@byollm/protocol 0.1.0-alpha.3 → 0.1.0-alpha.5

package/dist/index.d.ts

@@ -448,6 +448,7 @@ declare function isTerminal(state: JobState): boolean;
 declare function canTransition(from: JobState, to: JobState): boolean;
 /** A lease: the right to work on a job until `expiresAt`. */
 declare const Lease: z.ZodObject<{
+    id: z.ZodString;
     runnerId: z.ZodString;
     expiresAt: z.ZodNumber;
 }, z.core.$strip>;
@@ -504,6 +505,7 @@ declare const ClaimedJob: z.ZodObject<{
     owner: z.ZodString;
     audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     lease: z.ZodObject<{
+        id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
     }, z.core.$strip>;
@@ -614,6 +616,353 @@ declare const DeliveredResult: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
+/**
+ * How big a payload is, in buckets — byollm_009 §6.
+ *
+ * A relay routes without reading, and matching a job to a machine needs some
+ * notion of size. Buckets rather than byte counts because the exact figure is
+ * a stronger fingerprint than the routing decision requires, and because a
+ * bucket survives compression and encoding changes that an exact count does
+ * not.
+ *
+ * `unbounded` exists for streamed jobs, which have no size when they start.
+ * It is reserved now rather than added later: byollm_009 §8.1 — adding a
+ * field to a published envelope is the v2 break all over again.
+ */
+declare const SizeClass: z.ZodEnum<{
+    small: "small";
+    medium: "medium";
+    large: "large";
+    unbounded: "unbounded";
+}>;
+type SizeClass = z.infer<typeof SizeClass>;
+/** Where the bucket boundaries sit, in characters of payload text. */
+declare const SIZE_CLASS_LIMITS: Readonly<{
+    small: 4000;
+    medium: 64000;
+    large: number;
+}>;
+/**
+ * The most a payload in this bucket can be.
+ *
+ * Used where a decision must be made from a stub, before the payload has been
+ * fetched — a budget check, for instance. Charging the bucket's ceiling is the
+ * conservative direction: it refuses slightly too eagerly rather than
+ * admitting work that turns out larger than the budget allowed.
+ *
+ * `unbounded` returns `Infinity`, which fails every ceiling. That is correct
+ * until byollm_006 defines how a streamed job is budgeted — failing closed on
+ * a case nobody has designed beats inventing an allowance for it.
+ */
+declare function sizeClassCeiling(sizeClass: SizeClass): number;
+/** Bucket a payload by its text length. */
+declare function sizeClassOf(textChars: number): SizeClass;
+/**
+ * Everything an upstream may see about a job — byollm_009 §6.
+ *
+ * **This list is exhaustive and normative.** It is a commitment about the
+ * metadata surface, not an accident of what the implementation happens to
+ * send: an upstream that requires more has exceeded the protocol, and an
+ * endpoint that emits more has leaked past it
+ * ({@link MUSTS.STUB_METADATA_EXHAUSTIVE}).
+ *
+ * What is absent is the point. No payload, no model, no prompt, no result.
+ * `kind` is here because capability matching happens upstream; if a later
+ * revision moves matching to the daemon, `kind` moves into the ciphertext.
+ */
+declare const JobStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type JobStub = z.infer<typeof JobStub>;
+/** A stub, plus the lease the claiming runner now holds for it. */
+declare const ClaimedStub: z.ZodObject<{
+    id: z.ZodString;
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    owner: z.ZodString;
+    audience: z.ZodEnum<{
+        self: "self";
+        named: "named";
+        public: "public";
+    }>;
+    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    sizeClass: z.ZodEnum<{
+        small: "small";
+        medium: "medium";
+        large: "large";
+        unbounded: "unbounded";
+    }>;
+    streaming: z.ZodBoolean;
+    deadlineAt: z.ZodNumber;
+    lease: z.ZodObject<{
+        id: z.ZodString;
+        runnerId: z.ZodString;
+        expiresAt: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strict>;
+type ClaimedStub = z.infer<typeof ClaimedStub>;
+
+/**
+ * Device and site keys — byollm_009 §3.
+ *
+ * **Two keypairs per party, and the split is load-bearing.** An Ed25519
+ * *identity* key signs; an X25519 *encryption* key receives sealed envelopes.
+ * The encryption key is signed by the identity key, and **the identity key is
+ * what gets pinned**. So "who sent this" and "who can read this" are answered
+ * by different keys — which is what lets an encryption key rotate without
+ * re-establishing trust, and what byollm_009 §6's signed-then-sealed envelope
+ * depends on.
+ *
+ * **No new dependency.** byollm_009 §2 says established primitives only, via
+ * libsodium. Everything *this* module needs — Ed25519 signing, X25519 key
+ * generation — Node provides natively, and using it costs nothing and adds no
+ * install weight to a daemon that must land fast on a stranger's laptop.
+ *
+ * libsodium becomes necessary at envelope v2, where sealing does. That is a
+ * real dependency decision and it belongs in the change that needs it: a
+ * sealed box is a specific reviewed construction, and rebuilding it out of
+ * Node primitives is exactly the "novel construction" §2 rules out. Deferring
+ * the dependency is not the same as deferring the rule.
+ */
+/** A public identity, as it travels on the wire. All values base64url. */
+declare const PublicIdentity: z.ZodObject<{
+    identity: z.ZodString;
+    encryption: z.ZodString;
+    encryptionSig: z.ZodString;
+}, z.core.$strict>;
+type PublicIdentity = z.infer<typeof PublicIdentity>;
+/** Private key material, as stored on disk. Never leaves the machine. */
+declare const StoredKeys: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    identityPublic: z.ZodString;
+    identityPrivate: z.ZodString;
+    encryptionPublic: z.ZodString;
+    encryptionPrivate: z.ZodString;
+    encryptionSig: z.ZodString;
+    createdAt: z.ZodNumber;
+}, z.core.$strict>;
+type StoredKeys = z.infer<typeof StoredKeys>;
+/** Generate a fresh pair of keypairs and bind them together. */
+declare function generateKeys(now: number): StoredKeys;
+/** The public half, for the wire. */
+declare function publicIdentityOf(keys: StoredKeys): PublicIdentity;
+/**
+ * Check that an encryption key really belongs to the identity presenting it.
+ *
+ * Called on everything received, including from an upstream we otherwise
+ * trust — the point of pinning the identity is that nothing else needs to be
+ * trusted, and that only holds if this is checked every time rather than at
+ * first sight.
+ */
+declare function verifyPublicIdentity(identity: PublicIdentity): boolean;
+/** Sign arbitrary bytes with an identity key. */
+declare function signWith(keys: StoredKeys, data: Uint8Array): string;
+/** Verify bytes against a raw Ed25519 public key. */
+declare function verifyWith(identityPublic: string, data: Uint8Array, signature: string): boolean;
+/**
+ * A fingerprint a human can compare out loud.
+ *
+ * 120 bits of SHA-256 over the raw identity key, as six groups of four. Long
+ * enough that grinding a colliding key is not worth anyone's afternoon, short
+ * enough to read down a phone line — which is the whole point. A fingerprint
+ * nobody can be bothered to compare provides no security at all, so
+ * legibility is a security property here, not a nicety.
+ *
+ * Formatted with a `BYOLLM-` prefix so a pasted fingerprint is recognisable
+ * out of context, in a support thread or a screenshot.
+ */
+declare function fingerprint(identityPublic: string): string;
+/** The short id used in envelopes and provenance. Stable, and comparable. */
+declare const keyId: (identityPublic: string) => string;
+
+declare function cryptoReady(): Promise<void>;
+/**
+ * How long a sealed payload is worth keeping, from creation.
+ *
+ * Bound into every envelope and recomputed when one is opened, so it lives
+ * here rather than in the two places that need it. Two copies of a value the
+ * signature depends on is the same bug as two clock readings: it works until
+ * they disagree, and then nothing can be opened.
+ *
+ * Not a job's TTL. That answers how long the *work* is worth doing, belongs
+ * to the app and the store, and may legitimately differ per deployment.
+ */
+declare const ENVELOPE_MAX_AGE_MS: number;
+/** Which leg an envelope belongs to. Bound into the signature. */
+declare const EnvelopeDirection: z.ZodEnum<{
+    payload: "payload";
+    result: "result";
+}>;
+type EnvelopeDirection = z.infer<typeof EnvelopeDirection>;
+declare const SealedEnvelope: z.ZodObject<{
+    ciphertext: z.ZodString;
+    recipientKeyId: z.ZodString;
+    senderKeyId: z.ZodString;
+    direction: z.ZodEnum<{
+        payload: "payload";
+        result: "result";
+    }>;
+    deadlineAt: z.ZodNumber;
+}, z.core.$strict>;
+type SealedEnvelope = z.infer<typeof SealedEnvelope>;
+/** Everything the signature covers besides the plaintext itself. */
+interface EnvelopeContext {
+    readonly jobId: string;
+    readonly senderKeyId: string;
+    readonly recipientKeyId: string;
+    readonly deadlineAt: number;
+    readonly direction: EnvelopeDirection;
+}
+/** Seal a plaintext to a recipient, signed by the sender's identity. */
+declare function seal(input: {
+    plaintext: string;
+    senderKeys: StoredKeys;
+    recipientEncryptionPublic: string;
+    context: EnvelopeContext;
+}): Promise<SealedEnvelope>;
+/** Why an envelope was refused. Never distinguished to a remote caller. */
+type EnvelopeFailure = "not-for-us" | "unopenable" | "malformed" | "bad-signature" | "context-mismatch";
+type OpenResult = {
+    readonly ok: true;
+    readonly plaintext: string;
+} | {
+    readonly ok: false;
+    readonly reason: EnvelopeFailure;
+};
+/**
+ * Open an envelope and verify it came from the pinned sender.
+ *
+ * Every failure returns rather than throws: this runs on input from the
+ * network, and a crash here is a denial of service on the delivery path.
+ *
+ * The context is checked against the signature, not merely read from the
+ * envelope. An envelope carries its own claims about who sent it and to
+ * whom — believing those would authenticate the attacker's assertion rather
+ * than the sender's key.
+ */
+declare function open(input: {
+    envelope: SealedEnvelope;
+    recipientKeys: StoredKeys;
+    senderIdentityPublic: string;
+    /** The deadline is taken from the envelope and checked against its signature. */
+    expected: Omit<EnvelopeContext, "deadlineAt">;
+}): Promise<OpenResult>;
+
+/**
+ * Request signing — byollm_009 §4.2.
+ *
+ * Every authenticated call is signed by the calling device's identity key.
+ * There is no bearer token on the daemon plane: possession of a file no
+ * longer grants access, possession of a *key* does, and the key never leaves
+ * the machine.
+ *
+ * ## Why this is not the server-issued nonce the spec first described
+ *
+ * byollm_009 §4.2 says "the upstream issues a nonce; the daemon signs it".
+ * Implementing that costs one of two things: a round trip before every
+ * request, or server-side session state — and sessions reintroduce a bearer
+ * credential, which is the thing being removed.
+ *
+ * Signing *the request itself* gets the same property without either, because
+ * of something the protocol already guarantees. A captured signature is valid
+ * only for the exact request it covers — same endpoint, same runner, same
+ * body — and every authenticated endpoint here is idempotent by design:
+ * `RESULT_IDEMPOTENT` makes a replayed result a no-op, a replayed claim from
+ * the same runner returns what that runner already holds, and heartbeat and
+ * release are idempotent in effect. So a replay inside the freshness window
+ * gains an attacker nothing they could not obtain by forwarding the original,
+ * which a relay can do anyway.
+ *
+ * That is the whole argument, and it is worth stating because it rests
+ * entirely on the endpoints being idempotent. Two ways that can fail, and the
+ * second is the one that actually bit:
+ *
+ * 1. **A future endpoint that is not idempotent cannot use this scheme
+ *    unchanged** — it would need a server-issued nonce.
+ * 2. **Idempotence must hold per *addressed instance*, not per endpoint.** A
+ *    request that names a mutable target — a lease, a session, a
+ *    subscription — must name the *instance*, or a replay lands on a
+ *    different one than the sender meant and the endpoint's idempotence buys
+ *    nothing. `release` was idempotent per lease and ambiguous across them:
+ *    it named a job and a runner, both of which survive a
+ *    claim-release-reclaim cycle, so a replayed release yanked a later grant.
+ *    Fixed by giving a lease its own id and requiring it.
+ *
+ * The rule for anything added later: if a signed request can be replayed onto
+ * a target that has changed underneath it, the request has to say which
+ * target it meant.
+ */
+/** How far a request's timestamp may be from the server's clock. */
+declare const MAX_CLOCK_SKEW_MS = 120000;
+/** The signed material a request carries. */
+declare const RequestSignature: z.ZodObject<{
+    runnerId: z.ZodString;
+    issuedAt: z.ZodNumber;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type RequestSignature = z.infer<typeof RequestSignature>;
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * Newline-separated with a version prefix and a domain separator. Every field
+ * that decides what the request *does* is in here: leave one out and it
+ * becomes something an intermediary can change without breaking the
+ * signature.
+ *
+ * The body is included by hash rather than by value, so signing does not
+ * depend on both sides serialising JSON identically — which they would not.
+ */
+declare function canonicalRequest(input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): Buffer;
+/** Sign an outgoing request with this machine's identity key. */
+declare function signRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    runnerId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Why a signed request was refused. Never returned to the caller verbatim. */
+type SignatureFailure = "stale" | "bad-signature";
+/**
+ * Verify a signed request against a runner's pinned identity key.
+ *
+ * Freshness is checked in **both** directions. A clock far ahead is as much a
+ * problem as one behind: it would let a captured request stay replayable long
+ * after it was made, which is the one thing the window exists to bound.
+ */
+declare function verifyRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
 
 /**
  * The normative MUSTs of protocol v0, as data.
@@ -630,6 +979,30 @@ type DeliveredResult = z.infer<typeof DeliveredResult>;
  */
 /** Which side of the wire is obliged to enforce a given MUST. */
 type MustEnforcer = "daemon" | "server" | "both";
+/**
+ * How a MUST is actually verified — which is not the same question as who
+ * enforces it, and is the one that decides what "byollm-compatible" means.
+ *
+ * The conformance kit's credibility rests on an implicit claim that every
+ * MUST is checkable. Ten of them were not, and the kit reported that honestly
+ * while nothing acted on it. Making the kind explicit turns "uncovered" from
+ * a number needing a paragraph of explanation into a number that should be
+ * zero.
+ *
+ * - `conformance` — the kit asserts it against *any* implementation. This is
+ *   the strong kind: a third party runs the suite and learns something.
+ * - `adversarial` — proved by the reference daemon's own suites in this repo
+ *   (the hostile-payload corpus, or its unit tests). Real verification, and
+ *   it runs in CI — but it proves things about *our* daemon, not about
+ *   someone else's, so the kit cannot carry it.
+ * - `construction` — true by the shape of the code, where a test could only
+ *   sample. A reviewer verifies it; a suite cannot.
+ * - `operator` — a claim about how someone runs a deployment, verifiable only
+ *   by audit or by reading source. The honest category, and the one that
+ *   exists so a property nobody can check from outside is *labelled* as such
+ *   rather than laundered by association with the checkable ones.
+ */
+type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
 /** A single normative requirement of the protocol. */
 interface Must {
     /** Stable public id, cited by conformance output. */
@@ -638,6 +1011,11 @@ interface Must {
     readonly statement: string;
     /** Which implementation is obliged to enforce it. */
     readonly enforcedBy: MustEnforcer;
+    /**
+     * How this is verified. `conformance` is the only kind the kit can assert;
+     * see {@link MustVerification} for why the others exist.
+     */
+    readonly verifiedBy: MustVerification;
     /** Spec section this was adjudicated in. */
     readonly source: string;
 }
@@ -653,6 +1031,12 @@ declare const MUSTS: Readonly<{
     readonly PAIR_ONE_USER: Must;
     readonly PAIR_INTERACTIVE: Must;
     readonly PAIR_CODE_EXPIRES: Must;
+    readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly KEYS_EXCHANGED_AT_CONSENT: Must;
+    readonly REQUESTS_SIGNED_NOT_BEARER: Must;
+    readonly LEASE_SCOPED_BY_GRANT: Must;
+    readonly STUB_METADATA_EXHAUSTIVE: Must;
+    readonly ENVELOPE_SEALED_AND_SIGNED: Must;
     readonly KIND_TYPED_ONLY: Must;
     readonly KIND_NO_CODE: Must;
     readonly CLAIM_REQUIRES_CAPABILITY: Must;
@@ -686,14 +1070,64 @@ declare const MUSTS: Readonly<{
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+/** Every MUST verified a particular way. */
+declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
 /** Protocol version carried on every request; servers refuse what they can't speak. */
 declare const PROTOCOL_VERSION: "0";
+/**
+ * Every protocol version this build can serve, **oldest first**.
+ *
+ * One entry today. It is a list rather than a constant because the shape of
+ * the check is the point: a server supporting two versions through a
+ * migration should not need a different code path from one supporting one.
+ */
+declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
+/**
+ * The oldest version this build will talk to — derived, not declared.
+ *
+ * Stating it separately would be a second thing to keep in step with the list
+ * above, and the failure would be silent: a minimum that no longer matches
+ * what is supported produces a refusal naming a version the server would in
+ * fact have accepted.
+ */
+declare const MIN_PROTOCOL_VERSION: string;
+/** A structured refusal, so a daemon can say something useful to its owner. */
+interface VersionRefusal {
+    readonly error: "unsupported-protocol-version";
+    readonly message: string;
+    readonly supported: readonly string[];
+    readonly minimum: string;
+}
+/**
+ * Check the protocol version on an incoming request
+ * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
+ *
+ * Returns a refusal, or `null` to proceed.
+ *
+ * **A missing version is refused the same way a wrong one is.** That is the
+ * half worth stating: before this existed, the version travelled as a
+ * `z.literal` inside each endpoint's schema, so a mismatch surfaced as a
+ * generic `bad-request` — a daemon and a server discovered they disagreed by
+ * failing, with nothing in the response naming the disagreement. An error a
+ * user cannot act on is barely better than a hang.
+ *
+ * The message names the fix, because the person reading it is usually the one
+ * who has to apply it.
+ */
+declare function checkProtocolVersion(body: unknown): VersionRefusal | null;
 /** The path prefix all endpoints mount under. */
 declare const PROTOCOL_PREFIX: "/byollm";
-/** The five endpoint names, in the order byollm_001 lists them. */
-declare const ENDPOINTS: readonly ["pair", "claim", "heartbeat", "result", "release"];
+/**
+ * The endpoint names, in the order byollm_001 lists them, plus `fetch`.
+ *
+ * `fetch` is byollm_009 §6's second phase: a claim returns a stub, and the
+ * payload is collected separately by the device that took it. Two steps
+ * rather than one because a payload can only be sealed once its recipient is
+ * known — which is also what makes multi-device free.
+ */
+declare const ENDPOINTS: readonly ["pair", "claim", "fetch", "heartbeat", "result", "release"];
 type Endpoint = (typeof ENDPOINTS)[number];
 /**
  * One entry of the capability matrix: a kind this daemon can actually serve,
@@ -799,6 +1233,11 @@ declare const PairStartRequest: z.ZodObject<{
             win32: "win32";
         }>;
     }, z.core.$strip>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
@@ -863,6 +1302,11 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     runnerId: z.ZodString;
     owner: z.ZodString;
     ownerLabel: z.ZodOptional<z.ZodString>;
+    site: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -877,6 +1321,11 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             win32: "win32";
         }>;
     }, z.core.$strip>;
+    device: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
@@ -968,28 +1417,23 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
-        payload: z.ZodUnion<readonly [z.ZodObject<{
-            prompt: z.ZodString;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>, z.ZodObject<{
-            messages: z.ZodArray<z.ZodObject<{
-                role: z.ZodEnum<{
-                    system: "system";
-                    user: "user";
-                    assistant: "assistant";
-                }>;
-                content: z.ZodString;
-            }, z.core.$strip>>;
-            system: z.ZodOptional<z.ZodString>;
-        }, z.core.$strict>]>;
+        owner: z.ZodString;
         audience: z.ZodEnum<{
             self: "self";
             named: "named";
             public: "public";
         }>;
-        owner: z.ZodString;
         audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        sizeClass: z.ZodEnum<{
+            small: "small";
+            medium: "medium";
+            large: "large";
+            unbounded: "unbounded";
+        }>;
+        streaming: z.ZodBoolean;
+        deadlineAt: z.ZodNumber;
         lease: z.ZodObject<{
+            id: z.ZodString;
             runnerId: z.ZodString;
             expiresAt: z.ZodNumber;
         }, z.core.$strip>;
@@ -1037,7 +1481,10 @@ declare const HeartbeatRequest: z.ZodObject<{
             public: "public";
         }>;
     }, z.core.$strict>>;
-    activeJobIds: z.ZodArray<z.ZodString>;
+    activeLeases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strip>>;
     paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
@@ -1052,22 +1499,43 @@ declare const HeartbeatResponse: z.ZodObject<{
     serverTime: z.ZodNumber;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
+/**
+ * What an intermediary learns about how a job ended — byollm_009 §6.
+ *
+ * The discriminator and nothing else. A relay has to know a job reached a
+ * terminal state, and whether it failed, because that decides whether the job
+ * leaves the queue or the app may re-enqueue. It does not have to know what
+ * the model said, or what an error said, and this is where that line is drawn.
+ *
+ * Kept identical to `JobOutcome`'s discriminator rather than coarsened to
+ * ok/not-ok: a cancelled job and a failed one are different routing outcomes,
+ * and collapsing them would make the relay guess.
+ */
+declare const ResultDisposition: z.ZodEnum<{
+    ok: "ok";
+    error: "error";
+    canceled: "canceled";
+}>;
+type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
-    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
-        outcome: z.ZodLiteral<"ok">;
-        text: z.ZodString;
-        artifactUrl: z.ZodOptional<z.ZodURL>;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"error">;
-        code: z.ZodString;
-        message: z.ZodString;
-        retryable: z.ZodBoolean;
-    }, z.core.$strict>, z.ZodObject<{
-        outcome: z.ZodLiteral<"canceled">;
-    }, z.core.$strict>], "outcome">;
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+    disposition: z.ZodEnum<{
+        ok: "ok";
+        error: "error";
+        canceled: "canceled";
+    }>;
     model: z.ZodString;
     backendClass: z.ZodEnum<{
         http: "http";
@@ -1084,7 +1552,10 @@ type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
-    jobIds: z.ZodArray<z.ZodString>;
+    leases: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
+    }, z.core.$strip>>;
     reason: z.ZodEnum<{
         revoked: "revoked";
         shutdown: "shutdown";
@@ -1107,9 +1578,9 @@ type ReleaseResponse = z.infer<typeof ReleaseResponse>;
  * with no response at all.
  */
 declare const WireErrorCode: z.ZodEnum<{
+    "unsupported-protocol-version": "unsupported-protocol-version";
     revoked: "revoked";
     "bad-request": "bad-request";
-    "unsupported-protocol-version": "unsupported-protocol-version";
     unauthorized: "unauthorized";
     "not-found": "not-found";
     "rate-limited": "rate-limited";
@@ -1118,9 +1589,9 @@ declare const WireErrorCode: z.ZodEnum<{
 type WireErrorCode = z.infer<typeof WireErrorCode>;
 declare const WireError: z.ZodObject<{
     error: z.ZodEnum<{
+        "unsupported-protocol-version": "unsupported-protocol-version";
         revoked: "revoked";
         "bad-request": "bad-request";
-        "unsupported-protocol-version": "unsupported-protocol-version";
         unauthorized: "unauthorized";
         "not-found": "not-found";
         "rate-limited": "rate-limited";
@@ -1132,5 +1603,25 @@ declare const WireError: z.ZodObject<{
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
+declare const FetchRequest: z.ZodObject<{
+    protocolVersion: z.ZodString;
+    runnerId: z.ZodString;
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
+}, z.core.$strict>;
+type FetchRequest = z.infer<typeof FetchRequest>;
+declare const FetchResponse: z.ZodObject<{
+    envelope: z.ZodObject<{
+        ciphertext: z.ZodString;
+        recipientKeyId: z.ZodString;
+        senderKeyId: z.ZodString;
+        direction: z.ZodEnum<{
+            payload: "payload";
+            result: "result";
+        }>;
+        deadlineAt: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, KindedPayload, Lease, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, ResultProvenance, ResultRequest, ResultResponse, type SpendConsent, TERMINAL_STATES, WireError, WireErrorCode, backendDescriptor, canTransition, effectiveOfferScope, isBackendId, isJobKind, isLocalHost, isTerminal, matchAudience, payloadTextLength, provenanceFor, resolveCost };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifyWith };