@byollm/protocol 0.1.0-alpha.3 → 0.1.0-alpha.30

package/dist/index.d.ts

@@ -314,6 +314,13 @@ declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
  * Upper bounds on payload size, enforced at the schema so oversized input is
  * refused at parse time rather than somewhere deeper.
  *
+ * All three are enforced — cloud_008 Tier 4, finding 30. `maxTotalChars` was
+ * declared here and referenced nowhere, under this docstring's claim that the
+ * schema enforces them, so a chat payload of 256 messages at a million
+ * characters each parsed cleanly at sixty-four times the stated ceiling. The
+ * per-field limits were real and the aggregate one was a number in a frozen
+ * object.
+ *
  * byollm_004 §4 requires stricter limits for community (`named`/`public`)
  * jobs; those are applied on top of these by the daemon's budget check, which
  * knows the job's audience. These are the absolute ceilings for any job.
@@ -448,6 +455,7 @@ declare function isTerminal(state: JobState): boolean;
 declare function canTransition(from: JobState, to: JobState): boolean;
 /** A lease: the right to work on a job until `expiresAt`. */
 declare const Lease: z.ZodObject<{
+    id: z.ZodString;
     runnerId: z.ZodString;
     expiresAt: z.ZodNumber;
 }, z.core.$strip>;
@@ -502,8 +510,9 @@ declare const ClaimedJob: z.ZodObject<{
         public: "public";
     }>;
     owner: z.ZodString;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    site: z.ZodOptional<z.ZodString>;
     lease: z.ZodObject<{
+        id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
     }, z.core.$strip>;
@@ -514,7 +523,7 @@ type ClaimedJob = z.infer<typeof ClaimedJob>;
  *
  * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
  * The app must never render volunteer output as its own AI's answer without
- * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
+ * knowing that is what it is ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
  */
 declare const ResultProvenance: z.ZodObject<{
     audience: z.ZodEnum<{
@@ -543,6 +552,30 @@ declare function provenanceFor(input: {
     backendClass: BackendClass;
     model: string;
 }): ResultProvenance;
+/**
+ * What the daemon did, sealed with the answer — cloud_008 §2.5.
+ *
+ * These travelled in the clear on `ResultRequest`, which meant two things at
+ * once. On the direct plane the site believed unauthenticated fields beside
+ * an authenticated envelope — a daemon could seal one answer and *declare* it
+ * came from a different model, and only the field it did not sign would be
+ * recorded. Through a relay they reached a third party that acts on none of
+ * them, and `model` in particular is the kind of detail Amendment A's rule
+ * keeps off the wire.
+ *
+ * Sealed, they are the daemon's signed statement about its own run: the site
+ * opens them, nothing in between sees them, and the disposition check that
+ * already compares clear-text against ciphertext extends to cover them.
+ */
+declare const RunMetadata: z.ZodObject<{
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>;
+type RunMetadata = z.infer<typeof RunMetadata>;
 /** Successful outcome. */
 declare const JobResultOk: z.ZodObject<{
     outcome: z.ZodLiteral<"ok">;
@@ -573,6 +606,37 @@ declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
     outcome: z.ZodLiteral<"canceled">;
 }, z.core.$strict>], "outcome">;
 type JobOutcome = z.infer<typeof JobOutcome>;
+/**
+ * The plaintext inside a result envelope.
+ *
+ * The outcome and how it was produced, together, because they are one
+ * statement by one signer. A site that opened only the outcome would be
+ * trusting the envelope for the answer and the request body for everything
+ * about it.
+ */
+declare const SealedOutcome: z.ZodObject<{
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    ran: z.ZodObject<{
+        model: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        durationMs: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type SealedOutcome = z.infer<typeof SealedOutcome>;
 /** A completed job as delivered to the app, provenance attached. */
 declare const DeliveredResult: z.ZodObject<{
     jobId: z.ZodString;
@@ -614,6 +678,435 @@ declare const DeliveredResult: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
+/**
+ * How big a payload is, in buckets — byollm_009 §6.
+ *
+ * A relay routes without reading, and matching a job to a machine needs some
+ * notion of size. Buckets rather than byte counts because the exact figure is
+ * a stronger fingerprint than the routing decision requires, and because a
+ * bucket survives compression and encoding changes that an exact count does
+ * not.
+ *
+ * `unbounded` exists for streamed jobs, which have no size when they start.
+ * It is reserved now rather than added later: byollm_009 §8.1 — adding a
+ * field to a published envelope is the v2 break all over again.
+ */
+declare const SizeClass: z.ZodEnum<{
+    small: "small";
+    medium: "medium";
+    large: "large";
+    unbounded: "unbounded";
+}>;
+type SizeClass = z.infer<typeof SizeClass>;
+/** Where the bucket boundaries sit, in characters of payload text. */
+declare const SIZE_CLASS_LIMITS: Readonly<{
+    small: 4000;
+    medium: 64000;
+    large: number;
+}>;
+/**
+ * The most a payload in this bucket can be.
+ *
+ * Used where a decision must be made from a stub, before the payload has been
+ * fetched — a budget check, for instance. Charging the bucket's ceiling is the
+ * conservative direction: it refuses slightly too eagerly rather than
+ * admitting work that turns out larger than the budget allowed.
+ *
+ * `unbounded` returns `Infinity`, which fails every ceiling. That is correct
+ * until byollm_006 defines how a streamed job is budgeted — failing closed on
+ * a case nobody has designed beats inventing an allowance for it.
+ */
+declare function sizeClassCeiling(sizeClass: SizeClass): number;
+/** Bucket a payload by its text length. */
+declare function sizeClassOf(textChars: number): SizeClass;
+/**
+ * Everything an upstream may see about a job — byollm_009 §6.
+ *
+ * **This list is exhaustive and normative.** It is a commitment about the
+ * metadata surface, not an accident of what the implementation happens to
+ * send: an upstream that requires more has exceeded the protocol, and an
+ * endpoint that emits more has leaked past it
+ * ({@link MUSTS.STUB_METADATA_EXHAUSTIVE}).
+ *
+ * What is absent is the point. No payload, no model, no prompt, no result.
+ * `kind` is here because capability matching happens upstream; if a later
+ * revision moves matching to the daemon, `kind` moves into the ciphertext.
+ */
+declare const JobStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    site: z.ZodString;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type JobStub = z.infer<typeof JobStub>;
+/** A stub, plus the lease the claiming runner now holds for it. */
+declare const ClaimedStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    site: z.ZodString;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+    lease: z.ZodObject<{
+        id: z.ZodString;
+        runnerId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strict>;
+type ClaimedStub = z.infer<typeof ClaimedStub>;
+
+/**
+ * Device and site keys — byollm_009 §3.
+ *
+ * **Two keypairs per party, and the split is load-bearing.** An Ed25519
+ * *identity* key signs; an X25519 *encryption* key receives sealed envelopes.
+ * The encryption key is signed by the identity key, and **the identity key is
+ * what gets pinned**. So "who sent this" and "who can read this" are answered
+ * by different keys — which is what lets an encryption key rotate without
+ * re-establishing trust, and what byollm_009 §6's signed-then-sealed envelope
+ * depends on.
+ *
+ * **No new dependency.** byollm_009 §2 says established primitives only, via
+ * libsodium. Everything *this* module needs — Ed25519 signing, X25519 key
+ * generation — Node provides natively, and using it costs nothing and adds no
+ * install weight to a daemon that must land fast on a stranger's laptop.
+ *
+ * libsodium becomes necessary at envelope v2, where sealing does. That is a
+ * real dependency decision and it belongs in the change that needs it: a
+ * sealed box is a specific reviewed construction, and rebuilding it out of
+ * Node primitives is exactly the "novel construction" §2 rules out. Deferring
+ * the dependency is not the same as deferring the rule.
+ */
+/** A public identity, as it travels on the wire. All values base64url. */
+declare const PublicIdentity: z.ZodObject<{
+    identity: z.ZodString;
+    encryption: z.ZodString;
+    encryptionSig: z.ZodString;
+}, z.core.$strict>;
+type PublicIdentity = z.infer<typeof PublicIdentity>;
+/** Private key material, as stored on disk. Never leaves the machine. */
+declare const StoredKeys: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    identityPublic: z.ZodString;
+    identityPrivate: z.ZodString;
+    encryptionPublic: z.ZodString;
+    encryptionPrivate: z.ZodString;
+    encryptionSig: z.ZodString;
+    createdAt: z.ZodNumber;
+}, z.core.$strict>;
+type StoredKeys = z.infer<typeof StoredKeys>;
+/** Domain separator, so a signature over an encryption key cannot be
+ * replayed as a signature over anything else. */
+/**
+ * What an encryption key's signature covers.
+ *
+ * Exported because a rotation is a real event this protocol has to be able to
+ * *test* — a record whose encryption key moved under an identity that signed
+ * the move is the one case pinning must refuse loudly, and building one
+ * outside this file otherwise means re-typing this string, which is how two
+ * copies of a constant start disagreeing.
+ */
+declare const ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
+/** Generate a fresh pair of keypairs and bind them together. */
+declare function generateKeys(now: number): StoredKeys;
+/** The public half, for the wire. */
+declare function publicIdentityOf(keys: StoredKeys): PublicIdentity;
+/**
+ * Check that an encryption key really belongs to the identity presenting it.
+ *
+ * Called on everything received, including from an upstream we otherwise
+ * trust — the point of pinning the identity is that nothing else needs to be
+ * trusted, and that only holds if this is checked every time rather than at
+ * first sight.
+ */
+declare function verifyPublicIdentity(identity: PublicIdentity): boolean;
+/** Sign arbitrary bytes with an identity key. */
+declare function signWith(keys: StoredKeys, data: Uint8Array): string;
+/** Verify bytes against a raw Ed25519 public key. */
+declare function verifyWith(identityPublic: string, data: Uint8Array, signature: string): boolean;
+/**
+ * A fingerprint a human can compare out loud.
+ *
+ * 120 bits of SHA-256 over the raw identity key, as six groups of four. Long
+ * enough that grinding a colliding key is not worth anyone's afternoon, short
+ * enough to read down a phone line — which is the whole point. A fingerprint
+ * nobody can be bothered to compare provides no security at all, so
+ * legibility is a security property here, not a nicety.
+ *
+ * Formatted with a `BYOLLM-` prefix so a pasted fingerprint is recognisable
+ * out of context, in a support thread or a screenshot.
+ */
+declare function fingerprint(identityPublic: string): string;
+/** The short id used in envelopes and provenance. Stable, and comparable. */
+declare const keyId: (identityPublic: string) => string;
+
+declare function cryptoReady(): Promise<void>;
+/**
+ * How long a sealed payload is worth keeping, from creation.
+ *
+ * Bound into every envelope and recomputed when one is opened, so it lives
+ * here rather than in the two places that need it. Two copies of a value the
+ * signature depends on is the same bug as two clock readings: it works until
+ * they disagree, and then nothing can be opened.
+ *
+ * Not a job's TTL. That answers how long the *work* is worth doing, belongs
+ * to the app and the store, and may legitimately differ per deployment.
+ */
+declare const ENVELOPE_MAX_AGE_MS: number;
+/** Which leg an envelope belongs to. Bound into the signature. */
+declare const EnvelopeDirection: z.ZodEnum<{
+    payload: "payload";
+    result: "result";
+}>;
+type EnvelopeDirection = z.infer<typeof EnvelopeDirection>;
+declare const SealedEnvelope: z.ZodObject<{
+    ciphertext: z.ZodString;
+    recipientKeyId: z.ZodString;
+    senderKeyId: z.ZodString;
+    direction: z.ZodEnum<{
+        payload: "payload";
+        result: "result";
+    }>;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type SealedEnvelope = z.infer<typeof SealedEnvelope>;
+/** Everything the signature covers besides the plaintext itself. */
+interface EnvelopeContext {
+    readonly jobId: string;
+    readonly senderKeyId: string;
+    readonly recipientKeyId: string;
+    readonly deadlineAt: number;
+    readonly direction: EnvelopeDirection;
+}
+/** Seal a plaintext to a recipient, signed by the sender's identity. */
+declare function seal(input: {
+    plaintext: string;
+    senderKeys: StoredKeys;
+    recipientEncryptionPublic: string;
+    context: EnvelopeContext;
+}): Promise<SealedEnvelope>;
+/** Why an envelope was refused. Never distinguished to a remote caller. */
+type EnvelopeFailure = "not-for-us" | "unopenable" | "malformed" | "bad-signature" | "context-mismatch";
+type OpenResult = {
+    readonly ok: true;
+    readonly plaintext: string;
+} | {
+    readonly ok: false;
+    readonly reason: EnvelopeFailure;
+};
+/**
+ * Open an envelope and verify it came from the pinned sender.
+ *
+ * Every failure returns rather than throws: this runs on input from the
+ * network, and a crash here is a denial of service on the delivery path.
+ *
+ * The context is checked against the signature, not merely read from the
+ * envelope. An envelope carries its own claims about who sent it and to
+ * whom — believing those would authenticate the attacker's assertion rather
+ * than the sender's key.
+ */
+declare function open(input: {
+    envelope: SealedEnvelope;
+    recipientKeys: StoredKeys;
+    senderIdentityPublic: string;
+    /** The deadline is taken from the envelope and checked against its signature. */
+    expected: Omit<EnvelopeContext, "deadlineAt">;
+}): Promise<OpenResult>;
+
+/**
+ * Request signing — byollm_009 §4.2.
+ *
+ * Every authenticated call is signed by the calling device's identity key.
+ * There is no bearer token on the daemon plane: possession of a file no
+ * longer grants access, possession of a *key* does, and the key never leaves
+ * the machine.
+ *
+ * ## Why this is not the server-issued nonce the spec first described
+ *
+ * byollm_009 §4.2 says "the upstream issues a nonce; the daemon signs it".
+ * Implementing that costs one of two things: a round trip before every
+ * request, or server-side session state — and sessions reintroduce a bearer
+ * credential, which is the thing being removed.
+ *
+ * Signing *the request itself* gets the same property without either, because
+ * of something the protocol already guarantees. A captured signature is valid
+ * only for the exact request it covers — same endpoint, same runner, same
+ * body — and every authenticated endpoint here is idempotent by design:
+ * `RESULT_IDEMPOTENT` makes a replayed result a no-op, a replayed claim from
+ * the same runner returns what that runner already holds, and heartbeat and
+ * release are idempotent in effect. So a replay inside the freshness window
+ * gains an attacker nothing they could not obtain by forwarding the original,
+ * which a relay can do anyway.
+ *
+ * That is the whole argument, and it is worth stating because it rests
+ * entirely on the endpoints being idempotent. Two ways that can fail, and the
+ * second is the one that actually bit:
+ *
+ * 1. **A future endpoint that is not idempotent cannot use this scheme
+ *    unchanged** — it would need a server-issued nonce.
+ * 2. **Idempotence must hold per *addressed instance*, not per endpoint.** A
+ *    request that names a mutable target — a lease, a session, a
+ *    subscription — must name the *instance*, or a replay lands on a
+ *    different one than the sender meant and the endpoint's idempotence buys
+ *    nothing. `release` was idempotent per lease and ambiguous across them:
+ *    it named a job and a runner, both of which survive a
+ *    claim-release-reclaim cycle, so a replayed release yanked a later grant.
+ *    Fixed by giving a lease its own id and requiring it.
+ *
+ * The rule for anything added later: if a signed request can be replayed onto
+ * a target that has changed underneath it, the request has to say which
+ * target it meant.
+ */
+/** How far a request's timestamp may be from the server's clock. */
+declare const MAX_CLOCK_SKEW_MS = 120000;
+/** The signed material a request carries. */
+declare const RequestSignature: z.ZodObject<{
+    runnerId: z.ZodString;
+    issuedAt: z.ZodNumber;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type RequestSignature = z.infer<typeof RequestSignature>;
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * Newline-separated with a version prefix and a domain separator. Every field
+ * that decides what the request *does* is in here: leave one out and it
+ * becomes something an intermediary can change without breaking the
+ * signature.
+ *
+ * The body is included by hash rather than by value, so signing does not
+ * depend on both sides serialising JSON identically — which they would not.
+ */
+declare function canonicalRequest(input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): Buffer;
+/** Sign an outgoing request with this machine's identity key. */
+declare function signRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/**
+ * The same scheme, for the party at the other end: a **site** calling a relay.
+ *
+ * A site talking to a relay is in exactly the daemon's position — an outbound
+ * caller with an identity keypair the other side already pins — so it gets the
+ * daemon's authentication rather than a second scheme. Bearer tokens for the
+ * site plane were the alternative, and they would have reintroduced the
+ * credential-in-a-file that §4.2 removed from the daemon plane, on the plane
+ * that carries *every* site's traffic.
+ *
+ * Two things make this safe to build on the same canonical string:
+ *
+ * 1. **The endpoint is namespaced.** Site endpoints sign `site/enqueue`, never
+ *    `enqueue`. The daemon plane's `result` and the site plane's `results` are
+ *    one character apart, and a naming collision between planes must not be
+ *    what stands between a signature and a replay onto the wrong handler. The
+ *    prefix is applied *inside* these helpers, so the two ends cannot disagree
+ *    about it — the alternative is two implementations of one bound value,
+ *    which is this project's most-repeated bug.
+ * 2. **The caller slot carries the site id.** `canonicalRequest` names that
+ *    field `runnerId` because the daemon plane got there first; here it holds
+ *    the site id, and the verifier looks the key up in the projection's site
+ *    registry rather than its device registry. The two registries never share
+ *    an entry, so a device signature cannot authenticate as a site.
+ *
+ * §4.2's replay argument carries over **only because the site plane's writes
+ * are idempotent per addressed instance**, which is a property that had to be
+ * built rather than found: `enqueue` reset a job of the same id, so a replayed
+ * enqueue inside the freshness window returned a claimed job to the queue and
+ * threw away a device's live lease. Identical in shape to the `release` bug
+ * above, on the other plane. Anything added to the site plane later must be
+ * idempotent by the instance it names, or this scheme does not cover it.
+ */
+declare function signSiteRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    siteId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Verify a site's call against the identity the control plane registered. */
+declare function verifySiteRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+/**
+ * Why a signed request was refused.
+ *
+ * **`bad-signature` is never returned verbatim; `stale` is, deliberately.**
+ * They are different kinds of refusal and conflating them costs a real user
+ * more than it costs an attacker.
+ *
+ * A bad signature is an authentication failure and the server says only
+ * "unauthorized" — telling a prober which part they got wrong is free help.
+ *
+ * A stale timestamp is a **precondition** failure: the signature may be
+ * perfectly valid and the caller's clock is simply wrong. Saying so reveals
+ * nothing, for two reasons that both have to hold. The server's time is
+ * already public — every response carries a `Date` header and the heartbeat
+ * response returns `serverTime` outright. And freshness is checked *before*
+ * the signature is verified, so a stale answer says nothing about whether the
+ * signature was any good.
+ *
+ * What conflating them costs: a machine whose clock has drifted gets
+ * `401 unauthorized` on every request, forever, with nothing anywhere pointing
+ * at the clock. That is the shape byollm_013 was filed about — a refusal that
+ * is correct, silent, and sends somebody to read our source.
+ */
+type SignatureFailure = "stale" | "bad-signature";
+/**
+ * Verify a signed request against a runner's pinned identity key.
+ *
+ * Freshness is checked in **both** directions. A clock far ahead is as much a
+ * problem as one behind: it would let a captured request stay replayable long
+ * after it was made, which is the one thing the window exists to bound.
+ */
+declare function verifyRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
 
 /**
  * The normative MUSTs of protocol v0, as data.
@@ -630,6 +1123,63 @@ type DeliveredResult = z.infer<typeof DeliveredResult>;
  */
 /** Which side of the wire is obliged to enforce a given MUST. */
 type MustEnforcer = "daemon" | "server" | "both";
+/**
+ * How a MUST is actually verified — which is not the same question as who
+ * enforces it, and is the one that decides what "byollm-compatible" means.
+ *
+ * The conformance kit's credibility rests on an implicit claim that every
+ * MUST is checkable. Ten of them were not, and the kit reported that honestly
+ * while nothing acted on it. Making the kind explicit turns "uncovered" from
+ * a number needing a paragraph of explanation into a number that should be
+ * zero.
+ *
+ * - `conformance` — the kit asserts it against *any* implementation. This is
+ *   the strong kind: a third party runs the suite and learns something.
+ * - `adversarial` — proved by the reference daemon's own suites in this repo
+ *   (the hostile-payload corpus, or its unit tests). Real verification, and
+ *   it runs in CI — but it proves things about *our* daemon, not about
+ *   someone else's, so the kit cannot carry it.
+ * - `construction` — true by the shape of the code, where a test could only
+ *   sample. A reviewer verifies it; a suite cannot.
+ * ## When a MUST binds both sides — cloud_008 Tier 3
+ *
+ * `AUDIENCE_BOTH_SIDES` says the server and the daemon each enforce. The kit
+ * passed **entirely** with the server's half deleted: every check drove a real
+ * daemon, and a daemon refuses locally, so "the job did not run" looked
+ * identical whichever side refused it. A full-honest-stack test proves only
+ * the conjunction.
+ *
+ * So a `both`-enforced MUST needs **one check per party, each with the honest
+ * counterpart removed** — C032 claims over the raw protocol precisely so no
+ * daemon admission logic runs. Where a check strips one side, its comment
+ * says which; where a MUST is enforced by both and only one side is checked,
+ * that is a gap rather than coverage.
+ *
+ * - `operator` — a claim about how someone runs a deployment, verifiable only
+ *   by audit or by reading source. The honest category, and the one that
+ *   exists so a property nobody can check from outside is *labelled* as such
+ *   rather than laundered by association with the checkable ones.
+ */
+type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
+/**
+ * How a MUST is verified — one kind, or several.
+ *
+ * Several is not hedging. `SITES_LOCALLY_APPROVED` is the case that forced it:
+ * the fence is **construction** — a daemon cannot serve a site that is not in
+ * its map, and admission refuses before a payload is fetched — while the
+ * property that a *removed and re-offered* id is still refused needs a hostile
+ * sequence of heartbeats no honest client would send, which is
+ * **adversarial**. Recording one and dropping the other would either overstate
+ * what a type check proves or understate what the suites do.
+ *
+ * The alternative was a second field for the second kind, which is two answers
+ * to one question — the shape this project keeps deleting.
+ */
+type MustVerifiedBy = MustVerification | readonly [MustVerification, ...MustVerification[]];
+/** The kinds a MUST claims, always as a list. */
+declare function kindsOf(must: {
+    readonly verifiedBy: MustVerifiedBy;
+}): readonly MustVerification[];
 /** A single normative requirement of the protocol. */
 interface Must {
     /** Stable public id, cited by conformance output. */
@@ -638,6 +1188,11 @@ interface Must {
     readonly statement: string;
     /** Which implementation is obliged to enforce it. */
     readonly enforcedBy: MustEnforcer;
+    /**
+     * How this is verified. `conformance` is the only kind the kit can assert;
+     * see {@link MustVerification} for why the others exist.
+     */
+    readonly verifiedBy: MustVerifiedBy;
     /** Spec section this was adjudicated in. */
     readonly source: string;
 }
@@ -653,6 +1208,14 @@ declare const MUSTS: Readonly<{
     readonly PAIR_ONE_USER: Must;
     readonly PAIR_INTERACTIVE: Must;
     readonly PAIR_CODE_EXPIRES: Must;
+    readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly SITE_KEY_BY_STUB: Must;
+    readonly SITES_LOCALLY_APPROVED: Must;
+    readonly KEYS_EXCHANGED_AT_CONSENT: Must;
+    readonly REQUESTS_SIGNED_NOT_BEARER: Must;
+    readonly LEASE_SCOPED_BY_GRANT: Must;
+    readonly STUB_METADATA_EXHAUSTIVE: Must;
+    readonly ENVELOPE_SEALED_AND_SIGNED: Must;
     readonly KIND_TYPED_ONLY: Must;
     readonly KIND_NO_CODE: Must;
     readonly CLAIM_REQUIRES_CAPABILITY: Must;
@@ -674,7 +1237,7 @@ declare const MUSTS: Readonly<{
     readonly TTL_EXPIRY: Must;
     readonly NO_RUNNER_SIGNAL: Must;
     readonly RESULT_IDEMPOTENT: Must;
-    readonly RESULT_PROVENANCE: Must;
+    readonly PROVENANCE_NAMES_DEVICE: Must;
     readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
     readonly NO_SHELL_INTERPOLATION: Must;
     readonly NO_PAYLOAD_ROUTING: Must;
@@ -682,18 +1245,92 @@ declare const MUSTS: Readonly<{
     readonly HTTP_BASE_URL_SAFE: Must;
     readonly OUTPUT_INERT: Must;
     readonly COMMUNITY_BUDGETS: Must;
+    readonly REVOCATION_IMMEDIATE: Must;
+    readonly CONSENT_BEFORE_ROUTE: Must;
+    readonly ROSTER_NOT_DISCLOSED: Must;
+    readonly EFFECTIVE_OFFER_ONLY: Must;
+    readonly FALLBACK_LABELED: Must;
+    readonly RELAY_BLIND: Must;
+    readonly SHARED_COMPUTE_DISCLOSED: Must;
 }>;
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "SITE_KEY_BY_STUB" | "SITES_LOCALLY_APPROVED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "PROVENANCE_NAMES_DEVICE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS" | "REVOCATION_IMMEDIATE" | "CONSENT_BEFORE_ROUTE" | "ROSTER_NOT_DISCLOSED" | "EFFECTIVE_OFFER_ONLY" | "FALLBACK_LABELED" | "RELAY_BLIND" | "SHARED_COMPUTE_DISCLOSED")[];
+/** Every MUST verified a particular way. */
+declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
 /** Protocol version carried on every request; servers refuse what they can't speak. */
 declare const PROTOCOL_VERSION: "0";
+/**
+ * Every protocol version this build can serve, **oldest first**.
+ *
+ * One entry today. It is a list rather than a constant because the shape of
+ * the check is the point: a server supporting two versions through a
+ * migration should not need a different code path from one supporting one.
+ */
+declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+/**
+ * The oldest version this build will talk to — derived, not declared.
+ *
+ * Stating it separately would be a second thing to keep in step with the list
+ * above, and the failure would be silent: a minimum that no longer matches
+ * what is supported produces a refusal naming a version the server would in
+ * fact have accepted.
+ */
+declare const MIN_PROTOCOL_VERSION: string;
+/** A structured refusal, so a daemon can say something useful to its owner. */
+interface VersionRefusal {
+    readonly error: "unsupported-protocol-version";
+    readonly message: string;
+    readonly supported: readonly string[];
+    readonly minimum: string;
+}
+/**
+ * The version a request declares, wherever it carries it.
+ *
+ * A POST declares it in its body, which is where every request schema has
+ * always put it. A GET has no body, and the relay has one — the site plane's
+ * `pending` read — so it declares it in the query string instead.
+ *
+ * **Two carriers, one rule.** That asymmetry is HTTP's rather than ours, and
+ * the alternative was worse in both directions: a header for everything would
+ * change every existing daemon's request, and skipping GETs would leave an
+ * endpoint outside the handshake — which is precisely the shape B.4 found,
+ * where a whole plane was outside it.
+ */
+declare function declaredVersion(input: {
+    body?: unknown;
+    query?: URLSearchParams;
+}): unknown;
+/**
+ * Check the protocol version on an incoming request
+ * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
+ *
+ * Returns a refusal, or `null` to proceed.
+ *
+ * **A missing version is refused the same way a wrong one is.** That is the
+ * half worth stating: before this existed, the version travelled as a
+ * `z.literal` inside each endpoint's schema, so a mismatch surfaced as a
+ * generic `bad-request` — a daemon and a server discovered they disagreed by
+ * failing, with nothing in the response naming the disagreement. An error a
+ * user cannot act on is barely better than a hang.
+ *
+ * The message names the fix, because the person reading it is usually the one
+ * who has to apply it.
+ */
+declare function checkProtocolVersion(body: unknown): VersionRefusal | null;
 /** The path prefix all endpoints mount under. */
 declare const PROTOCOL_PREFIX: "/byollm";
-/** The five endpoint names, in the order byollm_001 lists them. */
-declare const ENDPOINTS: readonly ["pair", "claim", "heartbeat", "result", "release"];
+/**
+ * The endpoint names, in the order byollm_001 lists them, plus `fetch`.
+ *
+ * `fetch` is byollm_009 §6's second phase: a claim returns a stub, and the
+ * payload is collected separately by the device that took it. Two steps
+ * rather than one because a payload can only be sealed once its recipient is
+ * known — which is also what makes multi-device free.
+ */
+declare const ENDPOINTS: readonly ["pair", "claim", "fetch", "heartbeat", "result", "release"];
 type Endpoint = (typeof ENDPOINTS)[number];
 /**
  * One entry of the capability matrix: a kind this daemon can actually serve,
@@ -799,6 +1436,11 @@ declare const PairStartRequest: z.ZodObject<{
             win32: "win32";
         }>;
     }, z.core.$strip>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
@@ -859,10 +1501,14 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     status: z.ZodLiteral<"expired">;
 }, z.core.$strict>, z.ZodObject<{
     status: z.ZodLiteral<"approved">;
-    runnerToken: z.ZodString;
     runnerId: z.ZodString;
     owner: z.ZodString;
     ownerLabel: z.ZodOptional<z.ZodString>;
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -877,6 +1523,11 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             win32: "win32";
         }>;
     }, z.core.$strip>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
@@ -968,28 +1619,23 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
-        payload: z.ZodUnion<readonly [z.ZodObject<{
-            prompt: z.ZodString;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>, z.ZodObject<{
-            messages: z.ZodArray<z.ZodObject<{
-                role: z.ZodEnum<{
-                    system: "system";
-                    user: "user";
-                    assistant: "assistant";
-                }>;
-                content: z.ZodString;
-            }, z.core.$strip>>;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
+        owner: z.ZodString;
+        site: z.ZodString;
         audience: z.ZodEnum<{
             self: "self";
             named: "named";
             public: "public";
         }>;
-        owner: z.ZodString;
-        audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        sizeClass: z.ZodEnum<{
+            small: "small";
+            medium: "medium";
+            large: "large";
+            unbounded: "unbounded";
+        }>;
+        streaming: z.ZodBoolean;
+        deadlineAt: z.ZodNumber;
         lease: z.ZodObject<{
+            id: z.ZodString;
             runnerId: z.ZodString;
             expiresAt: z.ZodNumber;
         }, z.core.$strip>;
@@ -1037,58 +1683,88 @@ declare const HeartbeatRequest: z.ZodObject<{
             public: "public";
         }>;
     }, z.core.$strict>>;
-    activeJobIds: z.ZodArray<z.ZodString>;
+    activeLeases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strip>>;
     paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
-    revoked: z.ZodBoolean;
-    cancel: z.ZodArray<z.ZodString>;
-    leases: z.ZodArray<z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
+    cancel: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
-        expiresAt: z.ZodNumber;
+        leaseId: z.ZodString;
+    }, z.core.$strict>>;
+    lost: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
     }, z.core.$strict>>;
-    lost: z.ZodArray<z.ZodString>;
     serverTime: z.ZodNumber;
+    awaitingConsent: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
+/**
+ * What an intermediary learns about how a job ended — byollm_009 §6.
+ *
+ * The discriminator and nothing else. A relay has to know a job reached a
+ * terminal state, and whether it failed, because that decides whether the job
+ * leaves the queue or the app may re-enqueue. It does not have to know what
+ * the model said, or what an error said, and this is where that line is drawn.
+ *
+ * Kept identical to `JobOutcome`'s discriminator rather than coarsened to
+ * ok/not-ok: a cancelled job and a failed one are different routing outcomes,
+ * and collapsing them would make the relay guess.
+ */
+declare const ResultDisposition: z.ZodEnum<{
+    ok: "ok";
+    error: "error";
+    canceled: "canceled";
+}>;
+type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
-    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        outcome: z.ZodLiteral<"ok">;
-        text: z.ZodString;
-        artifactUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"error">;
-        code: z.ZodString;
-        message: z.ZodString;
-        retryable: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"canceled">;
-    }, z.core.$strict>], "outcome">;
-    model: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
+    leaseId: z.ZodString;
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+    disposition: z.ZodEnum<{
+        ok: "ok";
+        error: "error";
+        canceled: "canceled";
     }>;
-    durationMs: z.ZodNumber;
 }, z.core.$strict>;
 type ResultRequest = z.infer<typeof ResultRequest>;
 declare const ResultResponse: z.ZodObject<{
     accepted: z.ZodBoolean;
+    duplicate: z.ZodOptional<z.ZodBoolean>;
     state: z.ZodString;
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
-    jobIds: z.ZodArray<z.ZodString>;
+    leases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strip>>;
     reason: z.ZodEnum<{
-        revoked: "revoked";
         shutdown: "shutdown";
         pause: "pause";
+        revoked: "revoked";
         "backend-down": "backend-down";
         refused: "refused";
     }>;
@@ -1107,30 +1783,62 @@ type ReleaseResponse = z.infer<typeof ReleaseResponse>;
  * with no response at all.
  */
 declare const WireErrorCode: z.ZodEnum<{
+    "unsupported-protocol-version": "unsupported-protocol-version";
     revoked: "revoked";
     "bad-request": "bad-request";
-    "unsupported-protocol-version": "unsupported-protocol-version";
     unauthorized: "unauthorized";
+    forbidden: "forbidden";
     "not-found": "not-found";
+    "not-ready": "not-ready";
+    "too-late": "too-late";
+    "clock-skew": "clock-skew";
     "rate-limited": "rate-limited";
     "server-error": "server-error";
 }>;
 type WireErrorCode = z.infer<typeof WireErrorCode>;
 declare const WireError: z.ZodObject<{
     error: z.ZodEnum<{
+        "unsupported-protocol-version": "unsupported-protocol-version";
         revoked: "revoked";
         "bad-request": "bad-request";
-        "unsupported-protocol-version": "unsupported-protocol-version";
         unauthorized: "unauthorized";
+        forbidden: "forbidden";
         "not-found": "not-found";
+        "not-ready": "not-ready";
+        "too-late": "too-late";
+        "clock-skew": "clock-skew";
         "rate-limited": "rate-limited";
         "server-error": "server-error";
     }>;
     message: z.ZodString;
+    supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    minimum: z.ZodOptional<z.ZodString>;
     retryAfter: z.ZodOptional<z.ZodNumber>;
+    serverTime: z.ZodOptional<z.ZodNumber>;
+    maxSkewMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
+declare const FetchRequest: z.ZodObject<{
+    protocolVersion: z.ZodLiteral<"0">;
+    runnerId: z.ZodString;
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
+}, z.core.$strict>;
+type FetchRequest = z.infer<typeof FetchRequest>;
+declare const FetchResponse: z.ZodObject<{
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, KindedPayload, Lease, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, ResultProvenance, ResultRequest, ResultResponse, type SpendConsent, TERMINAL_STATES, WireError, WireErrorCode, backendDescriptor, canTransition, effectiveOfferScope, isBackendId, isJobKind, isLocalHost, isTerminal, matchAudience, payloadTextLength, provenanceFor, resolveCost };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signSiteRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith };