@byollm/protocol 0.1.0-alpha.0

package/dist/index.d.ts

@@ -0,0 +1,930 @@
+import { z } from 'zod';
+
+/**
+ * How a backend reaches its model — the taxonomy introduced in byollm_001
+ * Rev 1 §A, because the two classes have different threat surfaces.
+ *
+ * - `http`: an OpenAI-compatible HTTP server (Ollama, `mlx_lm.server`,
+ *   llama.cpp server, vLLM). Spawns nothing, so byollm_004 §2's argv, stdin,
+ *   env and sandbox requirements are not applicable by construction. Its
+ *   threat surface is SSRF-shaped and bounded by {@link MUSTS.HTTP_BASE_URL_SAFE}.
+ * - `process`: spawns a binary (`claude` CLI today, `mlx_lm.lora` for a
+ *   future `train.*` kind). All of byollm_004 §2 is mandatory here.
+ */
+declare const BackendClass: z.ZodEnum<{
+    http: "http";
+    process: "process";
+}>;
+type BackendClass = z.infer<typeof BackendClass>;
+/**
+ * Whose account pays for the inference.
+ *
+ * `subscription` backends run against a vendor account belonging to the
+ * machine's owner. They are hard-locked to an offer scope of `self`
+ * ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — one account executes one person's
+ * work. This is orthogonal to {@link BackendClass}: `claude-cli` is both
+ * process-class and subscription-class, while a future local `mlx_lm.lora`
+ * backend would be process-class and open.
+ */
+declare const BackendAccount: z.ZodEnum<{
+    open: "open";
+    subscription: "subscription";
+}>;
+type BackendAccount = z.infer<typeof BackendAccount>;
+/** The immutable facts about a backend that the protocol reasons over. */
+interface BackendDescriptor {
+    /** Stable backend id, as written in `byollm.config.json`. */
+    readonly id: string;
+    /** Human-readable name for the trust UI. */
+    readonly label: string;
+    /** Determines which isolation requirements apply. */
+    readonly class: BackendClass;
+    /** Determines whether the offer scope can be widened past `self`. */
+    readonly account: BackendAccount;
+    /**
+     * Which adversarial corpus byollm_004 §5 runs against this backend. A
+     * backend cannot be registered without one — the coverage check in the
+     * adversarial suite enforces it.
+     */
+    readonly adversarialCorpus: "process" | "http";
+}
+/**
+ * The v1 backend registry.
+ *
+ * byollm_001 Rev 1 §A collapses four planned backends into one HTTP-class
+ * entry: Ollama, `mlx_lm.server`, llama.cpp server and vLLM all speak
+ * OpenAI-compatible `/v1/chat/completions`, so they are one backend with N
+ * owner-configured base URLs rather than four adapters. That is what puts
+ * MLX inference in v1.
+ */
+declare const BACKENDS: Readonly<{
+    readonly "openai-http": BackendDescriptor;
+    readonly "claude-cli": BackendDescriptor;
+}>;
+/** The id of a registered backend. */
+type BackendId = keyof typeof BACKENDS;
+/** All registered backend ids — the adversarial coverage check iterates this. */
+declare const BACKEND_IDS: readonly ("openai-http" | "claude-cli")[];
+declare const BackendIdSchema: z.ZodEnum<{
+    "openai-http": "openai-http";
+    "claude-cli": "claude-cli";
+}>;
+/** Narrow an arbitrary string to a registered backend id. */
+declare function isBackendId(value: string): value is BackendId;
+/**
+ * Look up a backend descriptor.
+ *
+ * @throws if the id is not registered — an unregistered backend has no
+ * adversarial corpus, so refusing is the safe direction.
+ */
+declare function backendDescriptor(id: BackendId): BackendDescriptor;
+
+/**
+ * Who may run a job, declared by the app that enqueued it.
+ *
+ * - `self` — only the job owner's own daemon.
+ * - `named` — a daemon whose owner has explicitly allowed this (server, user)
+ *   pair in their *local* allowlist (byollm_001 Rev 1 §B).
+ * - `public` — any daemon offering `public` compute.
+ */
+declare const Audience: z.ZodEnum<{
+    self: "self";
+    named: "named";
+    public: "public";
+}>;
+type Audience = z.infer<typeof Audience>;
+/**
+ * What a daemon backend is willing to run, declared by the machine's owner.
+ * Same three values as {@link Audience}, but the two are independent axes —
+ * a job runs only where both agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}).
+ */
+declare const OfferScope: z.ZodEnum<{
+    self: "self";
+    named: "named";
+    public: "public";
+}>;
+type OfferScope = z.infer<typeof OfferScope>;
+/** All audience values, in widening order. */
+declare const AUDIENCES: readonly ("self" | "named" | "public")[];
+/** All offer scopes, in widening order. */
+declare const OFFER_SCOPES: readonly ("self" | "named" | "public")[];
+/**
+ * Why a job was refused. Distinct codes because byollm_002 requires that
+ * different truths never share a message — "no matching work" and "refused on
+ * principle" are not the same event, and a volunteer debugging their setup
+ * needs to know which one happened.
+ */
+declare const MatchRefusal: z.ZodEnum<{
+    "no-capability": "no-capability";
+    "audience-self-other-owner": "audience-self-other-owner";
+    "not-locally-allowed": "not-locally-allowed";
+    "not-in-server-allowlist": "not-in-server-allowlist";
+    "offer-scope-too-narrow": "offer-scope-too-narrow";
+    "subscription-self-lock": "subscription-self-lock";
+}>;
+type MatchRefusal = z.infer<typeof MatchRefusal>;
+/** The outcome of an audience match. */
+type MatchResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly refusal: MatchRefusal;
+};
+/**
+ * The effective offer scope of a backend.
+ *
+ * A subscription-class backend is locked to `self` regardless of what config
+ * requests ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}). This is a protocol MUST,
+ * not a setting: the lock is applied here, at the one place both the daemon's
+ * config loader and its matcher call, so there is no code path that observes
+ * a widened subscription scope.
+ */
+declare function effectiveOfferScope(configured: OfferScope, account: BackendAccount): OfferScope;
+/** The job-side facts a match needs. */
+interface MatchJob {
+    /** The app's id for the user who enqueued the job. */
+    readonly owner: string;
+    /** Who the app says may run it. */
+    readonly audience: Audience;
+    /**
+     * Optional server-side restriction on which runner owners may take a
+     * `named` job. Defence in depth only — the daemon's local allowlist is the
+     * enforcing side ({@link MUSTS.NAMED_LOCAL_ALLOWLIST}).
+     */
+    readonly audienceAllow?: readonly string[] | undefined;
+}
+/** The daemon-side facts a match needs. */
+interface MatchDaemon {
+    /** The app's id for the user this daemon is paired to. */
+    readonly owner: string;
+    /** Effective scope of the backend that would run the job. */
+    readonly offerScope: OfferScope;
+    /** Account class of that backend. */
+    readonly account: BackendAccount;
+    /**
+     * Does this daemon's *local* allowlist admit the given owner for the server
+     * origin the job came from? Supplied as a predicate so the protocol package
+     * stays free of file I/O; the daemon passes its allowlist, the server
+     * passes a conservative `() => true` because it cannot know a remote
+     * daemon's local list and must not pretend to.
+     */
+    readonly locallyAllows: (owner: string) => boolean;
+}
+/**
+ * Decide whether a job may run on a daemon.
+ *
+ * Both sides must agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}):
+ * 1. the job's audience must admit the daemon's owner, and
+ * 2. the backend's offer scope must admit the job's owner.
+ *
+ * The full nine-way matrix (three audiences × three offer scopes) is asserted
+ * by the conformance kit. The function is pure and total so both the daemon
+ * and the server can run the identical rule — the daemon refuses, and the
+ * server refuses too (byollm_003 §Server-side MUSTs).
+ *
+ * @example
+ * ```ts
+ * const result = matchAudience(
+ *   { owner: "alice", audience: "named" },
+ *   {
+ *     owner: "bob",
+ *     offerScope: "named",
+ *     account: "open",
+ *     locallyAllows: (o) => o === "alice",
+ *   },
+ * );
+ * // result.ok === true
+ * ```
+ */
+declare function matchAudience(job: MatchJob, daemon: MatchDaemon): MatchResult;
+/**
+ * Human-readable refusal text for the daemon's log and the trust UI.
+ * Each refusal reads as a distinct truth — byollm_002's "four different
+ * truths that must never share a message" applied to the audience axis.
+ */
+declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
+
+/**
+ * Upper bounds on payload size, enforced at the schema so oversized input is
+ * refused at parse time rather than somewhere deeper.
+ *
+ * byollm_004 §4 requires stricter limits for community (`named`/`public`)
+ * jobs; those are applied on top of these by the daemon's budget check, which
+ * knows the job's audience. These are the absolute ceilings for any job.
+ */
+declare const PAYLOAD_LIMITS: Readonly<{
+    /** Max characters in any single text field. */
+    maxTextChars: 1000000;
+    /** Max messages in an `llm.chat` conversation. */
+    maxMessages: 256;
+    /** Max characters across the whole payload. */
+    maxTotalChars: 4000000;
+}>;
+/**
+ * A conversation turn. `role` is a closed enum — it is routing *within the
+ * model call*, not routing of the call, so it cannot select a backend.
+ */
+declare const ChatMessage: z.ZodObject<{
+    role: z.ZodEnum<{
+        system: "system";
+        user: "user";
+        assistant: "assistant";
+    }>;
+    content: z.ZodString;
+}, z.core.$strip>;
+type ChatMessage = z.infer<typeof ChatMessage>;
+/**
+ * Payload for `llm.generate`.
+ *
+ * @remarks
+ * Text only, deliberately. byollm_004 §1 states the payload is "data handed
+ * to a model, never configuration and never a command", so v0 carries no
+ * sampling parameters, no model name, no base URL and no flags — those are
+ * owner-side route config. A future `params` field with an explicit closed
+ * allowlist and owner-set clamps is reserved; adding a field later is
+ * non-breaking, removing one is not.
+ */
+declare const GeneratePayload: z.ZodObject<{
+    prompt: z.ZodString;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type GeneratePayload = z.infer<typeof GeneratePayload>;
+/** Payload for `llm.chat`. Text only, for the same reason as {@link GeneratePayload}. */
+declare const ChatPayload: z.ZodObject<{
+    messages: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            system: "system";
+            user: "user";
+            assistant: "assistant";
+        }>;
+        content: z.ZodString;
+    }, z.core.$strip>>;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type ChatPayload = z.infer<typeof ChatPayload>;
+/**
+ * The job kinds a v1 daemon has handlers for.
+ *
+ * Kinds are resolved against handlers baked into the daemon
+ * ({@link MUSTS.KIND_TYPED_ONLY}); an unknown kind is refused, never guessed.
+ * Adding a kind is a protocol change with its own spec and threat review —
+ * notably any kind that needs tools, which byollm_004 §2 forbids as a payload
+ * flag.
+ */
+declare const JobKind: z.ZodEnum<{
+    "llm.generate": "llm.generate";
+    "llm.chat": "llm.chat";
+}>;
+type JobKind = z.infer<typeof JobKind>;
+/** All v1 job kinds. */
+declare const JOB_KINDS: readonly ("llm.generate" | "llm.chat")[];
+/** A payload discriminated by its kind. */
+declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"llm.generate">;
+    payload: z.ZodObject<{
+        prompt: z.ZodString;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strip>, z.ZodObject<{
+    kind: z.ZodLiteral<"llm.chat">;
+    payload: z.ZodObject<{
+        messages: z.ZodArray<z.ZodObject<{
+            role: z.ZodEnum<{
+                system: "system";
+                user: "user";
+                assistant: "assistant";
+            }>;
+            content: z.ZodString;
+        }, z.core.$strip>>;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strip>], "kind">;
+type KindedPayload = z.infer<typeof KindedPayload>;
+/** The payload type for a given kind. */
+type PayloadFor<K extends JobKind> = K extends "llm.generate" ? GeneratePayload : ChatPayload;
+/** Narrow an arbitrary string to a known job kind. */
+declare function isJobKind(value: string): value is JobKind;
+/**
+ * Total character weight of a payload, used by the daemon's community budget
+ * check and by the server's payload-size limits.
+ */
+declare function payloadTextLength(kinded: KindedPayload): number;
+
+/**
+ * The job lifecycle, made explicit by byollm_001 Rev 1 §D because the most
+ * user-visible failure mode — "nothing is running my job" — was previously
+ * unspecified.
+ *
+ * ```text
+ * queued ──claim──▶ claimed ──start──▶ running ──▶ ok | error | canceled
+ *   │                  │                   │
+ *   │                  └──lease expiry─────┘
+ *   │                         ▼
+ *   │                      queued  (reclaimable, no loss)
+ *   └──ttl elapsed──▶ expired
+ * ```
+ */
+declare const JobState: z.ZodEnum<{
+    ok: "ok";
+    error: "error";
+    queued: "queued";
+    claimed: "claimed";
+    running: "running";
+    canceled: "canceled";
+    expired: "expired";
+}>;
+type JobState = z.infer<typeof JobState>;
+/** States from which a job never moves again. */
+declare const TERMINAL_STATES: readonly ["ok", "error", "canceled", "expired"];
+/** Is this a state the job can never leave? */
+declare function isTerminal(state: JobState): boolean;
+/** May a job move from `from` to `to`? */
+declare function canTransition(from: JobState, to: JobState): boolean;
+/** A lease: the right to work on a job until `expiresAt`. */
+declare const Lease: z.ZodObject<{
+    runnerId: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>;
+type Lease = z.infer<typeof Lease>;
+/** Payload union as it appears on a job record. */
+declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
+    prompt: z.ZodString;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    messages: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            system: "system";
+            user: "user";
+            assistant: "assistant";
+        }>;
+        content: z.ZodString;
+    }, z.core.$strip>>;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+type JobPayload = z.infer<typeof JobPayload>;
+/**
+ * A job as the daemon receives it from `/byollm/claim`.
+ *
+ * Note what is absent: no model, no backend, no base URL, no flags, no path.
+ * Those come from the machine owner's config only
+ * ({@link MUSTS.NO_PAYLOAD_ROUTING}). The wire shape is the first place that
+ * rule is enforced — there is no field to carry them.
+ */
+declare const ClaimedJob: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    payload: z.ZodUnion<readonly [z.ZodObject<{
+        prompt: z.ZodString;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        messages: z.ZodArray<z.ZodObject<{
+            role: z.ZodEnum<{
+                system: "system";
+                user: "user";
+                assistant: "assistant";
+            }>;
+            content: z.ZodString;
+        }, z.core.$strip>>;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    owner: z.ZodString;
+    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    lease: z.ZodObject<{
+        runnerId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strict>;
+type ClaimedJob = z.infer<typeof ClaimedJob>;
+/**
+ * The provenance that travels with every result to the delivery seam.
+ *
+ * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
+ * The app must never render volunteer output as its own AI's answer without
+ * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
+ */
+declare const ResultProvenance: z.ZodObject<{
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    runnerId: z.ZodString;
+    runnerOwner: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    model: z.ZodString;
+    untrusted: z.ZodBoolean;
+}, z.core.$strict>;
+type ResultProvenance = z.infer<typeof ResultProvenance>;
+/**
+ * Build provenance for a completed job. `untrusted` is derived, never
+ * supplied, so no caller can mark volunteer output as first-party.
+ */
+declare function provenanceFor(input: {
+    audience: Audience;
+    runnerId: string;
+    runnerOwner: string;
+    backendClass: BackendClass;
+    model: string;
+}): ResultProvenance;
+/** Successful outcome. */
+declare const JobResultOk: z.ZodObject<{
+    outcome: z.ZodLiteral<"ok">;
+    text: z.ZodString;
+    artifactUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>;
+/** Failed outcome. `code` is a stable machine string; `message` is for humans. */
+declare const JobResultError: z.ZodObject<{
+    outcome: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    message: z.ZodString;
+    retryable: z.ZodBoolean;
+}, z.core.$strict>;
+/** Cancelled outcome, reported by the daemon after honoring a cancel. */
+declare const JobResultCanceled: z.ZodObject<{
+    outcome: z.ZodLiteral<"canceled">;
+}, z.core.$strict>;
+declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    outcome: z.ZodLiteral<"ok">;
+    text: z.ZodString;
+    artifactUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>, z.ZodObject<{
+    outcome: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    message: z.ZodString;
+    retryable: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    outcome: z.ZodLiteral<"canceled">;
+}, z.core.$strict>], "outcome">;
+type JobOutcome = z.infer<typeof JobOutcome>;
+/** A completed job as delivered to the app, provenance attached. */
+declare const DeliveredResult: z.ZodObject<{
+    jobId: z.ZodString;
+    state: z.ZodEnum<{
+        ok: "ok";
+        error: "error";
+        queued: "queued";
+        claimed: "claimed";
+        running: "running";
+        canceled: "canceled";
+        expired: "expired";
+    }>;
+    outcome: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">>;
+    provenance: z.ZodOptional<z.ZodObject<{
+        audience: z.ZodEnum<{
+            self: "self";
+            named: "named";
+            public: "public";
+        }>;
+        runnerId: z.ZodString;
+        runnerOwner: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        untrusted: z.ZodBoolean;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type DeliveredResult = z.infer<typeof DeliveredResult>;
+
+/**
+ * The normative MUSTs of protocol v0, as data.
+ *
+ * byollm_001 requires that "every MUST above has a conformance test id
+ * referenced inline". Keeping the MUSTs as a frozen registry rather than
+ * prose is what makes that requirement *checkable*: the conformance kit
+ * imports {@link MUSTS} and fails if any id has no test asserting it, so a
+ * new MUST cannot be added without a test and a test cannot silently drift
+ * away from the statement it claims to prove.
+ *
+ * Ids are stable and public — third-party servers cite them in their
+ * certification output.
+ */
+/** Which side of the wire is obliged to enforce a given MUST. */
+type MustEnforcer = "daemon" | "server" | "both";
+/** A single normative requirement of the protocol. */
+interface Must {
+    /** Stable public id, cited by conformance output. */
+    readonly id: string;
+    /** The requirement, in MUST language. */
+    readonly statement: string;
+    /** Which implementation is obliged to enforce it. */
+    readonly enforcedBy: MustEnforcer;
+    /** Spec section this was adjudicated in. */
+    readonly source: string;
+}
+/**
+ * Every normative MUST in protocol v0.
+ *
+ * @remarks
+ * Grouped by concern for readability; the conformance kit treats this as a
+ * flat set. Adding an entry here without a corresponding conformance test is
+ * a CI failure, by design.
+ */
+declare const MUSTS: Readonly<{
+    readonly PAIR_ONE_USER: Must;
+    readonly PAIR_INTERACTIVE: Must;
+    readonly PAIR_CODE_EXPIRES: Must;
+    readonly KIND_TYPED_ONLY: Must;
+    readonly KIND_NO_CODE: Must;
+    readonly CLAIM_REQUIRES_CAPABILITY: Must;
+    readonly CAPABILITY_IS_DETECTED: Must;
+    readonly CLAIM_ATOMIC: Must;
+    readonly LEASE_HONORED: Must;
+    readonly LEASE_RECLAIMABLE: Must;
+    readonly AUDIENCE_BOTH_SIDES: Must;
+    readonly SUBSCRIPTION_SELF_LOCK: Must;
+    readonly NAMED_LOCAL_ALLOWLIST: Must;
+    readonly REFUSAL_NOT_REOFFERED: Must;
+    readonly REVOCATION_HONORED: Must;
+    readonly CANCEL_HONORED: Must;
+    readonly DEPENDS_ON_GATING: Must;
+    readonly TTL_EXPIRY: Must;
+    readonly NO_RUNNER_SIGNAL: Must;
+    readonly RESULT_IDEMPOTENT: Must;
+    readonly RESULT_PROVENANCE: Must;
+    readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
+    readonly NO_SHELL_INTERPOLATION: Must;
+    readonly NO_PAYLOAD_ROUTING: Must;
+    readonly STRIPPED_CHILD_ENV: Must;
+    readonly HTTP_BASE_URL_SAFE: Must;
+    readonly OUTPUT_INERT: Must;
+    readonly COMMUNITY_BUDGETS: Must;
+}>;
+/** The id of any normative MUST. */
+type MustId = keyof typeof MUSTS;
+/** All MUST ids, for coverage checks. */
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+
+/** Protocol version carried on every request; servers refuse what they can't speak. */
+declare const PROTOCOL_VERSION: "0";
+/** The path prefix all endpoints mount under. */
+declare const PROTOCOL_PREFIX: "/byollm";
+/** The five endpoint names, in the order byollm_001 lists them. */
+declare const ENDPOINTS: readonly ["pair", "claim", "heartbeat", "result", "release"];
+type Endpoint = (typeof ENDPOINTS)[number];
+/**
+ * One entry of the capability matrix: a kind this daemon can actually serve,
+ * right now, with the backend and model that would serve it.
+ *
+ * Derived from owner config intersected with detected reality
+ * ({@link MUSTS.CAPABILITY_IS_DETECTED}) — a configured-but-unreachable
+ * backend must not appear here. Carries `backendClass` so the app can tell
+ * whether a result came from a sandboxed spawn or an HTTP call
+ * (byollm_001 Rev 1 §A).
+ */
+declare const Capability: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    backendId: z.ZodEnum<{
+        "openai-http": "openai-http";
+        "claude-cli": "claude-cli";
+    }>;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    model: z.ZodString;
+    offerScope: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+}, z.core.$strict>;
+type Capability = z.infer<typeof Capability>;
+/** The capability matrix a daemon advertises. */
+declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    backendId: z.ZodEnum<{
+        "openai-http": "openai-http";
+        "claude-cli": "claude-cli";
+    }>;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    model: z.ZodString;
+    offerScope: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+}, z.core.$strict>>;
+type CapabilityMatrix = z.infer<typeof CapabilityMatrix>;
+/**
+ * Pairing is a device-code exchange, not a pasted secret
+ * ({@link MUSTS.PAIR_INTERACTIVE}). The daemon starts a pairing, shows the
+ * user a short code and a URL, and polls until the user approves it inside
+ * the app's own authenticated session. Nothing listens on the user's machine
+ * and nothing works over a copied string alone.
+ */
+declare const PairStartRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    action: z.ZodLiteral<"start">;
+    daemon: z.ZodObject<{
+        version: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            win32: "win32";
+        }>;
+    }, z.core.$strip>;
+    capabilities: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        backendId: z.ZodEnum<{
+            "openai-http": "openai-http";
+            "claude-cli": "claude-cli";
+        }>;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        offerScope: z.ZodEnum<{
+            self: "self";
+            named: "named";
+            public: "public";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type PairStartRequest = z.infer<typeof PairStartRequest>;
+declare const PairStartResponse: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUrl: z.ZodURL;
+    expiresAt: z.ZodNumber;
+    pollIntervalMs: z.ZodNumber;
+}, z.core.$strict>;
+type PairStartResponse = z.infer<typeof PairStartResponse>;
+declare const PairPollRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    action: z.ZodLiteral<"poll">;
+    deviceCode: z.ZodString;
+}, z.core.$strict>;
+type PairPollRequest = z.infer<typeof PairPollRequest>;
+declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"denied">;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"expired">;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    runnerToken: z.ZodString;
+    runnerId: z.ZodString;
+    owner: z.ZodString;
+    ownerLabel: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "status">;
+type PairPollResponse = z.infer<typeof PairPollResponse>;
+declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    action: z.ZodLiteral<"start">;
+    daemon: z.ZodObject<{
+        version: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            win32: "win32";
+        }>;
+    }, z.core.$strip>;
+    capabilities: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        backendId: z.ZodEnum<{
+            "openai-http": "openai-http";
+            "claude-cli": "claude-cli";
+        }>;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        offerScope: z.ZodEnum<{
+            self: "self";
+            named: "named";
+            public: "public";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    action: z.ZodLiteral<"poll">;
+    deviceCode: z.ZodString;
+}, z.core.$strict>], "action">;
+type PairRequest = z.infer<typeof PairRequest>;
+declare const ClaimRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    runnerId: z.ZodString;
+    capabilities: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        backendId: z.ZodEnum<{
+            "openai-http": "openai-http";
+            "claude-cli": "claude-cli";
+        }>;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        offerScope: z.ZodEnum<{
+            self: "self";
+            named: "named";
+            public: "public";
+        }>;
+    }, z.core.$strict>>;
+    max: z.ZodNumber;
+}, z.core.$strict>;
+type ClaimRequest = z.infer<typeof ClaimRequest>;
+declare const ClaimResponse: z.ZodObject<{
+    jobs: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        payload: z.ZodUnion<readonly [z.ZodObject<{
+            prompt: z.ZodString;
+            system: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            messages: z.ZodArray<z.ZodObject<{
+                role: z.ZodEnum<{
+                    system: "system";
+                    user: "user";
+                    assistant: "assistant";
+                }>;
+                content: z.ZodString;
+            }, z.core.$strip>>;
+            system: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>]>;
+        audience: z.ZodEnum<{
+            self: "self";
+            named: "named";
+            public: "public";
+        }>;
+        owner: z.ZodString;
+        audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        lease: z.ZodObject<{
+            runnerId: z.ZodString;
+            expiresAt: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strict>>;
+    leaseMs: z.ZodNumber;
+}, z.core.$strict>;
+type ClaimResponse = z.infer<typeof ClaimResponse>;
+declare const HeartbeatRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    runnerId: z.ZodString;
+    daemonVersion: z.ZodString;
+    capabilities: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        backendId: z.ZodEnum<{
+            "openai-http": "openai-http";
+            "claude-cli": "claude-cli";
+        }>;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        offerScope: z.ZodEnum<{
+            self: "self";
+            named: "named";
+            public: "public";
+        }>;
+    }, z.core.$strict>>;
+    activeJobIds: z.ZodArray<z.ZodString>;
+    paused: z.ZodBoolean;
+}, z.core.$strict>;
+type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
+declare const HeartbeatResponse: z.ZodObject<{
+    revoked: z.ZodBoolean;
+    cancel: z.ZodArray<z.ZodString>;
+    leases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strict>>;
+    lost: z.ZodArray<z.ZodString>;
+    serverTime: z.ZodNumber;
+}, z.core.$strict>;
+type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
+declare const ResultRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    runnerId: z.ZodString;
+    jobId: z.ZodString;
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>;
+type ResultRequest = z.infer<typeof ResultRequest>;
+declare const ResultResponse: z.ZodObject<{
+    accepted: z.ZodBoolean;
+    state: z.ZodString;
+}, z.core.$strict>;
+type ResultResponse = z.infer<typeof ResultResponse>;
+declare const ReleaseRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    runnerId: z.ZodString;
+    jobIds: z.ZodArray<z.ZodString>;
+    reason: z.ZodEnum<{
+        revoked: "revoked";
+        shutdown: "shutdown";
+        pause: "pause";
+        "backend-down": "backend-down";
+        refused: "refused";
+    }>;
+}, z.core.$strict>;
+type ReleaseRequest = z.infer<typeof ReleaseRequest>;
+declare const ReleaseResponse: z.ZodObject<{
+    released: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+type ReleaseResponse = z.infer<typeof ReleaseResponse>;
+/**
+ * Wire error codes.
+ *
+ * byollm_002 requires that "server unreachable", "revoked", "no matching
+ * work" and "backend down" never share a message. Distinct codes here are how
+ * the daemon can tell three of those apart; the fourth is a transport failure
+ * with no response at all.
+ */
+declare const WireErrorCode: z.ZodEnum<{
+    revoked: "revoked";
+    "bad-request": "bad-request";
+    "unsupported-protocol-version": "unsupported-protocol-version";
+    unauthorized: "unauthorized";
+    "not-found": "not-found";
+    "rate-limited": "rate-limited";
+    "server-error": "server-error";
+}>;
+type WireErrorCode = z.infer<typeof WireErrorCode>;
+declare const WireError: z.ZodObject<{
+    error: z.ZodEnum<{
+        revoked: "revoked";
+        "bad-request": "bad-request";
+        "unsupported-protocol-version": "unsupported-protocol-version";
+        unauthorized: "unauthorized";
+        "not-found": "not-found";
+        "rate-limited": "rate-limited";
+        "server-error": "server-error";
+    }>;
+    message: z.ZodString;
+    retryAfter: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strict>;
+type WireError = z.infer<typeof WireError>;
+/** HTTP status each error code is served with. */
+declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
+
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendAccount, BackendClass, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, KindedPayload, Lease, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, ResultProvenance, ResultRequest, ResultResponse, TERMINAL_STATES, WireError, WireErrorCode, backendDescriptor, canTransition, effectiveOfferScope, isBackendId, isJobKind, isTerminal, matchAudience, payloadTextLength, provenanceFor };