@byollm/protocol 0.1.0-alpha.1 → 0.1.0-alpha.100

package/dist/index.d.ts

@@ -1,771 +1,462 @@
 import { z } from 'zod';
+import { S as StoredKeys, P as PublicIdentity } from './portable-C6rfiCXi.js';
+export { C as CONSOLE_FRAME_VERSION, a as CONSOLE_MAX_DATA_BYTES, b as ConsoleBye, c as ConsoleFrame, d as ConsoleHello, e as ConsoleOrder, f as ConsoleOrderFault, g as ConsoleOrderResult, h as ConsoleResize, i as ConsoleStdin, j as ConsoleStdout, E as ENCRYPTION_KEY_CONTEXT, k as ENVELOPE_BODY_VERSION, l as ENVELOPE_MAX_AGE_MS, m as EnvelopeBodyContext, n as EnvelopeContext, o as EnvelopeDirection, p as EnvelopeFailure, q as EnvelopeInner, O as OpenResult, r as SealedEnvelope, s as consoleDataBytes, t as consoleEnvelope, u as consoleOrder, v as cryptoReady, w as decodeConsoleData, x as decodeEnvelopeInner, y as encodeConsoleData, z as encodeEnvelopeInner, A as envelopeSignedBody, B as fingerprint, D as fromBase64Url, F as generateKeys, G as keyId, H as open, I as publicIdentityOf, J as seal, K as signWith, L as toBase64Url, M as verifyPublicIdentity, N as verifyWith } from './portable-C6rfiCXi.js';
 
 /**
- * How a backend reaches its model — the taxonomy introduced in byollm_001
- * Rev 1 §A, because the two classes have different threat surfaces.
+ * Protocol version carried on every request; servers refuse what they can't
+ * speak.
  *
- * - `http`: an OpenAI-compatible HTTP server (Ollama, `mlx_lm.server`,
- *   llama.cpp server, vLLM). Spawns nothing, so byollm_004 §2's argv, stdin,
- *   env and sandbox requirements are not applicable by construction. Its
- *   threat surface is SSRF-shaped and bounded by {@link MUSTS.HTTP_BASE_URL_SAFE}.
- * - `process`: spawns a binary (`claude` CLI today, `mlx_lm.lora` for a
- *   future `train.*` kind). All of byollm_004 §2 is mandatory here.
- */
-declare const BackendClass: z.ZodEnum<{
-    http: "http";
-    process: "process";
-}>;
-type BackendClass = z.infer<typeof BackendClass>;
-/**
- * Whose account pays for the inference.
+ * **`1` because byollm_016 changed the vocabulary** — byollm-review
+ * 2026-08-27. `OfferScope` lost `public`, `self|named` became
+ * `private|team`, `JobStub` lost `service` and gained `purpose`, and the
+ * grant's site field changed namespace. The version stayed `0` through all of
+ * it.
  *
- * `subscription` backends run against a vendor account belonging to the
- * machine's owner. They are hard-locked to an offer scope of `self`
- * ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — one account executes one person's
- * work. This is orthogonal to {@link BackendClass}: `claude-cli` is both
- * process-class and subscription-class, while a future local `mlx_lm.lora`
- * backend would be process-class and open.
- */
-declare const BackendAccount: z.ZodEnum<{
-    open: "open";
-    subscription: "subscription";
-}>;
-type BackendAccount = z.infer<typeof BackendAccount>;
-/** The immutable facts about a backend that the protocol reasons over. */
-interface BackendDescriptor {
-    /** Stable backend id, as written in `byollm.config.json`. */
-    readonly id: string;
-    /** Human-readable name for the trust UI. */
-    readonly label: string;
-    /** Determines which isolation requirements apply. */
-    readonly class: BackendClass;
-    /** Determines whether the offer scope can be widened past `self`. */
-    readonly account: BackendAccount;
-    /**
-     * Which adversarial corpus byollm_004 §5 runs against this backend. A
-     * backend cannot be registered without one — the coverage check in the
-     * adversarial suite enforces it.
-     */
-    readonly adversarialCorpus: "process" | "http";
-}
-/**
- * The v1 backend registry.
+ * The consequence was the failure the handshake exists to prevent, arriving
+ * around it: a pre-rip daemon declares `0`, passes the version check, and
+ * then fails whole-body schema validation with "request failed schema
+ * validation" — no field named, no vocabulary named, no upgrade command. Once
+ * every ten seconds, forever, while its owner watches a device go stale for
+ * no stated reason. The check below was written because "a mismatch surfaced
+ * as a generic bad-request" and "an error a user cannot act on is barely
+ * better than a hang"; the number not moving is how that came back.
  *
- * byollm_001 Rev 1 §A collapses four planned backends into one HTTP-class
- * entry: Ollama, `mlx_lm.server`, llama.cpp server and vLLM all speak
- * OpenAI-compatible `/v1/chat/completions`, so they are one backend with N
- * owner-configured base URLs rather than four adapters. That is what puts
- * MLX inference in v1.
+ * A registry is a schema and an enum value is the contract — this project's
+ * own words, from the release that silenced a fleet by adding a backend id.
+ * The same sentence applies to removing an offer scope.
  */
-declare const BACKENDS: Readonly<{
-    readonly "openai-http": BackendDescriptor;
-    readonly "claude-cli": BackendDescriptor;
-}>;
-/** The id of a registered backend. */
-type BackendId = keyof typeof BACKENDS;
-/** All registered backend ids — the adversarial coverage check iterates this. */
-declare const BACKEND_IDS: readonly ("openai-http" | "claude-cli")[];
-declare const BackendIdSchema: z.ZodEnum<{
-    "openai-http": "openai-http";
-    "claude-cli": "claude-cli";
-}>;
-/** Narrow an arbitrary string to a registered backend id. */
-declare function isBackendId(value: string): value is BackendId;
+declare const PROTOCOL_VERSION: "1";
 /**
- * Look up a backend descriptor.
+ * Every protocol version this build can serve, **oldest first**.
  *
- * @throws if the id is not registered — an unregistered backend has no
- * adversarial corpus, so refusing is the safe direction.
+ * One entry today. It is a list rather than a constant because the shape of
+ * the check is the point: a server supporting two versions through a
+ * migration should not need a different code path from one supporting one.
  */
-declare function backendDescriptor(id: BackendId): BackendDescriptor;
-
 /**
- * Who may run a job, declared by the app that enqueued it.
+ * `0` is deliberately **not** here, though the list exists for exactly that.
  *
- * - `self` — only the job owner's own daemon.
- * - `named` — a daemon whose owner has explicitly allowed this (server, user)
- *   pair in their *local* allowlist (byollm_001 Rev 1 §B).
- * - `public` — any daemon offering `public` compute.
- */
-declare const Audience: z.ZodEnum<{
-    self: "self";
-    named: "named";
-    public: "public";
-}>;
-type Audience = z.infer<typeof Audience>;
-/**
- * What a daemon backend is willing to run, declared by the machine's owner.
- * Same three values as {@link Audience}, but the two are independent axes —
- * a job runs only where both agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}).
+ * Supporting two versions through a migration is the shape this was built
+ * for, and it is the wrong tool when the vocabularies are incompatible: a `0`
+ * daemon sends `offer: "public"` and a `service` on its stubs, so accepting
+ * its version only moves the refusal one layer down — to the schema error
+ * that names nothing, which is the bug. Refusing the version is the whole
+ * point, because that refusal says what to do.
  */
-declare const OfferScope: z.ZodEnum<{
-    self: "self";
-    named: "named";
-    public: "public";
-}>;
-type OfferScope = z.infer<typeof OfferScope>;
-/** All audience values, in widening order. */
-declare const AUDIENCES: readonly ("self" | "named" | "public")[];
-/** All offer scopes, in widening order. */
-declare const OFFER_SCOPES: readonly ("self" | "named" | "public")[];
+declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 /**
- * Why a job was refused. Distinct codes because byollm_002 requires that
- * different truths never share a message — "no matching work" and "refused on
- * principle" are not the same event, and a volunteer debugging their setup
- * needs to know which one happened.
+ * The oldest version this build will talk to — derived, not declared.
+ *
+ * Stating it separately would be a second thing to keep in step with the list
+ * above, and the failure would be silent: a minimum that no longer matches
+ * what is supported produces a refusal naming a version the server would in
+ * fact have accepted.
  */
-declare const MatchRefusal: z.ZodEnum<{
-    "no-capability": "no-capability";
-    "audience-self-other-owner": "audience-self-other-owner";
-    "not-locally-allowed": "not-locally-allowed";
-    "not-in-server-allowlist": "not-in-server-allowlist";
-    "offer-scope-too-narrow": "offer-scope-too-narrow";
-    "subscription-self-lock": "subscription-self-lock";
-}>;
-type MatchRefusal = z.infer<typeof MatchRefusal>;
-/** The outcome of an audience match. */
-type MatchResult = {
-    readonly ok: true;
-} | {
-    readonly ok: false;
-    readonly refusal: MatchRefusal;
-};
+declare const MIN_PROTOCOL_VERSION: string;
+/** A structured refusal, so a daemon can say something useful to its owner. */
+interface VersionRefusal {
+    readonly error: "unsupported-protocol-version";
+    readonly message: string;
+    readonly supported: readonly string[];
+    readonly minimum: string;
+}
 /**
- * The effective offer scope of a backend.
+ * The version a request declares, wherever it carries it.
+ *
+ * A POST declares it in its body, which is where every request schema has
+ * always put it. A GET has no body, and the relay has one — the site plane's
+ * `pending` read — so it declares it in the query string instead.
  *
- * A subscription-class backend is locked to `self` regardless of what config
- * requests ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}). This is a protocol MUST,
- * not a setting: the lock is applied here, at the one place both the daemon's
- * config loader and its matcher call, so there is no code path that observes
- * a widened subscription scope.
+ * **Two carriers, one rule.** That asymmetry is HTTP's rather than ours, and
+ * the alternative was worse in both directions: a header for everything would
+ * change every existing daemon's request, and skipping GETs would leave an
+ * endpoint outside the handshake — which is precisely the shape B.4 found,
+ * where a whole plane was outside it.
  */
-declare function effectiveOfferScope(configured: OfferScope, account: BackendAccount): OfferScope;
-/** The job-side facts a match needs. */
-interface MatchJob {
-    /** The app's id for the user who enqueued the job. */
-    readonly owner: string;
-    /** Who the app says may run it. */
-    readonly audience: Audience;
-    /**
-     * Optional server-side restriction on which runner owners may take a
-     * `named` job. Defence in depth only — the daemon's local allowlist is the
-     * enforcing side ({@link MUSTS.NAMED_LOCAL_ALLOWLIST}).
-     */
-    readonly audienceAllow?: readonly string[] | undefined;
-}
-/** The daemon-side facts a match needs. */
-interface MatchDaemon {
-    /** The app's id for the user this daemon is paired to. */
-    readonly owner: string;
-    /** Effective scope of the backend that would run the job. */
-    readonly offerScope: OfferScope;
-    /** Account class of that backend. */
-    readonly account: BackendAccount;
-    /**
-     * Does this daemon's *local* allowlist admit the given owner for the server
-     * origin the job came from? Supplied as a predicate so the protocol package
-     * stays free of file I/O; the daemon passes its allowlist, the server
-     * passes a conservative `() => true` because it cannot know a remote
-     * daemon's local list and must not pretend to.
-     */
-    readonly locallyAllows: (owner: string) => boolean;
-}
+declare function declaredVersion(input: {
+    body?: unknown;
+    query?: URLSearchParams;
+}): unknown;
 /**
- * Decide whether a job may run on a daemon.
+ * Check the protocol version on an incoming request
+ * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
  *
- * Both sides must agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}):
- * 1. the job's audience must admit the daemon's owner, and
- * 2. the backend's offer scope must admit the job's owner.
+ * Returns a refusal, or `null` to proceed.
  *
- * The full nine-way matrix (three audiences × three offer scopes) is asserted
- * by the conformance kit. The function is pure and total so both the daemon
- * and the server can run the identical rule — the daemon refuses, and the
- * server refuses too (byollm_003 §Server-side MUSTs).
+ * **A missing version is refused the same way a wrong one is.** That is the
+ * half worth stating: before this existed, the version travelled as a
+ * `z.literal` inside each endpoint's schema, so a mismatch surfaced as a
+ * generic `bad-request` — a daemon and a server discovered they disagreed by
+ * failing, with nothing in the response naming the disagreement. An error a
+ * user cannot act on is barely better than a hang.
  *
- * @example
- * ```ts
- * const result = matchAudience(
- *   { owner: "alice", audience: "named" },
- *   {
- *     owner: "bob",
- *     offerScope: "named",
- *     account: "open",
- *     locallyAllows: (o) => o === "alice",
- *   },
- * );
- * // result.ok === true
- * ```
+ * The message names the fix, because the person reading it is usually the one
+ * who has to apply it.
  */
-declare function matchAudience(job: MatchJob, daemon: MatchDaemon): MatchResult;
+declare function checkProtocolVersion(body: unknown): VersionRefusal | null;
 /**
- * Human-readable refusal text for the daemon's log and the trust UI.
- * Each refusal reads as a distinct truth — byollm_002's "four different
- * truths that must never share a message" applied to the audience axis.
+ * How to upgrade a daemon, in one place.
+ *
+ * `@latest`, which is correct in both eras and therefore never has to be
+ * revisited: during a prerelease it resolves to the current alpha, and after
+ * one it resolves to the current stable.
+ *
+ * `@alpha` was considered and rejected. The argument for it was that `latest`
+ * is moved by hand — it needs a human with 2FA, deliberately — so it can lag
+ * the `alpha` tag. In practice that lag has been minutes, and the cost on the
+ * other side is permanent: the day this stops being a prerelease, `@alpha`
+ * starts meaning "the unstable one", and every user who followed this message
+ * is pinned to prereleases with nothing to tell them.
+ *
+ * Note this is deliberately *not* the rule `scripts/check-site.mjs` enforces
+ * on the docs, which requires `npx byollm@alpha`. That rule is about somebody
+ * choosing to install a prerelease knowingly, with the warning in front of
+ * them. This is an upgrade instruction handed to somebody who already has the
+ * daemon and needs a newer one — a different question with a different answer.
  */
-declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
-
+declare const UPGRADE_COMMAND: "npm i -g byollm@latest";
+/** The path prefix all endpoints mount under. */
+declare const PROTOCOL_PREFIX: "/byollm";
 /**
- * Upper bounds on payload size, enforced at the schema so oversized input is
- * refused at parse time rather than somewhere deeper.
+ * The endpoint names, in the order byollm_001 lists them, plus `fetch`.
  *
- * byollm_004 §4 requires stricter limits for community (`named`/`public`)
- * jobs; those are applied on top of these by the daemon's budget check, which
- * knows the job's audience. These are the absolute ceilings for any job.
+ * `fetch` is byollm_009 §6's second phase: a claim returns a stub, and the
+ * payload is collected separately by the device that took it. Two steps
+ * rather than one because a payload can only be sealed once its recipient is
+ * known — which is also what makes multi-device free.
  */
-declare const PAYLOAD_LIMITS: Readonly<{
-    /** Max characters in any single text field. */
-    maxTextChars: 1000000;
-    /** Max messages in an `llm.chat` conversation. */
-    maxMessages: 256;
-    /** Max characters across the whole payload. */
-    maxTotalChars: 4000000;
-}>;
+declare const ENDPOINTS: readonly ["pair", "claim", "fetch", "heartbeat", "result", "release"];
+type Endpoint = (typeof ENDPOINTS)[number];
 /**
- * A conversation turn. `role` is a closed enum — it is routing *within the
- * model call*, not routing of the call, so it cannot select a backend.
+ * One entry of the capability matrix: a kind this daemon can actually serve,
+ * right now, with the backend and model that would serve it.
+ *
+ * Derived from owner config intersected with detected reality
+ * ({@link MUSTS.CAPABILITY_IS_DETECTED}) — a configured-but-unreachable
+ * backend must not appear here. Carries `backendClass` so the app can tell
+ * whether a result came from a sandboxed spawn or an HTTP call
+ * (byollm_001 Rev 1 §A).
  */
-declare const ChatMessage: z.ZodObject<{
-    role: z.ZodEnum<{
-        system: "system";
-        user: "user";
-        assistant: "assistant";
+declare const Capability: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
     }>;
-    content: z.ZodString;
-}, z.core.$strip>;
-type ChatMessage = z.infer<typeof ChatMessage>;
+    service: z.ZodString;
+    backendId: z.ZodEnum<{
+        ollama: "ollama";
+        mlx: "mlx";
+        llamacpp: "llamacpp";
+        vllm: "vllm";
+        lmstudio: "lmstudio";
+        jan: "jan";
+        localai: "localai";
+        anthropic: "anthropic";
+        openai: "openai";
+        gemini: "gemini";
+        grok: "grok";
+        groq: "groq";
+        openrouter: "openrouter";
+        together: "together";
+        deepseek: "deepseek";
+        mistral: "mistral";
+        "openai-http": "openai-http";
+        "claude-cli": "claude-cli";
+        "codex-cli": "codex-cli";
+    }>;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    model: z.ZodString;
+    knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    offerScope: z.ZodEnum<{
+        private: "private";
+        team: "team";
+    }>;
+}, z.core.$strict>;
+type Capability = z.infer<typeof Capability>;
+/** The capability matrix a daemon advertises. */
+declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    service: z.ZodString;
+    backendId: z.ZodEnum<{
+        ollama: "ollama";
+        mlx: "mlx";
+        llamacpp: "llamacpp";
+        vllm: "vllm";
+        lmstudio: "lmstudio";
+        jan: "jan";
+        localai: "localai";
+        anthropic: "anthropic";
+        openai: "openai";
+        gemini: "gemini";
+        grok: "grok";
+        groq: "groq";
+        openrouter: "openrouter";
+        together: "together";
+        deepseek: "deepseek";
+        mistral: "mistral";
+        "openai-http": "openai-http";
+        "claude-cli": "claude-cli";
+        "codex-cli": "codex-cli";
+    }>;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    model: z.ZodString;
+    knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    offerScope: z.ZodEnum<{
+        private: "private";
+        team: "team";
+    }>;
+}, z.core.$strict>>;
+type CapabilityMatrix = z.infer<typeof CapabilityMatrix>;
 /**
- * Payload for `llm.generate`.
+ * A kind this device could serve and deliberately does not — byollm_016.
  *
- * @remarks
- * Text only, deliberately. byollm_004 §1 states the payload is "data handed
- * to a model, never configuration and never a command", so v0 carries no
- * sampling parameters, no model name, no base URL and no flags — those are
- * owner-side route config. A future `params` field with an explicit closed
- * allowlist and owner-set clamps is reserved; adding a field later is
- * non-breaking, removing one is not.
+ * Two services answer one kind and the owner has not said which wins, so the
+ * kind is not advertised. That is correct and, unsaid, invisible: the owner
+ * adds a second service, jobs stop matching, and no surface explains it.
+ *
+ * It travels because the surfaces that must say so are not all on the device.
+ * The owner's card names the claimants; a teammate's card says only that the
+ * owner has a choice to make. Claimant **offer scopes** ride along so the hub
+ * can compute that difference without the device deciding who is asking —
+ * carry for computation, filter for display, the same shape the effective
+ * offer already uses.
  */
-declare const GeneratePayload: z.ZodObject<{
-    prompt: z.ZodString;
-    system: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>;
-type GeneratePayload = z.infer<typeof GeneratePayload>;
-/** Payload for `llm.chat`. Text only, for the same reason as {@link GeneratePayload}. */
-declare const ChatPayload: z.ZodObject<{
-    messages: z.ZodArray<z.ZodObject<{
-        role: z.ZodEnum<{
-            system: "system";
-            user: "user";
-            assistant: "assistant";
+declare const WithheldKind: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    claimants: z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        offer: z.ZodEnum<{
+            private: "private";
+            team: "team";
         }>;
-        content: z.ZodString;
-    }, z.core.$strip>>;
-    system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
-type ChatPayload = z.infer<typeof ChatPayload>;
+type WithheldKind = z.infer<typeof WithheldKind>;
 /**
- * The job kinds a v1 daemon has handlers for.
+ * One grant, named by both halves — V1-3.
  *
- * Kinds are resolved against handlers baked into the daemon
- * ({@link MUSTS.KIND_TYPED_ONLY}); an unknown kind is refused, never guessed.
- * Adding a kind is a protocol change with its own spec and threat review —
- * notably any kind that needs tools, which byollm_004 §2 forbids as a payload
- * flag.
+ * A job id is chosen per site, so the lease id is the unique thing an upstream
+ * and a daemon can both point at. Anywhere a request says "this piece of work,
+ * held by me", it says it with both.
+ *
+ * Declared once because it was written out twice — `activeLeases` and
+ * `ReleaseRequest.leases` — and both needed the same `.strict()` added. Two
+ * copies of a shape are two places to forget it.
  */
-declare const JobKind: z.ZodEnum<{
-    "llm.generate": "llm.generate";
-    "llm.chat": "llm.chat";
-}>;
-type JobKind = z.infer<typeof JobKind>;
-/** All v1 job kinds. */
-declare const JOB_KINDS: readonly ("llm.generate" | "llm.chat")[];
-/** A payload discriminated by its kind. */
-declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"llm.generate">;
-    payload: z.ZodObject<{
-        prompt: z.ZodString;
-        system: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>;
-}, z.core.$strip>, z.ZodObject<{
-    kind: z.ZodLiteral<"llm.chat">;
-    payload: z.ZodObject<{
-        messages: z.ZodArray<z.ZodObject<{
-            role: z.ZodEnum<{
-                system: "system";
-                user: "user";
-                assistant: "assistant";
-            }>;
-            content: z.ZodString;
-        }, z.core.$strip>>;
-        system: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>;
-}, z.core.$strip>], "kind">;
-type KindedPayload = z.infer<typeof KindedPayload>;
-/** The payload type for a given kind. */
-type PayloadFor<K extends JobKind> = K extends "llm.generate" ? GeneratePayload : ChatPayload;
-/** Narrow an arbitrary string to a known job kind. */
-declare function isJobKind(value: string): value is JobKind;
-/**
- * Total character weight of a payload, used by the daemon's community budget
- * check and by the server's payload-size limits.
- */
-declare function payloadTextLength(kinded: KindedPayload): number;
-
-/**
- * The job lifecycle, made explicit by byollm_001 Rev 1 §D because the most
- * user-visible failure mode — "nothing is running my job" — was previously
- * unspecified.
- *
- * ```text
- * queued ──claim──▶ claimed ──start──▶ running ──▶ ok | error | canceled
- *   │                  │                   │
- *   │                  └──lease expiry─────┘
- *   │                         ▼
- *   │                      queued  (reclaimable, no loss)
- *   └──ttl elapsed──▶ expired
- * ```
- */
-declare const JobState: z.ZodEnum<{
-    ok: "ok";
-    error: "error";
-    queued: "queued";
-    claimed: "claimed";
-    running: "running";
-    canceled: "canceled";
-    expired: "expired";
-}>;
-type JobState = z.infer<typeof JobState>;
-/** States from which a job never moves again. */
-declare const TERMINAL_STATES: readonly ["ok", "error", "canceled", "expired"];
-/** Is this a state the job can never leave? */
-declare function isTerminal(state: JobState): boolean;
-/** May a job move from `from` to `to`? */
-declare function canTransition(from: JobState, to: JobState): boolean;
-/** A lease: the right to work on a job until `expiresAt`. */
-declare const Lease: z.ZodObject<{
-    runnerId: z.ZodString;
-    expiresAt: z.ZodNumber;
-}, z.core.$strip>;
-type Lease = z.infer<typeof Lease>;
-/** Payload union as it appears on a job record. */
-declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
-    prompt: z.ZodString;
-    system: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>, z.ZodObject<{
-    messages: z.ZodArray<z.ZodObject<{
-        role: z.ZodEnum<{
-            system: "system";
-            user: "user";
-            assistant: "assistant";
-        }>;
-        content: z.ZodString;
-    }, z.core.$strip>>;
-    system: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>]>;
-type JobPayload = z.infer<typeof JobPayload>;
-/**
- * A job as the daemon receives it from `/byollm/claim`.
- *
- * Note what is absent: no model, no backend, no base URL, no flags, no path.
- * Those come from the machine owner's config only
- * ({@link MUSTS.NO_PAYLOAD_ROUTING}). The wire shape is the first place that
- * rule is enforced — there is no field to carry them.
- */
-declare const ClaimedJob: z.ZodObject<{
-    id: z.ZodString;
-    kind: z.ZodEnum<{
-        "llm.generate": "llm.generate";
-        "llm.chat": "llm.chat";
-    }>;
-    payload: z.ZodUnion<readonly [z.ZodObject<{
-        prompt: z.ZodString;
-        system: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>, z.ZodObject<{
-        messages: z.ZodArray<z.ZodObject<{
-            role: z.ZodEnum<{
-                system: "system";
-                user: "user";
-                assistant: "assistant";
-            }>;
-            content: z.ZodString;
-        }, z.core.$strip>>;
-        system: z.ZodOptional<z.ZodString>;
-    }, z.core.$strict>]>;
-    audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
-    }>;
-    owner: z.ZodString;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    lease: z.ZodObject<{
-        runnerId: z.ZodString;
-        expiresAt: z.ZodNumber;
-    }, z.core.$strip>;
-}, z.core.$strict>;
-type ClaimedJob = z.infer<typeof ClaimedJob>;
-/**
- * The provenance that travels with every result to the delivery seam.
- *
- * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
- * The app must never render volunteer output as its own AI's answer without
- * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
- */
-declare const ResultProvenance: z.ZodObject<{
-    audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
-    }>;
-    runnerId: z.ZodString;
-    runnerOwner: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    model: z.ZodString;
-    untrusted: z.ZodBoolean;
+declare const GrantRef: z.ZodObject<{
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
 }, z.core.$strict>;
-type ResultProvenance = z.infer<typeof ResultProvenance>;
+type GrantRef = z.infer<typeof GrantRef>;
 /**
- * Build provenance for a completed job. `untrusted` is derived, never
- * supplied, so no caller can mark volunteer output as first-party.
+ * Pairing is a device-code exchange, not a pasted secret
+ * ({@link MUSTS.PAIR_INTERACTIVE}). The daemon starts a pairing, shows the
+ * user a short code and a URL, and polls until the user approves it inside
+ * the app's own authenticated session. Nothing listens on the user's machine
+ * and nothing works over a copied string alone.
  */
-declare function provenanceFor(input: {
-    audience: Audience;
-    runnerId: string;
-    runnerOwner: string;
-    backendClass: BackendClass;
-    model: string;
-}): ResultProvenance;
-/** Successful outcome. */
-declare const JobResultOk: z.ZodObject<{
-    outcome: z.ZodLiteral<"ok">;
-    text: z.ZodString;
-    artifactUrl: z.ZodOptional<z.ZodURL>;
+declare const PairStartRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"1">;
+    action: z.ZodLiteral<"start">;
+    daemon: z.ZodObject<{
+        version: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            win32: "win32";
+        }>;
+    }, z.core.$strict>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        service: z.ZodString;
+        backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
+            "openai-http": "openai-http";
+            "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
+        }>;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        offerScope: z.ZodEnum<{
+            private: "private";
+            team: "team";
+        }>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
-/** Failed outcome. `code` is a stable machine string; `message` is for humans. */
-declare const JobResultError: z.ZodObject<{
-    outcome: z.ZodLiteral<"error">;
-    code: z.ZodString;
-    message: z.ZodString;
-    retryable: z.ZodBoolean;
+type PairStartRequest = z.infer<typeof PairStartRequest>;
+declare const PairStartResponse: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUrl: z.ZodURL;
+    expiresAt: z.ZodNumber;
+    pollIntervalMs: z.ZodNumber;
 }, z.core.$strict>;
-/** Cancelled outcome, reported by the daemon after honoring a cancel. */
-declare const JobResultCanceled: z.ZodObject<{
-    outcome: z.ZodLiteral<"canceled">;
+type PairStartResponse = z.infer<typeof PairStartResponse>;
+declare const PairPollRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"1">;
+    action: z.ZodLiteral<"poll">;
+    deviceCode: z.ZodString;
 }, z.core.$strict>;
-declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    outcome: z.ZodLiteral<"ok">;
-    text: z.ZodString;
-    artifactUrl: z.ZodOptional<z.ZodURL>;
+type PairPollRequest = z.infer<typeof PairPollRequest>;
+declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"pending">;
 }, z.core.$strict>, z.ZodObject<{
-    outcome: z.ZodLiteral<"error">;
-    code: z.ZodString;
-    message: z.ZodString;
-    retryable: z.ZodBoolean;
+    status: z.ZodLiteral<"denied">;
 }, z.core.$strict>, z.ZodObject<{
-    outcome: z.ZodLiteral<"canceled">;
-}, z.core.$strict>], "outcome">;
-type JobOutcome = z.infer<typeof JobOutcome>;
-/** A completed job as delivered to the app, provenance attached. */
-declare const DeliveredResult: z.ZodObject<{
-    jobId: z.ZodString;
-    state: z.ZodEnum<{
-        ok: "ok";
-        error: "error";
-        queued: "queued";
-        claimed: "claimed";
-        running: "running";
-        canceled: "canceled";
-        expired: "expired";
-    }>;
-    outcome: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
-        outcome: z.ZodLiteral<"ok">;
-        text: z.ZodString;
-        artifactUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"error">;
-        code: z.ZodString;
-        message: z.ZodString;
-        retryable: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"canceled">;
-    }, z.core.$strict>], "outcome">>;
-    provenance: z.ZodOptional<z.ZodObject<{
-        audience: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
-        }>;
-        runnerId: z.ZodString;
-        runnerOwner: z.ZodString;
-        backendClass: z.ZodEnum<{
-            http: "http";
-            process: "process";
-        }>;
-        model: z.ZodString;
-        untrusted: z.ZodBoolean;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-type DeliveredResult = z.infer<typeof DeliveredResult>;
-
-/**
- * The normative MUSTs of protocol v0, as data.
- *
- * byollm_001 requires that "every MUST above has a conformance test id
- * referenced inline". Keeping the MUSTs as a frozen registry rather than
- * prose is what makes that requirement *checkable*: the conformance kit
- * imports {@link MUSTS} and fails if any id has no test asserting it, so a
- * new MUST cannot be added without a test and a test cannot silently drift
- * away from the statement it claims to prove.
- *
- * Ids are stable and public — third-party servers cite them in their
- * certification output.
- */
-/** Which side of the wire is obliged to enforce a given MUST. */
-type MustEnforcer = "daemon" | "server" | "both";
-/** A single normative requirement of the protocol. */
-interface Must {
-    /** Stable public id, cited by conformance output. */
-    readonly id: string;
-    /** The requirement, in MUST language. */
-    readonly statement: string;
-    /** Which implementation is obliged to enforce it. */
-    readonly enforcedBy: MustEnforcer;
-    /** Spec section this was adjudicated in. */
-    readonly source: string;
-}
-/**
- * Every normative MUST in protocol v0.
- *
- * @remarks
- * Grouped by concern for readability; the conformance kit treats this as a
- * flat set. Adding an entry here without a corresponding conformance test is
- * a CI failure, by design.
- */
-declare const MUSTS: Readonly<{
-    readonly PAIR_ONE_USER: Must;
-    readonly PAIR_INTERACTIVE: Must;
-    readonly PAIR_CODE_EXPIRES: Must;
-    readonly KIND_TYPED_ONLY: Must;
-    readonly KIND_NO_CODE: Must;
-    readonly CLAIM_REQUIRES_CAPABILITY: Must;
-    readonly CAPABILITY_IS_DETECTED: Must;
-    readonly CLAIM_ATOMIC: Must;
-    readonly LEASE_HONORED: Must;
-    readonly LEASE_RECLAIMABLE: Must;
-    readonly AUDIENCE_BOTH_SIDES: Must;
-    readonly SUBSCRIPTION_SELF_LOCK: Must;
-    readonly NAMED_LOCAL_ALLOWLIST: Must;
-    readonly REFUSAL_NOT_REOFFERED: Must;
-    readonly REVOCATION_HONORED: Must;
-    readonly CANCEL_HONORED: Must;
-    readonly DEPENDS_ON_GATING: Must;
-    readonly TTL_EXPIRY: Must;
-    readonly NO_RUNNER_SIGNAL: Must;
-    readonly RESULT_IDEMPOTENT: Must;
-    readonly RESULT_PROVENANCE: Must;
-    readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
-    readonly NO_SHELL_INTERPOLATION: Must;
-    readonly NO_PAYLOAD_ROUTING: Must;
-    readonly STRIPPED_CHILD_ENV: Must;
-    readonly HTTP_BASE_URL_SAFE: Must;
-    readonly OUTPUT_INERT: Must;
-    readonly COMMUNITY_BUDGETS: Must;
-}>;
-/** The id of any normative MUST. */
-type MustId = keyof typeof MUSTS;
-/** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
-
-/** Protocol version carried on every request; servers refuse what they can't speak. */
-declare const PROTOCOL_VERSION: "0";
-/** The path prefix all endpoints mount under. */
-declare const PROTOCOL_PREFIX: "/byollm";
-/** The five endpoint names, in the order byollm_001 lists them. */
-declare const ENDPOINTS: readonly ["pair", "claim", "heartbeat", "result", "release"];
-type Endpoint = (typeof ENDPOINTS)[number];
-/**
- * One entry of the capability matrix: a kind this daemon can actually serve,
- * right now, with the backend and model that would serve it.
- *
- * Derived from owner config intersected with detected reality
- * ({@link MUSTS.CAPABILITY_IS_DETECTED}) — a configured-but-unreachable
- * backend must not appear here. Carries `backendClass` so the app can tell
- * whether a result came from a sandboxed spawn or an HTTP call
- * (byollm_001 Rev 1 §A).
- */
-declare const Capability: z.ZodObject<{
-    kind: z.ZodEnum<{
-        "llm.generate": "llm.generate";
-        "llm.chat": "llm.chat";
-    }>;
-    backendId: z.ZodEnum<{
-        "openai-http": "openai-http";
-        "claude-cli": "claude-cli";
-    }>;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    model: z.ZodString;
-    offerScope: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
-    }>;
-}, z.core.$strict>;
-type Capability = z.infer<typeof Capability>;
-/** The capability matrix a daemon advertises. */
-declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
-    kind: z.ZodEnum<{
-        "llm.generate": "llm.generate";
-        "llm.chat": "llm.chat";
-    }>;
-    backendId: z.ZodEnum<{
-        "openai-http": "openai-http";
-        "claude-cli": "claude-cli";
-    }>;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    model: z.ZodString;
-    offerScope: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
-    }>;
-}, z.core.$strict>>;
-type CapabilityMatrix = z.infer<typeof CapabilityMatrix>;
-/**
- * Pairing is a device-code exchange, not a pasted secret
- * ({@link MUSTS.PAIR_INTERACTIVE}). The daemon starts a pairing, shows the
- * user a short code and a URL, and polls until the user approves it inside
- * the app's own authenticated session. Nothing listens on the user's machine
- * and nothing works over a copied string alone.
- */
-declare const PairStartRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
-    action: z.ZodLiteral<"start">;
-    daemon: z.ZodObject<{
-        version: z.ZodString;
-        label: z.ZodString;
-        platform: z.ZodEnum<{
-            darwin: "darwin";
-            linux: "linux";
-            win32: "win32";
-        }>;
-    }, z.core.$strip>;
-    capabilities: z.ZodArray<z.ZodObject<{
-        kind: z.ZodEnum<{
-            "llm.generate": "llm.generate";
-            "llm.chat": "llm.chat";
-        }>;
-        backendId: z.ZodEnum<{
-            "openai-http": "openai-http";
-            "claude-cli": "claude-cli";
-        }>;
-        backendClass: z.ZodEnum<{
-            http: "http";
-            process: "process";
-        }>;
-        model: z.ZodString;
-        offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
-        }>;
-    }, z.core.$strict>>;
-}, z.core.$strict>;
-type PairStartRequest = z.infer<typeof PairStartRequest>;
-declare const PairStartResponse: z.ZodObject<{
-    deviceCode: z.ZodString;
-    userCode: z.ZodString;
-    verificationUrl: z.ZodURL;
-    expiresAt: z.ZodNumber;
-    pollIntervalMs: z.ZodNumber;
-}, z.core.$strict>;
-type PairStartResponse = z.infer<typeof PairStartResponse>;
-declare const PairPollRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
-    action: z.ZodLiteral<"poll">;
-    deviceCode: z.ZodString;
-}, z.core.$strict>;
-type PairPollRequest = z.infer<typeof PairPollRequest>;
-declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    status: z.ZodLiteral<"pending">;
-}, z.core.$strict>, z.ZodObject<{
-    status: z.ZodLiteral<"denied">;
-}, z.core.$strict>, z.ZodObject<{
-    status: z.ZodLiteral<"expired">;
-}, z.core.$strict>, z.ZodObject<{
-    status: z.ZodLiteral<"approved">;
-    runnerToken: z.ZodString;
-    runnerId: z.ZodString;
-    owner: z.ZodString;
-    ownerLabel: z.ZodOptional<z.ZodString>;
-}, z.core.$strict>], "status">;
-type PairPollResponse = z.infer<typeof PairPollResponse>;
-declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
-    action: z.ZodLiteral<"start">;
-    daemon: z.ZodObject<{
-        version: z.ZodString;
-        label: z.ZodString;
-        platform: z.ZodEnum<{
-            darwin: "darwin";
-            linux: "linux";
-            win32: "win32";
-        }>;
-    }, z.core.$strip>;
-    capabilities: z.ZodArray<z.ZodObject<{
-        kind: z.ZodEnum<{
-            "llm.generate": "llm.generate";
-            "llm.chat": "llm.chat";
-        }>;
-        backendId: z.ZodEnum<{
-            "openai-http": "openai-http";
-            "claude-cli": "claude-cli";
+    status: z.ZodLiteral<"expired">;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"approved">;
+    runnerId: z.ZodString;
+    owner: z.ZodString;
+    ownerLabel: z.ZodOptional<z.ZodString>;
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
+    controlPlanePublic: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>], "status">;
+type PairPollResponse = z.infer<typeof PairPollResponse>;
+declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"1">;
+    action: z.ZodLiteral<"start">;
+    daemon: z.ZodObject<{
+        version: z.ZodString;
+        label: z.ZodString;
+        platform: z.ZodEnum<{
+            darwin: "darwin";
+            linux: "linux";
+            win32: "win32";
+        }>;
+    }, z.core.$strict>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
+    capabilities: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        service: z.ZodString;
+        backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
+            "openai-http": "openai-http";
+            "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
     }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>], "action">;
 type PairRequest = z.infer<typeof PairRequest>;
 declare const ClaimRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
         backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
     }, z.core.$strict>>;
     max: z.ZodNumber;
@@ -778,37 +469,44 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
-        payload: z.ZodUnion<readonly [z.ZodObject<{
-            prompt: z.ZodString;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>, z.ZodObject<{
-            messages: z.ZodArray<z.ZodObject<{
-                role: z.ZodEnum<{
-                    system: "system";
-                    user: "user";
-                    assistant: "assistant";
-                }>;
-                content: z.ZodString;
-            }, z.core.$strip>>;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
+        owner: z.ZodString;
+        site: z.ZodString;
         audience: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
-        owner: z.ZodString;
-        audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        purpose: z.ZodOptional<z.ZodString>;
+        sizeClass: z.ZodEnum<{
+            small: "small";
+            medium: "medium";
+            large: "large";
+            unbounded: "unbounded";
+        }>;
+        streaming: z.ZodBoolean;
+        deadlineAt: z.ZodNumber;
         lease: z.ZodObject<{
+            id: z.ZodString;
             runnerId: z.ZodString;
             expiresAt: z.ZodNumber;
-        }, z.core.$strip>;
+        }, z.core.$strict>;
+        grant: z.ZodOptional<z.ZodObject<{
+            grantId: z.ZodString;
+            jobId: z.ZodString;
+            site: z.ZodString;
+            user: z.ZodString;
+            owner: z.ZodString;
+            purpose: z.ZodString;
+            kind: z.ZodString;
+            service: z.ZodString;
+            issuedAt: z.ZodNumber;
+            signature: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     leaseMs: z.ZodNumber;
 }, z.core.$strict>;
 type ClaimResponse = z.infer<typeof ClaimResponse>;
 declare const HeartbeatRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     daemonVersion: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
@@ -816,75 +514,148 @@ declare const HeartbeatRequest: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
         backendId: z.ZodEnum<{
+            ollama: "ollama";
+            mlx: "mlx";
+            llamacpp: "llamacpp";
+            vllm: "vllm";
+            lmstudio: "lmstudio";
+            jan: "jan";
+            localai: "localai";
+            anthropic: "anthropic";
+            openai: "openai";
+            gemini: "gemini";
+            grok: "grok";
+            groq: "groq";
+            openrouter: "openrouter";
+            together: "together";
+            deepseek: "deepseek";
+            mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
+        }>;
+    }, z.core.$strict>>;
+    withheld: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
         }>;
+        claimants: z.ZodArray<z.ZodObject<{
+            service: z.ZodString;
+            offer: z.ZodEnum<{
+                private: "private";
+                team: "team";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
+    activeLeases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
     }, z.core.$strict>>;
-    activeJobIds: z.ZodArray<z.ZodString>;
     paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
-    revoked: z.ZodBoolean;
-    cancel: z.ZodArray<z.ZodString>;
-    leases: z.ZodArray<z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
+    successions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        succeeds: z.ZodArray<z.ZodObject<{
+            identity: z.ZodObject<{
+                identity: z.ZodString;
+                encryption: z.ZodString;
+                encryptionSig: z.ZodString;
+            }, z.core.$strict>;
+            signature: z.ZodString;
+        }, z.core.$strict>>;
+        retiringUntil: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    cancel: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
-        expiresAt: z.ZodNumber;
+        leaseId: z.ZodString;
+    }, z.core.$strict>>;
+    lost: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
     }, z.core.$strict>>;
-    lost: z.ZodArray<z.ZodString>;
     serverTime: z.ZodNumber;
+    awaitingConsent: z.ZodArray<z.ZodString>;
+    updateTo: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
+/**
+ * What an intermediary learns about how a job ended — byollm_009 §6.
+ *
+ * The discriminator and nothing else. A relay has to know a job reached a
+ * terminal state, and whether it failed, because that decides whether the job
+ * leaves the queue or the app may re-enqueue. It does not have to know what
+ * the model said, or what an error said, and this is where that line is drawn.
+ *
+ * Kept identical to `JobOutcome`'s discriminator rather than coarsened to
+ * ok/not-ok: a cancelled job and a failed one are different routing outcomes,
+ * and collapsing them would make the relay guess.
+ */
+declare const ResultDisposition: z.ZodEnum<{
+    error: "error";
+    ok: "ok";
+    canceled: "canceled";
+}>;
+type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
-    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        outcome: z.ZodLiteral<"ok">;
-        text: z.ZodString;
-        artifactUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"error">;
-        code: z.ZodString;
-        message: z.ZodString;
-        retryable: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"canceled">;
-    }, z.core.$strict>], "outcome">;
-    model: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
+    leaseId: z.ZodString;
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+    disposition: z.ZodEnum<{
+        error: "error";
+        ok: "ok";
+        canceled: "canceled";
     }>;
-    durationMs: z.ZodNumber;
 }, z.core.$strict>;
 type ResultRequest = z.infer<typeof ResultRequest>;
 declare const ResultResponse: z.ZodObject<{
     accepted: z.ZodBoolean;
+    duplicate: z.ZodOptional<z.ZodBoolean>;
     state: z.ZodString;
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
-    jobIds: z.ZodArray<z.ZodString>;
+    leases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strict>>;
     reason: z.ZodEnum<{
-        revoked: "revoked";
+        refused: "refused";
         shutdown: "shutdown";
         pause: "pause";
+        revoked: "revoked";
         "backend-down": "backend-down";
-        refused: "refused";
     }>;
 }, z.core.$strict>;
 type ReleaseRequest = z.infer<typeof ReleaseRequest>;
@@ -901,30 +672,2138 @@ type ReleaseResponse = z.infer<typeof ReleaseResponse>;
  * with no response at all.
  */
 declare const WireErrorCode: z.ZodEnum<{
+    "unsupported-protocol-version": "unsupported-protocol-version";
     revoked: "revoked";
     "bad-request": "bad-request";
-    "unsupported-protocol-version": "unsupported-protocol-version";
+    "daemon-below-floor": "daemon-below-floor";
     unauthorized: "unauthorized";
+    forbidden: "forbidden";
     "not-found": "not-found";
+    "not-ready": "not-ready";
+    "too-late": "too-late";
+    "clock-skew": "clock-skew";
     "rate-limited": "rate-limited";
     "server-error": "server-error";
 }>;
 type WireErrorCode = z.infer<typeof WireErrorCode>;
 declare const WireError: z.ZodObject<{
     error: z.ZodEnum<{
+        "unsupported-protocol-version": "unsupported-protocol-version";
         revoked: "revoked";
         "bad-request": "bad-request";
-        "unsupported-protocol-version": "unsupported-protocol-version";
+        "daemon-below-floor": "daemon-below-floor";
         unauthorized: "unauthorized";
+        forbidden: "forbidden";
         "not-found": "not-found";
+        "not-ready": "not-ready";
+        "too-late": "too-late";
+        "clock-skew": "clock-skew";
         "rate-limited": "rate-limited";
         "server-error": "server-error";
     }>;
     message: z.ZodString;
+    supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    minimum: z.ZodOptional<z.ZodString>;
+    floor: z.ZodOptional<z.ZodString>;
     retryAfter: z.ZodOptional<z.ZodNumber>;
+    serverTime: z.ZodOptional<z.ZodNumber>;
+    maxSkewMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
+declare const FetchRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"1">;
+    runnerId: z.ZodString;
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
+}, z.core.$strict>;
+type FetchRequest = z.infer<typeof FetchRequest>;
+declare const FetchResponse: z.ZodObject<{
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type FetchResponse = z.infer<typeof FetchResponse>;
+
+/**
+ * Who may be told about a new version — B053.
+ *
+ * `HeartbeatResponse.updateTo` is a new field on a `.strict()` schema, and
+ * strict means a daemon built before the field does not ignore it: it rejects
+ * the entire heartbeat. Send it to everybody and the message carrying the
+ * update is the message that takes offline the machines it was meant to
+ * update — the fleet-wide version of the failure this codebase keeps meeting
+ * one surface at a time.
+ *
+ * No handshake is needed to avoid that. `HeartbeatRequest.daemonVersion` is
+ * already on the wire, so the sender can simply decline to say anything a
+ * given listener cannot hear. The rule lives here, next to the field it
+ * governs, because a rule of this kind in a runbook is a rule that holds
+ * until the next person deploys.
+ *
+ * ## The other direction, deliberately not taken
+ *
+ * The tidier-looking design is a capability list on the request — the daemon
+ * says what it understands. It has a hole this one does not: that field is
+ * also new, the hub's schema is also strict, and an upgraded daemon sending
+ * it to a hub that has not deployed yet is refused outright. It makes the
+ * daemon's upgrade depend on the hub's, in a system where the daemon is the
+ * side we do not control the timing of.
+ *
+ * Reading a field that already exists has no such ordering problem: old
+ * daemons are never sent the new field, new daemons are, and neither needs
+ * the other to have moved first.
+ */
+/**
+ * The first daemon version whose schema has `updateTo` in it.
+ *
+ * Raising this is safe and lowering it is not, which is worth knowing before
+ * anybody tidies it: too high means some daemons miss an update they could
+ * have taken, and too low means their heartbeats are refused.
+ */
+declare const UPDATE_OFFER_SINCE = "0.1.0-alpha.83";
+/**
+ * Semver ordering, only as far as this needs it.
+ *
+ * Numeric prerelease parts compare as numbers, which is the whole reason not
+ * to compare these as strings: `alpha.9` sorts after `alpha.83`
+ * lexicographically, and that mistake here means every daemon between .10 and
+ * .82 is treated as too old to hear about an update — or worse, in the other
+ * direction, sent a field it cannot parse.
+ */
+declare function compareVersions(a: string, b: string): number | undefined;
+/**
+ * May this daemon be told about a new version?
+ *
+ * **A version this cannot parse is a no.** Unreadable is not permission: the
+ * consequence of guessing wrong in that direction is the daemon's heartbeat
+ * being refused, which is worse than it missing one update cycle. The same
+ * rule the rest of this protocol applies to unreadable answers, on the one
+ * field where getting it wrong is fleet-shaped.
+ */
+declare function mayOfferUpdate(daemonVersion: string): boolean;
+/**
+ * The oldest daemon a hub will serve — B052, the floor.
+ *
+ * The updater's backstop and its opposite number. The updater moves machines
+ * that opted in; the floor is what moves the ones that did not, and it is the
+ * only mechanism that works on a daemon which is not listening for offers.
+ *
+ * Raising it is a deliberate act with a spec note, never automatic — a floor
+ * that followed `latest` would refuse every machine that had not updated in
+ * the last hour, which is the outage version of hygiene.
+ */
+interface FloorRefusal {
+    readonly error: "daemon-below-floor";
+    readonly message: string;
+    readonly floor: string;
+}
+/**
+ * Is this daemon too old to serve?
+ *
+ * **An unreadable version is NOT refused**, and that is the deliberate
+ * asymmetry with {@link mayOfferUpdate}, which treats an unreadable version
+ * as "do not offer". The two point the same way once you ask what the
+ * mistake costs: there, guessing yes sends a field that breaks the
+ * heartbeat; here, guessing yes takes a working machine out of service over
+ * a string it could not parse. Both decline to act when they cannot tell,
+ * and declining to act means opposite booleans.
+ */
+declare function checkDaemonFloor(input: {
+    readonly daemonVersion: string;
+    readonly floor: string;
+    /** How somebody fixes it. The floor is useless without the remedy. */
+    readonly upgradeCommand: string;
+}): FloorRefusal | null;
+/**
+ * The only way to put `updateTo` on a heartbeat — D1's first deploy
+ * condition, made structural.
+ *
+ * The condition was "the hub must not be ABLE to set `updateTo` raw". A rule
+ * that says "remember to call `mayOfferUpdate` first" is a rule that holds
+ * until somebody adds a second return site — and the heartbeat handler
+ * already has two. So the fence is not a thing to remember; it is the only
+ * function that produces the field, and it applies the check inside itself.
+ *
+ * Returns a spreadable object rather than a value, so the call site reads
+ * `...updateOfferFor(...)` and there is no `updateTo:` anywhere for a later
+ * hand to copy.
+ *
+ * Absent `offer` means this deployment is offering nothing, which is the
+ * default and the safe one: a hub that has not been told a version says
+ * nothing to anybody.
+ */
+declare function updateOfferFor(input: {
+    readonly offer: string | undefined;
+    readonly daemonVersion: string;
+}): {
+    readonly updateTo?: string;
+};
+/**
+ * Source with its comments removed, for the checks below.
+ *
+ * Comments go first because a rule about a field has to be explainable in
+ * prose beside the code it governs — and the first version of the relay's
+ * fence test flagged its own explanation, which was written to say there
+ * must be no such write anywhere.
+ */
+declare function withoutComments(source: string): string;
+/**
+ * Does this source mention a wire field at all?
+ *
+ * **A word, not a spelling.** The relay's fence test shipped scanning for
+ * `/\bupdateTo\s*:/`, which is one syntax of one way to set a property —
+ * `"updateTo": offer`, `res.updateTo = offer`, `res["updateTo"] = offer` and
+ * shorthand in a spread all walk straight past it. The check's claim was
+ * "there is nowhere else to call from"; what it enforced was a spelling.
+ * That is our own recurring law, and this is its sixth instance — the first
+ * inside a test written to be structural rather than remembered.
+ *
+ * So the question this asks is deliberately blunter than the rule it serves.
+ * A mention is not a write, and the false positives are the point: anything
+ * that names the field in code has to be looked at by a person, because the
+ * cost of the miss is every daemon that predates the field rejecting every
+ * heartbeat.
+ *
+ * Lives here, beside {@link updateOfferFor}, so the hub and the relay run one
+ * copy rather than two that drift — the field's hazard is fleet-wide and it
+ * crosses a repository boundary, which is exactly where a duplicated rule
+ * stops being the same rule.
+ */
+declare function mentionsWireField(source: string, field: string): boolean;
+
+/** The full description — five sections, plus why it matters. */
+declare const ABOUT = "# About BYOLLM\n\n**What BYOLLM is**\n\nBYOLLM lets you use your own AI on websites. You install one small program on\nyour computer. Then, websites that support BYOLLM can use the AI you already\nhave \u2014 a free model running on your machine, or an AI service you already pay\nfor \u2014 instead of the website paying for AI and passing the cost to you.\n\n**Why it matters**\n\nFor you:\n\n- Your favorite model, everywhere you go.\n- New models the moment you get them \u2013 not when a site gets around to adding\n  them.\n- Encrypted end-to-end. Your prompts go to your own device; byollm.cloud can't\n  read them.\n- Sites never learn which model you use, and your subscriptions are never\n  shared.\n- Pay less. Sites that don't pay for AI can charge you less \u2013 or nothing.\n\nFor sites and developers:\n\n- Zero AI bills. Your users bring their own compute.\n- No floating money \u2013 you don't pay LLM bills up front and hope to collect\n  later, and you never ask people to prepay just to try you.\n- Free trials that cost you nothing to offer.\n- Ship the AI features you kept private for fear of the API bill.\n- One small integration. Your users choose the models.\n\n**Your device**\n\nThe `byollm` program runs on your computer. It knows which AI services you have\nset up: free open-source models on your machine, metered services you pay per\nuse, or your own subscriptions like Claude Pro/Max. When a website you have\nenabled sends work, your device runs it with the service you chose. Your\nprompts are encrypted end-to-end to your own device. byollm.cloud passes them\nalong and cannot read them.\n\n**Sites**\n\nA website that wants to use BYOLLM says what it needs \u2014 \"writing help,\" \"chat,\"\nand so on. When you connect the site, you pick which of your services answers\neach one. The site never learns which model you use. You can turn a site off at\nany time, and it stops getting your work.\n\n**Teams (optional)**\n\nA team lets you share what runs on your devices with people you name \u2014 the free\nopen-source models on your machine, or a metered service with a spending limit\nyou set. Your subscription accounts (like Claude Pro/Max) are never shared with\nanyone. That is a rule, not a setting.\n\n**byollm.cloud (or your own relay)**\n\nMany sites, many devices, many people. byollm.cloud keeps track of who has\nallowed what and sends each job to the right device. It never sees your\nprompts. If you would rather run this part yourself, the relay is open source \u2014\nyou can run your own instead of using byollm.cloud.";
+/**
+ * The first paragraph, which stands alone.
+ *
+ * What the welcome screen shows: somebody deciding whether to trust a site's
+ * button needs the whole idea in one breath, not a page.
+ */
+declare const ABOUT_SHORT_LEDE = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.";
+/** The rest, for surfaces with room. Shown before "Learn more →". */
+declare const ABOUT_SHORT_TAIL = "Sites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
+/** Both halves, for a surface that wants the paragraph entire. */
+declare const ABOUT_SHORT = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.\n\nSites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
+
+/**
+ * Its members, for anything that has to report what it accepts.
+ *
+ * Derived from the enum for the reason `JOB_KINDS` and `OFFER_SCOPES` are: a
+ * second list of the same words is a second thing to keep in step, and this
+ * one is read by the promotion gate to compare a deployed hub against a
+ * version about to be promoted.
+ */
+declare const BACKEND_CLASSES: readonly ("http" | "process")[];
+/**
+ * How a backend reaches its model — the taxonomy introduced in byollm_001
+ * Rev 1 §A, because the two classes have different threat surfaces.
+ *
+ * - `http`: an OpenAI-compatible HTTP server (Ollama, `mlx_lm.server`,
+ *   llama.cpp server, vLLM, and every hosted provider that speaks the same
+ *   wire format). Spawns nothing, so byollm_004 §2's argv, stdin, env and
+ *   sandbox requirements are not applicable by construction. Its threat
+ *   surface is SSRF-shaped and bounded by {@link MUSTS.HTTP_BASE_URL_SAFE}.
+ * - `process`: spawns a binary (`claude` CLI today, `mlx_lm.lora` for a
+ *   future `train.*` kind). All of byollm_004 §2 is mandatory here.
+ */
+declare const BackendClass: z.ZodEnum<{
+    http: "http";
+    process: "process";
+}>;
+type BackendClass = z.infer<typeof BackendClass>;
+/**
+ * Who pays, and how — byollm_007.
+ *
+ * This replaced a two-valued `account` field that conflated two unrelated
+ * constraints and, in doing so, left a hole: `openai-http` was "open", but it
+ * accepts an API key, so an owner could point it at a paid endpoint, share it,
+ * and donate their credit balance to strangers. The community budgets cap job
+ * *count*, not spend.
+ *
+ * - `free` — local compute. Costs electricity, not money. Shareable.
+ * - `metered` — per-token billing against the owner's account. Legal to
+ *   share and ruinous to share by accident.
+ * - `subscription` — a vendor account whose terms forbid third-party work.
+ *   Sharing is a terms violation, not merely expensive.
+ */
+declare const BackendCost: z.ZodEnum<{
+    free: "free";
+    metered: "metered";
+    subscription: "subscription";
+}>;
+type BackendCost = z.infer<typeof BackendCost>;
+/** The immutable facts about a backend that the protocol reasons over. */
+interface BackendDescriptor {
+    /** Stable backend id, as written in `byollm.config.json`. */
+    readonly id: string;
+    /** Human-readable name for the trust UI. */
+    readonly label: string;
+    /** Determines which isolation requirements apply. */
+    readonly class: BackendClass;
+    /**
+     * Who pays. Fixed here for every named provider and **not overridable by
+     * configuration** ({@link MUSTS.COST_NOT_CONFIGURABLE}) — `openai` is
+     * metered because it is, and no setting changes that.
+     *
+     * `null` only for the generic {@link BACKENDS."openai-http"} entry, whose
+     * cost is inferred from its base URL instead
+     * ({@link MUSTS.REMOTE_IS_NEVER_FREE}).
+     */
+    readonly cost: BackendCost | null;
+    /**
+     * Which adversarial corpus byollm_004 §5 runs against this backend. A
+     * backend cannot be registered without one — the coverage check in the
+     * adversarial suite enforces it.
+     */
+    readonly adversarialCorpus: "process" | "http";
+    /**
+     * Where this provider lives, when that is knowable. Owner config may
+     * override it; a provider with no default requires one to be given.
+     */
+    readonly defaultBaseUrl?: string;
+}
+/**
+ * The backend registry.
+ *
+ * **Providers are entries, not implementations.** Every HTTP-class provider
+ * below shares the single `openai-http` transport, because they all speak
+ * OpenAI-compatible `/v1/chat/completions`. An entry adds a stable id, a cost
+ * class the owner cannot override, and a default base URL. Adding a provider
+ * is therefore one line and no new code — which is why the adversarial corpus
+ * still covers all of them, and why a PR adding one is reviewable at a glance.
+ */
+declare const BACKENDS: Readonly<{
+    readonly ollama: BackendDescriptor;
+    readonly mlx: BackendDescriptor;
+    readonly llamacpp: BackendDescriptor;
+    readonly vllm: BackendDescriptor;
+    readonly lmstudio: BackendDescriptor;
+    readonly jan: BackendDescriptor;
+    readonly localai: BackendDescriptor;
+    /**
+     * Note the pair: `anthropic` and {@link BACKENDS."claude-cli"} reach the
+     * same vendor and land in different cost classes. That is not an
+     * inconsistency — it is the axis working. One bills a key per token, the
+     * other runs under a personal plan whose terms cover one person's work. Who
+     * pays and under what terms is the question; which company is not.
+     */
+    readonly anthropic: BackendDescriptor;
+    readonly openai: BackendDescriptor;
+    readonly gemini: BackendDescriptor;
+    readonly grok: BackendDescriptor;
+    readonly groq: BackendDescriptor;
+    readonly openrouter: BackendDescriptor;
+    readonly together: BackendDescriptor;
+    readonly deepseek: BackendDescriptor;
+    readonly mistral: BackendDescriptor;
+    readonly "openai-http": BackendDescriptor;
+    readonly "claude-cli": BackendDescriptor;
+    /**
+     * OpenAI's Codex CLI, on a ChatGPT plan — byollm_016 stage 3.
+     *
+     * `subscription`, so `SUBSCRIPTION_SELF_LOCK` pins it to its owner's own
+     * work whatever the config says. That is load-bearing here in a way it is
+     * not for `claude-cli`: Codex is an *agent*, and its default feature set
+     * includes a shell tool, browser control and computer use. The daemon
+     * disables every one of them, verified against the shipped binary rather
+     * than assumed — see `codex-cli.ts` — but the self-lock is the floor under
+     * that verification rather than a duplicate of it.
+     */
+    readonly "codex-cli": BackendDescriptor;
+}>;
+/** The id of a registered backend. */
+type BackendId = keyof typeof BACKENDS;
+/** All registered backend ids — the adversarial coverage check iterates this. */
+declare const BACKEND_IDS: readonly ("ollama" | "mlx" | "llamacpp" | "vllm" | "lmstudio" | "jan" | "localai" | "anthropic" | "openai" | "gemini" | "grok" | "groq" | "openrouter" | "together" | "deepseek" | "mistral" | "openai-http" | "claude-cli" | "codex-cli")[];
+declare const BackendIdSchema: z.ZodEnum<{
+    ollama: "ollama";
+    mlx: "mlx";
+    llamacpp: "llamacpp";
+    vllm: "vllm";
+    lmstudio: "lmstudio";
+    jan: "jan";
+    localai: "localai";
+    anthropic: "anthropic";
+    openai: "openai";
+    gemini: "gemini";
+    grok: "grok";
+    groq: "groq";
+    openrouter: "openrouter";
+    together: "together";
+    deepseek: "deepseek";
+    mistral: "mistral";
+    "openai-http": "openai-http";
+    "claude-cli": "claude-cli";
+    "codex-cli": "codex-cli";
+}>;
+/** Narrow an arbitrary string to a registered backend id. */
+declare function isBackendId(value: string): value is BackendId;
+/**
+ * Look up a backend descriptor.
+ *
+ * @throws if the id is not registered — an unregistered backend has no
+ * adversarial corpus, so refusing is the safe direction.
+ */
+declare function backendDescriptor(id: BackendId): BackendDescriptor;
+/**
+ * Is this host local enough that compute there is free?
+ *
+ * Loopback and the private ranges only. This is the rule that makes
+ * {@link MUSTS.REMOTE_IS_NEVER_FREE} enforceable rather than a promise: an
+ * owner cannot reach a paid API through the generic backend and call it free,
+ * because "free" is derived from the address, not from what the config claims.
+ *
+ * **What this cannot see.** The address is all it reads. A proxy on
+ * `127.0.0.1` forwarding to a paid API classes as `free` and nothing
+ * downstream will contradict it. That is deliberate: standing up a relay is
+ * an act by the machine's owner against their own account, and the threat
+ * model here is a hostile *job*, not an owner routing around a rule that
+ * exists to protect them. What this catches is the accident — a remote paid
+ * endpoint offered to a team because nobody thought about the bill. See
+ * `docs/security.md` §4a.
+ */
+declare function isLocalHost(hostname: string): boolean;
+/**
+ * Is this model name a hosted one billed by its vendor?
+ *
+ * Ollama serves cloud models through the same local endpoint as local ones,
+ * so the address says "free" about a model somebody is being charged for. The
+ * only thing that distinguishes them is the name, and the distinguishing part
+ * is the **tag** — everything after the last colon.
+ *
+ * End-anchored on the tag, which is what makes it decidable rather than a
+ * guess about substrings:
+ *
+ * - `glm-5.2:cloud` → cloud
+ * - `deepseek-v4-flash:0731-cloud` → cloud
+ * - `x:cloudless` → not cloud, the tag ends in "less"
+ * - `cloudmodel:7b` → not cloud, the tag is "7b"
+ * - `llama3.2` → not cloud, there is no tag at all
+ *
+ * An oddball like `:xcloud` classifies as cloud, and that is the **only
+ * permitted failure direction**: calling a free model metered narrows what an
+ * owner may share and costs nobody money, while the reverse hands somebody
+ * else's bill to a stranger.
+ */
+declare function isCloudTaggedModel(model: string): boolean;
+/**
+ * The cost class of a configured service.
+ *
+ * For every named provider this is whatever the registry says, full stop
+ * ({@link MUSTS.COST_NOT_CONFIGURABLE}). For the generic `openai-http` entry
+ * it is inferred from the base URL, and a base URL that cannot be parsed is
+ * treated as `metered` — the expensive side, because guessing "free" wrong
+ * costs the owner money.
+ *
+ * The model has the last word in one direction only. A local address with a
+ * cloud-tagged model is `metered`: Ollama proxies hosted models through
+ * `127.0.0.1`, so the endpoint is local and the bill is not. Read from the
+ * **configured value**, never from what the server lists — the owner's config
+ * is the thing they chose, and a server's catalogue is not theirs to be
+ * classified by.
+ */
+declare function resolveCost(id: BackendId, baseUrl: string | undefined, 
+/**
+ * **Required, and that is the fix.**
+ *
+ * This was optional, and the no-re-derivation law was breached through the
+ * gap rather than by anybody copying the logic. `byollm offer` passed two of
+ * three arguments and `resolveConfig` passed three, so the same service was
+ * free to one and metered to the other: `glm-5.2:cloud` on a loopback
+ * address looks local until you read the tag. The command wrote a share the
+ * daemon then refused, and told its owner to run the command they had just
+ * run.
+ *
+ * A shared rule's signature admits no partial askers. `undefined` is still a
+ * legal *value* — a service genuinely without a model — but it has to be
+ * passed, so choosing to omit the model is a decision at the call site
+ * rather than a default nobody notices.
+ */
+model: string | undefined): BackendCost;
+/**
+ * Why a service costs what it costs — the same decision, said out loud.
+ *
+ * Consent has to name the rule that fired. The offer ceremony read
+ * "Any OpenAI-compatible server ... bills your account per token", which is
+ * false about the type — an owner's local qwen is `openai-http` and costs
+ * nothing but electricity — and so it gave a reason that its reader could
+ * check and find wrong. The thing that bills is the `:cloud` tag on one
+ * model, not the transport that carries it.
+ *
+ * One function decides and one function explains, and the second calls the
+ * first, so a message can never describe a classification the code did not
+ * make. Splitting them would be the same defect this signature was just
+ * hardened against, arriving as prose.
+ */
+/**
+ * The product's name alone, without the parenthetical that classifies it.
+ *
+ * Every label in this registry does two jobs: it names a product and says what
+ * that product means for the person paying — "Claude CLI (your subscription)",
+ * "Ollama (local)". That is right for a list, where the parenthetical is the
+ * only classification on screen.
+ *
+ * It is wrong inside a sentence that states the classification itself, which
+ * then stutters: "my-claude runs on Claude CLI (your subscription), a
+ * subscription whose terms…". Prose wants the name; the sentence around it is
+ * already carrying the meaning.
+ *
+ * One definition rather than a regex at each call site — and the place to
+ * change if the registry ever splits the two facts into two fields, which is
+ * the better shape and not worth a migration today.
+ */
+declare function backendName(id: BackendId): string;
+interface CostReason {
+    readonly cost: BackendCost;
+    /** The rule, in the words a person consenting needs. */
+    readonly because: string;
+}
+declare function classifyCost(id: BackendId, baseUrl: string | undefined, model: string | undefined): CostReason;
+
+/**
+ * Who may run a job, declared by the app that enqueued it.
+ *
+ * - `private` — only the job owner's own devices.
+ * - `team` — a device whose owner admits this person.
+ *
+ * **One vocabulary, ruled 2026-08-24.** These were `self | named | public`
+ * while {@link OfferScope} used different words for the same idea, which would
+ * have left every seam where the two meet speaking two languages, and every
+ * doc explaining "self versus private" for ever. They are still independent
+ * axes — a job says who may run it, a service says who it will run for — and a
+ * job runs only where both agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}).
+ *
+ * **`public` is gone, ruled 2026-08-26 (byollm_016).** Not deprecated,
+ * removed, and removed from the OSS daemon too rather than parked as a
+ * community posture. The argument was a measurement rather than a preference:
+ * device-side admission had never once been exercised end to end, because
+ * every cross-user test ran against a publicly offered service and
+ * {@link matchAudience} returned ALLOWED for those *without consulting the
+ * device at all*. `public` was the off switch for admission, and an enum with
+ * a value that skips verification is a fail-open waiting for the wiring bug
+ * that reaches it. There is now no such value.
+ */
+declare const Audience: z.ZodEnum<{
+    private: "private";
+    team: "team";
+}>;
+type Audience = z.infer<typeof Audience>;
+/**
+ * What a device's owner is willing to run for other people, per service.
+ *
+ * - `private` — the owner's own work only.
+ * - `team` — whoever the owner's authority admits. Membership is **central**,
+ *   not per-person: the device follows what it is told by a signature it can
+ *   check, rather than holding its own copy of who is in it (byollm_016).
+ *
+ * Two values, and no third that means "everyone". See {@link Audience} for
+ * why `public` was removed rather than parked, and note the shape of the
+ * remaining enum: **every value left requires the device to verify
+ * something.** `private` checks the owner; `team` checks admission. That is
+ * the property, not an accident of there being two.
+ */
+declare const OfferScope: z.ZodEnum<{
+    private: "private";
+    team: "team";
+}>;
+type OfferScope = z.infer<typeof OfferScope>;
+/** All audience values, in widening order. */
+declare const AUDIENCES: readonly ("private" | "team")[];
+/** All offer scopes, in widening order. */
+declare const OFFER_SCOPES: readonly ("private" | "team")[];
+/**
+ * Why a job was refused. Distinct codes because byollm_002 requires that
+ * different truths never share a message — "no matching work" and "refused on
+ * principle" are not the same event, and a volunteer debugging their setup
+ * needs to know which one happened.
+ */
+declare const MatchRefusal: z.ZodEnum<{
+    "no-capability": "no-capability";
+    "audience-self-other-owner": "audience-self-other-owner";
+    "not-locally-allowed": "not-locally-allowed";
+    "not-in-server-allowlist": "not-in-server-allowlist";
+    "offer-scope-too-narrow": "offer-scope-too-narrow";
+    "subscription-self-lock": "subscription-self-lock";
+    "metered-no-spend-consent": "metered-no-spend-consent";
+    "metered-ceiling-reached": "metered-ceiling-reached";
+}>;
+type MatchRefusal = z.infer<typeof MatchRefusal>;
+/** The outcome of an audience match. */
+type MatchResult = {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly refusal: MatchRefusal;
+};
+/** What the owner has agreed to spend on other people's work, if anything. */
+interface SpendConsent {
+    /** The owner explicitly acknowledged that sharing this backend costs money. */
+    readonly acknowledged: boolean;
+    /** Their ceiling. Absent means no ceiling was set, which is not consent. */
+    readonly ceilingReached?: boolean;
+}
+/**
+ * The effective offer scope of a backend.
+ *
+ * Three rules, applied at the one place both the daemon's config loader and
+ * its matcher call, so no code path can observe a scope wider than the cost
+ * class allows:
+ *
+ * - `subscription` is locked to `private` regardless of config
+ *   ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — someone else's terms.
+ * - `metered` narrows to `private` unless the owner has explicitly acknowledged
+ *   the spend ({@link MUSTS.METERED_DEFAULTS_SELF}) — their money.
+ * - `free` passes through — their electricity.
+ *
+ * Note the asymmetry: subscription can never be widened, metered can be
+ * widened deliberately. Conflating those was byollm_007's bug.
+ */
+declare function effectiveOfferScope(configured: OfferScope, cost: BackendCost, spend?: SpendConsent): OfferScope;
+/** The job-side facts a match needs. */
+interface MatchJob {
+    /** The app's id for the user who enqueued the job. */
+    readonly owner: string;
+    /** Who the app says may run it. */
+    readonly audience: Audience;
+    /**
+     * Optional server-side restriction on which runner owners may take a
+     * `team` job. Defence in depth only, and direct-mode only — it never
+     * reaches a daemon (cloud_008 §0.2), so the device's own admission is the
+     * enforcing side ({@link MUSTS.NAMED_LOCAL_ALLOWLIST}).
+     */
+    readonly audienceAllow?: readonly string[] | undefined;
+}
+/** The daemon-side facts a match needs. */
+interface MatchDaemon {
+    /** The app's id for the user this daemon is paired to. */
+    readonly owner: string;
+    /** Effective scope of the backend that would run the job. */
+    readonly offerScope: OfferScope;
+    /** Who pays for that backend's tokens. */
+    readonly cost: BackendCost;
+    /** What the owner agreed to spend on others, for a `metered` backend. */
+    readonly spend?: SpendConsent | undefined;
+    /**
+     * Has something **this device verified** admitted the job's owner?
+     *
+     * A predicate rather than a value so the protocol package stays free of
+     * both file I/O and signature state. What supplies it has changed twice and
+     * will change again — a local allowlist, then a held roster, and now a
+     * claim-time signed grant (Amendment J) — and the law it feeds has not
+     * changed at all: a `team` service runs a stranger's work only when
+     * somebody this device can check said so.
+     *
+     * The server passes a conservative `() => true`: it cannot know what a
+     * remote device verified and must not pretend to. The device is the
+     * enforcing side, which is the whole point of asking here.
+     *
+     * Named for the question, not for where the answer lives. This was called
+     * `locallyAllows`, and "locally" stopped being true the moment the answer
+     * came from a document somebody else signed.
+     */
+    readonly admits: (owner: string) => boolean;
+}
+/**
+ * Decide whether a job may run on a daemon.
+ *
+ * Both sides must agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}):
+ * 1. the job's audience must admit the daemon's owner, and
+ * 2. the backend's offer scope must admit the job's owner.
+ *
+ * The full four-way matrix (two audiences × two offer scopes) is asserted by
+ * the conformance kit. The function is pure and total so both the daemon
+ * and the server can run the identical rule — the daemon refuses, and the
+ * server refuses too (byollm_003 §Server-side MUSTs).
+ *
+ * @example
+ * ```ts
+ * const result = matchAudience(
+ *   { owner: "alice", audience: "team" },
+ *   {
+ *     owner: "bob",
+ *     offerScope: "team",
+ *     cost: "free",
+ *     admits: (o) => o === "alice",
+ *   },
+ * );
+ * // result.ok === true
+ * ```
+ */
+declare function matchAudience(job: MatchJob, daemon: MatchDaemon): MatchResult;
+/**
+ * Human-readable refusal text for the daemon's log and the trust UI.
+ * Each refusal reads as a distinct truth — byollm_002's "four different
+ * truths that must never share a message" applied to the audience axis.
+ */
+declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
+
+/**
+ * Upper bounds on payload size, enforced at the schema so oversized input is
+ * refused at parse time rather than somewhere deeper.
+ *
+ * All three are enforced — cloud_008 Tier 4, finding 30. `maxTotalChars` was
+ * declared here and referenced nowhere, under this docstring's claim that the
+ * schema enforces them, so a chat payload of 256 messages at a million
+ * characters each parsed cleanly at sixty-four times the stated ceiling. The
+ * per-field limits were real and the aggregate one was a number in a frozen
+ * object.
+ *
+ * byollm_004 §4 requires stricter limits for community (`team`) jobs; those
+ * are applied on top of these by the daemon's budget check, which knows the
+ * job's audience. These are the absolute ceilings for any job.
+ */
+declare const PAYLOAD_LIMITS: Readonly<{
+    /** Max characters in any single text field. */
+    maxTextChars: 1000000;
+    /** Max messages in an `llm.chat` conversation. */
+    maxMessages: 256;
+    /** Max characters across the whole payload. */
+    maxTotalChars: 4000000;
+}>;
+/**
+ * A conversation turn. `role` is a closed enum — it is routing *within the
+ * model call*, not routing of the call, so it cannot select a backend.
+ */
+declare const ChatMessage: z.ZodObject<{
+    role: z.ZodEnum<{
+        user: "user";
+        system: "system";
+        assistant: "assistant";
+    }>;
+    content: z.ZodString;
+}, z.core.$strict>;
+type ChatMessage = z.infer<typeof ChatMessage>;
+/**
+ * Payload for `llm.generate`.
+ *
+ * @remarks
+ * Text only, deliberately. byollm_004 §1 states the payload is "data handed
+ * to a model, never configuration and never a command", so v0 carries no
+ * sampling parameters, no model name, no base URL and no flags — those are
+ * owner-side route config. A future `params` field with an explicit closed
+ * allowlist and owner-set clamps is reserved; adding a field later is
+ * non-breaking, removing one is not.
+ */
+declare const GeneratePayload: z.ZodObject<{
+    prompt: z.ZodString;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type GeneratePayload = z.infer<typeof GeneratePayload>;
+/** Payload for `llm.chat`. Text only, for the same reason as {@link GeneratePayload}. */
+declare const ChatPayload: z.ZodObject<{
+    messages: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            user: "user";
+            system: "system";
+            assistant: "assistant";
+        }>;
+        content: z.ZodString;
+    }, z.core.$strict>>;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+type ChatPayload = z.infer<typeof ChatPayload>;
+/**
+ * The job kinds a v1 daemon has handlers for.
+ *
+ * Kinds are resolved against handlers baked into the daemon
+ * ({@link MUSTS.KIND_TYPED_ONLY}); an unknown kind is refused, never guessed.
+ * Adding a kind is a protocol change with its own spec and threat review —
+ * notably any kind that needs tools, which byollm_004 §2 forbids as a payload
+ * flag.
+ */
+declare const JobKind: z.ZodEnum<{
+    "llm.generate": "llm.generate";
+    "llm.chat": "llm.chat";
+}>;
+type JobKind = z.infer<typeof JobKind>;
+/** All v1 job kinds. */
+declare const JOB_KINDS: readonly ("llm.generate" | "llm.chat")[];
+/** A payload discriminated by its kind. */
+declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"llm.generate">;
+    payload: z.ZodObject<{
+        prompt: z.ZodString;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"llm.chat">;
+    payload: z.ZodObject<{
+        messages: z.ZodArray<z.ZodObject<{
+            role: z.ZodEnum<{
+                user: "user";
+                system: "system";
+                assistant: "assistant";
+            }>;
+            content: z.ZodString;
+        }, z.core.$strict>>;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "kind">;
+type KindedPayload = z.infer<typeof KindedPayload>;
+/** The payload type for a given kind. */
+type PayloadFor<K extends JobKind> = K extends "llm.generate" ? GeneratePayload : ChatPayload;
+/** Narrow an arbitrary string to a known job kind. */
+declare function isJobKind(value: string): value is JobKind;
+/**
+ * Total character weight of a payload, used by the daemon's community budget
+ * check and by the server's payload-size limits.
+ */
+declare function payloadTextLength(kinded: KindedPayload): number;
+
+/**
+ * The job lifecycle, made explicit by byollm_001 Rev 1 §D because the most
+ * user-visible failure mode — "nothing is running my job" — was previously
+ * unspecified.
+ *
+ * ```text
+ * queued ──claim──▶ claimed ──start──▶ running ──▶ ok | error | canceled
+ *   │                  │                   │
+ *   │                  └──lease expiry─────┘
+ *   │                         ▼
+ *   │                      queued  (reclaimable, no loss)
+ *   └──ttl elapsed──▶ expired
+ * ```
+ */
+declare const JobState: z.ZodEnum<{
+    error: "error";
+    ok: "ok";
+    expired: "expired";
+    queued: "queued";
+    claimed: "claimed";
+    running: "running";
+    canceled: "canceled";
+}>;
+type JobState = z.infer<typeof JobState>;
+/** States from which a job never moves again. */
+declare const TERMINAL_STATES: readonly ["ok", "error", "canceled", "expired"];
+/** Is this a state the job can never leave? */
+declare function isTerminal(state: JobState): boolean;
+/** May a job move from `from` to `to`? */
+declare function canTransition(from: JobState, to: JobState): boolean;
+/** A lease: the right to work on a job until `expiresAt`. */
+declare const Lease: z.ZodObject<{
+    id: z.ZodString;
+    runnerId: z.ZodString;
+    expiresAt: z.ZodNumber;
+}, z.core.$strict>;
+type Lease = z.infer<typeof Lease>;
+/** Payload union as it appears on a job record. */
+declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
+    prompt: z.ZodString;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    messages: z.ZodArray<z.ZodObject<{
+        role: z.ZodEnum<{
+            user: "user";
+            system: "system";
+            assistant: "assistant";
+        }>;
+        content: z.ZodString;
+    }, z.core.$strict>>;
+    system: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>]>;
+type JobPayload = z.infer<typeof JobPayload>;
+/**
+ * A job as the daemon receives it from `/byollm/claim`.
+ *
+ * Note what is absent: no model, no backend, no base URL, no flags, no path.
+ * Those come from the machine owner's config only
+ * ({@link MUSTS.NO_PAYLOAD_ROUTING}). The wire shape is the first place that
+ * rule is enforced — there is no field to carry them.
+ */
+declare const ClaimedJob: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    payload: z.ZodUnion<readonly [z.ZodObject<{
+        prompt: z.ZodString;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        messages: z.ZodArray<z.ZodObject<{
+            role: z.ZodEnum<{
+                user: "user";
+                system: "system";
+                assistant: "assistant";
+            }>;
+            content: z.ZodString;
+        }, z.core.$strict>>;
+        system: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>]>;
+    audience: z.ZodEnum<{
+        private: "private";
+        team: "team";
+    }>;
+    owner: z.ZodString;
+    site: z.ZodOptional<z.ZodString>;
+    service: z.ZodOptional<z.ZodString>;
+    deadlineAt: z.ZodOptional<z.ZodNumber>;
+    lease: z.ZodObject<{
+        id: z.ZodString;
+        runnerId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type ClaimedJob = z.infer<typeof ClaimedJob>;
+/**
+ * The provenance that travels with every result to the delivery seam.
+ *
+ * byollm_003 Rev 1: a `team` result is attacker-controlled text.
+ * The app must never render volunteer output as its own AI's answer without
+ * knowing that is what it is ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
+ */
+declare const ResultProvenance: z.ZodObject<{
+    audience: z.ZodEnum<{
+        private: "private";
+        team: "team";
+    }>;
+    runnerId: z.ZodString;
+    runnerOwner: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    model: z.ZodString;
+    untrusted: z.ZodBoolean;
+}, z.core.$strict>;
+type ResultProvenance = z.infer<typeof ResultProvenance>;
+/**
+ * Build provenance for a completed job. `untrusted` is derived, never
+ * supplied, so no caller can mark volunteer output as first-party.
+ */
+declare function provenanceFor(input: {
+    audience: Audience;
+    runnerId: string;
+    runnerOwner: string;
+    backendClass: BackendClass;
+    model: string;
+}): ResultProvenance;
+/**
+ * What the daemon did, sealed with the answer — cloud_008 §2.5.
+ *
+ * These travelled in the clear on `ResultRequest`, which meant two things at
+ * once. On the direct plane the site believed unauthenticated fields beside
+ * an authenticated envelope — a daemon could seal one answer and *declare* it
+ * came from a different model, and only the field it did not sign would be
+ * recorded. Through a relay they reached a third party that acts on none of
+ * them, and `model` in particular is the kind of detail Amendment A's rule
+ * keeps off the wire.
+ *
+ * Sealed, they are the daemon's signed statement about its own run: the site
+ * opens them, nothing in between sees them, and the disposition check that
+ * already compares clear-text against ciphertext extends to cover them.
+ */
+/**
+ * The closed set, as a schema — so the values exist once.
+ *
+ * A bare union would mean anything that has to VALIDATE a stop reason (the
+ * ingress log, and the wire when step 4 lands) retyping the four strings
+ * beside it. Instruction 9: one definition, both ends, and where a consumer
+ * needs a runtime check the definition has to be one it can run.
+ *
+ * The type below is inferred from this rather than written twice, so the
+ * compiler and the validator cannot disagree about what a stop reason is.
+ */
+declare const StopReasonSchema: z.ZodEnum<{
+    length: "length";
+    unknown: "unknown";
+    end: "end";
+    "stop-sequence": "stop-sequence";
+}>;
+type StopReason = 
+/** The model finished on its own. */
+"end"
+/** The model stopped at its own output ceiling. */
+ | "length"
+/** A configured stop token ended it. */
+ | "stop-sequence"
+/**
+ * The adapter cannot tell, and says so.
+ *
+ * **The default, and never `"end"`.** An adapter nobody has updated — or
+ * one somebody adds next year — must not be able to claim completion by
+ * saying nothing. If absence meant "end", every un-updated adapter would go
+ * on telling exactly the lie this exists to fix, and every new adapter
+ * would inherit it in silence.
+ *
+ * It is the opposite-boolean rule this codebase keeps arriving at: when you
+ * cannot tell, guess toward silence rather than toward a claim. "We do not
+ * know" is a thing a site can act on; "it finished" when it did not is not.
+ */
+ | "unknown";
+declare const RunMetadata: z.ZodObject<{
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+    stop: z.ZodOptional<z.ZodEnum<{
+        length: "length";
+        unknown: "unknown";
+        end: "end";
+        "stop-sequence": "stop-sequence";
+    }>>;
+    stopReported: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+type RunMetadata = z.infer<typeof RunMetadata>;
+/** Successful outcome. */
+declare const JobResultOk: z.ZodObject<{
+    outcome: z.ZodLiteral<"ok">;
+    text: z.ZodString;
+    artifactUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>;
+/** Failed outcome. `code` is a stable machine string; `message` is for humans. */
+declare const JobResultError: z.ZodObject<{
+    outcome: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    message: z.ZodString;
+    retryable: z.ZodBoolean;
+}, z.core.$strict>;
+/** Cancelled outcome, reported by the daemon after honoring a cancel. */
+declare const JobResultCanceled: z.ZodObject<{
+    outcome: z.ZodLiteral<"canceled">;
+}, z.core.$strict>;
+declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    outcome: z.ZodLiteral<"ok">;
+    text: z.ZodString;
+    artifactUrl: z.ZodOptional<z.ZodURL>;
+}, z.core.$strict>, z.ZodObject<{
+    outcome: z.ZodLiteral<"error">;
+    code: z.ZodString;
+    message: z.ZodString;
+    retryable: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    outcome: z.ZodLiteral<"canceled">;
+}, z.core.$strict>], "outcome">;
+type JobOutcome = z.infer<typeof JobOutcome>;
+/**
+ * Why a job can never run — byollm_016 Phase B.
+ *
+ * Every one of these is **terminal**, and that is the whole point of naming
+ * them. A job that cannot be matched used to sit queued until its deadline,
+ * which reads exactly like a job that is merely waiting for a device to come
+ * online — so an app could not tell "any moment now" from "never", and neither
+ * could the person watching a spinner. Silence must never read as pending.
+ *
+ * They are decided by whoever knows first: the site's own SDK where it can see
+ * the answer without asking, the router where matching happens, and the daemon
+ * again on arrival under the both-sides rule. All three reason from the same
+ * list rather than three private vocabularies.
+ */
+declare const RefusalReason: z.ZodEnum<{
+    "default-ambiguity": "default-ambiguity";
+    "default-unusable": "default-unusable";
+}>;
+type RefusalReason = z.infer<typeof RefusalReason>;
+/**
+ * A terminal outcome nobody sealed — byollm_016 Phase B.
+ *
+ * Every other finished job carries an envelope encrypted by the device that
+ * ran it, which is what makes a result unforgeable. These have no device: the
+ * job was refused *before* anything could run it, so there is nobody to seal
+ * from and no content to seal.
+ *
+ * **What that costs, stated plainly.** This is the one terminal outcome a
+ * router can author. It is worth being exact about the power that grants,
+ * because "the relay can write this" sounds alarming until you compare it with
+ * what a relay could already do: drop the job, never offer it, and let it
+ * expire. A router-authored refusal is *denial of service by a shorter route*,
+ * which is a power the router has always had and which the trust model has
+ * always said it has. What it emphatically is **not** is forgery: this shape
+ * carries no envelope and no output, so it can never be mistaken for an answer
+ * a device produced. A relay still cannot fabricate a result, because that
+ * needs a signature it does not hold.
+ *
+ * So the rule this shape enforces by construction: a refusal may deny, and may
+ * never assert. Anything that claims work was *done* still comes sealed.
+ */
+declare const JobRefused: z.ZodObject<{
+    outcome: z.ZodLiteral<"refused">;
+    reason: z.ZodEnum<{
+        "default-ambiguity": "default-ambiguity";
+        "default-unusable": "default-unusable";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>;
+type JobRefused = z.infer<typeof JobRefused>;
+/**
+ * The outward text for each reason, so a message cannot vary by call site.
+ *
+ * The mirror image of `REFUSAL_MESSAGES` in `audience.ts`, and the contrast is
+ * worth holding in one thought. That table is read by the **owner** of the
+ * device, where byollm_002's rule applies — four different truths must never
+ * share a message, because a person debugging their own machine needs to know
+ * which one they hit. This table is read by a **requester**, where the rule
+ * inverts: two different truths must share a message exactly, because the
+ * difference between them is somebody else's inventory.
+ *
+ * Same project, opposite requirements, and confusing them is how the oracle
+ * comes back. Hence a table rather than prose at the throw site: three
+ * refusals written in three places drift into three slightly different
+ * sentences, and "slightly different" is all an oracle needs.
+ *
+ * ## Published, because the drift it prevents happens outside this repo — B103
+ *
+ * `JobRefused` and `RefusalReason` were exported and **this was not**, so we
+ * shipped the vocabulary and withheld the sentences. Nothing here constructs a
+ * refusal; the producers are sites and the hub, and every one of them would
+ * have written its own message for a reason code we defined.
+ *
+ * **That is the drift this table argues against, made inevitable by the export
+ * list** — and `message` is a required field on the envelope, so each of them
+ * had to write something.
+ */
+declare const REFUSAL_TEXT: Readonly<Record<RefusalReason, string>>;
+/**
+ * The plaintext inside a result envelope.
+ *
+ * The outcome and how it was produced, together, because they are one
+ * statement by one signer. A site that opened only the outcome would be
+ * trusting the envelope for the answer and the request body for everything
+ * about it.
+ */
+declare const SealedOutcome: z.ZodObject<{
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    ran: z.ZodObject<{
+        model: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        durationMs: z.ZodNumber;
+        stop: z.ZodOptional<z.ZodEnum<{
+            length: "length";
+            unknown: "unknown";
+            end: "end";
+            "stop-sequence": "stop-sequence";
+        }>>;
+        stopReported: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type SealedOutcome = z.infer<typeof SealedOutcome>;
+/** A completed job as delivered to the app, provenance attached. */
+declare const DeliveredResult: z.ZodObject<{
+    jobId: z.ZodString;
+    state: z.ZodEnum<{
+        error: "error";
+        ok: "ok";
+        expired: "expired";
+        queued: "queued";
+        claimed: "claimed";
+        running: "running";
+        canceled: "canceled";
+    }>;
+    outcome: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">>;
+    provenance: z.ZodOptional<z.ZodObject<{
+        audience: z.ZodEnum<{
+            private: "private";
+            team: "team";
+        }>;
+        runnerId: z.ZodString;
+        runnerOwner: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        model: z.ZodString;
+        untrusted: z.ZodBoolean;
+    }, z.core.$strict>>;
+    fallback: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>;
+type DeliveredResult = z.infer<typeof DeliveredResult>;
+/** Its members, derived — see {@link BACKEND_CLASSES} for why. */
+declare const SIZE_CLASSES: readonly ("small" | "medium" | "large" | "unbounded")[];
+/**
+ * How big a payload is, in buckets — byollm_009 §6.
+ *
+ * A relay routes without reading, and matching a job to a machine needs some
+ * notion of size. Buckets rather than byte counts because the exact figure is
+ * a stronger fingerprint than the routing decision requires, and because a
+ * bucket survives compression and encoding changes that an exact count does
+ * not.
+ *
+ * **Two grains, on purpose — ratified 2026-08-28.** Metering a
+ * GB-denominated plan needs real totals, and this is deliberately not where
+ * they come from: exact bytes exist only as increment-only *monthly*
+ * aggregates, and no per-job byte figure is ever persisted anywhere. The
+ * record needs vagueness and the meter needs totals; neither borrows the
+ * other's grain, which is why the consent screen's "roughly how big" stays
+ * exactly true of everything retained about a job. If you are here because
+ * you need a number, the aggregate is the one to reach for — adding a byte
+ * count to this envelope would trade a promise for a convenience.
+ *
+ * `unbounded` exists for streamed jobs, which have no size when they start.
+ * It is reserved now rather than added later: byollm_009 §8.1 — adding a
+ * field to a published envelope is the v2 break all over again.
+ */
+declare const SizeClass: z.ZodEnum<{
+    small: "small";
+    medium: "medium";
+    large: "large";
+    unbounded: "unbounded";
+}>;
+type SizeClass = z.infer<typeof SizeClass>;
+/**
+ * The most one envelope may be, in bytes — **6 MiB, ruled 2026-09-10.**
+ *
+ * ## Why six, which is two sentences and neither is about capacity
+ *
+ * Todd, 09-10: *"6 MB solves for just text and people don't try to push
+ * images. We will add R2 for multimodal later."* **The cap is a SHAPE
+ * decision** — it makes the envelope the wrong tool for a photo, which is the
+ * point, because the right tool for a photo is object storage and a reference
+ * to it rather than a bigger pipe.
+ *
+ * And the half that makes it aligned rather than merely chosen: **6 MiB sits
+ * under a hosted box's memory and bandwidth limits.** A box is 320 MiB of RAM;
+ * a 10 MiB envelope buffered is a real fraction of it. **Six is the number at
+ * which the smallest thing we sell can hold the largest thing we accept.**
+ *
+ * Both sentences are here because a number without them is a number the next
+ * person rounds up. It was 10 MiB from 2026-08-28 until this ruling.
+ *
+ * A **relay-memory safety rail**, not a plan feature: every tier has the same
+ * ceiling, and differentiating tiers on it would be selling a safety limit as
+ * a benefit. What it bounds is any single job, so no one message can make the
+ * relay hold an unbounded amount of somebody else's memory.
+ *
+ * ## It stores nothing, and that is the design
+ *
+ * Enforced at ingress by refusing before acceptance, in both directions. A
+ * ceiling on what the relay already has in hand needs no schema and no record:
+ * the size is known for the length of the check and then it is gone. This
+ * matters because the alternative — recording a size to enforce a limit
+ * against — is precisely the per-job byte figure the metering ruling exists to
+ * not have.
+ *
+ * ## Measured on the serialised envelope
+ *
+ * The same quantity the monthly rollup counts, deliberately. The relay stores
+ * the serialised envelope and the meter measures what it stored, so a cap on
+ * anything else — the ciphertext alone, the decoded length — would mean the
+ * limit and the bill disagreed about what a byte is, and a job could be small
+ * enough to accept and larger than it was charged as.
+ */
+declare const MAX_ENVELOPE_BYTES: number;
+/**
+ * How big an envelope is, by the one measure that counts it.
+ *
+ * `JSON.stringify` because that is what the store persists and therefore what
+ * the meter measures. Length in UTF-16 code units rather than encoded bytes:
+ * it is the same number the store's own `HSTRLEN` reports, and the point of
+ * this function is that one number answers both questions.
+ */
+declare function envelopeBytes(envelope: unknown): number;
+/**
+ * A size somebody can act on, rounded **up** and only ever up.
+ *
+ * The rounding rule, in one place, because it has now been got wrong twice —
+ * B072. `toFixed` rounds to nearest, so a message one byte over the line
+ * printed "this message is 10.5 MB and the limit is 10.5 MB": a refusal that
+ * reads as a contradiction, given to somebody who now has no idea what to
+ * change.
+ *
+ * The relay found that, fixed it, and wrote the reasoning down beside the
+ * fix. The SDK's refusal then rediscovered the identical bug, because it
+ * copied the SENTENCE rather than the function — which is the same shape as
+ * `MAX_BODY_BYTES` diverging from `MAX_ENVELOPE_BYTES`, and the same answer:
+ * neither side holds the rule.
+ *
+ * Up is also the honest direction. Understating how far over a message is
+ * sends somebody to trim a hundred bytes off something that needs to lose a
+ * megabyte; overstating by a tenth costs them nothing.
+ */
+declare function describeBytes(bytes: number): string;
+/**
+ * What a message that is too big is told, minus anything about pricing.
+ *
+ * Shared because both planes refuse the same thing for the same reason. What
+ * is NOT shared is the relay's "every plan has the same ceiling" — a hosted
+ * sentence, and meaningless to somebody self-hosting the direct lane, where
+ * there are no plans. One rule, two audiences: the rule travels, the words
+ * about our billing do not.
+ */
+declare function tooLargeMessage(input: {
+    readonly bytes: number;
+    readonly limit: number;
+}): string;
+/** Where the bucket boundaries sit, in characters of payload text. */
+declare const SIZE_CLASS_LIMITS: Readonly<{
+    small: 4000;
+    medium: 64000;
+    large: number;
+}>;
+/**
+ * The most a payload in this bucket can be.
+ *
+ * Used where a decision must be made from a stub, before the payload has been
+ * fetched — a budget check, for instance. Charging the bucket's ceiling is the
+ * conservative direction: it refuses slightly too eagerly rather than
+ * admitting work that turns out larger than the budget allowed.
+ *
+ * `unbounded` returns `Infinity`, which fails every ceiling. That is correct
+ * until byollm_006 defines how a streamed job is budgeted — failing closed on
+ * a case nobody has designed beats inventing an allowance for it.
+ */
+declare function sizeClassCeiling(sizeClass: SizeClass): number;
+/** Bucket a payload by its text length. */
+declare function sizeClassOf(textChars: number): SizeClass;
+/**
+ * Everything an upstream may see about a job — byollm_009 §6.
+ *
+ * **This list is exhaustive and normative.** It is a commitment about the
+ * metadata surface, not an accident of what the implementation happens to
+ * send: an upstream that requires more has exceeded the protocol, and an
+ * endpoint that emits more has leaked past it
+ * ({@link MUSTS.STUB_METADATA_EXHAUSTIVE}).
+ *
+ * What is absent is the point. No payload, no model, no prompt, no result.
+ * `kind` is here because capability matching happens upstream; if a later
+ * revision moves matching to the daemon, `kind` moves into the ciphertext.
+ */
+declare const JobStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    site: z.ZodString;
+    audience: z.ZodEnum<{
+        private: "private";
+        team: "team";
+    }>;
+    purpose: z.ZodOptional<z.ZodString>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type JobStub = z.infer<typeof JobStub>;
+/**
+ * A stub, plus the lease the claiming runner now holds for it — and, on a
+ * relayed route, the grant that says it may run at all.
+ *
+ * The grant lives here rather than on {@link JobStub} because of *when* it is
+ * authored. A stub exists from enqueue; a grant is written at claim, against
+ * the membership and mapping true at that moment. That timing is the whole of
+ * Amendment J: a job queued yesterday for somebody removed this morning gets
+ * no grant when it is finally claimed, and a roster held on the device could
+ * never have known.
+ *
+ * Optional, and the absence is meaningful rather than lenient. A device that
+ * pinned a control-plane key at pairing **requires** one — a claimed job
+ * arriving without it is refused, not admitted by default. A device that
+ * pinned none is in direct mode, where there is no control plane to author
+ * anything and the owner's own work is the only work that runs.
+ */
+declare const ClaimedStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    site: z.ZodString;
+    audience: z.ZodEnum<{
+        private: "private";
+        team: "team";
+    }>;
+    purpose: z.ZodOptional<z.ZodString>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+    lease: z.ZodObject<{
+        id: z.ZodString;
+        runnerId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strict>;
+    grant: z.ZodOptional<z.ZodObject<{
+        grantId: z.ZodString;
+        jobId: z.ZodString;
+        site: z.ZodString;
+        user: z.ZodString;
+        owner: z.ZodString;
+        purpose: z.ZodString;
+        kind: z.ZodString;
+        service: z.ZodString;
+        issuedAt: z.ZodNumber;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type ClaimedStub = z.infer<typeof ClaimedStub>;
+
+/**
+ * Request signing — byollm_009 §4.2.
+ *
+ * Every authenticated call is signed by the calling device's identity key.
+ * There is no bearer token on the daemon plane: possession of a file no
+ * longer grants access, possession of a *key* does, and the key never leaves
+ * the machine.
+ *
+ * ## Why this is not the server-issued nonce the spec first described
+ *
+ * byollm_009 §4.2 says "the upstream issues a nonce; the daemon signs it".
+ * Implementing that costs one of two things: a round trip before every
+ * request, or server-side session state — and sessions reintroduce a bearer
+ * credential, which is the thing being removed.
+ *
+ * Signing *the request itself* gets the same property without either, because
+ * of something the protocol already guarantees. A captured signature is valid
+ * only for the exact request it covers — same endpoint, same runner, same
+ * body — and every authenticated endpoint here is idempotent by design:
+ * `RESULT_IDEMPOTENT` makes a replayed result a no-op, a replayed claim from
+ * the same runner returns what that runner already holds, and heartbeat and
+ * release are idempotent in effect. So a replay inside the freshness window
+ * gains an attacker nothing they could not obtain by forwarding the original,
+ * which a relay can do anyway.
+ *
+ * That is the whole argument, and it is worth stating because it rests
+ * entirely on the endpoints being idempotent. Two ways that can fail, and the
+ * second is the one that actually bit:
+ *
+ * 1. **A future endpoint that is not idempotent cannot use this scheme
+ *    unchanged** — it would need a server-issued nonce.
+ * 2. **Idempotence must hold per *addressed instance*, not per endpoint.** A
+ *    request that names a mutable target — a lease, a session, a
+ *    subscription — must name the *instance*, or a replay lands on a
+ *    different one than the sender meant and the endpoint's idempotence buys
+ *    nothing. `release` was idempotent per lease and ambiguous across them:
+ *    it named a job and a runner, both of which survive a
+ *    claim-release-reclaim cycle, so a replayed release yanked a later grant.
+ *    Fixed by giving a lease its own id and requiring it.
+ *
+ * The rule for anything added later: if a signed request can be replayed onto
+ * a target that has changed underneath it, the request has to say which
+ * target it meant.
+ */
+/** How far a request's timestamp may be from the server's clock. */
+declare const MAX_CLOCK_SKEW_MS = 120000;
+/** The signed material a request carries. */
+declare const RequestSignature: z.ZodObject<{
+    runnerId: z.ZodString;
+    issuedAt: z.ZodNumber;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type RequestSignature = z.infer<typeof RequestSignature>;
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * Newline-separated with a version prefix and a domain separator. Every field
+ * that decides what the request *does* is in here: leave one out and it
+ * becomes something an intermediary can change without breaking the
+ * signature.
+ *
+ * The body is included by hash rather than by value, so signing does not
+ * depend on both sides serialising JSON identically — which they would not.
+ */
+declare function canonicalRequest(input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): Buffer;
+/** Sign an outgoing request with this machine's identity key. */
+declare function signRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/**
+ * The same scheme, for the party at the other end: a **site** calling a relay.
+ *
+ * A site talking to a relay is in exactly the daemon's position — an outbound
+ * caller with an identity keypair the other side already pins — so it gets the
+ * daemon's authentication rather than a second scheme. Bearer tokens for the
+ * site plane were the alternative, and they would have reintroduced the
+ * credential-in-a-file that §4.2 removed from the daemon plane, on the plane
+ * that carries *every* site's traffic.
+ *
+ * Two things make this safe to build on the same canonical string:
+ *
+ * 1. **The endpoint is namespaced.** Site endpoints sign `site/enqueue`, never
+ *    `enqueue`. The daemon plane's `result` and the site plane's `results` are
+ *    one character apart, and a naming collision between planes must not be
+ *    what stands between a signature and a replay onto the wrong handler. The
+ *    prefix is applied *inside* these helpers, so the two ends cannot disagree
+ *    about it — the alternative is two implementations of one bound value,
+ *    which is this project's most-repeated bug.
+ * 2. **The caller slot carries the site id.** `canonicalRequest` names that
+ *    field `runnerId` because the daemon plane got there first; here it holds
+ *    the site id, and the verifier looks the key up in the projection's site
+ *    registry rather than its device registry. The two registries never share
+ *    an entry, so a device signature cannot authenticate as a site.
+ *
+ * §4.2's replay argument carries over **only because the site plane's writes
+ * are idempotent per addressed instance**, which is a property that had to be
+ * built rather than found: `enqueue` reset a job of the same id, so a replayed
+ * enqueue inside the freshness window returned a claimed job to the queue and
+ * threw away a device's live lease. Identical in shape to the `release` bug
+ * above, on the other plane. Anything added to the site plane later must be
+ * idempotent by the instance it names, or this scheme does not cover it.
+ */
+declare function signSiteRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    siteId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Verify a site's call against the identity the control plane registered. */
+declare function verifySiteRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+/**
+ * Why a signed request was refused.
+ *
+ * **`bad-signature` is never returned verbatim; `stale` is, deliberately.**
+ * They are different kinds of refusal and conflating them costs a real user
+ * more than it costs an attacker.
+ *
+ * A bad signature is an authentication failure and the server says only
+ * "unauthorized" — telling a prober which part they got wrong is free help.
+ *
+ * A stale timestamp is a **precondition** failure: the signature may be
+ * perfectly valid and the caller's clock is simply wrong. Saying so reveals
+ * nothing, for two reasons that both have to hold. The server's time is
+ * already public — every response carries a `Date` header and the heartbeat
+ * response returns `serverTime` outright. And freshness is checked *before*
+ * the signature is verified, so a stale answer says nothing about whether the
+ * signature was any good.
+ *
+ * What conflating them costs: a machine whose clock has drifted gets
+ * `401 unauthorized` on every request, forever, with nothing anywhere pointing
+ * at the clock. That is the shape byollm_013 was filed about — a refusal that
+ * is correct, silent, and sends somebody to read our source.
+ */
+type SignatureFailure = "stale" | "bad-signature";
+/**
+ * Verify a signed request against a runner's pinned identity key.
+ *
+ * Freshness is checked in **both** directions. A clock far ahead is as much a
+ * problem as one behind: it would let a captured request stay replayable long
+ * after it was made, which is the one thing the window exists to bound.
+ */
+declare function verifyRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+
+/**
+ * What a site says it needs — byollm_016 Amendment L.
+ *
+ * A site declares **purposes**, and each purpose lists the job kinds it uses.
+ * A person then maps each purpose to one of their own services, on the consent
+ * screen, and that mapping *is* the consent. The control plane joins the two
+ * at claim time and signs the result into a grant.
+ *
+ * ## Why a site declares needs instead of naming services
+ *
+ * Because it cannot name one. The site's vocabulary is its own purposes; the
+ * person's vocabulary is their services; and the two never meet. A site asks
+ * for "writing assistant, llm.chat" and learns only whether that slot is
+ * satisfiable — never which model answered, never whose machine, never even
+ * the name of the service. Key-vs-value reaches its strongest form here: the
+ * site cannot describe what it wants *or* name it, only ask for what it
+ * declared.
+ *
+ * ## Keys are ids; labels are prose
+ *
+ * They are separate fields and nothing derives one from the other, which is
+ * the amendment's ruling and worth restating where somebody will read it. A
+ * key travels on every job and is what mappings are stored against, so it is
+ * stable-or-nothing: renaming one deletes a purpose and creates another,
+ * unmapping everybody who had chosen for it. A label is changeable whenever
+ * the site likes and is the **only** thing a consent screen renders.
+ */
+/**
+ * The purpose a site gets when it declares no purposes of its own.
+ *
+ * Reserved, and refused by {@link Manifest} rather than by whatever handles
+ * registration. A site with a single undifferentiated use has one purpose —
+ * everything it does — and that purpose needs an id because mappings are
+ * keyed by one. An id taken from the site's own vocabulary would collide the
+ * day it declared a real purpose of the same name.
+ *
+ * **Never rendered.** "default → your Claude" tells a person nothing; a
+ * consent screen shows the site's own name for this slot, because that is
+ * what a single-purpose site's one purpose actually is.
+ */
+declare const RESERVED_PURPOSE = "default";
+declare const Purpose: z.ZodObject<{
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    kinds: z.ZodArray<z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>>;
+}, z.core.$strict>;
+type Purpose = z.infer<typeof Purpose>;
+/**
+ * Everything a site needs, by purpose key.
+ *
+ * At least one purpose: a site that declares none is a site that can enqueue
+ * nothing, and accepting it would mean the first refusal a person saw came
+ * from a job rather than from registration.
+ */
+/**
+ * How many purposes one site may declare.
+ *
+ * There was no bound at all: a site could declare fifty thousand, each one
+ * individually valid, and the consent screen renders a slot per (purpose,
+ * kind) — so the page that *is* the consent mechanism becomes unusable, and
+ * the notification mail that enumerates slots grows with it.
+ *
+ * Thirty-two is chosen rather than derived, and the number is an argument: a
+ * purpose is a thing a person reads and decides about one at a time, and a
+ * screen asking more than about thirty separate questions has stopped being a
+ * consent screen whatever it renders. Of Tomorrow Press declares five. A site
+ * that genuinely needs more has a product question to answer before it has a
+ * schema one.
+ */
+declare const MAX_PURPOSES = 32;
+declare const Manifest: z.ZodRecord<z.ZodString, z.ZodObject<{
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    kinds: z.ZodArray<z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>>;
+}, z.core.$strict>>;
+type Manifest = z.infer<typeof Manifest>;
+/**
+ * The manifest a site with no declared purposes is treated as having.
+ *
+ * The sugar in Amendment L, made explicit rather than special-cased
+ * downstream: everything after this point sees a manifest with one purpose,
+ * so no consent screen, mapping table or resolver needs a branch for the
+ * flat-list case.
+ *
+ * The label is the caller's — a site's own name — because it is the one thing
+ * that can make "everything this site does" read as a sentence about a
+ * particular site rather than about software in general.
+ */
+declare function singlePurposeManifest(input: {
+    readonly label: string;
+    readonly kinds: readonly JobKind[];
+}): Manifest;
+
+/**
+ * One job, one signature, one answer — byollm_016 Amendment J.
+ *
+ * A grant is the control plane's signed statement that a particular job may
+ * run on a particular device, authored at claim time and verified against the
+ * key that device pinned when it paired.
+ *
+ * ## What it replaced, and why the replacement is smaller
+ *
+ * Until 2026-08-26 a device held a signed **roster** and answered admission
+ * from it. Amendment G's four properties were right and the mechanism was a
+ * cache — one that bought nothing. On the cloud route the job path and the
+ * roster path share fate: jobs arrive through the relay, so if the relay is
+ * unreachable there are no jobs to admit and a locally held roster adds no
+ * availability. What it did add was staleness, which is the only reason
+ * `ROSTER_MAX_AGE_MS` existed: a bound on how long a removed person keeps
+ * running. Authoring at claim collapses that bound to this document's own
+ * lifetime — add somebody and their next job runs, remove them and their next
+ * claim fails, including jobs already queued.
+ *
+ * It also collapses four questions into one signature. Consented, member,
+ * admitted, and *which service* were four mechanisms answering separately;
+ * they are now four fields of one statement, and the device verifies once.
+ *
+ * ## What it is not
+ *
+ * Amendment G property 1 outlawed admitting on a per-job assertion, and this
+ * is per-job. The distinction is authorship: G outlawed trusting the
+ * **relay's or site's unsigned** claim. A grant is signed by the control
+ * plane with a key the device pinned at pairing, so the relay can withhold it
+ * and cannot forge it — exactly the power a relay has over a job.
+ * `RELAY_BLIND` is untouched: the relay delivers, it never authors.
+ *
+ * ## What the device still checks for itself
+ *
+ * A grant is necessary and not sufficient. Four checks stay on the device and
+ * none of them is delegated:
+ *
+ * 1. the signature, against the pinned key;
+ * 2. replay — {@link SignedGrant.grantId} is single-use;
+ * 3. offer-consistency — the named service is one this device actually
+ *    offers, at a scope that includes this user;
+ * 4. **private is absolute** — a `private` service runs for the paired owner
+ *    and nobody else, so no compromise of a control plane can grant somebody
+ *    else's job onto it.
+ */
+/**
+ * How long a grant is honoured after it was signed. Ruled 120s (2026-08-26).
+ *
+ * This bounds **acceptance**, not execution: a job admitted inside the window
+ * runs to completion however long it takes. So the number only has to cover
+ * the trip from the control plane signing to the device checking — claim,
+ * deliver, verify — and every second past that is a second a captured grant
+ * stays useful.
+ *
+ * Two minutes is generous for that trip and mean for the capture. It is also
+ * the number ordinary clock drift is measured against, which is why
+ * {@link CLOCK_SKEW_WARN_MS} sits well inside it: a device whose clock is off
+ * by half the window would refuse real work, and must be told before it does.
+ *
+ * The verifier's policy, deliberately not a field on the document. An
+ * `expiresAt` the signer chose would let whoever signs decide how long their
+ * own statement stays good, and the party with the most reason to want a
+ * longer window is the party being bounded.
+ */
+declare const GRANT_MAX_AGE_MS = 120000;
+/**
+ * Clock disagreement past which a device says so, before it starts refusing.
+ *
+ * Skew eats {@link GRANT_MAX_AGE_MS} directly — a device 60s behind its
+ * relay's clock has half a window left, and one 120s behind has none and
+ * refuses everything for a reason no refusal message would otherwise name.
+ * Thirty seconds is a quarter of the window: far enough out to be a real
+ * problem, early enough to be a warning rather than an outage.
+ */
+declare const CLOCK_SKEW_WARN_MS = 30000;
+/**
+ * Skew past which a freshness refusal names the clock instead of the grant.
+ *
+ * Five seconds, because below that the clock is not the story and saying so
+ * would send somebody to check ntp about an unrelated failure. Above it, "this
+ * grant expired" and "your clock is wrong" are the same event wearing
+ * different words, and only one of them can be acted on.
+ */
+declare const CLOCK_ATTRIBUTION_MS = 5000;
+/**
+ * The domain separator.
+ *
+ * Every signature in this system says what kind of statement it is before it
+ * says anything else. Without it, bytes signed for one purpose verify for
+ * another — a grant and a request are both "bytes this key signed", and a
+ * scheme that could not tell them apart would let one be replayed as the
+ * other.
+ */
+declare const GRANT_CONTEXT = "byollm/v1/grant";
+declare const SignedGrant: z.ZodObject<{
+    grantId: z.ZodString;
+    jobId: z.ZodString;
+    site: z.ZodString;
+    user: z.ZodString;
+    owner: z.ZodString;
+    purpose: z.ZodString;
+    kind: z.ZodString;
+    service: z.ZodString;
+    issuedAt: z.ZodNumber;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type SignedGrant = z.infer<typeof SignedGrant>;
+/** Everything a grant says, before it is signed. */
+type GrantClaims = Omit<SignedGrant, "signature">;
+/**
+ * Every field of {@link SignedGrant} except the signature, sorted.
+ *
+ * **Derived from the schema, never written out by hand.** The unsigned-field
+ * attack is that somebody adds a field to the document, forgets to add it to
+ * the bytes, and ships a value an intermediary can rewrite without breaking
+ * any signature. A hand-maintained list is exactly the shape that fails: it
+ * does not grow when the code does, and nothing about adding a field reminds
+ * you it exists.
+ *
+ * Reading the shape closes it structurally rather than by review. A new field
+ * is signed the moment it is declared, and grant.test.ts asserts this list
+ * still covers the schema so a future zod version that hides `shape` fails
+ * loudly instead of silently signing less.
+ */
+declare const GRANT_SIGNED_FIELDS: readonly (keyof GrantClaims)[];
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * JSON-encoded rather than joined with a separator, because a separator can
+ * be imitated. Newline-joining `["a", "b\nc"]` and `["a\nb", "c"]` produces
+ * identical bytes, so two different grants would share a signature — and the
+ * values here include a site id and a user id, at least one of which comes
+ * from somebody else's namespace. JSON escapes the separator it uses, so no
+ * arrangement of field values can spell a different document.
+ *
+ * The context string leads, and the field order is the schema's own sorted
+ * keys, so the encoding is canonical without anyone maintaining a list.
+ */
+declare function grantStatement(claims: GrantClaims): Uint8Array;
+/** Sign a grant with the control plane's own key. */
+declare function signGrant(keys: Pick<StoredKeys, "identityPrivate">, claims: GrantClaims): SignedGrant;
+/**
+ * Why a grant was refused.
+ *
+ * Split by remedy, because these send somebody to different places: fix your
+ * clock, take it up with the relay, or nothing at all — you are being
+ * attacked and the refusal worked.
+ *
+ * There is deliberately no `no-pinned-key` here. A device that pinned no
+ * control-plane key never reaches this function: it is in direct mode, and
+ * the question "is this grant good" does not arise. A value nothing can
+ * return is a branch every caller has to handle and no test can reach.
+ */
+type GrantRefusal = 
+/** The signature does not verify against the pinned key. */
+"bad-signature"
+/** Genuine, and for a different device's owner. */
+ | "wrong-owner"
+/** Genuine, and lifted from a different job. */
+ | "wrong-job"
+/** Older than {@link GRANT_MAX_AGE_MS}. */
+ | "expired"
+/**
+ * Issued further in the future than clock drift explains.
+ *
+ * Checked, and not as pedantry: an `issuedAt` ahead of now extends a
+ * grant's life past the bound, which is the whole thing being enforced.
+ *
+ * Tolerant by {@link CLOCK_SKEW_WARN_MS}, because it was tolerant by
+ * nothing and that made ordinary drift a total outage — see
+ * {@link verifyGrant}.
+ */
+ | "from-the-future";
+/**
+ * Is this grant one this device may act on, right now?
+ *
+ * Document-level checks only. Replay, offer-consistency and the private rule
+ * need state this function does not have and are the device's to apply — see
+ * the class comment for the full list of four.
+ */
+declare function verifyGrant(input: {
+    grant: SignedGrant;
+    owner: string;
+    jobId: string;
+    controlPlanePublic: string;
+    now: number;
+    maxAgeMs?: number;
+}): GrantRefusal | null;
+
+/**
+ * Rotation — byollm_009 Amendment C.
+ *
+ * A site holding identity key **K1** wants to be known by **K2**. It publishes
+ * a *succession*: K2, plus a signature by K1 over a statement naming both key
+ * ids. That signature is the entire mechanism, and the reason rotation can be
+ * automatic without becoming a hole is that **the relay cannot mint one** — it
+ * never holds K1. It is the same trust step a daemon already performs at
+ * pairing, applied to the site's own succession.
+ *
+ * ## Why the statement names both keys
+ *
+ * A signature over K2 alone could be lifted from this site's record and
+ * replayed into another site's, moving *that* site to K2 — a key the attacker
+ * holds. Naming the predecessor binds the succession to one chain, and it is
+ * the reason `verifyLink` takes the id it expects to be succeeding from
+ * rather than reading it out of the statement it is checking.
+ */
+/** The domain separator. Distinct from every other thing an identity signs. */
+declare const SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+/**
+ * How long a retired key may still sign work — Amendment C, ruling 2.
+ *
+ * A protocol constant and not the site's to choose. Per-site overlap
+ * arithmetic is exactly the kind of number that has to mean one thing
+ * everywhere, and a site that could choose it could choose *forever*, which is
+ * a two-key site permanently and a second key nobody ever notices retiring.
+ *
+ * Seven days: long enough that a daemon which polls daily and a laptop shut
+ * for a long weekend both see the new record before the old key stops working,
+ * short enough that "which key is live" is never an interesting question.
+ */
+declare const RETIREMENT_WINDOW_MS: number;
+/**
+ * The longest chain a daemon will walk — Amendment C, ruling 1.
+ *
+ * **A denial-of-service guard, not policy.** The bound exists so a projection
+ * cannot make a daemon verify ten thousand signatures, not to express an
+ * opinion about how often a site may rotate. A site that legitimately exceeds
+ * it has a re-pair ahead of it, which is why it is generous: at one rotation a
+ * quarter this is sixteen years.
+ */
+declare const MAX_SUCCESSION_CHAIN = 64;
+/** One step of a chain: a key, and the signature by it over its successor. */
+declare const Succession: z.ZodObject<{
+    identity: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type Succession = z.infer<typeof Succession>;
+/** The exact bytes signed. One definition; both sides call it. */
+declare function successionStatement(fromKeyId: string, toKeyId: string): Uint8Array;
+/**
+ * Sign a succession from the keys being retired to the identity taking over.
+ *
+ * Takes `StoredKeys` for the predecessor because only the holder of K1's
+ * private half can produce this, which is the property the whole design rests
+ * on. A site calls this once, at rotation, on the machine holding its keys.
+ */
+declare function signSuccession(previous: StoredKeys, next: PublicIdentity): Succession;
+/**
+ * Check one link: did `link.identity` sign over succeeding to `toKeyId`?
+ *
+ * `toKeyId` is passed in rather than read from anywhere in `link`, and that is
+ * the load-bearing detail. A verifier that recovered the successor from the
+ * signed statement would accept a statement about *any* successor, which is
+ * the replay this design names in C.1 — the signature is genuine, the
+ * successor it names is not the one being installed.
+ */
+declare function verifyLink(link: Succession, toKeyId: string): boolean;
+/** Why a chain was refused, in the words a log line uses. */
+type SuccessionFailure = "no-chain" | "too-long" | "unknown-origin" | "broken-link";
+interface SuccessionWalk {
+    /** The ids the chain passes through, oldest first, ending at the current. */
+    readonly path: string[];
+    /** The approved id the chain reached, when it reached one. */
+    readonly from?: string;
+    readonly failure?: SuccessionFailure;
+}
+/**
+ * Walk a chain from the key being presented back to a key already approved.
+ *
+ * `chain` is ordered oldest last, as the projection carries it — so walking it
+ * means starting at the current key and stepping backwards, each link proving
+ * that its holder signed for the id in front of it.
+ *
+ * Returns the approved id it reached, or why it did not. **Deliberately
+ * returns rather than throws**: a chain that does not verify is ordinary
+ * hostile input, and the caller's job is to keep its existing pin and say so.
+ *
+ * `approved` is asked as a predicate rather than taken as a set because the
+ * daemon's notion of "already approved" includes tombstoned ids — a site that
+ * left the allowlist and came back is still a site this machine has vouched
+ * for, and rotation must not become a way to launder that distinction away.
+ */
+declare function walkSuccession(input: {
+    current: string;
+    chain: readonly Succession[];
+    approved: (keyId: string) => boolean;
+}): SuccessionWalk;
+
+/**
+ * The normative MUSTs of protocol v0, as data.
+ *
+ * byollm_001 requires that "every MUST above has a conformance test id
+ * referenced inline". Keeping the MUSTs as a frozen registry rather than
+ * prose is what makes that requirement *checkable*: the conformance kit
+ * imports {@link MUSTS} and fails if any id has no test asserting it, so a
+ * new MUST cannot be added without a test and a test cannot silently drift
+ * away from the statement it claims to prove.
+ *
+ * Ids are stable and public — third-party servers cite them in their
+ * certification output.
+ */
+/** Which side of the wire is obliged to enforce a given MUST. */
+type MustEnforcer = "daemon" | "server" | "both";
+/**
+ * How a MUST is actually verified — which is not the same question as who
+ * enforces it, and is the one that decides what "byollm-compatible" means.
+ *
+ * The conformance kit's credibility rests on an implicit claim that every
+ * MUST is checkable. Ten of them were not, and the kit reported that honestly
+ * while nothing acted on it. Making the kind explicit turns "uncovered" from
+ * a number needing a paragraph of explanation into a number that should be
+ * zero.
+ *
+ * - `conformance` — the kit asserts it against *any* implementation. This is
+ *   the strong kind: a third party runs the suite and learns something.
+ * - `adversarial` — proved by the reference daemon's own suites in this repo
+ *   (the hostile-payload corpus, or its unit tests). Real verification, and
+ *   it runs in CI — but it proves things about *our* daemon, not about
+ *   someone else's, so the kit cannot carry it.
+ * - `construction` — true by the shape of the code, where a test could only
+ *   sample. A reviewer verifies it; a suite cannot.
+ * ## When a MUST binds both sides — cloud_008 Tier 3
+ *
+ * `AUDIENCE_BOTH_SIDES` says the server and the daemon each enforce. The kit
+ * passed **entirely** with the server's half deleted: every check drove a real
+ * daemon, and a daemon refuses locally, so "the job did not run" looked
+ * identical whichever side refused it. A full-honest-stack test proves only
+ * the conjunction.
+ *
+ * So a `both`-enforced MUST needs **one check per party, each with the honest
+ * counterpart removed** — C032 claims over the raw protocol precisely so no
+ * daemon admission logic runs. Where a check strips one side, its comment
+ * says which; where a MUST is enforced by both and only one side is checked,
+ * that is a gap rather than coverage.
+ *
+ * - `operator` — a claim about how someone runs a deployment, verifiable only
+ *   by audit or by reading source. The honest category, and the one that
+ *   exists so a property nobody can check from outside is *labelled* as such
+ *   rather than laundered by association with the checkable ones.
+ */
+type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
+/**
+ * How a MUST is verified — one kind, or several.
+ *
+ * Several is not hedging. `SITES_LOCALLY_APPROVED` is the case that forced it:
+ * the fence is **construction** — a daemon cannot serve a site that is not in
+ * its map, and admission refuses before a payload is fetched — while the
+ * property that a *removed and re-offered* id is still refused needs a hostile
+ * sequence of heartbeats no honest client would send, which is
+ * **adversarial**. Recording one and dropping the other would either overstate
+ * what a type check proves or understate what the suites do.
+ *
+ * The alternative was a second field for the second kind, which is two answers
+ * to one question — the shape this project keeps deleting.
+ */
+type MustVerifiedBy = MustVerification | readonly [MustVerification, ...MustVerification[]];
+/** The kinds a MUST claims, always as a list. */
+declare function kindsOf(must: {
+    readonly verifiedBy: MustVerifiedBy;
+}): readonly MustVerification[];
+/** A single normative requirement of the protocol. */
+interface Must {
+    /** Stable public id, cited by conformance output. */
+    readonly id: string;
+    /** The requirement, in MUST language. */
+    readonly statement: string;
+    /** Which implementation is obliged to enforce it. */
+    readonly enforcedBy: MustEnforcer;
+    /**
+     * How this is verified. `conformance` is the only kind the kit can assert;
+     * see {@link MustVerification} for why the others exist.
+     */
+    readonly verifiedBy: MustVerifiedBy;
+    /** Spec section this was adjudicated in. */
+    readonly source: string;
+}
+/**
+ * Every normative MUST in protocol v0.
+ *
+ * @remarks
+ * Grouped by concern for readability; the conformance kit treats this as a
+ * flat set. Adding an entry here without a corresponding conformance test is
+ * a CI failure, by design.
+ */
+declare const MUSTS: Readonly<{
+    readonly PAIR_ONE_USER: Must;
+    readonly PAIR_INTERACTIVE: Must;
+    readonly PAIR_CODE_EXPIRES: Must;
+    readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly SITE_KEY_BY_STUB: Must;
+    readonly SITES_LOCALLY_APPROVED: Must;
+    readonly KEYS_EXCHANGED_AT_CONSENT: Must;
+    readonly REQUESTS_SIGNED_NOT_BEARER: Must;
+    readonly LEASE_SCOPED_BY_GRANT: Must;
+    readonly STUB_METADATA_EXHAUSTIVE: Must;
+    readonly ENVELOPE_SEALED_AND_SIGNED: Must;
+    readonly KIND_TYPED_ONLY: Must;
+    readonly KIND_NO_CODE: Must;
+    readonly CLAIM_REQUIRES_CAPABILITY: Must;
+    readonly CAPABILITY_IS_DETECTED: Must;
+    readonly CLAIM_ATOMIC: Must;
+    readonly LEASE_HONORED: Must;
+    readonly LEASE_RECLAIMABLE: Must;
+    readonly AUDIENCE_BOTH_SIDES: Must;
+    readonly SUBSCRIPTION_SELF_LOCK: Must;
+    readonly METERED_DEFAULTS_SELF: Must;
+    readonly METERED_REQUIRES_CEILING: Must;
+    readonly COST_NOT_CONFIGURABLE: Must;
+    readonly REMOTE_IS_NEVER_FREE: Must;
+    readonly NAMED_LOCAL_ALLOWLIST: Must;
+    readonly REFUSAL_NOT_REOFFERED: Must;
+    readonly REVOCATION_HONORED: Must;
+    readonly CANCEL_HONORED: Must;
+    readonly DEPENDS_ON_GATING: Must;
+    readonly TTL_EXPIRY: Must;
+    readonly NO_RUNNER_SIGNAL: Must;
+    readonly RESULT_IDEMPOTENT: Must;
+    readonly PROVENANCE_NAMES_DEVICE: Must;
+    readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
+    readonly NO_SHELL_INTERPOLATION: Must;
+    /**
+     * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
+     *
+     * A site may now name a **service** on the stub. The temptation is to read
+     * that as a crack in this law, so the statement below says exactly where the
+     * line is: a name selects from a menu the owner published, and resolves to a
+     * model, backend, base URL and flags **only** through that owner's own
+     * config. The site supplies a key; the owner supplies every value it maps
+     * to. A name the owner does not advertise is refused rather than
+     * substituted, because substitution is how "you may pick from my list" turns
+     * into "you may ask for anything and get something".
+     *
+     * Two properties keep it from drifting into "sites demand models":
+     *
+     *   1. **Nothing the site sends is ever a value.** No model string, no URL,
+     *      no flag crosses the wire — only a key that means nothing off this
+     *      owner's machine.
+     *   2. **It is a stub field, never a payload field.** The prompt cannot
+     *      reach it. That is unchanged and is the sentence the second clause
+     *      below still enforces verbatim.
+     */
+    readonly NO_PAYLOAD_ROUTING: Must;
+    readonly STRIPPED_CHILD_ENV: Must;
+    readonly HTTP_BASE_URL_SAFE: Must;
+    readonly OUTPUT_INERT: Must;
+    readonly COMMUNITY_BUDGETS: Must;
+    readonly REVOCATION_IMMEDIATE: Must;
+    readonly CONSENT_BEFORE_ROUTE: Must;
+    readonly ROSTER_NOT_DISCLOSED: Must;
+    readonly EFFECTIVE_OFFER_ONLY: Must;
+    readonly FALLBACK_LABELED: Must;
+    readonly RELAY_BLIND: Must;
+    readonly SHARED_COMPUTE_DISCLOSED: Must;
+}>;
+/** The id of any normative MUST. */
+type MustId = keyof typeof MUSTS;
+/** All MUST ids, for coverage checks. */
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "SITE_KEY_BY_STUB" | "SITES_LOCALLY_APPROVED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "PROVENANCE_NAMES_DEVICE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS" | "REVOCATION_IMMEDIATE" | "CONSENT_BEFORE_ROUTE" | "ROSTER_NOT_DISCLOSED" | "EFFECTIVE_OFFER_ONLY" | "FALLBACK_LABELED" | "RELAY_BLIND" | "SHARED_COMPUTE_DISCLOSED")[];
+/** Every MUST verified a particular way. */
+declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendAccount, BackendClass, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, KindedPayload, Lease, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, ResultProvenance, ResultRequest, ResultResponse, TERMINAL_STATES, WireError, WireErrorCode, backendDescriptor, canTransition, effectiveOfferScope, isBackendId, isJobKind, isTerminal, matchAudience, payloadTextLength, provenanceFor };
+export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, REFUSAL_TEXT, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, payloadTextLength, provenanceFor, resolveCost, signGrant, signRequest, signSiteRequest, signSuccession, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyRequest, verifySiteRequest, walkSuccession, withoutComments };