@byollm/protocol 0.1.0-alpha.58 → 0.1.0-alpha.59

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.58`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.59`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npm install @byollm/protocol@alpha`.
 >
@@ -83,7 +83,7 @@
 > packages published and `@byollm/server` did not: a Sigstore
 > transparency-log 409 on its provenance attestation. The workflow's
 > "already published" guard correctly refuses to resume a partial publish,
-> so `0.1.0-alpha.58` is that release, whole.
+> so `0.1.0-alpha.59` is that release, whole.
 >
 > If you run the Supabase adapter, `alpha.21` needs
 > `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's

package/dist/index.d.ts

@@ -477,7 +477,7 @@ declare const ChatMessage: z.ZodObject<{
         assistant: "assistant";
     }>;
     content: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strict>;
 type ChatMessage = z.infer<typeof ChatMessage>;
 /**
  * Payload for `llm.generate`.
@@ -504,7 +504,7 @@ declare const ChatPayload: z.ZodObject<{
             assistant: "assistant";
         }>;
         content: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     system: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 type ChatPayload = z.infer<typeof ChatPayload>;
@@ -531,7 +531,7 @@ declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
         prompt: z.ZodString;
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"llm.chat">;
     payload: z.ZodObject<{
         messages: z.ZodArray<z.ZodObject<{
@@ -541,10 +541,10 @@ declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 assistant: "assistant";
             }>;
             content: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$strict>>;
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
-}, z.core.$strip>], "kind">;
+}, z.core.$strict>], "kind">;
 type KindedPayload = z.infer<typeof KindedPayload>;
 /** The payload type for a given kind. */
 type PayloadFor<K extends JobKind> = K extends "llm.generate" ? GeneratePayload : ChatPayload;
@@ -591,7 +591,7 @@ declare const Lease: z.ZodObject<{
     id: z.ZodString;
     runnerId: z.ZodString;
     expiresAt: z.ZodNumber;
-}, z.core.$strip>;
+}, z.core.$strict>;
 type Lease = z.infer<typeof Lease>;
 /** Payload union as it appears on a job record. */
 declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
@@ -605,7 +605,7 @@ declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
             assistant: "assistant";
         }>;
         content: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     system: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>]>;
 type JobPayload = z.infer<typeof JobPayload>;
@@ -634,7 +634,7 @@ declare const ClaimedJob: z.ZodObject<{
                 assistant: "assistant";
             }>;
             content: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$strict>>;
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>]>;
     audience: z.ZodEnum<{
@@ -648,7 +648,7 @@ declare const ClaimedJob: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
 }, z.core.$strict>;
 type ClaimedJob = z.infer<typeof ClaimedJob>;
 /**
@@ -979,11 +979,11 @@ declare const ClaimedStub: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     grant: z.ZodOptional<z.ZodObject<{
         grantId: z.ZodString;
         jobId: z.ZodString;
-        siteId: z.ZodString;
+        site: z.ZodString;
         user: z.ZodString;
         owner: z.ZodString;
         purpose: z.ZodString;
@@ -1378,13 +1378,6 @@ declare const Purpose: z.ZodObject<{
     }>>;
 }, z.core.$strict>;
 type Purpose = z.infer<typeof Purpose>;
-/**
- * Everything a site needs, by purpose key.
- *
- * At least one purpose: a site that declares none is a site that can enqueue
- * nothing, and accepting it would mean the first refusal a person saw came
- * from a job rather than from registration.
- */
 declare const Manifest: z.ZodRecord<z.ZodString, z.ZodObject<{
     label: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
@@ -1509,7 +1502,7 @@ declare const GRANT_CONTEXT = "byollm/v1/grant";
 declare const SignedGrant: z.ZodObject<{
     grantId: z.ZodString;
     jobId: z.ZodString;
-    siteId: z.ZodString;
+    site: z.ZodString;
     user: z.ZodString;
     owner: z.ZodString;
     purpose: z.ZodString;
@@ -1575,10 +1568,14 @@ type GrantRefusal =
 /** Older than {@link GRANT_MAX_AGE_MS}. */
  | "expired"
 /**
- * Issued in the future.
+ * Issued further in the future than clock drift explains.
  *
  * Checked, and not as pedantry: an `issuedAt` ahead of now extends a
  * grant's life past the bound, which is the whole thing being enforced.
+ *
+ * Tolerant by {@link CLOCK_SKEW_WARN_MS}, because it was tolerant by
+ * nothing and that made ordinary drift a total outage — see
+ * {@link verifyGrant}.
  */
  | "from-the-future";
 /**
@@ -2061,6 +2058,22 @@ declare const WithheldKind: z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>;
 type WithheldKind = z.infer<typeof WithheldKind>;
+/**
+ * One grant, named by both halves — V1-3.
+ *
+ * A job id is chosen per site, so the lease id is the unique thing an upstream
+ * and a daemon can both point at. Anywhere a request says "this piece of work,
+ * held by me", it says it with both.
+ *
+ * Declared once because it was written out twice — `activeLeases` and
+ * `ReleaseRequest.leases` — and both needed the same `.strict()` added. Two
+ * copies of a shape are two places to forget it.
+ */
+declare const GrantRef: z.ZodObject<{
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
+}, z.core.$strict>;
+type GrantRef = z.infer<typeof GrantRef>;
 /**
  * Pairing is a device-code exchange, not a pasted secret
  * ({@link MUSTS.PAIR_INTERACTIVE}). The daemon starts a pairing, shows the
@@ -2079,7 +2092,7 @@ declare const PairStartRequest: z.ZodObject<{
             linux: "linux";
             win32: "win32";
         }>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     device: z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
@@ -2168,7 +2181,7 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             linux: "linux";
             win32: "win32";
         }>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     device: z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
@@ -2286,11 +2299,11 @@ declare const ClaimResponse: z.ZodObject<{
             id: z.ZodString;
             runnerId: z.ZodString;
             expiresAt: z.ZodNumber;
-        }, z.core.$strip>;
+        }, z.core.$strict>;
         grant: z.ZodOptional<z.ZodObject<{
             grantId: z.ZodString;
             jobId: z.ZodString;
-            siteId: z.ZodString;
+            site: z.ZodString;
             user: z.ZodString;
             owner: z.ZodString;
             purpose: z.ZodString;
@@ -2360,7 +2373,7 @@ declare const HeartbeatRequest: z.ZodObject<{
     activeLeases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         leaseId: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
@@ -2445,7 +2458,7 @@ declare const ReleaseRequest: z.ZodObject<{
     leases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         leaseId: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     reason: z.ZodEnum<{
         refused: "refused";
         shutdown: "shutdown";
@@ -2526,4 +2539,4 @@ declare const FetchResponse: z.ZodObject<{
 }, z.core.$strict>;
 type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkProtocolVersion, classifyCost, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkProtocolVersion, classifyCost, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };

package/dist/index.js

@@ -348,7 +348,7 @@ var PAYLOAD_LIMITS = Object.freeze({
 var ChatMessage = z3.object({
   role: z3.enum(["system", "user", "assistant"]),
   content: z3.string().max(PAYLOAD_LIMITS.maxTextChars)
-});
+}).strict();
 var GeneratePayload = z3.object({
   prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
   system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
@@ -370,8 +370,11 @@ var ChatPayload = z3.object({
 var JobKind = z3.enum(["llm.generate", "llm.chat"]);
 var JOB_KINDS = Object.freeze(JobKind.options);
 var KindedPayload = z3.discriminatedUnion("kind", [
-  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }),
-  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload })
+  // Strict on the wrappers too. A union member that strips is a door beside
+  // the one that is locked: the payloads inside are strict, and an extra key
+  // on the envelope vanished just as quietly.
+  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }).strict(),
+  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload }).strict()
 ]);
 function isJobKind(value) {
   return JOB_KINDS.includes(value);
@@ -542,8 +545,29 @@ var SignedGrant = z5.object({
    * attack, and this field is why it fails.
    */
   jobId: z5.string().min(1),
-  /** The site the work came from. */
-  siteId: z5.string().min(1),
+  /**
+   * The site the work came from, **as a key id** — byollm-review 2026-08-27.
+   *
+   * This was `siteId`, holding the site's id in the control plane's
+   * namespace, and it was signed by the engine and read by nobody. A signed
+   * field nobody checks is not a weak guarantee, it is the appearance of
+   * one: the design says "the grant carries the site", and nothing anywhere
+   * compared it to anything.
+   *
+   * It could not be compared. Job ids are chosen per site, so a grant
+   * authored for (site A, `job_1`) satisfied every device check against a
+   * stub naming (site B, `job_1`) — but the device holds sites only by the
+   * key ids it pinned, and had no way to relate a control-plane uuid to
+   * one. Checking the field would have meant a lookup through the party the
+   * grant exists to distrust.
+   *
+   * So the namespace changes to the one the device already has, and the
+   * name changes with it: this is the same value as {@link JobStub.site},
+   * compared directly, no lookup and nothing to believe. The control-plane
+   * id is not carried alongside — it had no reader, and keeping an
+   * unchecked field beside a checked one is how this hole was dug.
+   */
+  site: z5.string().min(1),
   /** Whose job it is — the person the site enqueued for. */
   user: z5.string().min(1),
   /**
@@ -593,7 +617,7 @@ function verifyGrant(input) {
   if (grant.owner !== input.owner) return "wrong-owner";
   if (grant.jobId !== input.jobId) return "wrong-job";
   const age = now - grant.issuedAt;
-  if (age < 0) return "from-the-future";
+  if (age < -CLOCK_SKEW_WARN_MS) return "from-the-future";
   if (age > (input.maxAgeMs ?? GRANT_MAX_AGE_MS)) return "expired";
   return verifyWith(
     input.controlPlanePublic,
@@ -655,7 +679,7 @@ var Lease = z6.object({
   runnerId: z6.string().min(1),
   /** Epoch milliseconds after which the claim is void. */
   expiresAt: z6.number().int().positive()
-});
+}).strict();
 var JobPayload = z6.union([GeneratePayload, ChatPayload]);
 var ClaimedJob = z6.object({
   id: z6.string().min(1),
@@ -1113,6 +1137,13 @@ function verifyRequest(input) {
 // src/manifest.ts
 import { z as z9 } from "zod";
 var RESERVED_PURPOSE = "default";
+var RENDERABLE = /^[^\p{Cc}\p{Cf}\p{Cs}\p{Co}]+$/u;
+var renderable = (max, what) => z9.string().min(1).max(max).regex(
+  RENDERABLE,
+  `a ${what} is text a person reads \u2014 no control characters, direction overrides or zero-width padding`
+).refine((value) => value.trim() !== "", {
+  message: `a ${what} cannot be blank`
+});
 var PurposeKey = z9.string().regex(
   /^[a-z0-9][a-z0-9-]*$/,
   "a purpose key is a lowercase slug \u2014 letters, digits and hyphens"
@@ -1125,9 +1156,9 @@ var Purpose = z9.object({
    * compromise between machines and this is not. "Writing Assistant" is
    * what somebody understands; `writing-assistant` is what travels.
    */
-  label: z9.string().min(1).max(80),
+  label: renderable(80, "label"),
   /** One line of context for the consent screen. Optional. */
-  description: z9.string().min(1).max(280).optional(),
+  description: renderable(280, "description").optional(),
   /**
    * The kinds this purpose uses.
    *
@@ -1135,10 +1166,15 @@ var Purpose = z9.object({
    * person can send this purpose's chat to one service and its generation
    * to another. Listing a kind here is what makes that slot appear.
    */
-  kinds: z9.array(JobKind).min(1)
+  kinds: z9.array(JobKind).min(1).max(JOB_KINDS.length).refine((kinds) => new Set(kinds).size === kinds.length, {
+    message: "a purpose lists each kind once"
+  })
 }).strict();
+var MAX_PURPOSES = 32;
 var Manifest = z9.record(PurposeKey, Purpose).refine((manifest) => Object.keys(manifest).length > 0, {
   message: "a manifest declares at least one purpose"
+}).refine((manifest) => Object.keys(manifest).length <= MAX_PURPOSES, {
+  message: `a manifest declares at most ${String(MAX_PURPOSES)} purposes \u2014 a consent screen is a set of questions somebody answers one at a time`
 }).refine((manifest) => !(RESERVED_PURPOSE in manifest), {
   message: `"${RESERVED_PURPOSE}" is reserved for a site that declares no purposes of its own \u2014 give this one a name from your own vocabulary`
 });
@@ -1716,6 +1752,7 @@ var WithheldKind = z11.object({
     z11.object({ service: z11.string().min(1), offer: OfferScope }).strict()
   ).min(2)
 }).strict();
+var GrantRef = z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict();
 var PairStartRequest = z11.object({
   protocolVersion: z11.literal(PROTOCOL_VERSION),
   action: z11.literal("start"),
@@ -1724,7 +1761,7 @@ var PairStartRequest = z11.object({
     /** Shown in the app's runner list so a user can tell their machines apart. */
     label: z11.string().min(1).max(120),
     platform: z11.enum(["darwin", "linux", "win32"])
-  }),
+  }).strict(),
   /**
    * This machine's public keys (byollm_009 §5).
    *
@@ -1861,9 +1898,7 @@ var HeartbeatRequest = z11.object({
    * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
    * grant the runner no longer holds — see {@link Lease.id}.
    */
-  activeLeases: z11.array(
-    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) })
-  ),
+  activeLeases: z11.array(GrantRef),
   /** True while the owner has the daemon paused; the server stops offering work. */
   paused: z11.boolean()
 }).strict();
@@ -2073,9 +2108,7 @@ var ReleaseRequest = z11.object({
    * moment it arrives, which for a replayed request is not the lease the
    * daemon meant. See {@link Lease.id}.
    */
-  leases: z11.array(
-    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) })
-  ),
+  leases: z11.array(GrantRef),
   /**
    * Why, so the app's runner list can say something true.
    *
@@ -2281,6 +2314,7 @@ export {
   GRANT_MAX_AGE_MS,
   GRANT_SIGNED_FIELDS,
   GeneratePayload,
+  GrantRef,
   HeartbeatRequest,
   HeartbeatResponse,
   JOB_KINDS,