_FIELDS("task.offer_for_agent_with_egress"),
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", field: "agentMemory", capability: "agent-memory-selection", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", field: "agentMemory", value: "read-if-admitted", capability: "agent-memory-read-if-admitted", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress", field: "agentMemory", value: "read-write-if-admitted", capability: "agent-memory-read-write-if-admitted", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-home-contract", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-egress-policy", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", capability: "agent-egress-reliable-ack", advertisedBy: "device" },
@@ -227,6 +254,7 @@ var PLAIN_ROWS = [
   ...EGRESS_OFFER_FIELDS("task.offer_for_agent_with_egress_fresh"),
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", field: "agentMemory", capability: "agent-memory-selection", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", field: "agentMemory", value: "read-if-admitted", capability: "agent-memory-read-if-admitted", advertisedBy: "device" },
+  { kind: "envelope", rule: "gated", surface: "task.offer_for_agent_with_egress_fresh", field: "agentMemory", value: "read-write-if-admitted", capability: "agent-memory-read-write-if-admitted", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-home-contract", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-input-preparation-v9", advertisedBy: "device" },
   { kind: "envelope", rule: "gated", surface: "task.offer_prepared", capability: "agent-egress-policy", advertisedBy: "device" },
@@ -255,7 +283,8 @@ var PLAIN_ROWS = [
   { kind: "envelope", rule: "strip-safe", surface: "task.progress", field: "events[].mcp" },
   // Daemon to server.
   { kind: "envelope", rule: "gated", surface: "agent.message.draft", capability: "agent-message-draft", advertisedBy: "server" },
-  { kind: "envelope", rule: "gated", surface: "task.approval_resolved", capability: "approval_resolved", advertisedBy: "server" }
+  { kind: "envelope", rule: "gated", surface: "task.approval_resolved", capability: "approval_resolved", advertisedBy: "server" },
+  { kind: "envelope", rule: "gated", surface: "task.fail", field: "failure", capability: "runtime-failure-class", advertisedBy: "server" }
 ];
 var WIRE_ADDITIONS = Object.freeze([
   ...PLAIN_ROWS,
@@ -271,7 +300,10 @@ function requiredReceiverCapabilities(type, payload) {
   for (const entry of WIRE_ADDITIONS) {
     if (entry.kind !== "envelope" || entry.rule !== "gated" || entry.surface !== type) continue;
     if (entry.field !== void 0) {
-      const value = fields[entry.field];
+      const value = entry.field.split(".").reduce(
+        (parent, segment) => parent !== null && typeof parent === "object" ? parent[segment] : void 0,
+        fields
+      );
       if (value === void 0) continue;
       if (entry.value !== void 0 && value !== entry.value) continue;
     }
@@ -1446,6 +1478,7 @@ var E2EE_MEMBER_CHAIN_APPEND_MAX_ENTRIES = 64;
 var E2EE_MEMBER_CHAIN_ENTRY_MAX_BYTES = 65536;
 var E2EE_MEMBER_CHAIN_READ_MAX_ENTRIES = 256;
 var E2EE_SCOPE_KEY_PACKAGE_PUT_MAX = 256;
+var E2EE_SCOPE_KEY_PACKAGE_PAGE_MAX = 16;
 var E2EE_SCOPE_ID_MAX_LENGTH = 512;
 var E2EE_MEMBER_KEY_REGISTER_OPERATION = "e2ee-member-key.register";
 var E2EE_MEMBER_CHAIN_APPEND_OPERATION = "e2ee-member-chain.append";
@@ -1474,6 +1507,13 @@ var E2eeMemberKeyBundleSchema = z.strictObject({
   deviceId: z.string().min(1).optional()
 });
 var E2EE_MEMBER_CHAIN_OPS = ["add", "remove", "rotate", "scope-policy", "shred"];
+var E2eeScopeShredSubjectSchema = z.strictObject({ scopeId: z.string().min(1) });
+var E2eeMemberRotateSubjectSchema = z.strictObject({
+  memberId: MemberIdSchema,
+  kemPublicJwk: P256PublicJwkSchema,
+  kemEpoch: PositiveSafeIntegerSchema,
+  kemSig: SignatureSchema
+});
 var E2eeMemberChainEntrySchema = z.strictObject({
   v: z.literal(1),
   tenantId: z.string().min(1),
@@ -1488,8 +1528,14 @@ var E2eeMemberChainEntrySchema = z.strictObject({
 }).refine((entry) => entry.seq === 1 === (entry.prev === null), {
   path: ["prev"],
   message: "the first entry, and only the first, has no prev"
-});
-var E2eeScopeKeyPackageSchema = z.strictObject({
+}).refine((entry) => entry.op !== "shred" || E2eeScopeShredSubjectSchema.safeParse(entry.subject).success, {
+  path: ["subject"],
+  message: "a shred subject is exactly { scopeId }"
+}).refine((entry) => entry.op !== "rotate" || E2eeMemberRotateSubjectSchema.safeParse(entry.subject).success, {
+  path: ["subject"],
+  message: "a rotate subject is exactly { memberId, kemPublicJwk, kemEpoch, kemSig }"
+});
+var E2eeScopeKeyPackageV1Schema = z.strictObject({
   v: z.literal(1),
   tenantId: z.string().min(1),
   scopeId: z.string().min(1),
@@ -1501,6 +1547,12 @@ var E2eeScopeKeyPackageSchema = z.strictObject({
   ciphertext: base64UrlBytes(48),
   sig: SignatureSchema
 });
+var E2eeScopeKeyPackageV2Schema = z.strictObject({
+  ...E2eeScopeKeyPackageV1Schema.shape,
+  v: z.literal(2),
+  recipientKemEpoch: PositiveSafeIntegerSchema
+});
+var E2eeScopeKeyPackageSchema = z.union([E2eeScopeKeyPackageV1Schema, E2eeScopeKeyPackageV2Schema]);
 var E2eePairingMacSchema = base64UrlBytes(32);
 var E2eeMemberKeyRegisterRequestSchema = z.strictObject({
   member: E2eeMemberKeyBundleSchema.refine((member) => member.deviceId !== void 0, {
@@ -1644,7 +1696,11 @@ var TaskOfferWithToolsetsPayloadSchema = TaskOfferPayloadSchema.extend({
   requiredToolsets: RequiredToolsetsSchema
 }).strict();
 var AgentHomeAccessSchema = z.literal("memory-reader");
-var AgentMemorySelectionSchema = z.enum([...PreparedAgentMemoryModeSchema.options, "read-if-admitted"]);
+var AgentMemorySelectionSchema = z.enum([
+  ...PreparedAgentMemoryModeSchema.options,
+  "read-if-admitted",
+  "read-write-if-admitted"
+]);
 var TaskOfferForAgentPayloadSchema = z.object({
   ...NO_SEALED_MEMBER,
   instruction: z.union([z.string(), InstructionBlobRefSchema]),
@@ -1990,6 +2046,11 @@ var TaskCompletePayloadSchema = z.object({
   agentHomeProjection: TerminalAgentHomeProjectionSchema.optional(),
   agentHomeMemoryChange: TerminalAgentHomeMemoryChangeSchema.optional()
 });
+var RuntimeFailureClassSchema = z.enum(RUNTIME_FAILURE_CLASSES);
+var TaskFailureSchema = z.union([
+  z.object({ class: z.literal("quota"), resetsAt: z.iso.datetime().optional() }).strict(),
+  z.object({ class: RuntimeFailureClassSchema.exclude(["quota"]) }).strict()
+]);
 var TaskFailPayloadSchema = z.object({
   ...NO_SEALED_MEMBER,
   /** Local interruption observation bound to the immutable offer; does not assert a cloud claim. */
@@ -1997,6 +2058,8 @@ var TaskFailPayloadSchema = z.object({
   harnessId: HarnessIdSchema.optional(),
   reason: z.string(),
   retryable: z.boolean().optional(),
+  /** Gated on the server's `runtime-failure-class` flag. Plaintext on `task.fail_sealed`. */
+  failure: TaskFailureSchema.optional(),
   usage: TerminalInferenceUsageSchema.optional(),
   /** Present on a prepared Execution that observed provider usage before failing. */
   preparedObservation: TerminalPreparedObservationSchema.optional(),
@@ -2991,6 +3054,6 @@ function composeBotTurnOutcomeSchema(fragments, required = []) {
   return admitted.canonical;
 }
 
-export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EVENT_SPILL_UNSTORED_REASON_MAX_LENGTH, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_HOME_PROJECTION_MAX_BYTES, AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM, AGENT_HOME_READERS_CAPABILITY, AGENT_INPUT_PREPARATION_CAPABILITY, AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES, AGENT_MEMORY_INTENT_CAPABILITY, AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS_BY_RESERVATION, AGENT_MEMORY_INTENT_HOST_TERMINAL_CODES, AGENT_MEMORY_INTENT_OPERATIONS, AGENT_MEMORY_INTENT_PATH_MAX_BYTES, AGENT_MEMORY_INTENT_READBACK_DISPOSITIONS, AGENT_MEMORY_INTENT_REJECTION_CODES, AGENT_MEMORY_INTENT_RESERVATIONS, AGENT_MEMORY_MAX_SNAPSHOT_BYTES, AGENT_MEMORY_MAX_SNAPSHOT_FILES, AGENT_MEMORY_PROJECTION_CAPABILITY, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY, AGENT_MEMORY_SELECTION_CAPABILITY, AGENT_MESSAGE_DRAFT_FRAME_MAX_BYTES, AGENT_MESSAGE_EGRESS_CAPABILITY, AGENT_MESSAGE_MAX_BYTES, AGENT_REF_MAX_BYTES, ActivityIngressSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentContentReadPayloadSchema, AgentContentReadSurfaceSchema, AgentContentReceiptPayloadSchema, AgentEgressAckPayloadSchema, AgentEgressActivityPolicySchema, AgentEgressContentHashSchema, AgentEgressDropReasonSchema, AgentEgressLaneSchema, AgentEgressPolicyRevisionSchema, AgentEgressPolicySchema, AgentEgressReliablePayloadSchema, AgentEventOrUnknownSchema, AgentEventSchema, AgentEventSpillSchema, AgentHomeAccessSchema, AgentHomeProjectionAgentRefSchema, AgentHomeProjectionCompletionRequestSchema, AgentHomeProjectionHashSchema, AgentHomeProjectionOutcomeSchema, AgentHomeProjectionPayloadSchema, AgentHomeProjectionProfileRevisionSchema, AgentHomeProjectionReadbackSchema, AgentHomeProjectionStatusSchema, AgentHomeProjectionValueSchema, AgentInputPreparationPayloadSchema, AgentMemoryIntentApprovalRefSchema, AgentMemoryIntentAvailablePayloadSchema, AgentMemoryIntentCompletionSchema, AgentMemoryIntentContentSchema, AgentMemoryIntentFetchRequestSchema, AgentMemoryIntentFetchResponseSchema, AgentMemoryIntentFileObservationSchema, AgentMemoryIntentHostTerminalCodeSchema, AgentMemoryIntentOperationDigestSchema, AgentMemoryIntentOperationSchema, AgentMemoryIntentPathSchema, AgentMemoryIntentReadbackDispositionSchema, AgentMemoryIntentReadbackSchema, AgentMemoryIntentRejectionCodeSchema, AgentMemoryIntentReservationSchema, AgentMemoryIntentRevisionSchema, AgentMemoryIntentV1Schema, AgentMemoryProjectionCommitRequestSchema, AgentMemoryProjectionCommitResponseSchema, AgentMemoryProjectionEraseResultSchema, AgentMemoryProjectionGrantRefSchema, AgentMemoryProjectionMeteringReceiptSchema, AgentMemoryProjectionMutationSchema, AgentMemoryProjectionReceiptSchema, AgentMemoryProjectionSessionRefSchema, AgentMemoryProjectionSnapshotSchema, AgentMemoryProjectionSourceSeqSchema, AgentMemoryProjectionWriterEpochSchema, AgentMemorySelectionSchema, AgentMessageContentTypeSchema, AgentMessageContractSchema, AgentMessageDestinationBindingSchema, AgentMessageDispositionPayloadSchema, AgentMessageDraftPayloadSchema, AgentMessageEgressRequirementSchema, AgentMessageFreshnessCursorSchema, AgentMessagePublishPayloadSchema, AgentMessageServerContextSchema, AgentRefSchema, AgentReliableQuotaPolicySchema, BOT_TURN_OUTCOME_CONTRACT, BOT_TURN_OUTCOME_LIMITS, BYOK_ACTIVITY_PATH, BYOK_AGENT_HOME_PROJECTIONS_PATH, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, BYOK_AGENT_MEMORY_PROJECTIONS_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_E2EE_CHAIN_PATH, BYOK_E2EE_KEY_PACKAGES_PATH, BYOK_E2EE_MEMBER_KEY_PATH, BYOK_E2EE_PAIRING_MAC_PATH, BYOK_EVENTS_PATH, BYOK_INPUT_PREPARATIONS_PATH, BYOK_INPUT_PREPARATION_COMPLETION_ROUTE, BYOK_INPUT_PREPARATION_STATUS_ROUTE, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, BotTurnOutcomeSchemaError, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, CUSTOM_HARNESS_CAPABILITY, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, ContentReadPolicySchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, E2EE_MEMBER_CHAIN_APPEND_MAX_ENTRIES, E2EE_MEMBER_CHAIN_APPEND_OPERATION, E2EE_MEMBER_CHAIN_ENTRY_MAX_BYTES, E2EE_MEMBER_CHAIN_OPS, E2EE_MEMBER_CHAIN_READ_MAX_ENTRIES, E2EE_MEMBER_KEY_REGISTER_OPERATION, E2EE_SCOPE_ID_MAX_LENGTH, E2EE_SCOPE_KEY_PACKAGE_PUT_MAX, E2EE_SCOPE_KEY_PACKAGE_PUT_OPERATION, E2eeClientPairingMacSchema, E2eeKeyPackageAvailablePayloadSchema, E2eeMemberChainEntrySchema, E2eeMemberKeyBundleSchema, E2eeMemberKeyRegisterRequestSchema, E2eePairingMacSchema, E2eeScopeKeyPackageSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, HOST_MCP_TASK_CONTEXT_CAPABILITY, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, INPUT_PREPARATION_WIRE_VERSION, InputPreparationAccountingPolicyRefSchema, InputPreparationArtifactSummarySchema, InputPreparationBindingSchema, InputPreparationCompletionRequestSchema, InputPreparationContentHashSchema, InputPreparationContextDocumentSchema, InputPreparationCounterEvidenceSchema, InputPreparationCounterProviderEvidenceSchema, InputPreparationCounterTargetSchema, InputPreparationHostCanonicalAssistantMessageSchema, InputPreparationMessageSchema, InputPreparationModelCostSchema, InputPreparationModelSchema, InputPreparationOfferBindingSchema, InputPreparationOptionsSchema, InputPreparationPolicyRevisionSchema, InputPreparationProfileIdSchema, InputPreparationProjectionSchema, InputPreparationPromptSnapshotSchema, InputPreparationReadbackSchema, InputPreparationReadinessReasonSchema, InputPreparationReceiptSummarySchema, InputPreparationReferenceSchema, InputPreparationRejectionReasonSchema, InputPreparationResidualKeySchema, InputPreparationResidualValueClassSchema, InputPreparationRuntimeIdentitySchema, InputPreparationSelectionSchema, InputPreparationSourceSchema, InputPreparationStateSchema, InputPreparationStatusQuerySchema, InputPreparationStatusSchema, InputPreparationUserMessageSchema, KNOWN_AGENT_EVENT_TYPES, MAILBOX_READ_AHEAD_CAPABILITY, MAILBOX_READ_AHEAD_MAX_SEQS, MAX_MESSAGES_PER_BATCH, MESSAGES_SEND_MAX_BODY_BYTES, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessageSendOutcomeSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, OUTBOUND_REFUSAL_REASONS, PAIR_RESPONSE_TENANT_ID_MAX_LENGTH, PREPARED_AGENT_MEMORY_MODES, PROTOCOL_VERSION, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_BINDING_CAPABILITY, PROVIDER_PROVISIONING_CAPABILITY, PROVIDER_PROVISIONING_DISPOSITIONS, PROVIDER_PROVISIONING_HOST_TERMINAL_CODES, PROVIDER_PROVISIONING_KEY_CHECK_RESULTS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM, PROVIDER_PROVISIONING_REJECTION_CODES, PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION, PairRequestSchema, PairResponseSchema, PairResponseTenantIdSchema, PreparedAgentMemoryModeSchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, ProviderModelCapabilitySchema, ProviderProfileBindingSchema, ProviderProfileHashSchema, ProviderProfileRefSchema, ProviderProfileRevisionSchema, ProviderProvisioningAvailablePayloadSchema, ProviderProvisioningCompletionSchema, ProviderProvisioningDispositionSchema, ProviderProvisioningKeyCheckResultSchema, ProviderProvisioningKeyCheckSchema, ProviderProvisioningOperationDigestSchema, ProviderProvisioningOperationGenerationSchema, ProviderProvisioningOperationSchema, ProviderProvisioningProviderStatusSchema, ProviderProvisioningReadbackSchema, ProviderProvisioningRejectionCodeSchema, RESULT_DOCUMENT_MAX_BYTES, RESULT_ISSUES_MAX_BYTES, RESULT_ISSUES_MAX_COUNT, RESULT_JSON_MAX_DEPTH, RESULT_OUTCOME_MAX_BYTES, RESULT_SCHEMA_INSTANCE_TYPES, RESULT_SCHEMA_KEYWORDS, RESULT_SCHEMA_MAX_BYTES, RESULT_SCHEMA_MAX_DEPTH, ROUTINE_DAYS_OF_WEEK, RUNTIME_IDS, RequiredToolsetsSchema, ResultDocumentSchemaSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SEALED_DECLINE_CODES, SEALED_INLINE_MAX_PADDED_LENGTH, SEALED_PAYLOAD_CAPABILITY, SEALED_PAYLOAD_CATEGORIES, SEALED_PAYLOAD_MAX_CONTENT_LENGTH, SEALED_PAYLOAD_MAX_PADDED_LENGTH, SEALED_PAYLOAD_SUITE, SEALED_PAYLOAD_V1_CATEGORIES, SEALED_PAYLOAD_VERSION, SEALED_SPLIT_TABLE, SEALED_TASK_PLAIN_CODES, SERVER_TO_DAEMON_TYPES, STRICT_AGENT_ONLY_CAPABILITY, SealedPayloadSchema, SealedTaskInputSchema, SealedTaskOutputSchema, TASK_OFFER_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_PROJECTION_SELECTION_CAPABILITY, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferPayloadSchema, TaskOfferPreparedPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskSealingSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalAgentHomeMemoryChangeSchema, TerminalAgentHomeProjectionSchema, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalProjectionContractSchema, TerminalProjectionSelectionSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, WIRE_ADDITIONS, agentMemoryIntentFetchResponseSchemaFor, agentMemoryProjectionBase64UrlByteLength, botTurnOutcomeFragments, byokAgentHomeProjectionCompletionPath, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokInputPreparationCompletionPath, byokInputPreparationStatusPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, checkResultSchema, composeBotTurnOutcomeSchema, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isPreparedAgentMemoryMode, isSealedMessageType, isSealedTaskPlainOutput, isServerToDaemonType, isTaskOfferType, parseMessage, partitionAgentEvents, requiredReceiverCapabilities, resultOutcomeMaxBytes, sealedBase64UrlByteLength, sealedPayloadPaddedLength, validateResultOutcome };
+export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_FRESH_SESSION_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_EVENT_SPILL_UNSTORED_REASON_MAX_LENGTH, AGENT_HOME_MEMORY_DIGEST_MAX_BYTES, AGENT_HOME_MEMORY_DIGEST_MAX_FILES, AGENT_HOME_MEMORY_PATH_MAX_LENGTH, AGENT_HOME_PROJECTION_CAPABILITY, AGENT_HOME_PROJECTION_MAX_BYTES, AGENT_HOME_PROJECTION_PROFILE_REVISION_MAXIMUM, AGENT_HOME_READERS_CAPABILITY, AGENT_INPUT_PREPARATION_CAPABILITY, AGENT_MEMORY_INTENT_APPROVAL_REF_MAX_BYTES, AGENT_MEMORY_INTENT_CAPABILITY, AGENT_MEMORY_INTENT_CONTENT_MAX_BYTES, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS, AGENT_MEMORY_INTENT_FETCH_DISPOSITIONS_BY_RESERVATION, AGENT_MEMORY_INTENT_HOST_TERMINAL_CODES, AGENT_MEMORY_INTENT_OPERATIONS, AGENT_MEMORY_INTENT_PATH_MAX_BYTES, AGENT_MEMORY_INTENT_READBACK_DISPOSITIONS, AGENT_MEMORY_INTENT_REJECTION_CODES, AGENT_MEMORY_INTENT_RESERVATIONS, AGENT_MEMORY_MAX_SNAPSHOT_BYTES, AGENT_MEMORY_MAX_SNAPSHOT_FILES, AGENT_MEMORY_PROJECTION_CAPABILITY, AGENT_MEMORY_PROJECTION_MAX_ORDERING_VALUE, AGENT_MEMORY_PROJECTION_MAX_REDACTED_BYTES, AGENT_MEMORY_READ_IF_ADMITTED_CAPABILITY, AGENT_MEMORY_READ_WRITE_IF_ADMITTED_CAPABILITY, AGENT_MEMORY_SELECTION_CAPABILITY, AGENT_MESSAGE_DRAFT_FRAME_MAX_BYTES, AGENT_MESSAGE_EGRESS_CAPABILITY, AGENT_MESSAGE_MAX_BYTES, AGENT_REF_MAX_BYTES, ActivityIngressSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentContentReadPayloadSchema, AgentContentReadSurfaceSchema, AgentContentReceiptPayloadSchema, AgentEgressAckPayloadSchema, AgentEgressActivityPolicySchema, AgentEgressContentHashSchema, AgentEgressDropReasonSchema, AgentEgressLaneSchema, AgentEgressPolicyRevisionSchema, AgentEgressPolicySchema, AgentEgressReliablePayloadSchema, AgentEventOrUnknownSchema, AgentEventSchema, AgentEventSpillSchema, AgentHomeAccessSchema, AgentHomeProjectionAgentRefSchema, AgentHomeProjectionCompletionRequestSchema, AgentHomeProjectionHashSchema, AgentHomeProjectionOutcomeSchema, AgentHomeProjectionPayloadSchema, AgentHomeProjectionProfileRevisionSchema, AgentHomeProjectionReadbackSchema, AgentHomeProjectionStatusSchema, AgentHomeProjectionValueSchema, AgentInputPreparationPayloadSchema, AgentMemoryIntentApprovalRefSchema, AgentMemoryIntentAvailablePayloadSchema, AgentMemoryIntentCompletionSchema, AgentMemoryIntentContentSchema, AgentMemoryIntentFetchRequestSchema, AgentMemoryIntentFetchResponseSchema, AgentMemoryIntentFileObservationSchema, AgentMemoryIntentHostTerminalCodeSchema, AgentMemoryIntentOperationDigestSchema, AgentMemoryIntentOperationSchema, AgentMemoryIntentPathSchema, AgentMemoryIntentReadbackDispositionSchema, AgentMemoryIntentReadbackSchema, AgentMemoryIntentRejectionCodeSchema, AgentMemoryIntentReservationSchema, AgentMemoryIntentRevisionSchema, AgentMemoryIntentV1Schema, AgentMemoryProjectionCommitRequestSchema, AgentMemoryProjectionCommitResponseSchema, AgentMemoryProjectionEraseResultSchema, AgentMemoryProjectionGrantRefSchema, AgentMemoryProjectionMeteringReceiptSchema, AgentMemoryProjectionMutationSchema, AgentMemoryProjectionReceiptSchema, AgentMemoryProjectionSessionRefSchema, AgentMemoryProjectionSnapshotSchema, AgentMemoryProjectionSourceSeqSchema, AgentMemoryProjectionWriterEpochSchema, AgentMemorySelectionSchema, AgentMessageContentTypeSchema, AgentMessageContractSchema, AgentMessageDestinationBindingSchema, AgentMessageDispositionPayloadSchema, AgentMessageDraftPayloadSchema, AgentMessageEgressRequirementSchema, AgentMessageFreshnessCursorSchema, AgentMessagePublishPayloadSchema, AgentMessageServerContextSchema, AgentRefSchema, AgentReliableQuotaPolicySchema, BOT_TURN_OUTCOME_CONTRACT, BOT_TURN_OUTCOME_LIMITS, BYOK_ACTIVITY_PATH, BYOK_AGENT_HOME_PROJECTIONS_PATH, BYOK_AGENT_HOME_PROJECTION_COMPLETION_ROUTE, BYOK_AGENT_MEMORY_PROJECTIONS_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_E2EE_CHAIN_PATH, BYOK_E2EE_KEY_PACKAGES_PATH, BYOK_E2EE_MEMBER_KEY_PATH, BYOK_E2EE_PAIRING_MAC_PATH, BYOK_EVENTS_PATH, BYOK_INPUT_PREPARATIONS_PATH, BYOK_INPUT_PREPARATION_COMPLETION_ROUTE, BYOK_INPUT_PREPARATION_STATUS_ROUTE, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, BotTurnOutcomeSchemaError, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, CUSTOM_HARNESS_CAPABILITY, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, ContentReadPolicySchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, E2EE_MEMBER_CHAIN_APPEND_MAX_ENTRIES, E2EE_MEMBER_CHAIN_APPEND_OPERATION, E2EE_MEMBER_CHAIN_ENTRY_MAX_BYTES, E2EE_MEMBER_CHAIN_OPS, E2EE_MEMBER_CHAIN_READ_MAX_ENTRIES, E2EE_MEMBER_KEY_REGISTER_OPERATION, E2EE_SCOPE_ID_MAX_LENGTH, E2EE_SCOPE_KEY_PACKAGE_PAGE_MAX, E2EE_SCOPE_KEY_PACKAGE_PUT_MAX, E2EE_SCOPE_KEY_PACKAGE_PUT_OPERATION, E2eeClientPairingMacSchema, E2eeKeyPackageAvailablePayloadSchema, E2eeMemberChainEntrySchema, E2eeMemberKeyBundleSchema, E2eeMemberKeyRegisterRequestSchema, E2eePairingMacSchema, E2eeScopeKeyPackageSchema, E2eeScopeKeyPackageV2Schema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, HOST_MCP_TASK_CONTEXT_CAPABILITY, HarnessIdSchema, HarnessInfoSchema, HarnessInventorySchema, INPUT_PREPARATION_WIRE_VERSION, InputPreparationAccountingPolicyRefSchema, InputPreparationArtifactSummarySchema, InputPreparationBindingSchema, InputPreparationCompletionRequestSchema, InputPreparationContentHashSchema, InputPreparationContextDocumentSchema, InputPreparationCounterEvidenceSchema, InputPreparationCounterProviderEvidenceSchema, InputPreparationCounterTargetSchema, InputPreparationHostCanonicalAssistantMessageSchema, InputPreparationMessageSchema, InputPreparationModelCostSchema, InputPreparationModelSchema, InputPreparationOfferBindingSchema, InputPreparationOptionsSchema, InputPreparationPolicyRevisionSchema, InputPreparationProfileIdSchema, InputPreparationProjectionSchema, InputPreparationPromptSnapshotSchema, InputPreparationReadbackSchema, InputPreparationReadinessReasonSchema, InputPreparationReceiptSummarySchema, InputPreparationReferenceSchema, InputPreparationRejectionReasonSchema, InputPreparationResidualKeySchema, InputPreparationResidualValueClassSchema, InputPreparationRuntimeIdentitySchema, InputPreparationSelectionSchema, InputPreparationSourceSchema, InputPreparationStateSchema, InputPreparationStatusQuerySchema, InputPreparationStatusSchema, InputPreparationUserMessageSchema, KNOWN_AGENT_EVENT_TYPES, MAILBOX_READ_AHEAD_CAPABILITY, MAILBOX_READ_AHEAD_MAX_SEQS, MAX_MESSAGES_PER_BATCH, MESSAGES_SEND_MAX_BODY_BYTES, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessageSendOutcomeSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, OUTBOUND_REFUSAL_REASONS, PAIR_RESPONSE_TENANT_ID_MAX_LENGTH, PREPARED_AGENT_MEMORY_MODES, PROTOCOL_VERSION, PROVIDER_MODEL_CAPABILITIES, PROVIDER_PROFILE_BINDING_CAPABILITY, PROVIDER_PROVISIONING_CAPABILITY, PROVIDER_PROVISIONING_DISPOSITIONS, PROVIDER_PROVISIONING_HOST_TERMINAL_CODES, PROVIDER_PROVISIONING_KEY_CHECK_RESULTS, PROVIDER_PROVISIONING_OPERATIONS, PROVIDER_PROVISIONING_OPERATION_GENERATION_MAXIMUM, PROVIDER_PROVISIONING_REJECTION_CODES, PROVIDER_SECRET_SEALING_KEY_REGISTER_OPERATION, PairRequestSchema, PairResponseSchema, PairResponseTenantIdSchema, PreparedAgentMemoryModeSchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, ProviderModelCapabilitySchema, ProviderProfileBindingSchema, ProviderProfileHashSchema, ProviderProfileRefSchema, ProviderProfileRevisionSchema, ProviderProvisioningAvailablePayloadSchema, ProviderProvisioningCompletionSchema, ProviderProvisioningDispositionSchema, ProviderProvisioningKeyCheckResultSchema, ProviderProvisioningKeyCheckSchema, ProviderProvisioningOperationDigestSchema, ProviderProvisioningOperationGenerationSchema, ProviderProvisioningOperationSchema, ProviderProvisioningProviderStatusSchema, ProviderProvisioningReadbackSchema, ProviderProvisioningRejectionCodeSchema, RESULT_DOCUMENT_MAX_BYTES, RESULT_ISSUES_MAX_BYTES, RESULT_ISSUES_MAX_COUNT, RESULT_JSON_MAX_DEPTH, RESULT_OUTCOME_MAX_BYTES, RESULT_SCHEMA_INSTANCE_TYPES, RESULT_SCHEMA_KEYWORDS, RESULT_SCHEMA_MAX_BYTES, RESULT_SCHEMA_MAX_DEPTH, ROUTINE_DAYS_OF_WEEK, RUNTIME_FAILURE_CLASSES, RUNTIME_FAILURE_CLASS_CAPABILITY, RUNTIME_IDS, RequiredToolsetsSchema, ResultDocumentSchemaSchema, RuntimeCapabilitiesSchema, RuntimeFailureClassSchema, RuntimeIdSchema, RuntimeInfoSchema, SEALED_DECLINE_CODES, SEALED_INLINE_MAX_PADDED_LENGTH, SEALED_OUTPUT_CIPHERTEXT_REF_CAPABILITY, SEALED_PAYLOAD_CAPABILITY, SEALED_PAYLOAD_CATEGORIES, SEALED_PAYLOAD_MAX_CONTENT_LENGTH, SEALED_PAYLOAD_MAX_PADDED_LENGTH, SEALED_PAYLOAD_SUITE, SEALED_PAYLOAD_V1_CATEGORIES, SEALED_PAYLOAD_VERSION, SEALED_SPLIT_TABLE, SEALED_TASK_PLAIN_CODES, SERVER_TO_DAEMON_TYPES, STRICT_AGENT_ONLY_CAPABILITY, SealedPayloadSchema, SealedTaskInputSchema, SealedTaskOutputSchema, TASK_OFFER_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_PROJECTION_SELECTION_CAPABILITY, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskFailureSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressFreshPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferPayloadSchema, TaskOfferPreparedPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskSealingSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalAgentHomeMemoryChangeSchema, TerminalAgentHomeProjectionSchema, TerminalInferenceUsageSchema, TerminalPreparedObservationSchema, TerminalProjectionContractSchema, TerminalProjectionSelectionSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, WIRE_ADDITIONS, agentMemoryIntentFetchResponseSchemaFor, agentMemoryProjectionBase64UrlByteLength, botTurnOutcomeFragments, byokAgentHomeProjectionCompletionPath, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokInputPreparationCompletionPath, byokInputPreparationStatusPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, checkResultSchema, composeBotTurnOutcomeSchema, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isPreparedAgentMemoryMode, isSealedMessageType, isSealedTaskPlainOutput, isServerToDaemonType, isTaskOfferType, parseMessage, partitionAgentEvents, requiredReceiverCapabilities, resultOutcomeMaxBytes, sealedBase64UrlByteLength, sealedPayloadPaddedLength, validateResultOutcome };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map