@byollm/protocol 0.1.0-alpha.7 → 0.1.0-alpha.71

package/dist/index.d.ts

@@ -1,5 +1,28 @@
 import { z } from 'zod';
 
+/** The full description — five sections, plus why it matters. */
+declare const ABOUT = "# About BYOLLM\n\n**What BYOLLM is**\n\nBYOLLM lets you use your own AI on websites. You install one small program on\nyour computer. Then, websites that support BYOLLM can use the AI you already\nhave \u2014 a free model running on your machine, or an AI service you already pay\nfor \u2014 instead of the website paying for AI and passing the cost to you.\n\n**Why it matters**\n\nFor you:\n\n- Your favorite model, everywhere you go.\n- New models the moment you get them \u2013 not when a site gets around to adding\n  them.\n- Encrypted end-to-end. Your prompts go to your own device; byollm.cloud can't\n  read them.\n- Sites never learn which model you use, and your subscriptions are never\n  shared.\n- Pay less. Sites that don't pay for AI can charge you less \u2013 or nothing.\n\nFor sites and developers:\n\n- Zero AI bills. Your users bring their own compute.\n- No floating money \u2013 you don't pay LLM bills up front and hope to collect\n  later, and you never ask people to prepay just to try you.\n- Free trials that cost you nothing to offer.\n- Ship the AI features you kept private for fear of the API bill.\n- One small integration. Your users choose the models.\n\n**Your device**\n\nThe `byollm` program runs on your computer. It knows which AI services you have\nset up: free open-source models on your machine, metered services you pay per\nuse, or your own subscriptions like Claude Pro/Max. When a website you have\nenabled sends work, your device runs it with the service you chose. Your\nprompts are encrypted end-to-end to your own device. byollm.cloud passes them\nalong and cannot read them.\n\n**Sites**\n\nA website that wants to use BYOLLM says what it needs \u2014 \"writing help,\" \"chat,\"\nand so on. When you connect the site, you pick which of your services answers\neach one. The site never learns which model you use. You can turn a site off at\nany time, and it stops getting your work.\n\n**Teams (optional)**\n\nA team lets you share what runs on your devices with people you name \u2014 the free\nopen-source models on your machine, or a metered service with a spending limit\nyou set. Your subscription accounts (like Claude Pro/Max) are never shared with\nanyone. That is a rule, not a setting.\n\n**byollm.cloud (or your own relay)**\n\nMany sites, many devices, many people. byollm.cloud keeps track of who has\nallowed what and sends each job to the right device. It never sees your\nprompts. If you would rather run this part yourself, the relay is open source \u2014\nyou can run your own instead of using byollm.cloud.";
+/**
+ * The first paragraph, which stands alone.
+ *
+ * What the welcome screen shows: somebody deciding whether to trust a site's
+ * button needs the whole idea in one breath, not a page.
+ */
+declare const ABOUT_SHORT_LEDE = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.";
+/** The rest, for surfaces with room. Shown before "Learn more →". */
+declare const ABOUT_SHORT_TAIL = "Sites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
+/** Both halves, for a surface that wants the paragraph entire. */
+declare const ABOUT_SHORT = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.\n\nSites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
+
+/**
+ * Its members, for anything that has to report what it accepts.
+ *
+ * Derived from the enum for the reason `JOB_KINDS` and `OFFER_SCOPES` are: a
+ * second list of the same words is a second thing to keep in step, and this
+ * one is read by the promotion gate to compare a deployed hub against a
+ * version about to be promoted.
+ */
+declare const BACKEND_CLASSES: readonly ("http" | "process")[];
 /**
  * How a backend reaches its model — the taxonomy introduced in byollm_001
  * Rev 1 §A, because the two classes have different threat surfaces.
@@ -22,9 +45,9 @@ type BackendClass = z.infer<typeof BackendClass>;
  *
  * This replaced a two-valued `account` field that conflated two unrelated
  * constraints and, in doing so, left a hole: `openai-http` was "open", but it
- * accepts an API key, so an owner could point it at a paid endpoint, offer it
- * `public`, and donate their credit balance to strangers. The community
- * budgets cap job *count*, not spend.
+ * accepts an API key, so an owner could point it at a paid endpoint, share it,
+ * and donate their credit balance to strangers. The community budgets cap job
+ * *count*, not spend.
  *
  * - `free` — local compute. Costs electricity, not money. Shareable.
  * - `metered` — per-token billing against the owner's account. Legal to
@@ -104,11 +127,23 @@ declare const BACKENDS: Readonly<{
     readonly mistral: BackendDescriptor;
     readonly "openai-http": BackendDescriptor;
     readonly "claude-cli": BackendDescriptor;
+    /**
+     * OpenAI's Codex CLI, on a ChatGPT plan — byollm_016 stage 3.
+     *
+     * `subscription`, so `SUBSCRIPTION_SELF_LOCK` pins it to its owner's own
+     * work whatever the config says. That is load-bearing here in a way it is
+     * not for `claude-cli`: Codex is an *agent*, and its default feature set
+     * includes a shell tool, browser control and computer use. The daemon
+     * disables every one of them, verified against the shipped binary rather
+     * than assumed — see `codex-cli.ts` — but the self-lock is the floor under
+     * that verification rather than a duplicate of it.
+     */
+    readonly "codex-cli": BackendDescriptor;
 }>;
 /** The id of a registered backend. */
 type BackendId = keyof typeof BACKENDS;
 /** All registered backend ids — the adversarial coverage check iterates this. */
-declare const BACKEND_IDS: readonly ("ollama" | "mlx" | "llamacpp" | "vllm" | "lmstudio" | "jan" | "localai" | "anthropic" | "openai" | "gemini" | "grok" | "groq" | "openrouter" | "together" | "deepseek" | "mistral" | "openai-http" | "claude-cli")[];
+declare const BACKEND_IDS: readonly ("ollama" | "mlx" | "llamacpp" | "vllm" | "lmstudio" | "jan" | "localai" | "anthropic" | "openai" | "gemini" | "grok" | "groq" | "openrouter" | "together" | "deepseek" | "mistral" | "openai-http" | "claude-cli" | "codex-cli")[];
 declare const BackendIdSchema: z.ZodEnum<{
     ollama: "ollama";
     mlx: "mlx";
@@ -128,6 +163,7 @@ declare const BackendIdSchema: z.ZodEnum<{
     mistral: "mistral";
     "openai-http": "openai-http";
     "claude-cli": "claude-cli";
+    "codex-cli": "codex-cli";
 }>;
 /** Narrow an arbitrary string to a registered backend id. */
 declare function isBackendId(value: string): value is BackendId;
@@ -152,50 +188,158 @@ declare function backendDescriptor(id: BackendId): BackendDescriptor;
  * an act by the machine's owner against their own account, and the threat
  * model here is a hostile *job*, not an owner routing around a rule that
  * exists to protect them. What this catches is the accident — a remote paid
- * endpoint offered `public` because nobody thought about the bill. See
+ * endpoint offered to a team because nobody thought about the bill. See
  * `docs/security.md` §4a.
  */
 declare function isLocalHost(hostname: string): boolean;
 /**
- * The cost class of a configured backend instance.
+ * Is this model name a hosted one billed by its vendor?
+ *
+ * Ollama serves cloud models through the same local endpoint as local ones,
+ * so the address says "free" about a model somebody is being charged for. The
+ * only thing that distinguishes them is the name, and the distinguishing part
+ * is the **tag** — everything after the last colon.
+ *
+ * End-anchored on the tag, which is what makes it decidable rather than a
+ * guess about substrings:
+ *
+ * - `glm-5.2:cloud` → cloud
+ * - `deepseek-v4-flash:0731-cloud` → cloud
+ * - `x:cloudless` → not cloud, the tag ends in "less"
+ * - `cloudmodel:7b` → not cloud, the tag is "7b"
+ * - `llama3.2` → not cloud, there is no tag at all
+ *
+ * An oddball like `:xcloud` classifies as cloud, and that is the **only
+ * permitted failure direction**: calling a free model metered narrows what an
+ * owner may share and costs nobody money, while the reverse hands somebody
+ * else's bill to a stranger.
+ */
+declare function isCloudTaggedModel(model: string): boolean;
+/**
+ * The cost class of a configured service.
  *
  * For every named provider this is whatever the registry says, full stop
  * ({@link MUSTS.COST_NOT_CONFIGURABLE}). For the generic `openai-http` entry
  * it is inferred from the base URL, and a base URL that cannot be parsed is
  * treated as `metered` — the expensive side, because guessing "free" wrong
  * costs the owner money.
+ *
+ * The model has the last word in one direction only. A local address with a
+ * cloud-tagged model is `metered`: Ollama proxies hosted models through
+ * `127.0.0.1`, so the endpoint is local and the bill is not. Read from the
+ * **configured value**, never from what the server lists — the owner's config
+ * is the thing they chose, and a server's catalogue is not theirs to be
+ * classified by.
+ */
+declare function resolveCost(id: BackendId, baseUrl: string | undefined, 
+/**
+ * **Required, and that is the fix.**
+ *
+ * This was optional, and the no-re-derivation law was breached through the
+ * gap rather than by anybody copying the logic. `byollm offer` passed two of
+ * three arguments and `resolveConfig` passed three, so the same service was
+ * free to one and metered to the other: `glm-5.2:cloud` on a loopback
+ * address looks local until you read the tag. The command wrote a share the
+ * daemon then refused, and told its owner to run the command they had just
+ * run.
+ *
+ * A shared rule's signature admits no partial askers. `undefined` is still a
+ * legal *value* — a service genuinely without a model — but it has to be
+ * passed, so choosing to omit the model is a decision at the call site
+ * rather than a default nobody notices.
  */
-declare function resolveCost(id: BackendId, baseUrl: string | undefined): BackendCost;
+model: string | undefined): BackendCost;
+/**
+ * Why a service costs what it costs — the same decision, said out loud.
+ *
+ * Consent has to name the rule that fired. The offer ceremony read
+ * "Any OpenAI-compatible server ... bills your account per token", which is
+ * false about the type — an owner's local qwen is `openai-http` and costs
+ * nothing but electricity — and so it gave a reason that its reader could
+ * check and find wrong. The thing that bills is the `:cloud` tag on one
+ * model, not the transport that carries it.
+ *
+ * One function decides and one function explains, and the second calls the
+ * first, so a message can never describe a classification the code did not
+ * make. Splitting them would be the same defect this signature was just
+ * hardened against, arriving as prose.
+ */
+/**
+ * The product's name alone, without the parenthetical that classifies it.
+ *
+ * Every label in this registry does two jobs: it names a product and says what
+ * that product means for the person paying — "Claude CLI (your subscription)",
+ * "Ollama (local)". That is right for a list, where the parenthetical is the
+ * only classification on screen.
+ *
+ * It is wrong inside a sentence that states the classification itself, which
+ * then stutters: "my-claude runs on Claude CLI (your subscription), a
+ * subscription whose terms…". Prose wants the name; the sentence around it is
+ * already carrying the meaning.
+ *
+ * One definition rather than a regex at each call site — and the place to
+ * change if the registry ever splits the two facts into two fields, which is
+ * the better shape and not worth a migration today.
+ */
+declare function backendName(id: BackendId): string;
+interface CostReason {
+    readonly cost: BackendCost;
+    /** The rule, in the words a person consenting needs. */
+    readonly because: string;
+}
+declare function classifyCost(id: BackendId, baseUrl: string | undefined, model: string | undefined): CostReason;
 
 /**
  * Who may run a job, declared by the app that enqueued it.
  *
- * - `self` — only the job owner's own daemon.
- * - `named` — a daemon whose owner has explicitly allowed this (server, user)
- *   pair in their *local* allowlist (byollm_001 Rev 1 §B).
- * - `public` — any daemon offering `public` compute.
+ * - `private` — only the job owner's own devices.
+ * - `team` — a device whose owner admits this person.
+ *
+ * **One vocabulary, ruled 2026-08-24.** These were `self | named | public`
+ * while {@link OfferScope} used different words for the same idea, which would
+ * have left every seam where the two meet speaking two languages, and every
+ * doc explaining "self versus private" for ever. They are still independent
+ * axes — a job says who may run it, a service says who it will run for — and a
+ * job runs only where both agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}).
+ *
+ * **`public` is gone, ruled 2026-08-26 (byollm_016).** Not deprecated,
+ * removed, and removed from the OSS daemon too rather than parked as a
+ * community posture. The argument was a measurement rather than a preference:
+ * device-side admission had never once been exercised end to end, because
+ * every cross-user test ran against a publicly offered service and
+ * {@link matchAudience} returned ALLOWED for those *without consulting the
+ * device at all*. `public` was the off switch for admission, and an enum with
+ * a value that skips verification is a fail-open waiting for the wiring bug
+ * that reaches it. There is now no such value.
  */
 declare const Audience: z.ZodEnum<{
-    self: "self";
-    named: "named";
-    public: "public";
+    private: "private";
+    team: "team";
 }>;
 type Audience = z.infer<typeof Audience>;
 /**
- * What a daemon backend is willing to run, declared by the machine's owner.
- * Same three values as {@link Audience}, but the two are independent axes —
- * a job runs only where both agree ({@link MUSTS.AUDIENCE_BOTH_SIDES}).
+ * What a device's owner is willing to run for other people, per service.
+ *
+ * - `private` — the owner's own work only.
+ * - `team` — whoever the owner's authority admits. Membership is **central**,
+ *   not per-person: the device follows what it is told by a signature it can
+ *   check, rather than holding its own copy of who is in it (byollm_016).
+ *
+ * Two values, and no third that means "everyone". See {@link Audience} for
+ * why `public` was removed rather than parked, and note the shape of the
+ * remaining enum: **every value left requires the device to verify
+ * something.** `private` checks the owner; `team` checks admission. That is
+ * the property, not an accident of there being two.
  */
 declare const OfferScope: z.ZodEnum<{
-    self: "self";
-    named: "named";
-    public: "public";
+    private: "private";
+    team: "team";
 }>;
 type OfferScope = z.infer<typeof OfferScope>;
 /** All audience values, in widening order. */
-declare const AUDIENCES: readonly ("self" | "named" | "public")[];
+declare const AUDIENCES: readonly ("private" | "team")[];
 /** All offer scopes, in widening order. */
-declare const OFFER_SCOPES: readonly ("self" | "named" | "public")[];
+declare const OFFER_SCOPES: readonly ("private" | "team")[];
 /**
  * Why a job was refused. Distinct codes because byollm_002 requires that
  * different truths never share a message — "no matching work" and "refused on
@@ -234,9 +378,9 @@ interface SpendConsent {
  * its matcher call, so no code path can observe a scope wider than the cost
  * class allows:
  *
- * - `subscription` is locked to `self` regardless of config
+ * - `subscription` is locked to `private` regardless of config
  *   ({@link MUSTS.SUBSCRIPTION_SELF_LOCK}) — someone else's terms.
- * - `metered` narrows to `self` unless the owner has explicitly acknowledged
+ * - `metered` narrows to `private` unless the owner has explicitly acknowledged
  *   the spend ({@link MUSTS.METERED_DEFAULTS_SELF}) — their money.
  * - `free` passes through — their electricity.
  *
@@ -252,7 +396,8 @@ interface MatchJob {
     readonly audience: Audience;
     /**
      * Optional server-side restriction on which runner owners may take a
-     * `named` job. Defence in depth only — the daemon's local allowlist is the
+     * `team` job. Defence in depth only, and direct-mode only — it never
+     * reaches a daemon (cloud_008 §0.2), so the device's own admission is the
      * enforcing side ({@link MUSTS.NAMED_LOCAL_ALLOWLIST}).
      */
     readonly audienceAllow?: readonly string[] | undefined;
@@ -268,13 +413,24 @@ interface MatchDaemon {
     /** What the owner agreed to spend on others, for a `metered` backend. */
     readonly spend?: SpendConsent | undefined;
     /**
-     * Does this daemon's *local* allowlist admit the given owner for the server
-     * origin the job came from? Supplied as a predicate so the protocol package
-     * stays free of file I/O; the daemon passes its allowlist, the server
-     * passes a conservative `() => true` because it cannot know a remote
-     * daemon's local list and must not pretend to.
+     * Has something **this device verified** admitted the job's owner?
+     *
+     * A predicate rather than a value so the protocol package stays free of
+     * both file I/O and signature state. What supplies it has changed twice and
+     * will change again — a local allowlist, then a held roster, and now a
+     * claim-time signed grant (Amendment J) — and the law it feeds has not
+     * changed at all: a `team` service runs a stranger's work only when
+     * somebody this device can check said so.
+     *
+     * The server passes a conservative `() => true`: it cannot know what a
+     * remote device verified and must not pretend to. The device is the
+     * enforcing side, which is the whole point of asking here.
+     *
+     * Named for the question, not for where the answer lives. This was called
+     * `locallyAllows`, and "locally" stopped being true the moment the answer
+     * came from a document somebody else signed.
      */
-    readonly locallyAllows: (owner: string) => boolean;
+    readonly admits: (owner: string) => boolean;
 }
 /**
  * Decide whether a job may run on a daemon.
@@ -283,20 +439,20 @@ interface MatchDaemon {
  * 1. the job's audience must admit the daemon's owner, and
  * 2. the backend's offer scope must admit the job's owner.
  *
- * The full nine-way matrix (three audiences × three offer scopes) is asserted
- * by the conformance kit. The function is pure and total so both the daemon
+ * The full four-way matrix (two audiences × two offer scopes) is asserted by
+ * the conformance kit. The function is pure and total so both the daemon
  * and the server can run the identical rule — the daemon refuses, and the
  * server refuses too (byollm_003 §Server-side MUSTs).
  *
  * @example
  * ```ts
  * const result = matchAudience(
- *   { owner: "alice", audience: "named" },
+ *   { owner: "alice", audience: "team" },
  *   {
  *     owner: "bob",
- *     offerScope: "named",
+ *     offerScope: "team",
  *     cost: "free",
- *     locallyAllows: (o) => o === "alice",
+ *     admits: (o) => o === "alice",
  *   },
  * );
  * // result.ok === true
@@ -314,9 +470,16 @@ declare const REFUSAL_MESSAGES: Readonly<Record<MatchRefusal, string>>;
  * Upper bounds on payload size, enforced at the schema so oversized input is
  * refused at parse time rather than somewhere deeper.
  *
- * byollm_004 §4 requires stricter limits for community (`named`/`public`)
- * jobs; those are applied on top of these by the daemon's budget check, which
- * knows the job's audience. These are the absolute ceilings for any job.
+ * All three are enforced — cloud_008 Tier 4, finding 30. `maxTotalChars` was
+ * declared here and referenced nowhere, under this docstring's claim that the
+ * schema enforces them, so a chat payload of 256 messages at a million
+ * characters each parsed cleanly at sixty-four times the stated ceiling. The
+ * per-field limits were real and the aggregate one was a number in a frozen
+ * object.
+ *
+ * byollm_004 §4 requires stricter limits for community (`team`) jobs; those
+ * are applied on top of these by the daemon's budget check, which knows the
+ * job's audience. These are the absolute ceilings for any job.
  */
 declare const PAYLOAD_LIMITS: Readonly<{
     /** Max characters in any single text field. */
@@ -337,7 +500,7 @@ declare const ChatMessage: z.ZodObject<{
         assistant: "assistant";
     }>;
     content: z.ZodString;
-}, z.core.$strip>;
+}, z.core.$strict>;
 type ChatMessage = z.infer<typeof ChatMessage>;
 /**
  * Payload for `llm.generate`.
@@ -364,7 +527,7 @@ declare const ChatPayload: z.ZodObject<{
             assistant: "assistant";
         }>;
         content: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     system: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 type ChatPayload = z.infer<typeof ChatPayload>;
@@ -391,7 +554,7 @@ declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
         prompt: z.ZodString;
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
-}, z.core.$strip>, z.ZodObject<{
+}, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"llm.chat">;
     payload: z.ZodObject<{
         messages: z.ZodArray<z.ZodObject<{
@@ -401,10 +564,10 @@ declare const KindedPayload: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 assistant: "assistant";
             }>;
             content: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$strict>>;
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
-}, z.core.$strip>], "kind">;
+}, z.core.$strict>], "kind">;
 type KindedPayload = z.infer<typeof KindedPayload>;
 /** The payload type for a given kind. */
 type PayloadFor<K extends JobKind> = K extends "llm.generate" ? GeneratePayload : ChatPayload;
@@ -433,11 +596,11 @@ declare function payloadTextLength(kinded: KindedPayload): number;
 declare const JobState: z.ZodEnum<{
     ok: "ok";
     error: "error";
+    expired: "expired";
     queued: "queued";
     claimed: "claimed";
     running: "running";
     canceled: "canceled";
-    expired: "expired";
 }>;
 type JobState = z.infer<typeof JobState>;
 /** States from which a job never moves again. */
@@ -451,7 +614,7 @@ declare const Lease: z.ZodObject<{
     id: z.ZodString;
     runnerId: z.ZodString;
     expiresAt: z.ZodNumber;
-}, z.core.$strip>;
+}, z.core.$strict>;
 type Lease = z.infer<typeof Lease>;
 /** Payload union as it appears on a job record. */
 declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
@@ -465,7 +628,7 @@ declare const JobPayload: z.ZodUnion<readonly [z.ZodObject<{
             assistant: "assistant";
         }>;
         content: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     system: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>]>;
 type JobPayload = z.infer<typeof JobPayload>;
@@ -494,35 +657,34 @@ declare const ClaimedJob: z.ZodObject<{
                 assistant: "assistant";
             }>;
             content: z.ZodString;
-        }, z.core.$strip>>;
+        }, z.core.$strict>>;
         system: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>]>;
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
+        private: "private";
+        team: "team";
     }>;
     owner: z.ZodString;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    site: z.ZodOptional<z.ZodString>;
+    service: z.ZodOptional<z.ZodString>;
     lease: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
 }, z.core.$strict>;
 type ClaimedJob = z.infer<typeof ClaimedJob>;
 /**
  * The provenance that travels with every result to the delivery seam.
  *
- * byollm_003 Rev 1: a `named`/`public` result is attacker-controlled text.
+ * byollm_003 Rev 1: a `team` result is attacker-controlled text.
  * The app must never render volunteer output as its own AI's answer without
- * knowing that is what it is ({@link MUSTS.RESULT_PROVENANCE}).
+ * knowing that is what it is ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
  */
 declare const ResultProvenance: z.ZodObject<{
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
+        private: "private";
+        team: "team";
     }>;
     runnerId: z.ZodString;
     runnerOwner: z.ZodString;
@@ -545,6 +707,30 @@ declare function provenanceFor(input: {
     backendClass: BackendClass;
     model: string;
 }): ResultProvenance;
+/**
+ * What the daemon did, sealed with the answer — cloud_008 §2.5.
+ *
+ * These travelled in the clear on `ResultRequest`, which meant two things at
+ * once. On the direct plane the site believed unauthenticated fields beside
+ * an authenticated envelope — a daemon could seal one answer and *declare* it
+ * came from a different model, and only the field it did not sign would be
+ * recorded. Through a relay they reached a third party that acts on none of
+ * them, and `model` in particular is the kind of detail Amendment A's rule
+ * keeps off the wire.
+ *
+ * Sealed, they are the daemon's signed statement about its own run: the site
+ * opens them, nothing in between sees them, and the disposition check that
+ * already compares clear-text against ciphertext extends to cover them.
+ */
+declare const RunMetadata: z.ZodObject<{
+    model: z.ZodString;
+    backendClass: z.ZodEnum<{
+        http: "http";
+        process: "process";
+    }>;
+    durationMs: z.ZodNumber;
+}, z.core.$strict>;
+type RunMetadata = z.infer<typeof RunMetadata>;
 /** Successful outcome. */
 declare const JobResultOk: z.ZodObject<{
     outcome: z.ZodLiteral<"ok">;
@@ -575,17 +761,98 @@ declare const JobOutcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
     outcome: z.ZodLiteral<"canceled">;
 }, z.core.$strict>], "outcome">;
 type JobOutcome = z.infer<typeof JobOutcome>;
+/**
+ * Why a job can never run — byollm_016 Phase B.
+ *
+ * Every one of these is **terminal**, and that is the whole point of naming
+ * them. A job that cannot be matched used to sit queued until its deadline,
+ * which reads exactly like a job that is merely waiting for a device to come
+ * online — so an app could not tell "any moment now" from "never", and neither
+ * could the person watching a spinner. Silence must never read as pending.
+ *
+ * They are decided by whoever knows first: the site's own SDK where it can see
+ * the answer without asking, the router where matching happens, and the daemon
+ * again on arrival under the both-sides rule. All three reason from the same
+ * list rather than three private vocabularies.
+ */
+declare const RefusalReason: z.ZodEnum<{
+    "default-ambiguity": "default-ambiguity";
+    "default-unusable": "default-unusable";
+}>;
+type RefusalReason = z.infer<typeof RefusalReason>;
+/**
+ * A terminal outcome nobody sealed — byollm_016 Phase B.
+ *
+ * Every other finished job carries an envelope encrypted by the device that
+ * ran it, which is what makes a result unforgeable. These have no device: the
+ * job was refused *before* anything could run it, so there is nobody to seal
+ * from and no content to seal.
+ *
+ * **What that costs, stated plainly.** This is the one terminal outcome a
+ * router can author. It is worth being exact about the power that grants,
+ * because "the relay can write this" sounds alarming until you compare it with
+ * what a relay could already do: drop the job, never offer it, and let it
+ * expire. A router-authored refusal is *denial of service by a shorter route*,
+ * which is a power the router has always had and which the trust model has
+ * always said it has. What it emphatically is **not** is forgery: this shape
+ * carries no envelope and no output, so it can never be mistaken for an answer
+ * a device produced. A relay still cannot fabricate a result, because that
+ * needs a signature it does not hold.
+ *
+ * So the rule this shape enforces by construction: a refusal may deny, and may
+ * never assert. Anything that claims work was *done* still comes sealed.
+ */
+declare const JobRefused: z.ZodObject<{
+    outcome: z.ZodLiteral<"refused">;
+    reason: z.ZodEnum<{
+        "default-ambiguity": "default-ambiguity";
+        "default-unusable": "default-unusable";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>;
+type JobRefused = z.infer<typeof JobRefused>;
+/**
+ * The plaintext inside a result envelope.
+ *
+ * The outcome and how it was produced, together, because they are one
+ * statement by one signer. A site that opened only the outcome would be
+ * trusting the envelope for the answer and the request body for everything
+ * about it.
+ */
+declare const SealedOutcome: z.ZodObject<{
+    outcome: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        outcome: z.ZodLiteral<"ok">;
+        text: z.ZodString;
+        artifactUrl: z.ZodOptional<z.ZodURL>;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"error">;
+        code: z.ZodString;
+        message: z.ZodString;
+        retryable: z.ZodBoolean;
+    }, z.core.$strict>, z.ZodObject<{
+        outcome: z.ZodLiteral<"canceled">;
+    }, z.core.$strict>], "outcome">;
+    ran: z.ZodObject<{
+        model: z.ZodString;
+        backendClass: z.ZodEnum<{
+            http: "http";
+            process: "process";
+        }>;
+        durationMs: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+type SealedOutcome = z.infer<typeof SealedOutcome>;
 /** A completed job as delivered to the app, provenance attached. */
 declare const DeliveredResult: z.ZodObject<{
     jobId: z.ZodString;
     state: z.ZodEnum<{
         ok: "ok";
         error: "error";
+        expired: "expired";
         queued: "queued";
         claimed: "claimed";
         running: "running";
         canceled: "canceled";
-        expired: "expired";
     }>;
     outcome: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
         outcome: z.ZodLiteral<"ok">;
@@ -601,9 +868,8 @@ declare const DeliveredResult: z.ZodObject<{
     }, z.core.$strict>], "outcome">>;
     provenance: z.ZodOptional<z.ZodObject<{
         audience: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
         runnerId: z.ZodString;
         runnerOwner: z.ZodString;
@@ -614,8 +880,11 @@ declare const DeliveredResult: z.ZodObject<{
         model: z.ZodString;
         untrusted: z.ZodBoolean;
     }, z.core.$strict>>;
+    fallback: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 type DeliveredResult = z.infer<typeof DeliveredResult>;
+/** Its members, derived — see {@link BACKEND_CLASSES} for why. */
+declare const SIZE_CLASSES: readonly ("small" | "medium" | "large" | "unbounded")[];
 /**
  * How big a payload is, in buckets — byollm_009 §6.
  *
@@ -625,6 +894,16 @@ type DeliveredResult = z.infer<typeof DeliveredResult>;
  * bucket survives compression and encoding changes that an exact count does
  * not.
  *
+ * **Two grains, on purpose — ratified 2026-08-28.** Metering a
+ * GB-denominated plan needs real totals, and this is deliberately not where
+ * they come from: exact bytes exist only as increment-only *monthly*
+ * aggregates, and no per-job byte figure is ever persisted anywhere. The
+ * record needs vagueness and the meter needs totals; neither borrows the
+ * other's grain, which is why the consent screen's "roughly how big" stays
+ * exactly true of everything retained about a job. If you are here because
+ * you need a number, the aggregate is the one to reach for — adding a byte
+ * count to this envelope would trade a promise for a convenience.
+ *
  * `unbounded` exists for streamed jobs, which have no size when they start.
  * It is reserved now rather than added later: byollm_009 §8.1 — adding a
  * field to a published envelope is the v2 break all over again.
@@ -636,6 +915,41 @@ declare const SizeClass: z.ZodEnum<{
     unbounded: "unbounded";
 }>;
 type SizeClass = z.infer<typeof SizeClass>;
+/**
+ * The most one envelope may be, in bytes — ratified 2026-08-28.
+ *
+ * A **relay-memory safety rail**, not a plan feature: every tier has the same
+ * ceiling, and differentiating tiers on it would be selling a safety limit as
+ * a benefit. What it bounds is any single job, so no one message can make the
+ * relay hold an unbounded amount of somebody else's memory.
+ *
+ * ## It stores nothing, and that is the design
+ *
+ * Enforced at ingress by refusing before acceptance, in both directions. A
+ * ceiling on what the relay already has in hand needs no schema and no record:
+ * the size is known for the length of the check and then it is gone. This
+ * matters because the alternative — recording a size to enforce a limit
+ * against — is precisely the per-job byte figure the metering ruling exists to
+ * not have.
+ *
+ * ## Measured on the serialised envelope
+ *
+ * The same quantity the monthly rollup counts, deliberately. The relay stores
+ * the serialised envelope and the meter measures what it stored, so a cap on
+ * anything else — the ciphertext alone, the decoded length — would mean the
+ * limit and the bill disagreed about what a byte is, and a job could be small
+ * enough to accept and larger than it was charged as.
+ */
+declare const MAX_ENVELOPE_BYTES: number;
+/**
+ * How big an envelope is, by the one measure that counts it.
+ *
+ * `JSON.stringify` because that is what the store persists and therefore what
+ * the meter measures. Length in UTF-16 code units rather than encoded bytes:
+ * it is the same number the store's own `HSTRLEN` reports, and the point of
+ * this function is that one number answers both questions.
+ */
+declare function envelopeBytes(envelope: unknown): number;
 /** Where the bucket boundaries sit, in characters of payload text. */
 declare const SIZE_CLASS_LIMITS: Readonly<{
     small: 4000;
@@ -677,12 +991,12 @@ declare const JobStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
+        private: "private";
+        team: "team";
     }>;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    purpose: z.ZodOptional<z.ZodString>;
     sizeClass: z.ZodEnum<{
         small: "small";
         medium: "medium";
@@ -693,7 +1007,23 @@ declare const JobStub: z.ZodObject<{
     deadlineAt: z.ZodNumber;
 }, z.core.$strict>;
 type JobStub = z.infer<typeof JobStub>;
-/** A stub, plus the lease the claiming runner now holds for it. */
+/**
+ * A stub, plus the lease the claiming runner now holds for it — and, on a
+ * relayed route, the grant that says it may run at all.
+ *
+ * The grant lives here rather than on {@link JobStub} because of *when* it is
+ * authored. A stub exists from enqueue; a grant is written at claim, against
+ * the membership and mapping true at that moment. That timing is the whole of
+ * Amendment J: a job queued yesterday for somebody removed this morning gets
+ * no grant when it is finally claimed, and a roster held on the device could
+ * never have known.
+ *
+ * Optional, and the absence is meaningful rather than lenient. A device that
+ * pinned a control-plane key at pairing **requires** one — a claimed job
+ * arriving without it is refused, not admitted by default. A device that
+ * pinned none is in direct mode, where there is no control plane to author
+ * anything and the owner's own work is the only work that runs.
+ */
 declare const ClaimedStub: z.ZodObject<{
     id: z.ZodString;
     kind: z.ZodEnum<{
@@ -701,12 +1031,12 @@ declare const ClaimedStub: z.ZodObject<{
         "llm.chat": "llm.chat";
     }>;
     owner: z.ZodString;
+    site: z.ZodString;
     audience: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
+        private: "private";
+        team: "team";
     }>;
-    audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    purpose: z.ZodOptional<z.ZodString>;
     sizeClass: z.ZodEnum<{
         small: "small";
         medium: "medium";
@@ -719,7 +1049,19 @@ declare const ClaimedStub: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
         expiresAt: z.ZodNumber;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
+    grant: z.ZodOptional<z.ZodObject<{
+        grantId: z.ZodString;
+        jobId: z.ZodString;
+        site: z.ZodString;
+        user: z.ZodString;
+        owner: z.ZodString;
+        purpose: z.ZodString;
+        kind: z.ZodString;
+        service: z.ZodString;
+        issuedAt: z.ZodNumber;
+        signature: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 type ClaimedStub = z.infer<typeof ClaimedStub>;
 
@@ -763,6 +1105,18 @@ declare const StoredKeys: z.ZodObject<{
     createdAt: z.ZodNumber;
 }, z.core.$strict>;
 type StoredKeys = z.infer<typeof StoredKeys>;
+/** Domain separator, so a signature over an encryption key cannot be
+ * replayed as a signature over anything else. */
+/**
+ * What an encryption key's signature covers.
+ *
+ * Exported because a rotation is a real event this protocol has to be able to
+ * *test* — a record whose encryption key moved under an identity that signed
+ * the move is the one case pinning must refuse loudly, and building one
+ * outside this file otherwise means re-typing this string, which is how two
+ * copies of a constant start disagreeing.
+ */
+declare const ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
 /** Generate a fresh pair of keypairs and bind them together. */
 declare function generateKeys(now: number): StoredKeys;
 /** The public half, for the wire. */
@@ -777,7 +1131,17 @@ declare function publicIdentityOf(keys: StoredKeys): PublicIdentity;
  */
 declare function verifyPublicIdentity(identity: PublicIdentity): boolean;
 /** Sign arbitrary bytes with an identity key. */
-declare function signWith(keys: StoredKeys, data: Uint8Array): string;
+/**
+ * Sign bytes with an identity key.
+ *
+ * Takes only the private half it uses. A signer that demanded a whole
+ * {@link StoredKeys} would make every caller hold an encryption keypair for a
+ * job that has no encryption in it — and the control plane, which signs
+ * rosters and opens nothing, would be generating and storing secret material
+ * it can never need. Every existing caller passes a full `StoredKeys`, which
+ * satisfies this.
+ */
+declare function signWith(keys: Pick<StoredKeys, "identityPrivate">, data: Uint8Array): string;
 /** Verify bytes against a raw Ed25519 public key. */
 declare function verifyWith(identityPublic: string, data: Uint8Array, signature: string): boolean;
 /**
@@ -946,7 +1310,77 @@ declare function signRequest(keys: StoredKeys, input: {
     issuedAt: number;
     body: string;
 }): RequestSignature;
-/** Why a signed request was refused. Never returned to the caller verbatim. */
+/**
+ * The same scheme, for the party at the other end: a **site** calling a relay.
+ *
+ * A site talking to a relay is in exactly the daemon's position — an outbound
+ * caller with an identity keypair the other side already pins — so it gets the
+ * daemon's authentication rather than a second scheme. Bearer tokens for the
+ * site plane were the alternative, and they would have reintroduced the
+ * credential-in-a-file that §4.2 removed from the daemon plane, on the plane
+ * that carries *every* site's traffic.
+ *
+ * Two things make this safe to build on the same canonical string:
+ *
+ * 1. **The endpoint is namespaced.** Site endpoints sign `site/enqueue`, never
+ *    `enqueue`. The daemon plane's `result` and the site plane's `results` are
+ *    one character apart, and a naming collision between planes must not be
+ *    what stands between a signature and a replay onto the wrong handler. The
+ *    prefix is applied *inside* these helpers, so the two ends cannot disagree
+ *    about it — the alternative is two implementations of one bound value,
+ *    which is this project's most-repeated bug.
+ * 2. **The caller slot carries the site id.** `canonicalRequest` names that
+ *    field `runnerId` because the daemon plane got there first; here it holds
+ *    the site id, and the verifier looks the key up in the projection's site
+ *    registry rather than its device registry. The two registries never share
+ *    an entry, so a device signature cannot authenticate as a site.
+ *
+ * §4.2's replay argument carries over **only because the site plane's writes
+ * are idempotent per addressed instance**, which is a property that had to be
+ * built rather than found: `enqueue` reset a job of the same id, so a replayed
+ * enqueue inside the freshness window returned a claimed job to the queue and
+ * threw away a device's live lease. Identical in shape to the `release` bug
+ * above, on the other plane. Anything added to the site plane later must be
+ * idempotent by the instance it names, or this scheme does not cover it.
+ */
+declare function signSiteRequest(keys: StoredKeys, input: {
+    endpoint: string;
+    siteId: string;
+    issuedAt: number;
+    body: string;
+}): RequestSignature;
+/** Verify a site's call against the identity the control plane registered. */
+declare function verifySiteRequest(input: {
+    identityPublic: string;
+    endpoint: string;
+    body: string;
+    signature: RequestSignature;
+    now: number;
+    maxSkewMs?: number;
+}): SignatureFailure | null;
+/**
+ * Why a signed request was refused.
+ *
+ * **`bad-signature` is never returned verbatim; `stale` is, deliberately.**
+ * They are different kinds of refusal and conflating them costs a real user
+ * more than it costs an attacker.
+ *
+ * A bad signature is an authentication failure and the server says only
+ * "unauthorized" — telling a prober which part they got wrong is free help.
+ *
+ * A stale timestamp is a **precondition** failure: the signature may be
+ * perfectly valid and the caller's clock is simply wrong. Saying so reveals
+ * nothing, for two reasons that both have to hold. The server's time is
+ * already public — every response carries a `Date` header and the heartbeat
+ * response returns `serverTime` outright. And freshness is checked *before*
+ * the signature is verified, so a stale answer says nothing about whether the
+ * signature was any good.
+ *
+ * What conflating them costs: a machine whose clock has drifted gets
+ * `401 unauthorized` on every request, forever, with nothing anywhere pointing
+ * at the clock. That is the shape byollm_013 was filed about — a refusal that
+ * is correct, silent, and sends somebody to read our source.
+ */
 type SignatureFailure = "stale" | "bad-signature";
 /**
  * Verify a signed request against a runner's pinned identity key.
@@ -964,6 +1398,399 @@ declare function verifyRequest(input: {
     maxSkewMs?: number;
 }): SignatureFailure | null;
 
+/**
+ * What a site says it needs — byollm_016 Amendment L.
+ *
+ * A site declares **purposes**, and each purpose lists the job kinds it uses.
+ * A person then maps each purpose to one of their own services, on the consent
+ * screen, and that mapping *is* the consent. The control plane joins the two
+ * at claim time and signs the result into a grant.
+ *
+ * ## Why a site declares needs instead of naming services
+ *
+ * Because it cannot name one. The site's vocabulary is its own purposes; the
+ * person's vocabulary is their services; and the two never meet. A site asks
+ * for "writing assistant, llm.chat" and learns only whether that slot is
+ * satisfiable — never which model answered, never whose machine, never even
+ * the name of the service. Key-vs-value reaches its strongest form here: the
+ * site cannot describe what it wants *or* name it, only ask for what it
+ * declared.
+ *
+ * ## Keys are ids; labels are prose
+ *
+ * They are separate fields and nothing derives one from the other, which is
+ * the amendment's ruling and worth restating where somebody will read it. A
+ * key travels on every job and is what mappings are stored against, so it is
+ * stable-or-nothing: renaming one deletes a purpose and creates another,
+ * unmapping everybody who had chosen for it. A label is changeable whenever
+ * the site likes and is the **only** thing a consent screen renders.
+ */
+/**
+ * The purpose a site gets when it declares no purposes of its own.
+ *
+ * Reserved, and refused by {@link Manifest} rather than by whatever handles
+ * registration. A site with a single undifferentiated use has one purpose —
+ * everything it does — and that purpose needs an id because mappings are
+ * keyed by one. An id taken from the site's own vocabulary would collide the
+ * day it declared a real purpose of the same name.
+ *
+ * **Never rendered.** "default → your Claude" tells a person nothing; a
+ * consent screen shows the site's own name for this slot, because that is
+ * what a single-purpose site's one purpose actually is.
+ */
+declare const RESERVED_PURPOSE = "default";
+declare const Purpose: z.ZodObject<{
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    kinds: z.ZodArray<z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>>;
+}, z.core.$strict>;
+type Purpose = z.infer<typeof Purpose>;
+/**
+ * Everything a site needs, by purpose key.
+ *
+ * At least one purpose: a site that declares none is a site that can enqueue
+ * nothing, and accepting it would mean the first refusal a person saw came
+ * from a job rather than from registration.
+ */
+/**
+ * How many purposes one site may declare.
+ *
+ * There was no bound at all: a site could declare fifty thousand, each one
+ * individually valid, and the consent screen renders a slot per (purpose,
+ * kind) — so the page that *is* the consent mechanism becomes unusable, and
+ * the notification mail that enumerates slots grows with it.
+ *
+ * Thirty-two is chosen rather than derived, and the number is an argument: a
+ * purpose is a thing a person reads and decides about one at a time, and a
+ * screen asking more than about thirty separate questions has stopped being a
+ * consent screen whatever it renders. Of Tomorrow Press declares five. A site
+ * that genuinely needs more has a product question to answer before it has a
+ * schema one.
+ */
+declare const MAX_PURPOSES = 32;
+declare const Manifest: z.ZodRecord<z.ZodString, z.ZodObject<{
+    label: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    kinds: z.ZodArray<z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>>;
+}, z.core.$strict>>;
+type Manifest = z.infer<typeof Manifest>;
+/**
+ * The manifest a site with no declared purposes is treated as having.
+ *
+ * The sugar in Amendment L, made explicit rather than special-cased
+ * downstream: everything after this point sees a manifest with one purpose,
+ * so no consent screen, mapping table or resolver needs a branch for the
+ * flat-list case.
+ *
+ * The label is the caller's — a site's own name — because it is the one thing
+ * that can make "everything this site does" read as a sentence about a
+ * particular site rather than about software in general.
+ */
+declare function singlePurposeManifest(input: {
+    readonly label: string;
+    readonly kinds: readonly JobKind[];
+}): Manifest;
+
+/**
+ * One job, one signature, one answer — byollm_016 Amendment J.
+ *
+ * A grant is the control plane's signed statement that a particular job may
+ * run on a particular device, authored at claim time and verified against the
+ * key that device pinned when it paired.
+ *
+ * ## What it replaced, and why the replacement is smaller
+ *
+ * Until 2026-08-26 a device held a signed **roster** and answered admission
+ * from it. Amendment G's four properties were right and the mechanism was a
+ * cache — one that bought nothing. On the cloud route the job path and the
+ * roster path share fate: jobs arrive through the relay, so if the relay is
+ * unreachable there are no jobs to admit and a locally held roster adds no
+ * availability. What it did add was staleness, which is the only reason
+ * `ROSTER_MAX_AGE_MS` existed: a bound on how long a removed person keeps
+ * running. Authoring at claim collapses that bound to this document's own
+ * lifetime — add somebody and their next job runs, remove them and their next
+ * claim fails, including jobs already queued.
+ *
+ * It also collapses four questions into one signature. Consented, member,
+ * admitted, and *which service* were four mechanisms answering separately;
+ * they are now four fields of one statement, and the device verifies once.
+ *
+ * ## What it is not
+ *
+ * Amendment G property 1 outlawed admitting on a per-job assertion, and this
+ * is per-job. The distinction is authorship: G outlawed trusting the
+ * **relay's or site's unsigned** claim. A grant is signed by the control
+ * plane with a key the device pinned at pairing, so the relay can withhold it
+ * and cannot forge it — exactly the power a relay has over a job.
+ * `RELAY_BLIND` is untouched: the relay delivers, it never authors.
+ *
+ * ## What the device still checks for itself
+ *
+ * A grant is necessary and not sufficient. Four checks stay on the device and
+ * none of them is delegated:
+ *
+ * 1. the signature, against the pinned key;
+ * 2. replay — {@link SignedGrant.grantId} is single-use;
+ * 3. offer-consistency — the named service is one this device actually
+ *    offers, at a scope that includes this user;
+ * 4. **private is absolute** — a `private` service runs for the paired owner
+ *    and nobody else, so no compromise of a control plane can grant somebody
+ *    else's job onto it.
+ */
+/**
+ * How long a grant is honoured after it was signed. Ruled 120s (2026-08-26).
+ *
+ * This bounds **acceptance**, not execution: a job admitted inside the window
+ * runs to completion however long it takes. So the number only has to cover
+ * the trip from the control plane signing to the device checking — claim,
+ * deliver, verify — and every second past that is a second a captured grant
+ * stays useful.
+ *
+ * Two minutes is generous for that trip and mean for the capture. It is also
+ * the number ordinary clock drift is measured against, which is why
+ * {@link CLOCK_SKEW_WARN_MS} sits well inside it: a device whose clock is off
+ * by half the window would refuse real work, and must be told before it does.
+ *
+ * The verifier's policy, deliberately not a field on the document. An
+ * `expiresAt` the signer chose would let whoever signs decide how long their
+ * own statement stays good, and the party with the most reason to want a
+ * longer window is the party being bounded.
+ */
+declare const GRANT_MAX_AGE_MS = 120000;
+/**
+ * Clock disagreement past which a device says so, before it starts refusing.
+ *
+ * Skew eats {@link GRANT_MAX_AGE_MS} directly — a device 60s behind its
+ * relay's clock has half a window left, and one 120s behind has none and
+ * refuses everything for a reason no refusal message would otherwise name.
+ * Thirty seconds is a quarter of the window: far enough out to be a real
+ * problem, early enough to be a warning rather than an outage.
+ */
+declare const CLOCK_SKEW_WARN_MS = 30000;
+/**
+ * Skew past which a freshness refusal names the clock instead of the grant.
+ *
+ * Five seconds, because below that the clock is not the story and saying so
+ * would send somebody to check ntp about an unrelated failure. Above it, "this
+ * grant expired" and "your clock is wrong" are the same event wearing
+ * different words, and only one of them can be acted on.
+ */
+declare const CLOCK_ATTRIBUTION_MS = 5000;
+/**
+ * The domain separator.
+ *
+ * Every signature in this system says what kind of statement it is before it
+ * says anything else. Without it, bytes signed for one purpose verify for
+ * another — a grant and a request are both "bytes this key signed", and a
+ * scheme that could not tell them apart would let one be replayed as the
+ * other.
+ */
+declare const GRANT_CONTEXT = "byollm/v1/grant";
+declare const SignedGrant: z.ZodObject<{
+    grantId: z.ZodString;
+    jobId: z.ZodString;
+    site: z.ZodString;
+    user: z.ZodString;
+    owner: z.ZodString;
+    purpose: z.ZodString;
+    kind: z.ZodString;
+    service: z.ZodString;
+    issuedAt: z.ZodNumber;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type SignedGrant = z.infer<typeof SignedGrant>;
+/** Everything a grant says, before it is signed. */
+type GrantClaims = Omit<SignedGrant, "signature">;
+/**
+ * Every field of {@link SignedGrant} except the signature, sorted.
+ *
+ * **Derived from the schema, never written out by hand.** The unsigned-field
+ * attack is that somebody adds a field to the document, forgets to add it to
+ * the bytes, and ships a value an intermediary can rewrite without breaking
+ * any signature. A hand-maintained list is exactly the shape that fails: it
+ * does not grow when the code does, and nothing about adding a field reminds
+ * you it exists.
+ *
+ * Reading the shape closes it structurally rather than by review. A new field
+ * is signed the moment it is declared, and grant.test.ts asserts this list
+ * still covers the schema so a future zod version that hides `shape` fails
+ * loudly instead of silently signing less.
+ */
+declare const GRANT_SIGNED_FIELDS: readonly (keyof GrantClaims)[];
+/**
+ * The exact bytes both sides sign and verify.
+ *
+ * JSON-encoded rather than joined with a separator, because a separator can
+ * be imitated. Newline-joining `["a", "b\nc"]` and `["a\nb", "c"]` produces
+ * identical bytes, so two different grants would share a signature — and the
+ * values here include a site id and a user id, at least one of which comes
+ * from somebody else's namespace. JSON escapes the separator it uses, so no
+ * arrangement of field values can spell a different document.
+ *
+ * The context string leads, and the field order is the schema's own sorted
+ * keys, so the encoding is canonical without anyone maintaining a list.
+ */
+declare function grantStatement(claims: GrantClaims): Uint8Array;
+/** Sign a grant with the control plane's own key. */
+declare function signGrant(keys: Pick<StoredKeys, "identityPrivate">, claims: GrantClaims): SignedGrant;
+/**
+ * Why a grant was refused.
+ *
+ * Split by remedy, because these send somebody to different places: fix your
+ * clock, take it up with the relay, or nothing at all — you are being
+ * attacked and the refusal worked.
+ *
+ * There is deliberately no `no-pinned-key` here. A device that pinned no
+ * control-plane key never reaches this function: it is in direct mode, and
+ * the question "is this grant good" does not arise. A value nothing can
+ * return is a branch every caller has to handle and no test can reach.
+ */
+type GrantRefusal = 
+/** The signature does not verify against the pinned key. */
+"bad-signature"
+/** Genuine, and for a different device's owner. */
+ | "wrong-owner"
+/** Genuine, and lifted from a different job. */
+ | "wrong-job"
+/** Older than {@link GRANT_MAX_AGE_MS}. */
+ | "expired"
+/**
+ * Issued further in the future than clock drift explains.
+ *
+ * Checked, and not as pedantry: an `issuedAt` ahead of now extends a
+ * grant's life past the bound, which is the whole thing being enforced.
+ *
+ * Tolerant by {@link CLOCK_SKEW_WARN_MS}, because it was tolerant by
+ * nothing and that made ordinary drift a total outage — see
+ * {@link verifyGrant}.
+ */
+ | "from-the-future";
+/**
+ * Is this grant one this device may act on, right now?
+ *
+ * Document-level checks only. Replay, offer-consistency and the private rule
+ * need state this function does not have and are the device's to apply — see
+ * the class comment for the full list of four.
+ */
+declare function verifyGrant(input: {
+    grant: SignedGrant;
+    owner: string;
+    jobId: string;
+    controlPlanePublic: string;
+    now: number;
+    maxAgeMs?: number;
+}): GrantRefusal | null;
+
+/**
+ * Rotation — byollm_009 Amendment C.
+ *
+ * A site holding identity key **K1** wants to be known by **K2**. It publishes
+ * a *succession*: K2, plus a signature by K1 over a statement naming both key
+ * ids. That signature is the entire mechanism, and the reason rotation can be
+ * automatic without becoming a hole is that **the relay cannot mint one** — it
+ * never holds K1. It is the same trust step a daemon already performs at
+ * pairing, applied to the site's own succession.
+ *
+ * ## Why the statement names both keys
+ *
+ * A signature over K2 alone could be lifted from this site's record and
+ * replayed into another site's, moving *that* site to K2 — a key the attacker
+ * holds. Naming the predecessor binds the succession to one chain, and it is
+ * the reason `verifyLink` takes the id it expects to be succeeding from
+ * rather than reading it out of the statement it is checking.
+ */
+/** The domain separator. Distinct from every other thing an identity signs. */
+declare const SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+/**
+ * How long a retired key may still sign work — Amendment C, ruling 2.
+ *
+ * A protocol constant and not the site's to choose. Per-site overlap
+ * arithmetic is exactly the kind of number that has to mean one thing
+ * everywhere, and a site that could choose it could choose *forever*, which is
+ * a two-key site permanently and a second key nobody ever notices retiring.
+ *
+ * Seven days: long enough that a daemon which polls daily and a laptop shut
+ * for a long weekend both see the new record before the old key stops working,
+ * short enough that "which key is live" is never an interesting question.
+ */
+declare const RETIREMENT_WINDOW_MS: number;
+/**
+ * The longest chain a daemon will walk — Amendment C, ruling 1.
+ *
+ * **A denial-of-service guard, not policy.** The bound exists so a projection
+ * cannot make a daemon verify ten thousand signatures, not to express an
+ * opinion about how often a site may rotate. A site that legitimately exceeds
+ * it has a re-pair ahead of it, which is why it is generous: at one rotation a
+ * quarter this is sixteen years.
+ */
+declare const MAX_SUCCESSION_CHAIN = 64;
+/** One step of a chain: a key, and the signature by it over its successor. */
+declare const Succession: z.ZodObject<{
+    identity: z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>;
+    signature: z.ZodString;
+}, z.core.$strict>;
+type Succession = z.infer<typeof Succession>;
+/** The exact bytes signed. One definition; both sides call it. */
+declare function successionStatement(fromKeyId: string, toKeyId: string): Uint8Array;
+/**
+ * Sign a succession from the keys being retired to the identity taking over.
+ *
+ * Takes `StoredKeys` for the predecessor because only the holder of K1's
+ * private half can produce this, which is the property the whole design rests
+ * on. A site calls this once, at rotation, on the machine holding its keys.
+ */
+declare function signSuccession(previous: StoredKeys, next: PublicIdentity): Succession;
+/**
+ * Check one link: did `link.identity` sign over succeeding to `toKeyId`?
+ *
+ * `toKeyId` is passed in rather than read from anywhere in `link`, and that is
+ * the load-bearing detail. A verifier that recovered the successor from the
+ * signed statement would accept a statement about *any* successor, which is
+ * the replay this design names in C.1 — the signature is genuine, the
+ * successor it names is not the one being installed.
+ */
+declare function verifyLink(link: Succession, toKeyId: string): boolean;
+/** Why a chain was refused, in the words a log line uses. */
+type SuccessionFailure = "no-chain" | "too-long" | "unknown-origin" | "broken-link";
+interface SuccessionWalk {
+    /** The ids the chain passes through, oldest first, ending at the current. */
+    readonly path: string[];
+    /** The approved id the chain reached, when it reached one. */
+    readonly from?: string;
+    readonly failure?: SuccessionFailure;
+}
+/**
+ * Walk a chain from the key being presented back to a key already approved.
+ *
+ * `chain` is ordered oldest last, as the projection carries it — so walking it
+ * means starting at the current key and stepping backwards, each link proving
+ * that its holder signed for the id in front of it.
+ *
+ * Returns the approved id it reached, or why it did not. **Deliberately
+ * returns rather than throws**: a chain that does not verify is ordinary
+ * hostile input, and the caller's job is to keep its existing pin and say so.
+ *
+ * `approved` is asked as a predicate rather than taken as a set because the
+ * daemon's notion of "already approved" includes tombstoned ids — a site that
+ * left the allowlist and came back is still a site this machine has vouched
+ * for, and rotation must not become a way to launder that distinction away.
+ */
+declare function walkSuccession(input: {
+    current: string;
+    chain: readonly Succession[];
+    approved: (keyId: string) => boolean;
+}): SuccessionWalk;
+
 /**
  * The normative MUSTs of protocol v0, as data.
  *
@@ -997,12 +1824,45 @@ type MustEnforcer = "daemon" | "server" | "both";
  *   someone else's, so the kit cannot carry it.
  * - `construction` — true by the shape of the code, where a test could only
  *   sample. A reviewer verifies it; a suite cannot.
+ * ## When a MUST binds both sides — cloud_008 Tier 3
+ *
+ * `AUDIENCE_BOTH_SIDES` says the server and the daemon each enforce. The kit
+ * passed **entirely** with the server's half deleted: every check drove a real
+ * daemon, and a daemon refuses locally, so "the job did not run" looked
+ * identical whichever side refused it. A full-honest-stack test proves only
+ * the conjunction.
+ *
+ * So a `both`-enforced MUST needs **one check per party, each with the honest
+ * counterpart removed** — C032 claims over the raw protocol precisely so no
+ * daemon admission logic runs. Where a check strips one side, its comment
+ * says which; where a MUST is enforced by both and only one side is checked,
+ * that is a gap rather than coverage.
+ *
  * - `operator` — a claim about how someone runs a deployment, verifiable only
  *   by audit or by reading source. The honest category, and the one that
  *   exists so a property nobody can check from outside is *labelled* as such
  *   rather than laundered by association with the checkable ones.
  */
 type MustVerification = "conformance" | "adversarial" | "construction" | "operator";
+/**
+ * How a MUST is verified — one kind, or several.
+ *
+ * Several is not hedging. `SITES_LOCALLY_APPROVED` is the case that forced it:
+ * the fence is **construction** — a daemon cannot serve a site that is not in
+ * its map, and admission refuses before a payload is fetched — while the
+ * property that a *removed and re-offered* id is still refused needs a hostile
+ * sequence of heartbeats no honest client would send, which is
+ * **adversarial**. Recording one and dropping the other would either overstate
+ * what a type check proves or understate what the suites do.
+ *
+ * The alternative was a second field for the second kind, which is two answers
+ * to one question — the shape this project keeps deleting.
+ */
+type MustVerifiedBy = MustVerification | readonly [MustVerification, ...MustVerification[]];
+/** The kinds a MUST claims, always as a list. */
+declare function kindsOf(must: {
+    readonly verifiedBy: MustVerifiedBy;
+}): readonly MustVerification[];
 /** A single normative requirement of the protocol. */
 interface Must {
     /** Stable public id, cited by conformance output. */
@@ -1015,7 +1875,7 @@ interface Must {
      * How this is verified. `conformance` is the only kind the kit can assert;
      * see {@link MustVerification} for why the others exist.
      */
-    readonly verifiedBy: MustVerification;
+    readonly verifiedBy: MustVerifiedBy;
     /** Spec section this was adjudicated in. */
     readonly source: string;
 }
@@ -1032,6 +1892,8 @@ declare const MUSTS: Readonly<{
     readonly PAIR_INTERACTIVE: Must;
     readonly PAIR_CODE_EXPIRES: Must;
     readonly VERSION_HANDSHAKE_REQUIRED: Must;
+    readonly SITE_KEY_BY_STUB: Must;
+    readonly SITES_LOCALLY_APPROVED: Must;
     readonly KEYS_EXCHANGED_AT_CONSENT: Must;
     readonly REQUESTS_SIGNED_NOT_BEARER: Must;
     readonly LEASE_SCOPED_BY_GRANT: Must;
@@ -1058,24 +1920,74 @@ declare const MUSTS: Readonly<{
     readonly TTL_EXPIRY: Must;
     readonly NO_RUNNER_SIGNAL: Must;
     readonly RESULT_IDEMPOTENT: Must;
-    readonly RESULT_PROVENANCE: Must;
+    readonly PROVENANCE_NAMES_DEVICE: Must;
     readonly INGRESS_LOGGED_BEFORE_EXECUTION: Must;
     readonly NO_SHELL_INTERPOLATION: Must;
+    /**
+     * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
+     *
+     * A site may now name a **service** on the stub. The temptation is to read
+     * that as a crack in this law, so the statement below says exactly where the
+     * line is: a name selects from a menu the owner published, and resolves to a
+     * model, backend, base URL and flags **only** through that owner's own
+     * config. The site supplies a key; the owner supplies every value it maps
+     * to. A name the owner does not advertise is refused rather than
+     * substituted, because substitution is how "you may pick from my list" turns
+     * into "you may ask for anything and get something".
+     *
+     * Two properties keep it from drifting into "sites demand models":
+     *
+     *   1. **Nothing the site sends is ever a value.** No model string, no URL,
+     *      no flag crosses the wire — only a key that means nothing off this
+     *      owner's machine.
+     *   2. **It is a stub field, never a payload field.** The prompt cannot
+     *      reach it. That is unchanged and is the sentence the second clause
+     *      below still enforces verbatim.
+     */
     readonly NO_PAYLOAD_ROUTING: Must;
     readonly STRIPPED_CHILD_ENV: Must;
     readonly HTTP_BASE_URL_SAFE: Must;
     readonly OUTPUT_INERT: Must;
     readonly COMMUNITY_BUDGETS: Must;
+    readonly REVOCATION_IMMEDIATE: Must;
+    readonly CONSENT_BEFORE_ROUTE: Must;
+    readonly ROSTER_NOT_DISCLOSED: Must;
+    readonly EFFECTIVE_OFFER_ONLY: Must;
+    readonly FALLBACK_LABELED: Must;
+    readonly RELAY_BLIND: Must;
+    readonly SHARED_COMPUTE_DISCLOSED: Must;
 }>;
 /** The id of any normative MUST. */
 type MustId = keyof typeof MUSTS;
 /** All MUST ids, for coverage checks. */
-declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "RESULT_PROVENANCE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS")[];
+declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_CODE_EXPIRES" | "VERSION_HANDSHAKE_REQUIRED" | "SITE_KEY_BY_STUB" | "SITES_LOCALLY_APPROVED" | "KEYS_EXCHANGED_AT_CONSENT" | "REQUESTS_SIGNED_NOT_BEARER" | "LEASE_SCOPED_BY_GRANT" | "STUB_METADATA_EXHAUSTIVE" | "ENVELOPE_SEALED_AND_SIGNED" | "KIND_TYPED_ONLY" | "KIND_NO_CODE" | "CLAIM_REQUIRES_CAPABILITY" | "CAPABILITY_IS_DETECTED" | "CLAIM_ATOMIC" | "LEASE_HONORED" | "LEASE_RECLAIMABLE" | "AUDIENCE_BOTH_SIDES" | "SUBSCRIPTION_SELF_LOCK" | "METERED_DEFAULTS_SELF" | "METERED_REQUIRES_CEILING" | "COST_NOT_CONFIGURABLE" | "REMOTE_IS_NEVER_FREE" | "NAMED_LOCAL_ALLOWLIST" | "REFUSAL_NOT_REOFFERED" | "REVOCATION_HONORED" | "CANCEL_HONORED" | "DEPENDS_ON_GATING" | "TTL_EXPIRY" | "NO_RUNNER_SIGNAL" | "RESULT_IDEMPOTENT" | "PROVENANCE_NAMES_DEVICE" | "INGRESS_LOGGED_BEFORE_EXECUTION" | "NO_SHELL_INTERPOLATION" | "NO_PAYLOAD_ROUTING" | "STRIPPED_CHILD_ENV" | "HTTP_BASE_URL_SAFE" | "OUTPUT_INERT" | "COMMUNITY_BUDGETS" | "REVOCATION_IMMEDIATE" | "CONSENT_BEFORE_ROUTE" | "ROSTER_NOT_DISCLOSED" | "EFFECTIVE_OFFER_ONLY" | "FALLBACK_LABELED" | "RELAY_BLIND" | "SHARED_COMPUTE_DISCLOSED")[];
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-/** Protocol version carried on every request; servers refuse what they can't speak. */
-declare const PROTOCOL_VERSION: "0";
+/**
+ * Protocol version carried on every request; servers refuse what they can't
+ * speak.
+ *
+ * **`1` because byollm_016 changed the vocabulary** — byollm-review
+ * 2026-08-27. `OfferScope` lost `public`, `self|named` became
+ * `private|team`, `JobStub` lost `service` and gained `purpose`, and the
+ * grant's site field changed namespace. The version stayed `0` through all of
+ * it.
+ *
+ * The consequence was the failure the handshake exists to prevent, arriving
+ * around it: a pre-rip daemon declares `0`, passes the version check, and
+ * then fails whole-body schema validation with "request failed schema
+ * validation" — no field named, no vocabulary named, no upgrade command. Once
+ * every ten seconds, forever, while its owner watches a device go stale for
+ * no stated reason. The check below was written because "a mismatch surfaced
+ * as a generic bad-request" and "an error a user cannot act on is barely
+ * better than a hang"; the number not moving is how that came back.
+ *
+ * A registry is a schema and an enum value is the contract — this project's
+ * own words, from the release that silenced a fleet by adding a backend id.
+ * The same sentence applies to removing an offer scope.
+ */
+declare const PROTOCOL_VERSION: "1";
 /**
  * Every protocol version this build can serve, **oldest first**.
  *
@@ -1083,6 +1995,16 @@ declare const PROTOCOL_VERSION: "0";
  * the check is the point: a server supporting two versions through a
  * migration should not need a different code path from one supporting one.
  */
+/**
+ * `0` is deliberately **not** here, though the list exists for exactly that.
+ *
+ * Supporting two versions through a migration is the shape this was built
+ * for, and it is the wrong tool when the vocabularies are incompatible: a `0`
+ * daemon sends `offer: "public"` and a `service` on its stubs, so accepting
+ * its version only moves the refusal one layer down — to the schema error
+ * that names nothing, which is the bug. Refusing the version is the whole
+ * point, because that refusal says what to do.
+ */
 declare const SUPPORTED_PROTOCOL_VERSIONS: readonly string[];
 /**
  * The oldest version this build will talk to — derived, not declared.
@@ -1100,6 +2022,23 @@ interface VersionRefusal {
     readonly supported: readonly string[];
     readonly minimum: string;
 }
+/**
+ * The version a request declares, wherever it carries it.
+ *
+ * A POST declares it in its body, which is where every request schema has
+ * always put it. A GET has no body, and the relay has one — the site plane's
+ * `pending` read — so it declares it in the query string instead.
+ *
+ * **Two carriers, one rule.** That asymmetry is HTTP's rather than ours, and
+ * the alternative was worse in both directions: a header for everything would
+ * change every existing daemon's request, and skipping GETs would leave an
+ * endpoint outside the handshake — which is precisely the shape B.4 found,
+ * where a whole plane was outside it.
+ */
+declare function declaredVersion(input: {
+    body?: unknown;
+    query?: URLSearchParams;
+}): unknown;
 /**
  * Check the protocol version on an incoming request
  * ({@link MUSTS.VERSION_HANDSHAKE_REQUIRED}).
@@ -1144,6 +2083,7 @@ declare const Capability: z.ZodObject<{
         "llm.generate": "llm.generate";
         "llm.chat": "llm.chat";
     }>;
+    service: z.ZodString;
     backendId: z.ZodEnum<{
         ollama: "ollama";
         mlx: "mlx";
@@ -1163,16 +2103,17 @@ declare const Capability: z.ZodObject<{
         mistral: "mistral";
         "openai-http": "openai-http";
         "claude-cli": "claude-cli";
+        "codex-cli": "codex-cli";
     }>;
     backendClass: z.ZodEnum<{
         http: "http";
         process: "process";
     }>;
     model: z.ZodString;
+    knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     offerScope: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
+        private: "private";
+        team: "team";
     }>;
 }, z.core.$strict>;
 type Capability = z.infer<typeof Capability>;
@@ -1182,6 +2123,7 @@ declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
         "llm.generate": "llm.generate";
         "llm.chat": "llm.chat";
     }>;
+    service: z.ZodString;
     backendId: z.ZodEnum<{
         ollama: "ollama";
         mlx: "mlx";
@@ -1201,19 +2143,64 @@ declare const CapabilityMatrix: z.ZodArray<z.ZodObject<{
         mistral: "mistral";
         "openai-http": "openai-http";
         "claude-cli": "claude-cli";
+        "codex-cli": "codex-cli";
     }>;
     backendClass: z.ZodEnum<{
         http: "http";
         process: "process";
     }>;
     model: z.ZodString;
+    knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
     offerScope: z.ZodEnum<{
-        self: "self";
-        named: "named";
-        public: "public";
+        private: "private";
+        team: "team";
     }>;
 }, z.core.$strict>>;
 type CapabilityMatrix = z.infer<typeof CapabilityMatrix>;
+/**
+ * A kind this device could serve and deliberately does not — byollm_016.
+ *
+ * Two services answer one kind and the owner has not said which wins, so the
+ * kind is not advertised. That is correct and, unsaid, invisible: the owner
+ * adds a second service, jobs stop matching, and no surface explains it.
+ *
+ * It travels because the surfaces that must say so are not all on the device.
+ * The owner's card names the claimants; a teammate's card says only that the
+ * owner has a choice to make. Claimant **offer scopes** ride along so the hub
+ * can compute that difference without the device deciding who is asking —
+ * carry for computation, filter for display, the same shape the effective
+ * offer already uses.
+ */
+declare const WithheldKind: z.ZodObject<{
+    kind: z.ZodEnum<{
+        "llm.generate": "llm.generate";
+        "llm.chat": "llm.chat";
+    }>;
+    claimants: z.ZodArray<z.ZodObject<{
+        service: z.ZodString;
+        offer: z.ZodEnum<{
+            private: "private";
+            team: "team";
+        }>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+type WithheldKind = z.infer<typeof WithheldKind>;
+/**
+ * One grant, named by both halves — V1-3.
+ *
+ * A job id is chosen per site, so the lease id is the unique thing an upstream
+ * and a daemon can both point at. Anywhere a request says "this piece of work,
+ * held by me", it says it with both.
+ *
+ * Declared once because it was written out twice — `activeLeases` and
+ * `ReleaseRequest.leases` — and both needed the same `.strict()` added. Two
+ * copies of a shape are two places to forget it.
+ */
+declare const GrantRef: z.ZodObject<{
+    jobId: z.ZodString;
+    leaseId: z.ZodString;
+}, z.core.$strict>;
+type GrantRef = z.infer<typeof GrantRef>;
 /**
  * Pairing is a device-code exchange, not a pasted secret
  * ({@link MUSTS.PAIR_INTERACTIVE}). The daemon starts a pairing, shows the
@@ -1222,7 +2209,7 @@ type CapabilityMatrix = z.infer<typeof CapabilityMatrix>;
  * and nothing works over a copied string alone.
  */
 declare const PairStartRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"start">;
     daemon: z.ZodObject<{
         version: z.ZodString;
@@ -1232,7 +2219,7 @@ declare const PairStartRequest: z.ZodObject<{
             linux: "linux";
             win32: "win32";
         }>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     device: z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
@@ -1243,6 +2230,7 @@ declare const PairStartRequest: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1262,16 +2250,17 @@ declare const PairStartRequest: z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
@@ -1285,7 +2274,7 @@ declare const PairStartResponse: z.ZodObject<{
 }, z.core.$strict>;
 type PairStartResponse = z.infer<typeof PairStartResponse>;
 declare const PairPollRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>;
@@ -1298,19 +2287,19 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
     status: z.ZodLiteral<"expired">;
 }, z.core.$strict>, z.ZodObject<{
     status: z.ZodLiteral<"approved">;
-    runnerToken: z.ZodString;
     runnerId: z.ZodString;
     owner: z.ZodString;
     ownerLabel: z.ZodOptional<z.ZodString>;
-    site: z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
         encryptionSig: z.ZodString;
-    }, z.core.$strict>;
+    }, z.core.$strict>>;
+    controlPlanePublic: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"start">;
     daemon: z.ZodObject<{
         version: z.ZodString;
@@ -1320,7 +2309,7 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             linux: "linux";
             win32: "win32";
         }>;
-    }, z.core.$strip>;
+    }, z.core.$strict>;
     device: z.ZodObject<{
         identity: z.ZodString;
         encryption: z.ZodString;
@@ -1331,6 +2320,7 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1350,32 +2340,34 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
     }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>], "action">;
 type PairRequest = z.infer<typeof PairRequest>;
 declare const ClaimRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1395,16 +2387,17 @@ declare const ClaimRequest: z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
     }, z.core.$strict>>;
     max: z.ZodNumber;
@@ -1418,12 +2411,12 @@ declare const ClaimResponse: z.ZodObject<{
             "llm.chat": "llm.chat";
         }>;
         owner: z.ZodString;
+        site: z.ZodString;
         audience: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
-        audienceAllow: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        purpose: z.ZodOptional<z.ZodString>;
         sizeClass: z.ZodEnum<{
             small: "small";
             medium: "medium";
@@ -1436,13 +2429,25 @@ declare const ClaimResponse: z.ZodObject<{
             id: z.ZodString;
             runnerId: z.ZodString;
             expiresAt: z.ZodNumber;
-        }, z.core.$strip>;
+        }, z.core.$strict>;
+        grant: z.ZodOptional<z.ZodObject<{
+            grantId: z.ZodString;
+            jobId: z.ZodString;
+            site: z.ZodString;
+            user: z.ZodString;
+            owner: z.ZodString;
+            purpose: z.ZodString;
+            kind: z.ZodString;
+            service: z.ZodString;
+            issuedAt: z.ZodNumber;
+            signature: z.ZodString;
+        }, z.core.$strict>>;
     }, z.core.$strict>>;
     leaseMs: z.ZodNumber;
 }, z.core.$strict>;
 type ClaimResponse = z.infer<typeof ClaimResponse>;
 declare const HeartbeatRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     daemonVersion: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
@@ -1450,6 +2455,7 @@ declare const HeartbeatRequest: z.ZodObject<{
             "llm.generate": "llm.generate";
             "llm.chat": "llm.chat";
         }>;
+        service: z.ZodString;
         backendId: z.ZodEnum<{
             ollama: "ollama";
             mlx: "mlx";
@@ -1469,34 +2475,66 @@ declare const HeartbeatRequest: z.ZodObject<{
             mistral: "mistral";
             "openai-http": "openai-http";
             "claude-cli": "claude-cli";
+            "codex-cli": "codex-cli";
         }>;
         backendClass: z.ZodEnum<{
             http: "http";
             process: "process";
         }>;
         model: z.ZodString;
+        knownModels: z.ZodOptional<z.ZodArray<z.ZodString>>;
         offerScope: z.ZodEnum<{
-            self: "self";
-            named: "named";
-            public: "public";
+            private: "private";
+            team: "team";
         }>;
     }, z.core.$strict>>;
+    withheld: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            "llm.generate": "llm.generate";
+            "llm.chat": "llm.chat";
+        }>;
+        claimants: z.ZodArray<z.ZodObject<{
+            service: z.ZodString;
+            offer: z.ZodEnum<{
+                private: "private";
+                team: "team";
+            }>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     activeLeases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         leaseId: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
-    revoked: z.ZodBoolean;
-    cancel: z.ZodArray<z.ZodString>;
-    leases: z.ZodArray<z.ZodObject<{
+    sites: z.ZodRecord<z.ZodString, z.ZodObject<{
+        identity: z.ZodString;
+        encryption: z.ZodString;
+        encryptionSig: z.ZodString;
+    }, z.core.$strict>>;
+    successions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        succeeds: z.ZodArray<z.ZodObject<{
+            identity: z.ZodObject<{
+                identity: z.ZodString;
+                encryption: z.ZodString;
+                encryptionSig: z.ZodString;
+            }, z.core.$strict>;
+            signature: z.ZodString;
+        }, z.core.$strict>>;
+        retiringUntil: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>>;
+    cancel: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
-        expiresAt: z.ZodNumber;
+        leaseId: z.ZodString;
+    }, z.core.$strict>>;
+    lost: z.ZodArray<z.ZodObject<{
+        jobId: z.ZodString;
+        leaseId: z.ZodString;
     }, z.core.$strict>>;
-    lost: z.ZodArray<z.ZodString>;
     serverTime: z.ZodNumber;
+    awaitingConsent: z.ZodArray<z.ZodString>;
 }, z.core.$strict>;
 type HeartbeatResponse = z.infer<typeof HeartbeatResponse>;
 /**
@@ -1518,9 +2556,10 @@ declare const ResultDisposition: z.ZodEnum<{
 }>;
 type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
+    leaseId: z.ZodString;
     envelope: z.ZodObject<{
         ciphertext: z.ZodString;
         recipientKeyId: z.ZodString;
@@ -1536,32 +2575,27 @@ declare const ResultRequest: z.ZodObject<{
         error: "error";
         canceled: "canceled";
     }>;
-    model: z.ZodString;
-    backendClass: z.ZodEnum<{
-        http: "http";
-        process: "process";
-    }>;
-    durationMs: z.ZodNumber;
 }, z.core.$strict>;
 type ResultRequest = z.infer<typeof ResultRequest>;
 declare const ResultResponse: z.ZodObject<{
     accepted: z.ZodBoolean;
+    duplicate: z.ZodOptional<z.ZodBoolean>;
     state: z.ZodString;
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"0">;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     leases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
         leaseId: z.ZodString;
-    }, z.core.$strip>>;
+    }, z.core.$strict>>;
     reason: z.ZodEnum<{
-        revoked: "revoked";
+        refused: "refused";
         shutdown: "shutdown";
         pause: "pause";
+        revoked: "revoked";
         "backend-down": "backend-down";
-        refused: "refused";
     }>;
 }, z.core.$strict>;
 type ReleaseRequest = z.infer<typeof ReleaseRequest>;
@@ -1582,7 +2616,11 @@ declare const WireErrorCode: z.ZodEnum<{
     revoked: "revoked";
     "bad-request": "bad-request";
     unauthorized: "unauthorized";
+    forbidden: "forbidden";
     "not-found": "not-found";
+    "not-ready": "not-ready";
+    "too-late": "too-late";
+    "clock-skew": "clock-skew";
     "rate-limited": "rate-limited";
     "server-error": "server-error";
 }>;
@@ -1593,18 +2631,26 @@ declare const WireError: z.ZodObject<{
         revoked: "revoked";
         "bad-request": "bad-request";
         unauthorized: "unauthorized";
+        forbidden: "forbidden";
         "not-found": "not-found";
+        "not-ready": "not-ready";
+        "too-late": "too-late";
+        "clock-skew": "clock-skew";
         "rate-limited": "rate-limited";
         "server-error": "server-error";
     }>;
     message: z.ZodString;
+    supported: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    minimum: z.ZodOptional<z.ZodString>;
     retryAfter: z.ZodOptional<z.ZodNumber>;
+    serverTime: z.ZodOptional<z.ZodNumber>;
+    maxSkewMs: z.ZodOptional<z.ZodNumber>;
 }, z.core.$strict>;
 type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
 declare const FetchRequest: z.ZodObject<{
-    protocolVersion: z.ZodString;
+    protocolVersion: z.ZodLiteral<"1">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -1624,4 +2670,4 @@ declare const FetchResponse: z.ZodObject<{
 }, z.core.$strict>;
 type FetchResponse = z.infer<typeof FetchResponse>;
 
-export { AUDIENCES, Audience, BACKENDS, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GeneratePayload, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, REFUSAL_MESSAGES, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, SIZE_CLASS_LIMITS, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, type SignatureFailure, SizeClass, type SpendConsent, StoredKeys, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, backendDescriptor, canTransition, canonicalRequest, checkProtocolVersion, cryptoReady, effectiveOfferScope, fingerprint, generateKeys, isBackendId, isJobKind, isLocalHost, isTerminal, keyId, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signRequest, signWith, sizeClassCeiling, sizeClassOf, verifyPublicIdentity, verifyRequest, verifyWith };
+export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkProtocolVersion, classifyCost, cryptoReady, declaredVersion, effectiveOfferScope, envelopeBytes, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession };