@byollm/protocol 0.1.0-alpha.5 → 0.1.0-alpha.51

package/dist/index.d.ts

@@ -104,11 +104,23 @@ declare const BACKENDS: Readonly<{
     readonly mistral: BackendDescriptor;
     readonly "openai-http": BackendDescriptor;
     readonly "claude-cli": BackendDescriptor;
+    /**
+     * OpenAI's Codex CLI, on a ChatGPT plan — byollm_016 stage 3.
+     *
+     * `subscription`, so `SUBSCRIPTION_SELF_LOCK` pins it to its owner's own
+     * work whatever the config says. That is load-bearing here in a way it is
+     * not for `claude-cli`: Codex is an *agent*, and its default feature set
+     * includes a shell tool, browser control and computer use. The daemon
+     * disables every one of them, verified against the shipped binary rather
+     * than assumed — see `codex-cli.ts` — but the self-lock is the floor under
+     * that verification rather than a duplicate of it.
+     */
+    readonly "codex-cli": BackendDescriptor;
 }>;
 /** The id of a registered backend. */
 type BackendId = keyof typeof BACKENDS;
 /** All registered backend ids — the adversarial coverage check iterates this. */
-declare const BACKEND_IDS: readonly ("ollama" | "mlx" | "llamacpp" | "vllm" | "lmstudio" | "jan" | "localai" | "anthropic" | "openai" | "gemini" | "grok" | "groq" | "openrouter" | "together" | "deepseek" | "mistral" | "openai-http" | "claude-cli")[];
+declare const BACKEND_IDS: readonly ("ollama" | "mlx" | "llamacpp" | "vllm" | "lmstudio" | "jan" | "localai" | "anthropic" | "openai" | "gemini" | "grok" | "groq" | "openrouter" | "together" | "deepseek" | "mistral" | "openai-http" | "claude-cli" | "codex-cli")[];
 declare const BackendIdSchema: z.ZodEnum<{
     ollama: "ollama";
     mlx: "mlx";
@@ -128,6 +140,7 @@ declare const BackendIdSchema: z.ZodEnum<{
     mistral: "mistral";
     "openai-http": "openai-http";
     "claude-cli": "claude-cli";
+    "codex-cli": "codex-cli";
 }>;
 /** Narrow an arbitrary string to a registered backend id. */
 declare function isBackendId(value: string): value is BackendId;
@@ -157,45 +170,98 @@ declare function backendDescriptor(id: BackendId): BackendDescriptor;
  */
 declare function isLocalHost(hostname: string): boolean;
 /**
- * The cost class of a configured backend instance.
+ * Is this model name a hosted one billed by its vendor?
+ *
+ * Ollama serves cloud models through the same local endpoint as local ones,
+ * so the address says "free" about a model somebody is being charged for. The
+ * only thing that distinguishes them is the name, and the distinguishing part
+ * is the **tag** — everything after the last colon.
+ *
+ * End-anchored on the tag, which is what makes it decidable rather than a
+ * guess about substrings:
+ *
+ * - `glm-5.2:cloud` → cloud
+ * - `deepseek-v4-flash:0731-cloud` → cloud
+ * - `x:cloudless` → not cloud, the tag ends in "less"
+ * - `cloudmodel:7b` → not cloud, the tag is "7b"
+ * - `llama3.2` → not cloud, there is no tag at all
+ *
+ * An oddball like `:xcloud` classifies as cloud, and that is the **only
+ * permitted failure direction**: calling a free model metered narrows what an
+ * owner may share and costs nobody money, while the reverse hands somebody
+ * else's bill to a stranger.
+ */
+declare function isCloudTaggedModel(model: string): boolean;
+/**
+ * The cost class of a configured service.
  *
  * For every named provider this is whatever the registry says, full stop
  * ({@link MUSTS.COST_NOT_CONFIGURABLE}). For the generic `openai-http` entry
  * it is inferred from the base URL, and a base URL that cannot be parsed is
  * treated as `metered` — the expensive side, because guessing "free" wrong
  * costs the owner money.
+ *
+ * The model has the last word in one direction only. A local address with a
+ * cloud-tagged model is `metered`: Ollama proxies hosted models through
+ * `127.0.0.1`, so the endpoint is local and the bill is not. Read from the
+ * **configured value**, never from what the server lists — the owner's config
+ * is the thing they chose, and a server's catalogue is not theirs to be
+ * classified by.
  */
-declare function resolveCost(id: BackendId, baseUrl: string | undefined): BackendCost;
+declare function resolveCost(id: BackendId, baseUrl: string | undefined, model?: string): BackendCost;
 
 /**
  * Who may run a job, declared by the app that enqueued it.
  *
- * - `self` — only the job owner's own daemon.
- * - `named` — a daemon whose owner has explicitly allowed this (server, user)
- *   pair in their *local* allowlist (byollm_001 Rev 1 §B).
- * - `public` — any daemon offering `public` compute.
+ * - `private` — only the job owner's own devices.
+ * - `team` — a device whose owner has this person on their roster.
+ * - `public` — any device offering `public` compute.
+ *
+ * **One vocabulary, ruled 2026-08-24.** These were `self | named | public`
+ * while {@link OfferScope} became `private | team | public`, which would have
+ * left every seam where the two meet speaking two languages for one idea, and
+ * every doc explaining "self versus private" for ever. They are still
+ * independent axes — a job says who may run it, a service says who it will run
+ * for — and a job runs only where both agree
+ * ({@link MUSTS.AUDIENCE_BOTH_SIDES}). Sharing the words costs nothing and
+ * saves a mapping layer nobody would have enjoyed maintaining.
  */
 declare const Audience: z.ZodEnum<{
-    self: "self";
-    named: "named";
+    private: "private";
+    team: "team";
     public: "public";
 }>;
 type Audience = z.infer<typeof Audience>;
 /**
- * What a daemon backend is willing to run, declared by the machine's owner.
- * Same three values as {@link Audience}, but the two are independent axes —
- * a job runs only where both agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}).
+ * What a device's owner is willing to run for other people, per service.
+ *
+ * - `private` — the owner's own work only.
+ * - `team` — the owner's roster. Membership is **central**, not per-person:
+ *   the device follows the roster rather than holding its own copy of who is
+ *   in it (byollm_016, 2026-08-24).
+ * - `public` — any job, from anyone. This is the community posture the daemon
+ *   has always had (`byollm offer <service> public`), bounded by community
+ *   budgets. byollm_016 parks it as a **hosted-product** surface — the cloud
+ *   dashboard does not offer it — which is not the same as removing it from
+ *   the daemon, and the CLI still accepts it.
+ *
+ * Deliberately *not* the same words as {@link Audience}, which they used to
+ * share. They are independent axes — a job says who may run it, a service says
+ * who it will run for — and identical spellings made that read as one concept
+ * with two homes. A job runs only where both agree
+ * ({@link MUSTS.AUDIENCE_BOTH_SIDES}); {@link matches} is the one place the
+ * correspondence lives.
  */
 declare const OfferScope: z.ZodEnum<{
-    self: "self";
-    named: "named";
+    private: "private";
+    team: "team";
     public: "public";
 }>;
 type OfferScope = z.infer<typeof OfferScope>;
 /** All audience values, in widening order. */
-declare const AUDIENCES: readonly ("self" | "named" | "public")[];
+declare const AUDIENCES: readonly ("private" | "team" | "public")[];
 /** All offer scopes, in widening order. */
-declare const OFFER_SCOPES: readonly ("self" | "named" | "public")[];
+declare const OFFER_SCOPES: readonly ("private" | "team" | "public")[];
 /**
  * Why a job was refused. Distinct codes because byollm_002 requires that
  * different truths never share a message — "no matching work" and "refused on
@@ -236,7 +302,7 @@ interface SpendConsent {
  *
  * - `subscription` is locked to `self` regardless of config
  *   ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — someone else's terms.
- * - `metered` narrows to `self` unless the owner has explicitly acknowledged
+ * - `metered` narrows to `private` unless the owner has explicitly acknowledged
  *   the spend ({@link MUSTS.METERED_DEFAULTS_SELF}) — their money.
  * - `free` passes through — their electricity.
  *
@@ -291,10 +357,10 @@ interface MatchDaemon {
  * @example
  * ```ts
  * const result = matchAudience(
- *   { owner: "alice", audience: "named" },
+ *   { owner: "alice", audience: "team" },
  *   {
  *     owner: "bob",
- *     offerScope: "named",
+ *     offerScope: "team",
  *     cost: "free",
  *     locallyAllows: (o) => o === "alice",
  *   },
@@ -314,6 +380,13 @@ declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
  * Upper bounds on payload size, enforced at the schema so oversized input is
  * refused at parse time rather than somewhere deeper.
  *
+ * All three are enforced — cloud_008 Tier 4, finding 30. `maxTotalChars` was
+ * declared here and referenced nowhere, under this docstring's claim that the
+ * schema enforces them, so a chat payload of 256 messages at a million
+ * characters each parsed cleanly at sixty-four times the stated ceiling. The
+ * per-field limits were real and the aggregate one was a number in a frozen
+ * object.
+ *
  * byollm_004 §4 requires stricter limits for community (`named`/`public`)
  * jobs; those are applied on top of these by the daemon's budget check, which
  * knows the job's audience. These are the absolute ceilings for any job.
@@ -498,12 +571,13 @@ declare const ClaimedJob: z.ZodObject<{
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>]>;
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
+        private: "private";
+        team: "team";
         public: "public";
     }>;
     owner: z.ZodString;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    site: z.ZodOptional<z.ZodString>;
+    service: z.ZodOptional<z.ZodString>;
     lease: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
@@ -516,12 +590,12 @@ type ClaimedJob = z.infer<typeof ClaimedJob>;
  *
  * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
  * The app must never render volunteer output as its own AI's answer without
- * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
+ * knowing that is what it is ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
  */
 declare const ResultProvenance: z.ZodObject<{
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
+        private: "private";
+        team: "team";
         public: "public";
     }>;
     runnerId: z.ZodString;
@@ -545,6 +619,30 @@ declare function provenanceFor(input: {
     backendClass: BackendClass;
     model: string;
 }): ResultProvenance;
+/**
+ * What the daemon did, sealed with the answer — cloud_008 §2.5.
+ *
+ * These travelled in the clear on `ResultRequest`, which meant two things at
+ * once. On the direct plane the site believed unauthenticated fields beside
+ * an authenticated envelope — a daemon could seal one answer and *declare* it
+ * came from a different model, and only the field it did not sign would be
+ * recorded. Through a relay they reached a third party that acts on none of
+ * them, and `model` in particular is the kind of detail Amendment A's rule
+ * keeps off the wire.
+ *
+ * Sealed, they are the daemon's signed statement about its own run: the site
+ * opens them, nothing in between sees them, and the disposition check that
+ * already compares clear-text against ciphertext extends to cover them.
+ */
+declare const RunMetadata: z.ZodObject<{
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>;
+type RunMetadata = z.infer<typeof RunMetadata>;
 /** Successful outcome. */
 declare const JobResultOk: z.ZodObject<{
     outcome: z.ZodLiteral<"ok">;
@@ -575,6 +673,89 @@ declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
     outcome: z.ZodLiteral<"canceled">;
 }, z.core.$strict>], "outcome">;
 type JobOutcome = z.infer<typeof JobOutcome>;
+/**
+ * Why a job can never run — byollm_016 Phase B.
+ *
+ * Every one of these is **terminal**, and that is the whole point of naming
+ * them. A job that cannot be matched used to sit queued until its deadline,
+ * which reads exactly like a job that is merely waiting for a device to come
+ * online — so an app could not tell "any moment now" from "never", and neither
+ * could the person watching a spinner. Silence must never read as pending.
+ *
+ * They are decided by whoever knows first: the site's own SDK where it can see
+ * the answer without asking, the router where matching happens, and the daemon
+ * again on arrival under the both-sides rule. All three reason from the same
+ * list rather than three private vocabularies.
+ */
+declare const RefusalReason: z.ZodEnum<{
+    "select-unavailable": "select-unavailable";
+    "default-ambiguity": "default-ambiguity";
+    "default-unusable": "default-unusable";
+}>;
+type RefusalReason = z.infer<typeof RefusalReason>;
+/**
+ * A terminal outcome nobody sealed — byollm_016 Phase B.
+ *
+ * Every other finished job carries an envelope encrypted by the device that
+ * ran it, which is what makes a result unforgeable. These have no device: the
+ * job was refused *before* anything could run it, so there is nobody to seal
+ * from and no content to seal.
+ *
+ * **What that costs, stated plainly.** This is the one terminal outcome a
+ * router can author. It is worth being exact about the power that grants,
+ * because "the relay can write this" sounds alarming until you compare it with
+ * what a relay could already do: drop the job, never offer it, and let it
+ * expire. A router-authored refusal is *denial of service by a shorter route*,
+ * which is a power the router has always had and which the trust model has
+ * always said it has. What it emphatically is **not** is forgery: this shape
+ * carries no envelope and no output, so it can never be mistaken for an answer
+ * a device produced. A relay still cannot fabricate a result, because that
+ * needs a signature it does not hold.
+ *
+ * So the rule this shape enforces by construction: a refusal may deny, and may
+ * never assert. Anything that claims work was *done* still comes sealed.
+ */
+declare const JobRefused: z.ZodObject<{
+    outcome: z.ZodLiteral<"refused">;
+    reason: z.ZodEnum<{
+        "select-unavailable": "select-unavailable";
+        "default-ambiguity": "default-ambiguity";
+        "default-unusable": "default-unusable";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>;
+type JobRefused = z.infer<typeof JobRefused>;
+/**
+ * The plaintext inside a result envelope.
+ *
+ * The outcome and how it was produced, together, because they are one
+ * statement by one signer. A site that opened only the outcome would be
+ * trusting the envelope for the answer and the request body for everything
+ * about it.
+ */
+declare const SealedOutcome: z.ZodObject<{
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    ran: z.ZodObject<{
+        model: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        durationMs: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type SealedOutcome = z.infer<typeof SealedOutcome>;
 /** A completed job as delivered to the app, provenance attached. */
 declare const DeliveredResult: z.ZodObject<{
     jobId: z.ZodString;
@@ -601,8 +782,8 @@ declare const DeliveredResult: z.ZodObject<{
     }, z.core.$strict>], "outcome">>;
     provenance: z.ZodOptional<z.ZodObject<{
         audience: z.ZodEnum<{
-            self: "self";
-            named: "named";
+            private: "private";
+            team: "team";
             public: "public";
         }>;
         runnerId: z.ZodString;
@@ -614,6 +795,7 @@ declare const DeliveredResult: z.ZodObject<{
         model: z.ZodString;
         untrusted: z.ZodBoolean;
     }, z.core.$strict>>;
+    fallback: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
 /**
@@ -677,12 +859,13 @@ declare const JobStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
+        private: "private";
+        team: "team";
         public: "public";
     }>;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service: z.ZodOptional<z.ZodString>;
     sizeClass: z.ZodEnum<{
         small: "small";
         medium: "medium";
@@ -701,12 +884,13 @@ declare const ClaimedStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
+        private: "private";
+        team: "team";
         public: "public";
     }>;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    service: z.ZodOptional<z.ZodString>;
     sizeClass: z.ZodEnum<{
         small: "small";
         medium: "medium";
@@ -763,6 +947,18 @@ declare const StoredKeys: z.ZodObject<{
     createdAt: z.ZodNumber;
 }, z.core.$strict>;
 type StoredKeys = z.infer<typeof StoredKeys>;
+/** Domain separator, so a signature over an encryption key cannot be
+ * replayed as a signature over anything else. */
+/**
+ * What an encryption key's signature covers.
+ *
+ * Exported because a rotation is a real event this protocol has to be able to
+ * *test* — a record whose encryption key moved under an identity that signed
+ * the move is the one case pinning must refuse loudly, and building one
+ * outside this file otherwise means re-typing this string, which is how two
+ * copies of a constant start disagreeing.
+ */
+declare const ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
 /** Generate a fresh pair of keypairs and bind them together. */
 declare function generateKeys(now: number): StoredKeys;
 /** The public half, for the wire. */
@@ -946,7 +1142,77 @@ declare function signRequest(keys: StoredKeys, input: {
     issuedAt: number;
     body: string;
 }): RequestSignature;
-/** Why a signed request was refused. Never returned to the caller verbatim. */
+/**
+ * The same scheme, for the party at the other end: a **site** calling a relay.
+ *
+ * A site talking to a relay is in exactly the daemon's position — an outbound
+ * caller with an identity keypair the other side already pins — so it gets the
+ * daemon's authentication rather than a second scheme. Bearer tokens for the
+ * site plane were the alternative, and they would have reintroduced the
+ * credential-in-a-file that §4.2 removed from the daemon plane, on the plane
+ * that carries *every* site's traffic.
+ *
+ * Two things make this safe to build on the same canonical string:
+ *
+ * 1. **The endpoint is namespaced.** Site endpoints sign `site/enqueue`, never
+ *    `enqueue`. The daemon plane's `result` and the site plane's `results` are
+ *    one character apart, and a naming collision between planes must not be
+ *    what stands between a signature and a replay onto the wrong handler. The
+ *    prefix is applied *inside* these helpers, so the two ends cannot disagree
+ *    about it — the alternative is two implementations of one bound value,
+ *    which is this project's most-repeated bug.
+ * 2. **The caller slot carries the site id.** `canonicalRequest` names that
+ *    field `runnerId` because the daemon plane got there first; here it holds
+ *    the site id, and the verifier looks the key up in the projection's site
+ *    registry rather than its device registry. The two registries never share
+ *    an entry, so a device signature cannot authenticate as a site.
+ *
+ * §4.2's replay argument carries over **only because the site plane's writes
+ * are idempotent per addressed instance**, which is a property that had to be
+ * built rather than found: `enqueue` reset a job of the same id, so a replayed
+ * enqueue inside the freshness window returned a claimed job to the queue and
+ * threw away a device's live lease. Identical in shape to the `release` bug
+ * above, on the other plane. Anything added to the site plane later must be
+ * idempotent by the instance it names, or this scheme does not cover it.
+ */
+declare function signSiteRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    siteId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Verify a site's call against the identity the control plane registered. */
+declare function verifySiteRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+/**
+ * Why a signed request was refused.
+ *
+ * **`bad-signature` is never returned verbatim; `stale` is, deliberately.**
+ * They are different kinds of refusal and conflating them costs a real user
+ * more than it costs an attacker.
+ *
+ * A bad signature is an authentication failure and the server says only
+ * "unauthorized" — telling a prober which part they got wrong is free help.
+ *
+ * A stale timestamp is a **precondition** failure: the signature may be
+ * perfectly valid and the caller's clock is simply wrong. Saying so reveals
+ * nothing, for two reasons that both have to hold. The server's time is
+ * already public — every response carries a `Date` header and the heartbeat
+ * response returns `serverTime` outright. And freshness is checked *before*
+ * the signature is verified, so a stale answer says nothing about whether the
+ * signature was any good.
+ *
+ * What conflating them costs: a machine whose clock has drifted gets
+ * `401 unauthorized` on every request, forever, with nothing anywhere pointing
+ * at the clock. That is the shape byollm_013 was filed about — a refusal that
+ * is correct, silent, and sends somebody to read our source.
+ */
 type SignatureFailure = "stale" | "bad-signature";
 /**
  * Verify a signed request against a runner's pinned identity key.
@@ -964,6 +1230,110 @@ declare function verifyRequest(input: {
     maxSkewMs?: number;
 }): SignatureFailure | null;
 
+/**
+ * Rotation — byollm_009 Amendment C.
+ *
+ * A site holding identity key **K1** wants to be known by **K2**. It publishes
+ * a *succession*: K2, plus a signature by K1 over a statement naming both key
+ * ids. That signature is the entire mechanism, and the reason rotation can be
+ * automatic without becoming a hole is that **the relay cannot mint one** — it
+ * never holds K1. It is the same trust step a daemon already performs at
+ * pairing, applied to the site's own succession.
+ *
+ * ## Why the statement names both keys
+ *
+ * A signature over K2 alone could be lifted from this site's record and
+ * replayed into another site's, moving *that* site to K2 — a key the attacker
+ * holds. Naming the predecessor binds the succession to one chain, and it is
+ * the reason `verifyLink` takes the id it expects to be succeeding from
+ * rather than reading it out of the statement it is checking.
+ */
+/** The domain separator. Distinct from every other thing an identity signs. */
+declare const SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+/**
+ * How long a retired key may still sign work — Amendment C, ruling 2.
+ *
+ * A protocol constant and not the site's to choose. Per-site overlap
+ * arithmetic is exactly the kind of number that has to mean one thing
+ * everywhere, and a site that could choose it could choose *forever*, which is
+ * a two-key site permanently and a second key nobody ever notices retiring.
+ *
+ * Seven days: long enough that a daemon which polls daily and a laptop shut
+ * for a long weekend both see the new record before the old key stops working,
+ * short enough that "which key is live" is never an interesting question.
+ */
+declare const RETIREMENT_WINDOW_MS: number;
+/**
+ * The longest chain a daemon will walk — Amendment C, ruling 1.
+ *
+ * **A denial-of-service guard, not policy.** The bound exists so a projection
+ * cannot make a daemon verify ten thousand signatures, not to express an
+ * opinion about how often a site may rotate. A site that legitimately exceeds
+ * it has a re-pair ahead of it, which is why it is generous: at one rotation a
+ * quarter this is sixteen years.
+ */
+declare const MAX_SUCCESSION_CHAIN = 64;
+/** One step of a chain: a key, and the signature by it over its successor. */
+declare const Succession: z.ZodObject<{
+    identity: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type Succession = z.infer<typeof Succession>;
+/** The exact bytes signed. One definition; both sides call it. */
+declare function successionStatement(fromKeyId: string, toKeyId: string): Uint8Array;
+/**
+ * Sign a succession from the keys being retired to the identity taking over.
+ *
+ * Takes `StoredKeys` for the predecessor because only the holder of K1's
+ * private half can produce this, which is the property the whole design rests
+ * on. A site calls this once, at rotation, on the machine holding its keys.
+ */
+declare function signSuccession(previous: StoredKeys, next: PublicIdentity): Succession;
+/**
+ * Check one link: did `link.identity` sign over succeeding to `toKeyId`?
+ *
+ * `toKeyId` is passed in rather than read from anywhere in `link`, and that is
+ * the load-bearing detail. A verifier that recovered the successor from the
+ * signed statement would accept a statement about *any* successor, which is
+ * the replay this design names in C.1 — the signature is genuine, the
+ * successor it names is not the one being installed.
+ */
+declare function verifyLink(link: Succession, toKeyId: string): boolean;
+/** Why a chain was refused, in the words a log line uses. */
+type SuccessionFailure = "no-chain" | "too-long" | "unknown-origin" | "broken-link";
+interface SuccessionWalk {
+    /** The ids the chain passes through, oldest first, ending at the current. */
+    readonly path: string[];
+    /** The approved id the chain reached, when it reached one. */
+    readonly from?: string;
+    readonly failure?: SuccessionFailure;
+}
+/**
+ * Walk a chain from the key being presented back to a key already approved.
+ *
+ * `chain` is ordered oldest last, as the projection carries it — so walking it
+ * means starting at the current key and stepping backwards, each link proving
+ * that its holder signed for the id in front of it.
+ *
+ * Returns the approved id it reached, or why it did not. **Deliberately
+ * returns rather than throws**: a chain that does not verify is ordinary
+ * hostile input, and the caller's job is to keep its existing pin and say so.
+ *
+ * `approved` is asked as a predicate rather than taken as a set because the
+ * daemon's notion of "already approved" includes tombstoned ids — a site that
+ * left the allowlist and came back is still a site this machine has vouched
+ * for, and rotation must not become a way to launder that distinction away.
+ */
+declare function walkSuccession(input: {
+    current: string;
+    chain: readonly Succession[];
+    approved: (keyId: string) => boolean;
+}): SuccessionWalk;
+
 /**
  * The normative MUSTs of protocol v0, as data.
  *
@@ -997,12 +1367,45 @@ type MustEnforcer = "daemon" | "server" | "both";
  *   someone else's, so the kit cannot carry it.
  * - `construction` — true by the shape of the code, where a test could only
  *   sample. A reviewer verifies it; a suite cannot.
+ * ## When a MUST binds both sides — cloud_008 Tier 3
+ *
+ * `AUDIENCE_BOTH_SIDES` says the server and the daemon each enforce. The kit
+ * passed **entirely** with the server's half deleted: every check drove a real
+ * daemon, and a daemon refuses locally, so "the job did not run" looked
+ * identical whichever side refused it. A full-honest-stack test proves only
+ * the conjunction.
+ *
+ * So a `both`-enforced MUST needs **one check per party, each with the honest
+ * counterpart removed** — C032 claims over the raw protocol precisely so no
+ * daemon admission logic runs. Where a check strips one side, its comment
+ * says which; where a MUST is enforced by both and only one side is checked,
+ * that is a gap rather than coverage.
+ *
  * - `operator` — a claim about how someone runs a deployment, verifiable only
  *   by audit or by reading source. The honest category, and the one that
  *   exists so a property nobody can check from outside is *labelled* as such
  *   rather than laundered by association with the checkable ones.
  */
 type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
+/**
+ * How a MUST is verified — one kind, or several.
+ *
+ * Several is not hedging. `SITES_LOCALLY_APPROVED` is the case that forced it:
+ * the fence is **construction** — a daemon cannot serve a site that is not in
+ * its map, and admission refuses before a payload is fetched — while the
+ * property that a *removed and re-offered* id is still refused needs a hostile
+ * sequence of heartbeats no honest client would send, which is
+ * **adversarial**. Recording one and dropping the other would either overstate
+ * what a type check proves or understate what the suites do.
+ *
+ * The alternative was a second field for the second kind, which is two answers
+ * to one question — the shape this project keeps deleting.
+ */
+type MustVerifiedBy = MustVerification | readonly [MustVerification, ...MustVerification[]];
+/** The kinds a MUST claims, always as a list. */
+declare function kindsOf(must: {
+    readonly verifiedBy: MustVerifiedBy;
+}): readonly MustVerification[];
 /** A single normative requirement of the protocol. */
 interface Must {
     /** Stable public id, cited by conformance output. */
@@ -1015,7 +1418,7 @@ interface Must {
      * How this is verified. `conformance` is the only kind the kit can assert;
      * see {@link MustVerification} for why the others exist.
      */
-    readonly verifiedBy: MustVerification;
+    readonly verifiedBy: MustVerifiedBy;
     /** Spec section this was adjudicated in. */
     readonly source: string;
 }
@@ -1032,6 +1435,8 @@ declare const MUSTS: Readonly<{
     readonly PAIR_INTERACTIVE: Must;
     readonly PAIR_CODE_EXPIRES: Must;
     readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly SITE_KEY_BY_STUB: Must;
+    readonly SITES_LOCALLY_APPROVED: Must;
     readonly KEYS_EXCHANGED_AT_CONSENT: Must;
     readonly REQUESTS_SIGNED_NOT_BEARER: Must;
     readonly LEASE_SCOPED_BY_GRANT: Must;
@@ -1058,19 +1463,47 @@ declare const MUSTS: Readonly<{
     readonly TTL_EXPIRY: Must;
     readonly NO_RUNNER_SIGNAL: Must;
     readonly RESULT_IDEMPOTENT: Must;
-    readonly RESULT_PROVENANCE: Must;
+    readonly PROVENANCE_NAMES_DEVICE: Must;
     readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
     readonly NO_SHELL_INTERPOLATION: Must;
+    /**
+     * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
+     *
+     * A site may now name a **service** on the stub. The temptation is to read
+     * that as a crack in this law, so the statement below says exactly where the
+     * line is: a name selects from a menu the owner published, and resolves to a
+     * model, backend, base URL and flags **only** through that owner's own
+     * config. The site supplies a key; the owner supplies every value it maps
+     * to. A name the owner does not advertise is refused rather than
+     * substituted, because substitution is how "you may pick from my list" turns
+     * into "you may ask for anything and get something".
+     *
+     * Two properties keep it from drifting into "sites demand models":
+     *
+     *   1. **Nothing the site sends is ever a value.** No model string, no URL,
+     *      no flag crosses the wire — only a key that means nothing off this
+     *      owner's machine.
+     *   2. **It is a stub field, never a payload field.** The prompt cannot
+     *      reach it. That is unchanged and is the sentence the second clause
+     *      below still enforces verbatim.
+     */
     readonly NO_PAYLOAD_ROUTING: Must;
     readonly STRIPPED_CHILD_ENV: Must;
     readonly HTTP_BASE_URL_SAFE: Must;
     readonly OUTPUT_INERT: Must;
     readonly COMMUNITY_BUDGETS: Must;
+    readonly REVOCATION_IMMEDIATE: Must;
+    readonly CONSENT_BEFORE_ROUTE: Must;
+    readonly ROSTER_NOT_DISCLOSED: Must;
+    readonly EFFECTIVE_OFFER_ONLY: Must;
+    readonly FALLBACK_LABELED: Must;
+    readonly RELAY_BLIND: Must;
+    readonly SHARED_COMPUTE_DISCLOSED: Must;
 }>;
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "SITE_KEY_BY_STUB" | "SITES_LOCALLY_APPROVED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "PROVENANCE_NAMES_DEVICE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS" | "REVOCATION_IMMEDIATE" | "CONSENT_BEFORE_ROUTE" | "ROSTER_NOT_DISCLOSED" | "EFFECTIVE_OFFER_ONLY" | "FALLBACK_LABELED" | "RELAY_BLIND" | "SHARED_COMPUTE_DISCLOSED")[];
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
@@ -1100,6 +1533,23 @@ interface VersionRefusal {
     readonly supported: readonly string[];
     readonly minimum: string;
 }
+/**
+ * The version a request declares, wherever it carries it.
+ *
+ * A POST declares it in its body, which is where every request schema has
+ * always put it. A GET has no body, and the relay has one — the site plane's
+ * `pending` read — so it declares it in the query string instead.
+ *
+ * **Two carriers, one rule.** That asymmetry is HTTP's rather than ours, and
+ * the alternative was worse in both directions: a header for everything would
+ * change every existing daemon's request, and skipping GETs would leave an
+ * endpoint outside the handshake — which is precisely the shape B.4 found,
+ * where a whole plane was outside it.
+ */
+declare function declaredVersion(input: {
+    body?: unknown;
+    query?: URLSearchParams;
+}): unknown;
 /**
  * Check the protocol version on an incoming request
  * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
@@ -1144,6 +1594,8 @@ declare const Capability: z.ZodObject<{
         "llm.generate": "llm.generate";
         "llm.chat": "llm.chat";
     }>;
+    service: z.ZodString;
+    isDefault: z.ZodBoolean;
     backendId: z.ZodEnum<{
         ollama: "ollama";
         mlx: "mlx";
@@ -1163,6 +1615,7 @@ declare const Capability: z.ZodObject<{
         mistral: "mistral";
         "openai-http": "openai-http";
         "claude-cli": "claude-cli";
+        "codex-cli": "codex-cli";
     }>;
     backendClass: z.ZodEnum<{
         http: "http";
@@ -1170,8 +1623,8 @@ declare const Capability: z.ZodObject<{
     }>;
     model: z.ZodString;
     offerScope: z.ZodEnum<{
-        self: "self";
-        named: "named";
+        private: "private";
+        team: "team";
         public: "public";
     }>;
 }, z.core.$strict>;
@@ -1182,6 +1635,8 @@ declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
         "llm.generate": "llm.generate";
         "llm.chat": "llm.chat";
     }>;
+    service: z.ZodString;
+    isDefault: z.ZodBoolean;
     backendId: z.ZodEnum<{
         ollama: "ollama";
         mlx: "mlx";
@@ -1201,6 +1656,7 @@ declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
         mistral: "mistral";
         "openai-http": "openai-http";
         "claude-cli": "claude-cli";
+        "codex-cli": "codex-cli";
     }>;
     backendClass: z.ZodEnum<{
         http: "http";
@@ -1208,12 +1664,41 @@ declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
     }>;
     model: z.ZodString;
     offerScope: z.ZodEnum<{
-        self: "self";
-        named: "named";
+        private: "private";
+        team: "team";
         public: "public";
     }>;
 }, z.core.$strict>>;
 type CapabilityMatrix = z.infer<typeof CapabilityMatrix>;
+/**
+ * A kind this device could serve and deliberately does not — byollm_016.
+ *
+ * Two services answer one kind and the owner has not said which wins, so the
+ * kind is not advertised. That is correct and, unsaid, invisible: the owner
+ * adds a second service, jobs stop matching, and no surface explains it.
+ *
+ * It travels because the surfaces that must say so are not all on the device.
+ * The owner's card names the claimants; a teammate's card says only that the
+ * owner has a choice to make. Claimant **offer scopes** ride along so the hub
+ * can compute that difference without the device deciding who is asking —
+ * carry for computation, filter for display, the same shape the effective
+ * offer already uses.
+ */
+declare const WithheldKind: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    claimants: z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        offer: z.ZodEnum<{
+            private: "private";
+            team: "team";
+            public: "public";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type WithheldKind = z.infer<typeof WithheldKind>;
 /**
  * Pairing is a device-code exchange, not a pasted secret
  * ({@link MUSTS.PAIR_INTERACTIVE}). The daemon starts a pairing, shows the
@@ -1243,6 +1728,8 @@ declare const PairStartRequest: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
+        isDefault: z.ZodBoolean;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1262,6 +1749,7 @@ declare const PairStartRequest: z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
@@ -1269,8 +1757,8 @@ declare const PairStartRequest: z.ZodObject<{
         }>;
         model: z.ZodString;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
+            private: "private";
+            team: "team";
             public: "public";
         }>;
     }, z.core.$strict>>;
@@ -1298,15 +1786,14 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     status: z.ZodLiteral<"expired">;
 }, z.core.$strict>, z.ZodObject<{
     status: z.ZodLiteral<"approved">;
-    runnerToken: z.ZodString;
     runnerId: z.ZodString;
     owner: z.ZodString;
     ownerLabel: z.ZodOptional<z.ZodString>;
-    site: z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
         encryptionSig: z.ZodString;
-    }, z.core.$strict>;
+    }, z.core.$strict>>;
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -1331,6 +1818,8 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
+        isDefault: z.ZodBoolean;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1350,6 +1839,7 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
@@ -1357,8 +1847,8 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
         model: z.ZodString;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
+            private: "private";
+            team: "team";
             public: "public";
         }>;
     }, z.core.$strict>>;
@@ -1376,6 +1866,8 @@ declare const ClaimRequest: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
+        isDefault: z.ZodBoolean;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1395,6 +1887,7 @@ declare const ClaimRequest: z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
@@ -1402,8 +1895,8 @@ declare const ClaimRequest: z.ZodObject<{
         }>;
         model: z.ZodString;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
+            private: "private";
+            team: "team";
             public: "public";
         }>;
     }, z.core.$strict>>;
@@ -1418,12 +1911,13 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.chat": "llm.chat";
         }>;
         owner: z.ZodString;
+        site: z.ZodString;
         audience: z.ZodEnum<{
-            self: "self";
-            named: "named";
+            private: "private";
+            team: "team";
             public: "public";
         }>;
-        audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        service: z.ZodOptional<z.ZodString>;
         sizeClass: z.ZodEnum<{
             small: "small";
             medium: "medium";
@@ -1450,6 +1944,8 @@ declare const HeartbeatRequest: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
+        isDefault: z.ZodBoolean;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1469,6 +1965,7 @@ declare const HeartbeatRequest: z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
@@ -1476,11 +1973,25 @@ declare const HeartbeatRequest: z.ZodObject<{
         }>;
         model: z.ZodString;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
+            private: "private";
+            team: "team";
             public: "public";
         }>;
     }, z.core.$strict>>;
+    withheld: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        claimants: z.ZodArray<z.ZodObject<{
+            service: z.ZodString;
+            offer: z.ZodEnum<{
+                private: "private";
+                team: "team";
+                public: "public";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     activeLeases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         leaseId: z.ZodString;
@@ -1489,14 +2000,32 @@ declare const HeartbeatRequest: z.ZodObject<{
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
-    revoked: z.ZodBoolean;
-    cancel: z.ZodArray<z.ZodString>;
-    leases: z.ZodArray<z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
+    successions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        succeeds: z.ZodArray<z.ZodObject<{
+            identity: z.ZodObject<{
+                identity: z.ZodString;
+                encryption: z.ZodString;
+                encryptionSig: z.ZodString;
+            }, z.core.$strict>;
+            signature: z.ZodString;
+        }, z.core.$strict>>;
+        retiringUntil: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    cancel: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
-        expiresAt: z.ZodNumber;
+        leaseId: z.ZodString;
+    }, z.core.$strict>>;
+    lost: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
     }, z.core.$strict>>;
-    lost: z.ZodArray<z.ZodString>;
     serverTime: z.ZodNumber;
+    awaitingConsent: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
 /**
@@ -1521,6 +2050,7 @@ declare const ResultRequest: z.ZodObject<{
     protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
+    leaseId: z.ZodString;
     envelope: z.ZodObject<{
         ciphertext: z.ZodString;
         recipientKeyId: z.ZodString;
@@ -1536,16 +2066,11 @@ declare const ResultRequest: z.ZodObject<{
         error: "error";
         canceled: "canceled";
     }>;
-    model: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    durationMs: z.ZodNumber;
 }, z.core.$strict>;
 type ResultRequest = z.infer<typeof ResultRequest>;
 declare const ResultResponse: z.ZodObject<{
     accepted: z.ZodBoolean;
+    duplicate: z.ZodOptional<z.ZodBoolean>;
     state: z.ZodString;
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
@@ -1557,11 +2082,11 @@ declare const ReleaseRequest: z.ZodObject<{
         leaseId: z.ZodString;
     }, z.core.$strip>>;
     reason: z.ZodEnum<{
-        revoked: "revoked";
+        refused: "refused";
         shutdown: "shutdown";
         pause: "pause";
+        revoked: "revoked";
         "backend-down": "backend-down";
-        refused: "refused";
     }>;
 }, z.core.$strict>;
 type ReleaseRequest = z.infer<typeof ReleaseRequest>;
@@ -1582,7 +2107,11 @@ declare const WireErrorCode: z.ZodEnum<{
     revoked: "revoked";
     "bad-request": "bad-request";
     unauthorized: "unauthorized";
+    forbidden: "forbidden";
     "not-found": "not-found";
+    "not-ready": "not-ready";
+    "too-late": "too-late";
+    "clock-skew": "clock-skew";
     "rate-limited": "rate-limited";
     "server-error": "server-error";
 }>;
@@ -1593,18 +2122,26 @@ declare const WireError: z.ZodObject<{
         revoked: "revoked";
         "bad-request": "bad-request";
         unauthorized: "unauthorized";
+        forbidden: "forbidden";
         "not-found": "not-found";
+        "not-ready": "not-ready";
+        "too-late": "too-late";
+        "clock-skew": "clock-skew";
         "rate-limited": "rate-limited";
         "server-error": "server-error";
     }>;
     message: z.ZodString;
+    supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    minimum: z.ZodOptional<z.ZodString>;
     retryAfter: z.ZodOptional<z.ZodNumber>;
+    serverTime: z.ZodOptional<z.ZodNumber>;
+    maxSkewMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
 declare const FetchRequest: z.ZodObject<{
-    protocolVersion: z.ZodString;
+    protocolVersion: z.ZodLiteral<"0">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -1624,4 +2161,4 @@ declare const FetchResponse: z.ZodObject<{
 }, z.core.$strict>;
 type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifyWith };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signSiteRequest, signSuccession, signWith, sizeClassCeiling, sizeClassOf, successionStatement, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };