@byollm/protocol 0.1.0-alpha.0 → 0.1.0-alpha.10

package/dist/index.d.ts

@@ -5,9 +5,10 @@ import { z } from 'zod';
  * Rev 1 §A, because the two classes have different threat surfaces.
  *
  * - `http`: an OpenAI-compatible HTTP server (Ollama, `mlx_lm.server`,
- *   llama.cpp server, vLLM). Spawns nothing, so byollm_004 §2's argv, stdin,
- *   env and sandbox requirements are not applicable by construction. Its
- *   threat surface is SSRF-shaped and bounded by {@link MUSTS.HTTP_BASE_URL_SAFE}.
+ *   llama.cpp server, vLLM, and every hosted provider that speaks the same
+ *   wire format). Spawns nothing, so byollm_004 §2's argv, stdin, env and
+ *   sandbox requirements are not applicable by construction. Its threat
+ *   surface is SSRF-shaped and bounded by {@link MUSTS.HTTP_BASE_URL_SAFE}.
  * - `process`: spawns a binary (`claude` CLI today, `mlx_lm.lora` for a
  *   future `train.*` kind). All of byollm_004 §2 is mandatory here.
  */
@@ -17,20 +18,26 @@ declare const BackendClass: z.ZodEnum<{
 }>;
 type BackendClass = z.infer<typeof BackendClass>;
 /**
- * Whose account pays for the inference.
+ * Who pays, and how — byollm_007.
  *
- * `subscription` backends run against a vendor account belonging to the
- * machine's owner. They are hard-locked to an offer scope of `self`
- * ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — one account executes one person's
- * work. This is orthogonal to {@link BackendClass}: `claude-cli` is both
- * process-class and subscription-class, while a future local `mlx_lm.lora`
- * backend would be process-class and open.
+ * This replaced a two-valued `account` field that conflated two unrelated
+ * constraints and, in doing so, left a hole: `openai-http` was "open", but it
+ * accepts an API key, so an owner could point it at a paid endpoint, offer it
+ * `public`, and donate their credit balance to strangers. The community
+ * budgets cap job *count*, not spend.
+ *
+ * - `free` — local compute. Costs electricity, not money. Shareable.
+ * - `metered` — per-token billing against the owner's account. Legal to
+ *   share and ruinous to share by accident.
+ * - `subscription` — a vendor account whose terms forbid third-party work.
+ *   Sharing is a terms violation, not merely expensive.
  */
-declare const BackendAccount: z.ZodEnum<{
-    open: "open";
+declare const BackendCost: z.ZodEnum<{
+    free: "free";
+    metered: "metered";
     subscription: "subscription";
 }>;
-type BackendAccount = z.infer<typeof BackendAccount>;
+type BackendCost = z.infer<typeof BackendCost>;
 /** The immutable facts about a backend that the protocol reasons over. */
 interface BackendDescriptor {
     /** Stable backend id, as written in `byollm.config.json`. */
@@ -39,33 +46,86 @@ interface BackendDescriptor {
     readonly label: string;
     /** Determines which isolation requirements apply. */
     readonly class: BackendClass;
-    /** Determines whether the offer scope can be widened past `self`. */
-    readonly account: BackendAccount;
+    /**
+     * Who pays. Fixed here for every named provider and **not overridable by
+     * configuration** ({@link MUSTS.COST_NOT_CONFIGURABLE}) — `openai` is
+     * metered because it is, and no setting changes that.
+     *
+     * `null` only for the generic {@link BACKENDS."openai-http"} entry, whose
+     * cost is inferred from its base URL instead
+     * ({@link MUSTS.REMOTE_IS_NEVER_FREE}).
+     */
+    readonly cost: BackendCost | null;
     /**
      * Which adversarial corpus byollm_004 §5 runs against this backend. A
      * backend cannot be registered without one — the coverage check in the
      * adversarial suite enforces it.
      */
     readonly adversarialCorpus: "process" | "http";
+    /**
+     * Where this provider lives, when that is knowable. Owner config may
+     * override it; a provider with no default requires one to be given.
+     */
+    readonly defaultBaseUrl?: string;
 }
 /**
- * The v1 backend registry.
+ * The backend registry.
  *
- * byollm_001 Rev 1 §A collapses four planned backends into one HTTP-class
- * entry: Ollama, `mlx_lm.server`, llama.cpp server and vLLM all speak
- * OpenAI-compatible `/v1/chat/completions`, so they are one backend with N
- * owner-configured base URLs rather than four adapters. That is what puts
- * MLX inference in v1.
+ * **Providers are entries, not implementations.** Every HTTP-class provider
+ * below shares the single `openai-http` transport, because they all speak
+ * OpenAI-compatible `/v1/chat/completions`. An entry adds a stable id, a cost
+ * class the owner cannot override, and a default base URL. Adding a provider
+ * is therefore one line and no new code — which is why the adversarial corpus
+ * still covers all of them, and why a PR adding one is reviewable at a glance.
  */
 declare const BACKENDS: Readonly<{
+    readonly ollama: BackendDescriptor;
+    readonly mlx: BackendDescriptor;
+    readonly llamacpp: BackendDescriptor;
+    readonly vllm: BackendDescriptor;
+    readonly lmstudio: BackendDescriptor;
+    readonly jan: BackendDescriptor;
+    readonly localai: BackendDescriptor;
+    /**
+     * Note the pair: `anthropic` and {@link BACKENDS."claude-cli"} reach the
+     * same vendor and land in different cost classes. That is not an
+     * inconsistency — it is the axis working. One bills a key per token, the
+     * other runs under a personal plan whose terms cover one person's work. Who
+     * pays and under what terms is the question; which company is not.
+     */
+    readonly anthropic: BackendDescriptor;
+    readonly openai: BackendDescriptor;
+    readonly gemini: BackendDescriptor;
+    readonly grok: BackendDescriptor;
+    readonly groq: BackendDescriptor;
+    readonly openrouter: BackendDescriptor;
+    readonly together: BackendDescriptor;
+    readonly deepseek: BackendDescriptor;
+    readonly mistral: BackendDescriptor;
     readonly "openai-http": BackendDescriptor;
     readonly "claude-cli": BackendDescriptor;
 }>;
 /** The id of a registered backend. */
 type BackendId = keyof typeof BACKENDS;
 /** All registered backend ids — the adversarial coverage check iterates this. */
-declare const BACKEND_IDS: readonly ("openai-http" | "claude-cli")[];
+declare const BACKEND_IDS: readonly ("ollama" | "mlx" | "llamacpp" | "vllm" | "lmstudio" | "jan" | "localai" | "anthropic" | "openai" | "gemini" | "grok" | "groq" | "openrouter" | "together" | "deepseek" | "mistral" | "openai-http" | "claude-cli")[];
 declare const BackendIdSchema: z.ZodEnum<{
+    ollama: "ollama";
+    mlx: "mlx";
+    llamacpp: "llamacpp";
+    vllm: "vllm";
+    lmstudio: "lmstudio";
+    jan: "jan";
+    localai: "localai";
+    anthropic: "anthropic";
+    openai: "openai";
+    gemini: "gemini";
+    grok: "grok";
+    groq: "groq";
+    openrouter: "openrouter";
+    together: "together";
+    deepseek: "deepseek";
+    mistral: "mistral";
     "openai-http": "openai-http";
     "claude-cli": "claude-cli";
 }>;
@@ -78,6 +138,34 @@ declare function isBackendId(value: string): value is BackendId;
  * adversarial corpus, so refusing is the safe direction.
  */
 declare function backendDescriptor(id: BackendId): BackendDescriptor;
+/**
+ * Is this host local enough that compute there is free?
+ *
+ * Loopback and the private ranges only. This is the rule that makes
+ * {@link MUSTS.REMOTE_IS_NEVER_FREE} enforceable rather than a promise: an
+ * owner cannot reach a paid API through the generic backend and call it free,
+ * because "free" is derived from the address, not from what the config claims.
+ *
+ * **What this cannot see.** The address is all it reads. A proxy on
+ * `127.0.0.1` forwarding to a paid API classes as `free` and nothing
+ * downstream will contradict it. That is deliberate: standing up a relay is
+ * an act by the machine's owner against their own account, and the threat
+ * model here is a hostile *job*, not an owner routing around a rule that
+ * exists to protect them. What this catches is the accident — a remote paid
+ * endpoint offered `public` because nobody thought about the bill. See
+ * `docs/security.md` §4a.
+ */
+declare function isLocalHost(hostname: string): boolean;
+/**
+ * The cost class of a configured backend instance.
+ *
+ * For every named provider this is whatever the registry says, full stop
+ * ({@link MUSTS.COST_NOT_CONFIGURABLE}). For the generic `openai-http` entry
+ * it is inferred from the base URL, and a base URL that cannot be parsed is
+ * treated as `metered` — the expensive side, because guessing "free" wrong
+ * costs the owner money.
+ */
+declare function resolveCost(id: BackendId, baseUrl: string | undefined): BackendCost;
 
 /**
  * Who may run a job, declared by the app that enqueued it.
@@ -121,6 +209,8 @@ declare const MatchRefusal: z.ZodEnum<{
     "not-in-server-allowlist": "not-in-server-allowlist";
     "offer-scope-too-narrow": "offer-scope-too-narrow";
     "subscription-self-lock": "subscription-self-lock";
+    "metered-no-spend-consent": "metered-no-spend-consent";
+    "metered-ceiling-reached": "metered-ceiling-reached";
 }>;
 type MatchRefusal = z.infer<typeof MatchRefusal>;
 /** The outcome of an audience match. */
@@ -130,16 +220,30 @@ type MatchResult = {
     readonly ok: false;
     readonly refusal: MatchRefusal;
 };
+/** What the owner has agreed to spend on other people's work, if anything. */
+interface SpendConsent {
+    /** The owner explicitly acknowledged that sharing this backend costs money. */
+    readonly acknowledged: boolean;
+    /** Their ceiling. Absent means no ceiling was set, which is not consent. */
+    readonly ceilingReached?: boolean;
+}
 /**
  * The effective offer scope of a backend.
  *
- * A subscription-class backend is locked to `self` regardless of what config
- * requests ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}). This is a protocol MUST,
- * not a setting: the lock is applied here, at the one place both the daemon's
- * config loader and its matcher call, so there is no code path that observes
- * a widened subscription scope.
+ * Three rules, applied at the one place both the daemon's config loader and
+ * its matcher call, so no code path can observe a scope wider than the cost
+ * class allows:
+ *
+ * - `subscription` is locked to `self` regardless of config
+ *   ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — someone else's terms.
+ * - `metered` narrows to `self` unless the owner has explicitly acknowledged
+ *   the spend ({@link MUSTS.METERED_DEFAULTS_SELF}) — their money.
+ * - `free` passes through — their electricity.
+ *
+ * Note the asymmetry: subscription can never be widened, metered can be
+ * widened deliberately. Conflating those was byollm_007's bug.
  */
-declare function effectiveOfferScope(configured: OfferScope, account: BackendAccount): OfferScope;
+declare function effectiveOfferScope(configured: OfferScope, cost: BackendCost, spend?: SpendConsent): OfferScope;
 /** The job-side facts a match needs. */
 interface MatchJob {
     /** The app's id for the user who enqueued the job. */
@@ -159,8 +263,10 @@ interface MatchDaemon {
     readonly owner: string;
     /** Effective scope of the backend that would run the job. */
     readonly offerScope: OfferScope;
-    /** Account class of that backend. */
-    readonly account: BackendAccount;
+    /** Who pays for that backend's tokens. */
+    readonly cost: BackendCost;
+    /** What the owner agreed to spend on others, for a `metered` backend. */
+    readonly spend?: SpendConsent | undefined;
     /**
      * Does this daemon's *local* allowlist admit the given owner for the server
      * origin the job came from? Supplied as a predicate so the protocol package
@@ -189,7 +295,7 @@ interface MatchDaemon {
  *   {
  *     owner: "bob",
  *     offerScope: "named",
- *     account: "open",
+ *     cost: "free",
  *     locallyAllows: (o) => o === "alice",
  *   },
  * );
@@ -342,6 +448,7 @@ declare function isTerminal(state: JobState): boolean;
 declare function canTransition(from: JobState, to: JobState): boolean;
 /** A lease: the right to work on a job until `expiresAt`. */
 declare const Lease: z.ZodObject<{
+    id: z.ZodString;
     runnerId: z.ZodString;
     expiresAt: z.ZodNumber;
 }, z.core.$strip>;
@@ -398,6 +505,7 @@ declare const ClaimedJob: z.ZodObject<{
     owner: z.ZodString;
     audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     lease: z.ZodObject<{
+        id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
     }, z.core.$strip>;
@@ -508,6 +616,401 @@ declare const DeliveredResult: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
+/**
+ * How big a payload is, in buckets — byollm_009 §6.
+ *
+ * A relay routes without reading, and matching a job to a machine needs some
+ * notion of size. Buckets rather than byte counts because the exact figure is
+ * a stronger fingerprint than the routing decision requires, and because a
+ * bucket survives compression and encoding changes that an exact count does
+ * not.
+ *
+ * `unbounded` exists for streamed jobs, which have no size when they start.
+ * It is reserved now rather than added later: byollm_009 §8.1 — adding a
+ * field to a published envelope is the v2 break all over again.
+ */
+declare const SizeClass: z.ZodEnum<{
+    small: "small";
+    medium: "medium";
+    large: "large";
+    unbounded: "unbounded";
+}>;
+type SizeClass = z.infer<typeof SizeClass>;
+/** Where the bucket boundaries sit, in characters of payload text. */
+declare const SIZE_CLASS_LIMITS: Readonly<{
+    small: 4000;
+    medium: 64000;
+    large: number;
+}>;
+/**
+ * The most a payload in this bucket can be.
+ *
+ * Used where a decision must be made from a stub, before the payload has been
+ * fetched — a budget check, for instance. Charging the bucket's ceiling is the
+ * conservative direction: it refuses slightly too eagerly rather than
+ * admitting work that turns out larger than the budget allowed.
+ *
+ * `unbounded` returns `Infinity`, which fails every ceiling. That is correct
+ * until byollm_006 defines how a streamed job is budgeted — failing closed on
+ * a case nobody has designed beats inventing an allowance for it.
+ */
+declare function sizeClassCeiling(sizeClass: SizeClass): number;
+/** Bucket a payload by its text length. */
+declare function sizeClassOf(textChars: number): SizeClass;
+/**
+ * Everything an upstream may see about a job — byollm_009 §6.
+ *
+ * **This list is exhaustive and normative.** It is a commitment about the
+ * metadata surface, not an accident of what the implementation happens to
+ * send: an upstream that requires more has exceeded the protocol, and an
+ * endpoint that emits more has leaked past it
+ * ({@link MUSTS.STUB_METADATA_EXHAUSTIVE}).
+ *
+ * What is absent is the point. No payload, no model, no prompt, no result.
+ * `kind` is here because capability matching happens upstream; if a later
+ * revision moves matching to the daemon, `kind` moves into the ciphertext.
+ */
+declare const JobStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type JobStub = z.infer<typeof JobStub>;
+/** A stub, plus the lease the claiming runner now holds for it. */
+declare const ClaimedStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+    lease: z.ZodObject<{
+        id: z.ZodString;
+        runnerId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strict>;
+type ClaimedStub = z.infer<typeof ClaimedStub>;
+
+/**
+ * Device and site keys — byollm_009 §3.
+ *
+ * **Two keypairs per party, and the split is load-bearing.** An Ed25519
+ * *identity* key signs; an X25519 *encryption* key receives sealed envelopes.
+ * The encryption key is signed by the identity key, and **the identity key is
+ * what gets pinned**. So "who sent this" and "who can read this" are answered
+ * by different keys — which is what lets an encryption key rotate without
+ * re-establishing trust, and what byollm_009 §6's signed-then-sealed envelope
+ * depends on.
+ *
+ * **No new dependency.** byollm_009 §2 says established primitives only, via
+ * libsodium. Everything *this* module needs — Ed25519 signing, X25519 key
+ * generation — Node provides natively, and using it costs nothing and adds no
+ * install weight to a daemon that must land fast on a stranger's laptop.
+ *
+ * libsodium becomes necessary at envelope v2, where sealing does. That is a
+ * real dependency decision and it belongs in the change that needs it: a
+ * sealed box is a specific reviewed construction, and rebuilding it out of
+ * Node primitives is exactly the "novel construction" §2 rules out. Deferring
+ * the dependency is not the same as deferring the rule.
+ */
+/** A public identity, as it travels on the wire. All values base64url. */
+declare const PublicIdentity: z.ZodObject<{
+    identity: z.ZodString;
+    encryption: z.ZodString;
+    encryptionSig: z.ZodString;
+}, z.core.$strict>;
+type PublicIdentity = z.infer<typeof PublicIdentity>;
+/** Private key material, as stored on disk. Never leaves the machine. */
+declare const StoredKeys: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    identityPublic: z.ZodString;
+    identityPrivate: z.ZodString;
+    encryptionPublic: z.ZodString;
+    encryptionPrivate: z.ZodString;
+    encryptionSig: z.ZodString;
+    createdAt: z.ZodNumber;
+}, z.core.$strict>;
+type StoredKeys = z.infer<typeof StoredKeys>;
+/** Generate a fresh pair of keypairs and bind them together. */
+declare function generateKeys(now: number): StoredKeys;
+/** The public half, for the wire. */
+declare function publicIdentityOf(keys: StoredKeys): PublicIdentity;
+/**
+ * Check that an encryption key really belongs to the identity presenting it.
+ *
+ * Called on everything received, including from an upstream we otherwise
+ * trust — the point of pinning the identity is that nothing else needs to be
+ * trusted, and that only holds if this is checked every time rather than at
+ * first sight.
+ */
+declare function verifyPublicIdentity(identity: PublicIdentity): boolean;
+/** Sign arbitrary bytes with an identity key. */
+declare function signWith(keys: StoredKeys, data: Uint8Array): string;
+/** Verify bytes against a raw Ed25519 public key. */
+declare function verifyWith(identityPublic: string, data: Uint8Array, signature: string): boolean;
+/**
+ * A fingerprint a human can compare out loud.
+ *
+ * 120 bits of SHA-256 over the raw identity key, as six groups of four. Long
+ * enough that grinding a colliding key is not worth anyone's afternoon, short
+ * enough to read down a phone line — which is the whole point. A fingerprint
+ * nobody can be bothered to compare provides no security at all, so
+ * legibility is a security property here, not a nicety.
+ *
+ * Formatted with a `BYOLLM-` prefix so a pasted fingerprint is recognisable
+ * out of context, in a support thread or a screenshot.
+ */
+declare function fingerprint(identityPublic: string): string;
+/** The short id used in envelopes and provenance. Stable, and comparable. */
+declare const keyId: (identityPublic: string) => string;
+
+declare function cryptoReady(): Promise<void>;
+/**
+ * How long a sealed payload is worth keeping, from creation.
+ *
+ * Bound into every envelope and recomputed when one is opened, so it lives
+ * here rather than in the two places that need it. Two copies of a value the
+ * signature depends on is the same bug as two clock readings: it works until
+ * they disagree, and then nothing can be opened.
+ *
+ * Not a job's TTL. That answers how long the *work* is worth doing, belongs
+ * to the app and the store, and may legitimately differ per deployment.
+ */
+declare const ENVELOPE_MAX_AGE_MS: number;
+/** Which leg an envelope belongs to. Bound into the signature. */
+declare const EnvelopeDirection: z.ZodEnum<{
+    payload: "payload";
+    result: "result";
+}>;
+type EnvelopeDirection = z.infer<typeof EnvelopeDirection>;
+declare const SealedEnvelope: z.ZodObject<{
+    ciphertext: z.ZodString;
+    recipientKeyId: z.ZodString;
+    senderKeyId: z.ZodString;
+    direction: z.ZodEnum<{
+        payload: "payload";
+        result: "result";
+    }>;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type SealedEnvelope = z.infer<typeof SealedEnvelope>;
+/** Everything the signature covers besides the plaintext itself. */
+interface EnvelopeContext {
+    readonly jobId: string;
+    readonly senderKeyId: string;
+    readonly recipientKeyId: string;
+    readonly deadlineAt: number;
+    readonly direction: EnvelopeDirection;
+}
+/** Seal a plaintext to a recipient, signed by the sender's identity. */
+declare function seal(input: {
+    plaintext: string;
+    senderKeys: StoredKeys;
+    recipientEncryptionPublic: string;
+    context: EnvelopeContext;
+}): Promise<SealedEnvelope>;
+/** Why an envelope was refused. Never distinguished to a remote caller. */
+type EnvelopeFailure = "not-for-us" | "unopenable" | "malformed" | "bad-signature" | "context-mismatch";
+type OpenResult = {
+    readonly ok: true;
+    readonly plaintext: string;
+} | {
+    readonly ok: false;
+    readonly reason: EnvelopeFailure;
+};
+/**
+ * Open an envelope and verify it came from the pinned sender.
+ *
+ * Every failure returns rather than throws: this runs on input from the
+ * network, and a crash here is a denial of service on the delivery path.
+ *
+ * The context is checked against the signature, not merely read from the
+ * envelope. An envelope carries its own claims about who sent it and to
+ * whom — believing those would authenticate the attacker's assertion rather
+ * than the sender's key.
+ */
+declare function open(input: {
+    envelope: SealedEnvelope;
+    recipientKeys: StoredKeys;
+    senderIdentityPublic: string;
+    /** The deadline is taken from the envelope and checked against its signature. */
+    expected: Omit<EnvelopeContext, "deadlineAt">;
+}): Promise<OpenResult>;
+
+/**
+ * Request signing — byollm_009 §4.2.
+ *
+ * Every authenticated call is signed by the calling device's identity key.
+ * There is no bearer token on the daemon plane: possession of a file no
+ * longer grants access, possession of a *key* does, and the key never leaves
+ * the machine.
+ *
+ * ## Why this is not the server-issued nonce the spec first described
+ *
+ * byollm_009 §4.2 says "the upstream issues a nonce; the daemon signs it".
+ * Implementing that costs one of two things: a round trip before every
+ * request, or server-side session state — and sessions reintroduce a bearer
+ * credential, which is the thing being removed.
+ *
+ * Signing *the request itself* gets the same property without either, because
+ * of something the protocol already guarantees. A captured signature is valid
+ * only for the exact request it covers — same endpoint, same runner, same
+ * body — and every authenticated endpoint here is idempotent by design:
+ * `RESULT_IDEMPOTENT` makes a replayed result a no-op, a replayed claim from
+ * the same runner returns what that runner already holds, and heartbeat and
+ * release are idempotent in effect. So a replay inside the freshness window
+ * gains an attacker nothing they could not obtain by forwarding the original,
+ * which a relay can do anyway.
+ *
+ * That is the whole argument, and it is worth stating because it rests
+ * entirely on the endpoints being idempotent. Two ways that can fail, and the
+ * second is the one that actually bit:
+ *
+ * 1. **A future endpoint that is not idempotent cannot use this scheme
+ *    unchanged** — it would need a server-issued nonce.
+ * 2. **Idempotence must hold per *addressed instance*, not per endpoint.** A
+ *    request that names a mutable target — a lease, a session, a
+ *    subscription — must name the *instance*, or a replay lands on a
+ *    different one than the sender meant and the endpoint's idempotence buys
+ *    nothing. `release` was idempotent per lease and ambiguous across them:
+ *    it named a job and a runner, both of which survive a
+ *    claim-release-reclaim cycle, so a replayed release yanked a later grant.
+ *    Fixed by giving a lease its own id and requiring it.
+ *
+ * The rule for anything added later: if a signed request can be replayed onto
+ * a target that has changed underneath it, the request has to say which
+ * target it meant.
+ */
+/** How far a request's timestamp may be from the server's clock. */
+declare const MAX_CLOCK_SKEW_MS = 120000;
+/** The signed material a request carries. */
+declare const RequestSignature: z.ZodObject<{
+    runnerId: z.ZodString;
+    issuedAt: z.ZodNumber;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type RequestSignature = z.infer<typeof RequestSignature>;
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * Newline-separated with a version prefix and a domain separator. Every field
+ * that decides what the request *does* is in here: leave one out and it
+ * becomes something an intermediary can change without breaking the
+ * signature.
+ *
+ * The body is included by hash rather than by value, so signing does not
+ * depend on both sides serialising JSON identically — which they would not.
+ */
+declare function canonicalRequest(input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): Buffer;
+/** Sign an outgoing request with this machine's identity key. */
+declare function signRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/**
+ * The same scheme, for the party at the other end: a **site** calling a relay.
+ *
+ * A site talking to a relay is in exactly the daemon's position — an outbound
+ * caller with an identity keypair the other side already pins — so it gets the
+ * daemon's authentication rather than a second scheme. Bearer tokens for the
+ * site plane were the alternative, and they would have reintroduced the
+ * credential-in-a-file that §4.2 removed from the daemon plane, on the plane
+ * that carries *every* site's traffic.
+ *
+ * Two things make this safe to build on the same canonical string:
+ *
+ * 1. **The endpoint is namespaced.** Site endpoints sign `site/enqueue`, never
+ *    `enqueue`. The daemon plane's `result` and the site plane's `results` are
+ *    one character apart, and a naming collision between planes must not be
+ *    what stands between a signature and a replay onto the wrong handler. The
+ *    prefix is applied *inside* these helpers, so the two ends cannot disagree
+ *    about it — the alternative is two implementations of one bound value,
+ *    which is this project's most-repeated bug.
+ * 2. **The caller slot carries the site id.** `canonicalRequest` names that
+ *    field `runnerId` because the daemon plane got there first; here it holds
+ *    the site id, and the verifier looks the key up in the projection's site
+ *    registry rather than its device registry. The two registries never share
+ *    an entry, so a device signature cannot authenticate as a site.
+ *
+ * §4.2's replay argument carries over **only because the site plane's writes
+ * are idempotent per addressed instance**, which is a property that had to be
+ * built rather than found: `enqueue` reset a job of the same id, so a replayed
+ * enqueue inside the freshness window returned a claimed job to the queue and
+ * threw away a device's live lease. Identical in shape to the `release` bug
+ * above, on the other plane. Anything added to the site plane later must be
+ * idempotent by the instance it names, or this scheme does not cover it.
+ */
+declare function signSiteRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    siteId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Verify a site's call against the identity the control plane registered. */
+declare function verifySiteRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+/** Why a signed request was refused. Never returned to the caller verbatim. */
+type SignatureFailure = "stale" | "bad-signature";
+/**
+ * Verify a signed request against a runner's pinned identity key.
+ *
+ * Freshness is checked in **both** directions. A clock far ahead is as much a
+ * problem as one behind: it would let a captured request stay replayable long
+ * after it was made, which is the one thing the window exists to bound.
+ */
+declare function verifyRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
 
 /**
  * The normative MUSTs of protocol v0, as data.
@@ -524,6 +1027,30 @@ type DeliveredResult = z.infer<typeof DeliveredResult>;
  */
 /** Which side of the wire is obliged to enforce a given MUST. */
 type MustEnforcer = "daemon" | "server" | "both";
+/**
+ * How a MUST is actually verified — which is not the same question as who
+ * enforces it, and is the one that decides what "byollm-compatible" means.
+ *
+ * The conformance kit's credibility rests on an implicit claim that every
+ * MUST is checkable. Ten of them were not, and the kit reported that honestly
+ * while nothing acted on it. Making the kind explicit turns "uncovered" from
+ * a number needing a paragraph of explanation into a number that should be
+ * zero.
+ *
+ * - `conformance` — the kit asserts it against *any* implementation. This is
+ *   the strong kind: a third party runs the suite and learns something.
+ * - `adversarial` — proved by the reference daemon's own suites in this repo
+ *   (the hostile-payload corpus, or its unit tests). Real verification, and
+ *   it runs in CI — but it proves things about *our* daemon, not about
+ *   someone else's, so the kit cannot carry it.
+ * - `construction` — true by the shape of the code, where a test could only
+ *   sample. A reviewer verifies it; a suite cannot.
+ * - `operator` — a claim about how someone runs a deployment, verifiable only
+ *   by audit or by reading source. The honest category, and the one that
+ *   exists so a property nobody can check from outside is *labelled* as such
+ *   rather than laundered by association with the checkable ones.
+ */
+type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
 /** A single normative requirement of the protocol. */
 interface Must {
     /** Stable public id, cited by conformance output. */
@@ -532,6 +1059,11 @@ interface Must {
     readonly statement: string;
     /** Which implementation is obliged to enforce it. */
     readonly enforcedBy: MustEnforcer;
+    /**
+     * How this is verified. `conformance` is the only kind the kit can assert;
+     * see {@link MustVerification} for why the others exist.
+     */
+    readonly verifiedBy: MustVerification;
     /** Spec section this was adjudicated in. */
     readonly source: string;
 }
@@ -547,6 +1079,12 @@ declare const MUSTS: Readonly<{
     readonly PAIR_ONE_USER: Must;
     readonly PAIR_INTERACTIVE: Must;
     readonly PAIR_CODE_EXPIRES: Must;
+    readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly KEYS_EXCHANGED_AT_CONSENT: Must;
+    readonly REQUESTS_SIGNED_NOT_BEARER: Must;
+    readonly LEASE_SCOPED_BY_GRANT: Must;
+    readonly STUB_METADATA_EXHAUSTIVE: Must;
+    readonly ENVELOPE_SEALED_AND_SIGNED: Must;
     readonly KIND_TYPED_ONLY: Must;
     readonly KIND_NO_CODE: Must;
     readonly CLAIM_REQUIRES_CAPABILITY: Must;
@@ -556,6 +1094,10 @@ declare const MUSTS: Readonly<{
     readonly LEASE_RECLAIMABLE: Must;
     readonly AUDIENCE_BOTH_SIDES: Must;
     readonly SUBSCRIPTION_SELF_LOCK: Must;
+    readonly METERED_DEFAULTS_SELF: Must;
+    readonly METERED_REQUIRES_CEILING: Must;
+    readonly COST_NOT_CONFIGURABLE: Must;
+    readonly REMOTE_IS_NEVER_FREE: Must;
     readonly NAMED_LOCAL_ALLOWLIST: Must;
     readonly REFUSAL_NOT_REOFFERED: Must;
     readonly REVOCATION_HONORED: Must;
@@ -576,14 +1118,64 @@ declare const MUSTS: Readonly<{
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+/** Every MUST verified a particular way. */
+declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
 /** Protocol version carried on every request; servers refuse what they can't speak. */
 declare const PROTOCOL_VERSION: "0";
+/**
+ * Every protocol version this build can serve, **oldest first**.
+ *
+ * One entry today. It is a list rather than a constant because the shape of
+ * the check is the point: a server supporting two versions through a
+ * migration should not need a different code path from one supporting one.
+ */
+declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+/**
+ * The oldest version this build will talk to — derived, not declared.
+ *
+ * Stating it separately would be a second thing to keep in step with the list
+ * above, and the failure would be silent: a minimum that no longer matches
+ * what is supported produces a refusal naming a version the server would in
+ * fact have accepted.
+ */
+declare const MIN_PROTOCOL_VERSION: string;
+/** A structured refusal, so a daemon can say something useful to its owner. */
+interface VersionRefusal {
+    readonly error: "unsupported-protocol-version";
+    readonly message: string;
+    readonly supported: readonly string[];
+    readonly minimum: string;
+}
+/**
+ * Check the protocol version on an incoming request
+ * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
+ *
+ * Returns a refusal, or `null` to proceed.
+ *
+ * **A missing version is refused the same way a wrong one is.** That is the
+ * half worth stating: before this existed, the version travelled as a
+ * `z.literal` inside each endpoint's schema, so a mismatch surfaced as a
+ * generic `bad-request` — a daemon and a server discovered they disagreed by
+ * failing, with nothing in the response naming the disagreement. An error a
+ * user cannot act on is barely better than a hang.
+ *
+ * The message names the fix, because the person reading it is usually the one
+ * who has to apply it.
+ */
+declare function checkProtocolVersion(body: unknown): VersionRefusal | null;
 /** The path prefix all endpoints mount under. */
 declare const PROTOCOL_PREFIX: "/byollm";
-/** The five endpoint names, in the order byollm_001 lists them. */
-declare const ENDPOINTS: readonly ["pair", "claim", "heartbeat", "result", "release"];
+/**
+ * The endpoint names, in the order byollm_001 lists them, plus `fetch`.
+ *
+ * `fetch` is byollm_009 §6's second phase: a claim returns a stub, and the
+ * payload is collected separately by the device that took it. Two steps
+ * rather than one because a payload can only be sealed once its recipient is
+ * known — which is also what makes multi-device free.
+ */
+declare const ENDPOINTS: readonly ["pair", "claim", "fetch", "heartbeat", "result", "release"];
 type Endpoint = (typeof ENDPOINTS)[number];
 /**
  * One entry of the capability matrix: a kind this daemon can actually serve,
@@ -601,6 +1193,22 @@ declare const Capability: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     backendId: z.ZodEnum<{
+        ollama: "ollama";
+        mlx: "mlx";
+        llamacpp: "llamacpp";
+        vllm: "vllm";
+        lmstudio: "lmstudio";
+        jan: "jan";
+        localai: "localai";
+        anthropic: "anthropic";
+        openai: "openai";
+        gemini: "gemini";
+        grok: "grok";
+        groq: "groq";
+        openrouter: "openrouter";
+        together: "together";
+        deepseek: "deepseek";
+        mistral: "mistral";
         "openai-http": "openai-http";
         "claude-cli": "claude-cli";
     }>;
@@ -623,6 +1231,22 @@ declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     backendId: z.ZodEnum<{
+        ollama: "ollama";
+        mlx: "mlx";
+        llamacpp: "llamacpp";
+        vllm: "vllm";
+        lmstudio: "lmstudio";
+        jan: "jan";
+        localai: "localai";
+        anthropic: "anthropic";
+        openai: "openai";
+        gemini: "gemini";
+        grok: "grok";
+        groq: "groq";
+        openrouter: "openrouter";
+        together: "together";
+        deepseek: "deepseek";
+        mistral: "mistral";
         "openai-http": "openai-http";
         "claude-cli": "claude-cli";
     }>;
@@ -657,12 +1281,33 @@ declare const PairStartRequest: z.ZodObject<{
             win32: "win32";
         }>;
     }, z.core.$strip>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
         backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
         }>;
@@ -705,6 +1350,11 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     runnerId: z.ZodString;
     owner: z.ZodString;
     ownerLabel: z.ZodOptional<z.ZodString>;
+    site: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -719,12 +1369,33 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             win32: "win32";
         }>;
     }, z.core.$strip>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
         backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
         }>;
@@ -754,6 +1425,22 @@ declare const ClaimRequest: z.ZodObject<{
             "llm.chat": "llm.chat";
         }>;
         backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
         }>;
@@ -778,28 +1465,23 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
-        payload: z.ZodUnion<readonly [z.ZodObject<{
-            prompt: z.ZodString;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>, z.ZodObject<{
-            messages: z.ZodArray<z.ZodObject<{
-                role: z.ZodEnum<{
-                    system: "system";
-                    user: "user";
-                    assistant: "assistant";
-                }>;
-                content: z.ZodString;
-            }, z.core.$strip>>;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
+        owner: z.ZodString;
         audience: z.ZodEnum<{
             self: "self";
             named: "named";
             public: "public";
         }>;
-        owner: z.ZodString;
         audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        sizeClass: z.ZodEnum<{
+            small: "small";
+            medium: "medium";
+            large: "large";
+            unbounded: "unbounded";
+        }>;
+        streaming: z.ZodBoolean;
+        deadlineAt: z.ZodNumber;
         lease: z.ZodObject<{
+            id: z.ZodString;
             runnerId: z.ZodString;
             expiresAt: z.ZodNumber;
         }, z.core.$strip>;
@@ -817,6 +1499,22 @@ declare const HeartbeatRequest: z.ZodObject<{
             "llm.chat": "llm.chat";
         }>;
         backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
         }>;
@@ -831,7 +1529,10 @@ declare const HeartbeatRequest: z.ZodObject<{
             public: "public";
         }>;
     }, z.core.$strict>>;
-    activeJobIds: z.ZodArray<z.ZodString>;
+    activeLeases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strip>>;
     paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
@@ -846,22 +1547,43 @@ declare const HeartbeatResponse: z.ZodObject<{
     serverTime: z.ZodNumber;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
+/**
+ * What an intermediary learns about how a job ended — byollm_009 §6.
+ *
+ * The discriminator and nothing else. A relay has to know a job reached a
+ * terminal state, and whether it failed, because that decides whether the job
+ * leaves the queue or the app may re-enqueue. It does not have to know what
+ * the model said, or what an error said, and this is where that line is drawn.
+ *
+ * Kept identical to `JobOutcome`'s discriminator rather than coarsened to
+ * ok/not-ok: a cancelled job and a failed one are different routing outcomes,
+ * and collapsing them would make the relay guess.
+ */
+declare const ResultDisposition: z.ZodEnum<{
+    ok: "ok";
+    error: "error";
+    canceled: "canceled";
+}>;
+type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
-    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        outcome: z.ZodLiteral<"ok">;
-        text: z.ZodString;
-        artifactUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"error">;
-        code: z.ZodString;
-        message: z.ZodString;
-        retryable: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"canceled">;
-    }, z.core.$strict>], "outcome">;
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+    disposition: z.ZodEnum<{
+        ok: "ok";
+        error: "error";
+        canceled: "canceled";
+    }>;
     model: z.ZodString;
     backendClass: z.ZodEnum<{
         http: "http";
@@ -878,7 +1600,10 @@ type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
-    jobIds: z.ZodArray<z.ZodString>;
+    leases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strip>>;
     reason: z.ZodEnum<{
         revoked: "revoked";
         shutdown: "shutdown";
@@ -901,9 +1626,9 @@ type ReleaseResponse = z.infer<typeof ReleaseResponse>;
  * with no response at all.
  */
 declare const WireErrorCode: z.ZodEnum<{
+    "unsupported-protocol-version": "unsupported-protocol-version";
     revoked: "revoked";
     "bad-request": "bad-request";
-    "unsupported-protocol-version": "unsupported-protocol-version";
     unauthorized: "unauthorized";
     "not-found": "not-found";
     "rate-limited": "rate-limited";
@@ -912,9 +1637,9 @@ declare const WireErrorCode: z.ZodEnum<{
 type WireErrorCode = z.infer<typeof WireErrorCode>;
 declare const WireError: z.ZodObject<{
     error: z.ZodEnum<{
+        "unsupported-protocol-version": "unsupported-protocol-version";
         revoked: "revoked";
         "bad-request": "bad-request";
-        "unsupported-protocol-version": "unsupported-protocol-version";
         unauthorized: "unauthorized";
         "not-found": "not-found";
         "rate-limited": "rate-limited";
@@ -926,5 +1651,25 @@ declare const WireError: z.ZodObject<{
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
+declare const FetchRequest: z.ZodObject<{
+    protocolVersion: z.ZodString;
+    runnerId: z.ZodString;
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
+}, z.core.$strict>;
+type FetchRequest = z.infer<typeof FetchRequest>;
+declare const FetchResponse: z.ZodObject<{
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendAccount, BackendClass, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, KindedPayload, Lease, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, ResultProvenance, ResultRequest, ResultResponse, TERMINAL_STATES, WireError, WireErrorCode, backendDescriptor, canTransition, effectiveOfferScope, isBackendId, isJobKind, isTerminal, matchAudience, payloadTextLength, provenanceFor };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signSiteRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith };