@byok-sdk/protocol 0.31.0 → 0.33.0

package/dist/open-vocabulary.d.ts

@@ -0,0 +1,5 @@
+import { z } from 'zod';
+/** Any well-formed open-vocabulary token, without a membership rule. */
+export declare function openVocabularyToken(): z.ZodString;
+/** A well-formed token that is none of `known`: the raw value a receiver keeps as `reported<Field>`. */
+export declare function unrecognizedToken(known: readonly string[]): z.ZodString;

package/dist/sealed-payload.d.ts

@@ -1,5 +1,6 @@
 /**
- * Sealed payload v1 on the hosted wire (#654 design §8.1, §8.3, §8.6).
+ * Sealed payload on the hosted wire: v1 (#654 design §8.1, §8.3, §8.6) and
+ * the v2 categories (#1045).
  *
  * Sealed is a property of the payload, not a message type: each sealable
  * type's payload is a plaintext branch or a sealed branch. The sealed branch is
@@ -19,20 +20,17 @@
  * length function; a cross-package test keeps the two equal.
  */
 import { z } from 'zod';
-export { SEALED_SPLIT_TABLE, isSealableMessageType, isSealedPayload } from './sealed-split-table';
+export { SEALED_SPLIT_TABLE, isSealableMessageType, isSealedPayload, sealedMovedFields } from './sealed-split-table';
 export type { SealableMessageType, SealedDigestRule, SealedSplitEntry } from './sealed-split-table';
 export declare const SEALED_PAYLOAD_VERSION = 1;
 /** The only suite v1 admits. A new suite is a new constant and a new capability, never a parser branch. */
 export declare const SEALED_PAYLOAD_SUITE = "byok-sealed-v1.hkdf-sha256.aes-256-gcm";
-/** C1–C4 in canonical order. A task lists its sealing categories in this order. */
-export declare const SEALED_PAYLOAD_CATEGORIES: readonly ['task-input', 'agent-message', 'task-output', 'memory-projection'];
-export type SealedPayloadCategory = (typeof SEALED_PAYLOAD_CATEGORIES)[number];
 /**
- * The categories a v1 task may seal (D17): task input and task output. Agent
- * messages, memory projections, input preparation and drafts come later.
+ * C1–C4 in canonical order. A task lists its sealing categories in this order.
+ * Input preparation and drafts have no category; they stay plaintext.
  */
-export declare const SEALED_PAYLOAD_V1_CATEGORIES: readonly ['task-input', 'task-output'];
-export type SealedPayloadV1Category = (typeof SEALED_PAYLOAD_V1_CATEGORIES)[number];
+export declare const SEALED_PAYLOAD_CATEGORIES: readonly ['task-input', 'agent-message', 'task-output', 'memory-projection'];
+export type SealedPayloadCategory = (typeof SEALED_PAYLOAD_CATEGORIES)[number];
 /**
  * Closed `task.decline` codes of a receiver that refuses sealed task input
  * (§8.3). They are plaintext: a device without the scope key cannot seal a
@@ -64,23 +62,34 @@ export declare const SEALED_TASK_PLAIN_CODES: Readonly<{
 }>;
 /**
  * True when `payload` is a legal plaintext `type` message of a task whose
- * output is sealed: each field that the `task-output` sealed branch of `type`
- * moves or drops is absent or holds one of {@link SEALED_TASK_PLAIN_CODES}.
- * A type that has a sealed output branch and is not listed there is never
- * legal. A plaintext decline also names its code as `code`. A type with no
- * sealed output branch is always legal.
+ * output is sealed under `categories`: each field that the `task-output`
+ * sealed branch of `type` moves (with the `movedWith` fields of `categories`)
+ * or drops is absent or holds one of {@link SEALED_TASK_PLAIN_CODES}. A type
+ * that has a sealed output branch and is not listed there is never legal. A
+ * plaintext decline also names its code as `code`. A type with no sealed
+ * output branch is always legal.
  */
-export declare function isSealedTaskPlainOutput(type: string, payload: object): boolean;
+export declare function isSealedTaskPlainOutput(type: string, payload: object, categories: readonly SealedPayloadCategory[]): boolean;
 /** Padded frames above this length travel as a ciphertext blob (§8.6). */
 export declare const SEALED_INLINE_MAX_PADDED_LENGTH: number;
-/** Plaintext limit of every v1 category, in UTF-8 bytes of canonical JSON (D8). */
+/** Plaintext limit of every category, in UTF-8 bytes of canonical JSON (D8). */
 export declare const SEALED_PAYLOAD_MAX_CONTENT_LENGTH: number;
+/**
+ * The largest opened content of a sealed `agent.message.publish` whose body
+ * is at most `maxBytes` UTF-8 bytes (#1045 O2): `6 × maxBytes + 11`. At
+ * `AGENT_MESSAGE_MAX_BYTES` it is 1,572,875, below
+ * {@link SEALED_PAYLOAD_MAX_CONTENT_LENGTH}, so every legal body seals. The
+ * device seals within it, and the Host bounds a sealed message's
+ * `paddedLength` by `sealedPayloadPaddedLength(4 + this)` for the task's
+ * frozen `maxBytes`.
+ */
+export declare function sealedAgentMessageMaxContentLength(maxBytes: number): number;
 /**
  * The one legal padded length of a frame of `frameLength` bytes
  * (`4 + contentLength`): the next multiple of 256 up to 16 KiB, Padmé above.
  */
 export declare function sealedPayloadPaddedLength(frameLength: number): number;
-/** The largest padded length a v1 content may have. */
+/** The largest padded length a sealed content may have. */
 export declare const SEALED_PAYLOAD_MAX_PADDED_LENGTH: number;
 /**
  * The byte length of canonical unpadded base64url, or `undefined`. Canonical
@@ -88,11 +97,13 @@ export declare const SEALED_PAYLOAD_MAX_PADDED_LENGTH: number;
  * character, so one byte string has exactly one encoding.
  */
 export declare function sealedBase64UrlByteLength(value: string): number | undefined;
-/** A sealed member of any v1 category. */
+/** A sealed member of any category. */
 export declare const SealedPayloadSchema: z.ZodObject<{
     v: z.ZodLiteral<1>;
     suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
     category: z.ZodEnum<{
+        "agent-message": "agent-message";
+        "memory-projection": "memory-projection";
         "task-input": "task-input";
         "task-output": "task-output";
     }>;
@@ -173,15 +184,76 @@ export declare const SealedTaskOutputSchema: z.ZodObject<{
         contentType: z.ZodString;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+/** The sealed member of an `agent.message.publish` (#1045 C2). */
+export declare const SealedAgentMessageSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
+    category: z.ZodLiteral<"agent-message">;
+    scope: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+        keyId: z.ZodString;
+    }, z.core.$strict>;
+    chainHead: z.ZodObject<{
+        seq: z.ZodNumber;
+        hash: z.ZodString;
+    }, z.core.$strict>;
+    sender: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    paddedLength: z.ZodNumber;
+    contentMac: z.ZodString;
+    ciphertext: z.ZodOptional<z.ZodString>;
+    ciphertextRef: z.ZodOptional<z.ZodObject<{
+        blobId: z.ZodString;
+        contentHash: z.ZodString;
+        size: z.ZodNumber;
+        contentType: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * The sealed member of a memory projection (#1045 C4). It is inline only
+ * (owner decision O2): the Host keeps one latest snapshot per Agent and holds
+ * no ciphertext blob for it.
+ */
+export declare const SealedMemoryProjectionSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
+    category: z.ZodLiteral<"memory-projection">;
+    scope: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+        keyId: z.ZodString;
+    }, z.core.$strict>;
+    chainHead: z.ZodObject<{
+        seq: z.ZodNumber;
+        hash: z.ZodString;
+    }, z.core.$strict>;
+    sender: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    paddedLength: z.ZodNumber;
+    contentMac: z.ZodString;
+    ciphertext: z.ZodOptional<z.ZodString>;
+    ciphertextRef: z.ZodOptional<z.ZodObject<{
+        blobId: z.ZodString;
+        contentHash: z.ZodString;
+        size: z.ZodNumber;
+        contentType: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 /**
  * A task's frozen sealing policy (§6.2). The offer carries it in plaintext.
  * `epoch` is the epoch of the offer's task-input content, and the lowest epoch
- * the task accepts.
+ * the task accepts. `memory-projection` needs `task-output`: a terminal seals
+ * the task's memory-change evidence inside its task-output ciphertext.
  */
 export declare const TaskSealingSchema: z.ZodObject<{
     scopeId: z.ZodString;
     epoch: z.ZodNumber;
     categories: z.ZodArray<z.ZodEnum<{
+        "agent-message": "agent-message";
+        "memory-projection": "memory-projection";
         "task-input": "task-input";
         "task-output": "task-output";
     }>>;

package/dist/sealed-split-table.d.ts

@@ -1,4 +1,4 @@
-import type { SealedPayloadV1Category } from './sealed-payload';
+import type { SealedPayloadCategory } from './sealed-payload';
 /**
  * How the sealed branch of a type treats one digest field of its plaintext
  * branch (D16, design §9.3).
@@ -20,7 +20,7 @@ export interface SealedSplitEntry {
      * and the content MAC bind the wire type as the family.
      */
     readonly marker: 'sealing' | 'sealed';
-    readonly category: SealedPayloadV1Category;
+    readonly category: SealedPayloadCategory;
     /**
      * Payload fields that, after the envelope `task_id`, name this write in the
      * AAD and the content MAC (§8.2, §9.1). The sealed branch requires them.
@@ -32,7 +32,17 @@ export interface SealedSplitEntry {
      * object back and validates the plaintext branch.
      */
     readonly moved: readonly string[];
-    /** Top-level fields of the plaintext branch that the sealed branch drops in v1. */
+    /**
+     * Top-level fields that also move into this ciphertext when the task's
+     * frozen `sealing` names the category (#1045): on a task that seals
+     * `memory-projection`, a terminal seals its `agentHomeMemoryChange`. The
+     * sealed branch schema cannot see the task's sealing, so the Host and the
+     * device check these fields; read them with {@link sealedMovedFields}.
+     */
+    readonly movedWith?: {
+        readonly [category in SealedPayloadCategory]?: readonly string[];
+    };
+    /** Top-level fields of the plaintext branch that the sealed branch drops. */
     readonly forbidden: readonly string[];
     /**
      * Every path of the plaintext branch whose name contains `digest`, `hash` or
@@ -102,6 +112,9 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["summary", "finalMessage", "document"];
+        readonly movedWith: {
+            readonly 'memory-projection': readonly ['agentHomeMemoryChange'];
+        };
         readonly forbidden: readonly ["artifactRefs", "preparedObservation"];
         readonly digests: {
             readonly 'agentRef.profileRevision': 'plain';
@@ -116,6 +129,9 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
+        readonly movedWith: {
+            readonly 'memory-projection': readonly ['agentHomeMemoryChange'];
+        };
         readonly forbidden: readonly ["preparedObservation"];
         readonly digests: {
             readonly 'agentRef.profileRevision': 'plain';
@@ -139,6 +155,9 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
+        readonly movedWith: {
+            readonly 'memory-projection': readonly ['agentHomeMemoryChange'];
+        };
         readonly forbidden: readonly [];
         readonly digests: {
             readonly 'agentRef.profileRevision': 'plain';
@@ -179,7 +198,34 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly digests: {};
         readonly inlineOnly: true;
     };
+    readonly 'agent.message.publish': {
+        readonly marker: 'sealed';
+        readonly category: 'agent-message';
+        readonly identity: readonly ["messageId", "cursor"];
+        readonly moved: readonly ["body"];
+        readonly forbidden: readonly ["contentHash", "byteCount"];
+        readonly digests: {
+            readonly 'agentRef.profileRevision': 'plain';
+            readonly contentHash: 'forbidden';
+        };
+    };
+}>;
+/**
+ * The receiver capability each category's sealed branches need: the v1
+ * categories `sealed-payload-v1`, the #1045 categories `sealed-payload-v2`.
+ */
+export declare const SEALED_CATEGORY_CAPABILITY: Readonly<{
+    readonly 'task-input': 'sealed-payload-v1';
+    readonly 'agent-message': 'sealed-payload-v2';
+    readonly 'task-output': 'sealed-payload-v1';
+    readonly 'memory-projection': 'sealed-payload-v2';
 }>;
+/**
+ * The top-level fields a `type` message of a task whose frozen `sealing`
+ * lists `categories` moves into its ciphertext: the type's `moved` fields and
+ * the `movedWith` fields of each listed category.
+ */
+export declare function sealedMovedFields(type: SealableMessageType, categories: readonly SealedPayloadCategory[]): readonly string[];
 /** A message type with a sealed branch. */
 export type SealableMessageType = keyof typeof SEALED_SPLIT_TABLE;
 export declare function isSealableMessageType(type: string): type is SealableMessageType;

package/dist/version.d.ts

@@ -69,5 +69,5 @@ export declare const AGENT_HOME_READERS_CAPABILITY: 'agent-home-readers';
  * MCP configuration.
  */
 export declare const CUSTOM_HARNESS_CAPABILITY: 'custom-harness';
-export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", "agent-memory-selection", "agent-memory-read-if-admitted", "agent-memory-read-write-if-admitted", 'agent-message-draft', "sealed-payload-v1", "sealed-output-ciphertext-ref", "runtime-failure-class"];
+export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", "agent-memory-selection", "agent-memory-read-if-admitted", "agent-memory-read-write-if-admitted", 'agent-message-draft', "sealed-payload-v1", "sealed-payload-v2", "sealed-output-ciphertext-ref", "runtime-failure-class", "runtime-quota-scope", "runtime-unavailable-cause"];
 export type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];

package/dist/wire-additions.d.ts

@@ -8,9 +8,10 @@
  *
  * - `gated`: the sender must not emit the surface unless the receiver
  *   durably advertised `capability`. A field entry applies when the payload
- *   carries the field (and, with `value`, when the field equals it); a
- *   dotted field names a nested field, for example `sealed.ciphertextRef`. A type
- *   entry applies to every message of that type. Server-to-daemon surfaces
+ *   carries the field (and, with `value`, when the field equals it, or when
+ *   the field is an array that includes it); a dotted field names a nested
+ *   field, for example `sealed.ciphertextRef`. A type entry applies to every
+ *   message of that type. Server-to-daemon surfaces
  *   are gated by a device flag, daemon-to-server surfaces by a server flag.
  * - `strip-safe`: an optional field an older receiver drops without changing
  *   what it executes or acknowledges.
@@ -36,7 +37,7 @@
  */
 import type { MessageType } from './messages';
 import type { CapabilityFlag } from './version';
-type HttpWireSurface = 'ChallengeRequest' | 'ChallengeResponse' | 'TokenRequest' | 'TokenResponse' | 'EventsPollQuery' | 'EventsPollResponse' | 'MessagesSendRequest' | 'MessagesSendResponse';
+type HttpWireSurface = 'ChallengeRequest' | 'ChallengeResponse' | 'TokenRequest' | 'TokenResponse' | 'PairRequest' | 'PairResponse' | 'EventsPollQuery' | 'EventsPollResponse' | 'MessagesSendRequest' | 'MessagesSendResponse' | 'PresencePublishRequest';
 export type WireAddition = {
     readonly kind: 'envelope';
     readonly rule: 'gated';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/protocol",
-  "version": "0.31.0",
+  "version": "0.33.0",
   "description": "BYOK SDK wire protocol: envelope schema, message types, and codec helpers",
   "type": "module",
   "license": "MIT",
@@ -29,6 +29,10 @@
     "./constants": {
       "types": "./dist/constants.d.ts",
       "import": "./dist/constants.js"
+    },
+    "./agent-memory": {
+      "types": "./dist/agent-memory.d.ts",
+      "import": "./dist/agent-memory.js"
     }
   },
   "files": [
@@ -49,7 +53,7 @@
   },
   "dependencies": {
     "@cfworker/json-schema": "4.1.1",
-    "zod": "^4.4.3"
+    "zod": "^4.6.6"
   },
   "devDependencies": {
     "byok-protocol-previous": "https://registry.npmjs.org/@byok-sdk/protocol/-/protocol-0.30.2.tgz"

package/dist/task-assertion.d.ts

@@ -1,28 +0,0 @@
-/**
- * The device-level half of the task lane's capability gate (contract §8.1).
- *
- * Contract §8.1 fixes ONE name, `host-mcp-task-context`, carried on two
- * independent channels that must both be in place before a host may route a
- * tool invocation through the task lane:
- *
- * 1. **Deployment level** — the ADR-010 `CapabilityDeclarationSchema` a
- *    deployment serves (`@byok-sdk/cloud`'s `CLOUD_CAPABILITIES`). §8.2(1)
- *    governs it: a deployment declares the capability only once it is
- *    completely implemented.
- * 2. **Device level** — this constant: a `conn.hello` capability string a host
- *    consumes through `declaresCapabilities`. §8.3 governs it: a device whose
- *    build cannot serve the lane simply does not advertise it, and the host
- *    answers `unavailable` rather than reaching for the device assertion the
- *    task lane does not accept.
- *
- * It lives in `@byok-sdk/protocol` for the same reason every other daemon
- * capability flag does: this package is the wire vocabulary both sides compile
- * against, and a name spelled twice is a name that can drift. It is registered
- * in `CAPABILITY_FLAGS` (`./version`), which is what makes it a value a daemon
- * can actually send.
- *
- * The spelling satisfies `@byok-sdk/core`'s `CAPABILITY_NAME_PATTERN`
- * (`/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/`) on purpose: the deployment-level channel
- * carries this exact literal, so a name legal in only one of the two channels
- * would leave them naming different things.
- */