@byollm/protocol 0.1.0-alpha.82 → 0.1.0-alpha.84

package/dist/index.js

@@ -1,79 +1,198 @@
-// src/about.ts
-var ABOUT = `# About BYOLLM
-
-**What BYOLLM is**
-
-BYOLLM lets you use your own AI on websites. You install one small program on
-your computer. Then, websites that support BYOLLM can use the AI you already
-have \u2014 a free model running on your machine, or an AI service you already pay
-for \u2014 instead of the website paying for AI and passing the cost to you.
-
-**Why it matters**
-
-For you:
-
-- Your favorite model, everywhere you go.
-- New models the moment you get them \u2013 not when a site gets around to adding
-  them.
-- Encrypted end-to-end. Your prompts go to your own device; byollm.cloud can't
-  read them.
-- Sites never learn which model you use, and your subscriptions are never
-  shared.
-- Pay less. Sites that don't pay for AI can charge you less \u2013 or nothing.
-
-For sites and developers:
-
-- Zero AI bills. Your users bring their own compute.
-- No floating money \u2013 you don't pay LLM bills up front and hope to collect
-  later, and you never ask people to prepay just to try you.
-- Free trials that cost you nothing to offer.
-- Ship the AI features you kept private for fear of the API bill.
-- One small integration. Your users choose the models.
-
-**Your device**
-
-The \`byollm\` program runs on your computer. It knows which AI services you have
-set up: free open-source models on your machine, metered services you pay per
-use, or your own subscriptions like Claude Pro/Max. When a website you have
-enabled sends work, your device runs it with the service you chose. Your
-prompts are encrypted end-to-end to your own device. byollm.cloud passes them
-along and cannot read them.
-
-**Sites**
-
-A website that wants to use BYOLLM says what it needs \u2014 "writing help," "chat,"
-and so on. When you connect the site, you pick which of your services answers
-each one. The site never learns which model you use. You can turn a site off at
-any time, and it stops getting your work.
-
-**Teams (optional)**
-
-A team lets you share what runs on your devices with people you name \u2014 the free
-open-source models on your machine, or a metered service with a spending limit
-you set. Your subscription accounts (like Claude Pro/Max) are never shared with
-anyone. That is a rule, not a setting.
-
-**byollm.cloud (or your own relay)**
+// src/wire.ts
+import { z as z9 } from "zod";
 
-Many sites, many devices, many people. byollm.cloud keeps track of who has
-allowed what and sends each job to the right device. It never sees your
-prompts. If you would rather run this part yourself, the relay is open source \u2014
-you can run your own instead of using byollm.cloud.`;
-var ABOUT_SHORT_LEDE = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.";
-var ABOUT_SHORT_TAIL = "Sites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
-var ABOUT_SHORT = `${ABOUT_SHORT_LEDE}
+// src/keys.ts
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  generateKeyPairSync,
+  sign,
+  verify
+} from "crypto";
+import { z } from "zod";
+var PublicIdentity = z.object({
+  /** Raw Ed25519 public key. The pinned one. */
+  identity: z.string().min(1),
+  /** Raw X25519 public key, for sealing to this party. */
+  encryption: z.string().min(1),
+  /**
+   * Ed25519 signature over the encryption key, by the identity key.
+   *
+   * This is what stops an upstream substituting an encryption key of its
+   * own while relaying a genuine identity: the receiver pins the identity
+   * and refuses any encryption key not signed by it.
+   */
+  encryptionSig: z.string().min(1)
+}).strict();
+var StoredKeys = z.object({
+  version: z.literal(1),
+  identityPublic: z.string().min(1),
+  identityPrivate: z.string().min(1),
+  encryptionPublic: z.string().min(1),
+  encryptionPrivate: z.string().min(1),
+  encryptionSig: z.string().min(1),
+  createdAt: z.number().int().positive()
+}).strict();
+var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
+function rawPublic(key) {
+  const jwk = key.export({ format: "jwk" });
+  const x = jwk.x;
+  if (typeof x !== "string") throw new Error("key has no raw public component");
+  return x;
+}
+function importPublic(raw, crv) {
+  return createPublicKey({ key: { kty: "OKP", crv, x: raw }, format: "jwk" });
+}
+function importPrivate(stored) {
+  return createPrivateKey({
+    key: Buffer.from(stored, "base64"),
+    type: "pkcs8",
+    format: "der"
+  });
+}
+var exportPrivate = (key) => key.export({ type: "pkcs8", format: "der" }).toString("base64");
+function generateKeys(now) {
+  const identity = generateKeyPairSync("ed25519");
+  const encryption = generateKeyPairSync("x25519");
+  const encryptionPublic = rawPublic(encryption.publicKey);
+  return {
+    version: 1,
+    identityPublic: rawPublic(identity.publicKey),
+    identityPrivate: exportPrivate(identity.privateKey),
+    encryptionPublic,
+    encryptionPrivate: exportPrivate(encryption.privateKey),
+    encryptionSig: sign(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${encryptionPublic}`),
+      identity.privateKey
+    ).toString("base64url"),
+    createdAt: now
+  };
+}
+function publicIdentityOf(keys) {
+  return {
+    identity: keys.identityPublic,
+    encryption: keys.encryptionPublic,
+    encryptionSig: keys.encryptionSig
+  };
+}
+function verifyPublicIdentity(identity) {
+  try {
+    return verify(
+      null,
+      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${identity.encryption}`),
+      importPublic(identity.identity, "Ed25519"),
+      Buffer.from(identity.encryptionSig, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+function signWith(keys, data) {
+  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
+    "base64url"
+  );
+}
+function verifyWith(identityPublic, data, signature) {
+  try {
+    return verify(
+      null,
+      data,
+      importPublic(identityPublic, "Ed25519"),
+      Buffer.from(signature, "base64url")
+    );
+  } catch {
+    return false;
+  }
+}
+var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+function fingerprint(identityPublic) {
+  const digest = createHash("sha256").update(Buffer.from(identityPublic, "base64url")).digest();
+  let bits = 0;
+  let value = 0;
+  let out = "";
+  for (const byte of digest.subarray(0, 15)) {
+    value = value << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += ALPHABET.charAt(value >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  const groups = out.match(/.{1,4}/g) ?? [];
+  return `BYOLLM-${groups.join("-")}`;
+}
+var keyId = (identityPublic) => fingerprint(identityPublic);
 
-${ABOUT_SHORT_TAIL}`;
+// src/succession.ts
+import { z as z2 } from "zod";
+var SUCCESSION_CONTEXT = "byollm/v1/site-succession";
+var RETIREMENT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
+var MAX_SUCCESSION_CHAIN = 64;
+var Succession = z2.object({
+  /**
+   * The predecessor's public identity — K1, in full.
+   *
+   * The whole identity rather than the key id, because a daemon meeting a
+   * chain it has not seen before has to *verify* each link, and a key id is
+   * a fingerprint: enough to compare, never enough to check a signature.
+   */
+  identity: PublicIdentity,
+  /** K1's signature over the statement naming K1 and its successor. */
+  signature: z2.string().min(1)
+}).strict();
+function successionStatement(fromKeyId, toKeyId) {
+  return Buffer.from(`${SUCCESSION_CONTEXT}:${fromKeyId}:${toKeyId}`);
+}
+function signSuccession(previous, next) {
+  return {
+    identity: {
+      identity: previous.identityPublic,
+      encryption: previous.encryptionPublic,
+      encryptionSig: previous.encryptionSig
+    },
+    signature: signWith(
+      previous,
+      successionStatement(keyId(previous.identityPublic), keyId(next.identity))
+    )
+  };
+}
+function verifyLink(link, toKeyId) {
+  if (!verifyPublicIdentity(link.identity)) return false;
+  return verifyWith(
+    link.identity.identity,
+    successionStatement(keyId(link.identity.identity), toKeyId),
+    link.signature
+  );
+}
+function walkSuccession(input) {
+  const { current, chain, approved } = input;
+  if (chain.length === 0) return { path: [current], failure: "no-chain" };
+  if (chain.length > MAX_SUCCESSION_CHAIN)
+    return { path: [current], failure: "too-long" };
+  const steps = [...chain].reverse();
+  const path = [current];
+  let succeeding = current;
+  for (const link of steps) {
+    if (!verifyLink(link, succeeding)) return { path, failure: "broken-link" };
+    const previous = keyId(link.identity.identity);
+    path.unshift(previous);
+    if (approved(previous)) return { path, from: previous };
+    succeeding = previous;
+  }
+  return { path, failure: "unknown-origin" };
+}
 
 // src/audience.ts
-import { z as z2 } from "zod";
+import { z as z4 } from "zod";
 
 // src/backends.ts
 import { isIP } from "net";
-import { z } from "zod";
-var BackendClass = z.enum(["http", "process"]);
+import { z as z3 } from "zod";
+var BackendClass = z3.enum(["http", "process"]);
 var BACKEND_CLASSES = Object.freeze(BackendClass.options);
-var BackendCost = z.enum(["free", "metered", "subscription"]);
+var BackendCost = z3.enum(["free", "metered", "subscription"]);
 var backend = (b) => Object.freeze(b);
 var BACKENDS = Object.freeze({
   // -- free: local compute, costs electricity ------------------------------
@@ -252,7 +371,7 @@ var BACKENDS = Object.freeze({
   })
 });
 var BACKEND_IDS = Object.freeze(Object.keys(BACKENDS));
-var BackendIdSchema = z.enum(
+var BackendIdSchema = z3.enum(
   BACKEND_IDS
 );
 function isBackendId(value) {
@@ -323,11 +442,11 @@ function classifyCost(id, baseUrl, model) {
 }
 
 // src/audience.ts
-var Audience = z2.enum(["private", "team"]);
-var OfferScope = z2.enum(["private", "team"]);
+var Audience = z4.enum(["private", "team"]);
+var OfferScope = z4.enum(["private", "team"]);
 var AUDIENCES = Object.freeze(Audience.options);
 var OFFER_SCOPES = Object.freeze(OfferScope.options);
-var MatchRefusal = z2.enum([
+var MatchRefusal = z4.enum([
   /** The daemon advertises no capability for this kind. */
   "no-capability",
   /** Job is `private` but this daemon belongs to a different user. */
@@ -403,193 +522,12 @@ var REFUSAL_MESSAGES = Object.freeze({
   "metered-ceiling-reached": "this backend is shared but has reached the spend ceiling its owner set"
 });
 
-// src/kinds.ts
-import { z as z3 } from "zod";
-var PAYLOAD_LIMITS = Object.freeze({
-  /** Max characters in any single text field. */
-  maxTextChars: 1e6,
-  /** Max messages in an `llm.chat` conversation. */
-  maxMessages: 256,
-  /** Max characters across the whole payload. */
-  maxTotalChars: 4e6
-});
-var ChatMessage = z3.object({
-  role: z3.enum(["system", "user", "assistant"]),
-  content: z3.string().max(PAYLOAD_LIMITS.maxTextChars)
-}).strict();
-var GeneratePayload = z3.object({
-  prompt: z3.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
-  system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict().refine(
-  (payload) => payload.prompt.length + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
-  {
-    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
-  }
-);
-var ChatPayload = z3.object({
-  messages: z3.array(ChatMessage).min(1).max(PAYLOAD_LIMITS.maxMessages),
-  system: z3.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
-}).strict().refine(
-  (payload) => payload.messages.reduce((sum, m) => sum + m.content.length, 0) + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
-  {
-    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
-  }
-);
-var JobKind = z3.enum(["llm.generate", "llm.chat"]);
-var JOB_KINDS = Object.freeze(JobKind.options);
-var KindedPayload = z3.discriminatedUnion("kind", [
-  // Strict on the wrappers too. A union member that strips is a door beside
-  // the one that is locked: the payloads inside are strict, and an extra key
-  // on the envelope vanished just as quietly.
-  z3.object({ kind: z3.literal("llm.generate"), payload: GeneratePayload }).strict(),
-  z3.object({ kind: z3.literal("llm.chat"), payload: ChatPayload }).strict()
-]);
-function isJobKind(value) {
-  return JOB_KINDS.includes(value);
-}
-function payloadTextLength(kinded) {
-  if (kinded.kind === "llm.generate") {
-    return kinded.payload.prompt.length + (kinded.payload.system?.length ?? 0);
-  }
-  const messages = kinded.payload.messages.reduce(
-    (sum, m) => sum + m.content.length,
-    0
-  );
-  return messages + (kinded.payload.system?.length ?? 0);
-}
-
 // src/job.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // src/grant.ts
 import { Buffer as Buffer2 } from "buffer";
 import { z as z5 } from "zod";
-
-// src/keys.ts
-import {
-  createHash,
-  createPrivateKey,
-  createPublicKey,
-  generateKeyPairSync,
-  sign,
-  verify
-} from "crypto";
-import { z as z4 } from "zod";
-var PublicIdentity = z4.object({
-  /** Raw Ed25519 public key. The pinned one. */
-  identity: z4.string().min(1),
-  /** Raw X25519 public key, for sealing to this party. */
-  encryption: z4.string().min(1),
-  /**
-   * Ed25519 signature over the encryption key, by the identity key.
-   *
-   * This is what stops an upstream substituting an encryption key of its
-   * own while relaying a genuine identity: the receiver pins the identity
-   * and refuses any encryption key not signed by it.
-   */
-  encryptionSig: z4.string().min(1)
-}).strict();
-var StoredKeys = z4.object({
-  version: z4.literal(1),
-  identityPublic: z4.string().min(1),
-  identityPrivate: z4.string().min(1),
-  encryptionPublic: z4.string().min(1),
-  encryptionPrivate: z4.string().min(1),
-  encryptionSig: z4.string().min(1),
-  createdAt: z4.number().int().positive()
-}).strict();
-var ENCRYPTION_KEY_CONTEXT = "byollm/v1/encryption-key";
-function rawPublic(key) {
-  const jwk = key.export({ format: "jwk" });
-  const x = jwk.x;
-  if (typeof x !== "string") throw new Error("key has no raw public component");
-  return x;
-}
-function importPublic(raw, crv) {
-  return createPublicKey({ key: { kty: "OKP", crv, x: raw }, format: "jwk" });
-}
-function importPrivate(stored) {
-  return createPrivateKey({
-    key: Buffer.from(stored, "base64"),
-    type: "pkcs8",
-    format: "der"
-  });
-}
-var exportPrivate = (key) => key.export({ type: "pkcs8", format: "der" }).toString("base64");
-function generateKeys(now) {
-  const identity = generateKeyPairSync("ed25519");
-  const encryption = generateKeyPairSync("x25519");
-  const encryptionPublic = rawPublic(encryption.publicKey);
-  return {
-    version: 1,
-    identityPublic: rawPublic(identity.publicKey),
-    identityPrivate: exportPrivate(identity.privateKey),
-    encryptionPublic,
-    encryptionPrivate: exportPrivate(encryption.privateKey),
-    encryptionSig: sign(
-      null,
-      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${encryptionPublic}`),
-      identity.privateKey
-    ).toString("base64url"),
-    createdAt: now
-  };
-}
-function publicIdentityOf(keys) {
-  return {
-    identity: keys.identityPublic,
-    encryption: keys.encryptionPublic,
-    encryptionSig: keys.encryptionSig
-  };
-}
-function verifyPublicIdentity(identity) {
-  try {
-    return verify(
-      null,
-      Buffer.from(`${ENCRYPTION_KEY_CONTEXT}:${identity.encryption}`),
-      importPublic(identity.identity, "Ed25519"),
-      Buffer.from(identity.encryptionSig, "base64url")
-    );
-  } catch {
-    return false;
-  }
-}
-function signWith(keys, data) {
-  return sign(null, data, importPrivate(keys.identityPrivate)).toString(
-    "base64url"
-  );
-}
-function verifyWith(identityPublic, data, signature) {
-  try {
-    return verify(
-      null,
-      data,
-      importPublic(identityPublic, "Ed25519"),
-      Buffer.from(signature, "base64url")
-    );
-  } catch {
-    return false;
-  }
-}
-var ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
-function fingerprint(identityPublic) {
-  const digest = createHash("sha256").update(Buffer.from(identityPublic, "base64url")).digest();
-  let bits = 0;
-  let value = 0;
-  let out = "";
-  for (const byte of digest.subarray(0, 15)) {
-    value = value << 8 | byte;
-    bits += 8;
-    while (bits >= 5) {
-      out += ALPHABET.charAt(value >>> bits - 5 & 31);
-      bits -= 5;
-    }
-  }
-  const groups = out.match(/.{1,4}/g) ?? [];
-  return `BYOLLM-${groups.join("-")}`;
-}
-var keyId = (identityPublic) => fingerprint(identityPublic);
-
-// src/grant.ts
 var GRANT_MAX_AGE_MS = 12e4;
 var CLOCK_SKEW_WARN_MS = 3e4;
 var CLOCK_ATTRIBUTION_MS = 5e3;
@@ -694,8 +632,63 @@ function verifyGrant(input) {
   ) ? null : "bad-signature";
 }
 
+// src/kinds.ts
+import { z as z6 } from "zod";
+var PAYLOAD_LIMITS = Object.freeze({
+  /** Max characters in any single text field. */
+  maxTextChars: 1e6,
+  /** Max messages in an `llm.chat` conversation. */
+  maxMessages: 256,
+  /** Max characters across the whole payload. */
+  maxTotalChars: 4e6
+});
+var ChatMessage = z6.object({
+  role: z6.enum(["system", "user", "assistant"]),
+  content: z6.string().max(PAYLOAD_LIMITS.maxTextChars)
+}).strict();
+var GeneratePayload = z6.object({
+  prompt: z6.string().min(1).max(PAYLOAD_LIMITS.maxTextChars),
+  system: z6.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
+}).strict().refine(
+  (payload) => payload.prompt.length + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
+var ChatPayload = z6.object({
+  messages: z6.array(ChatMessage).min(1).max(PAYLOAD_LIMITS.maxMessages),
+  system: z6.string().max(PAYLOAD_LIMITS.maxTextChars).optional()
+}).strict().refine(
+  (payload) => payload.messages.reduce((sum, m) => sum + m.content.length, 0) + (payload.system?.length ?? 0) <= PAYLOAD_LIMITS.maxTotalChars,
+  {
+    message: `payload exceeds ${String(PAYLOAD_LIMITS.maxTotalChars)} characters`
+  }
+);
+var JobKind = z6.enum(["llm.generate", "llm.chat"]);
+var JOB_KINDS = Object.freeze(JobKind.options);
+var KindedPayload = z6.discriminatedUnion("kind", [
+  // Strict on the wrappers too. A union member that strips is a door beside
+  // the one that is locked: the payloads inside are strict, and an extra key
+  // on the envelope vanished just as quietly.
+  z6.object({ kind: z6.literal("llm.generate"), payload: GeneratePayload }).strict(),
+  z6.object({ kind: z6.literal("llm.chat"), payload: ChatPayload }).strict()
+]);
+function isJobKind(value) {
+  return JOB_KINDS.includes(value);
+}
+function payloadTextLength(kinded) {
+  if (kinded.kind === "llm.generate") {
+    return kinded.payload.prompt.length + (kinded.payload.system?.length ?? 0);
+  }
+  const messages = kinded.payload.messages.reduce(
+    (sum, m) => sum + m.content.length,
+    0
+  );
+  return messages + (kinded.payload.system?.length ?? 0);
+}
+
 // src/job.ts
-var JobState = z6.enum([
+var JobState = z7.enum([
   "queued",
   "claimed",
   "running",
@@ -727,7 +720,7 @@ var TRANSITIONS = Object.freeze({
 function canTransition(from, to) {
   return TRANSITIONS[from].includes(to);
 }
-var Lease = z6.object({
+var Lease = z7.object({
   /**
    * Identifies *this* grant, not just its holder.
    *
@@ -742,20 +735,20 @@ var Lease = z6.object({
    * and release *is*, per lease, but not across leases, because nothing in
    * the request said which one.
    */
-  id: z6.string().min(1),
+  id: z7.string().min(1),
   /** The runner holding the lease. */
-  runnerId: z6.string().min(1),
+  runnerId: z7.string().min(1),
   /** Epoch milliseconds after which the claim is void. */
-  expiresAt: z6.number().int().positive()
+  expiresAt: z7.number().int().positive()
 }).strict();
-var JobPayload = z6.union([GeneratePayload, ChatPayload]);
-var ClaimedJob = z6.object({
-  id: z6.string().min(1),
+var JobPayload = z7.union([GeneratePayload, ChatPayload]);
+var ClaimedJob = z7.object({
+  id: z7.string().min(1),
   kind: JobKind,
   payload: JobPayload,
   audience: Audience,
   /** The app's id for the user who enqueued it. */
-  owner: z6.string().min(1),
+  owner: z7.string().min(1),
   /**
    * Which site's job — V1-3.
    *
@@ -768,7 +761,7 @@ var ClaimedJob = z6.object({
    * one, and so this reads as what it is: a fact about where the work came
    * from, not a second copy of the routing key.
    */
-  site: z6.string().min(1).optional(),
+  site: z7.string().min(1).optional(),
   /**
    * Which of the owner's services runs this — resolved, not requested.
    *
@@ -785,25 +778,25 @@ var ClaimedJob = z6.object({
    * Optional, because direct mode has no control plane to resolve anything
    * and the owner's own defaults answer under the ambiguity law.
    */
-  service: z6.string().min(1).optional(),
+  service: z7.string().min(1).optional(),
   lease: Lease
 }).strict();
-var ResultProvenance = z6.object({
+var ResultProvenance = z7.object({
   /** The audience the job ran under. */
   audience: Audience,
   /** The runner that produced it. */
-  runnerId: z6.string().min(1),
+  runnerId: z7.string().min(1),
   /** The runner owner's id in this app's namespace. */
-  runnerOwner: z6.string().min(1),
+  runnerOwner: z7.string().min(1),
   /** Which backend class produced it — an HTTP call or a sandboxed spawn. */
   backendClass: BackendClass,
   /** The model the runner reports having used. */
-  model: z6.string().min(1),
+  model: z7.string().min(1),
   /**
    * False only for `self` jobs. When true the app MUST treat `text` as
    * untrusted third-party content.
    */
-  untrusted: z6.boolean()
+  untrusted: z7.boolean()
 }).strict();
 function provenanceFor(input) {
   return {
@@ -815,35 +808,35 @@ function provenanceFor(input) {
     untrusted: input.audience !== "private"
   };
 }
-var RunMetadata = z6.object({
+var RunMetadata = z7.object({
   /** Which model actually served it. */
-  model: z6.string().min(1),
+  model: z7.string().min(1),
   backendClass: BackendClass,
   /** Wall-clock milliseconds the backend call took. */
-  durationMs: z6.number().int().nonnegative()
+  durationMs: z7.number().int().nonnegative()
 }).strict();
-var JobResultOk = z6.object({
-  outcome: z6.literal("ok"),
-  text: z6.string(),
+var JobResultOk = z7.object({
+  outcome: z7.literal("ok"),
+  text: z7.string(),
   /** Optional reference to a stored artifact; never a local path. */
-  artifactUrl: z6.url().optional()
+  artifactUrl: z7.url().optional()
 }).strict();
-var JobResultError = z6.object({
-  outcome: z6.literal("error"),
-  code: z6.string().min(1),
-  message: z6.string().min(1),
+var JobResultError = z7.object({
+  outcome: z7.literal("error"),
+  code: z7.string().min(1),
+  message: z7.string().min(1),
   /** Whether the app may reasonably re-enqueue. */
-  retryable: z6.boolean()
+  retryable: z7.boolean()
 }).strict();
-var JobResultCanceled = z6.object({
-  outcome: z6.literal("canceled")
+var JobResultCanceled = z7.object({
+  outcome: z7.literal("canceled")
 }).strict();
-var JobOutcome = z6.discriminatedUnion("outcome", [
+var JobOutcome = z7.discriminatedUnion("outcome", [
   JobResultOk,
   JobResultError,
   JobResultCanceled
 ]);
-var RefusalReason = z6.enum([
+var RefusalReason = z7.enum([
   /**
    * Two or more services answer this kind and the owner has named no default,
    * so the kind is withheld. Nobody may pick on the owner's behalf — the wrong
@@ -873,19 +866,19 @@ var RefusalReason = z6.enum([
    */
   "default-unusable"
 ]);
-var JobRefused = z6.object({
-  outcome: z6.literal("refused"),
+var JobRefused = z7.object({
+  outcome: z7.literal("refused"),
   reason: RefusalReason,
   /** Plain words for a human reading a log, never parsed. */
-  message: z6.string().min(1)
+  message: z7.string().min(1)
 }).strict();
 var REFUSAL_TEXT = Object.freeze({
   "default-ambiguity": "this device serves that kind from more than one service and its owner has not chosen which",
   "default-unusable": "this device's default for that kind cannot run work for you"
 });
-var SealedOutcome = z6.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
-var DeliveredResult = z6.object({
-  jobId: z6.string().min(1),
+var SealedOutcome = z7.object({ outcome: JobOutcome, ran: RunMetadata }).strict();
+var DeliveredResult = z7.object({
+  jobId: z7.string().min(1),
   state: JobState,
   outcome: JobOutcome.optional(),
   provenance: ResultProvenance.optional(),
@@ -903,9 +896,9 @@ var DeliveredResult = z6.object({
    * runner ran the job, and the *server* stamps it — an app cannot supply
    * a substitute that hides what it is.
    */
-  fallback: z6.literal(true).optional()
+  fallback: z7.literal(true).optional()
 }).strict();
-var SizeClass = z6.enum(["small", "medium", "large", "unbounded"]);
+var SizeClass = z7.enum(["small", "medium", "large", "unbounded"]);
 var SIZE_CLASSES = Object.freeze(SizeClass.options);
 var MAX_ENVELOPE_BYTES = 10 * 1024 * 1024;
 function envelopeBytes(envelope) {
@@ -926,11 +919,11 @@ function sizeClassOf(textChars) {
   if (textChars <= SIZE_CLASS_LIMITS.medium) return "medium";
   return "large";
 }
-var JobStub = z6.object({
-  id: z6.string().min(1),
+var JobStub = z7.object({
+  id: z7.string().min(1),
   kind: JobKind,
   /** The app's id for the user who enqueued it. */
-  owner: z6.string().min(1),
+  owner: z7.string().min(1),
   /**
    * Which site this job belongs to — byollm_009 Amendment A §A.3.
    *
@@ -954,7 +947,7 @@ var JobStub = z6.object({
    * overlap window, and a daemon re-keys its own map by verifying that
    * signature against the key it already pinned (§A.3.1).
    */
-  site: z6.string().min(1),
+  site: z7.string().min(1),
   audience: Audience,
   // `audienceAllow` is **not** here, and its absence is the enforcement —
   // cloud_008 §0.2.
@@ -1009,12 +1002,12 @@ var JobStub = z6.object({
    * `NO_PAYLOAD_ROUTING` draws: the prompt cannot reach it, so no amount of
    * user text can influence what runs.
    */
-  purpose: z6.string().min(1).optional(),
+  purpose: z7.string().min(1).optional(),
   sizeClass: SizeClass,
   /** Reserved for byollm_006. False until streaming exists. */
-  streaming: z6.boolean(),
+  streaming: z7.boolean(),
   /** Epoch ms after which the work is pointless; bounds ciphertext retention. */
-  deadlineAt: z6.number().int().positive()
+  deadlineAt: z7.number().int().positive()
 }).strict();
 var ClaimedStub = JobStub.extend({
   lease: Lease,
@@ -1024,21 +1017,21 @@ var ClaimedStub = JobStub.extend({
 // src/envelope.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2 } from "crypto";
 import sodium from "libsodium-wrappers";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var readied;
 async function cryptoReady() {
   readied ??= sodium.ready;
   await readied;
 }
 var ENVELOPE_MAX_AGE_MS = 24 * 60 * 6e4;
-var EnvelopeDirection = z7.enum(["payload", "result"]);
-var SealedEnvelope = z7.object({
+var EnvelopeDirection = z8.enum(["payload", "result"]);
+var SealedEnvelope = z8.object({
   /** Base64url `crypto_box_seal` output over the signed plaintext. */
-  ciphertext: z7.string().min(1),
+  ciphertext: z8.string().min(1),
   /** Who this was sealed to — the recipient checks it is them. */
-  recipientKeyId: z7.string().min(1),
+  recipientKeyId: z8.string().min(1),
   /** Who signed it — the recipient checks this against its pin. */
-  senderKeyId: z7.string().min(1),
+  senderKeyId: z8.string().min(1),
   direction: EnvelopeDirection,
   /**
    * When this ciphertext stops being worth keeping.
@@ -1052,7 +1045,7 @@ var SealedEnvelope = z7.object({
    * Not trusted as written: it is also inside the signature, so a changed
    * deadline fails to verify.
    */
-  deadlineAt: z7.number().int().positive()
+  deadlineAt: z8.number().int().positive()
 }).strict();
 function signedBody(context, plaintext) {
   return Buffer.from(
@@ -1145,756 +1138,147 @@ async function open(input) {
   return { ok: true, plaintext: claims["plaintext"] };
 }
 
-// src/signing.ts
-import { createHash as createHash2 } from "crypto";
-import { z as z8 } from "zod";
-var MAX_CLOCK_SKEW_MS = 12e4;
-var RequestSignature = z8.object({
-  /** Which runner is calling. The server looks up its pinned identity. */
-  runnerId: z8.string().min(1),
-  /** Epoch ms, bounded by {@link MAX_CLOCK_SKEW_MS}. */
-  issuedAt: z8.number().int().positive(),
-  /** Base64url Ed25519 signature over {@link canonicalRequest}. */
-  signature: z8.string().min(1)
-}).strict();
-function canonicalRequest(input) {
-  const digest = createHash2("sha256").update(input.body, "utf8").digest("hex");
-  return Buffer.from(
-    [
-      "byollm/v1/request",
-      input.endpoint,
-      input.runnerId,
-      String(input.issuedAt),
-      digest
-    ].join("\n"),
-    "utf8"
-  );
-}
-function signRequest(keys, input) {
-  return {
-    runnerId: input.runnerId,
-    issuedAt: input.issuedAt,
-    signature: signWith(keys, canonicalRequest(input))
-  };
-}
-function signSiteRequest(keys, input) {
-  return signRequest(keys, {
-    endpoint: siteEndpoint(input.endpoint),
-    runnerId: input.siteId,
-    issuedAt: input.issuedAt,
-    body: input.body
-  });
+// src/wire.ts
+var PROTOCOL_VERSION = "1";
+var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
+  PROTOCOL_VERSION
+]);
+var MIN_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] ?? PROTOCOL_VERSION;
+function declaredVersion(input) {
+  const { body, query } = input;
+  if (typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion")) {
+    return body.protocolVersion;
+  }
+  return query?.get("protocolVersion") ?? void 0;
 }
-function verifySiteRequest(input) {
-  return verifyRequest({
-    ...input,
-    endpoint: siteEndpoint(input.endpoint)
-  });
+function checkProtocolVersion(body) {
+  const declared = typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion") ? body.protocolVersion : void 0;
+  if (typeof declared !== "string" || declared.length === 0) {
+    return {
+      error: "unsupported-protocol-version",
+      message: `this request declared no protocol version. Upgrade the daemon: \`${UPGRADE_COMMAND}\`.`,
+      supported: SUPPORTED_PROTOCOL_VERSIONS,
+      minimum: MIN_PROTOCOL_VERSION
+    };
+  }
+  if (!SUPPORTED_PROTOCOL_VERSIONS.includes(declared)) {
+    return {
+      error: "unsupported-protocol-version",
+      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? `Upgrade the daemon: \`${UPGRADE_COMMAND}\`.` : "This daemon is newer than the server; the server needs upgrading."),
+      supported: SUPPORTED_PROTOCOL_VERSIONS,
+      minimum: MIN_PROTOCOL_VERSION
+    };
+  }
+  return null;
 }
-var siteEndpoint = (endpoint) => `site/${endpoint}`;
-function verifyRequest(input) {
-  const skew = input.maxSkewMs ?? MAX_CLOCK_SKEW_MS;
-  if (Math.abs(input.now - input.signature.issuedAt) > skew) return "stale";
-  const ok = verifyWith(
-    input.identityPublic,
-    canonicalRequest({
-      endpoint: input.endpoint,
-      runnerId: input.signature.runnerId,
-      issuedAt: input.signature.issuedAt,
-      body: input.body
-    }),
-    input.signature.signature
-  );
-  return ok ? null : "bad-signature";
-}
-
-// src/manifest.ts
-import { z as z9 } from "zod";
-var RESERVED_PURPOSE = "default";
-var RENDERABLE = /^[^\p{Cc}\p{Cf}\p{Cs}\p{Co}]+$/u;
-var renderable = (max, what) => z9.string().min(1).max(max).regex(
-  RENDERABLE,
-  `a ${what} is text a person reads \u2014 no control characters, direction overrides or zero-width padding`
-).refine((value) => value.trim() !== "", {
-  message: `a ${what} cannot be blank`
-});
-var PurposeKey = z9.string().regex(
-  /^[a-z0-9][a-z0-9-]*$/,
-  "a purpose key is a lowercase slug \u2014 letters, digits and hyphens"
-).max(64);
-var Purpose = z9.object({
+var UPGRADE_COMMAND = "npm i -g byollm@latest";
+var PROTOCOL_PREFIX = "/byollm";
+var ENDPOINTS = Object.freeze([
+  "pair",
+  "claim",
+  "fetch",
+  "heartbeat",
+  "result",
+  "release"
+]);
+var Capability = z9.object({
+  kind: JobKind,
   /**
-   * What a person reads on the consent screen. The only rendered field.
+   * The owner's name for the service answering this kind — byollm_016.
    *
-   * Declared rather than derived from the key, because a key is a
-   * compromise between machines and this is not. "Writing Assistant" is
-   * what somebody understands; `writing-assistant` is what travels.
+   * A device advertises *which* of its services serves a kind, not merely
+   * that something does. **A site never sees this**, and never did after
+   * Amendment L: it is what a control plane resolves a person's mapping
+   * against, so that the service a grant names is one this device actually
+   * offers rather than one somebody invented.
+   *
+   * `isDefault` used to sit beside it, saying which row an unselected job
+   * took. Nothing selects any more — a job names a purpose and a person's
+   * mapping names a service — so there is no unselected job for a default
+   * to catch, and the field went with the machinery it served.
    */
-  label: renderable(80, "label"),
-  /** One line of context for the consent screen. Optional. */
-  description: renderable(280, "description").optional(),
+  service: z9.string().min(1),
+  backendId: BackendIdSchema,
+  backendClass: BackendClass,
+  model: z9.string().min(1),
   /**
-   * The kinds this purpose uses.
+   * Models this device's CLI knows about — byollm_017 ruling 3.
    *
-   * A purpose may span kinds, and a mapping is per (purpose, kind) — so a
-   * person can send this purpose's chat to one service and its generation
-   * to another. Listing a kind here is what makes that slot appear.
+   * **Suggestions, not a vocabulary.** Free text is always allowed: the
+   * promise is that a model released this morning works this morning, and a
+   * frozen list anywhere a person picks from breaks that on the first day
+   * it matters. What makes free text safe is ruling 2 — a model is probed
+   * before it is stored, so "found is not works" is answered by the device
+   * rather than by a list.
+   *
+   * Announced with the capability rather than kept in the dashboard,
+   * because the answer is "what does THIS device's CLI know" and only the
+   * device can say. A list held cloud-side would be one more thing to
+   * update on release day, and wrong for anybody who had not upgraded.
+   *
+   * Optional, and empty is legal. A backend with nothing to suggest — a
+   * local server serving one model — is not a backend in an error state,
+   * and a reader must not render an absent list as "no models available".
    */
-  kinds: z9.array(JobKind).min(1).max(JOB_KINDS.length).refine((kinds) => new Set(kinds).size === kinds.length, {
-    message: "a purpose lists each kind once"
-  })
+  knownModels: z9.array(z9.string().min(1)).optional(),
+  offerScope: OfferScope
 }).strict();
-var MAX_PURPOSES = 32;
-var Manifest = z9.record(PurposeKey, Purpose).refine((manifest) => Object.keys(manifest).length > 0, {
-  message: "a manifest declares at least one purpose"
-}).refine((manifest) => Object.keys(manifest).length <= MAX_PURPOSES, {
-  message: `a manifest declares at most ${String(MAX_PURPOSES)} purposes \u2014 a consent screen is a set of questions somebody answers one at a time`
-}).refine((manifest) => !(RESERVED_PURPOSE in manifest), {
-  message: `"${RESERVED_PURPOSE}" is reserved for a site that declares no purposes of its own \u2014 give this one a name from your own vocabulary`
-});
-function singlePurposeManifest(input) {
-  return {
-    [RESERVED_PURPOSE]: { label: input.label, kinds: [...input.kinds] }
-  };
-}
-
-// src/succession.ts
-import { z as z10 } from "zod";
-var SUCCESSION_CONTEXT = "byollm/v1/site-succession";
-var RETIREMENT_WINDOW_MS = 7 * 24 * 60 * 60 * 1e3;
-var MAX_SUCCESSION_CHAIN = 64;
-var Succession = z10.object({
+var CapabilityMatrix = z9.array(Capability);
+var WithheldKind = z9.object({
+  kind: JobKind,
+  claimants: z9.array(
+    z9.object({ service: z9.string().min(1), offer: OfferScope }).strict()
+  ).min(2)
+}).strict();
+var GrantRef = z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) }).strict();
+var PairStartRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  action: z9.literal("start"),
+  daemon: z9.object({
+    version: z9.string().min(1),
+    /** Shown in the app's runner list so a user can tell their machines apart. */
+    label: z9.string().min(1).max(120),
+    platform: z9.enum(["darwin", "linux", "win32"])
+  }).strict(),
   /**
-   * The predecessor's public identity — K1, in full.
+   * This machine's public keys (byollm_009 §5).
    *
-   * The whole identity rather than the key id, because a daemon meeting a
-   * chain it has not seen before has to *verify* each link, and a key id is
-   * a fingerprint: enough to compare, never enough to check a signature.
+   * Pairing is where the two parties learn each other's identities, because
+   * it is the one moment a human is already deciding to trust: the approval
+   * click. A key exchanged anywhere else would be a key nobody chose.
    */
-  identity: PublicIdentity,
-  /** K1's signature over the statement naming K1 and its successor. */
-  signature: z10.string().min(1)
+  device: PublicIdentity,
+  capabilities: CapabilityMatrix
 }).strict();
-function successionStatement(fromKeyId, toKeyId) {
-  return Buffer.from(`${SUCCESSION_CONTEXT}:${fromKeyId}:${toKeyId}`);
-}
-function signSuccession(previous, next) {
-  return {
-    identity: {
-      identity: previous.identityPublic,
-      encryption: previous.encryptionPublic,
-      encryptionSig: previous.encryptionSig
-    },
-    signature: signWith(
-      previous,
-      successionStatement(keyId(previous.identityPublic), keyId(next.identity))
-    )
-  };
-}
-function verifyLink(link, toKeyId) {
-  if (!verifyPublicIdentity(link.identity)) return false;
-  return verifyWith(
-    link.identity.identity,
-    successionStatement(keyId(link.identity.identity), toKeyId),
-    link.signature
-  );
-}
-function walkSuccession(input) {
-  const { current, chain, approved } = input;
-  if (chain.length === 0) return { path: [current], failure: "no-chain" };
-  if (chain.length > MAX_SUCCESSION_CHAIN)
-    return { path: [current], failure: "too-long" };
-  const steps = [...chain].reverse();
-  const path = [current];
-  let succeeding = current;
-  for (const link of steps) {
-    if (!verifyLink(link, succeeding)) return { path, failure: "broken-link" };
-    const previous = keyId(link.identity.identity);
-    path.unshift(previous);
-    if (approved(previous)) return { path, from: previous };
-    succeeding = previous;
-  }
-  return { path, failure: "unknown-origin" };
-}
-
-// src/musts.ts
-function kindsOf(must2) {
-  return typeof must2.verifiedBy === "string" ? [must2.verifiedBy] : must2.verifiedBy;
-}
-var must = (m) => Object.freeze(m);
-var MUSTS = Object.freeze({
-  // ---- Pairing and identity -------------------------------------------
-  PAIR_ONE_USER: must({
-    id: "PAIR_ONE_USER",
-    statement: "A runner token MUST be bound to exactly one user; a daemon MUST refuse work not attributable to its paired user.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7MUSTs"
-  }),
-  PAIR_INTERACTIVE: must({
-    id: "PAIR_INTERACTIVE",
-    statement: "Pairing MUST be interactive (device-code approval in the app's own session); a long-lived pasted secret MUST NOT be accepted as pairing.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Endpoints.1"
-  }),
-  PAIR_CODE_EXPIRES: must({
-    id: "PAIR_CODE_EXPIRES",
-    statement: "An unapproved device code MUST expire and MUST NOT be redeemable after expiry.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Endpoints.1"
-  }),
-  // ---- Typed job kinds --------------------------------------------------
-  VERSION_HANDSHAKE_REQUIRED: must({
-    id: "VERSION_HANDSHAKE_REQUIRED",
-    statement: "Every protocol request MUST declare a protocol version, and a server MUST refuse an absent or unsupported one with a structured error naming what it supports \u2014 never a generic parse failure.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA74"
-  }),
-  SITE_KEY_BY_STUB: must({
-    id: "SITE_KEY_BY_STUB",
-    statement: "A daemon MUST verify a job's payload against the pinned key of the site the stub names, and MUST refuse a job naming a site it has not pinned. It MUST NOT fall back to another pinned key, and MUST refuse an envelope whose declared sender disagrees with the stub's site.",
-    enforcedBy: "daemon",
-    // Adversarial, and the reason is the finding that produced it: the
-    // honest paths pass with every site check deleted, because `open`
-    // refuses a signature from the wrong key anyway. What distinguishes an
-    // enforced rule from a coincidence here is a hostile pairing of stub and
-    // envelope, which no conformance client would ever send.
-    verifiedBy: "adversarial",
-    source: "byollm_009 \xA7A.3"
-  }),
-  SITES_LOCALLY_APPROVED: must({
-    id: "SITES_LOCALLY_APPROVED",
-    statement: "A daemon MUST NOT run work for a site on an upstream's word alone. An upstream may propose a site set; work for any site in it MUST additionally carry a grant signed by the control-plane key this daemon pinned at pairing. A key that has changed for an id this daemon already pinned MUST be refused for the life of the pairing, including after that id has left the set and returned. A **verified succession** is not a changed key: a new key id carrying a signature, by a key this daemon has already pinned, over a statement naming both key ids MUST be accepted \u2014 provided the control plane projects the same successor \u2014 and MUST be announced rather than applied silently. The first job from a site this daemon has never served MUST be announced at the machine.",
-    enforcedBy: "daemon",
-    // Two kinds, and the second is the one that matters — V1-1.
+var PairStartResponse = z9.object({
+  /** Secret the daemon polls with. Never shown to the user. */
+  deviceCode: z9.string().min(20),
+  /** Short code the user reads and confirms in the browser. */
+  userCode: z9.string().min(4).max(16),
+  /** Where the user approves. Must be on the server's own origin. */
+  verificationUrl: z9.url(),
+  /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
+  expiresAt: z9.number().int().positive(),
+  /** How often the daemon may poll. */
+  pollIntervalMs: z9.number().int().min(500).max(6e4)
+}).strict();
+var PairPollRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  action: z9.literal("poll"),
+  deviceCode: z9.string().min(20)
+}).strict();
+var PairPollResponse = z9.discriminatedUnion("status", [
+  z9.object({ status: z9.literal("pending") }).strict(),
+  z9.object({ status: z9.literal("denied") }).strict(),
+  z9.object({ status: z9.literal("expired") }).strict(),
+  z9.object({
+    status: z9.literal("approved"),
+    // `runnerToken` is gone — cloud_008 §2.4, finding 37.
     //
-    // `construction`: the daemon cannot serve a site that is not in its
-    // pinned map, and admission refuses before a payload is fetched — and
-    // since byollm_016 Amendment K, being in the map is no longer sufficient
-    // either: a signed grant is, and the relay proposing the set cannot
-    // produce one.
-    //
-    // `adversarial`: the property that survives is about a *sequence* —
-    // remove the id, re-offer it under a different key — which no honest
-    // upstream sends and which the fence above does not see. That was the
-    // bypass: the pin was deleted with the id, so the comparison had nothing
-    // to compare against and the substitution arrived as a stranger.
-    // **Not `conformance`, and that is a live gap rather than a judgement.**
-    // Amendment C's succession clause is a rule about two implementations
-    // agreeing, which is what a conformance check is for — but rotating a
-    // site's key is not something `ConformanceTarget` can express, and adding
-    // an optional hook that most targets omit would produce a check reporting
-    // success for a reason unrelated to the property it claims. That is this
-    // project's most-repeated bug, and it is not worth reintroducing for a
-    // stronger-sounding word in a table. The rotation path is verified by
-    // `site-rotation.test.ts` (both directions, against the shipped runner)
-    // and `relay/test/rotation.test.ts` (both planes, against the reference
-    // relay); the missing piece is a second *independent* implementation to
-    // check them against, and there is not one yet.
-    verifiedBy: ["construction", "adversarial"],
-    source: "byollm_009 \xA7B.2, Amendment C"
-  }),
-  KEYS_EXCHANGED_AT_CONSENT: must({
-    id: "KEYS_EXCHANGED_AT_CONSENT",
-    statement: "Pairing MUST exchange both parties' public identities; each side MUST verify that the encryption key is signed by the identity presenting it, and MUST pin the identity. Keys MUST NOT be delivered before approval.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA75"
-  }),
-  REQUESTS_SIGNED_NOT_BEARER: must({
-    id: "REQUESTS_SIGNED_NOT_BEARER",
-    statement: "Every authenticated request MUST be signed by the calling device's pinned identity key, over the endpoint, the runner id, a timestamp and the exact request body. A server MUST NOT accept a bearer credential in place of a signature.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA74.2"
-  }),
-  LEASE_SCOPED_BY_GRANT: must({
-    id: "LEASE_SCOPED_BY_GRANT",
-    statement: "A lease-scoped request MUST name the lease it acts on, and a server MUST apply it only to that lease. Naming the job and the runner is not sufficient: both survive a claim-release-reclaim cycle.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA74.2"
-  }),
-  STUB_METADATA_EXHAUSTIVE: must({
-    id: "STUB_METADATA_EXHAUSTIVE",
-    statement: "A claim MUST answer with stubs carrying exactly the enumerated fields and no payload. An endpoint MUST NOT emit a stub carrying others, and an upstream MUST NOT require any.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA76"
-  }),
-  ENVELOPE_SEALED_AND_SIGNED: must({
-    id: "ENVELOPE_SEALED_AND_SIGNED",
-    statement: "A stored payload MUST be sealed, and MUST be signed by the sender's identity key. An endpoint MUST refuse an envelope whose signature does not verify against the identity it pinned.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA76"
-  }),
-  KIND_TYPED_ONLY: must({
-    id: "KIND_TYPED_ONLY",
-    statement: "Job kinds MUST resolve against handlers baked into the daemon. A daemon MUST refuse an unknown kind rather than guess.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Jobs are typed data"
-  }),
-  KIND_NO_CODE: must({
-    id: "KIND_NO_CODE",
-    statement: "A server MUST NOT be able to convey code, a shell string, or a path to execute; payloads are data handed to a model only.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Jobs are typed data; byollm_004 \xA71"
-  }),
-  // ---- Capability and claiming -----------------------------------------
-  CLAIM_REQUIRES_CAPABILITY: must({
-    id: "CLAIM_REQUIRES_CAPABILITY",
-    statement: "A daemon MUST NOT be given a job whose kind is absent from its advertised capability matrix.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7MUSTs"
-  }),
-  CAPABILITY_IS_DETECTED: must({
-    id: "CAPABILITY_IS_DETECTED",
-    statement: "An advertised capability matrix MUST be the intersection of owner config and detected, healthy reality \u2014 never config alone.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_002 \xA7Routing"
-  }),
-  CLAIM_ATOMIC: must({
-    id: "CLAIM_ATOMIC",
-    statement: "Claiming MUST be atomic: a job MUST NOT be handed to two runners concurrently.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Endpoints.2"
-  }),
-  // ---- Leases -----------------------------------------------------------
-  LEASE_HONORED: must({
-    id: "LEASE_HONORED",
-    statement: "A daemon MUST stop work on a job whose lease it has failed to renew, and MUST NOT report a result for an expired lease it no longer holds.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7MUSTs"
-  }),
-  LEASE_RECLAIMABLE: must({
-    id: "LEASE_RECLAIMABLE",
-    statement: "A lease that expires un-renewed MUST make its job claimable again with no loss of the job.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Endpoints.2"
-  }),
-  // ---- Audience and offer scope ----------------------------------------
-  AUDIENCE_BOTH_SIDES: must({
-    id: "AUDIENCE_BOTH_SIDES",
-    statement: "A job MUST run on a daemon only if the daemon's offer scope admits the job's owner AND the job's audience admits the daemon's owner.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7The audience model"
-  }),
-  SUBSCRIPTION_SELF_LOCK: must({
-    id: "SUBSCRIPTION_SELF_LOCK",
-    statement: "A subscription-class backend's offer scope MUST be 'private' and MUST NOT be widened by configuration.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7The audience model"
-  }),
-  METERED_DEFAULTS_SELF: must({
-    id: "METERED_DEFAULTS_SELF",
-    statement: "A metered backend's effective offer scope MUST be 'private' unless the owner has explicitly acknowledged spending money on others' work.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_007 \xA74"
-  }),
-  METERED_REQUIRES_CEILING: must({
-    id: "METERED_REQUIRES_CEILING",
-    statement: "A widened metered backend MUST carry a spend ceiling, and the daemon MUST refuse community work once it is reached.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_007 \xA74"
-  }),
-  COST_NOT_CONFIGURABLE: must({
-    id: "COST_NOT_CONFIGURABLE",
-    statement: "A built-in provider's cost class MUST NOT be overridable by configuration.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_007 \xA72"
-  }),
-  REMOTE_IS_NEVER_FREE: must({
-    id: "REMOTE_IS_NEVER_FREE",
-    statement: "A generic HTTP backend whose base URL is not loopback or private MUST be treated as metered.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_007 \xA72"
-  }),
-  NAMED_LOCAL_ALLOWLIST: must({
-    id: "NAMED_LOCAL_ALLOWLIST",
-    statement: "A 'team' job MUST be admitted only by something the device itself verified, keyed by (server origin, user id) \u2014 never on the routing party's assertion alone.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 Rev 1 \xA7B"
-  }),
-  REFUSAL_NOT_REOFFERED: must({
-    id: "REFUSAL_NOT_REOFFERED",
-    statement: "A server MUST NOT re-offer a job to a runner that released it with reason 'refused'.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 Rev 1 \xA7B (loop resolved in build review)"
-  }),
-  // ---- Revocation and cancel -------------------------------------------
-  REVOCATION_HONORED: must({
-    id: "REVOCATION_HONORED",
-    statement: "A revoked daemon MUST stop claiming and MUST abandon in-flight work by the next heartbeat at the latest.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7MUSTs"
-  }),
-  CANCEL_HONORED: must({
-    id: "CANCEL_HONORED",
-    statement: "A job id in a heartbeat response's cancel list MUST abort that job's in-flight backend call and be reported as 'canceled'.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 Rev 1 \xA7C"
-  }),
-  // ---- Lifecycle, dependencies, delivery -------------------------------
-  DEPENDS_ON_GATING: must({
-    id: "DEPENDS_ON_GATING",
-    statement: "A job MUST NOT be claimable until every job in its dependsOn set has reached the 'ok' state.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 Rev 1 \xA7E"
-  }),
-  TTL_EXPIRY: must({
-    id: "TTL_EXPIRY",
-    statement: "An unclaimed job MUST become 'expired' once its TTL elapses, and the TTL clock MUST start when the job becomes claimable, not at enqueue.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 Rev 1 \xA7D (TTL clock resolved in build review)"
-  }),
-  NO_RUNNER_SIGNAL: must({
-    id: "NO_RUNNER_SIGNAL",
-    statement: "A server MUST surface noRunnerAvailable when no runner with matching capability has heartbeated within the liveness window, and MUST NOT raise it for a job still blocked on dependencies.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 Rev 1 \xA7D"
-  }),
-  RESULT_IDEMPOTENT: must({
-    id: "RESULT_IDEMPOTENT",
-    statement: "Result submission MUST be idempotent by job id; the first terminal outcome wins and later submissions MUST NOT change it.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7Endpoints.4"
-  }),
-  PROVENANCE_NAMES_DEVICE: must({
-    id: "PROVENANCE_NAMES_DEVICE",
-    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA711"
-  }),
-  // ---- The trust surface -------------------------------------------------
-  INGRESS_LOGGED_BEFORE_EXECUTION: must({
-    id: "INGRESS_LOGGED_BEFORE_EXECUTION",
-    statement: "Every executed prompt MUST be appended to the local ingress log before execution begins.",
-    enforcedBy: "daemon",
-    verifiedBy: "conformance",
-    source: "byollm_001 \xA7MUSTs"
-  }),
-  // ---- Execution isolation (byollm_004) ---------------------------------
-  NO_SHELL_INTERPOLATION: must({
-    id: "NO_SHELL_INTERPOLATION",
-    statement: "Process-class backends MUST be invoked with a fixed argv array and the payload delivered on stdin; payload text MUST NOT reach a command line.",
-    enforcedBy: "daemon",
-    verifiedBy: "adversarial",
-    source: "byollm_004 \xA72"
-  }),
-  /**
-   * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
-   *
-   * A site may now name a **service** on the stub. The temptation is to read
-   * that as a crack in this law, so the statement below says exactly where the
-   * line is: a name selects from a menu the owner published, and resolves to a
-   * model, backend, base URL and flags **only** through that owner's own
-   * config. The site supplies a key; the owner supplies every value it maps
-   * to. A name the owner does not advertise is refused rather than
-   * substituted, because substitution is how "you may pick from my list" turns
-   * into "you may ask for anything and get something".
-   *
-   * Two properties keep it from drifting into "sites demand models":
-   *
-   *   1. **Nothing the site sends is ever a value.** No model string, no URL,
-   *      no flag crosses the wire — only a key that means nothing off this
-   *      owner's machine.
-   *   2. **It is a stub field, never a payload field.** The prompt cannot
-   *      reach it. That is unchanged and is the sentence the second clause
-   *      below still enforces verbatim.
-   */
-  NO_PAYLOAD_ROUTING: must({
-    id: "NO_PAYLOAD_ROUTING",
-    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them. A stub MAY name a service the owner advertises, which selects among that owner's own config entries and MUST NOT introduce any value the owner did not write; an unadvertised name MUST be refused, never substituted.",
-    enforcedBy: "daemon",
-    verifiedBy: "adversarial",
-    source: "byollm_004 \xA72, amended byollm_016 \xA7Phase B"
-  }),
-  STRIPPED_CHILD_ENV: must({
-    id: "STRIPPED_CHILD_ENV",
-    statement: "Process-class children MUST spawn with an allowlisted environment, a scratch cwd, no inherited descriptors beyond std streams, and hard timeout and output-size caps.",
-    enforcedBy: "daemon",
-    verifiedBy: "adversarial",
-    source: "byollm_004 \xA72"
-  }),
-  HTTP_BASE_URL_SAFE: must({
-    id: "HTTP_BASE_URL_SAFE",
-    statement: "HTTP-class backends MUST send requests only to the owner-configured base URL and MUST refuse base URLs resolving to cloud-metadata or link-local addresses.",
-    enforcedBy: "daemon",
-    verifiedBy: "adversarial",
-    source: "byollm_004 Rev 1 \xA7Backend taxonomy"
-  }),
-  OUTPUT_INERT: must({
-    id: "OUTPUT_INERT",
-    statement: "Returned text MUST be treated as inert bytes: never evaluated, never written to a payload-named path, never interpolated into a shell or into terminal control sequences when logged.",
-    enforcedBy: "daemon",
-    verifiedBy: "adversarial",
-    source: "byollm_004 \xA72"
-  }),
-  COMMUNITY_BUDGETS: must({
-    id: "COMMUNITY_BUDGETS",
-    statement: "Jobs whose owner is not the daemon's owner MUST be subject to the owner's rate limits, daily cap, and resource budget.",
-    enforcedBy: "daemon",
-    verifiedBy: "adversarial",
-    source: "byollm_004 \xA74"
-  }),
-  REVOCATION_IMMEDIATE: must({
-    id: "REVOCATION_IMMEDIATE",
-    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
-    // Both, and stated as one sentence with two obligations rather than
-    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
-    // daemon stops claiming and abandons in-flight work. This binds the
-    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
-    // revocation enforced at one end survives a compromise of that end" — and
-    // one entry covering both would make a compromised daemon look compliant.
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA711"
-  }),
-  CONSENT_BEFORE_ROUTE: must({
-    id: "CONSENT_BEFORE_ROUTE",
-    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
-    enforcedBy: "server",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA711"
-  }),
-  ROSTER_NOT_DISCLOSED: must({
-    id: "ROSTER_NOT_DISCLOSED",
-    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
-    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
-    // property now holds by *absence*, and absence is exactly what a strict
-    // schema and a serialised stub can be asked about. Before that it was a
-    // sentence — and one this project cited in code comments, tests and two
-    // specs as though it were enforced data, which is why it is worth
-    // stating precisely rather than generously.
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA711"
-  }),
-  EFFECTIVE_OFFER_ONLY: must({
-    id: "EFFECTIVE_OFFER_ONLY",
-    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
-    enforcedBy: "both",
-    verifiedBy: "conformance",
-    source: "byollm_009 \xA711"
-  }),
-  FALLBACK_LABELED: must({
-    id: "FALLBACK_LABELED",
-    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
-    // `construction` today, and deliberately not `conformance`. Nothing on
-    // the wire yet distinguishes a fallback from any other community job —
-    // the ledger that would give it a surface is unbuilt — so a check would
-    // have to assert something it cannot observe. Promoted the day that
-    // surface exists. Marking it `conformance` now would put "verified"
-    // beside a property no third party can see, which is the one thing the
-    // kinds exist to prevent.
-    enforcedBy: "both",
-    verifiedBy: "construction",
-    source: "byollm_009 \xA711"
-  }),
-  RELAY_BLIND: must({
-    id: "RELAY_BLIND",
-    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
-    // Operator: a third party can read the relay's types and see there is
-    // nowhere to put such a key, but the kit certifies a *server* and cannot
-    // reach inside somebody's deployment to prove what it holds.
-    enforcedBy: "server",
-    verifiedBy: "operator",
-    source: "byollm_009 \xA711"
-  }),
-  SHARED_COMPUTE_DISCLOSED: must({
-    id: "SHARED_COMPUTE_DISCLOSED",
-    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
-    // Operator, and cloud_008 §0.3 is why the classification now comes with a
-    // standing answer rather than a standing question. The screen is not
-    // wire-observable, but the *string the server composes* is, and it is
-    // now unit-tested with the two false sentences forbidden by name. The
-    // kind stays `operator` because a third-party site can still render
-    // whatever it likes; what changed is that the part inside our own
-    // boundary stopped depending on somebody remembering to audit it.
-    enforcedBy: "server",
-    verifiedBy: "operator",
-    source: "byollm_009 \xA711"
-  })
-});
-var RETIRED_MUSTS = Object.freeze({
-  RESULT_PROVENANCE: {
-    supersededBy: "PROVENANCE_NAMES_DEVICE",
-    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
-  }
-});
-var MUST_IDS = Object.freeze(Object.keys(MUSTS));
-function mustsVerifiedBy(kind) {
-  return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
-}
-
-// src/wire.ts
-import { z as z11 } from "zod";
-var PROTOCOL_VERSION = "1";
-var SUPPORTED_PROTOCOL_VERSIONS = Object.freeze([
-  PROTOCOL_VERSION
-]);
-var MIN_PROTOCOL_VERSION = SUPPORTED_PROTOCOL_VERSIONS[0] ?? PROTOCOL_VERSION;
-function declaredVersion(input) {
-  const { body, query } = input;
-  if (typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion")) {
-    return body.protocolVersion;
-  }
-  return query?.get("protocolVersion") ?? void 0;
-}
-function checkProtocolVersion(body) {
-  const declared = typeof body === "object" && body !== null && Object.hasOwn(body, "protocolVersion") ? body.protocolVersion : void 0;
-  if (typeof declared !== "string" || declared.length === 0) {
-    return {
-      error: "unsupported-protocol-version",
-      message: `this request declared no protocol version. Upgrade the daemon: \`${UPGRADE_COMMAND}\`.`,
-      supported: SUPPORTED_PROTOCOL_VERSIONS,
-      minimum: MIN_PROTOCOL_VERSION
-    };
-  }
-  if (!SUPPORTED_PROTOCOL_VERSIONS.includes(declared)) {
-    return {
-      error: "unsupported-protocol-version",
-      message: `this server speaks protocol ${SUPPORTED_PROTOCOL_VERSIONS.join(", ")} and the daemon asked for ${declared}. ` + (declared < MIN_PROTOCOL_VERSION ? `Upgrade the daemon: \`${UPGRADE_COMMAND}\`.` : "This daemon is newer than the server; the server needs upgrading."),
-      supported: SUPPORTED_PROTOCOL_VERSIONS,
-      minimum: MIN_PROTOCOL_VERSION
-    };
-  }
-  return null;
-}
-var UPGRADE_COMMAND = "npm i -g byollm@latest";
-var PROTOCOL_PREFIX = "/byollm";
-var ENDPOINTS = Object.freeze([
-  "pair",
-  "claim",
-  "fetch",
-  "heartbeat",
-  "result",
-  "release"
-]);
-var Capability = z11.object({
-  kind: JobKind,
-  /**
-   * The owner's name for the service answering this kind — byollm_016.
-   *
-   * A device advertises *which* of its services serves a kind, not merely
-   * that something does. **A site never sees this**, and never did after
-   * Amendment L: it is what a control plane resolves a person's mapping
-   * against, so that the service a grant names is one this device actually
-   * offers rather than one somebody invented.
-   *
-   * `isDefault` used to sit beside it, saying which row an unselected job
-   * took. Nothing selects any more — a job names a purpose and a person's
-   * mapping names a service — so there is no unselected job for a default
-   * to catch, and the field went with the machinery it served.
-   */
-  service: z11.string().min(1),
-  backendId: BackendIdSchema,
-  backendClass: BackendClass,
-  model: z11.string().min(1),
-  /**
-   * Models this device's CLI knows about — byollm_017 ruling 3.
-   *
-   * **Suggestions, not a vocabulary.** Free text is always allowed: the
-   * promise is that a model released this morning works this morning, and a
-   * frozen list anywhere a person picks from breaks that on the first day
-   * it matters. What makes free text safe is ruling 2 — a model is probed
-   * before it is stored, so "found is not works" is answered by the device
-   * rather than by a list.
-   *
-   * Announced with the capability rather than kept in the dashboard,
-   * because the answer is "what does THIS device's CLI know" and only the
-   * device can say. A list held cloud-side would be one more thing to
-   * update on release day, and wrong for anybody who had not upgraded.
-   *
-   * Optional, and empty is legal. A backend with nothing to suggest — a
-   * local server serving one model — is not a backend in an error state,
-   * and a reader must not render an absent list as "no models available".
-   */
-  knownModels: z11.array(z11.string().min(1)).optional(),
-  offerScope: OfferScope
-}).strict();
-var CapabilityMatrix = z11.array(Capability);
-var WithheldKind = z11.object({
-  kind: JobKind,
-  claimants: z11.array(
-    z11.object({ service: z11.string().min(1), offer: OfferScope }).strict()
-  ).min(2)
-}).strict();
-var GrantRef = z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict();
-var PairStartRequest = z11.object({
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  action: z11.literal("start"),
-  daemon: z11.object({
-    version: z11.string().min(1),
-    /** Shown in the app's runner list so a user can tell their machines apart. */
-    label: z11.string().min(1).max(120),
-    platform: z11.enum(["darwin", "linux", "win32"])
-  }).strict(),
-  /**
-   * This machine's public keys (byollm_009 §5).
-   *
-   * Pairing is where the two parties learn each other's identities, because
-   * it is the one moment a human is already deciding to trust: the approval
-   * click. A key exchanged anywhere else would be a key nobody chose.
-   */
-  device: PublicIdentity,
-  capabilities: CapabilityMatrix
-}).strict();
-var PairStartResponse = z11.object({
-  /** Secret the daemon polls with. Never shown to the user. */
-  deviceCode: z11.string().min(20),
-  /** Short code the user reads and confirms in the browser. */
-  userCode: z11.string().min(4).max(16),
-  /** Where the user approves. Must be on the server's own origin. */
-  verificationUrl: z11.url(),
-  /** Epoch ms after which the code is dead ({@link MUSTS.PAIR_CODE_EXPIRES}). */
-  expiresAt: z11.number().int().positive(),
-  /** How often the daemon may poll. */
-  pollIntervalMs: z11.number().int().min(500).max(6e4)
-}).strict();
-var PairPollRequest = z11.object({
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  action: z11.literal("poll"),
-  deviceCode: z11.string().min(20)
-}).strict();
-var PairPollResponse = z11.discriminatedUnion("status", [
-  z11.object({ status: z11.literal("pending") }).strict(),
-  z11.object({ status: z11.literal("denied") }).strict(),
-  z11.object({ status: z11.literal("expired") }).strict(),
-  z11.object({
-    status: z11.literal("approved"),
-    // `runnerToken` is gone — cloud_008 §2.4, finding 37.
-    //
-    // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
-    // the daemon's pairings file, and then **never sent, never looked up
-    // and never compared**. `getRunnerByTokenHash` existed on both stores
-    // and was called by nothing but a test asserting it returns null.
+    // It was minted here, hashed into `RunnerRecord.tokenHash`, written to
+    // the daemon's pairings file, and then **never sent, never looked up
+    // and never compared**. `getRunnerByTokenHash` existed on both stores
+    // and was called by nothing but a test asserting it returns null.
     //
     // Not merely dead wire, which is what `audienceAllow` and
     // `HeartbeatResponse.leases` were. This was a *secret*: minted,
@@ -1905,11 +1289,11 @@ var PairPollResponse = z11.discriminatedUnion("status", [
     // `REQUESTS_SIGNED_NOT_BEARER` was already the rule and was already
     // enforced — every authenticated call is signed by the device's pinned
     // identity key. This removes the thing the MUST is named after.
-    runnerId: z11.string().min(1),
+    runnerId: z9.string().min(1),
     /** The app's id for the approving user — this daemon's owner forever. */
-    owner: z11.string().min(1),
+    owner: z9.string().min(1),
     /** Display name for the trust UI, if the app offers one. */
-    ownerLabel: z11.string().optional(),
+    ownerLabel: z9.string().optional(),
     /**
      * The sites this pairing covers, for the daemon to pin (byollm_009 §5),
      * keyed by each site's identity key id — cloud_009 §5.
@@ -1928,7 +1312,7 @@ var PairPollResponse = z11.discriminatedUnion("status", [
      * runner's lookup is a map read rather than a join across two
      * namespaces.
      */
-    sites: z11.record(z11.string().min(1), PublicIdentity),
+    sites: z9.record(z9.string().min(1), PublicIdentity),
     /**
      * The control plane's grant-signing key, pinned here — Amendment J.
      *
@@ -1949,34 +1333,34 @@ var PairPollResponse = z11.discriminatedUnion("status", [
      * Rotation is Amendment C's, with no path where a grant teaches a
      * daemon a new key.
      */
-    controlPlanePublic: z11.string().min(1).optional()
+    controlPlanePublic: z9.string().min(1).optional()
   }).strict()
 ]);
-var PairRequest = z11.discriminatedUnion("action", [
+var PairRequest = z9.discriminatedUnion("action", [
   PairStartRequest,
   PairPollRequest
 ]);
-var ClaimRequest = z11.object({
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  runnerId: z11.string().min(1),
+var ClaimRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
   /** Re-sent on every claim so a server never matches against a stale matrix. */
   capabilities: CapabilityMatrix,
   /** Upper bound on jobs to return; the server may return fewer. */
-  max: z11.number().int().min(1).max(64)
+  max: z9.number().int().min(1).max(64)
 }).strict();
-var ClaimResponse = z11.object({
+var ClaimResponse = z9.object({
   /**
    * Stubs, not jobs. The payload arrives from `fetch`, sealed to whichever
    * device claimed — see {@link JobStub} for the exhaustive metadata list.
    */
-  jobs: z11.array(ClaimedStub),
+  jobs: z9.array(ClaimedStub),
   /** Lease duration granted, so the daemon knows its renewal deadline. */
-  leaseMs: z11.number().int().positive()
+  leaseMs: z9.number().int().positive()
 }).strict();
-var HeartbeatRequest = z11.object({
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  runnerId: z11.string().min(1),
-  daemonVersion: z11.string().min(1),
+var HeartbeatRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  daemonVersion: z9.string().min(1),
   capabilities: CapabilityMatrix,
   /**
    * Kinds this device is withholding, and why it can be said.
@@ -1985,18 +1369,18 @@ var HeartbeatRequest = z11.object({
    * older daemon against a newer hub is simply a device with no withheld
    * kinds rather than a parse failure.
    */
-  withheld: z11.array(WithheldKind).default([]),
+  withheld: z9.array(WithheldKind).default([]),
   /**
    * Leases this daemon believes it holds; the server renews exactly these.
    *
    * Lease ids rather than job ids, so a replayed heartbeat cannot renew a
    * grant the runner no longer holds — see {@link Lease.id}.
    */
-  activeLeases: z11.array(GrantRef),
+  activeLeases: z9.array(GrantRef),
   /** True while the owner has the daemon paused; the server stops offering work. */
-  paused: z11.boolean()
+  paused: z9.boolean()
 }).strict();
-var HeartbeatResponse = z11.object({
+var HeartbeatResponse = z9.object({
   /**
    * The sites this daemon may serve, right now — cloud_008 finding 59.
    *
@@ -2014,7 +1398,7 @@ var HeartbeatResponse = z11.object({
    * rather than being told a second time — two fields for one fact is how
    * they drift.
    */
-  sites: z11.record(z11.string().min(1), PublicIdentity),
+  sites: z9.record(z9.string().min(1), PublicIdentity),
   /**
    * How a site's current key traces back to one this daemon already holds —
    * byollm_009 Amendment C.
@@ -2032,11 +1416,11 @@ var HeartbeatResponse = z11.object({
    * history is public by construction, because a daemon that cannot read it
    * cannot verify it.
    */
-  successions: z11.record(
-    z11.string().min(1),
-    z11.object({
+  successions: z9.record(
+    z9.string().min(1),
+    z9.object({
       /** Oldest last, as the projection carries it. */
-      succeeds: z11.array(Succession).max(MAX_SUCCESSION_CHAIN),
+      succeeds: z9.array(Succession).max(MAX_SUCCESSION_CHAIN),
       /**
        * Until when the superseded key may still sign work — epoch ms.
        *
@@ -2045,7 +1429,7 @@ var HeartbeatResponse = z11.object({
        * window indefinitely would be a two-key site forever, decided by
        * the party this design does not trust.
        */
-      retiringUntil: z11.number().int().positive().optional()
+      retiringUntil: z9.number().int().positive().optional()
     }).strict()
   ).optional(),
   /**
@@ -2058,8 +1442,8 @@ var HeartbeatResponse = z11.object({
    * is the unique grant and the daemon already keys its work by it; this is
    * the same shape `activeLeases` sends in the other direction.
    */
-  cancel: z11.array(
-    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict()
+  cancel: z9.array(
+    z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) }).strict()
   ),
   // `leases` is deliberately absent — cloud_008 §1.4b, finding 16.
   //
@@ -2089,11 +1473,11 @@ var HeartbeatResponse = z11.object({
    * ambiguous across sites, and "the lease you no longer hold" is exactly
    * what this field means anyway.
    */
-  lost: z11.array(
-    z11.object({ jobId: z11.string().min(1), leaseId: z11.string().min(1) }).strict()
+  lost: z9.array(
+    z9.object({ jobId: z9.string().min(1), leaseId: z9.string().min(1) }).strict()
   ),
   /** Server clock, so a daemon with a skewed clock still honors leases. */
-  serverTime: z11.number().int().positive(),
+  serverTime: z9.number().int().positive(),
   /**
    * Sites whose disclosure the user must read again before work moves —
    * cloud_008 finding 48, named rather than counted.
@@ -2108,13 +1492,36 @@ var HeartbeatResponse = z11.object({
    * operator stopped it" — one word with two subjects on two halves of one
    * exchange is a confusion nobody untangles from a log.
    */
-  awaitingConsent: z11.array(z11.string().min(1))
+  awaitingConsent: z9.array(z9.string().min(1)),
+  /**
+   * A version this daemon should move itself to — B053.
+   *
+   * The channel the auto-updater reads, and it is the channel the daemon
+   * already polls rather than a new phone-home, which is what the ruling
+   * asked for (016 §Auto-update).
+   *
+   * **The hub may not send this to every daemon.** This schema is
+   * `.strict()`, so a daemon built before the field exists does not ignore
+   * it — it rejects the whole heartbeat and stops working. Which would mean
+   * the message carrying the update is the message that breaks the machines
+   * it was meant to update.
+   *
+   * That is decidable without any new handshake, because the request
+   * already carries `daemonVersion`. {@link mayOfferUpdate} is the rule,
+   * kept here as code rather than as a paragraph in a runbook, so both
+   * sides read the same one.
+   *
+   * Exact versions only, never a tag: the daemon refuses anything else, and
+   * a fleet resolving one tag at different minutes is a fleet on different
+   * builds reporting one number.
+   */
+  updateTo: z9.string().min(1).optional()
 }).strict();
-var ResultDisposition = z11.enum(["ok", "error", "canceled"]);
-var ResultRequest = z11.object({
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  runnerId: z11.string().min(1),
-  jobId: z11.string().min(1),
+var ResultDisposition = z9.enum(["ok", "error", "canceled"]);
+var ResultRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  jobId: z9.string().min(1),
   /**
    * The grant this result was produced under — cloud_008 §1.4a.
    *
@@ -2137,7 +1544,7 @@ var ResultRequest = z11.object({
    * learned once already, when a replayed release yanked a later grant, and
    * it applies here for the same reason.
    */
-  leaseId: z11.string().min(1),
+  leaseId: z9.string().min(1),
   /**
    * The outcome, sealed to the site and signed by the device.
    *
@@ -2169,12 +1576,12 @@ var ResultRequest = z11.object({
   // on it, so it is a class a routing party consumes. Nobody between the
   // two ends consumes these.
 }).strict();
-var ResultResponse = z11.object({
+var ResultResponse = z9.object({
   /**
    * False when this submission wrote nothing — the daemon should discard,
    * not retry ({@link MUSTS.RESULT_IDEMPOTENT}).
    */
-  accepted: z11.boolean(),
+  accepted: z9.boolean(),
   /**
    * True when this device had already recorded this job's result.
    *
@@ -2188,196 +1595,923 @@ var ResultResponse = z11.object({
    * the same refusal it would get for a job that is *not* terminal, so a job
    * id cannot be used as a terminality probe.
    */
-  duplicate: z11.boolean().optional(),
+  duplicate: z9.boolean().optional(),
   /** The job's state after this submission. */
-  state: z11.string().min(1)
+  state: z9.string().min(1)
+}).strict();
+var ReleaseRequest = z9.object({
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  /**
+   * Which leases to release — the grant, not just the job.
+   *
+   * A release naming only a job id releases whatever lease exists at the
+   * moment it arrives, which for a replayed request is not the lease the
+   * daemon meant. See {@link Lease.id}.
+   */
+  leases: z9.array(GrantRef),
+  /**
+   * Why, so the app's runner list can say something true.
+   *
+   * `refused` is load-bearing, not cosmetic: the server cannot evaluate
+   * what a device will admit (§4.2), so it may legitimately offer
+   * a job this daemon then declines. The server MUST record the refusal and
+   * stop offering that job to that runner, or the pair would spin between
+   * claim and release forever.
+   */
+  reason: z9.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
 }).strict();
-var ReleaseRequest = z11.object({
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  runnerId: z11.string().min(1),
+var ReleaseResponse = z9.object({
+  released: z9.array(z9.string().min(1))
+}).strict();
+var WireErrorCode = z9.enum([
+  "bad-request",
+  "unsupported-protocol-version",
+  /**
+   * The daemon is older than this hub will serve — B052.
+   *
+   * Distinct from `unsupported-protocol-version`, which is about the
+   * contract; this is about the build. A daemon can speak protocol 1
+   * perfectly and still be old enough that we would rather move it than keep
+   * carrying it — and the two need different remedies in the message, since
+   * one is "your daemon and this server disagree" and the other is "yours
+   * works, and it is time".
+   *
+   * The floor is the backstop to the auto-updater (B053), and the only lever
+   * that reaches a machine which never opted into offers.
+   */
+  "daemon-below-floor",
+  // "We do not know who you are." Exactly 401, and only that — cloud_008
+  // §1.4d.
+  "unauthorized",
+  /**
+   * "We know exactly who you are, and the answer is no." Exactly 403.
+   *
+   * Five refusals across both planes served 403 with `unauthorized`, whose
+   * table entry is 401: a revoked device, a site claiming another site's
+   * stub, a job you do not hold, a device belonging to another owner, a
+   * relay that does not route for you. Every one of them is an *identified*
+   * caller being refused.
+   *
+   * Collapsing the two loses a distinction that matters everywhere it is
+   * read: a revoked daemon would look like an unsigned one in every log and
+   * every client branch, and "check your keys" is the wrong advice for both
+   * of them in opposite directions.
+   */
+  "forbidden",
+  "revoked",
+  "not-found",
+  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
+  //
+  // A daemon must retry rather than abandon: the job is legitimately still
+  // its own until the lease or the awaiting-payload clock says otherwise.
+  // That is why it cannot be `not-found` or `server-error`, and why it was
+  // the protocol gap that produced a bare 409 in the first place.
+  "not-ready",
+  /**
+   * The job is over, and this call is about a job — V1-6, and the code the
+   * site plane has been serving without one (V1-13).
+   *
+   * Distinct from `not-found`, which says "no such job", and from
+   * `not-ready`, which says "not yet, keep asking". This one says "yes, and
+   * it finished" — so a daemon must stop rather than retry, and a replayed
+   * request must not be able to reopen it.
+   */
+  "too-late",
+  // The caller's clock is too far from ours to judge a signature's freshness.
+  //
+  // Split out from `unauthorized` because the remedy is completely different
+  // and only the server can tell them apart: a bad signature means the key is
+  // wrong, this means the machine's time is wrong. A daemon reporting it as a
+  // generic rejection sends its owner looking at their network.
+  "clock-skew",
+  "rate-limited",
+  "server-error"
+]);
+var WireError = z9.object({
+  error: WireErrorCode,
+  message: z9.string().min(1),
+  /**
+   * What this server speaks, on `unsupported-protocol-version` — §B.4.
+   *
+   * The refusal has carried these since the version handshake existed and
+   * the enumeration did not model them, so the one error that exists to be
+   * *acted on* was the one that failed to parse as a wire error. Found by
+   * the relay's own suite the day the relay started sending it: a refusal
+   * outside the enumerated shape is a refusal a client cannot branch on,
+   * which is the whole reason §1.4 enumerates them.
+   *
+   * Modelled the way `clock-skew`'s two fields already are — code-specific
+   * extras, refused on any other code by the refinement below.
+   */
+  supported: z9.array(z9.string().min(1)).optional(),
+  minimum: z9.string().min(1).optional(),
+  /**
+   * The oldest daemon this hub serves, on `daemon-below-floor` — B052.
+   *
+   * Carried for the same reason `supported` and `minimum` are: a refusal
+   * that cannot be branched on is a refusal a client can only print. The
+   * message already names the floor for a person; this names it for the
+   * code, so a surface can say "you are two versions under" without
+   * parsing English.
+   */
+  floor: z9.string().min(1).optional(),
+  /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
+  retryAfter: z9.number().int().nonnegative().optional(),
+  /**
+   * The server's clock, and the window it allows. `clock-skew` only.
+   *
+   * So the far side can say *how far off* rather than *that something is
+   * wrong* — the difference between "adjust your clock by four minutes" and
+   * "something is wrong with your connection". Not a disclosure: the
+   * heartbeat response returns the same value, and so does every `Date`
+   * header.
+   */
+  serverTime: z9.number().int().positive().optional(),
+  maxSkewMs: z9.number().int().positive().optional()
+}).strict().superRefine((error, ctx) => {
+  const skew = error.error === "clock-skew";
+  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
+  if (skew && !carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: "clock-skew must carry serverTime and maxSkewMs"
+    });
+  }
+  if (!skew && carried) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry serverTime or maxSkewMs`
+    });
+  }
+  const floored = error.error === "daemon-below-floor";
+  if (floored && error.floor === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "daemon-below-floor must carry floor"
+    });
+  }
+  if (!floored && error.floor !== void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry floor`
+    });
+  }
+  const version = error.error === "unsupported-protocol-version";
+  const versionFields = error.supported !== void 0 || error.minimum !== void 0;
+  if (version && !versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: "unsupported-protocol-version must carry supported and minimum"
+    });
+  }
+  if (!version && versionFields) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${error.error} must not carry supported or minimum`
+    });
+  }
+});
+var ERROR_STATUS = Object.freeze({
+  "bad-request": 400,
+  "unsupported-protocol-version": 400,
+  /**
+   * 426 Upgrade Required — B052, and it is the one status that says this.
+   *
+   * Not 403, which this daemon reads as a permission problem and which
+   * sits beside `revoked` in every log. Not 400, which reads as a
+   * malformed request; the request was perfect and the sender is old.
+   *
+   * It also fails safely on a daemon that predates the code: 426 is not in
+   * that switch, so it lands on the 4xx default — `rejected`, which is
+   * "never retried: the request is wrong, and repeating it stays wrong".
+   * Vaguer than the remedy, and the right behaviour, which is what a
+   * fallback has to be.
+   */
+  "daemon-below-floor": 426,
+  unauthorized: 401,
+  forbidden: 403,
+  revoked: 403,
+  "not-found": 404,
+  // 409, not 404: the job exists and is yours, it is simply not ready.
+  "not-ready": 409,
+  // The same 409 as `not-ready` and the opposite instruction: that one says
+  // keep asking, this one says stop. The status is the class of the
+  // problem — a request that does not fit the resource's state — and the
+  // code is what a caller acts on.
+  "too-late": 409,
+  // 401 alongside `unauthorized`, because that is what it is — the
+  // signature could not be judged. The code is what carries the remedy.
+  "clock-skew": 401,
+  "rate-limited": 429,
+  "server-error": 500
+});
+var FetchRequest = z9.object({
+  // `literal`, like every other request — V1-17. This one said
+  // `string().min(1)`, so a daemon speaking a version this server does not
+  // know got past the handshake on the one endpoint that hands over a
+  // sealed payload. The version check exists so that a mismatch is a named
+  // refusal rather than a schema failure three fields later; here it was
+  // neither.
+  protocolVersion: z9.literal(PROTOCOL_VERSION),
+  runnerId: z9.string().min(1),
+  jobId: z9.string().min(1),
   /**
-   * Which leases to release — the grant, not just the job.
+   * The grant this daemon holds.
    *
-   * A release naming only a job id releases whatever lease exists at the
-   * moment it arrives, which for a replayed request is not the lease the
-   * daemon meant. See {@link Lease.id}.
+   * Named, not inferred: a fetch is lease-scoped, and a request that names
+   * only the job would be answerable for whatever lease exists when it
+   * arrives ({@link Lease.id}).
    */
-  leases: z11.array(GrantRef),
+  leaseId: z9.string().min(1)
+}).strict();
+var FetchResponse = z9.object({
   /**
-   * Why, so the app's runner list can say something true.
+   * The work, sealed to the device that claimed it — byollm_009 §6.
    *
-   * `refused` is load-bearing, not cosmetic: the server cannot evaluate
-   * what a device will admit (§4.2), so it may legitimately offer
-   * a job this daemon then declines. The server MUST record the refusal and
-   * stop offering that job to that runner, or the pair would spin between
-   * claim and release forever.
+   * Not plaintext. The site opens its own at-rest envelope and re-seals to
+   * the claiming device's key, signed by the site's identity, so the work
+   * is readable only by the machine that took it and only if it came from
+   * the site that machine pinned.
    */
-  reason: z11.enum(["shutdown", "pause", "revoked", "backend-down", "refused"])
+  envelope: SealedEnvelope
 }).strict();
-var ReleaseResponse = z11.object({
-  released: z11.array(z11.string().min(1))
+
+// src/update-offer.ts
+var UPDATE_OFFER_SINCE = "0.1.0-alpha.83";
+function parse(version) {
+  const match = /^(\d+)\.(\d+)\.(\d+)(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/.exec(
+    version
+  );
+  if (match === null) return void 0;
+  return {
+    release: [Number(match[1]), Number(match[2]), Number(match[3])],
+    pre: match[4] === void 0 ? [] : match[4].split(".").map((part) => /^\d+$/.test(part) ? Number(part) : part)
+  };
+}
+function compareVersions(a, b) {
+  const left = parse(a);
+  const right = parse(b);
+  if (left === void 0 || right === void 0) return void 0;
+  for (let i = 0; i < 3; i += 1) {
+    const diff = (left.release[i] ?? 0) - (right.release[i] ?? 0);
+    if (diff !== 0) return diff < 0 ? -1 : 1;
+  }
+  if (left.pre.length === 0 && right.pre.length > 0) return 1;
+  if (left.pre.length > 0 && right.pre.length === 0) return -1;
+  for (let i = 0; i < Math.max(left.pre.length, right.pre.length); i += 1) {
+    const l = left.pre[i];
+    const r = right.pre[i];
+    if (l === void 0) return -1;
+    if (r === void 0) return 1;
+    if (l === r) continue;
+    if (typeof l === "number" && typeof r === "number") return l < r ? -1 : 1;
+    if (typeof l === "number") return -1;
+    if (typeof r === "number") return 1;
+    return l < r ? -1 : 1;
+  }
+  return 0;
+}
+function mayOfferUpdate(daemonVersion) {
+  const order = compareVersions(daemonVersion, UPDATE_OFFER_SINCE);
+  return order !== void 0 && order >= 0;
+}
+function checkDaemonFloor(input) {
+  const order = compareVersions(input.daemonVersion, input.floor);
+  if (order === void 0 || order >= 0) return null;
+  return {
+    error: "daemon-below-floor",
+    message: `byollm ${input.daemonVersion} is below the supported floor (${input.floor}). Run \`${input.upgradeCommand}\`, then \`byollm start\`.`,
+    floor: input.floor
+  };
+}
+function updateOfferFor(input) {
+  const { offer, daemonVersion } = input;
+  if (offer === void 0) return {};
+  if (exactOffer(offer) === void 0) return {};
+  if (!mayOfferUpdate(daemonVersion)) return {};
+  if (daemonVersion === offer) return {};
+  return { updateTo: offer };
+}
+function exactOffer(value) {
+  return /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value) ? value : void 0;
+}
+
+// src/about.ts
+var ABOUT = `# About BYOLLM
+
+**What BYOLLM is**
+
+BYOLLM lets you use your own AI on websites. You install one small program on
+your computer. Then, websites that support BYOLLM can use the AI you already
+have \u2014 a free model running on your machine, or an AI service you already pay
+for \u2014 instead of the website paying for AI and passing the cost to you.
+
+**Why it matters**
+
+For you:
+
+- Your favorite model, everywhere you go.
+- New models the moment you get them \u2013 not when a site gets around to adding
+  them.
+- Encrypted end-to-end. Your prompts go to your own device; byollm.cloud can't
+  read them.
+- Sites never learn which model you use, and your subscriptions are never
+  shared.
+- Pay less. Sites that don't pay for AI can charge you less \u2013 or nothing.
+
+For sites and developers:
+
+- Zero AI bills. Your users bring their own compute.
+- No floating money \u2013 you don't pay LLM bills up front and hope to collect
+  later, and you never ask people to prepay just to try you.
+- Free trials that cost you nothing to offer.
+- Ship the AI features you kept private for fear of the API bill.
+- One small integration. Your users choose the models.
+
+**Your device**
+
+The \`byollm\` program runs on your computer. It knows which AI services you have
+set up: free open-source models on your machine, metered services you pay per
+use, or your own subscriptions like Claude Pro/Max. When a website you have
+enabled sends work, your device runs it with the service you chose. Your
+prompts are encrypted end-to-end to your own device. byollm.cloud passes them
+along and cannot read them.
+
+**Sites**
+
+A website that wants to use BYOLLM says what it needs \u2014 "writing help," "chat,"
+and so on. When you connect the site, you pick which of your services answers
+each one. The site never learns which model you use. You can turn a site off at
+any time, and it stops getting your work.
+
+**Teams (optional)**
+
+A team lets you share what runs on your devices with people you name \u2014 the free
+open-source models on your machine, or a metered service with a spending limit
+you set. Your subscription accounts (like Claude Pro/Max) are never shared with
+anyone. That is a rule, not a setting.
+
+**byollm.cloud (or your own relay)**
+
+Many sites, many devices, many people. byollm.cloud keeps track of who has
+allowed what and sends each job to the right device. It never sees your
+prompts. If you would rather run this part yourself, the relay is open source \u2014
+you can run your own instead of using byollm.cloud.`;
+var ABOUT_SHORT_LEDE = "BYOLLM \u2013 Bring Your Own LLM \u2013 lets you use your own AI on websites you authorize. A small program installed on your machine lets you use your own models and subscriptions on any BYOLLM-integrated site, including new models the moment you get access \u2013 no site updates required. BYOLLM Cloud connects sites to your devices with end-to-end encryption, so no one, including us, can see your data.";
+var ABOUT_SHORT_TAIL = "Sites can charge you less because you bring your own \u2013 see why that matters \u2192. Teams can optionally share the free or metered services on their devices with people they name. Personal subscriptions are never shared.";
+var ABOUT_SHORT = `${ABOUT_SHORT_LEDE}
+
+${ABOUT_SHORT_TAIL}`;
+
+// src/signing.ts
+import { createHash as createHash2 } from "crypto";
+import { z as z10 } from "zod";
+var MAX_CLOCK_SKEW_MS = 12e4;
+var RequestSignature = z10.object({
+  /** Which runner is calling. The server looks up its pinned identity. */
+  runnerId: z10.string().min(1),
+  /** Epoch ms, bounded by {@link MAX_CLOCK_SKEW_MS}. */
+  issuedAt: z10.number().int().positive(),
+  /** Base64url Ed25519 signature over {@link canonicalRequest}. */
+  signature: z10.string().min(1)
 }).strict();
-var WireErrorCode = z11.enum([
-  "bad-request",
-  "unsupported-protocol-version",
-  // "We do not know who you are." Exactly 401, and only that — cloud_008
-  // §1.4d.
-  "unauthorized",
+function canonicalRequest(input) {
+  const digest = createHash2("sha256").update(input.body, "utf8").digest("hex");
+  return Buffer.from(
+    [
+      "byollm/v1/request",
+      input.endpoint,
+      input.runnerId,
+      String(input.issuedAt),
+      digest
+    ].join("\n"),
+    "utf8"
+  );
+}
+function signRequest(keys, input) {
+  return {
+    runnerId: input.runnerId,
+    issuedAt: input.issuedAt,
+    signature: signWith(keys, canonicalRequest(input))
+  };
+}
+function signSiteRequest(keys, input) {
+  return signRequest(keys, {
+    endpoint: siteEndpoint(input.endpoint),
+    runnerId: input.siteId,
+    issuedAt: input.issuedAt,
+    body: input.body
+  });
+}
+function verifySiteRequest(input) {
+  return verifyRequest({
+    ...input,
+    endpoint: siteEndpoint(input.endpoint)
+  });
+}
+var siteEndpoint = (endpoint) => `site/${endpoint}`;
+function verifyRequest(input) {
+  const skew = input.maxSkewMs ?? MAX_CLOCK_SKEW_MS;
+  if (Math.abs(input.now - input.signature.issuedAt) > skew) return "stale";
+  const ok = verifyWith(
+    input.identityPublic,
+    canonicalRequest({
+      endpoint: input.endpoint,
+      runnerId: input.signature.runnerId,
+      issuedAt: input.signature.issuedAt,
+      body: input.body
+    }),
+    input.signature.signature
+  );
+  return ok ? null : "bad-signature";
+}
+
+// src/manifest.ts
+import { z as z11 } from "zod";
+var RESERVED_PURPOSE = "default";
+var RENDERABLE = /^[^\p{Cc}\p{Cf}\p{Cs}\p{Co}]+$/u;
+var renderable = (max, what) => z11.string().min(1).max(max).regex(
+  RENDERABLE,
+  `a ${what} is text a person reads \u2014 no control characters, direction overrides or zero-width padding`
+).refine((value) => value.trim() !== "", {
+  message: `a ${what} cannot be blank`
+});
+var PurposeKey = z11.string().regex(
+  /^[a-z0-9][a-z0-9-]*$/,
+  "a purpose key is a lowercase slug \u2014 letters, digits and hyphens"
+).max(64);
+var Purpose = z11.object({
   /**
-   * "We know exactly who you are, and the answer is no." Exactly 403.
-   *
-   * Five refusals across both planes served 403 with `unauthorized`, whose
-   * table entry is 401: a revoked device, a site claiming another site's
-   * stub, a job you do not hold, a device belonging to another owner, a
-   * relay that does not route for you. Every one of them is an *identified*
-   * caller being refused.
+   * What a person reads on the consent screen. The only rendered field.
    *
-   * Collapsing the two loses a distinction that matters everywhere it is
-   * read: a revoked daemon would look like an unsigned one in every log and
-   * every client branch, and "check your keys" is the wrong advice for both
-   * of them in opposite directions.
+   * Declared rather than derived from the key, because a key is a
+   * compromise between machines and this is not. "Writing Assistant" is
+   * what somebody understands; `writing-assistant` is what travels.
    */
-  "forbidden",
-  "revoked",
-  "not-found",
-  // Claimed, but the site has not sealed the payload yet — cloud_008 §1.4.
-  //
-  // A daemon must retry rather than abandon: the job is legitimately still
-  // its own until the lease or the awaiting-payload clock says otherwise.
-  // That is why it cannot be `not-found` or `server-error`, and why it was
-  // the protocol gap that produced a bare 409 in the first place.
-  "not-ready",
+  label: renderable(80, "label"),
+  /** One line of context for the consent screen. Optional. */
+  description: renderable(280, "description").optional(),
   /**
-   * The job is over, and this call is about a job — V1-6, and the code the
-   * site plane has been serving without one (V1-13).
+   * The kinds this purpose uses.
    *
-   * Distinct from `not-found`, which says "no such job", and from
-   * `not-ready`, which says "not yet, keep asking". This one says "yes, and
-   * it finished" — so a daemon must stop rather than retry, and a replayed
-   * request must not be able to reopen it.
+   * A purpose may span kinds, and a mapping is per (purpose, kind) — so a
+   * person can send this purpose's chat to one service and its generation
+   * to another. Listing a kind here is what makes that slot appear.
    */
-  "too-late",
-  // The caller's clock is too far from ours to judge a signature's freshness.
-  //
-  // Split out from `unauthorized` because the remedy is completely different
-  // and only the server can tell them apart: a bad signature means the key is
-  // wrong, this means the machine's time is wrong. A daemon reporting it as a
-  // generic rejection sends its owner looking at their network.
-  "clock-skew",
-  "rate-limited",
-  "server-error"
-]);
-var WireError = z11.object({
-  error: WireErrorCode,
-  message: z11.string().min(1),
+  kinds: z11.array(JobKind).min(1).max(JOB_KINDS.length).refine((kinds) => new Set(kinds).size === kinds.length, {
+    message: "a purpose lists each kind once"
+  })
+}).strict();
+var MAX_PURPOSES = 32;
+var Manifest = z11.record(PurposeKey, Purpose).refine((manifest) => Object.keys(manifest).length > 0, {
+  message: "a manifest declares at least one purpose"
+}).refine((manifest) => Object.keys(manifest).length <= MAX_PURPOSES, {
+  message: `a manifest declares at most ${String(MAX_PURPOSES)} purposes \u2014 a consent screen is a set of questions somebody answers one at a time`
+}).refine((manifest) => !(RESERVED_PURPOSE in manifest), {
+  message: `"${RESERVED_PURPOSE}" is reserved for a site that declares no purposes of its own \u2014 give this one a name from your own vocabulary`
+});
+function singlePurposeManifest(input) {
+  return {
+    [RESERVED_PURPOSE]: { label: input.label, kinds: [...input.kinds] }
+  };
+}
+
+// src/musts.ts
+function kindsOf(must2) {
+  return typeof must2.verifiedBy === "string" ? [must2.verifiedBy] : must2.verifiedBy;
+}
+var must = (m) => Object.freeze(m);
+var MUSTS = Object.freeze({
+  // ---- Pairing and identity -------------------------------------------
+  PAIR_ONE_USER: must({
+    id: "PAIR_ONE_USER",
+    statement: "A runner token MUST be bound to exactly one user; a daemon MUST refuse work not attributable to its paired user.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  PAIR_INTERACTIVE: must({
+    id: "PAIR_INTERACTIVE",
+    statement: "Pairing MUST be interactive (device-code approval in the app's own session); a long-lived pasted secret MUST NOT be accepted as pairing.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Endpoints.1"
+  }),
+  PAIR_CODE_EXPIRES: must({
+    id: "PAIR_CODE_EXPIRES",
+    statement: "An unapproved device code MUST expire and MUST NOT be redeemable after expiry.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Endpoints.1"
+  }),
+  // ---- Typed job kinds --------------------------------------------------
+  VERSION_HANDSHAKE_REQUIRED: must({
+    id: "VERSION_HANDSHAKE_REQUIRED",
+    statement: "Every protocol request MUST declare a protocol version, and a server MUST refuse an absent or unsupported one with a structured error naming what it supports \u2014 never a generic parse failure.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74"
+  }),
+  SITE_KEY_BY_STUB: must({
+    id: "SITE_KEY_BY_STUB",
+    statement: "A daemon MUST verify a job's payload against the pinned key of the site the stub names, and MUST refuse a job naming a site it has not pinned. It MUST NOT fall back to another pinned key, and MUST refuse an envelope whose declared sender disagrees with the stub's site.",
+    enforcedBy: "daemon",
+    // Adversarial, and the reason is the finding that produced it: the
+    // honest paths pass with every site check deleted, because `open`
+    // refuses a signature from the wrong key anyway. What distinguishes an
+    // enforced rule from a coincidence here is a hostile pairing of stub and
+    // envelope, which no conformance client would ever send.
+    verifiedBy: "adversarial",
+    source: "byollm_009 \xA7A.3"
+  }),
+  SITES_LOCALLY_APPROVED: must({
+    id: "SITES_LOCALLY_APPROVED",
+    statement: "A daemon MUST NOT run work for a site on an upstream's word alone. An upstream may propose a site set; work for any site in it MUST additionally carry a grant signed by the control-plane key this daemon pinned at pairing. A key that has changed for an id this daemon already pinned MUST be refused for the life of the pairing, including after that id has left the set and returned. A **verified succession** is not a changed key: a new key id carrying a signature, by a key this daemon has already pinned, over a statement naming both key ids MUST be accepted \u2014 provided the control plane projects the same successor \u2014 and MUST be announced rather than applied silently. The first job from a site this daemon has never served MUST be announced at the machine.",
+    enforcedBy: "daemon",
+    // Two kinds, and the second is the one that matters — V1-1.
+    //
+    // `construction`: the daemon cannot serve a site that is not in its
+    // pinned map, and admission refuses before a payload is fetched — and
+    // since byollm_016 Amendment K, being in the map is no longer sufficient
+    // either: a signed grant is, and the relay proposing the set cannot
+    // produce one.
+    //
+    // `adversarial`: the property that survives is about a *sequence* —
+    // remove the id, re-offer it under a different key — which no honest
+    // upstream sends and which the fence above does not see. That was the
+    // bypass: the pin was deleted with the id, so the comparison had nothing
+    // to compare against and the substitution arrived as a stranger.
+    // **Not `conformance`, and that is a live gap rather than a judgement.**
+    // Amendment C's succession clause is a rule about two implementations
+    // agreeing, which is what a conformance check is for — but rotating a
+    // site's key is not something `ConformanceTarget` can express, and adding
+    // an optional hook that most targets omit would produce a check reporting
+    // success for a reason unrelated to the property it claims. That is this
+    // project's most-repeated bug, and it is not worth reintroducing for a
+    // stronger-sounding word in a table. The rotation path is verified by
+    // `site-rotation.test.ts` (both directions, against the shipped runner)
+    // and `relay/test/rotation.test.ts` (both planes, against the reference
+    // relay); the missing piece is a second *independent* implementation to
+    // check them against, and there is not one yet.
+    verifiedBy: ["construction", "adversarial"],
+    source: "byollm_009 \xA7B.2, Amendment C"
+  }),
+  KEYS_EXCHANGED_AT_CONSENT: must({
+    id: "KEYS_EXCHANGED_AT_CONSENT",
+    statement: "Pairing MUST exchange both parties' public identities; each side MUST verify that the encryption key is signed by the identity presenting it, and MUST pin the identity. Keys MUST NOT be delivered before approval.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA75"
+  }),
+  REQUESTS_SIGNED_NOT_BEARER: must({
+    id: "REQUESTS_SIGNED_NOT_BEARER",
+    statement: "Every authenticated request MUST be signed by the calling device's pinned identity key, over the endpoint, the runner id, a timestamp and the exact request body. A server MUST NOT accept a bearer credential in place of a signature.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74.2"
+  }),
+  LEASE_SCOPED_BY_GRANT: must({
+    id: "LEASE_SCOPED_BY_GRANT",
+    statement: "A lease-scoped request MUST name the lease it acts on, and a server MUST apply it only to that lease. Naming the job and the runner is not sufficient: both survive a claim-release-reclaim cycle.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA74.2"
+  }),
+  STUB_METADATA_EXHAUSTIVE: must({
+    id: "STUB_METADATA_EXHAUSTIVE",
+    statement: "A claim MUST answer with stubs carrying exactly the enumerated fields and no payload. An endpoint MUST NOT emit a stub carrying others, and an upstream MUST NOT require any.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA76"
+  }),
+  ENVELOPE_SEALED_AND_SIGNED: must({
+    id: "ENVELOPE_SEALED_AND_SIGNED",
+    statement: "A stored payload MUST be sealed, and MUST be signed by the sender's identity key. An endpoint MUST refuse an envelope whose signature does not verify against the identity it pinned.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA76"
+  }),
+  KIND_TYPED_ONLY: must({
+    id: "KIND_TYPED_ONLY",
+    statement: "Job kinds MUST resolve against handlers baked into the daemon. A daemon MUST refuse an unknown kind rather than guess.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Jobs are typed data"
+  }),
+  KIND_NO_CODE: must({
+    id: "KIND_NO_CODE",
+    statement: "A server MUST NOT be able to convey code, a shell string, or a path to execute; payloads are data handed to a model only.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Jobs are typed data; byollm_004 \xA71"
+  }),
+  // ---- Capability and claiming -----------------------------------------
+  CLAIM_REQUIRES_CAPABILITY: must({
+    id: "CLAIM_REQUIRES_CAPABILITY",
+    statement: "A daemon MUST NOT be given a job whose kind is absent from its advertised capability matrix.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  CAPABILITY_IS_DETECTED: must({
+    id: "CAPABILITY_IS_DETECTED",
+    statement: "An advertised capability matrix MUST be the intersection of owner config and detected, healthy reality \u2014 never config alone.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_002 \xA7Routing"
+  }),
+  CLAIM_ATOMIC: must({
+    id: "CLAIM_ATOMIC",
+    statement: "Claiming MUST be atomic: a job MUST NOT be handed to two runners concurrently.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Endpoints.2"
+  }),
+  // ---- Leases -----------------------------------------------------------
+  LEASE_HONORED: must({
+    id: "LEASE_HONORED",
+    statement: "A daemon MUST stop work on a job whose lease it has failed to renew, and MUST NOT report a result for an expired lease it no longer holds.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  LEASE_RECLAIMABLE: must({
+    id: "LEASE_RECLAIMABLE",
+    statement: "A lease that expires un-renewed MUST make its job claimable again with no loss of the job.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Endpoints.2"
+  }),
+  // ---- Audience and offer scope ----------------------------------------
+  AUDIENCE_BOTH_SIDES: must({
+    id: "AUDIENCE_BOTH_SIDES",
+    statement: "A job MUST run on a daemon only if the daemon's offer scope admits the job's owner AND the job's audience admits the daemon's owner.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7The audience model"
+  }),
+  SUBSCRIPTION_SELF_LOCK: must({
+    id: "SUBSCRIPTION_SELF_LOCK",
+    statement: "A subscription-class backend's offer scope MUST be 'private' and MUST NOT be widened by configuration.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7The audience model"
+  }),
+  METERED_DEFAULTS_SELF: must({
+    id: "METERED_DEFAULTS_SELF",
+    statement: "A metered backend's effective offer scope MUST be 'private' unless the owner has explicitly acknowledged spending money on others' work.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA74"
+  }),
+  METERED_REQUIRES_CEILING: must({
+    id: "METERED_REQUIRES_CEILING",
+    statement: "A widened metered backend MUST carry a spend ceiling, and the daemon MUST refuse community work once it is reached.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA74"
+  }),
+  COST_NOT_CONFIGURABLE: must({
+    id: "COST_NOT_CONFIGURABLE",
+    statement: "A built-in provider's cost class MUST NOT be overridable by configuration.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA72"
+  }),
+  REMOTE_IS_NEVER_FREE: must({
+    id: "REMOTE_IS_NEVER_FREE",
+    statement: "A generic HTTP backend whose base URL is not loopback or private MUST be treated as metered.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_007 \xA72"
+  }),
+  NAMED_LOCAL_ALLOWLIST: must({
+    id: "NAMED_LOCAL_ALLOWLIST",
+    statement: "A 'team' job MUST be admitted only by something the device itself verified, keyed by (server origin, user id) \u2014 never on the routing party's assertion alone.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 Rev 1 \xA7B"
+  }),
+  REFUSAL_NOT_REOFFERED: must({
+    id: "REFUSAL_NOT_REOFFERED",
+    statement: "A server MUST NOT re-offer a job to a runner that released it with reason 'refused'.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 Rev 1 \xA7B (loop resolved in build review)"
+  }),
+  // ---- Revocation and cancel -------------------------------------------
+  REVOCATION_HONORED: must({
+    id: "REVOCATION_HONORED",
+    statement: "A revoked daemon MUST stop claiming and MUST abandon in-flight work by the next heartbeat at the latest.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  CANCEL_HONORED: must({
+    id: "CANCEL_HONORED",
+    statement: "A job id in a heartbeat response's cancel list MUST abort that job's in-flight backend call and be reported as 'canceled'.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 Rev 1 \xA7C"
+  }),
+  // ---- Lifecycle, dependencies, delivery -------------------------------
+  DEPENDS_ON_GATING: must({
+    id: "DEPENDS_ON_GATING",
+    statement: "A job MUST NOT be claimable until every job in its dependsOn set has reached the 'ok' state.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 Rev 1 \xA7E"
+  }),
+  TTL_EXPIRY: must({
+    id: "TTL_EXPIRY",
+    statement: "An unclaimed job MUST become 'expired' once its TTL elapses, and the TTL clock MUST start when the job becomes claimable, not at enqueue.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 Rev 1 \xA7D (TTL clock resolved in build review)"
+  }),
+  NO_RUNNER_SIGNAL: must({
+    id: "NO_RUNNER_SIGNAL",
+    statement: "A server MUST surface noRunnerAvailable when no runner with matching capability has heartbeated within the liveness window, and MUST NOT raise it for a job still blocked on dependencies.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 Rev 1 \xA7D"
+  }),
+  RESULT_IDEMPOTENT: must({
+    id: "RESULT_IDEMPOTENT",
+    statement: "Result submission MUST be idempotent by job id; the first terminal outcome wins and later submissions MUST NOT change it.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7Endpoints.4"
+  }),
+  PROVENANCE_NAMES_DEVICE: must({
+    id: "PROVENANCE_NAMES_DEVICE",
+    statement: "A result MUST carry the claiming device's key id and its relationship to the requester, to the delivery seam, so an app never treats volunteer output as first-party. The key id MUST be the device the upstream granted the lease to, and a result whose signature does not verify against that device MUST be refused rather than recorded.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  // ---- The trust surface -------------------------------------------------
+  INGRESS_LOGGED_BEFORE_EXECUTION: must({
+    id: "INGRESS_LOGGED_BEFORE_EXECUTION",
+    statement: "Every executed prompt MUST be appended to the local ingress log before execution begins.",
+    enforcedBy: "daemon",
+    verifiedBy: "conformance",
+    source: "byollm_001 \xA7MUSTs"
+  }),
+  // ---- Execution isolation (byollm_004) ---------------------------------
+  NO_SHELL_INTERPOLATION: must({
+    id: "NO_SHELL_INTERPOLATION",
+    statement: "Process-class backends MUST be invoked with a fixed argv array and the payload delivered on stdin; payload text MUST NOT reach a command line.",
+    enforcedBy: "daemon",
+    verifiedBy: "adversarial",
+    source: "byollm_004 \xA72"
+  }),
   /**
-   * What this server speaks, on `unsupported-protocol-version` — §B.4.
+   * Amended for byollm_016 Phase B, and the amendment is deliberately narrow.
    *
-   * The refusal has carried these since the version handshake existed and
-   * the enumeration did not model them, so the one error that exists to be
-   * *acted on* was the one that failed to parse as a wire error. Found by
-   * the relay's own suite the day the relay started sending it: a refusal
-   * outside the enumerated shape is a refusal a client cannot branch on,
-   * which is the whole reason §1.4 enumerates them.
+   * A site may now name a **service** on the stub. The temptation is to read
+   * that as a crack in this law, so the statement below says exactly where the
+   * line is: a name selects from a menu the owner published, and resolves to a
+   * model, backend, base URL and flags **only** through that owner's own
+   * config. The site supplies a key; the owner supplies every value it maps
+   * to. A name the owner does not advertise is refused rather than
+   * substituted, because substitution is how "you may pick from my list" turns
+   * into "you may ask for anything and get something".
    *
-   * Modelled the way `clock-skew`'s two fields already are — code-specific
-   * extras, refused on any other code by the refinement below.
-   */
-  supported: z11.array(z11.string().min(1)).optional(),
-  minimum: z11.string().min(1).optional(),
-  /** Seconds; mirrors Retry-After for `rate-limited` and `server-error`. */
-  retryAfter: z11.number().int().nonnegative().optional(),
-  /**
-   * The server's clock, and the window it allows. `clock-skew` only.
+   * Two properties keep it from drifting into "sites demand models":
    *
-   * So the far side can say *how far off* rather than *that something is
-   * wrong* — the difference between "adjust your clock by four minutes" and
-   * "something is wrong with your connection". Not a disclosure: the
-   * heartbeat response returns the same value, and so does every `Date`
-   * header.
+   *   1. **Nothing the site sends is ever a value.** No model string, no URL,
+   *      no flag crosses the wire — only a key that means nothing off this
+   *      owner's machine.
+   *   2. **It is a stub field, never a payload field.** The prompt cannot
+   *      reach it. That is unchanged and is the sentence the second clause
+   *      below still enforces verbatim.
    */
-  serverTime: z11.number().int().positive().optional(),
-  maxSkewMs: z11.number().int().positive().optional()
-}).strict().superRefine((error, ctx) => {
-  const skew = error.error === "clock-skew";
-  const carried = error.serverTime !== void 0 || error.maxSkewMs !== void 0;
-  if (skew && !carried) {
-    ctx.addIssue({
-      code: "custom",
-      message: "clock-skew must carry serverTime and maxSkewMs"
-    });
-  }
-  if (!skew && carried) {
-    ctx.addIssue({
-      code: "custom",
-      message: `${error.error} must not carry serverTime or maxSkewMs`
-    });
-  }
-  const version = error.error === "unsupported-protocol-version";
-  const versionFields = error.supported !== void 0 || error.minimum !== void 0;
-  if (version && !versionFields) {
-    ctx.addIssue({
-      code: "custom",
-      message: "unsupported-protocol-version must carry supported and minimum"
-    });
-  }
-  if (!version && versionFields) {
-    ctx.addIssue({
-      code: "custom",
-      message: `${error.error} must not carry supported or minimum`
-    });
-  }
+  NO_PAYLOAD_ROUTING: must({
+    id: "NO_PAYLOAD_ROUTING",
+    statement: "Model, backend, base URL, and flags MUST come from owner config only; a payload MUST NOT influence any of them. A stub MAY name a service the owner advertises, which selects among that owner's own config entries and MUST NOT introduce any value the owner did not write; an unadvertised name MUST be refused, never substituted.",
+    enforcedBy: "daemon",
+    verifiedBy: "adversarial",
+    source: "byollm_004 \xA72, amended byollm_016 \xA7Phase B"
+  }),
+  STRIPPED_CHILD_ENV: must({
+    id: "STRIPPED_CHILD_ENV",
+    statement: "Process-class children MUST spawn with an allowlisted environment, a scratch cwd, no inherited descriptors beyond std streams, and hard timeout and output-size caps.",
+    enforcedBy: "daemon",
+    verifiedBy: "adversarial",
+    source: "byollm_004 \xA72"
+  }),
+  HTTP_BASE_URL_SAFE: must({
+    id: "HTTP_BASE_URL_SAFE",
+    statement: "HTTP-class backends MUST send requests only to the owner-configured base URL and MUST refuse base URLs resolving to cloud-metadata or link-local addresses.",
+    enforcedBy: "daemon",
+    verifiedBy: "adversarial",
+    source: "byollm_004 Rev 1 \xA7Backend taxonomy"
+  }),
+  OUTPUT_INERT: must({
+    id: "OUTPUT_INERT",
+    statement: "Returned text MUST be treated as inert bytes: never evaluated, never written to a payload-named path, never interpolated into a shell or into terminal control sequences when logged.",
+    enforcedBy: "daemon",
+    verifiedBy: "adversarial",
+    source: "byollm_004 \xA72"
+  }),
+  COMMUNITY_BUDGETS: must({
+    id: "COMMUNITY_BUDGETS",
+    statement: "Jobs whose owner is not the daemon's owner MUST be subject to the owner's rate limits, daily cap, and resource budget.",
+    enforcedBy: "daemon",
+    verifiedBy: "adversarial",
+    source: "byollm_004 \xA74"
+  }),
+  REVOCATION_IMMEDIATE: must({
+    id: "REVOCATION_IMMEDIATE",
+    statement: "Revocation MUST take effect at the upstream at once \u2014 a revoked runner MUST NOT be granted further work from the moment the record changes \u2014 and MUST reach the daemon by its next heartbeat.",
+    // Both, and stated as one sentence with two obligations rather than
+    // folded into REVOCATION_HONORED. That one binds the *daemon*: a revoked
+    // daemon stops claiming and abandons in-flight work. This binds the
+    // *upstream*. byollm_009 §5 is explicit that the pair is the point — "a
+    // revocation enforced at one end survives a compromise of that end" — and
+    // one entry covering both would make a compromised daemon look compliant.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  CONSENT_BEFORE_ROUTE: must({
+    id: "CONSENT_BEFORE_ROUTE",
+    statement: "An upstream MUST NOT route a job to a device without a record binding that user, that site and that scope. There MUST be no discovery path by which a device receives work it was never granted.",
+    enforcedBy: "server",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  ROSTER_NOT_DISCLOSED: must({
+    id: "ROSTER_NOT_DISCLOSED",
+    statement: "A site MUST NOT learn the membership of a group whose compute it uses, and MUST NOT publish membership to a routing party. No wire message may carry a list of who may run a job.",
+    // Checkable since cloud_008 §0.2 took `audienceAllow` off the stub: the
+    // property now holds by *absence*, and absence is exactly what a strict
+    // schema and a serialised stub can be asked about. Before that it was a
+    // sentence — and one this project cited in code comments, tests and two
+    // specs as though it were enforced data, which is why it is worth
+    // stating precisely rather than generously.
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  EFFECTIVE_OFFER_ONLY: must({
+    id: "EFFECTIVE_OFFER_ONLY",
+    statement: "A daemon MUST declare effective offers only. An upstream MUST NOT receive raw config, allowlists, or capacity the owner has not shared, and MUST act on the declared offer rather than on what was asked for.",
+    enforcedBy: "both",
+    verifiedBy: "conformance",
+    source: "byollm_009 \xA711"
+  }),
+  FALLBACK_LABELED: must({
+    id: "FALLBACK_LABELED",
+    statement: "Work served by anything other than the user's own compute MUST be labelled as such wherever it is reported, and MUST NOT be silently substituted.",
+    // `construction` today, and deliberately not `conformance`. Nothing on
+    // the wire yet distinguishes a fallback from any other community job —
+    // the ledger that would give it a surface is unbuilt — so a check would
+    // have to assert something it cannot observe. Promoted the day that
+    // surface exists. Marking it `conformance` now would put "verified"
+    // beside a property no third party can see, which is the one thing the
+    // kinds exist to prevent.
+    enforcedBy: "both",
+    verifiedBy: "construction",
+    source: "byollm_009 \xA711"
+  }),
+  RELAY_BLIND: must({
+    id: "RELAY_BLIND",
+    statement: "A relay MUST NOT hold any key capable of decrypting a payload, a result, or a delta frame.",
+    // Operator: a third party can read the relay's types and see there is
+    // nowhere to put such a key, but the kit certifies a *server* and cannot
+    // reach inside somebody's deployment to prove what it holds.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  }),
+  SHARED_COMPUTE_DISCLOSED: must({
+    id: "SHARED_COMPUTE_DISCLOSED",
+    statement: "Before a user's work first runs on compute they do not own, they MUST be told in plain language that the machine's owner can see it.",
+    // Operator, and cloud_008 §0.3 is why the classification now comes with a
+    // standing answer rather than a standing question. The screen is not
+    // wire-observable, but the *string the server composes* is, and it is
+    // now unit-tested with the two false sentences forbidden by name. The
+    // kind stays `operator` because a third-party site can still render
+    // whatever it likes; what changed is that the part inside our own
+    // boundary stopped depending on somebody remembering to audit it.
+    enforcedBy: "server",
+    verifiedBy: "operator",
+    source: "byollm_009 \xA711"
+  })
 });
-var ERROR_STATUS = Object.freeze({
-  "bad-request": 400,
-  "unsupported-protocol-version": 400,
-  unauthorized: 401,
-  forbidden: 403,
-  revoked: 403,
-  "not-found": 404,
-  // 409, not 404: the job exists and is yours, it is simply not ready.
-  "not-ready": 409,
-  // The same 409 as `not-ready` and the opposite instruction: that one says
-  // keep asking, this one says stop. The status is the class of the
-  // problem — a request that does not fit the resource's state — and the
-  // code is what a caller acts on.
-  "too-late": 409,
-  // 401 alongside `unauthorized`, because that is what it is — the
-  // signature could not be judged. The code is what carries the remedy.
-  "clock-skew": 401,
-  "rate-limited": 429,
-  "server-error": 500
+var RETIRED_MUSTS = Object.freeze({
+  RESULT_PROVENANCE: {
+    supersededBy: "PROVENANCE_NAMES_DEVICE",
+    note: "Strengthened, not renamed: attribution is now by proof of possession \u2014 the result's signature must verify against the device the upstream granted the lease to \u2014 rather than by a provenance label travelling beside it. byollm_009 \xA711 states the stronger form."
+  }
 });
-var FetchRequest = z11.object({
-  // `literal`, like every other request — V1-17. This one said
-  // `string().min(1)`, so a daemon speaking a version this server does not
-  // know got past the handshake on the one endpoint that hands over a
-  // sealed payload. The version check exists so that a mismatch is a named
-  // refusal rather than a schema failure three fields later; here it was
-  // neither.
-  protocolVersion: z11.literal(PROTOCOL_VERSION),
-  runnerId: z11.string().min(1),
-  jobId: z11.string().min(1),
-  /**
-   * The grant this daemon holds.
-   *
-   * Named, not inferred: a fetch is lease-scoped, and a request that names
-   * only the job would be answerable for whatever lease exists when it
-   * arrives ({@link Lease.id}).
-   */
-  leaseId: z11.string().min(1)
-}).strict();
-var FetchResponse = z11.object({
-  /**
-   * The work, sealed to the device that claimed it — byollm_009 §6.
-   *
-   * Not plaintext. The site opens its own at-rest envelope and re-seals to
-   * the claiming device's key, signed by the site's identity, so the work
-   * is readable only by the machine that took it and only if it came from
-   * the site that machine pinned.
-   */
-  envelope: SealedEnvelope
-}).strict();
+var MUST_IDS = Object.freeze(Object.keys(MUSTS));
+function mustsVerifiedBy(kind) {
+  return MUST_IDS.filter((id) => kindsOf(MUSTS[id]).includes(kind));
+}
 export {
   ABOUT,
   ABOUT_SHORT,
@@ -2472,6 +2606,8 @@ export {
   StoredKeys,
   Succession,
   TERMINAL_STATES,
+  UPDATE_OFFER_SINCE,
+  UPGRADE_COMMAND,
   WireError,
   WireErrorCode,
   WithheldKind,
@@ -2479,8 +2615,10 @@ export {
   backendName,
   canTransition,
   canonicalRequest,
+  checkDaemonFloor,
   checkProtocolVersion,
   classifyCost,
+  compareVersions,
   cryptoReady,
   declaredVersion,
   effectiveOfferScope,
@@ -2496,6 +2634,7 @@ export {
   keyId,
   kindsOf,
   matchAudience,
+  mayOfferUpdate,
   mustsVerifiedBy,
   open,
   payloadTextLength,
@@ -2512,6 +2651,7 @@ export {
   sizeClassCeiling,
   sizeClassOf,
   successionStatement,
+  updateOfferFor,
   verifyGrant,
   verifyLink,
   verifyPublicIdentity,