@byok-sdk/protocol 0.32.0 → 0.33.0

package/dist/messages.d.ts

@@ -626,6 +626,8 @@ export declare const TaskOfferSealedPayloadSchema: z.ZodObject<{
         scopeId: z.ZodString;
         epoch: z.ZodNumber;
         categories: z.ZodArray<z.ZodEnum<{
+            "agent-message": "agent-message";
+            "memory-projection": "memory-projection";
             "task-input": "task-input";
             "task-output": "task-output";
         }>>;
@@ -899,6 +901,8 @@ export declare const TaskOfferPayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
         scopeId: z.ZodString;
         epoch: z.ZodNumber;
         categories: z.ZodArray<z.ZodEnum<{
+            "agent-message": "agent-message";
+            "memory-projection": "memory-projection";
             "task-input": "task-input";
             "task-output": "task-output";
         }>>;
@@ -978,7 +982,10 @@ export declare const AgentMessageDraftPayloadSchema: z.ZodObject<{
     overflow: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 export type AgentMessageDraftPayload = z.infer<typeof AgentMessageDraftPayloadSchema>;
-export declare const AgentMessagePublishPayloadSchema: z.ZodObject<{
+/** Daemon -> server: one Agent message in plaintext. */
+export declare const AgentMessagePublishPlainPayloadSchema: z.ZodObject<{
+    sealed: z.ZodOptional<z.ZodNever>;
+    sealing: z.ZodOptional<z.ZodNever>;
     agentRef: z.ZodObject<{
         agentId: z.ZodString;
         profileRevision: z.ZodString;
@@ -995,8 +1002,116 @@ export declare const AgentMessagePublishPayloadSchema: z.ZodObject<{
     contentHash: z.ZodString;
     byteCount: z.ZodNumber;
 }, z.core.$strict>;
+export type AgentMessagePublishPlainPayload = z.infer<typeof AgentMessagePublishPlainPayloadSchema>;
+/**
+ * Daemon -> server: one Agent message of a task whose `sealing` lists
+ * `agent-message` (#1045 C2). `body` is sealed; `contentHash` and
+ * `byteCount` are not carried, and `messageId` and `cursor` name the write in
+ * the AAD and the content MAC. Gated on `sealed-payload-v2`.
+ */
+export declare const AgentMessagePublishSealedPayloadSchema: z.ZodObject<{
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    sessionRef: z.ZodString;
+    contract: z.ZodString;
+    messageId: z.ZodUUID;
+    cursor: z.ZodNumber;
+    contentType: z.ZodEnum<{
+        "text/markdown": "text/markdown";
+        "text/plain": "text/plain";
+    }>;
+    sealed: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
+        category: z.ZodLiteral<"agent-message">;
+        scope: z.ZodObject<{
+            id: z.ZodString;
+            epoch: z.ZodNumber;
+            keyId: z.ZodString;
+        }, z.core.$strict>;
+        chainHead: z.ZodObject<{
+            seq: z.ZodNumber;
+            hash: z.ZodString;
+        }, z.core.$strict>;
+        sender: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        paddedLength: z.ZodNumber;
+        contentMac: z.ZodString;
+        ciphertext: z.ZodOptional<z.ZodString>;
+        ciphertextRef: z.ZodOptional<z.ZodObject<{
+            blobId: z.ZodString;
+            contentHash: z.ZodString;
+            size: z.ZodNumber;
+            contentType: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type AgentMessagePublishSealedPayload = z.infer<typeof AgentMessagePublishSealedPayloadSchema>;
+/** Narrow with `payload.sealed !== undefined`; the plaintext branch's `sealed` is `never`. */
+export declare const AgentMessagePublishPayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
+    sealed: z.ZodOptional<z.ZodNever>;
+    sealing: z.ZodOptional<z.ZodNever>;
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    sessionRef: z.ZodString;
+    contract: z.ZodString;
+    messageId: z.ZodUUID;
+    cursor: z.ZodNumber;
+    contentType: z.ZodEnum<{
+        "text/markdown": "text/markdown";
+        "text/plain": "text/plain";
+    }>;
+    body: z.ZodString;
+    contentHash: z.ZodString;
+    byteCount: z.ZodNumber;
+}, z.core.$strict>, z.ZodObject<{
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    sessionRef: z.ZodString;
+    contract: z.ZodString;
+    messageId: z.ZodUUID;
+    cursor: z.ZodNumber;
+    contentType: z.ZodEnum<{
+        "text/markdown": "text/markdown";
+        "text/plain": "text/plain";
+    }>;
+    sealed: z.ZodObject<{
+        v: z.ZodLiteral<1>;
+        suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
+        category: z.ZodLiteral<"agent-message">;
+        scope: z.ZodObject<{
+            id: z.ZodString;
+            epoch: z.ZodNumber;
+            keyId: z.ZodString;
+        }, z.core.$strict>;
+        chainHead: z.ZodObject<{
+            seq: z.ZodNumber;
+            hash: z.ZodString;
+        }, z.core.$strict>;
+        sender: z.ZodString;
+        salt: z.ZodString;
+        nonce: z.ZodString;
+        paddedLength: z.ZodNumber;
+        contentMac: z.ZodString;
+        ciphertext: z.ZodOptional<z.ZodString>;
+        ciphertextRef: z.ZodOptional<z.ZodObject<{
+            blobId: z.ZodString;
+            contentHash: z.ZodString;
+            size: z.ZodNumber;
+            contentType: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
 export type AgentMessagePublishPayload = z.infer<typeof AgentMessagePublishPayloadSchema>;
-export declare const AgentMessageDispositionPayloadSchema: z.ZodObject<{
+/** Server -> daemon: the disposition of a plaintext message, naming its `contentHash`. */
+export declare const AgentMessageDispositionPlainPayloadSchema: z.ZodObject<{
     agentRef: z.ZodObject<{
         agentId: z.ZodString;
         profileRevision: z.ZodString;
@@ -1005,7 +1120,31 @@ export declare const AgentMessageDispositionPayloadSchema: z.ZodObject<{
     contract: z.ZodString;
     messageId: z.ZodUUID;
     cursor: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        accepted: "accepted";
+        held: "held";
+        refused: "refused";
+    }>;
+    receiptId: z.ZodUUID;
+    reasonCode: z.ZodOptional<z.ZodString>;
     contentHash: z.ZodString;
+    contentMac: z.ZodOptional<z.ZodNever>;
+}, z.core.$strict>;
+export type AgentMessageDispositionPlainPayload = z.infer<typeof AgentMessageDispositionPlainPayloadSchema>;
+/**
+ * Server -> daemon: the disposition of a sealed message (#1045 C2). It names
+ * the message by its sealed member's `contentMac`, because the sealed message
+ * carries no `contentHash`. Gated on `sealed-payload-v2`.
+ */
+export declare const AgentMessageDispositionSealedPayloadSchema: z.ZodObject<{
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    sessionRef: z.ZodString;
+    contract: z.ZodString;
+    messageId: z.ZodUUID;
+    cursor: z.ZodNumber;
     outcome: z.ZodEnum<{
         accepted: "accepted";
         held: "held";
@@ -1013,7 +1152,48 @@ export declare const AgentMessageDispositionPayloadSchema: z.ZodObject<{
     }>;
     receiptId: z.ZodUUID;
     reasonCode: z.ZodOptional<z.ZodString>;
+    contentMac: z.ZodString;
+    contentHash: z.ZodOptional<z.ZodNever>;
 }, z.core.$strict>;
+export type AgentMessageDispositionSealedPayload = z.infer<typeof AgentMessageDispositionSealedPayloadSchema>;
+/** Narrow with `payload.contentMac !== undefined`. */
+export declare const AgentMessageDispositionPayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    sessionRef: z.ZodString;
+    contract: z.ZodString;
+    messageId: z.ZodUUID;
+    cursor: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        accepted: "accepted";
+        held: "held";
+        refused: "refused";
+    }>;
+    receiptId: z.ZodUUID;
+    reasonCode: z.ZodOptional<z.ZodString>;
+    contentHash: z.ZodString;
+    contentMac: z.ZodOptional<z.ZodNever>;
+}, z.core.$strict>, z.ZodObject<{
+    agentRef: z.ZodObject<{
+        agentId: z.ZodString;
+        profileRevision: z.ZodString;
+    }, z.core.$strict>;
+    sessionRef: z.ZodString;
+    contract: z.ZodString;
+    messageId: z.ZodUUID;
+    cursor: z.ZodNumber;
+    outcome: z.ZodEnum<{
+        accepted: "accepted";
+        held: "held";
+        refused: "refused";
+    }>;
+    receiptId: z.ZodUUID;
+    reasonCode: z.ZodOptional<z.ZodString>;
+    contentMac: z.ZodString;
+    contentHash: z.ZodOptional<z.ZodNever>;
+}, z.core.$strict>]>;
 export type AgentMessageDispositionPayload = z.infer<typeof AgentMessageDispositionPayloadSchema>;
 /** Server -> daemon: one exact, independently-capability-gated content read. */
 export declare const AgentContentReadPayloadSchema: z.ZodObject<{
@@ -1698,10 +1878,17 @@ export declare const RuntimeFailureClassSchema: z.ZodEnum<{
     unknown: "unknown";
 }>;
 export type RuntimeFailureClass = z.infer<typeof RuntimeFailureClassSchema>;
+/** Whether a `quota` limit covers the whole account or one model (#1271). */
+export declare const RuntimeQuotaScopeSchema: z.ZodEnum<{
+    account: "account";
+    model: "model";
+}>;
+export type RuntimeQuotaScope = z.infer<typeof RuntimeQuotaScopeSchema>;
 /**
  * The machine-readable failure of a `task.fail` (#869); `reason` stays display
- * text. `resetsAt` (ISO 8601 UTC) exists only on `quota`, and only when the
- * runtime reported when the limit resets.
+ * text. `resetsAt` (ISO 8601 UTC) and `scope` exist only on `quota`, and only
+ * when the runtime reported them. `scope` is gated on the server's
+ * `runtime-quota-scope` flag (#1271).
  *
  * The class is open (#1121): a well-formed class this version does not know,
  * with whatever fields a newer device put beside it, is accepted and kept
@@ -1711,6 +1898,10 @@ export type RuntimeFailureClass = z.infer<typeof RuntimeFailureClassSchema>;
 export declare const TaskFailureSchema: z.ZodUnion<readonly [z.ZodObject<{
     class: z.ZodLiteral<"quota">;
     resetsAt: z.ZodOptional<z.ZodISODateTime>;
+    scope: z.ZodOptional<z.ZodEnum<{
+        account: "account";
+        model: "model";
+    }>>;
 }, z.core.$strict>, z.ZodObject<{
     class: z.ZodEnum<{
         auth: "auth";
@@ -1734,6 +1925,7 @@ export type TaskFailure = z.infer<typeof TaskFailureSchema>;
 export type TaskFailureReading = {
     readonly class: 'quota';
     readonly resetsAt?: string;
+    readonly scope?: RuntimeQuotaScope;
 } | {
     readonly class: Exclude<RuntimeFailureClass, 'quota' | 'unknown'>;
 } | {
@@ -1892,6 +2084,10 @@ export declare const TaskFailSealedPayloadSchema: z.ZodObject<{
     failure: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         class: z.ZodLiteral<"quota">;
         resetsAt: z.ZodOptional<z.ZodISODateTime>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            account: "account";
+            model: "model";
+        }>>;
     }, z.core.$strict>, z.ZodObject<{
         class: z.ZodEnum<{
             auth: "auth";
@@ -2677,6 +2873,10 @@ export declare const TaskFailPayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
     failure: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         class: z.ZodLiteral<"quota">;
         resetsAt: z.ZodOptional<z.ZodISODateTime>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            account: "account";
+            model: "model";
+        }>>;
     }, z.core.$strict>, z.ZodObject<{
         class: z.ZodEnum<{
             auth: "auth";
@@ -2744,6 +2944,10 @@ export declare const TaskFailPayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
     failure: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
         class: z.ZodLiteral<"quota">;
         resetsAt: z.ZodOptional<z.ZodISODateTime>;
+        scope: z.ZodOptional<z.ZodEnum<{
+            account: "account";
+            model: "model";
+        }>>;
     }, z.core.$strict>, z.ZodObject<{
         class: z.ZodEnum<{
             auth: "auth";

package/dist/sealed-payload.d.ts

@@ -1,5 +1,6 @@
 /**
- * Sealed payload v1 on the hosted wire (#654 design §8.1, §8.3, §8.6).
+ * Sealed payload on the hosted wire: v1 (#654 design §8.1, §8.3, §8.6) and
+ * the v2 categories (#1045).
  *
  * Sealed is a property of the payload, not a message type: each sealable
  * type's payload is a plaintext branch or a sealed branch. The sealed branch is
@@ -19,20 +20,17 @@
  * length function; a cross-package test keeps the two equal.
  */
 import { z } from 'zod';
-export { SEALED_SPLIT_TABLE, isSealableMessageType, isSealedPayload } from './sealed-split-table';
+export { SEALED_SPLIT_TABLE, isSealableMessageType, isSealedPayload, sealedMovedFields } from './sealed-split-table';
 export type { SealableMessageType, SealedDigestRule, SealedSplitEntry } from './sealed-split-table';
 export declare const SEALED_PAYLOAD_VERSION = 1;
 /** The only suite v1 admits. A new suite is a new constant and a new capability, never a parser branch. */
 export declare const SEALED_PAYLOAD_SUITE = "byok-sealed-v1.hkdf-sha256.aes-256-gcm";
-/** C1–C4 in canonical order. A task lists its sealing categories in this order. */
-export declare const SEALED_PAYLOAD_CATEGORIES: readonly ['task-input', 'agent-message', 'task-output', 'memory-projection'];
-export type SealedPayloadCategory = (typeof SEALED_PAYLOAD_CATEGORIES)[number];
 /**
- * The categories a v1 task may seal (D17): task input and task output. Agent
- * messages, memory projections, input preparation and drafts come later.
+ * C1–C4 in canonical order. A task lists its sealing categories in this order.
+ * Input preparation and drafts have no category; they stay plaintext.
  */
-export declare const SEALED_PAYLOAD_V1_CATEGORIES: readonly ['task-input', 'task-output'];
-export type SealedPayloadV1Category = (typeof SEALED_PAYLOAD_V1_CATEGORIES)[number];
+export declare const SEALED_PAYLOAD_CATEGORIES: readonly ['task-input', 'agent-message', 'task-output', 'memory-projection'];
+export type SealedPayloadCategory = (typeof SEALED_PAYLOAD_CATEGORIES)[number];
 /**
  * Closed `task.decline` codes of a receiver that refuses sealed task input
  * (§8.3). They are plaintext: a device without the scope key cannot seal a
@@ -64,23 +62,34 @@ export declare const SEALED_TASK_PLAIN_CODES: Readonly<{
 }>;
 /**
  * True when `payload` is a legal plaintext `type` message of a task whose
- * output is sealed: each field that the `task-output` sealed branch of `type`
- * moves or drops is absent or holds one of {@link SEALED_TASK_PLAIN_CODES}.
- * A type that has a sealed output branch and is not listed there is never
- * legal. A plaintext decline also names its code as `code`. A type with no
- * sealed output branch is always legal.
+ * output is sealed under `categories`: each field that the `task-output`
+ * sealed branch of `type` moves (with the `movedWith` fields of `categories`)
+ * or drops is absent or holds one of {@link SEALED_TASK_PLAIN_CODES}. A type
+ * that has a sealed output branch and is not listed there is never legal. A
+ * plaintext decline also names its code as `code`. A type with no sealed
+ * output branch is always legal.
  */
-export declare function isSealedTaskPlainOutput(type: string, payload: object): boolean;
+export declare function isSealedTaskPlainOutput(type: string, payload: object, categories: readonly SealedPayloadCategory[]): boolean;
 /** Padded frames above this length travel as a ciphertext blob (§8.6). */
 export declare const SEALED_INLINE_MAX_PADDED_LENGTH: number;
-/** Plaintext limit of every v1 category, in UTF-8 bytes of canonical JSON (D8). */
+/** Plaintext limit of every category, in UTF-8 bytes of canonical JSON (D8). */
 export declare const SEALED_PAYLOAD_MAX_CONTENT_LENGTH: number;
+/**
+ * The largest opened content of a sealed `agent.message.publish` whose body
+ * is at most `maxBytes` UTF-8 bytes (#1045 O2): `6 × maxBytes + 11`. At
+ * `AGENT_MESSAGE_MAX_BYTES` it is 1,572,875, below
+ * {@link SEALED_PAYLOAD_MAX_CONTENT_LENGTH}, so every legal body seals. The
+ * device seals within it, and the Host bounds a sealed message's
+ * `paddedLength` by `sealedPayloadPaddedLength(4 + this)` for the task's
+ * frozen `maxBytes`.
+ */
+export declare function sealedAgentMessageMaxContentLength(maxBytes: number): number;
 /**
  * The one legal padded length of a frame of `frameLength` bytes
  * (`4 + contentLength`): the next multiple of 256 up to 16 KiB, Padmé above.
  */
 export declare function sealedPayloadPaddedLength(frameLength: number): number;
-/** The largest padded length a v1 content may have. */
+/** The largest padded length a sealed content may have. */
 export declare const SEALED_PAYLOAD_MAX_PADDED_LENGTH: number;
 /**
  * The byte length of canonical unpadded base64url, or `undefined`. Canonical
@@ -88,11 +97,13 @@ export declare const SEALED_PAYLOAD_MAX_PADDED_LENGTH: number;
  * character, so one byte string has exactly one encoding.
  */
 export declare function sealedBase64UrlByteLength(value: string): number | undefined;
-/** A sealed member of any v1 category. */
+/** A sealed member of any category. */
 export declare const SealedPayloadSchema: z.ZodObject<{
     v: z.ZodLiteral<1>;
     suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
     category: z.ZodEnum<{
+        "agent-message": "agent-message";
+        "memory-projection": "memory-projection";
         "task-input": "task-input";
         "task-output": "task-output";
     }>;
@@ -173,15 +184,76 @@ export declare const SealedTaskOutputSchema: z.ZodObject<{
         contentType: z.ZodString;
     }, z.core.$strict>>;
 }, z.core.$strict>;
+/** The sealed member of an `agent.message.publish` (#1045 C2). */
+export declare const SealedAgentMessageSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
+    category: z.ZodLiteral<"agent-message">;
+    scope: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+        keyId: z.ZodString;
+    }, z.core.$strict>;
+    chainHead: z.ZodObject<{
+        seq: z.ZodNumber;
+        hash: z.ZodString;
+    }, z.core.$strict>;
+    sender: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    paddedLength: z.ZodNumber;
+    contentMac: z.ZodString;
+    ciphertext: z.ZodOptional<z.ZodString>;
+    ciphertextRef: z.ZodOptional<z.ZodObject<{
+        blobId: z.ZodString;
+        contentHash: z.ZodString;
+        size: z.ZodNumber;
+        contentType: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+/**
+ * The sealed member of a memory projection (#1045 C4). It is inline only
+ * (owner decision O2): the Host keeps one latest snapshot per Agent and holds
+ * no ciphertext blob for it.
+ */
+export declare const SealedMemoryProjectionSchema: z.ZodObject<{
+    v: z.ZodLiteral<1>;
+    suite: z.ZodLiteral<"byok-sealed-v1.hkdf-sha256.aes-256-gcm">;
+    category: z.ZodLiteral<"memory-projection">;
+    scope: z.ZodObject<{
+        id: z.ZodString;
+        epoch: z.ZodNumber;
+        keyId: z.ZodString;
+    }, z.core.$strict>;
+    chainHead: z.ZodObject<{
+        seq: z.ZodNumber;
+        hash: z.ZodString;
+    }, z.core.$strict>;
+    sender: z.ZodString;
+    salt: z.ZodString;
+    nonce: z.ZodString;
+    paddedLength: z.ZodNumber;
+    contentMac: z.ZodString;
+    ciphertext: z.ZodOptional<z.ZodString>;
+    ciphertextRef: z.ZodOptional<z.ZodObject<{
+        blobId: z.ZodString;
+        contentHash: z.ZodString;
+        size: z.ZodNumber;
+        contentType: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
 /**
  * A task's frozen sealing policy (§6.2). The offer carries it in plaintext.
  * `epoch` is the epoch of the offer's task-input content, and the lowest epoch
- * the task accepts.
+ * the task accepts. `memory-projection` needs `task-output`: a terminal seals
+ * the task's memory-change evidence inside its task-output ciphertext.
  */
 export declare const TaskSealingSchema: z.ZodObject<{
     scopeId: z.ZodString;
     epoch: z.ZodNumber;
     categories: z.ZodArray<z.ZodEnum<{
+        "agent-message": "agent-message";
+        "memory-projection": "memory-projection";
         "task-input": "task-input";
         "task-output": "task-output";
     }>>;

package/dist/sealed-split-table.d.ts

@@ -1,4 +1,4 @@
-import type { SealedPayloadV1Category } from './sealed-payload';
+import type { SealedPayloadCategory } from './sealed-payload';
 /**
  * How the sealed branch of a type treats one digest field of its plaintext
  * branch (D16, design §9.3).
@@ -20,7 +20,7 @@ export interface SealedSplitEntry {
      * and the content MAC bind the wire type as the family.
      */
     readonly marker: 'sealing' | 'sealed';
-    readonly category: SealedPayloadV1Category;
+    readonly category: SealedPayloadCategory;
     /**
      * Payload fields that, after the envelope `task_id`, name this write in the
      * AAD and the content MAC (§8.2, §9.1). The sealed branch requires them.
@@ -32,7 +32,17 @@ export interface SealedSplitEntry {
      * object back and validates the plaintext branch.
      */
     readonly moved: readonly string[];
-    /** Top-level fields of the plaintext branch that the sealed branch drops in v1. */
+    /**
+     * Top-level fields that also move into this ciphertext when the task's
+     * frozen `sealing` names the category (#1045): on a task that seals
+     * `memory-projection`, a terminal seals its `agentHomeMemoryChange`. The
+     * sealed branch schema cannot see the task's sealing, so the Host and the
+     * device check these fields; read them with {@link sealedMovedFields}.
+     */
+    readonly movedWith?: {
+        readonly [category in SealedPayloadCategory]?: readonly string[];
+    };
+    /** Top-level fields of the plaintext branch that the sealed branch drops. */
     readonly forbidden: readonly string[];
     /**
      * Every path of the plaintext branch whose name contains `digest`, `hash` or
@@ -102,6 +112,9 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["summary", "finalMessage", "document"];
+        readonly movedWith: {
+            readonly 'memory-projection': readonly ['agentHomeMemoryChange'];
+        };
         readonly forbidden: readonly ["artifactRefs", "preparedObservation"];
         readonly digests: {
             readonly 'agentRef.profileRevision': 'plain';
@@ -116,6 +129,9 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
+        readonly movedWith: {
+            readonly 'memory-projection': readonly ['agentHomeMemoryChange'];
+        };
         readonly forbidden: readonly ["preparedObservation"];
         readonly digests: {
             readonly 'agentRef.profileRevision': 'plain';
@@ -139,6 +155,9 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly category: 'task-output';
         readonly identity: readonly [];
         readonly moved: readonly ["reason"];
+        readonly movedWith: {
+            readonly 'memory-projection': readonly ['agentHomeMemoryChange'];
+        };
         readonly forbidden: readonly [];
         readonly digests: {
             readonly 'agentRef.profileRevision': 'plain';
@@ -179,7 +198,34 @@ export declare const SEALED_SPLIT_TABLE: Readonly<{
         readonly digests: {};
         readonly inlineOnly: true;
     };
+    readonly 'agent.message.publish': {
+        readonly marker: 'sealed';
+        readonly category: 'agent-message';
+        readonly identity: readonly ["messageId", "cursor"];
+        readonly moved: readonly ["body"];
+        readonly forbidden: readonly ["contentHash", "byteCount"];
+        readonly digests: {
+            readonly 'agentRef.profileRevision': 'plain';
+            readonly contentHash: 'forbidden';
+        };
+    };
+}>;
+/**
+ * The receiver capability each category's sealed branches need: the v1
+ * categories `sealed-payload-v1`, the #1045 categories `sealed-payload-v2`.
+ */
+export declare const SEALED_CATEGORY_CAPABILITY: Readonly<{
+    readonly 'task-input': 'sealed-payload-v1';
+    readonly 'agent-message': 'sealed-payload-v2';
+    readonly 'task-output': 'sealed-payload-v1';
+    readonly 'memory-projection': 'sealed-payload-v2';
 }>;
+/**
+ * The top-level fields a `type` message of a task whose frozen `sealing`
+ * lists `categories` moves into its ciphertext: the type's `moved` fields and
+ * the `movedWith` fields of each listed category.
+ */
+export declare function sealedMovedFields(type: SealableMessageType, categories: readonly SealedPayloadCategory[]): readonly string[];
 /** A message type with a sealed branch. */
 export type SealableMessageType = keyof typeof SEALED_SPLIT_TABLE;
 export declare function isSealableMessageType(type: string): type is SealableMessageType;

package/dist/version.d.ts

@@ -69,5 +69,5 @@ export declare const AGENT_HOME_READERS_CAPABILITY: 'agent-home-readers';
  * MCP configuration.
  */
 export declare const CUSTOM_HARNESS_CAPABILITY: 'custom-harness';
-export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", "agent-memory-selection", "agent-memory-read-if-admitted", "agent-memory-read-write-if-admitted", 'agent-message-draft', "sealed-payload-v1", "sealed-output-ciphertext-ref", "runtime-failure-class", "runtime-unavailable-cause"];
+export declare const CAPABILITY_FLAGS: readonly ['steer', 'blob-upload', 'dispatch-selection', "provider-profile-binding", 'toolset-selection', 'agent-home-contract', "agent-home-readers", "agent-egress-policy", "agent-egress-reliable-ack", "agent-message-egress", "agent-egress-fresh-session", "agent-content-workspace-read", "agent-content-transcript-read", "agent-content-artifact-read", "agent-home-projection", "agent-input-preparation-v9", "terminal-projection-selection", "host-mcp-task-context", "custom-harness", "mailbox-read-ahead", "provider-provisioning.v1", "agent-memory-intent.v1", "agent-memory-selection", "agent-memory-read-if-admitted", "agent-memory-read-write-if-admitted", 'agent-message-draft', "sealed-payload-v1", "sealed-payload-v2", "sealed-output-ciphertext-ref", "runtime-failure-class", "runtime-quota-scope", "runtime-unavailable-cause"];
 export type CapabilityFlag = (typeof CAPABILITY_FLAGS)[number];

package/dist/wire-additions.d.ts

@@ -8,9 +8,10 @@
  *
  * - `gated`: the sender must not emit the surface unless the receiver
  *   durably advertised `capability`. A field entry applies when the payload
- *   carries the field (and, with `value`, when the field equals it); a
- *   dotted field names a nested field, for example `sealed.ciphertextRef`. A type
- *   entry applies to every message of that type. Server-to-daemon surfaces
+ *   carries the field (and, with `value`, when the field equals it, or when
+ *   the field is an array that includes it); a dotted field names a nested
+ *   field, for example `sealed.ciphertextRef`. A type entry applies to every
+ *   message of that type. Server-to-daemon surfaces
  *   are gated by a device flag, daemon-to-server surfaces by a server flag.
  * - `strip-safe`: an optional field an older receiver drops without changing
  *   what it executes or acknowledges.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byok-sdk/protocol",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "description": "BYOK SDK wire protocol: envelope schema, message types, and codec helpers",
   "type": "module",
   "license": "MIT",