@byok-sdk/protocol 0.6.0 → 0.7.0

package/dist/index.d.ts

@@ -6,14 +6,16 @@ export { PermissionPolicySchema, PERMISSION_MODES } from './permission';
 export type { PermissionPolicy, PermissionMode } from './permission';
 export { AgentEventSchema, UnknownAgentEventSchema, AgentEventOrUnknownSchema, KNOWN_AGENT_EVENT_TYPES, isKnownAgentEvent, partitionAgentEvents, } from './agent-event';
 export type { AgentEvent, UnknownAgentEvent, AgentEventOrUnknown } from './agent-event';
+export { AgentEgressPolicySchema, AgentEgressActivityPolicySchema, AgentReliableQuotaPolicySchema, ContentReadPolicySchema, AgentEgressLaneSchema, AgentEgressDropReasonSchema, AgentContentReadSurfaceSchema, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentEgressContentHashSchema, AgentEgressPolicyRevisionSchema, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, } from './agent-egress';
+export type { AgentEgressPolicy, AgentEgressActivityPolicy, AgentReliableQuotaPolicy, ContentReadPolicy, AgentEgressLane, AgentEgressDropReason, AgentContentReadSurface, AgentContentActorKind, AgentContentActor, AgentContentDecodeAs, AgentContentReadDecision, AgentContentReadDenialReason, } from './agent-egress';
 export { TASK_STATES, TASK_TRANSITIONS, canTransition } from './task-state';
 export type { TaskState } from './task-state';
-export { MESSAGE_TYPES, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, RuntimeCapabilitiesSchema, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
-export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, } from './messages';
+export { MESSAGE_TYPES, MESSAGE_PAYLOAD_SCHEMAS, SERVER_TO_DAEMON_TYPES, DAEMON_TO_SERVER_TYPES, RuntimeIdSchema, ProtocolVersionNumberSchema, RuntimeInfoSchema, RuntimeCapabilitiesSchema, AgentRefSchema, AGENT_REF_MAX_BYTES, DispatchSelectionSchema, ToolsetIdSchema, ConfiguredToolsetsSchema, RequiredToolsetsSchema, CONFIGURED_TOOLSETS_MAX_ITEMS, ConnHelloPayloadSchema, ConnAckPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, AgentEgressReliablePayloadSchema, AgentEgressAckPayloadSchema, AgentContentReadPayloadSchema, AgentContentReceiptPayloadSchema, TaskApprovePayloadSchema, TaskRejectPayloadSchema, TaskCancelPayloadSchema, TaskSteerPayloadSchema, TaskClaimPayloadSchema, TaskStartedPayloadSchema, TaskDeclinePayloadSchema, TaskProgressPayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCompletePayloadSchema, TaskFailPayloadSchema, TaskCancelledPayloadSchema, TaskApprovalResolvedPayloadSchema, RESULT_DOCUMENT_MAX_BYTES, checkResultDocument, TerminalInferenceUsageSchema, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, } from './messages';
+export type { ResultDocumentCheck, MessageType, RuntimeId, RuntimeInfo, RuntimeCapabilities, AgentRef, DispatchSelection, ToolsetId, ConnHelloPayload, ConnAckPayload, TaskOfferPayload, TaskOfferWithToolsetsPayload, TaskOfferForAgentPayload, TaskOfferForAgentWithEgressPayload, AgentEgressReliablePayload, AgentEgressAckPayload, AgentContentReadPayload, AgentContentReceiptPayload, TaskApprovePayload, TaskRejectPayload, TaskCancelPayload, TaskSteerPayload, TaskClaimPayload, TaskStartedPayload, TaskDeclinePayload, TaskProgressPayload, TaskArtifactPayload, TaskAwaitApprovalPayload, TaskCompletePayload, TaskFailPayload, TaskCancelledPayload, TaskApprovalResolvedPayload, TerminalInferenceUsage, } from './messages';
 export { EnvelopeSchema, isServerToDaemonType } from './envelope';
 export type { Envelope } from './envelope';
 export { ProtocolError, EnvelopeParseError, UnknownMessageTypeError, EnvelopeValidationError, } from './errors';
 export { encodeEnvelope, decodeEnvelope, createEnvelope, parseMessage } from './codec';
 export type { CreateEnvelopeOptions } from './codec';
-export { PairRequestSchema, PairResponseSchema, ChallengeRequestSchema, ChallengeResponseSchema, TokenRequestSchema, TokenResponseSchema, PresencePublishRequestSchema, CreateBlobRequestSchema, CreateBlobResponseSchema, BlobDownloadUrlResponseSchema, EventsPollQuerySchema, EventsPollResponseSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, MAX_MESSAGES_PER_BATCH, BYOK_WS_PATH, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_BOARD_PATH, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, byokRecordPath, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, byokSkillPackFilePath, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, byokBlobFinalizePath, byokBlobUrlPath, byokBlobContentPath, } from './http-api';
+export { PairRequestSchema, PairResponseTenantIdSchema, PAIR_RESPONSE_TENANT_ID_MAX_LENGTH, PairResponseSchema, ChallengeRequestSchema, ChallengeResponseSchema, TokenRequestSchema, TokenResponseSchema, PresencePublishRequestSchema, CreateBlobRequestSchema, CreateBlobResponseSchema, BlobDownloadUrlResponseSchema, EventsPollQuerySchema, EventsPollResponseSchema, MessagesSendRequestSchema, MessagesSendResponseSchema, MAX_MESSAGES_PER_BATCH, BYOK_WS_PATH, BYOK_PAIR_PATH, BYOK_CHALLENGE_PATH, BYOK_TOKEN_PATH, BYOK_CAPABILITIES_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PRESENCE_PATH, BYOK_ACTIVITY_PATH, BYOK_BOARD_PATH, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_BOARD_STATUS_ROUTE, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, byokRecordPath, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, byokSkillPackFilePath, BYOK_BLOBS_PATH, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BLOB_CONTENT_ROUTE, byokBlobFinalizePath, byokBlobUrlPath, byokBlobContentPath, } from './http-api';
 export type { PairRequest, PairResponse, ChallengeRequest, ChallengeResponse, TokenRequest, TokenResponse, PresencePublishRequest, CreateBlobRequest, CreateBlobResponse, BlobDownloadUrlResponse, EventsPollQuery, EventsPollResponse, MessagesSendRequest, MessagesSendResponse, } from './http-api';

package/dist/index.js

@@ -1,5 +1,89 @@
 import { z } from 'zod';
 
+// src/agent-egress.ts
+var AGENT_EGRESS_POLICY_CAPABILITY = "agent-egress-policy";
+var AGENT_EGRESS_RELIABLE_ACK_CAPABILITY = "agent-egress-reliable-ack";
+var AGENT_CONTENT_WORKSPACE_READ_CAPABILITY = "agent-content-workspace-read";
+var AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY = "agent-content-transcript-read";
+var AGENT_CONTENT_ARTIFACT_READ_CAPABILITY = "agent-content-artifact-read";
+var POLICY_REVISION = z.string().min(1).max(160).regex(/^[^\u0000-\u001f\u007f\r\n]+$/u, "policyRevision must not contain control characters");
+var POSITIVE_LIMIT = z.number().int().positive().max(2147483647);
+var AgentContentMimeTypeSchema = z.string().min(3).max(255).regex(/^[a-z0-9!#$&^_.+-]+\/[a-z0-9!#$&^_.+-]+$/iu, "MIME types must be explicit type/subtype values");
+var ContentReadPolicySchema = z.object({
+  maxBytes: POSITIVE_LIMIT,
+  allowedMimeTypes: z.array(AgentContentMimeTypeSchema).min(1).max(32)
+}).strict();
+var AgentEgressActivityPolicySchema = z.discriminatedUnion("mode", [
+  z.object({
+    mode: z.literal("metadata-status"),
+    delivery: z.literal("latest-value")
+  }).strict(),
+  z.object({
+    mode: z.literal("contentful-trajectory"),
+    delivery: z.literal("latest-value"),
+    maxCoalesceMs: POSITIVE_LIMIT,
+    maxEventBytes: POSITIVE_LIMIT
+  }).strict()
+]);
+var AgentReliableQuotaPolicySchema = z.object({
+  maxPendingEventsPerAgent: POSITIVE_LIMIT,
+  maxPendingBytesPerAgent: POSITIVE_LIMIT,
+  maxPendingBytesPerTenant: POSITIVE_LIMIT
+}).strict();
+var AgentEgressPolicySchema = z.object({
+  policyRevision: POLICY_REVISION,
+  activity: AgentEgressActivityPolicySchema,
+  reliable: AgentReliableQuotaPolicySchema,
+  transfers: z.object({
+    workspace: z.union([z.literal("disabled"), ContentReadPolicySchema]),
+    transcript: z.union([z.literal("disabled"), ContentReadPolicySchema]),
+    artifact: z.union([z.literal("disabled"), ContentReadPolicySchema])
+  }).strict()
+}).strict();
+var AgentEgressLaneSchema = z.enum(["reliable", "latest-value"]);
+var AgentEgressDropReasonSchema = z.enum([
+  "policy_denied",
+  "capability_missing",
+  "sanitizer_rejected",
+  "quota_exceeded",
+  "backpressure",
+  "coalesced",
+  "disconnected",
+  "invalid_envelope",
+  "ack_mismatch"
+]);
+var AgentContentReadSurfaceSchema = z.enum(["workspace", "transcript", "artifact"]);
+var AgentContentActorKindSchema = z.enum(["user", "agent", "system"]);
+var AgentContentActorSchema = z.object({
+  kind: AgentContentActorKindSchema,
+  id: z.string().min(1).max(512).regex(/^[^\u0000-\u001f\u007f]+$/u, "actor id must not contain control characters")
+}).strict();
+var AgentContentDecodeAsSchema = z.enum(["bytes", "utf8"]);
+var AgentContentReadDecisionSchema = z.enum(["allowed", "denied"]);
+var AgentContentReadDenialReasonSchema = z.enum([
+  "invalid-request",
+  "policy-disabled",
+  "capability-missing",
+  "policy-revision-mismatch",
+  "absolute-target",
+  "non-relative-target",
+  "dot-segment",
+  "sensitive-name",
+  "root-not-allowlisted",
+  "root-invalid",
+  "path-escape",
+  "target-missing",
+  "symlink",
+  "not-regular-file",
+  "byte-limit",
+  "mime-not-allowlisted",
+  "text-not-allowlisted",
+  "text-decode-failed",
+  "identity-mismatch"
+]);
+var AgentEgressContentHashSchema = z.string().regex(/^sha256:[a-f0-9]{64}$/u, "contentHash must be a lowercase SHA-256 digest");
+var AgentEgressPolicyRevisionSchema = POLICY_REVISION;
+
 // src/version.ts
 var PROTOCOL_VERSION = 1;
 var CAPABILITY_FLAGS = [
@@ -10,7 +94,13 @@ var CAPABILITY_FLAGS = [
   "approval-targeting",
   "result-document",
   "dispatch-selection",
-  "toolset-selection"
+  "toolset-selection",
+  "agent-home-contract",
+  AGENT_EGRESS_POLICY_CAPABILITY,
+  AGENT_EGRESS_RELIABLE_ACK_CAPABILITY,
+  AGENT_CONTENT_WORKSPACE_READ_CAPABILITY,
+  AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY,
+  AGENT_CONTENT_ARTIFACT_READ_CAPABILITY
 ];
 var CONTENT_HASH_RE = /^sha256:[0-9a-f]{64}$/;
 var BlobRefSchema = z.object({
@@ -129,6 +219,21 @@ var RuntimeInfoSchema = z.object({
 });
 var CONFIGURED_TOOLSETS_MAX_ITEMS = 64;
 var ToolsetIdSchema = z.string().min(1).max(128).regex(/^[a-z0-9]+(?:[._-][a-z0-9]+)*$/u, "toolset ids must be lowercase logical identifiers");
+var AGENT_REF_MAX_BYTES = 160;
+var AGENT_REF_VALUE = z.string().min(1).max(AGENT_REF_MAX_BYTES).refine((value) => new TextEncoder().encode(value).byteLength <= AGENT_REF_MAX_BYTES, {
+  message: `AgentRef values must not exceed ${AGENT_REF_MAX_BYTES} UTF-8 bytes`
+}).regex(/^[^\u0000-\u001f\u007f\r\n]+$/u, "AgentRef values must not contain control characters");
+var WINDOWS_RESERVED_AGENT_SEGMENT = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
+var AgentRefSchema = z.object({
+  agentId: AGENT_REF_VALUE.regex(/^[^\\/:<>"|?*]+$/u, "agentId must be one portable pathname segment").refine(
+    (value) => value !== "." && value !== "..",
+    "agentId must not be a dot segment"
+  ).refine(
+    (value) => !/[. ]$/u.test(value) && !WINDOWS_RESERVED_AGENT_SEGMENT.test(value),
+    "agentId must be a portable Windows-safe pathname segment"
+  ),
+  profileRevision: AGENT_REF_VALUE
+}).strict();
 function rejectDuplicateToolsets(ids, ctx, label) {
   const seen = /* @__PURE__ */ new Set();
   for (const [index, id] of ids.entries()) {
@@ -195,6 +300,117 @@ var RequiredToolsetsSchema = z.array(ToolsetIdSchema).min(1).max(16).superRefine
 var TaskOfferWithToolsetsPayloadSchema = TaskOfferPayloadSchema.extend({
   requiredToolsets: RequiredToolsetsSchema
 }).strict();
+var TaskOfferForAgentPayloadSchema = z.object({
+  instruction: z.union([z.string(), InstructionBlobRefSchema]),
+  policy: PermissionPolicySchema,
+  agentRef: AgentRefSchema,
+  requiredToolsets: RequiredToolsetsSchema.optional(),
+  runtime: RuntimeIdSchema.optional(),
+  dispatchSelection: DispatchSelectionSchema.optional(),
+  sessionRef: z.string().optional(),
+  limits: z.object({
+    maxDurationMs: z.number().int().positive().optional(),
+    maxTokens: z.number().int().positive().optional()
+  }).optional()
+}).strict();
+var TaskOfferForAgentWithEgressPayloadSchema = TaskOfferForAgentPayloadSchema.extend({
+  sessionRef: z.string().min(1).max(512),
+  egressPolicy: AgentEgressPolicySchema
+}).strict();
+var EGRESS_SAFE_VALUE = z.json().refine(
+  (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 256 * 1024,
+  "sanitized egress payload exceeds 256KiB"
+);
+var EGRESS_SESSION_REF = z.string().min(1).max(512);
+var AgentEgressReliablePayloadSchema = z.object({
+  agentRef: AgentRefSchema,
+  sessionRef: EGRESS_SESSION_REF,
+  policyRevision: AgentEgressPolicyRevisionSchema,
+  eventId: z.uuid(),
+  cursor: z.number().int().positive(),
+  payload: EGRESS_SAFE_VALUE,
+  contentHash: AgentEgressContentHashSchema,
+  byteCount: z.number().int().nonnegative().max(256 * 1024)
+}).strict();
+var AgentEgressAckPayloadSchema = z.object({
+  agentRef: AgentRefSchema,
+  sessionRef: EGRESS_SESSION_REF,
+  policyRevision: AgentEgressPolicyRevisionSchema,
+  eventId: z.uuid(),
+  cursor: z.number().int().positive(),
+  receiptId: z.uuid()
+}).strict();
+var AGENT_CONTENT_TARGET = z.string().min(1).max(1024).regex(/^[^\u0000-\u001f\u007f]+$/u, "content target must not contain control characters").refine(
+  (value) => !value.startsWith("/") && !value.includes("\\") && value.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== ".."),
+  "content target must be a portable relative path without dot segments"
+);
+var AGENT_CONTENT_CWD = z.string().min(1).max(4096).regex(/^[^\u0000-\u001f\u007f]+$/u, "cwd must not contain control characters").regex(/^(?:\/|[A-Za-z]:[\\/])/u, "cwd must be absolute");
+var AgentContentReadPayloadSchema = z.object({
+  requestId: z.uuid(),
+  surface: AgentContentReadSurfaceSchema,
+  actor: AgentContentActorSchema,
+  agentRef: AgentRefSchema,
+  sessionRef: EGRESS_SESSION_REF,
+  runtime: RuntimeIdSchema,
+  cwd: AGENT_CONTENT_CWD,
+  policyRevision: AgentEgressPolicyRevisionSchema,
+  target: AGENT_CONTENT_TARGET,
+  mimeType: AgentContentMimeTypeSchema,
+  decodeAs: AgentContentDecodeAsSchema,
+  policy: ContentReadPolicySchema
+}).strict();
+var AgentContentReceiptPayloadSchema = z.discriminatedUnion("decision", [
+  z.object({
+    requestId: z.uuid(),
+    /** Stable reliable-delivery identity. Content receipts use their requestId. */
+    eventId: z.uuid(),
+    /** Stable positive cursor allocated by the durable Agent spool. */
+    cursor: z.number().int().positive(),
+    surface: AgentContentReadSurfaceSchema,
+    actor: AgentContentActorSchema,
+    agentRef: AgentRefSchema,
+    sessionRef: EGRESS_SESSION_REF,
+    runtime: RuntimeIdSchema,
+    cwd: AGENT_CONTENT_CWD,
+    policyRevision: AgentEgressPolicyRevisionSchema,
+    target: AGENT_CONTENT_TARGET,
+    mimeType: AgentContentMimeTypeSchema,
+    decodeAs: AgentContentDecodeAsSchema,
+    decision: z.literal("allowed"),
+    byteCount: z.number().int().nonnegative(),
+    contentHash: AgentEgressContentHashSchema,
+    blobRef: BlobRefSchema
+  }).strict(),
+  z.object({
+    requestId: z.uuid(),
+    eventId: z.uuid(),
+    cursor: z.number().int().positive(),
+    surface: AgentContentReadSurfaceSchema,
+    actor: AgentContentActorSchema,
+    agentRef: AgentRefSchema,
+    sessionRef: EGRESS_SESSION_REF,
+    runtime: RuntimeIdSchema,
+    cwd: AGENT_CONTENT_CWD,
+    policyRevision: AgentEgressPolicyRevisionSchema,
+    target: AGENT_CONTENT_TARGET,
+    mimeType: AgentContentMimeTypeSchema,
+    decodeAs: AgentContentDecodeAsSchema,
+    decision: z.literal("denied"),
+    byteCount: z.literal(0),
+    reason: AgentContentReadDenialReasonSchema
+  }).strict()
+]).superRefine((value, ctx) => {
+  if (value.decision !== "allowed") return;
+  if (value.blobRef.size !== value.byteCount) {
+    ctx.addIssue({ code: "custom", path: ["blobRef", "size"], message: "blobRef size must equal byteCount" });
+  }
+  if (value.blobRef.contentHash !== value.contentHash) {
+    ctx.addIssue({ code: "custom", path: ["blobRef", "contentHash"], message: "blobRef contentHash must equal contentHash" });
+  }
+  if (value.blobRef.contentType !== value.mimeType) {
+    ctx.addIssue({ code: "custom", path: ["blobRef", "contentType"], message: "blobRef contentType must equal mimeType" });
+  }
+});
 var TaskApprovePayloadSchema = z.object({
   approvalId: z.string().optional()
 });
@@ -211,13 +427,15 @@ var TaskSteerPayloadSchema = z.object({
 var TaskClaimPayloadSchema = z.object({
   deviceId: z.string(),
   agentId: z.string().optional(),
+  agentRef: AgentRefSchema.optional(),
   runtime: RuntimeIdSchema.optional(),
   capabilities: RuntimeCapabilitiesSchema.optional()
 });
 var TaskStartedPayloadSchema = z.object({});
 var TaskDeclinePayloadSchema = z.object({
   reason: z.string(),
-  retryable: z.boolean().optional()
+  retryable: z.boolean().optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskProgressPayloadSchema = z.object({
   seq: z.number().int(),
@@ -316,16 +534,19 @@ var TaskCompletePayloadSchema = z.object({
   document: z.unknown().optional().refine((value) => value === void 0 || checkResultDocument(value).ok, {
     message: `task.complete.document must be plain JSON data (equal to its own JSON round trip) and at most ${RESULT_DOCUMENT_MAX_BYTES} bytes as canonical JSON (UTF-8)`
   }),
-  usage: TerminalInferenceUsageSchema.optional()
+  usage: TerminalInferenceUsageSchema.optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskFailPayloadSchema = z.object({
   reason: z.string(),
   retryable: z.boolean().optional(),
-  usage: TerminalInferenceUsageSchema.optional()
+  usage: TerminalInferenceUsageSchema.optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskCancelledPayloadSchema = z.object({
   reason: z.string().optional(),
-  usage: TerminalInferenceUsageSchema.optional()
+  usage: TerminalInferenceUsageSchema.optional(),
+  agentRef: AgentRefSchema.optional()
 });
 var TaskApprovalResolvedPayloadSchema = z.object({
   approvalId: z.string(),
@@ -338,6 +559,12 @@ var MESSAGE_PAYLOAD_SCHEMAS = {
   "conn.ack": ConnAckPayloadSchema,
   "task.offer": TaskOfferPayloadSchema,
   "task.offer_with_toolsets": TaskOfferWithToolsetsPayloadSchema,
+  "task.offer_for_agent": TaskOfferForAgentPayloadSchema,
+  "task.offer_for_agent_with_egress": TaskOfferForAgentWithEgressPayloadSchema,
+  "agent.egress.reliable": AgentEgressReliablePayloadSchema,
+  "agent.egress.ack": AgentEgressAckPayloadSchema,
+  "agent.content.read": AgentContentReadPayloadSchema,
+  "agent.content.receipt": AgentContentReceiptPayloadSchema,
   "task.approve": TaskApprovePayloadSchema,
   "task.reject": TaskRejectPayloadSchema,
   "task.cancel": TaskCancelPayloadSchema,
@@ -358,6 +585,10 @@ var SERVER_TO_DAEMON_TYPES = [
   "conn.ack",
   "task.offer",
   "task.offer_with_toolsets",
+  "task.offer_for_agent",
+  "task.offer_for_agent_with_egress",
+  "agent.egress.ack",
+  "agent.content.read",
   "task.approve",
   "task.reject",
   "task.cancel",
@@ -373,7 +604,9 @@ var DAEMON_TO_SERVER_TYPES = [
   "task.complete",
   "task.fail",
   "task.cancelled",
-  "task.approval_resolved"
+  "task.approval_resolved",
+  "agent.egress.reliable",
+  "agent.content.receipt"
 ];
 var REQUIRED_TASK_ID = z.string().min(1);
 var OPTIONAL_TASK_ID = REQUIRED_TASK_ID.optional();
@@ -401,6 +634,10 @@ var EnvelopeSchema = z.discriminatedUnion("type", [
   // (per-device redelivery cursor).
   envelopeShape("task.offer", REQUIRED_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.offer_with_toolsets", REQUIRED_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("task.offer_for_agent", REQUIRED_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("task.offer_for_agent_with_egress", REQUIRED_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("agent.egress.ack", OPTIONAL_TASK_ID, REQUIRED_SEQ),
+  envelopeShape("agent.content.read", OPTIONAL_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.approve", REQUIRED_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.reject", REQUIRED_TASK_ID, REQUIRED_SEQ),
   envelopeShape("task.cancel", REQUIRED_TASK_ID, REQUIRED_SEQ),
@@ -417,7 +654,9 @@ var EnvelopeSchema = z.discriminatedUnion("type", [
   envelopeShape("task.complete", REQUIRED_TASK_ID, OPTIONAL_SEQ),
   envelopeShape("task.fail", REQUIRED_TASK_ID, OPTIONAL_SEQ),
   envelopeShape("task.cancelled", REQUIRED_TASK_ID, OPTIONAL_SEQ),
-  envelopeShape("task.approval_resolved", REQUIRED_TASK_ID, OPTIONAL_SEQ)
+  envelopeShape("task.approval_resolved", REQUIRED_TASK_ID, OPTIONAL_SEQ),
+  envelopeShape("agent.egress.reliable", OPTIONAL_TASK_ID, OPTIONAL_SEQ),
+  envelopeShape("agent.content.receipt", OPTIONAL_TASK_ID, OPTIONAL_SEQ)
 ]);
 function isServerToDaemonType(type) {
   return SERVER_TO_DAEMON_TYPES.includes(type);
@@ -510,12 +749,20 @@ var PairRequestSchema = z.object({
   /** Ed25519 public key, base64url-encoded. Private key stays device-local (OS keychain or 0600 file). */
   devicePublicKey: z.string()
 });
+var PAIR_RESPONSE_TENANT_ID_MAX_LENGTH = 200;
+var PairResponseTenantIdSchema = z.string().min(1).max(PAIR_RESPONSE_TENANT_ID_MAX_LENGTH).refine((value) => value.trim() === value, {
+  message: "tenantId must not have leading or trailing whitespace"
+}).refine((value) => !value.includes("\0"), {
+  message: "tenantId must not contain a NUL character"
+});
 var PairResponseSchema = z.object({
   deviceId: z.string(),
   /** JWT, ~1h lifetime. */
   accessToken: z.string(),
   /** Opaque hint for when/how to renew (e.g. an ISO timestamp); not itself a credential. */
-  refreshHint: z.string().optional()
+  refreshHint: z.string().optional(),
+  /** Exact opaque, non-secret tenant binding from the authenticated device row. */
+  tenantId: PairResponseTenantIdSchema
 });
 var ChallengeRequestSchema = z.object({
   deviceId: z.string()
@@ -624,6 +871,6 @@ function byokBlobContentPath(blobId) {
   return `/byok/blobs/${blobId}/content`;
 }
 
-export { AgentEventOrUnknownSchema, AgentEventSchema, BYOK_ACTIVITY_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BYOK_WS_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, KNOWN_AGENT_EVENT_TYPES, MAX_MESSAGES_PER_BATCH, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessagesSendRequestSchema, MessagesSendResponseSchema, PERMISSION_MODES, PROTOCOL_VERSION, PairRequestSchema, PairResponseSchema, PermissionPolicySchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, RESULT_DOCUMENT_MAX_BYTES, RequiredToolsetsSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SERVER_TO_DAEMON_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalInferenceUsageSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isServerToDaemonType, parseMessage, partitionAgentEvents };
+export { AGENT_CONTENT_ARTIFACT_READ_CAPABILITY, AGENT_CONTENT_TRANSCRIPT_READ_CAPABILITY, AGENT_CONTENT_WORKSPACE_READ_CAPABILITY, AGENT_EGRESS_POLICY_CAPABILITY, AGENT_EGRESS_RELIABLE_ACK_CAPABILITY, AGENT_REF_MAX_BYTES, AgentContentActorKindSchema, AgentContentActorSchema, AgentContentDecodeAsSchema, AgentContentMimeTypeSchema, AgentContentReadDecisionSchema, AgentContentReadDenialReasonSchema, AgentContentReadPayloadSchema, AgentContentReadSurfaceSchema, AgentContentReceiptPayloadSchema, AgentEgressAckPayloadSchema, AgentEgressActivityPolicySchema, AgentEgressContentHashSchema, AgentEgressDropReasonSchema, AgentEgressLaneSchema, AgentEgressPolicyRevisionSchema, AgentEgressPolicySchema, AgentEgressReliablePayloadSchema, AgentEventOrUnknownSchema, AgentEventSchema, AgentRefSchema, AgentReliableQuotaPolicySchema, BYOK_ACTIVITY_PATH, BYOK_BLOBS_PATH, BYOK_BLOB_CONTENT_ROUTE, BYOK_BLOB_FINALIZE_ROUTE, BYOK_BLOB_URL_ROUTE, BYOK_BOARD_CLAIM_ROUTE, BYOK_BOARD_PATH, BYOK_BOARD_STATUS_ROUTE, BYOK_BOARD_STREAM_PATH, BYOK_BOARD_UNCLAIM_ROUTE, BYOK_CAPABILITIES_PATH, BYOK_CHALLENGE_PATH, BYOK_EVENTS_PATH, BYOK_MESSAGES_PATH, BYOK_PAIR_PATH, BYOK_PRESENCE_PATH, BYOK_RECORDS_PATH, BYOK_RECORD_ROUTE, BYOK_SKILL_PACKS_PATH, BYOK_SKILL_PACK_FILE_ROUTE, BYOK_TOKEN_PATH, BYOK_WS_PATH, BlobDownloadUrlResponseSchema, BlobRefSchema, CAPABILITY_FLAGS, CONFIGURED_TOOLSETS_MAX_ITEMS, CONTENT_HASH_RE, ChallengeRequestSchema, ChallengeResponseSchema, ConfiguredToolsetsSchema, ConnAckPayloadSchema, ConnHelloPayloadSchema, ContentReadPolicySchema, CreateBlobRequestSchema, CreateBlobResponseSchema, DAEMON_TO_SERVER_TYPES, DispatchSelectionSchema, EnvelopeParseError, EnvelopeSchema, EnvelopeValidationError, EventsPollQuerySchema, EventsPollResponseSchema, KNOWN_AGENT_EVENT_TYPES, MAX_MESSAGES_PER_BATCH, MESSAGE_PAYLOAD_SCHEMAS, MESSAGE_TYPES, MessagesSendRequestSchema, MessagesSendResponseSchema, PAIR_RESPONSE_TENANT_ID_MAX_LENGTH, PERMISSION_MODES, PROTOCOL_VERSION, PairRequestSchema, PairResponseSchema, PairResponseTenantIdSchema, PermissionPolicySchema, PresencePublishRequestSchema, ProtocolError, ProtocolVersionNumberSchema, RESULT_DOCUMENT_MAX_BYTES, RequiredToolsetsSchema, RuntimeCapabilitiesSchema, RuntimeIdSchema, RuntimeInfoSchema, SERVER_TO_DAEMON_TYPES, TASK_STATES, TASK_TRANSITIONS, TERMINAL_INFERENCE_USAGE_CLIENT_VERSION_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_MAX_DURATION_MS, TERMINAL_INFERENCE_USAGE_MAX_TOKENS, TERMINAL_INFERENCE_USAGE_MODEL_MAX_LENGTH, TERMINAL_INFERENCE_USAGE_PROVIDER_MAX_LENGTH, TaskApprovalResolvedPayloadSchema, TaskApprovePayloadSchema, TaskArtifactPayloadSchema, TaskAwaitApprovalPayloadSchema, TaskCancelPayloadSchema, TaskCancelledPayloadSchema, TaskClaimPayloadSchema, TaskCompletePayloadSchema, TaskDeclinePayloadSchema, TaskFailPayloadSchema, TaskOfferForAgentPayloadSchema, TaskOfferForAgentWithEgressPayloadSchema, TaskOfferPayloadSchema, TaskOfferWithToolsetsPayloadSchema, TaskProgressPayloadSchema, TaskRejectPayloadSchema, TaskStartedPayloadSchema, TaskSteerPayloadSchema, TerminalInferenceUsageSchema, TokenRequestSchema, TokenResponseSchema, ToolsetIdSchema, UnknownAgentEventSchema, UnknownMessageTypeError, byokBlobContentPath, byokBlobFinalizePath, byokBlobUrlPath, byokRecordPath, byokSkillPackFilePath, canTransition, checkResultDocument, createEnvelope, decodeEnvelope, encodeEnvelope, isKnownAgentEvent, isServerToDaemonType, parseMessage, partitionAgentEvents };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map