@byok-sdk/protocol 0.5.0 → 0.6.1

package/dist/index.d.ts

@@ -6,14 +6,16 @@ export { PermissionPolicySchema, PERMISSION_MODES } from './permission';
 export type { PermissionPolicy, PermissionMode } from './permission';
 export { AgentEventSchema, UnknownAgentEventSchema, AgentEventOrUnknownSchema, KNOWN_AGENT_EVENT_TYPES, isKnownAgentEvent, partitionAgentEvents, } from './agent-event';
 export type { AgentEvent, UnknownAgentEvent, AgentEventOrUnknown } from './agent-event';
+export { AgentEgressPolicySchema, AgentEgressActivityPolicySchema, AgentReliableQuotaPolicySchema, ContentReadPolicySchema, AgentEgressLaneSchema, AgentEgressDropReasonSchema, AgentContentReadSurfaceSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentEgressContentHashSchema, AgentEgressPolicyRevisionSchema, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, } from './agent-egress';
+export type { AgentEgressPolicy, AgentEgressActivityPolicy, AgentReliableQuotaPolicy, ContentReadPolicy, AgentEgressLane, AgentEgressDropReason, AgentContentReadSurface, AgentContentActorKind, AgentContentActor, AgentContentDecodeAs, AgentContentReadDecision, AgentContentReadDenialReason, } from './agent-egress';
 export { TASK_STATES, TASK_TRANSITIONS, canTransition } from './task-state';
 export type { TaskState } from './task-state';
-export { MESSAGE_TYPES, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, RuntimeInfoSchema, RuntimeCapabilitiesSchema, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, } from './messages';
-export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, } from './messages';
+export { MESSAGE_TYPES, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, RuntimeCapabilitiesSchema, AgentRefSchema, AGENT_REF_MAX_BYTES, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, AgentEgressReliablePayloadSchema, AgentEgressAckPayloadSchema, AgentContentReadPayloadSchema, AgentContentReceiptPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
+export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, AgentRef, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskOfferForAgentPayload, TaskOfferForAgentWithEgressPayload, AgentEgressReliablePayload, AgentEgressAckPayload, AgentContentReadPayload, AgentContentReceiptPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, } from './messages';
 export { EnvelopeSchema, isServerToDaemonType } from './envelope';
 export type { Envelope } from './envelope';
 export { ProtocolError, EnvelopeParseError, UnknownMessageTypeError, EnvelopeValidationError, } from './errors';
 export { encodeEnvelope, decodeEnvelope, createEnvelope, parseMessage } from './codec';
 export type { CreateEnvelopeOptions } from './codec';
-export { PairRequestSchema, PairResponseSchema, ChallengeRequestSchema, ChallengeResponseSchema, TokenRequestSchema, TokenResponseSchema, CreateBlobRequestSchema, CreateBlobResponseSchema, BlobDownloadUrlResponseSchema, EventsPollQuerySchema, EventsPollResponseSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, MAX_MESSAGES_PER_BATCH, BYOK_WS_PATH, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_BOARD_PATH, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, byokRecordPath, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, byokSkillPackFilePath, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, byokBlobFinalizePath, byokBlobUrlPath, byokBlobContentPath, } from './http-api';
-export type { PairRequest, PairResponse, ChallengeRequest, ChallengeResponse, TokenRequest, TokenResponse, CreateBlobRequest, CreateBlobResponse, BlobDownloadUrlResponse, EventsPollQuery, EventsPollResponse, MessagesSendRequest, MessagesSendResponse, } from './http-api';
+export { PairRequestSchema, PairResponseSchema, ChallengeRequestSchema, ChallengeResponseSchema, TokenRequestSchema, TokenResponseSchema, PresencePublishRequestSchema, CreateBlobRequestSchema, CreateBlobResponseSchema, BlobDownloadUrlResponseSchema, EventsPollQuerySchema, EventsPollResponseSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, MAX_MESSAGES_PER_BATCH, BYOK_WS_PATH, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_BOARD_PATH, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, byokRecordPath, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, byokSkillPackFilePath, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, byokBlobFinalizePath, byokBlobUrlPath, byokBlobContentPath, } from './http-api';
+export type { PairRequest, PairResponse, ChallengeRequest, ChallengeResponse, TokenRequest, TokenResponse, PresencePublishRequest, CreateBlobRequest, CreateBlobResponse, BlobDownloadUrlResponse, EventsPollQuery, EventsPollResponse, MessagesSendRequest, MessagesSendResponse, } from './http-api';

package/dist/index.js

@@ -1,5 +1,89 @@
 import { z } from 'zod';
 
+// src/agent-egress.ts
+var AGENT_EGRESS_POLICY_CAPABILITY = "agent-egress-policy";
+var AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = "agent-egress-reliable-ack";
+var AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = "agent-content-workspace-read";
+var AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = "agent-content-transcript-read";
+var AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = "agent-content-artifact-read";
+var POLICY_REVISION = z.string().min(1).max(160).regex(/^[^\u0000-\u001f\u007f\r\n]+$/u, "policyRevision must not contain control characters");
+var POSITIVE_LIMIT = z.number().int().positive().max(2147483647);
+var AgentContentMimeTypeSchema = z.string().min(3).max(255).regex(/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/iu, "MIME types must be explicit type/subtype values");
+var ContentReadPolicySchema = z.object({
+  maxBytes: POSITIVE_LIMIT,
+  allowedMimeTypes: z.array(AgentContentMimeTypeSchema).min(1).max(32)
+}).strict();
+var AgentEgressActivityPolicySchema = z.discriminatedUnion("mode", [
+  z.object({
+    mode: z.literal("metadata-status"),
+    delivery: z.literal("latest-value")
+  }).strict(),
+  z.object({
+    mode: z.literal("contentful-trajectory"),
+    delivery: z.literal("latest-value"),
+    maxCoalesceMs: POSITIVE_LIMIT,
+    maxEventBytes: POSITIVE_LIMIT
+  }).strict()
+]);
+var AgentReliableQuotaPolicySchema = z.object({
+  maxPendingEventsPerAgent: POSITIVE_LIMIT,
+  maxPendingBytesPerAgent: POSITIVE_LIMIT,
+  maxPendingBytesPerTenant: POSITIVE_LIMIT
+}).strict();
+var AgentEgressPolicySchema = z.object({
+  policyRevision: POLICY_REVISION,
+  activity: AgentEgressActivityPolicySchema,
+  reliable: AgentReliableQuotaPolicySchema,
+  transfers: z.object({
+    workspace: z.union([z.literal("disabled"), ContentReadPolicySchema]),
+    transcript: z.union([z.literal("disabled"), ContentReadPolicySchema]),
+    artifact: z.union([z.literal("disabled"), ContentReadPolicySchema])
+  }).strict()
+}).strict();
+var AgentEgressLaneSchema = z.enum(["reliable", "latest-value"]);
+var AgentEgressDropReasonSchema = z.enum([
+  "policy_denied",
+  "capability_missing",
+  "sanitizer_rejected",
+  "quota_exceeded",
+  "backpressure",
+  "coalesced",
+  "disconnected",
+  "invalid_envelope",
+  "ack_mismatch"
+]);
+var AgentContentReadSurfaceSchema = z.enum(["workspace", "transcript", "artifact"]);
+var AgentContentActorKindSchema = z.enum(["user", "agent", "system"]);
+var AgentContentActorSchema = z.object({
+  kind: AgentContentActorKindSchema,
+  id: z.string().min(1).max(512).regex(/^[^\u0000-\u001f\u007f]+$/u, "actor id must not contain control characters")
+}).strict();
+var AgentContentDecodeAsSchema = z.enum(["bytes", "utf8"]);
+var AgentContentReadDecisionSchema = z.enum(["allowed", "denied"]);
+var AgentContentReadDenialReasonSchema = z.enum([
+  "invalid-request",
+  "policy-disabled",
+  "capability-missing",
+  "policy-revision-mismatch",
+  "absolute-target",
+  "non-relative-target",
+  "dot-segment",
+  "sensitive-name",
+  "root-not-allowlisted",
+  "root-invalid",
+  "path-escape",
+  "target-missing",
+  "symlink",
+  "not-regular-file",
+  "byte-limit",
+  "mime-not-allowlisted",
+  "text-not-allowlisted",
+  "text-decode-failed",
+  "identity-mismatch"
+]);
+var AgentEgressContentHashSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u, "contentHash must be a lowercase SHA-256 digest");
+var AgentEgressPolicyRevisionSchema = POLICY_REVISION;
+
 // src/version.ts
 var PROTOCOL_VERSION = 1;
 var CAPABILITY_FLAGS = [
@@ -10,7 +94,13 @@ var CAPABILITY_FLAGS = [
   "approval-targeting",
   "result-document",
   "dispatch-selection",
-  "toolset-selection"
+  "toolset-selection",
+  "agent-home-contract",
+  AGENT_EGRESS_POLICY_CAPABILITY,
+  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
+  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,
+  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY
 ];
 var CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
 var BlobRefSchema = z.object({
@@ -111,6 +201,7 @@ function isWithinInlineByteLimit(value) {
   return new TextEncoder().encode(value).length <= MAX_INLINE_BYTES;
 }
 var RuntimeIdSchema = z.enum(["pi", "claude", "codex"]);
+var ProtocolVersionNumberSchema = z.number().int().nonnegative().max(2147483647);
 var RuntimeCapabilitiesSchema = z.object({
   steer: z.boolean().optional(),
   resume: z.boolean().optional(),
@@ -128,6 +219,21 @@ var RuntimeInfoSchema = z.object({
 });
 var CONFIGURED_TOOLSETS_MAX_ITEMS = 64;
 var ToolsetIdSchema = z.string().min(1).max(128).regex(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u, "toolset ids must be lowercase logical identifiers");
+var AGENT_REF_MAX_BYTES = 160;
+var AGENT_REF_VALUE = z.string().min(1).max(AGENT_REF_MAX_BYTES).refine((value) => new TextEncoder().encode(value).byteLength <= AGENT_REF_MAX_BYTES, {
+  message: `AgentRef values must not exceed ${AGENT_REF_MAX_BYTES} UTF-8 bytes`
+}).regex(/^[^\u0000-\u001f\u007f\r\n]+$/u, "AgentRef values must not contain control characters");
+var WINDOWS_RESERVED_AGENT_SEGMENT = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
+var AgentRefSchema = z.object({
+  agentId: AGENT_REF_VALUE.regex(/^[^\\/:<>"|?*]+$/u, "agentId must be one portable pathname segment").refine(
+    (value) => value !== "." && value !== "..",
+    "agentId must not be a dot segment"
+  ).refine(
+    (value) => !/[. ]$/u.test(value) && !WINDOWS_RESERVED_AGENT_SEGMENT.test(value),
+    "agentId must be a portable Windows-safe pathname segment"
+  ),
+  profileRevision: AGENT_REF_VALUE
+}).strict();
 function rejectDuplicateToolsets(ids, ctx, label) {
   const seen = /* @__PURE__ */ new Set();
   for (const [index, id] of ids.entries()) {
@@ -139,10 +245,12 @@ function rejectDuplicateToolsets(ids, ctx, label) {
 }
 var ConfiguredToolsetsSchema = z.array(ToolsetIdSchema).max(CONFIGURED_TOOLSETS_MAX_ITEMS).superRefine((ids, ctx) => rejectDuplicateToolsets(ids, ctx, "configured"));
 var ConnHelloPayloadSchema = z.object({
-  protocolVersions: z.array(z.number().int()),
+  protocolVersions: z.array(ProtocolVersionNumberSchema).max(16),
   capabilities: z.array(z.string()),
   deviceId: z.string(),
   productId: z.string(),
+  /** U4a Local Agent release identity; this is the sole client-version authority. */
+  clientVersion: z.string().min(1).max(128).optional(),
   /** Runtimes detected on this device (M1 gap #4; replaces `agents`). */
   runtimes: z.array(RuntimeInfoSchema).optional(),
   /** Validated logical IDs configured on this device; definitions and secrets stay local. */
@@ -192,6 +300,117 @@ var RequiredToolsetsSchema = z.array(ToolsetIdSchema).min(1).max(16).superRefine
 var TaskOfferWithToolsetsPayloadSchema = TaskOfferPayloadSchema.extend({
   requiredToolsets: RequiredToolsetsSchema
 }).strict();
+var TaskOfferForAgentPayloadSchema = z.object({
+  instruction: z.union([z.string(), InstructionBlobRefSchema]),
+  policy: PermissionPolicySchema,
+  agentRef: AgentRefSchema,
+  requiredToolsets: RequiredToolsetsSchema.optional(),
+  runtime: RuntimeIdSchema.optional(),
+  dispatchSelection: DispatchSelectionSchema.optional(),
+  sessionRef: z.string().optional(),
+  limits: z.object({
+    maxDurationMs: z.number().int().positive().optional(),
+    maxTokens: z.number().int().positive().optional()
+  }).optional()
+}).strict();
+var TaskOfferForAgentWithEgressPayloadSchema = TaskOfferForAgentPayloadSchema.extend({
+  sessionRef: z.string().min(1).max(512),
+  egressPolicy: AgentEgressPolicySchema
+}).strict();
+var EGRESS_SAFE_VALUE = z.json().refine(
+  (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 256 * 1024,
+  "sanitized egress payload exceeds 256KiB"
+);
+var EGRESS_SESSION_REF = z.string().min(1).max(512);
+var AgentEgressReliablePayloadSchema = z.object({
+  agentRef: AgentRefSchema,
+  sessionRef: EGRESS_SESSION_REF,
+  policyRevision: AgentEgressPolicyRevisionSchema,
+  eventId: z.uuid(),
+  cursor: z.number().int().positive(),
+  payload: EGRESS_SAFE_VALUE,
+  contentHash: AgentEgressContentHashSchema,
+  byteCount: z.number().int().nonnegative().max(256 * 1024)
+}).strict();
+var AgentEgressAckPayloadSchema = z.object({
+  agentRef: AgentRefSchema,
+  sessionRef: EGRESS_SESSION_REF,
+  policyRevision: AgentEgressPolicyRevisionSchema,
+  eventId: z.uuid(),
+  cursor: z.number().int().positive(),
+  receiptId: z.uuid()
+}).strict();
+var AGENT_CONTENT_TARGET = z.string().min(1).max(1024).regex(/^[^\u0000-\u001f\u007f]+$/u, "content target must not contain control characters").refine(
+  (value) => !value.startsWith("/") && !value.includes("\\") && value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".."),
+  "content target must be a portable relative path without dot segments"
+);
+var AGENT_CONTENT_CWD = z.string().min(1).max(4096).regex(/^[^\u0000-\u001f\u007f]+$/u, "cwd must not contain control characters").regex(/^(?:\/|[A-Za-z]:[\\/])/u, "cwd must be absolute");
+var AgentContentReadPayloadSchema = z.object({
+  requestId: z.uuid(),
+  surface: AgentContentReadSurfaceSchema,
+  actor: AgentContentActorSchema,
+  agentRef: AgentRefSchema,
+  sessionRef: EGRESS_SESSION_REF,
+  runtime: RuntimeIdSchema,
+  cwd: AGENT_CONTENT_CWD,
+  policyRevision: AgentEgressPolicyRevisionSchema,
+  target: AGENT_CONTENT_TARGET,
+  mimeType: AgentContentMimeTypeSchema,
+  decodeAs: AgentContentDecodeAsSchema,
+  policy: ContentReadPolicySchema
+}).strict();
+var AgentContentReceiptPayloadSchema = z.discriminatedUnion("decision", [
+  z.object({
+    requestId: z.uuid(),
+    /** Stable reliable-delivery identity. Content receipts use their requestId. */
+    eventId: z.uuid(),
+    /** Stable positive cursor allocated by the durable Agent spool. */
+    cursor: z.number().int().positive(),
+    surface: AgentContentReadSurfaceSchema,
+    actor: AgentContentActorSchema,
+    agentRef: AgentRefSchema,
+    sessionRef: EGRESS_SESSION_REF,
+    runtime: RuntimeIdSchema,
+    cwd: AGENT_CONTENT_CWD,
+    policyRevision: AgentEgressPolicyRevisionSchema,
+    target: AGENT_CONTENT_TARGET,
+    mimeType: AgentContentMimeTypeSchema,
+    decodeAs: AgentContentDecodeAsSchema,
+    decision: z.literal("allowed"),
+    byteCount: z.number().int().nonnegative(),
+    contentHash: AgentEgressContentHashSchema,
+    blobRef: BlobRefSchema
+  }).strict(),
+  z.object({
+    requestId: z.uuid(),
+    eventId: z.uuid(),
+    cursor: z.number().int().positive(),
+    surface: AgentContentReadSurfaceSchema,
+    actor: AgentContentActorSchema,
+    agentRef: AgentRefSchema,
+    sessionRef: EGRESS_SESSION_REF,
+    runtime: RuntimeIdSchema,
+    cwd: AGENT_CONTENT_CWD,
+    policyRevision: AgentEgressPolicyRevisionSchema,
+    target: AGENT_CONTENT_TARGET,
+    mimeType: AgentContentMimeTypeSchema,
+    decodeAs: AgentContentDecodeAsSchema,
+    decision: z.literal("denied"),
+    byteCount: z.literal(0),
+    reason: AgentContentReadDenialReasonSchema
+  }).strict()
+]).superRefine((value, ctx) => {
+  if (value.decision !== "allowed") return;
+  if (value.blobRef.size !== value.byteCount) {
+    ctx.addIssue({ code: "custom", path: ["blobRef", "size"], message: "blobRef size must equal byteCount" });
+  }
+  if (value.blobRef.contentHash !== value.contentHash) {
+    ctx.addIssue({ code: "custom", path: ["blobRef", "contentHash"], message: "blobRef contentHash must equal contentHash" });
+  }
+  if (value.blobRef.contentType !== value.mimeType) {
+    ctx.addIssue({ code: "custom", path: ["blobRef", "contentType"], message: "blobRef contentType must equal mimeType" });
+  }
+});
 var TaskApprovePayloadSchema = z.object({
   approvalId: z.string().optional()
 });
@@ -208,13 +427,15 @@ var TaskSteerPayloadSchema = z.object({
 var TaskClaimPayloadSchema = z.object({
   deviceId: z.string(),
   agentId: z.string().optional(),
+  agentRef: AgentRefSchema.optional(),
   runtime: RuntimeIdSchema.optional(),
   capabilities: RuntimeCapabilitiesSchema.optional()
 });
 var TaskStartedPayloadSchema = z.object({});
 var TaskDeclinePayloadSchema = z.object({
   reason: z.string(),
-  retryable: z.boolean().optional()
+  retryable: z.boolean().optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskProgressPayloadSchema = z.object({
   seq: z.number().int(),
@@ -280,20 +501,52 @@ function checkResultDocument(document) {
   if (!isSameJsonData(document, canonical)) return { ok: false, reason: "not-plain-json" };
   return { ok: true, bytes, canonical };
 }
+var TERMINAL_INFERENCE_USAGE_MAX_TOKENS = 1e9;
+var TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS = 6048e5;
+var TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH = 160;
+var TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH = 160;
+var TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH = 128;
+var TerminalInferenceUsageNumberSchema = z.number().int().safe().nonnegative().max(TERMINAL_INFERENCE_USAGE_MAX_TOKENS);
+var TerminalInferenceUsageDurationSchema = z.number().int().safe().nonnegative().max(TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS);
+var TerminalInferenceReportedAtSchema = z.iso.datetime({ offset: true, precision: 3 }).refine((value) => value.endsWith("Z"), "reportedAt must be canonical UTC (Z)");
+var TerminalInferenceUsageSchema = z.object({
+  /** The adapter that actually started this task, never a requested fallback. */
+  runtime: RuntimeIdSchema,
+  /** Omitted unless the adapter itself exposed this provider observation. */
+  provider: z.string().min(1).max(TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH).optional(),
+  /** Omitted unless the adapter itself exposed this model observation. */
+  model: z.string().min(1).max(TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH).optional(),
+  /** Direct projection of the runtime's final observed input token count. */
+  promptTokens: TerminalInferenceUsageNumberSchema.optional(),
+  /** Direct projection of the runtime's final observed output token count. */
+  completionTokens: TerminalInferenceUsageNumberSchema.optional(),
+  /** Device-observed elapsed duration for the started task. */
+  durationMs: TerminalInferenceUsageDurationSchema.optional(),
+  /** Process-immutable Local Agent release version, owned outside the protocol. */
+  clientVersion: z.string().min(1).max(TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH),
+  /** Device observation time, never server receipt time. */
+  reportedAt: TerminalInferenceReportedAtSchema
+});
 var TaskCompletePayloadSchema = z.object({
   summary: z.string(),
   sessionRef: z.string(),
   artifactRefs: z.array(BlobRefSchema).optional(),
   document: z.unknown().optional().refine((value) => value === void 0 || checkResultDocument(value).ok, {
     message: `task.complete.document must be plain JSON data (equal to its own JSON round trip) and at most ${RESULT_DOCUMENT_MAX_BYTES} bytes as canonical JSON (UTF-8)`
-  })
+  }),
+  usage: TerminalInferenceUsageSchema.optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskFailPayloadSchema = z.object({
   reason: z.string(),
-  retryable: z.boolean().optional()
+  retryable: z.boolean().optional(),
+  usage: TerminalInferenceUsageSchema.optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskCancelledPayloadSchema = z.object({
-  reason: z.string().optional()
+  reason: z.string().optional(),
+  usage: TerminalInferenceUsageSchema.optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskApprovalResolvedPayloadSchema = z.object({
   approvalId: z.string(),
@@ -306,6 +559,12 @@ var MESSAGE_PAYLOAD_SCHEMAS = {
   "conn.ack": ConnAckPayloadSchema,
   "task.offer": TaskOfferPayloadSchema,
   "task.offer_with_toolsets": TaskOfferWithToolsetsPayloadSchema,
+  "task.offer_for_agent": TaskOfferForAgentPayloadSchema,
+  "task.offer_for_agent_with_egress": TaskOfferForAgentWithEgressPayloadSchema,
+  "agent.egress.reliable": AgentEgressReliablePayloadSchema,
+  "agent.egress.ack": AgentEgressAckPayloadSchema,
+  "agent.content.read": AgentContentReadPayloadSchema,
+  "agent.content.receipt": AgentContentReceiptPayloadSchema,
   "task.approve": TaskApprovePayloadSchema,
   "task.reject": TaskRejectPayloadSchema,
   "task.cancel": TaskCancelPayloadSchema,
@@ -326,6 +585,10 @@ var SERVER_TO_DAEMON_TYPES = [
   "conn.ack",
   "task.offer",
   "task.offer_with_toolsets",
+  "task.offer_for_agent",
+  "task.offer_for_agent_with_egress",
+  "agent.egress.ack",
+  "agent.content.read",
   "task.approve",
   "task.reject",
   "task.cancel",
@@ -341,7 +604,9 @@ var DAEMON_TO_SERVER_TYPES = [
   "task.complete",
   "task.fail",
   "task.cancelled",
-  "task.approval_resolved"
+  "task.approval_resolved",
+  "agent.egress.reliable",
+  "agent.content.receipt"
 ];
 var REQUIRED_TASK_ID = z.string().min(1);
 var OPTIONAL_TASK_ID = REQUIRED_TASK_ID.optional();
@@ -369,6 +634,10 @@ var EnvelopeSchema = z.discriminatedUnion("type", [
   // (per-device redelivery cursor).
   envelopeShape("task.offer", REQUIRED_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.offer_with_toolsets", REQUIRED_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("task.offer_for_agent", REQUIRED_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("task.offer_for_agent_with_egress", REQUIRED_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("agent.egress.ack", OPTIONAL_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("agent.content.read", OPTIONAL_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.approve", REQUIRED_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.reject", REQUIRED_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.cancel", REQUIRED_TASK_ID, REQUIRED_SEQ),
@@ -385,7 +654,9 @@ var EnvelopeSchema = z.discriminatedUnion("type", [
   envelopeShape("task.complete", REQUIRED_TASK_ID, OPTIONAL_SEQ),
   envelopeShape("task.fail", REQUIRED_TASK_ID, OPTIONAL_SEQ),
   envelopeShape("task.cancelled", REQUIRED_TASK_ID, OPTIONAL_SEQ),
-  envelopeShape("task.approval_resolved", REQUIRED_TASK_ID, OPTIONAL_SEQ)
+  envelopeShape("task.approval_resolved", REQUIRED_TASK_ID, OPTIONAL_SEQ),
+  envelopeShape("agent.egress.reliable", OPTIONAL_TASK_ID, OPTIONAL_SEQ),
+  envelopeShape("agent.content.receipt", OPTIONAL_TASK_ID, OPTIONAL_SEQ)
 ]);
 function isServerToDaemonType(type) {
   return SERVER_TO_DAEMON_TYPES.includes(type);
@@ -502,6 +773,23 @@ var TokenResponseSchema = z.object({
   accessToken: z.string(),
   expiresAt: z.iso.datetime({ offset: true })
 });
+var PRESENCE_DETAIL_MAX_LENGTH = 512;
+var PRESENCE_RUNTIME_VERSION_MAX_LENGTH = 128;
+var PresenceRuntimeFactSchema = z.object({
+  id: RuntimeIdSchema,
+  version: z.string().min(1).max(PRESENCE_RUNTIME_VERSION_MAX_LENGTH).optional(),
+  authPresent: z.boolean().optional()
+});
+var PresencePublishRequestSchema = z.object({
+  level: z.enum(["online", "thinking", "working", "error", "offline"]),
+  detail: z.string().max(PRESENCE_DETAIL_MAX_LENGTH).optional(),
+  configuredToolsets: ConfiguredToolsetsSchema.optional(),
+  /** U4a Local Agent release version; never inferred from a host package. */
+  clientVersion: z.string().min(1).max(128).optional(),
+  protocolVersions: z.array(ProtocolVersionNumberSchema).max(16).optional(),
+  /** Runtime version/auth facts from the same real probe as conn.hello. */
+  runtimes: z.array(PresenceRuntimeFactSchema).max(16).optional()
+});
 var CreateBlobRequestSchema = z.object({
   size: z.number().int().nonnegative(),
   contentType: z.string(),
@@ -575,6 +863,6 @@ function byokBlobContentPath(blobId) {
   return `/byok/blobs/${blobId}/content`;
 }
 
-export { AgentEventOrUnknownSchema, AgentEventSchema, BYOK_ACTIVITY_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BYOK_WS_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, KNOWN_AGENT_EVENT_TYPES, MAX_MESSAGES_PER_BATCH, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessagesSendRequestSchema, MessagesSendResponseSchema, PERMISSION_MODES, PROTOCOL_VERSION, PairRequestSchema, PairResponseSchema, PermissionPolicySchema, ProtocolError, RESULT_DOCUMENT_MAX_BYTES, RequiredToolsetsSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SERVER_TO_DAEMON_TYPES, TASK_STATES, TASK_TRANSITIONS, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isServerToDaemonType, parseMessage, partitionAgentEvents };
+export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_REF_MAX_BYTES, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentContentReadPayloadSchema, AgentContentReadSurfaceSchema, AgentContentReceiptPayloadSchema, AgentEgressAckPayloadSchema, AgentEgressActivityPolicySchema, AgentEgressContentHashSchema, AgentEgressDropReasonSchema, AgentEgressLaneSchema, AgentEgressPolicyRevisionSchema, AgentEgressPolicySchema, AgentEgressReliablePayloadSchema, AgentEventOrUnknownSchema, AgentEventSchema, AgentRefSchema, AgentReliableQuotaPolicySchema, BYOK_ACTIVITY_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BYOK_WS_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, ContentReadPolicySchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, KNOWN_AGENT_EVENT_TYPES, MAX_MESSAGES_PER_BATCH, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessagesSendRequestSchema, MessagesSendResponseSchema, PERMISSION_MODES, PROTOCOL_VERSION, PairRequestSchema, PairResponseSchema, PermissionPolicySchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, RESULT_DOCUMENT_MAX_BYTES, RequiredToolsetsSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SERVER_TO_DAEMON_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalInferenceUsageSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isServerToDaemonType, parseMessage, partitionAgentEvents };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map