@byollm/protocol 0.1.0-alpha.4 → 0.1.0-alpha.41

package/dist/index.d.ts

@@ -314,6 +314,13 @@ declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
  * Upper bounds on payload size, enforced at the schema so oversized input is
  * refused at parse time rather than somewhere deeper.
  *
+ * All three are enforced — cloud_008 Tier 4, finding 30. `maxTotalChars` was
+ * declared here and referenced nowhere, under this docstring's claim that the
+ * schema enforces them, so a chat payload of 256 messages at a million
+ * characters each parsed cleanly at sixty-four times the stated ceiling. The
+ * per-field limits were real and the aggregate one was a number in a frozen
+ * object.
+ *
  * byollm_004 §4 requires stricter limits for community (`named`/`public`)
  * jobs; those are applied on top of these by the daemon's budget check, which
  * knows the job's audience. These are the absolute ceilings for any job.
@@ -503,7 +510,7 @@ declare const ClaimedJob: z.ZodObject<{
         public: "public";
     }>;
     owner: z.ZodString;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    site: z.ZodOptional<z.ZodString>;
     lease: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
@@ -516,7 +523,7 @@ type ClaimedJob = z.infer<typeof ClaimedJob>;
  *
  * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
  * The app must never render volunteer output as its own AI's answer without
- * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
+ * knowing that is what it is ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
  */
 declare const ResultProvenance: z.ZodObject<{
     audience: z.ZodEnum<{
@@ -545,6 +552,30 @@ declare function provenanceFor(input: {
     backendClass: BackendClass;
     model: string;
 }): ResultProvenance;
+/**
+ * What the daemon did, sealed with the answer — cloud_008 §2.5.
+ *
+ * These travelled in the clear on `ResultRequest`, which meant two things at
+ * once. On the direct plane the site believed unauthenticated fields beside
+ * an authenticated envelope — a daemon could seal one answer and *declare* it
+ * came from a different model, and only the field it did not sign would be
+ * recorded. Through a relay they reached a third party that acts on none of
+ * them, and `model` in particular is the kind of detail Amendment A's rule
+ * keeps off the wire.
+ *
+ * Sealed, they are the daemon's signed statement about its own run: the site
+ * opens them, nothing in between sees them, and the disposition check that
+ * already compares clear-text against ciphertext extends to cover them.
+ */
+declare const RunMetadata: z.ZodObject<{
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>;
+type RunMetadata = z.infer<typeof RunMetadata>;
 /** Successful outcome. */
 declare const JobResultOk: z.ZodObject<{
     outcome: z.ZodLiteral<"ok">;
@@ -575,6 +606,37 @@ declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
     outcome: z.ZodLiteral<"canceled">;
 }, z.core.$strict>], "outcome">;
 type JobOutcome = z.infer<typeof JobOutcome>;
+/**
+ * The plaintext inside a result envelope.
+ *
+ * The outcome and how it was produced, together, because they are one
+ * statement by one signer. A site that opened only the outcome would be
+ * trusting the envelope for the answer and the request body for everything
+ * about it.
+ */
+declare const SealedOutcome: z.ZodObject<{
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    ran: z.ZodObject<{
+        model: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        durationMs: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type SealedOutcome = z.infer<typeof SealedOutcome>;
 /** A completed job as delivered to the app, provenance attached. */
 declare const DeliveredResult: z.ZodObject<{
     jobId: z.ZodString;
@@ -614,6 +676,7 @@ declare const DeliveredResult: z.ZodObject<{
         model: z.ZodString;
         untrusted: z.ZodBoolean;
     }, z.core.$strict>>;
+    fallback: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
 /**
@@ -677,12 +740,12 @@ declare const JobStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
         self: "self";
         named: "named";
         public: "public";
     }>;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sizeClass: z.ZodEnum<{
         small: "small";
         medium: "medium";
@@ -701,12 +764,12 @@ declare const ClaimedStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
         self: "self";
         named: "named";
         public: "public";
     }>;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sizeClass: z.ZodEnum<{
         small: "small";
         medium: "medium";
@@ -763,6 +826,18 @@ declare const StoredKeys: z.ZodObject<{
     createdAt: z.ZodNumber;
 }, z.core.$strict>;
 type StoredKeys = z.infer<typeof StoredKeys>;
+/** Domain separator, so a signature over an encryption key cannot be
+ * replayed as a signature over anything else. */
+/**
+ * What an encryption key's signature covers.
+ *
+ * Exported because a rotation is a real event this protocol has to be able to
+ * *test* — a record whose encryption key moved under an identity that signed
+ * the move is the one case pinning must refuse loudly, and building one
+ * outside this file otherwise means re-typing this string, which is how two
+ * copies of a constant start disagreeing.
+ */
+declare const ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
 /** Generate a fresh pair of keypairs and bind them together. */
 declare function generateKeys(now: number): StoredKeys;
 /** The public half, for the wire. */
@@ -946,7 +1021,77 @@ declare function signRequest(keys: StoredKeys, input: {
     issuedAt: number;
     body: string;
 }): RequestSignature;
-/** Why a signed request was refused. Never returned to the caller verbatim. */
+/**
+ * The same scheme, for the party at the other end: a **site** calling a relay.
+ *
+ * A site talking to a relay is in exactly the daemon's position — an outbound
+ * caller with an identity keypair the other side already pins — so it gets the
+ * daemon's authentication rather than a second scheme. Bearer tokens for the
+ * site plane were the alternative, and they would have reintroduced the
+ * credential-in-a-file that §4.2 removed from the daemon plane, on the plane
+ * that carries *every* site's traffic.
+ *
+ * Two things make this safe to build on the same canonical string:
+ *
+ * 1. **The endpoint is namespaced.** Site endpoints sign `site/enqueue`, never
+ *    `enqueue`. The daemon plane's `result` and the site plane's `results` are
+ *    one character apart, and a naming collision between planes must not be
+ *    what stands between a signature and a replay onto the wrong handler. The
+ *    prefix is applied *inside* these helpers, so the two ends cannot disagree
+ *    about it — the alternative is two implementations of one bound value,
+ *    which is this project's most-repeated bug.
+ * 2. **The caller slot carries the site id.** `canonicalRequest` names that
+ *    field `runnerId` because the daemon plane got there first; here it holds
+ *    the site id, and the verifier looks the key up in the projection's site
+ *    registry rather than its device registry. The two registries never share
+ *    an entry, so a device signature cannot authenticate as a site.
+ *
+ * §4.2's replay argument carries over **only because the site plane's writes
+ * are idempotent per addressed instance**, which is a property that had to be
+ * built rather than found: `enqueue` reset a job of the same id, so a replayed
+ * enqueue inside the freshness window returned a claimed job to the queue and
+ * threw away a device's live lease. Identical in shape to the `release` bug
+ * above, on the other plane. Anything added to the site plane later must be
+ * idempotent by the instance it names, or this scheme does not cover it.
+ */
+declare function signSiteRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    siteId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Verify a site's call against the identity the control plane registered. */
+declare function verifySiteRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+/**
+ * Why a signed request was refused.
+ *
+ * **`bad-signature` is never returned verbatim; `stale` is, deliberately.**
+ * They are different kinds of refusal and conflating them costs a real user
+ * more than it costs an attacker.
+ *
+ * A bad signature is an authentication failure and the server says only
+ * "unauthorized" — telling a prober which part they got wrong is free help.
+ *
+ * A stale timestamp is a **precondition** failure: the signature may be
+ * perfectly valid and the caller's clock is simply wrong. Saying so reveals
+ * nothing, for two reasons that both have to hold. The server's time is
+ * already public — every response carries a `Date` header and the heartbeat
+ * response returns `serverTime` outright. And freshness is checked *before*
+ * the signature is verified, so a stale answer says nothing about whether the
+ * signature was any good.
+ *
+ * What conflating them costs: a machine whose clock has drifted gets
+ * `401 unauthorized` on every request, forever, with nothing anywhere pointing
+ * at the clock. That is the shape byollm_013 was filed about — a refusal that
+ * is correct, silent, and sends somebody to read our source.
+ */
 type SignatureFailure = "stale" | "bad-signature";
 /**
  * Verify a signed request against a runner's pinned identity key.
@@ -964,6 +1109,110 @@ declare function verifyRequest(input: {
     maxSkewMs?: number;
 }): SignatureFailure | null;
 
+/**
+ * Rotation — byollm_009 Amendment C.
+ *
+ * A site holding identity key **K1** wants to be known by **K2**. It publishes
+ * a *succession*: K2, plus a signature by K1 over a statement naming both key
+ * ids. That signature is the entire mechanism, and the reason rotation can be
+ * automatic without becoming a hole is that **the relay cannot mint one** — it
+ * never holds K1. It is the same trust step a daemon already performs at
+ * pairing, applied to the site's own succession.
+ *
+ * ## Why the statement names both keys
+ *
+ * A signature over K2 alone could be lifted from this site's record and
+ * replayed into another site's, moving *that* site to K2 — a key the attacker
+ * holds. Naming the predecessor binds the succession to one chain, and it is
+ * the reason `verifyLink` takes the id it expects to be succeeding from
+ * rather than reading it out of the statement it is checking.
+ */
+/** The domain separator. Distinct from every other thing an identity signs. */
+declare const SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+/**
+ * How long a retired key may still sign work — Amendment C, ruling 2.
+ *
+ * A protocol constant and not the site's to choose. Per-site overlap
+ * arithmetic is exactly the kind of number that has to mean one thing
+ * everywhere, and a site that could choose it could choose *forever*, which is
+ * a two-key site permanently and a second key nobody ever notices retiring.
+ *
+ * Seven days: long enough that a daemon which polls daily and a laptop shut
+ * for a long weekend both see the new record before the old key stops working,
+ * short enough that "which key is live" is never an interesting question.
+ */
+declare const RETIREMENT_WINDOW_MS: number;
+/**
+ * The longest chain a daemon will walk — Amendment C, ruling 1.
+ *
+ * **A denial-of-service guard, not policy.** The bound exists so a projection
+ * cannot make a daemon verify ten thousand signatures, not to express an
+ * opinion about how often a site may rotate. A site that legitimately exceeds
+ * it has a re-pair ahead of it, which is why it is generous: at one rotation a
+ * quarter this is sixteen years.
+ */
+declare const MAX_SUCCESSION_CHAIN = 64;
+/** One step of a chain: a key, and the signature by it over its successor. */
+declare const Succession: z.ZodObject<{
+    identity: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type Succession = z.infer<typeof Succession>;
+/** The exact bytes signed. One definition; both sides call it. */
+declare function successionStatement(fromKeyId: string, toKeyId: string): Uint8Array;
+/**
+ * Sign a succession from the keys being retired to the identity taking over.
+ *
+ * Takes `StoredKeys` for the predecessor because only the holder of K1's
+ * private half can produce this, which is the property the whole design rests
+ * on. A site calls this once, at rotation, on the machine holding its keys.
+ */
+declare function signSuccession(previous: StoredKeys, next: PublicIdentity): Succession;
+/**
+ * Check one link: did `link.identity` sign over succeeding to `toKeyId`?
+ *
+ * `toKeyId` is passed in rather than read from anywhere in `link`, and that is
+ * the load-bearing detail. A verifier that recovered the successor from the
+ * signed statement would accept a statement about *any* successor, which is
+ * the replay this design names in C.1 — the signature is genuine, the
+ * successor it names is not the one being installed.
+ */
+declare function verifyLink(link: Succession, toKeyId: string): boolean;
+/** Why a chain was refused, in the words a log line uses. */
+type SuccessionFailure = "no-chain" | "too-long" | "unknown-origin" | "broken-link";
+interface SuccessionWalk {
+    /** The ids the chain passes through, oldest first, ending at the current. */
+    readonly path: string[];
+    /** The approved id the chain reached, when it reached one. */
+    readonly from?: string;
+    readonly failure?: SuccessionFailure;
+}
+/**
+ * Walk a chain from the key being presented back to a key already approved.
+ *
+ * `chain` is ordered oldest last, as the projection carries it — so walking it
+ * means starting at the current key and stepping backwards, each link proving
+ * that its holder signed for the id in front of it.
+ *
+ * Returns the approved id it reached, or why it did not. **Deliberately
+ * returns rather than throws**: a chain that does not verify is ordinary
+ * hostile input, and the caller's job is to keep its existing pin and say so.
+ *
+ * `approved` is asked as a predicate rather than taken as a set because the
+ * daemon's notion of "already approved" includes tombstoned ids — a site that
+ * left the allowlist and came back is still a site this machine has vouched
+ * for, and rotation must not become a way to launder that distinction away.
+ */
+declare function walkSuccession(input: {
+    current: string;
+    chain: readonly Succession[];
+    approved: (keyId: string) => boolean;
+}): SuccessionWalk;
+
 /**
  * The normative MUSTs of protocol v0, as data.
  *
@@ -997,12 +1246,45 @@ type MustEnforcer = "daemon" | "server" | "both";
  *   someone else's, so the kit cannot carry it.
  * - `construction` — true by the shape of the code, where a test could only
  *   sample. A reviewer verifies it; a suite cannot.
+ * ## When a MUST binds both sides — cloud_008 Tier 3
+ *
+ * `AUDIENCE_BOTH_SIDES` says the server and the daemon each enforce. The kit
+ * passed **entirely** with the server's half deleted: every check drove a real
+ * daemon, and a daemon refuses locally, so "the job did not run" looked
+ * identical whichever side refused it. A full-honest-stack test proves only
+ * the conjunction.
+ *
+ * So a `both`-enforced MUST needs **one check per party, each with the honest
+ * counterpart removed** — C032 claims over the raw protocol precisely so no
+ * daemon admission logic runs. Where a check strips one side, its comment
+ * says which; where a MUST is enforced by both and only one side is checked,
+ * that is a gap rather than coverage.
+ *
  * - `operator` — a claim about how someone runs a deployment, verifiable only
  *   by audit or by reading source. The honest category, and the one that
  *   exists so a property nobody can check from outside is *labelled* as such
  *   rather than laundered by association with the checkable ones.
  */
 type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
+/**
+ * How a MUST is verified — one kind, or several.
+ *
+ * Several is not hedging. `SITES_LOCALLY_APPROVED` is the case that forced it:
+ * the fence is **construction** — a daemon cannot serve a site that is not in
+ * its map, and admission refuses before a payload is fetched — while the
+ * property that a *removed and re-offered* id is still refused needs a hostile
+ * sequence of heartbeats no honest client would send, which is
+ * **adversarial**. Recording one and dropping the other would either overstate
+ * what a type check proves or understate what the suites do.
+ *
+ * The alternative was a second field for the second kind, which is two answers
+ * to one question — the shape this project keeps deleting.
+ */
+type MustVerifiedBy = MustVerification | readonly [MustVerification, ...MustVerification[]];
+/** The kinds a MUST claims, always as a list. */
+declare function kindsOf(must: {
+    readonly verifiedBy: MustVerifiedBy;
+}): readonly MustVerification[];
 /** A single normative requirement of the protocol. */
 interface Must {
     /** Stable public id, cited by conformance output. */
@@ -1015,7 +1297,7 @@ interface Must {
      * How this is verified. `conformance` is the only kind the kit can assert;
      * see {@link MustVerification} for why the others exist.
      */
-    readonly verifiedBy: MustVerification;
+    readonly verifiedBy: MustVerifiedBy;
     /** Spec section this was adjudicated in. */
     readonly source: string;
 }
@@ -1032,6 +1314,8 @@ declare const MUSTS: Readonly<{
     readonly PAIR_INTERACTIVE: Must;
     readonly PAIR_CODE_EXPIRES: Must;
     readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly SITE_KEY_BY_STUB: Must;
+    readonly SITES_LOCALLY_APPROVED: Must;
     readonly KEYS_EXCHANGED_AT_CONSENT: Must;
     readonly REQUESTS_SIGNED_NOT_BEARER: Must;
     readonly LEASE_SCOPED_BY_GRANT: Must;
@@ -1058,7 +1342,7 @@ declare const MUSTS: Readonly<{
     readonly TTL_EXPIRY: Must;
     readonly NO_RUNNER_SIGNAL: Must;
     readonly RESULT_IDEMPOTENT: Must;
-    readonly RESULT_PROVENANCE: Must;
+    readonly PROVENANCE_NAMES_DEVICE: Must;
     readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
     readonly NO_SHELL_INTERPOLATION: Must;
     readonly NO_PAYLOAD_ROUTING: Must;
@@ -1066,11 +1350,18 @@ declare const MUSTS: Readonly<{
     readonly HTTP_BASE_URL_SAFE: Must;
     readonly OUTPUT_INERT: Must;
     readonly COMMUNITY_BUDGETS: Must;
+    readonly REVOCATION_IMMEDIATE: Must;
+    readonly CONSENT_BEFORE_ROUTE: Must;
+    readonly ROSTER_NOT_DISCLOSED: Must;
+    readonly EFFECTIVE_OFFER_ONLY: Must;
+    readonly FALLBACK_LABELED: Must;
+    readonly RELAY_BLIND: Must;
+    readonly SHARED_COMPUTE_DISCLOSED: Must;
 }>;
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "SITE_KEY_BY_STUB" | "SITES_LOCALLY_APPROVED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "PROVENANCE_NAMES_DEVICE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS" | "REVOCATION_IMMEDIATE" | "CONSENT_BEFORE_ROUTE" | "ROSTER_NOT_DISCLOSED" | "EFFECTIVE_OFFER_ONLY" | "FALLBACK_LABELED" | "RELAY_BLIND" | "SHARED_COMPUTE_DISCLOSED")[];
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
@@ -1100,6 +1391,23 @@ interface VersionRefusal {
     readonly supported: readonly string[];
     readonly minimum: string;
 }
+/**
+ * The version a request declares, wherever it carries it.
+ *
+ * A POST declares it in its body, which is where every request schema has
+ * always put it. A GET has no body, and the relay has one — the site plane's
+ * `pending` read — so it declares it in the query string instead.
+ *
+ * **Two carriers, one rule.** That asymmetry is HTTP's rather than ours, and
+ * the alternative was worse in both directions: a header for everything would
+ * change every existing daemon's request, and skipping GETs would leave an
+ * endpoint outside the handshake — which is precisely the shape B.4 found,
+ * where a whole plane was outside it.
+ */
+declare function declaredVersion(input: {
+    body?: unknown;
+    query?: URLSearchParams;
+}): unknown;
 /**
  * Check the protocol version on an incoming request
  * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
@@ -1298,15 +1606,14 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     status: z.ZodLiteral<"expired">;
 }, z.core.$strict>, z.ZodObject<{
     status: z.ZodLiteral<"approved">;
-    runnerToken: z.ZodString;
     runnerId: z.ZodString;
     owner: z.ZodString;
     ownerLabel: z.ZodOptional<z.ZodString>;
-    site: z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
         encryptionSig: z.ZodString;
-    }, z.core.$strict>;
+    }, z.core.$strict>>;
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -1418,12 +1725,12 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.chat": "llm.chat";
         }>;
         owner: z.ZodString;
+        site: z.ZodString;
         audience: z.ZodEnum<{
             self: "self";
             named: "named";
             public: "public";
         }>;
-        audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
         sizeClass: z.ZodEnum<{
             small: "small";
             medium: "medium";
@@ -1489,14 +1796,32 @@ declare const HeartbeatRequest: z.ZodObject<{
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
-    revoked: z.ZodBoolean;
-    cancel: z.ZodArray<z.ZodString>;
-    leases: z.ZodArray<z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
+    successions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        succeeds: z.ZodArray<z.ZodObject<{
+            identity: z.ZodObject<{
+                identity: z.ZodString;
+                encryption: z.ZodString;
+                encryptionSig: z.ZodString;
+            }, z.core.$strict>;
+            signature: z.ZodString;
+        }, z.core.$strict>>;
+        retiringUntil: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    cancel: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
-        expiresAt: z.ZodNumber;
+        leaseId: z.ZodString;
+    }, z.core.$strict>>;
+    lost: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
     }, z.core.$strict>>;
-    lost: z.ZodArray<z.ZodString>;
     serverTime: z.ZodNumber;
+    awaitingConsent: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
 /**
@@ -1521,6 +1846,7 @@ declare const ResultRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
+    leaseId: z.ZodString;
     envelope: z.ZodObject<{
         ciphertext: z.ZodString;
         recipientKeyId: z.ZodString;
@@ -1536,16 +1862,11 @@ declare const ResultRequest: z.ZodObject<{
         error: "error";
         canceled: "canceled";
     }>;
-    model: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    durationMs: z.ZodNumber;
 }, z.core.$strict>;
 type ResultRequest = z.infer<typeof ResultRequest>;
 declare const ResultResponse: z.ZodObject<{
     accepted: z.ZodBoolean;
+    duplicate: z.ZodOptional<z.ZodBoolean>;
     state: z.ZodString;
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
@@ -1557,9 +1878,9 @@ declare const ReleaseRequest: z.ZodObject<{
         leaseId: z.ZodString;
     }, z.core.$strip>>;
     reason: z.ZodEnum<{
-        revoked: "revoked";
         shutdown: "shutdown";
         pause: "pause";
+        revoked: "revoked";
         "backend-down": "backend-down";
         refused: "refused";
     }>;
@@ -1582,7 +1903,11 @@ declare const WireErrorCode: z.ZodEnum<{
     revoked: "revoked";
     "bad-request": "bad-request";
     unauthorized: "unauthorized";
+    forbidden: "forbidden";
     "not-found": "not-found";
+    "not-ready": "not-ready";
+    "too-late": "too-late";
+    "clock-skew": "clock-skew";
     "rate-limited": "rate-limited";
     "server-error": "server-error";
 }>;
@@ -1593,18 +1918,26 @@ declare const WireError: z.ZodObject<{
         revoked: "revoked";
         "bad-request": "bad-request";
         unauthorized: "unauthorized";
+        forbidden: "forbidden";
         "not-found": "not-found";
+        "not-ready": "not-ready";
+        "too-late": "too-late";
+        "clock-skew": "clock-skew";
         "rate-limited": "rate-limited";
         "server-error": "server-error";
     }>;
     message: z.ZodString;
+    supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    minimum: z.ZodOptional<z.ZodString>;
     retryAfter: z.ZodOptional<z.ZodNumber>;
+    serverTime: z.ZodOptional<z.ZodNumber>;
+    maxSkewMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
 declare const FetchRequest: z.ZodObject<{
-    protocolVersion: z.ZodString;
+    protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -1624,4 +1957,4 @@ declare const FetchResponse: z.ZodObject<{
 }, z.core.$strict>;
 type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifyWith };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, RETIREMENT_WINDOW_MS, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signSiteRequest, signSuccession, signWith, sizeClassCeiling, sizeClassOf, successionStatement, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };