@byollm/protocol 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,663 @@
+// src/audience.ts
+import { z as z2 } from "zod";
+
+// src/backends.ts
+import { z } from "zod";
+var BackendClass = z.enum(["http", "process"]);
+var BackendAccount = z.enum(["open", "subscription"]);
+var backend = (b) => Object.freeze(b);
+var BACKENDS = Object.freeze({
+  "openai-http": backend({
+    id: "openai-http",
+    label: "OpenAI-compatible HTTP server (Ollama, MLX, llama.cpp, vLLM)",
+    class: "http",
+    account: "open",
+    adversarialCorpus: "http"
+  }),
+  "claude-cli": backend({
+    id: "claude-cli",
+    label: "Claude CLI (your subscription)",
+    class: "process",
+    account: "subscription",
+    adversarialCorpus: "process"
+  })
+});
+var BACKEND_IDS = Object.freeze(Object.keys(BACKENDS));
+var BackendIdSchema = z.enum(
+  BACKEND_IDS
+);
+function isBackendId(value) {
+  return Object.hasOwn(BACKENDS, value);
+}
+function backendDescriptor(id) {
+  return BACKENDS[id];
+}
+
+// src/audience.ts
+var Audience = z2.enum(["self", "named", "public"]);
+var OfferScope = z2.enum(["self", "named", "public"]);
+var AUDIENCES = Object.freeze(Audience.options);
+var OFFER_SCOPES = Object.freeze(OfferScope.options);
+var MatchRefusal = z2.enum([
+  /** The daemon advertises no capability for this kind. */
+  "no-capability",
+  /** Job is `self` but this daemon belongs to a different user. */
+  "audience-self-other-owner",
+  /** Job is `named` but this daemon's local allowlist does not admit the owner. */
+  "not-locally-allowed",
+  /** Job is `named`/`public` but the server's own allowlist excludes this runner. */
+  "not-in-server-allowlist",
+  /** The backend offers only `self` and the job belongs to someone else. */
+  "offer-scope-too-narrow",
+  /** The matched backend is subscription-class, which is locked to `self`. */
+  "subscription-self-lock"
+]);
+var ALLOWED = Object.freeze({ ok: true });
+var refuse = (refusal) => Object.freeze({ ok: false, refusal });
+function effectiveOfferScope(configured, account) {
+  return account === "subscription" ? "self" : configured;
+}
+function matchAudience(job, daemon) {
+  const sameOwner = job.owner === daemon.owner;
+  if (job.audience === "self" && !sameOwner) {
+    return refuse("audience-self-other-owner");
+  }
+  if (job.audience === "named" && !sameOwner && job.audienceAllow !== void 0 && !job.audienceAllow.includes(daemon.owner)) {
+    return refuse("not-in-server-allowlist");
+  }
+  const scope = effectiveOfferScope(daemon.offerScope, daemon.account);
+  if (sameOwner) {
+    return ALLOWED;
+  }
+  if (daemon.account === "subscription") {
+    return refuse("subscription-self-lock");
+  }
+  switch (scope) {
+    case "self":
+      return refuse("offer-scope-too-narrow");
+    case "named":
+      return daemon.locallyAllows(job.owner) ? ALLOWED : refuse("not-locally-allowed");
+    case "public":
+      return ALLOWED;
+  }
+}
+var REFUSAL_MESSAGES = Object.freeze({
+  "no-capability": "no backend on this machine is configured and healthy for that job kind",
+  "audience-self-other-owner": "the job is private to its owner and this machine is paired to someone else",
+  "not-locally-allowed": "the job's owner is not on this machine's allowlist (byollm allow <server> <user>)",
+  "not-in-server-allowlist": "the app restricted this job to named runners and this machine is not one of them",
+  "offer-scope-too-narrow": "this backend is offered to its owner only (byollm offer <backend> named|public to widen)",
+  "subscription-self-lock": "subscription-backed models run their owner's work only \u2014 this is a protocol rule, not a setting"
+});
+
+// src/kinds.ts
+import { z as z3 } from "zod";
+var PAYLOAD_LIMITS = Object.freeze({
+  /** Max characters in any single text field. */
+  maxTextChars: 1e6,
+  /** Max messages in an `llm.chat` conversation. */
+  maxMessages: 256,
+  /** Max characters across the whole payload. */
+  maxTotalChars: 4e6
+});
+var ChatMessage = z3.object({
+  role: z3.enum(["system", "user", "assistant"]),
+  content: z3.string().max(PAYLOAD_LIMITS.maxTextChars)
+});
+var GeneratePayload = z3.object({
+  prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
+  system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
+}).strict();
+var ChatPayload = z3.object({
+  messages: z3.array(ChatMessage).min(1).max(PAYLOAD_LIMITS.maxMessages),
+  system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
+}).strict();
+var JobKind = z3.enum(["llm.generate", "llm.chat"]);
+var JOB_KINDS = Object.freeze(JobKind.options);
+var KindedPayload = z3.discriminatedUnion("kind", [
+  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }),
+  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload })
+]);
+function isJobKind(value) {
+  return JOB_KINDS.includes(value);
+}
+function payloadTextLength(kinded) {
+  if (kinded.kind === "llm.generate") {
+    return kinded.payload.prompt.length + (kinded.payload.system?.length ?? 0);
+  }
+  const messages = kinded.payload.messages.reduce(
+    (sum, m) => sum + m.content.length,
+    0
+  );
+  return messages + (kinded.payload.system?.length ?? 0);
+}
+
+// src/job.ts
+import { z as z4 } from "zod";
+var JobState = z4.enum([
+  "queued",
+  "claimed",
+  "running",
+  "ok",
+  "error",
+  "canceled",
+  "expired"
+]);
+var TERMINAL_STATES = Object.freeze([
+  "ok",
+  "error",
+  "canceled",
+  "expired"
+]);
+function isTerminal(state) {
+  return TERMINAL_STATES.includes(state);
+}
+var TRANSITIONS = Object.freeze({
+  queued: ["claimed", "expired", "canceled"],
+  // A claimed job returns to `queued` when its lease expires un-renewed
+  // ({@link MUSTS.LEASE_RECLAIMABLE}).
+  claimed: ["running", "queued", "canceled", "error"],
+  running: ["ok", "error", "canceled", "queued"],
+  ok: [],
+  error: [],
+  canceled: [],
+  expired: []
+});
+function canTransition(from, to) {
+  return TRANSITIONS[from].includes(to);
+}
+var Lease = z4.object({
+  /** The runner holding the lease. */
+  runnerId: z4.string().min(1),
+  /** Epoch milliseconds after which the claim is void. */
+  expiresAt: z4.number().int().positive()
+});
+var JobPayload = z4.union([GeneratePayload, ChatPayload]);
+var ClaimedJob = z4.object({
+  id: z4.string().min(1),
+  kind: JobKind,
+  payload: JobPayload,
+  audience: Audience,
+  /** The app's id for the user who enqueued it. */
+  owner: z4.string().min(1),
+  /** Runner owners the app restricted a `named` job to, if any. */
+  audienceAllow: z4.array(z4.string().min(1)).optional(),
+  lease: Lease
+}).strict();
+var ResultProvenance = z4.object({
+  /** The audience the job ran under. */
+  audience: Audience,
+  /** The runner that produced it. */
+  runnerId: z4.string().min(1),
+  /** The runner owner's id in this app's namespace. */
+  runnerOwner: z4.string().min(1),
+  /** Which backend class produced it — an HTTP call or a sandboxed spawn. */
+  backendClass: BackendClass,
+  /** The model the runner reports having used. */
+  model: z4.string().min(1),
+  /**
+   * False only for `self` jobs. When true the app MUST treat `text` as
+   * untrusted third-party content.
+   */
+  untrusted: z4.boolean()
+}).strict();
+function provenanceFor(input) {
+  return {
+    audience: input.audience,
+    runnerId: input.runnerId,
+    runnerOwner: input.runnerOwner,
+    backendClass: input.backendClass,
+    model: input.model,
+    untrusted: input.audience !== "self"
+  };
+}
+var JobResultOk = z4.object({
+  outcome: z4.literal("ok"),
+  text: z4.string(),
+  /** Optional reference to a stored artifact; never a local path. */
+  artifactUrl: z4.url().optional()
+}).strict();
+var JobResultError = z4.object({
+  outcome: z4.literal("error"),
+  code: z4.string().min(1),
+  message: z4.string().min(1),
+  /** Whether the app may reasonably re-enqueue. */
+  retryable: z4.boolean()
+}).strict();
+var JobResultCanceled = z4.object({
+  outcome: z4.literal("canceled")
+}).strict();
+var JobOutcome = z4.discriminatedUnion("outcome", [
+  JobResultOk,
+  JobResultError,
+  JobResultCanceled
+]);
+var DeliveredResult = z4.object({
+  jobId: z4.string().min(1),
+  state: JobState,
+  outcome: JobOutcome.optional(),
+  provenance: ResultProvenance.optional()
+}).strict();
+
+// src/musts.ts
+var must = (m) => Object.freeze(m);
+var MUSTS = Object.freeze({
+  // ---- Pairing and identity -------------------------------------------
+  PAIR_ONE_USER: must({
+    id: "PAIR_ONE_USER",
+    statement: "A runner token MUST be bound to exactly one user; a daemon MUST refuse work not attributable to its paired user.",
+    enforcedBy: "both",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  PAIR_INTERACTIVE: must({
+    id: "PAIR_INTERACTIVE",
+    statement: "Pairing MUST be interactive (device-code approval in the app's own session); a long-lived pasted secret MUST NOT be accepted as pairing.",
+    enforcedBy: "server",
+    source: "byollm_001 \xA7Endpoints.1"
+  }),
+  PAIR_CODE_EXPIRES: must({
+    id: "PAIR_CODE_EXPIRES",
+    statement: "An unapproved device code MUST expire and MUST NOT be redeemable after expiry.",
+    enforcedBy: "server",
+    source: "byollm_001 \xA7Endpoints.1"
+  }),
+  // ---- Typed job kinds --------------------------------------------------
+  KIND_TYPED_ONLY: must({
+    id: "KIND_TYPED_ONLY",
+    statement: "Job kinds MUST resolve against handlers baked into the daemon. A daemon MUST refuse an unknown kind rather than guess.",
+    enforcedBy: "daemon",
+    source: "byollm_001 \xA7Jobs are typed data"
+  }),
+  KIND_NO_CODE: must({
+    id: "KIND_NO_CODE",
+    statement: "A server MUST NOT be able to convey code, a shell string, or a path to execute; payloads are data handed to a model only.",
+    enforcedBy: "daemon",
+    source: "byollm_001 \xA7Jobs are typed data; byollm_004 \xA71"
+  }),
+  // ---- Capability and claiming -----------------------------------------
+  CLAIM_REQUIRES_CAPABILITY: must({
+    id: "CLAIM_REQUIRES_CAPABILITY",
+    statement: "A daemon MUST NOT be given a job whose kind is absent from its advertised capability matrix.",
+    enforcedBy: "both",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  CAPABILITY_IS_DETECTED: must({
+    id: "CAPABILITY_IS_DETECTED",
+    statement: "An advertised capability matrix MUST be the intersection of owner config and detected, healthy reality \u2014 never config alone.",
+    enforcedBy: "daemon",
+    source: "byollm_002 \xA7Routing"
+  }),
+  CLAIM_ATOMIC: must({
+    id: "CLAIM_ATOMIC",
+    statement: "Claiming MUST be atomic: a job MUST NOT be handed to two runners concurrently.",
+    enforcedBy: "server",
+    source: "byollm_001 \xA7Endpoints.2"
+  }),
+  // ---- Leases -----------------------------------------------------------
+  LEASE_HONORED: must({
+    id: "LEASE_HONORED",
+    statement: "A daemon MUST stop work on a job whose lease it has failed to renew, and MUST NOT report a result for an expired lease it no longer holds.",
+    enforcedBy: "daemon",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  LEASE_RECLAIMABLE: must({
+    id: "LEASE_RECLAIMABLE",
+    statement: "A lease that expires un-renewed MUST make its job claimable again with no loss of the job.",
+    enforcedBy: "server",
+    source: "byollm_001 \xA7Endpoints.2"
+  }),
+  // ---- Audience and offer scope ----------------------------------------
+  AUDIENCE_BOTH_SIDES: must({
+    id: "AUDIENCE_BOTH_SIDES",
+    statement: "A job MUST run on a daemon only if the daemon's offer scope admits the job's owner AND the job's audience admits the daemon's owner.",
+    enforcedBy: "both",
+    source: "byollm_001 \xA7The audience model"
+  }),
+  SUBSCRIPTION_SELF_LOCK: must({
+    id: "SUBSCRIPTION_SELF_LOCK",
+    statement: "A subscription-class backend's offer scope MUST be 'self' and MUST NOT be widened by configuration.",
+    enforcedBy: "daemon",
+    source: "byollm_001 \xA7The audience model"
+  }),
+  NAMED_LOCAL_ALLOWLIST: must({
+    id: "NAMED_LOCAL_ALLOWLIST",
+    statement: "A 'named' job MUST be admitted only by the daemon's own local (server origin, user id) allowlist \u2014 never on the server's assertion alone.",
+    enforcedBy: "daemon",
+    source: "byollm_001 Rev 1 \xA7B"
+  }),
+  REFUSAL_NOT_REOFFERED: must({
+    id: "REFUSAL_NOT_REOFFERED",
+    statement: "A server MUST NOT re-offer a job to a runner that released it with reason 'refused'.",
+    enforcedBy: "server",
+    source: "byollm_001 Rev 1 \xA7B (loop resolved in build review)"
+  }),
+  // ---- Revocation and cancel -------------------------------------------
+  REVOCATION_HONORED: must({
+    id: "REVOCATION_HONORED",
+    statement: "A revoked daemon MUST stop claiming and MUST abandon in-flight work by the next heartbeat at the latest.",
+    enforcedBy: "daemon",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  CANCEL_HONORED: must({
+    id: "CANCEL_HONORED",
+    statement: "A job id in a heartbeat response's cancel list MUST abort that job's in-flight backend call and be reported as 'canceled'.",
+    enforcedBy: "daemon",
+    source: "byollm_001 Rev 1 \xA7C"
+  }),
+  // ---- Lifecycle, dependencies, delivery -------------------------------
+  DEPENDS_ON_GATING: must({
+    id: "DEPENDS_ON_GATING",
+    statement: "A job MUST NOT be claimable until every job in its dependsOn set has reached the 'ok' state.",
+    enforcedBy: "server",
+    source: "byollm_001 Rev 1 \xA7E"
+  }),
+  TTL_EXPIRY: must({
+    id: "TTL_EXPIRY",
+    statement: "An unclaimed job MUST become 'expired' once its TTL elapses, and the TTL clock MUST start when the job becomes claimable, not at enqueue.",
+    enforcedBy: "server",
+    source: "byollm_001 Rev 1 \xA7D (TTL clock resolved in build review)"
+  }),
+  NO_RUNNER_SIGNAL: must({
+    id: "NO_RUNNER_SIGNAL",
+    statement: "A server MUST surface noRunnerAvailable when no runner with matching capability has heartbeated within the liveness window, and MUST NOT raise it for a job still blocked on dependencies.",
+    enforcedBy: "server",
+    source: "byollm_001 Rev 1 \xA7D"
+  }),
+  RESULT_IDEMPOTENT: must({
+    id: "RESULT_IDEMPOTENT",
+    statement: "Result submission MUST be idempotent by job id; the first terminal outcome wins and later submissions MUST NOT change it.",
+    enforcedBy: "server",
+    source: "byollm_001 \xA7Endpoints.4"
+  }),
+  RESULT_PROVENANCE: must({
+    id: "RESULT_PROVENANCE",
+    statement: "A result from a non-'self' job MUST carry its provenance (audience and runner) to the delivery seam so an app never treats volunteer output as first-party.",
+    enforcedBy: "server",
+    source: "byollm_003 Rev 1 \xA7Return-trip"
+  }),
+  // ---- The trust surface -------------------------------------------------
+  INGRESS_LOGGED_BEFORE_EXECUTION: must({
+    id: "INGRESS_LOGGED_BEFORE_EXECUTION",
+    statement: "Every executed prompt MUST be appended to the local ingress log before execution begins.",
+    enforcedBy: "daemon",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  // ---- Execution isolation (byollm_004) ---------------------------------
+  NO_SHELL_INTERPOLATION: must({
+    id: "NO_SHELL_INTERPOLATION",
+    statement: "Process-class backends MUST be invoked with a fixed argv array and the payload delivered on stdin; payload text MUST NOT reach a command line.",
+    enforcedBy: "daemon",
+    source: "byollm_004 \xA72"
+  }),
+  NO_PAYLOAD_ROUTING: must({
+    id: "NO_PAYLOAD_ROUTING",
+    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them.",
+    enforcedBy: "daemon",
+    source: "byollm_004 \xA72"
+  }),
+  STRIPPED_CHILD_ENV: must({
+    id: "STRIPPED_CHILD_ENV",
+    statement: "Process-class children MUST spawn with an allowlisted environment, a scratch cwd, no inherited descriptors beyond std streams, and hard timeout and output-size caps.",
+    enforcedBy: "daemon",
+    source: "byollm_004 \xA72"
+  }),
+  HTTP_BASE_URL_SAFE: must({
+    id: "HTTP_BASE_URL_SAFE",
+    statement: "HTTP-class backends MUST send requests only to the owner-configured base URL and MUST refuse base URLs resolving to cloud-metadata or link-local addresses.",
+    enforcedBy: "daemon",
+    source: "byollm_004 Rev 1 \xA7Backend taxonomy"
+  }),
+  OUTPUT_INERT: must({
+    id: "OUTPUT_INERT",
+    statement: "Returned text MUST be treated as inert bytes: never evaluated, never written to a payload-named path, never interpolated into a shell or into terminal control sequences when logged.",
+    enforcedBy: "daemon",
+    source: "byollm_004 \xA72"
+  }),
+  COMMUNITY_BUDGETS: must({
+    id: "COMMUNITY_BUDGETS",
+    statement: "Jobs whose owner is not the daemon's owner MUST be subject to the owner's rate limits, daily cap, and resource budget.",
+    enforcedBy: "daemon",
+    source: "byollm_004 \xA74"
+  })
+});
+var MUST_IDS = Object.freeze(Object.keys(MUSTS));
+
+// src/wire.ts
+import { z as z5 } from "zod";
+var PROTOCOL_VERSION = "0";
+var PROTOCOL_PREFIX = "/byollm";
+var ENDPOINTS = Object.freeze([
+  "pair",
+  "claim",
+  "heartbeat",
+  "result",
+  "release"
+]);
+var Capability = z5.object({
+  kind: JobKind,
+  backendId: BackendIdSchema,
+  backendClass: BackendClass,
+  model: z5.string().min(1),
+  offerScope: OfferScope
+}).strict();
+var CapabilityMatrix = z5.array(Capability);
+var PairStartRequest = z5.object({
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  action: z5.literal("start"),
+  daemon: z5.object({
+    version: z5.string().min(1),
+    /** Shown in the app's runner list so a user can tell their machines apart. */
+    label: z5.string().min(1).max(120),
+    platform: z5.enum(["darwin", "linux", "win32"])
+  }),
+  capabilities: CapabilityMatrix
+}).strict();
+var PairStartResponse = z5.object({
+  /** Secret the daemon polls with. Never shown to the user. */
+  deviceCode: z5.string().min(20),
+  /** Short code the user reads and confirms in the browser. */
+  userCode: z5.string().min(4).max(16),
+  /** Where the user approves. Must be on the server's own origin. */
+  verificationUrl: z5.url(),
+  /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
+  expiresAt: z5.number().int().positive(),
+  /** How often the daemon may poll. */
+  pollIntervalMs: z5.number().int().min(500).max(6e4)
+}).strict();
+var PairPollRequest = z5.object({
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  action: z5.literal("poll"),
+  deviceCode: z5.string().min(20)
+}).strict();
+var PairPollResponse = z5.discriminatedUnion("status", [
+  z5.object({ status: z5.literal("pending") }).strict(),
+  z5.object({ status: z5.literal("denied") }).strict(),
+  z5.object({ status: z5.literal("expired") }).strict(),
+  z5.object({
+    status: z5.literal("approved"),
+    /** Bearer token for every later call. Scoped to exactly one user. */
+    runnerToken: z5.string().min(20),
+    runnerId: z5.string().min(1),
+    /** The app's id for the approving user — this daemon's owner forever. */
+    owner: z5.string().min(1),
+    /** Display name for the trust UI, if the app offers one. */
+    ownerLabel: z5.string().optional()
+  }).strict()
+]);
+var PairRequest = z5.discriminatedUnion("action", [
+  PairStartRequest,
+  PairPollRequest
+]);
+var ClaimRequest = z5.object({
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  runnerId: z5.string().min(1),
+  /** Re-sent on every claim so a server never matches against a stale matrix. */
+  capabilities: CapabilityMatrix,
+  /** Upper bound on jobs to return; the server may return fewer. */
+  max: z5.number().int().min(1).max(64)
+}).strict();
+var ClaimResponse = z5.object({
+  jobs: z5.array(ClaimedJob),
+  /** Lease duration granted, so the daemon knows its renewal deadline. */
+  leaseMs: z5.number().int().positive()
+}).strict();
+var HeartbeatRequest = z5.object({
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  runnerId: z5.string().min(1),
+  daemonVersion: z5.string().min(1),
+  capabilities: CapabilityMatrix,
+  /** Jobs this daemon believes it holds; the server renews their leases. */
+  activeJobIds: z5.array(z5.string().min(1)),
+  /** True while the owner has the daemon paused; the server stops offering work. */
+  paused: z5.boolean()
+}).strict();
+var HeartbeatResponse = z5.object({
+  /** Once true, the daemon stops claiming and abandons in-flight work. */
+  revoked: z5.boolean(),
+  /**
+   * Per-job cancel (byollm_001 Rev 1 §C). The daemon aborts these jobs'
+   * in-flight backend calls and reports them `canceled`.
+   */
+  cancel: z5.array(z5.string().min(1)),
+  /** Jobs whose leases were renewed, with their new expiry. */
+  leases: z5.array(
+    z5.object({
+      jobId: z5.string().min(1),
+      expiresAt: z5.number().int().positive()
+    }).strict()
+  ),
+  /**
+   * Jobs the daemon thinks it holds but the server has reassigned or
+   * expired. The daemon must stop work on these and not report results.
+   */
+  lost: z5.array(z5.string().min(1)),
+  /** Server clock, so a daemon with a skewed clock still honors leases. */
+  serverTime: z5.number().int().positive()
+}).strict();
+var ResultRequest = z5.object({
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  runnerId: z5.string().min(1),
+  jobId: z5.string().min(1),
+  outcome: JobOutcome,
+  /** Which model actually served it, for the result's provenance. */
+  model: z5.string().min(1),
+  backendClass: BackendClass,
+  /** Wall-clock milliseconds the backend call took. */
+  durationMs: z5.number().int().nonnegative()
+}).strict();
+var ResultResponse = z5.object({
+  /**
+   * False when the submission lost an idempotency race or the lease was
+   * already gone — the daemon should discard, not retry
+   * ({@link MUSTS.RESULT_IDEMPOTENT}).
+   */
+  accepted: z5.boolean(),
+  /** The job's state after this submission. */
+  state: z5.string().min(1)
+}).strict();
+var ReleaseRequest = z5.object({
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  runnerId: z5.string().min(1),
+  jobIds: z5.array(z5.string().min(1)),
+  /**
+   * Why, so the app's runner list can say something true.
+   *
+   * `refused` is load-bearing, not cosmetic: the server cannot evaluate a
+   * daemon's *local* `named` allowlist (§4.2), so it may legitimately offer
+   * a job this daemon then declines. The server MUST record the refusal and
+   * stop offering that job to that runner, or the pair would spin between
+   * claim and release forever.
+   */
+  reason: z5.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+}).strict();
+var ReleaseResponse = z5.object({
+  released: z5.array(z5.string().min(1))
+}).strict();
+var WireErrorCode = z5.enum([
+  "bad-request",
+  "unsupported-protocol-version",
+  "unauthorized",
+  "revoked",
+  "not-found",
+  "rate-limited",
+  "server-error"
+]);
+var WireError = z5.object({
+  error: WireErrorCode,
+  message: z5.string().min(1),
+  /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
+  retryAfter: z5.number().int().nonnegative().optional()
+}).strict();
+var ERROR_STATUS = Object.freeze({
+  "bad-request": 400,
+  "unsupported-protocol-version": 400,
+  unauthorized: 401,
+  revoked: 403,
+  "not-found": 404,
+  "rate-limited": 429,
+  "server-error": 500
+});
+export {
+  AUDIENCES,
+  Audience,
+  BACKENDS,
+  BACKEND_IDS,
+  BackendAccount,
+  BackendClass,
+  BackendIdSchema,
+  Capability,
+  CapabilityMatrix,
+  ChatMessage,
+  ChatPayload,
+  ClaimRequest,
+  ClaimResponse,
+  ClaimedJob,
+  DeliveredResult,
+  ENDPOINTS,
+  ERROR_STATUS,
+  GeneratePayload,
+  HeartbeatRequest,
+  HeartbeatResponse,
+  JOB_KINDS,
+  JobKind,
+  JobOutcome,
+  JobPayload,
+  JobResultCanceled,
+  JobResultError,
+  JobResultOk,
+  JobState,
+  KindedPayload,
+  Lease,
+  MUSTS,
+  MUST_IDS,
+  MatchRefusal,
+  OFFER_SCOPES,
+  OfferScope,
+  PAYLOAD_LIMITS,
+  PROTOCOL_PREFIX,
+  PROTOCOL_VERSION,
+  PairPollRequest,
+  PairPollResponse,
+  PairRequest,
+  PairStartRequest,
+  PairStartResponse,
+  REFUSAL_MESSAGES,
+  ReleaseRequest,
+  ReleaseResponse,
+  ResultProvenance,
+  ResultRequest,
+  ResultResponse,
+  TERMINAL_STATES,
+  WireError,
+  WireErrorCode,
+  backendDescriptor,
+  canTransition,
+  effectiveOfferScope,
+  isBackendId,
+  isJobKind,
+  isTerminal,
+  matchAudience,
+  payloadTextLength,
+  provenanceFor
+};
+//# sourceMappingURL=index.js.map