@byollm/protocol 0.1.0-alpha.87 → 0.1.0-alpha.89

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.87`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.89`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npm install @byollm/protocol@alpha`.
 >

package/dist/index.d.ts

@@ -1600,6 +1600,44 @@ declare function provenanceFor(input: {
  * opens them, nothing in between sees them, and the disposition check that
  * already compares clear-text against ciphertext extends to cover them.
  */
+/**
+ * The closed set, as a schema — so the values exist once.
+ *
+ * A bare union would mean anything that has to VALIDATE a stop reason (the
+ * ingress log, and the wire when step 4 lands) retyping the four strings
+ * beside it. Instruction 9: one definition, both ends, and where a consumer
+ * needs a runtime check the definition has to be one it can run.
+ *
+ * The type below is inferred from this rather than written twice, so the
+ * compiler and the validator cannot disagree about what a stop reason is.
+ */
+declare const StopReasonSchema: z.ZodEnum<{
+    length: "length";
+    unknown: "unknown";
+    end: "end";
+    "stop-sequence": "stop-sequence";
+}>;
+type StopReason = 
+/** The model finished on its own. */
+"end"
+/** The model stopped at its own output ceiling. */
+ | "length"
+/** A configured stop token ended it. */
+ | "stop-sequence"
+/**
+ * The adapter cannot tell, and says so.
+ *
+ * **The default, and never `"end"`.** An adapter nobody has updated — or
+ * one somebody adds next year — must not be able to claim completion by
+ * saying nothing. If absence meant "end", every un-updated adapter would go
+ * on telling exactly the lie this exists to fix, and every new adapter
+ * would inherit it in silence.
+ *
+ * It is the opposite-boolean rule this codebase keeps arriving at: when you
+ * cannot tell, guess toward silence rather than toward a claim. "We do not
+ * know" is a thing a site can act on; "it finished" when it did not is not.
+ */
+ | "unknown";
 declare const RunMetadata: z.ZodObject<{
     model: z.ZodString;
     backendClass: z.ZodEnum<{
@@ -1607,6 +1645,13 @@ declare const RunMetadata: z.ZodObject<{
         process: "process";
     }>;
     durationMs: z.ZodNumber;
+    stop: z.ZodOptional<z.ZodEnum<{
+        length: "length";
+        unknown: "unknown";
+        end: "end";
+        "stop-sequence": "stop-sequence";
+    }>>;
+    stopReported: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 type RunMetadata = z.infer<typeof RunMetadata>;
 /** Successful outcome. */
@@ -1717,6 +1762,13 @@ declare const SealedOutcome: z.ZodObject<{
             process: "process";
         }>;
         durationMs: z.ZodNumber;
+        stop: z.ZodOptional<z.ZodEnum<{
+            length: "length";
+            unknown: "unknown";
+            end: "end";
+            "stop-sequence": "stop-sequence";
+        }>>;
+        stopReported: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>;
 }, z.core.$strict>;
 type SealedOutcome = z.infer<typeof SealedOutcome>;
@@ -1794,7 +1846,23 @@ declare const SizeClass: z.ZodEnum<{
 }>;
 type SizeClass = z.infer<typeof SizeClass>;
 /**
- * The most one envelope may be, in bytes — ratified 2026-08-28.
+ * The most one envelope may be, in bytes — **6 MiB, ruled 2026-09-10.**
+ *
+ * ## Why six, which is two sentences and neither is about capacity
+ *
+ * Todd, 09-10: *"6 MB solves for just text and people don't try to push
+ * images. We will add R2 for multimodal later."* **The cap is a SHAPE
+ * decision** — it makes the envelope the wrong tool for a photo, which is the
+ * point, because the right tool for a photo is object storage and a reference
+ * to it rather than a bigger pipe.
+ *
+ * And the half that makes it aligned rather than merely chosen: **6 MiB sits
+ * under a hosted box's memory and bandwidth limits.** A box is 320 MiB of RAM;
+ * a 10 MiB envelope buffered is a real fraction of it. **Six is the number at
+ * which the smallest thing we sell can hold the largest thing we accept.**
+ *
+ * Both sentences are here because a number without them is a number the next
+ * person rounds up. It was 10 MiB from 2026-08-28 until this ruling.
  *
  * A **relay-memory safety rail**, not a plan feature: every tier has the same
  * ceiling, and differentiating tiers on it would be selling a safety limit as
@@ -2875,4 +2943,4 @@ declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_C
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, cryptoReady, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession, withoutComments };
+export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, cryptoReady, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession, withoutComments };

package/dist/index.js

@@ -405,6 +405,12 @@ function backendName(id) {
 }
 function classifyCost(id, baseUrl, model) {
   const declared = BACKENDS[id].cost;
+  if (declared === "free" && model !== void 0 && isCloudTaggedModel(model)) {
+    return {
+      cost: "metered",
+      because: `its model tag ends in \`:cloud\`, so the work runs on your provider's cloud account rather than on this machine \u2014 ${backendName(id)} serves hosted models through the same local address as local ones`
+    };
+  }
   if (declared !== null) {
     const label = BACKENDS[id].label;
     return {
@@ -885,12 +891,51 @@ function provenanceFor(input) {
     untrusted: input.audience !== "private"
   };
 }
+var StopReasonSchema = z7.enum([
+  "end",
+  "length",
+  "stop-sequence",
+  "unknown"
+]);
 var RunMetadata = z7.object({
   /** Which model actually served it. */
   model: z7.string().min(1),
   backendClass: BackendClass,
   /** Wall-clock milliseconds the backend call took. */
-  durationMs: z7.number().int().nonnegative()
+  durationMs: z7.number().int().nonnegative(),
+  /**
+   * Why generation stopped — B064 step 4.
+   *
+   * Here rather than on {@link JobResultOk} because the outcome is the
+   * ANSWER and this is the daemon's signed account of how it was produced.
+   * Why generation ended is the same kind of fact as how long it took.
+   *
+   * **Optional because it is meaningless, not because it is new.** A
+   * cancelled job has no model to have stopped and an error has no
+   * generation to have ended, and `ran` travels on those arms too.
+   * Instruction 10 forbids optionality bought for compatibility — a
+   * version gate wearing a question mark — and this is not that: it is
+   * absent exactly where it would be a fact about nothing. Present on
+   * every `ok` result, always, because the whole value is the difference
+   * between `end`, `length` and `unknown` and that difference only exists
+   * if it is always there.
+   */
+  stop: StopReasonSchema.optional(),
+  /**
+   * Whether the adapter could read a stop signal at all — B105's lesson,
+   * carried to the wire.
+   *
+   * Without this the site re-commits the defect B064's third mapping kind
+   * was introduced to fix. `unknown` is TWO facts: an adapter that cannot
+   * report one, and an adapter that reported a word we do not map — and
+   * `openai-http` maps `stop` and `length` and nothing else, so the second
+   * is the common case rather than the corner.
+   *
+   * A site told only `unknown` would say "we do not know why this stopped"
+   * for a `claude-cli` job forever, which is true, and for a
+   * `content_filter` result, which is not the same thing at all.
+   */
+  stopReported: z7.boolean().optional()
 }).strict();
 var JobResultOk = z7.object({
   outcome: z7.literal("ok"),
@@ -977,7 +1022,7 @@ var DeliveredResult = z7.object({
 }).strict();
 var SizeClass = z7.enum(["small", "medium", "large", "unbounded"]);
 var SIZE_CLASSES = Object.freeze(SizeClass.options);
-var MAX_ENVELOPE_BYTES = 10 * 1024 * 1024;
+var MAX_ENVELOPE_BYTES = 6 * 1024 * 1024;
 function envelopeBytes(envelope) {
   const counted = jsonLength(envelope);
   if (counted !== void 0) return counted;
@@ -2694,6 +2739,7 @@ export {
   SealedOutcome,
   SignedGrant,
   SizeClass,
+  StopReasonSchema,
   StoredKeys,
   Succession,
   TERMINAL_STATES,