@byollm/protocol 0.1.0-alpha.89 → 0.1.0-alpha.90

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.89`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.90`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npm install @byollm/protocol@alpha`.
 >
@@ -187,3 +187,17 @@ to know which one happened.
 conformance id that appears in this package's `MUSTS` registry.
 
 MIT
+
+<!-- family:start -->
+
+## The rest of byollm
+
+Six packages, and they are only interesting together:
+
+- [`byollm`](https://www.npmjs.com/package/byollm) — the daemon — runs models on your own machine and answers for it
+- [`@byollm/server`](https://www.npmjs.com/package/@byollm/server) — the SDK a site uses to ask a device for work
+- [`@byollm/relay`](https://www.npmjs.com/package/@byollm/relay) — the broker that holds jobs between a site and a device, and can read neither
+- [`@byollm/control-plane`](https://www.npmjs.com/package/@byollm/control-plane) — who may ask whom, and the policy store behind it
+- [`@byollm/conformance`](https://www.npmjs.com/package/@byollm/conformance) — the kit that proves an implementation is one — including a posture audit that holds nothing but a URL
+
+<!-- family:end -->

package/dist/index.d.ts

@@ -1545,6 +1545,7 @@ declare const ClaimedJob: z.ZodObject<{
     owner: z.ZodString;
     site: z.ZodOptional<z.ZodString>;
     service: z.ZodOptional<z.ZodString>;
+    deadlineAt: z.ZodOptional<z.ZodNumber>;
     lease: z.ZodObject<{
         id: z.ZodString;
         runnerId: z.ZodString;
@@ -1734,6 +1735,34 @@ declare const JobRefused: z.ZodObject<{
     message: z.ZodString;
 }, z.core.$strict>;
 type JobRefused = z.infer<typeof JobRefused>;
+/**
+ * The outward text for each reason, so a message cannot vary by call site.
+ *
+ * The mirror image of `REFUSAL_MESSAGES` in `audience.ts`, and the contrast is
+ * worth holding in one thought. That table is read by the **owner** of the
+ * device, where byollm_002's rule applies — four different truths must never
+ * share a message, because a person debugging their own machine needs to know
+ * which one they hit. This table is read by a **requester**, where the rule
+ * inverts: two different truths must share a message exactly, because the
+ * difference between them is somebody else's inventory.
+ *
+ * Same project, opposite requirements, and confusing them is how the oracle
+ * comes back. Hence a table rather than prose at the throw site: three
+ * refusals written in three places drift into three slightly different
+ * sentences, and "slightly different" is all an oracle needs.
+ *
+ * ## Published, because the drift it prevents happens outside this repo — B103
+ *
+ * `JobRefused` and `RefusalReason` were exported and **this was not**, so we
+ * shipped the vocabulary and withheld the sentences. Nothing here constructs a
+ * refusal; the producers are sites and the hub, and every one of them would
+ * have written its own message for a reason code we defined.
+ *
+ * **That is the drift this table argues against, made inevitable by the export
+ * list** — and `message` is a required field on the envelope, so each of them
+ * had to write something.
+ */
+declare const REFUSAL_TEXT: Readonly<Record<RefusalReason, string>>;
 /**
  * The plaintext inside a result envelope.
  *
@@ -2943,4 +2972,4 @@ declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_C
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, cryptoReady, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession, withoutComments };
+export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENCRYPTION_KEY_CONTEXT, ENDPOINTS, ENVELOPE_MAX_AGE_MS, ERROR_STATUS, type Endpoint, type EnvelopeContext, EnvelopeDirection, type EnvelopeFailure, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, type OpenResult, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, REFUSAL_TEXT, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedEnvelope, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, cryptoReady, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, fingerprint, generateKeys, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, keyId, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, open, payloadTextLength, provenanceFor, publicIdentityOf, resolveCost, seal, signGrant, signRequest, signSiteRequest, signSuccession, signWith, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyPublicIdentity, verifyRequest, verifySiteRequest, verifyWith, walkSuccession, withoutComments };

package/dist/index.js

@@ -862,6 +862,21 @@ var ClaimedJob = z7.object({
    * and the owner's own defaults answer under the ambiguity law.
    */
   service: z7.string().min(1).optional(),
+  /**
+   * When the work stops being worth doing — the stub's own TTL, carried on
+   * so the daemon can stop at it (B199).
+   *
+   * **A third clock, and not the lease.** The lease bounds how long this
+   * device holds the claim; this bounds how long the answer is wanted. A box
+   * ground two chat jobs toward `maxWallClockMs` — ten minutes — while their
+   * TTL was two, holding both slots and claiming nothing the whole time.
+   *
+   * Optional because the field is carried rather than required: a caller
+   * assembling a `ClaimedJob` without it gets the unclamped ceiling, which is
+   * the behaviour that existed before. The stub always has it, and the
+   * runner's own call site already spread it — this makes the type say so.
+   */
+  deadlineAt: z7.number().int().positive().optional(),
   lease: Lease
 }).strict();
 var ResultProvenance = z7.object({
@@ -2720,6 +2735,7 @@ export {
   PublicIdentity,
   Purpose,
   REFUSAL_MESSAGES,
+  REFUSAL_TEXT,
   RESERVED_PURPOSE,
   RETIREMENT_WINDOW_MS,
   RefusalReason,