@byok-sdk/protocol 0.30.2 → 0.32.0

package/dist/open-vocabulary.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+/** Any well-formed open-vocabulary token, without a membership rule. */
+export declare function openVocabularyToken(): z.ZodString;
+/** A well-formed token that is none of `known`: the raw value a receiver keeps as `reported<Field>`. */
+export declare function unrecognizedToken(known: readonly string[]): z.ZodString;

package/dist/sealed-payload.d.ts

@@ -1,11 +1,13 @@
 /**
  * Sealed payload v1 on the hosted wire (#654 design §8.1, §8.3, §8.6).
  *
- * Each sealed message type (`task.complete_sealed`, …) is its plaintext type
- * without the fields one data category moves into the ciphertext, plus a
- * sealed member. The type, not a field, is gated, so a decoder that does not
- * know `sealed-payload-v1` refuses the whole message. The Host reads only the
- * sealed member's outer fields. It checks the shape here:
+ * Sealed is a property of the payload, not a message type: each sealable
+ * type's payload is a plaintext branch or a sealed branch. The sealed branch is
+ * the plaintext fields without the ones one data category moves into the
+ * ciphertext, plus a sealed member; its marker field is gated on
+ * `sealed-payload-v1`, and the payload is strict, so a decoder that does not
+ * know the branch refuses the whole message. The Host reads only the sealed
+ * member's outer fields. It checks the shape here:
  * version, suite, encodings, a legal padded length, and exactly one of inline
  * `ciphertext` and `ciphertextRef`. Inline is the only legal form up to
  * {@link SEALED_INLINE_MAX_PADDED_LENGTH}; above it, the ciphertext is a blob.
@@ -17,8 +19,8 @@
  * length function; a cross-package test keeps the two equal.
  */
 import { z } from 'zod';
-export { SEALED_SPLIT_TABLE, isSealedMessageType } from './sealed-split-table';
-export type { SealedDigestRule, SealedMessageType, SealedSplitEntry } from './sealed-split-table';
+export { SEALED_SPLIT_TABLE, isSealableMessageType, isSealedPayload } from './sealed-split-table';
+export type { SealableMessageType, SealedDigestRule, SealedSplitEntry } from './sealed-split-table';
 export declare const SEALED_PAYLOAD_VERSION = 1;
 /** The only suite v1 admits. A new suite is a new constant and a new capability, never a parser branch. */
 export declare const SEALED_PAYLOAD_SUITE = "byok-sealed-v1.hkdf-sha256.aes-256-gcm";
@@ -41,10 +43,10 @@ export declare const SEALED_DECLINE_CODES: readonly ['sealed_key_unavailable', '
 export type SealedDeclineCode = (typeof SEALED_DECLINE_CODES)[number];
 /**
  * The closed plaintext codes of a task whose output is sealed (#654 12d).
- * It lists each plaintext output type that has a plaintext form on such a
- * task, with the codes that each field moved or dropped by its sealed type
- * may hold. Such a field that is not listed here must be absent. An output
- * type with a sealed form that is not listed has no plaintext form. An
+ * It lists each output type that has a plaintext form on such a task, with
+ * the codes that each field moved or dropped by its sealed branch may hold.
+ * Such a field that is not listed here must be absent. An output type with a
+ * sealed branch that is not listed has no plaintext form. An
  * interrupted task reports `daemon_interrupted`; a device that cannot seal
  * reports `sealed_key_unavailable`. The Host check, the daemon and the member
  * display read this one list, and compare by exact match.
@@ -62,11 +64,11 @@ export declare const SEALED_TASK_PLAIN_CODES: Readonly<{
 }>;
 /**
  * True when `payload` is a legal plaintext `type` message of a task whose
- * output is sealed: each field that a `task-output` sealed type of `type`
+ * output is sealed: each field that the `task-output` sealed branch of `type`
  * moves or drops is absent or holds one of {@link SEALED_TASK_PLAIN_CODES}.
- * A type that has a sealed output form and is not listed there is never
+ * A type that has a sealed output branch and is not listed there is never
  * legal. A plaintext decline also names its code as `code`. A type with no
- * sealed output form is always legal.
+ * sealed output branch is always legal.
  */
 export declare function isSealedTaskPlainOutput(type: string, payload: object): boolean;
 /** Padded frames above this length travel as a ciphertext blob (§8.6). */

package/dist/sealed-split-table.d.ts

@@ -1,49 +1,41 @@
-/**
- * The split table of sealed payload v1 (#654 design §8.1, §9.3): for each
- * sealed message type, its plaintext type, its data category, its identity
- * fields, the fields that move into the ciphertext, the fields it drops, and
- * the rule of each digest field (D16).
- *
- * Plain data with no runtime imports, so `wire-additions.ts` can derive the
- * sealed gates from it and stay free of zod.
- */
-import type { MessageType } from './messages';
 import type { SealedPayloadV1Category } from './sealed-payload';
 /**
- * How a sealed message type treats one digest field of its plaintext type
- * (D16, design §9.3).
+ * How the sealed branch of a type treats one digest field of its plaintext
+ * branch (D16, design §9.3).
  *
  * - `ciphertext-sha256`: the SHA-256 of the sealed bytes, for a Host that
  *   checks the bytes it stores (a ciphertext blob).
  * - `keyed-mac`: a keyed MAC under the scope's MAC key; the Host forwards it.
  * - `sealed`: the field moves into the ciphertext with its parent.
  * - `plain`: a digest that no sealed content derives, kept in plaintext.
- * - `forbidden`: the sealed type does not carry it in v1.
+ * - `forbidden`: the sealed branch does not carry it in v1.
  */
 export type SealedDigestRule = 'ciphertext-sha256' | 'keyed-mac' | 'sealed' | 'plain' | 'forbidden';
-/** One sealed message type in the split table. */
+/** One sealable message type in the split table. */
 export interface SealedSplitEntry {
     /**
-     * The plaintext message type this type seals. The AAD and the content MAC
-     * bind it as the family, not the sealed wire type.
+     * The payload field whose presence marks the sealed branch: `sealing` (the
+     * task's sealing policy) on `task.offer`, whose task may seal only its
+     * output and so carry no `sealed` member; `sealed` everywhere else. The AAD
+     * and the content MAC bind the wire type as the family.
      */
-    readonly plainType: MessageType;
+    readonly marker: 'sealing' | 'sealed';
     readonly category: SealedPayloadV1Category;
     /**
      * Payload fields that, after the envelope `task_id`, name this write in the
-     * AAD and the content MAC (§8.2, §9.1). The sealed type requires them.
+     * AAD and the content MAC (§8.2, §9.1). The sealed branch requires them.
      */
     readonly identity: readonly string[];
     /**
-     * Top-level fields of the plaintext type that move into the ciphertext.
-     * The sealed type does not have them; the receiver merges the opened
-     * object back and validates the plaintext type.
+     * Top-level fields of the plaintext branch that move into the ciphertext.
+     * The sealed branch does not have them; the receiver merges the opened
+     * object back and validates the plaintext branch.
      */
     readonly moved: readonly string[];
-    /** Top-level fields of the plaintext type that the sealed type drops in v1. */
+    /** Top-level fields of the plaintext branch that the sealed branch drops in v1. */
     readonly forbidden: readonly string[];
     /**
-     * Every path of the plaintext type whose name contains `digest`, `hash` or
+     * Every path of the plaintext branch whose name contains `digest`, `hash` or
      * `revision` (case-insensitive), with its rule. A schema test keeps this
      * complete.
      */
@@ -51,7 +43,7 @@ export interface SealedSplitEntry {
         readonly [path: string]: SealedDigestRule;
     };
     /**
-     * UTF-8 byte limits of moved fields that replace the plaintext type's limit
+     * UTF-8 byte limits of moved fields that replace the plaintext branch's limit
      * of that field after the merge (decision 12b). The category limit still
      * bounds the whole opened content.
      */
@@ -66,36 +58,47 @@ export interface SealedSplitEntry {
     readonly inlineOnly?: true;
 }
 /**
- * The split table (design §8.3): each sealed message type, the plaintext type
- * it seals, its category, identity, moved and forbidden fields, and the rule
- * of each digest field. It is the one authority; the schemas, the Host's
- * comparison projection and the receiver's merge read it.
+ * The split table (design §8.3): each sealable message type, the marker of its
+ * sealed branch, its category, identity, moved and forbidden fields, and the
+ * rule of each digest field. It is the one authority; the schemas, the gates,
+ * the Host's comparison projection and the receiver's merge read it.
  *
- * A sealed offer also carries the task's `sealing`. When the categories
- * include `task-input`, `instruction` is sealed; otherwise it stays plaintext
- * and only the task output is sealed.
+ * A sealed offer carries the task's `sealing`. When the categories include
+ * `task-input`, `instruction` is sealed; otherwise it stays plaintext and only
+ * the task output is sealed. A prepared Execution is never sealed.
  *
- * Blob bytes have no sealing rule yet, so a sealed type carries no plaintext
+ * Blob bytes have no sealing rule yet, so a sealed branch carries no plaintext
  * blob reference: `artifactRefs` and the artifact `blobRef` are dropped until
  * that rule exists. A sealed artifact is inline content, so its `inline`
  * takes up to 2 MiB instead of the plaintext 64 KB (decision 12b).
  */
 export declare const SEALED_SPLIT_TABLE: Readonly<{
-    readonly 'task.offer_sealed': SealedSplitEntry;
-    readonly 'task.offer_with_toolsets_sealed': SealedSplitEntry;
-    readonly 'task.offer_for_agent_sealed': SealedSplitEntry;
-    readonly 'task.offer_for_agent_with_egress_sealed': SealedSplitEntry;
-    readonly 'task.offer_for_agent_with_egress_fresh_sealed': SealedSplitEntry;
-    readonly 'task.steer_sealed': {
-        readonly plainType: 'task.steer';
+    readonly 'task.offer': {
+        readonly marker: 'sealing';
+        readonly category: 'task-input';
+        readonly identity: readonly [];
+        readonly moved: readonly ["instruction"];
+        readonly forbidden: readonly ["preparation"];
+        readonly digests: {
+            readonly 'instruction.blobRef.contentHash': 'sealed';
+            readonly 'agentRef.profileRevision': 'plain';
+            readonly 'dispatchSelection.providerProfile.profileRevision': 'plain';
+            readonly 'dispatchSelection.providerProfile.profileHash': 'plain';
+            readonly 'egressPolicy.policyRevision': 'plain';
+            readonly 'preparation.requestDigest': 'forbidden';
+            readonly 'preparation.artifactDigest': 'forbidden';
+        };
+    };
+    readonly 'task.steer': {
+        readonly marker: 'sealed';
         readonly category: 'task-input';
         readonly identity: readonly ["steerId"];
         readonly moved: readonly ["text"];
         readonly forbidden: readonly [];
         readonly digests: {};
     };
-    readonly 'task.complete_sealed': {
-        readonly plainType: 'task.complete';
+    readonly 'task.complete': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["summary", "finalMessage", "document"];
@@ -108,8 +111,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
             readonly 'preparedObservation.requestDigest': 'forbidden';
         };
     };
-    readonly 'task.fail_sealed': {
-        readonly plainType: 'task.fail';
+    readonly 'task.fail': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
@@ -121,8 +124,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
             readonly 'preparedObservation.requestDigest': 'forbidden';
         };
     };
-    readonly 'task.decline_sealed': {
-        readonly plainType: 'task.decline';
+    readonly 'task.decline': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
@@ -131,8 +134,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
             readonly 'agentRef.profileRevision': 'plain';
         };
     };
-    readonly 'task.cancelled_sealed': {
-        readonly plainType: 'task.cancelled';
+    readonly 'task.cancelled': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
@@ -143,8 +146,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
             readonly 'agentHomeProjection.projectionHash': 'plain';
         };
     };
-    readonly 'task.progress_sealed': {
-        readonly plainType: 'task.progress';
+    readonly 'task.progress': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly ["seq"];
         readonly moved: readonly ["events"];
@@ -154,8 +157,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         };
         readonly inlineOnly: true;
     };
-    readonly 'task.artifact_sealed': {
-        readonly plainType: 'task.artifact';
+    readonly 'task.artifact': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly ["artifactId"];
         readonly moved: readonly ["inline"];
@@ -167,8 +170,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
             readonly inline: number;
         };
     };
-    readonly 'task.await_approval_sealed': {
-        readonly plainType: 'task.await_approval';
+    readonly 'task.await_approval': {
+        readonly marker: 'sealed';
         readonly category: 'task-output';
         readonly identity: readonly ["approvalId"];
         readonly moved: readonly ["summary"];
@@ -177,5 +180,8 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly inlineOnly: true;
     };
 }>;
-export type SealedMessageType = keyof typeof SEALED_SPLIT_TABLE;
-export declare function isSealedMessageType(type: string): type is SealedMessageType;
+/** A message type with a sealed branch. */
+export type SealableMessageType = keyof typeof SEALED_SPLIT_TABLE;
+export declare function isSealableMessageType(type: string): type is SealableMessageType;
+/** Whether a `type` payload takes its sealed branch: it carries the type's marker field. */
+export declare function isSealedPayload(type: string, payload: unknown): boolean;

package/dist/version.d.ts

@@ -2,14 +2,25 @@
 export declare const MAILBOX_READ_AHEAD_MAX_SEQS = 4096;
 export declare const MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
 /**
- * Wire protocol version. Every v3 change is a version bump, a gated addition
+ * Wire protocol version. Every v4 change is a version bump, a gated addition
  * or a strip-safe addition: see docs/protocol.md "Freeze rule", which is the
  * one statement of the rule, and `src/wire-additions.ts`, which declares the
- * receiver-capability gates and additions. No v3 release has been published
- * yet, so `src/__tests__/compat.test.ts` has no published v3 decoder to prove
+ * receiver-capability gates and additions. No v4 release has been published
+ * yet, so `src/__tests__/compat.test.ts` has no published v4 decoder to prove
  * additions against; cross-release gates stay unproven until one exists.
  *
- * v3 makes `schema` required on the `terminalProjection.mode:
+ * v4 completes the ADR-034 cutover and retires the approval paths kept for
+ * pre-M5 peers. It removes the v3 handshake answer, the runtime-only offers
+ * (with and without toolsets) with their sealed twins, and the
+ * `strict-agent-only` flag: every offer is Agent-bound. `approvalId` is
+ * required on `task.await_approval`, `task.approve` and `task.reject`, so a
+ * decision resolves only the approval it names. `task.approval_resolved` is
+ * baseline: the daemon reports every locally resolved approval, and the
+ * server no longer infers one from later task activity. The three approval
+ * capability flags of v3 are gone. A v3 envelope is rejected; there is no v3 reader. Drain, then
+ * upgrade server and client together.
+ *
+ * v3 made `schema` required on the `terminalProjection.mode:
  * 'result-document'` arm (`terminal-projection.ts`, `result-schema.ts`): the
  * offer freezes the outcome schema, and the outcome reaches the Host only as
  * `task.complete.document`. That narrows a strict shape, so it is a wire
@@ -31,9 +42,7 @@ export declare const MAILBOX_READ_AHEAD_CAPABILITY = "mailbox-read-ahead";
  * attest tool executables. The artifact names its counted tools in
  * `toolNames`.
  */
-export declare const PROTOCOL_VERSION = 3;
-/** Host declares that this device accepts only Agent-bound offer variants. */
-export declare const STRICT_AGENT_ONLY_CAPABILITY: 'strict-agent-only';
+export declare const PROTOCOL_VERSION = 4;
 /**
  * The device runs `homeAccess: 'memory-reader'` Agent offers: each reader
  * Attempt gets its own run directory under the Agent home, and readers are
@@ -48,58 +57,17 @@ export declare const AGENT_HOME_READERS_CAPABILITY: 'agent-home-readers';
  * flags may be introduced without a protocol version bump; unrecognized flags
  * must be ignored by both sides.
  *
- * `interactive-approval` is RESERVED as of this addition: it gates the
- * (currently unexercised) approval seam — a server must not route an
- * approval-requiring policy to a daemon that hasn't advertised this flag. No
- * bundled runtime adapter emits it yet; that's expected until interactive
- * approval is actually wired up in a later wave.
- *
- * `approval_resolved` (additive-minor): a SERVER-advertised flag meaning
- * "I understand the `task.approval_resolved` message" (`messages.ts`). This
- * is the N/N-1 answer for that new daemon -> server message: an old server's
- * advertised capabilities never include it, so a new daemon talking to an old
- * server never sends `task.approval_resolved` at all (see `packages/client`'s
- * `task-runner.ts`) and falls back to the pre-existing implicit-resume inference
- * (the `relay.onTaskActivity` hook in `packages/server/src/index.ts`)
- * unconditionally, exactly as before this flag existed. Unlike
- * `interactive-approval`, this one IS exercised the moment both sides
- * support it — there is no reserved/dormant period for it.
- */
-/**
- * `approval-targeting` (M5, additive-minor): unlike `approval_resolved`
- * above, this flag is purely INFORMATIONAL/semantic, not a functional gate.
- * `task.await_approval`/`task.approve`/`task.reject` all carry their new
- * `approvalId` field UNCONDITIONALLY on both sides once each peer is
- * upgraded -- the wire is tolerant (a plain, non-`.strict()` `z.object()`
- * field, `messages.ts`), so no version/capability negotiation is needed just
- * to send it safely; an older peer that doesn't recognize the field simply
- * never reads it. Receivers decide whether to apply exact-match targeting
- * by FIELD PRESENCE on the specific message at hand (does this particular
- * `task.approve`/`task.reject`/`onApprovalResolved` payload carry an
- * `approvalId`, and does a stored one exist to compare it against?), never
- * by checking this flag -- see `approveTask`/`rejectTask` (`@byok-sdk/cloud`)
- * and `TaskRunner.handleApprove`/`handleReject` (`packages/client`'s
- * `task-runner.ts`). This flag exists only so each side can advertise
- * whether the OTHER side is new enough to participate in targeting at all (an
- * embedder could observe it through the old
- * reference server's `ConnectionHub.getDeviceCapabilities`; `@byok-sdk/server`
- * now reads it only internally) -- the same N/N-1-safe shape as every other
- * flag here, just consumed for observability instead of gating.
- */
-/**
  * `dispatch-selection` (additive-minor) is a correctness gate for the
- * optional `task.offer.dispatchSelection` control field. An older v1 daemon
+ * optional offer `dispatchSelection` control field. An older v1 daemon
  * legally strips unknown optional fields, so a server must never send an
  * authoritative provider/model selection unless the target connection
  * advertises this flag. Absence means reject before task creation, not send
- * a legacy runtime-only offer that could reach a different provider.
+ * an offer that could reach a different provider.
  *
- * `toolset-selection` (additive-minor) means the daemon understands
- * `task.offer_with_toolsets` and can resolve its logical ids against local
- * MCP configuration. The distinct message type is also the N/N-1 safety
- * boundary for long-poll: an older daemon skips it as unknown and therefore
- * cannot accidentally execute the instruction without the required tools.
+ * `toolset-selection` (additive-minor) means the daemon understands an
+ * offer's `requiredToolsets` and can resolve its logical ids against local
+ * MCP configuration.
  */
 export declare const CUSTOM_HARNESS_CAPABILITY: 'custom-harness';
-export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'interactive-approval', 'approval_resolved', 'approval-targeting', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "strict-agent-only", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", "agent-memory-selection", "agent-memory-read-if-admitted", "agent-memory-read-write-if-admitted", 'agent-message-draft', "sealed-payload-v1", "sealed-output-ciphertext-ref", "runtime-failure-class"];
+export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", "agent-memory-selection", "agent-memory-read-if-admitted", "agent-memory-read-write-if-admitted", 'agent-message-draft', "sealed-payload-v1", "sealed-output-ciphertext-ref", "runtime-failure-class", "runtime-unavailable-cause"];
 export type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];

package/dist/wire-additions.d.ts

@@ -2,7 +2,7 @@
  * The one table of receiver-capability gates and wire additions
  * (docs/protocol.md "Freeze rule").
  *
- * A v3 change takes exactly one of three paths: a version bump, a gated
+ * A v4 change takes exactly one of three paths: a version bump, a gated
  * addition, or a strip-safe addition. Envelope and HTTP rows have explicit
  * kinds. The last two are declared here.
  *
@@ -19,11 +19,15 @@
  * strip-safe rows and the v2 `result-document` gate are gone. The device
  * gates kept below name capabilities a daemon advertises only when it is
  * configured for them (Agent home, egress, input preparation, provisioning,
- * memory intents and so on): they gate on the receiver's configuration. The
- * server-advertised `approval_resolved` gate is kept as the daemon's sending
- * condition for `task.approval_resolved`. The first stable v3 decoder is
- * 0.27.0. Cross-release checks use its actual registry tarball
- * (`src/__tests__/published-compat.test.ts`).
+ * memory intents and so on): they gate on the receiver's configuration.
+ *
+ * v4 baseline: every v4 server reads `task.approval_resolved`, so its
+ * `approval_resolved` gate is gone. One `task.offer` replaces the Agent offer
+ * types and sealed is a payload branch, so a gate that a v3 type carried is a
+ * field or value row here. The offer is strict, so a daemon that does not know
+ * one of its fields stops instead of stripping it. The daemon also refuses an offer whose rows name a flag it did not advertise. No
+ * v4 release has been published yet, so no published decoder proves these rows
+ * across releases.
  *
  * Senders derive their admission flags from {@link requiredReceiverCapabilities}
  * and nowhere else, so a gate cannot exist in one place and be missing in
@@ -32,7 +36,7 @@
  */
 import type { MessageType } from './messages';
 import type { CapabilityFlag } from './version';
-type HttpWireSurface = 'ChallengeRequest' | 'ChallengeResponse' | 'TokenRequest' | 'TokenResponse' | 'EventsPollQuery' | 'EventsPollResponse' | 'MessagesSendRequest' | 'MessagesSendResponse';
+type HttpWireSurface = 'ChallengeRequest' | 'ChallengeResponse' | 'TokenRequest' | 'TokenResponse' | 'PairRequest' | 'PairResponse' | 'EventsPollQuery' | 'EventsPollResponse' | 'MessagesSendRequest' | 'MessagesSendResponse' | 'PresencePublishRequest';
 export type WireAddition = {
     readonly kind: 'envelope';
     readonly rule: 'gated';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/protocol",
-  "version": "0.30.2",
+  "version": "0.32.0",
   "description": "BYOK SDK wire protocol: envelope schema, message types, and codec helpers",
   "type": "module",
   "license": "MIT",
@@ -29,6 +29,10 @@
     "./constants": {
       "types": "./dist/constants.d.ts",
       "import": "./dist/constants.js"
+    },
+    "./agent-memory": {
+      "types": "./dist/agent-memory.d.ts",
+      "import": "./dist/agent-memory.js"
     }
   },
   "files": [
@@ -49,10 +53,9 @@
   },
   "dependencies": {
     "@cfworker/json-schema": "4.1.1",
-    "zod": "^4.4.3"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
-    "byok-protocol-floor": "https://registry.npmjs.org/@byok-sdk/protocol/-/protocol-0.27.0.tgz",
-    "byok-protocol-previous": "https://registry.npmjs.org/@byok-sdk/protocol/-/protocol-0.26.1.tgz"
+    "byok-protocol-previous": "https://registry.npmjs.org/@byok-sdk/protocol/-/protocol-0.30.2.tgz"
   }
 }

package/dist/task-assertion.d.ts

@@ -1,28 +0,0 @@
-/**
- * The device-level half of the task lane's capability gate (contract §8.1).
- *
- * Contract §8.1 fixes ONE name, `host-mcp-task-context`, carried on two
- * independent channels that must both be in place before a host may route a
- * tool invocation through the task lane:
- *
- * 1. **Deployment level** — the ADR-010 `CapabilityDeclarationSchema` a
- *    deployment serves (`@byok-sdk/cloud`'s `CLOUD_CAPABILITIES`). §8.2(1)
- *    governs it: a deployment declares the capability only once it is
- *    completely implemented.
- * 2. **Device level** — this constant: a `conn.hello` capability string a host
- *    consumes through `declaresCapabilities`. §8.3 governs it: a device whose
- *    build cannot serve the lane simply does not advertise it, and the host
- *    answers `unavailable` rather than reaching for the device assertion the
- *    task lane does not accept.
- *
- * It lives in `@byok-sdk/protocol` for the same reason every other daemon
- * capability flag does: this package is the wire vocabulary both sides compile
- * against, and a name spelled twice is a name that can drift. It is registered
- * in `CAPABILITY_FLAGS` (`./version`), which is what makes it a value a daemon
- * can actually send.
- *
- * The spelling satisfies `@byok-sdk/core`'s `CAPABILITY_NAME_PATTERN`
- * (`/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/`) on purpose: the deployment-level channel
- * carries this exact literal, so a name legal in only one of the two channels
- * would leave them naming different things.
- */