@byok-sdk/server 0.2.0 → 0.4.0

package/README.md

@@ -4,7 +4,25 @@ The self-hosted SaaS-side reference coordinator: pairing, authenticated device
 HTTP/WebSocket/long-poll transport, task leasing, approvals, and in-memory
 stores over the frozen v1 protocol.
 
-Use `@byok-sdk/cloud` plus `@byok-sdk/cloud-postgres` for the durable hosted
+Use `@byok-sdk/cloud` plus `@byok-sdk/cloud-dataplane` for the durable hosted
 composition.
 
+Toolset-aware dispatch names logical device-local MCP toolsets; it never sends
+their commands or credentials:
+
+```ts
+const task = await server.dispatch({
+  deviceId,
+  instruction: 'Find five qualified prospects and draft follow-ups.',
+  runtime: 'claude',
+  policy: { mode: 'auto' },
+  requiredToolsets: ['salesko.prospecting'],
+});
+```
+
+The self-hosted coordinator rejects this call before task creation unless the
+live device advertises `toolset-selection` and its `configuredToolsets`
+inventory contains every required ID. `machines.list()` projects that same
+logical-ID-only inventory; MCP commands and credentials remain device-local.
+
 MIT licensed. Node.js 22.19.0 or newer.

package/dist/auth.d.ts

@@ -16,14 +16,19 @@ export declare const ACCESS_TOKEN_TTL_SECONDS: number;
  * another, and an attacker who can get a device to sign anything shaped like
  * a nonce holds a token-renewal credential.
  *
- * The client signs the same literal (`packages/client/src/daemon/device-keys.ts`).
+ * The literal lives in `@byok-sdk/core` (`src/pairing.ts`) and the client signs
+ * the same binding (`packages/client/src/daemon/device-keys.ts`) — it used to
+ * be three copies, each commented as byte-identical to the other two, which is
+ * an agreement that holds only until someone edits one. Re-exported here so
+ * this module's public surface is unchanged.
+ *
  * There is deliberately no dual mode: a raw, unprefixed nonce signature is
  * simply invalid here, with no flag, fallback, or grace window that would
  * make the old encoding acceptable again. Because the four packages have no
  * published compatibility contract yet, the recovery path for a device on
  * the old encoding is a re-pair, not a server-side shim.
  */
-export declare const NONCE_SIGNING_DOMAIN = "byok-nonce-v1\n";
+export { NONCE_SIGNING_DOMAIN } from '@byok-sdk/core';
 /**
  * S1: server-local tenant identifier. A plain string alias for now — S2 moves
  * the branded/shared form into `@byok-sdk/core`, which does not exist yet, and
@@ -133,16 +138,23 @@ export declare class NonceStore {
 }
 /**
  * The ONLY nonce-signature check on this server (§6.2): the signed message is
- * {@link NONCE_SIGNING_DOMAIN} followed by the nonce. Applying the domain here
- * rather than at the call site is the point — there is one place that decides
- * what a device signature over a nonce means, so no route can be written that
- * accepts the undomained form.
+ * core's `nonceSigningBytes` — the domain followed by the nonce. Applying the
+ * domain here rather than at the call site is the point — there is one place
+ * that decides what a device signature over a nonce means, so no route can be
+ * written that accepts the undomained form.
  */
 export declare function verifyNonceSignature(devicePublicKey: string, nonce: string, signature: string): boolean;
 export declare function extractBearerToken(header: string | undefined): string | undefined;
 export interface AuthDeps {
     tokenSigner: TokenSigner;
     devices: DeviceRegistry;
+    /**
+     * The product THIS server instance serves (`createByokServer`'s
+     * `productId`). Part of authentication, not of routing: a device row paired
+     * into another product is not a principal here at all — see
+     * {@link authenticateBearer}.
+     */
+    productId: string;
 }
 /**
  * S1: the authenticated principal every authed surface works with. Built from
@@ -163,9 +175,19 @@ export interface AuthenticatedDevice {
  * S1 shape: the token's `(tenantId, deviceId)` are LOOKUP KEYS into the
  * registry, and the row that comes back is the authority. A token for a
  * device that no longer exists, one whose tenant does not own that device,
- * one whose product disagrees with the row, and one for a revoked device all
- * fail identically here and are indistinguishable to the caller — there is
- * deliberately no "which of those was it" signal to hand back, so no route
- * can turn a 401 into a cross-tenant existence oracle.
+ * one whose product disagrees with the row, one whose row belongs to a
+ * different product than this instance serves, and one for a revoked device
+ * all fail identically here and are indistinguishable to the caller — there
+ * is deliberately no "which of those was it" signal to hand back, so no route
+ * can turn a 401 into a cross-tenant (or cross-product) existence oracle.
+ *
+ * The last two checks are different facts and both are needed. Row vs claims
+ * says "the token belongs to this row"; row vs instance says "this row
+ * belongs to the product this server serves" — a single server can mint
+ * pairing codes for any product (`createPairingCode` takes the claims per
+ * code), so a row from another product is a real row holding a real token
+ * and is still not a principal here. `conn.hello`'s own product checks
+ * (`ws-server.ts`) validate the client's ANNOUNCEMENT, which is a third fact
+ * and stays where it is.
  */
 export declare function authenticateBearer(header: string | undefined, deps: AuthDeps): Promise<AuthenticatedDevice | undefined>;

package/dist/hub.d.ts

@@ -1,5 +1,5 @@
 import type { WebSocket } from 'ws';
-import { type Envelope, type RuntimeId, type RuntimeInfo, type TaskState } from '@byok-sdk/protocol';
+import { type Envelope, type RuntimeId, type RuntimeInfo, type TaskState, type ToolsetId } from '@byok-sdk/protocol';
 import type { DeviceRegistry } from './auth';
 import { RateLimiter } from './rate-limiter';
 import type { TaskStore } from './task-store';
@@ -29,7 +29,7 @@ import type { ByokServerEvent, DispatchInput, HubStats, MachineInfo, TaskHandle,
  * handlers below no longer carry their own device-mismatch checks.
  *
  * Outbound delivery (M1, §1.2/§9): every server -> daemon envelope
- * (`conn.ack`, `task.offer/approve/reject/cancel/steer`) gets a fresh
+ * (`conn.ack`, either task offer, `task.approve/reject/cancel/steer`) gets a fresh
  * per-device monotonic `seq` and is retained in a capped ring buffer
  * ({@link OUTBOX_RING_CAPACITY} entries) so it can be redelivered — in `seq`
  * order, skipping anything whose task has since reached a terminal state —
@@ -276,7 +276,7 @@ export declare class ConnectionHub {
      * connection this hub never learns capabilities for simply reads back
      * `undefined` from {@link getDeviceCapabilities}.
      */
-    registerConnection(deviceId: string, ws: WebSocket, runtimes: RuntimeInfo[] | undefined, capabilities?: readonly string[]): void;
+    registerConnection(deviceId: string, ws: WebSocket, runtimes: RuntimeInfo[] | undefined, capabilities?: readonly string[], configuredToolsets?: readonly ToolsetId[]): void;
     sendConnAck(deviceId: string, capabilities: string[]): void;
     /**
      * Reconnection procedure step 3 (§9): redeliver, in `seq` order, every