@byollm/protocol 0.1.0-alpha.60 → 0.1.0-alpha.61

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.60`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.61`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npm install @byollm/protocol@alpha`.
 >
@@ -83,7 +83,7 @@
 > packages published and `@byollm/server` did not: a Sigstore
 > transparency-log 409 on its provenance attestation. The workflow's
 > "already published" guard correctly refuses to resume a partial publish,
-> so `0.1.0-alpha.60` is that release, whole.
+> so `0.1.0-alpha.61` is that release, whole.
 >
 > If you run the Supabase adapter, `alpha.21` needs
 > `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's

package/dist/index.d.ts

@@ -1,5 +1,14 @@
 import { z } from 'zod';
 
+/**
+ * Its members, for anything that has to report what it accepts.
+ *
+ * Derived from the enum for the reason `JOB_KINDS` and `OFFER_SCOPES` are: a
+ * second list of the same words is a second thing to keep in step, and this
+ * one is read by the promotion gate to compare a deployed hub against a
+ * version about to be promoted.
+ */
+declare const BACKEND_CLASSES: readonly ("http" | "process")[];
 /**
  * How a backend reaches its model — the taxonomy introduced in byollm_001
  * Rev 1 §A, because the two classes have different threat surfaces.
@@ -860,6 +869,8 @@ declare const DeliveredResult: z.ZodObject<{
     fallback: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
+/** Its members, derived — see {@link BACKEND_CLASSES} for why. */
+declare const SIZE_CLASSES: readonly ("small" | "medium" | "large" | "unbounded")[];
 /**
  * How big a payload is, in buckets — byollm_009 §6.
  *
@@ -1894,8 +1905,30 @@ declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_C
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-/** Protocol version carried on every request; servers refuse what they can't speak. */
-declare const PROTOCOL_VERSION: "0";
+/**
+ * Protocol version carried on every request; servers refuse what they can't
+ * speak.
+ *
+ * **`1` because byollm_016 changed the vocabulary** — byollm-review
+ * 2026-08-27. `OfferScope` lost `public`, `self|named` became
+ * `private|team`, `JobStub` lost `service` and gained `purpose`, and the
+ * grant's site field changed namespace. The version stayed `0` through all of
+ * it.
+ *
+ * The consequence was the failure the handshake exists to prevent, arriving
+ * around it: a pre-rip daemon declares `0`, passes the version check, and
+ * then fails whole-body schema validation with "request failed schema
+ * validation" — no field named, no vocabulary named, no upgrade command. Once
+ * every ten seconds, forever, while its owner watches a device go stale for
+ * no stated reason. The check below was written because "a mismatch surfaced
+ * as a generic bad-request" and "an error a user cannot act on is barely
+ * better than a hang"; the number not moving is how that came back.
+ *
+ * A registry is a schema and an enum value is the contract — this project's
+ * own words, from the release that silenced a fleet by adding a backend id.
+ * The same sentence applies to removing an offer scope.
+ */
+declare const PROTOCOL_VERSION: "1";
 /**
  * Every protocol version this build can serve, **oldest first**.
  *
@@ -1903,6 +1936,16 @@ declare const PROTOCOL_VERSION: "0";
  * the check is the point: a server supporting two versions through a
  * migration should not need a different code path from one supporting one.
  */
+/**
+ * `0` is deliberately **not** here, though the list exists for exactly that.
+ *
+ * Supporting two versions through a migration is the shape this was built
+ * for, and it is the wrong tool when the vocabularies are incompatible: a `0`
+ * daemon sends `offer: "public"` and a `service` on its stubs, so accepting
+ * its version only moves the refusal one layer down — to the schema error
+ * that names nothing, which is the bug. Refusing the version is the whole
+ * point, because that refusal says what to do.
+ */
 declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 /**
  * The oldest version this build will talk to — derived, not declared.
@@ -2105,7 +2148,7 @@ type GrantRef = z.infer<typeof GrantRef>;
  * and nothing works over a copied string alone.
  */
 declare const PairStartRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"start">;
     daemon: z.ZodObject<{
         version: z.ZodString;
@@ -2169,7 +2212,7 @@ declare const PairStartResponse: z.ZodObject<{
 }, z.core.$strict>;
 type PairStartResponse = z.infer<typeof PairStartResponse>;
 declare const PairPollRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>;
@@ -2194,7 +2237,7 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"start">;
     daemon: z.ZodObject<{
         version: z.ZodString;
@@ -2248,13 +2291,13 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
     }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>], "action">;
 type PairRequest = z.infer<typeof PairRequest>;
 declare const ClaimRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
@@ -2340,7 +2383,7 @@ declare const ClaimResponse: z.ZodObject<{
 }, z.core.$strict>;
 type ClaimResponse = z.infer<typeof ClaimResponse>;
 declare const HeartbeatRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     daemonVersion: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
@@ -2448,7 +2491,7 @@ declare const ResultDisposition: z.ZodEnum<{
 }>;
 type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -2476,7 +2519,7 @@ declare const ResultResponse: z.ZodObject<{
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     leases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
@@ -2542,7 +2585,7 @@ type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
 declare const FetchRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -2562,4 +2605,4 @@ declare const FetchResponse: z.ZodObject<{
 }, z.core.$strict>;
 type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkProtocolVersion, classifyCost, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };
+export { AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkProtocolVersion, classifyCost, cryptoReady, declaredVersion, effectiveOfferScope, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };

package/dist/index.js

@@ -5,6 +5,7 @@ import { z as z2 } from "zod";
 import { isIP } from "net";
 import { z } from "zod";
 var BackendClass = z.enum(["http", "process"]);
+var BACKEND_CLASSES = Object.freeze(BackendClass.options);
 var BackendCost = z.enum(["free", "metered", "subscription"]);
 var backend = (b) => Object.freeze(b);
 var BACKENDS = Object.freeze({
@@ -838,6 +839,7 @@ var DeliveredResult = z6.object({
   fallback: z6.literal(true).optional()
 }).strict();
 var SizeClass = z6.enum(["small", "medium", "large", "unbounded"]);
+var SIZE_CLASSES = Object.freeze(SizeClass.options);
 var SIZE_CLASS_LIMITS = Object.freeze({
   small: 4e3,
   medium: 64e3,
@@ -1681,7 +1683,7 @@ function mustsVerifiedBy(kind) {
 
 // src/wire.ts
 import { z as z11 } from "zod";
-var PROTOCOL_VERSION = "0";
+var PROTOCOL_VERSION = "1";
 var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
   PROTOCOL_VERSION
 ]);
@@ -2288,6 +2290,7 @@ export {
   AUDIENCES,
   Audience,
   BACKENDS,
+  BACKEND_CLASSES,
   BACKEND_IDS,
   BackendClass,
   BackendCost,
@@ -2361,6 +2364,7 @@ export {
   ResultRequest,
   ResultResponse,
   RunMetadata,
+  SIZE_CLASSES,
   SIZE_CLASS_LIMITS,
   SUCCESSION_CONTEXT,
   SUPPORTED_PROTOCOL_VERSIONS,