@byollm/protocol 0.1.0-alpha.99 → 0.1.1

package/README.md

@@ -1,123 +1,11 @@
-> [!WARNING]
-> **Alpha (`0.1.0-alpha.99`) — under active development. Don't use this yet.**
+<!-- release-note 0.1.1 -->
+> **`0.1.1` is documentation only — nothing to upgrade.** `PROTOCOL_VERSION`
+> is still `2`, so a 0.1.0 party and a 0.1.1 party talk to each other in both
+> directions. No dependency, schema, wire field or on-disk shape moved.
 >
-> Install it deliberately: `npm install @byollm/protocol@alpha`.
->
-> The protocol is v0 and **will** change without a deprecation path, this has
-> never run outside its own test suite, and nothing here has production miles.
-> Read it, take the ideas, tell us what's wrong — but don't put it in front of
-> your users.
->
-> npm assigns `latest` on a first publish and won't let it be removed, so a
-> bare install resolves here too. This notice is the only guard — deliberately
-> not an npm deprecation, which would read as *abandoned* rather than *early*.
-> Ask for `@alpha` explicitly so your lockfile records that you meant to.>
-> **`alpha.15` is a breaking wire change, and it breaks daemons and relays —
-> not app authors.** If you call `app.enqueue(...)` and read results, nothing
-> in your code changes. If you run a daemon or an upstream, every package must
-> move together: a mixed pair refuses on both sides, because both ends parse
-> `.strict()`.
->
-> What moved, all of it reconciling the frozen `byollm_009` with its code:
-> `JobStub` gains `site` (the site's identity key id) and loses
-> `audienceAllow`; `ResultRequest` gains `leaseId`; `HeartbeatResponse` loses
-> `leases`, which nothing read; `WireErrorCode` gains `not-ready`,
-> `clock-skew` and `forbidden`, and `403` is `forbidden` rather than
-> `unauthorized`. `RESULT_PROVENANCE` is superseded by
-> `PROVENANCE_NAMES_DEVICE`. See `byollm_009` Amendment A.>
-> **`alpha.16` is a breaking wire change — daemons and relays again, not app
-> authors.** `app.enqueue(...)` and reading results are unchanged. All five
-> packages move together: both ends parse `.strict()`, so a mixed pair
-> refuses.
->
-> What moved, all of it Tier 2 of `cloud_008`: `model`, `backendClass` and
-> `durationMs` come off `ResultRequest` and are sealed **inside** the result
-> envelope as `SealedOutcome = { outcome, ran }` — so a daemon can no longer
-> declare a model it did not sign, and a relay carries neither.
-> `HeartbeatResponse` loses `leases` (nothing read it) and now reports real
-> cancellations instead of an empty list. `WireErrorCode` gains `forbidden`
-> for 403, leaving `unauthorized` at exactly 401. The relay gained a
-> site-plane `cancel` endpoint, honours `stub.deadlineAt`, honours
-> `stub.audience`, and remembers a refusal.>
-> **`alpha.17` is additive** — no wire change. It exports `ReleaseReason`,
-> which `RoutingStore.releaseLeases` names and the package did not export, so
-> the interface was unimplementable outside this repo.>
-> **`alpha.18` is a breaking wire change — daemons and relays, not app
-> authors.** `app.enqueue(...)` and reading results are unchanged. All five
-> packages move together.
->
-> The **bearer token is gone**: off `PairPollResponse`, off the runner row,
-> off the daemon's pairings file, out of the adapter's schema. It was minted,
-> hashed and stored on two disks and never sent, looked up or compared —
-> `REQUESTS_SIGNED_NOT_BEARER` was enforced by signatures the whole time. If
-> you run the Supabase adapter, apply
-> `20260819000000_drop_runner_token.sql`; `byollm_approve_pairing` now takes
-> one argument. A pairings file written by an older daemon still loads.
->
-> `model`, `backendClass` and `durationMs` moved **inside** the sealed result
-> (`SealedOutcome = { outcome, ran }`), so a daemon cannot declare a model it
-> did not sign and a relay carries none of them. Writing a `RoutingStore`?
-> `releaseLeases` takes an optional `reason` and `complete` requires
-> `leaseId`, and **an implementation that ignores either still typechecks** —
-> run the store contract tests.>
-> **`alpha.19` is additive on the wire and a behaviour change in every
-> store.** `ResultResponse` gains an optional `duplicate`. Nothing is removed,
-> so an older daemon keeps working — but the *order* two rules are checked in
-> has changed, and a `RoutingStore` implementation must change with it.
->
-> `complete` now checks **terminal state before holder**, scoped to the device
-> that finished the job: a replay from that device is answered `duplicate:
-> true` with a 2xx, and anyone else gets exactly the refusal they would get
-> for a job that is not terminal. Previously `RESULT_IDEMPOTENT` held only
-> because the lease is nulled on success, so the holder check tripped first —
-> deleting the idempotency branch failed no test. Run the store contract
-> tests; the compiler cannot see this.
->
-> **`alpha.3` is a breaking change.** `BackendDescriptor.account` is gone —
-> read `cost` (`free` / `metered` / `subscription`) instead. Four new MUSTs
-> come with it; see `byollm_007`.
-
-<!-- release-note 0.1.0-alpha.21 -->
-> [!NOTE]
-> **`0.1.0-alpha.20` is not a complete release — do not pin it.** Four
-> packages published and `@byollm/server` did not: a Sigstore
-> transparency-log 409 on its provenance attestation. The workflow's
-> "already published" guard correctly refuses to resume a partial publish,
-> so `0.1.0-alpha.21` is that release, whole.
->
-> If you run the Supabase adapter, `alpha.21` needs
-> `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
-> ordering without the column it stores the grant in.
-
-<!-- release-note 0.1.0-alpha.40 -->
-**`byollm start` — stop keeping a terminal open.** The daemon can now run
-under your computer's own supervisor and restart itself if it stops: a launchd
-agent on macOS, a `systemd --user` unit on Linux, a logon task on Windows. All
-user-level — no root, no system directories, and `byollm stop` takes it
-away. `byollm status` gained a line saying whether it is actually supervised
-right now, including the state that matters most: installed but not running,
-which looks fine from an app's dashboard and serves nothing.
-
-If you are running via `npx`, install properly first (`npm install -g
-byollm@latest`) — `install` refuses to supervise a copy in npx's cache, because
-npm deletes that directory and the service would fail at some later boot.
-
-<!-- release-note 0.1.0-alpha.41 -->
-**`onNoRunner` takes a string.** Your fallback answer is your own value, not
-wire data, and handing back a whole result record for it was ceremony — the
-README's own example got the shape wrong, which is how this was found.
-
-```ts
-const { outcome, fallback } = await job.result({
-  onNoRunner: () => runOnHostedModel(transcript),
-});
-```
-
-Whatever you return, `result()` labels it `fallback: true` — the stamp is
-applied by the wait, not taken from you, so an answer that did not run on
-somebody's device cannot be reported as though it did (`FALLBACK_LABELED`).
-Both delivery channels do it, polling and Supabase Realtime. Records still
-work; they just get labelled too.
+> This README used to open with a stack of release notes instead of with the
+> package. The history moved to `docs/release-notes/` and `CHANGELOG.md`,
+> where none of it was lost. Full note: `docs/release-notes/0.1.1.md`.
 
 # `@byollm/protocol`
 
@@ -183,7 +71,7 @@ to know which one happened.
 
 ## Normative spec
 
-[`docs/protocol.md`](../../docs/protocol.md). Every MUST there carries a
+[`docs/protocol.md`](https://github.com/oftomorrowinc/byollm/blob/main/docs/protocol.md). Every MUST there carries a
 conformance id that appears in this package's `MUSTS` registry.
 
 MIT
@@ -200,4 +88,11 @@ Six packages, and they are only interesting together:
 - [`@byollm/control-plane`](https://www.npmjs.com/package/@byollm/control-plane) — who may ask whom, and the policy store behind it
 - [`@byollm/conformance`](https://www.npmjs.com/package/@byollm/conformance) — the kit that proves an implementation is one — including a posture audit that holds nothing but a URL
 
+### Where the rest lives
+
+- [GitHub](https://github.com/oftomorrowinc/byollm) — the source, and where issues go
+- [byo-llm.com](https://byo-llm.com) — what this is, and why
+- [byollm.cloud](https://byollm.cloud) — the hosted relay — devices, consent and billing
+- [docs.byollm.cloud](https://docs.byollm.cloud) — integrating a site, end to end
+
 <!-- family:end -->

package/dist/index.d.ts

@@ -2,6 +2,84 @@ import { z } from 'zod';
 import { S as StoredKeys, P as PublicIdentity } from './portable-C6rfiCXi.js';
 export { C as CONSOLE_FRAME_VERSION, a as CONSOLE_MAX_DATA_BYTES, b as ConsoleBye, c as ConsoleFrame, d as ConsoleHello, e as ConsoleOrder, f as ConsoleOrderFault, g as ConsoleOrderResult, h as ConsoleResize, i as ConsoleStdin, j as ConsoleStdout, E as ENCRYPTION_KEY_CONTEXT, k as ENVELOPE_BODY_VERSION, l as ENVELOPE_MAX_AGE_MS, m as EnvelopeBodyContext, n as EnvelopeContext, o as EnvelopeDirection, p as EnvelopeFailure, q as EnvelopeInner, O as OpenResult, r as SealedEnvelope, s as consoleDataBytes, t as consoleEnvelope, u as consoleOrder, v as cryptoReady, w as decodeConsoleData, x as decodeEnvelopeInner, y as encodeConsoleData, z as encodeEnvelopeInner, A as envelopeSignedBody, B as fingerprint, D as fromBase64Url, F as generateKeys, G as keyId, H as open, I as publicIdentityOf, J as seal, K as signWith, L as toBase64Url, M as verifyPublicIdentity, N as verifyWith } from './portable-C6rfiCXi.js';
 
+/**
+ * What byollm.cloud can see, in the words a person reads — B039.
+ *
+ * ## Why a sentence is in a published package
+ *
+ * This one sentence has to be true in three places at once: the privacy page
+ * that prints it, the check beside the hub's schema that proves every recorded
+ * column is claimed by one of its clauses, and the page test that pins the
+ * wording. Two of those live in `byollm-cloud`, one in `byollm-cloud-web`, and
+ * **a check cannot read another repository** — so until now the sentence was
+ * written out three times and nothing compared the copies.
+ *
+ * That is not a tidiness problem. An enumeration is a promise, and a promise
+ * kept in three places drifts in two of them: the copy beside the schema is
+ * the one that fails when a column is added, and if it is not the copy on the
+ * page, the page stays reassuring and stops being true. Which is worse than
+ * never having made the promise.
+ *
+ * `byollm_023` named the only two shapes — a copy per repository (they
+ * diverge, silently) or one source both import (it goes stale, loudly, as a
+ * version pin). **Todd ruled shape 2 on 2026-09-17**, and the reason is the
+ * one that decides it: staleness is a number somebody can compare, and B164's
+ * cross-repository pin comparison is the thing that compares it. Divergence
+ * has no such number.
+ *
+ * ## Why it lives in `@byollm/protocol` and not a package of its own
+ *
+ * It was one, for a day. **Todd ruled on 2026-09-19: no seventh package** —
+ * *"I do think just adding it to protocol and importing that makes a ton of
+ * sense"* — and `packages/agreements` was deleted rather than marked private.
+ * Both consuming repositories already pin `@byollm/protocol`, so the sentence
+ * arrives on a pin they carry instead of a name they would have to adopt, and
+ * the cut stops carrying a package that had never been published.
+ *
+ * ## Published, not internal
+ *
+ * It ships to npm rather than living in a private repository, and that is a
+ * property rather than an accident: a promise about what a hosted service can
+ * see is worth more when anybody can install the package, read the sentence,
+ * and check it against what the service does. Protocol is public, so that is
+ * unchanged by the move.
+ */
+/**
+ * The hub fence, verbatim — ruled by Todd, 2026-09-04.
+ *
+ * Asserted whole rather than by keyword wherever it is checked: "close
+ * enough" is not a standard a page about what we can see gets to use, and a
+ * paraphrase that drifted would leave the other repository checking a sentence
+ * nobody ships.
+ */
+declare const HUB_FENCE: string;
+/**
+ * A clause of {@link HUB_FENCE}, and the columns it accounts for.
+ *
+ * The mapping is here rather than beside the schema for the same reason the
+ * sentence is: it is a fact about the sentence, and the sentence is shared.
+ * What stays beside the schema is the CHECK — every recorded column must be
+ * claimed by one of these before that suite passes — because the columns are
+ * the hub's and only the hub's repository can enumerate them.
+ *
+ * Coupling copy to columns by check rather than by convention is the whole of
+ * the ruling: the enumeration is only a promise if something fails when the
+ * code outgrows it.
+ */
+interface FenceClause {
+    /** The clause as it appears in {@link HUB_FENCE}. */
+    readonly says: string;
+    /** The recorded columns this clause accounts for. */
+    readonly covers: readonly string[];
+}
+/**
+ * Every clause, with what it covers.
+ *
+ * A column not claimed by any clause is a fact about somebody that the page
+ * does not mention, which is what the check beside the schema refuses.
+ */
+declare const HUB_FENCE_CLAUSES: readonly FenceClause[];
+
 /**
  * Protocol version carried on every request; servers refuse what they can't
  * speak.
@@ -25,7 +103,7 @@ export { C as CONSOLE_FRAME_VERSION, a as CONSOLE_MAX_DATA_BYTES, b as ConsoleBy
  * own words, from the release that silenced a fleet by adding a backend id.
  * The same sentence applies to removing an offer scope.
  */
-declare const PROTOCOL_VERSION: "1";
+declare const PROTOCOL_VERSION: "2";
 /**
  * Every protocol version this build can serve, **oldest first**.
  *
@@ -108,11 +186,17 @@ declare function checkProtocolVersion(body: unknown): VersionRefusal | null;
  * starts meaning "the unstable one", and every user who followed this message
  * is pinned to prereleases with nothing to tell them.
  *
- * Note this is deliberately *not* the rule `scripts/check-site.mjs` enforces
- * on the docs, which requires `npx byollm@alpha`. That rule is about somebody
- * choosing to install a prerelease knowingly, with the warning in front of
- * them. This is an upgrade instruction handed to somebody who already has the
- * daemon and needs a newer one — a different question with a different answer.
+ * This once said `scripts/check-site.mjs` deliberately enforces the OPPOSITE
+ * on the docs — *"which requires `npx byollm@alpha`"* — and drew a careful
+ * distinction between choosing a prerelease knowingly and being handed an
+ * upgrade command. **That rule inverted at the flip and this paragraph did
+ * not.** check-site now refuses any pin but `@latest`, for the reason written
+ * beside it: *"the tag that moves first is reviewed last, so asking for it
+ * explicitly is asking for the build nobody has looked at yet."* Which is what
+ * this constant already said, so the distinction it drew no longer exists.
+ *
+ * Found sweeping B341 — the same decay as B336 and B339, a third time, and
+ * every one was prose left standing over a constant that moved beneath it.
  */
 declare const UPGRADE_COMMAND: "npm i -g byollm@latest";
 /** The path prefix all endpoints mount under. */
@@ -268,7 +352,7 @@ type GrantRef = z.infer<typeof GrantRef>;
  * and nothing works over a copied string alone.
  */
 declare const PairStartRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     action: z.ZodLiteral<"start">;
     daemon: z.ZodObject<{
         version: z.ZodString;
@@ -333,7 +417,7 @@ declare const PairStartResponse: z.ZodObject<{
 }, z.core.$strict>;
 type PairStartResponse = z.infer<typeof PairStartResponse>;
 declare const PairPollRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>;
@@ -358,7 +442,7 @@ declare const PairPollResponse: z.ZodDiscriminatedUnion<[z.ZodObject<{
 }, z.core.$strict>], "status">;
 type PairPollResponse = z.infer<typeof PairPollResponse>;
 declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     action: z.ZodLiteral<"start">;
     daemon: z.ZodObject<{
         version: z.ZodString;
@@ -413,13 +497,13 @@ declare const PairRequest: z.ZodDiscriminatedUnion<[z.ZodObject<{
         }>;
     }, z.core.$strict>>;
 }, z.core.$strict>, z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     action: z.ZodLiteral<"poll">;
     deviceCode: z.ZodString;
 }, z.core.$strict>], "action">;
 type PairRequest = z.infer<typeof PairRequest>;
 declare const ClaimRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     runnerId: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
         kind: z.ZodEnum<{
@@ -506,7 +590,7 @@ declare const ClaimResponse: z.ZodObject<{
 }, z.core.$strict>;
 type ClaimResponse = z.infer<typeof ClaimResponse>;
 declare const HeartbeatRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     runnerId: z.ZodString;
     daemonVersion: z.ZodString;
     capabilities: z.ZodArray<z.ZodObject<{
@@ -564,7 +648,6 @@ declare const HeartbeatRequest: z.ZodObject<{
         jobId: z.ZodString;
         leaseId: z.ZodString;
     }, z.core.$strict>>;
-    paused: z.ZodBoolean;
 }, z.core.$strict>;
 type HeartbeatRequest = z.infer<typeof HeartbeatRequest>;
 declare const HeartbeatResponse: z.ZodObject<{
@@ -616,7 +699,7 @@ declare const ResultDisposition: z.ZodEnum<{
 }>;
 type ResultDisposition = z.infer<typeof ResultDisposition>;
 declare const ResultRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -644,7 +727,7 @@ declare const ResultResponse: z.ZodObject<{
 }, z.core.$strict>;
 type ResultResponse = z.infer<typeof ResultResponse>;
 declare const ReleaseRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     runnerId: z.ZodString;
     leases: z.ZodArray<z.ZodObject<{
         jobId: z.ZodString;
@@ -713,7 +796,7 @@ type WireError = z.infer<typeof WireError>;
 /** HTTP status each error code is served with. */
 declare const ERROR_STATUS: Readonly<Record<WireErrorCode, number>>;
 declare const FetchRequest: z.ZodObject<{
-    protocolVersion: z.ZodLiteral<"1">;
+    protocolVersion: z.ZodLiteral<"2">;
     runnerId: z.ZodString;
     jobId: z.ZodString;
     leaseId: z.ZodString;
@@ -1555,6 +1638,44 @@ declare const ClaimedJob: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 type ClaimedJob = z.infer<typeof ClaimedJob>;
+/**
+ * The closed set, as a schema — so the values exist once.
+ *
+ * A bare union would mean anything that has to VALIDATE a stop reason (the
+ * ingress log, and the wire when step 4 lands) retyping the four strings
+ * beside it. Instruction 9: one definition, both ends, and where a consumer
+ * needs a runtime check the definition has to be one it can run.
+ *
+ * The type below is inferred from this rather than written twice, so the
+ * compiler and the validator cannot disagree about what a stop reason is.
+ */
+declare const StopReasonSchema: z.ZodEnum<{
+    length: "length";
+    unknown: "unknown";
+    end: "end";
+    "stop-sequence": "stop-sequence";
+}>;
+type StopReason = 
+/** The model finished on its own. */
+"end"
+/** The model stopped at its own output ceiling. */
+ | "length"
+/** A configured stop token ended it. */
+ | "stop-sequence"
+/**
+ * The adapter cannot tell, and says so.
+ *
+ * **The default, and never `"end"`.** An adapter nobody has updated — or
+ * one somebody adds next year — must not be able to claim completion by
+ * saying nothing. If absence meant "end", every un-updated adapter would go
+ * on telling exactly the lie this exists to fix, and every new adapter
+ * would inherit it in silence.
+ *
+ * It is the opposite-boolean rule this codebase keeps arriving at: when you
+ * cannot tell, guess toward silence rather than toward a claim. "We do not
+ * know" is a thing a site can act on; "it finished" when it did not is not.
+ */
+ | "unknown";
 /**
  * The provenance that travels with every result to the delivery seam.
  *
@@ -1575,6 +1696,13 @@ declare const ResultProvenance: z.ZodObject<{
     }>;
     model: z.ZodString;
     untrusted: z.ZodBoolean;
+    stop: z.ZodOptional<z.ZodEnum<{
+        length: "length";
+        unknown: "unknown";
+        end: "end";
+        "stop-sequence": "stop-sequence";
+    }>>;
+    stopReported: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strict>;
 type ResultProvenance = z.infer<typeof ResultProvenance>;
 /**
@@ -1587,6 +1715,9 @@ declare function provenanceFor(input: {
     runnerOwner: string;
     backendClass: BackendClass;
     model: string;
+    /** From the sealed `ran`; absent on a cancelled or errored job — B260. */
+    stop?: StopReason | undefined;
+    stopReported?: boolean | undefined;
 }): ResultProvenance;
 /**
  * What the daemon did, sealed with the answer — cloud_008 §2.5.
@@ -1603,44 +1734,6 @@ declare function provenanceFor(input: {
  * opens them, nothing in between sees them, and the disposition check that
  * already compares clear-text against ciphertext extends to cover them.
  */
-/**
- * The closed set, as a schema — so the values exist once.
- *
- * A bare union would mean anything that has to VALIDATE a stop reason (the
- * ingress log, and the wire when step 4 lands) retyping the four strings
- * beside it. Instruction 9: one definition, both ends, and where a consumer
- * needs a runtime check the definition has to be one it can run.
- *
- * The type below is inferred from this rather than written twice, so the
- * compiler and the validator cannot disagree about what a stop reason is.
- */
-declare const StopReasonSchema: z.ZodEnum<{
-    length: "length";
-    unknown: "unknown";
-    end: "end";
-    "stop-sequence": "stop-sequence";
-}>;
-type StopReason = 
-/** The model finished on its own. */
-"end"
-/** The model stopped at its own output ceiling. */
- | "length"
-/** A configured stop token ended it. */
- | "stop-sequence"
-/**
- * The adapter cannot tell, and says so.
- *
- * **The default, and never `"end"`.** An adapter nobody has updated — or
- * one somebody adds next year — must not be able to claim completion by
- * saying nothing. If absence meant "end", every un-updated adapter would go
- * on telling exactly the lie this exists to fix, and every new adapter
- * would inherit it in silence.
- *
- * It is the opposite-boolean rule this codebase keeps arriving at: when you
- * cannot tell, guess toward silence rather than toward a claim. "We do not
- * know" is a thing a site can act on; "it finished" when it did not is not.
- */
- | "unknown";
 declare const RunMetadata: z.ZodObject<{
     model: z.ZodString;
     backendClass: z.ZodEnum<{
@@ -1840,6 +1933,13 @@ declare const DeliveredResult: z.ZodObject<{
         }>;
         model: z.ZodString;
         untrusted: z.ZodBoolean;
+        stop: z.ZodOptional<z.ZodEnum<{
+            length: "length";
+            unknown: "unknown";
+            end: "end";
+            "stop-sequence": "stop-sequence";
+        }>>;
+        stopReported: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
     fallback: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
@@ -2281,6 +2381,74 @@ declare function verifyRequest(input: {
  * what a single-purpose site's one purpose actually is.
  */
 declare const RESERVED_PURPOSE = "default";
+/**
+ * How a purpose's work is routed — RESERVED at 0.1.0, not yet acted on (B236).
+ *
+ * ## Why a key nothing reads is the highest-leverage thing in this file
+ *
+ * {@link Purpose} is `.strict()`, and that is right: a manifest is written by
+ * hand by a third party, and a typo'd key that is silently ignored is a site
+ * whose consent screen quietly says something other than what its author
+ * wrote. The cost of `.strict()` is that **there is no such thing as an
+ * additive change to it.** A key added in 1.4 is rejected by every validator
+ * built before 1.4, and the OSS repository ships the server — so those
+ * validators will exist, on machines nobody can upgrade, run by people who
+ * have no idea a key was added.
+ *
+ * The window in which this field can be introduced is therefore now: before
+ * the wire is declared stable, while every validator in existence is ours.
+ * After that the shape is load-bearing whether or not anything reads it.
+ *
+ * So the values are the ruled ones (B232 house lanes, B233 fallback lanes),
+ * the schema refuses anything else, and no code branches on it. A site may
+ * write `routing` today and get exactly the behaviour it gets without it,
+ * which is the point: the manifest it writes today is still valid the day
+ * the lanes land.
+ *
+ * ## What each value will mean, when something reads it
+ *
+ * - `user-choice` — the person maps this purpose to one of their own
+ *   services, and that mapping is the consent. Today's only behaviour, and
+ *   the default for a manifest that says nothing.
+ * - `site-fixed` — the site pays for and pins the service (B232's house
+ *   lane). The person is told, and consents to that rather than to a mapping.
+ * - `user-first-with-fallback` — the person's service if they have one, the
+ *   site's if they do not (B233).
+ *
+ * **The commitment attached to those last two** is written in the lock
+ * document rather than here, because it binds behaviour this file cannot
+ * enforce: a hub that does not implement a lane treats the purpose as
+ * `user-choice` and SAYS SO in a field rather than silently downgrading it,
+ * and a lane added later carries its own disclosure and never weakens an
+ * existing lane's promise.
+ */
+declare const PurposeRouting: z.ZodEnum<{
+    "user-choice": "user-choice";
+    "site-fixed": "site-fixed";
+    "user-first-with-fallback": "user-first-with-fallback";
+}>;
+type PurposeRouting = z.infer<typeof PurposeRouting>;
+/**
+ * What a purpose that does not say means.
+ *
+ * Named once, here, rather than written into the schema as `.default()`. A
+ * zod default is applied at PARSE, which would mean every manifest read by
+ * anything becomes a manifest with a `routing` key — and a hub that parses a
+ * site's manifest, stores it and serves it back would be handing a key to
+ * readers that predate it. The thing this field exists to avoid, performed by
+ * the field itself.
+ *
+ * Parsing stays shape-preserving; the default is applied where the value is
+ * USED, by {@link routingOf}.
+ */
+declare const DEFAULT_ROUTING: PurposeRouting;
+/**
+ * The routing a purpose asks for, defaulted.
+ *
+ * The one place the absent case is answered, so that when B232 and B233 do
+ * act on this there is no second opinion about what "not stated" meant.
+ */
+declare function routingOf(purpose: Purpose): PurposeRouting;
 declare const Purpose: z.ZodObject<{
     label: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
@@ -2288,6 +2456,11 @@ declare const Purpose: z.ZodObject<{
         "llm.generate": "llm.generate";
         "llm.chat": "llm.chat";
     }>>;
+    routing: z.ZodOptional<z.ZodEnum<{
+        "user-choice": "user-choice";
+        "site-fixed": "site-fixed";
+        "user-first-with-fallback": "user-first-with-fallback";
+    }>>;
 }, z.core.$strict>;
 type Purpose = z.infer<typeof Purpose>;
 /**
@@ -2320,6 +2493,11 @@ declare const Manifest: z.ZodRecord<z.ZodString, z.ZodObject<{
         "llm.generate": "llm.generate";
         "llm.chat": "llm.chat";
     }>>;
+    routing: z.ZodOptional<z.ZodEnum<{
+        "user-choice": "user-choice";
+        "site-fixed": "site-fixed";
+        "user-first-with-fallback": "user-first-with-fallback";
+    }>>;
 }, z.core.$strict>>;
 type Manifest = z.infer<typeof Manifest>;
 /**
@@ -2806,4 +2984,4 @@ declare const MUST_IDS: readonly ("PAIR_ONE_USER" | "PAIR_INTERACTIVE" | "PAIR_C
 /** Every MUST verified a particular way. */
 declare function mustsVerifiedBy(kind: MustVerification): MustId[];
 
-export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, REFUSAL_MESSAGES, REFUSAL_TEXT, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, payloadTextLength, provenanceFor, resolveCost, signGrant, signRequest, signSiteRequest, signSuccession, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyRequest, verifySiteRequest, walkSuccession, withoutComments };
+export { ABOUT, ABOUT_SHORT, ABOUT_SHORT_LEDE, ABOUT_SHORT_TAIL, AUDIENCES, Audience, BACKENDS, BACKEND_CLASSES, BACKEND_IDS, BackendClass, BackendCost, type BackendDescriptor, type BackendId, BackendIdSchema, CLOCK_ATTRIBUTION_MS, CLOCK_SKEW_WARN_MS, Capability, CapabilityMatrix, ChatMessage, ChatPayload, ClaimRequest, ClaimResponse, ClaimedJob, ClaimedStub, DEFAULT_ROUTING, DeliveredResult, ENDPOINTS, ERROR_STATUS, type Endpoint, type FenceClause, FetchRequest, FetchResponse, type FloorRefusal, GRANT_CONTEXT, GRANT_MAX_AGE_MS, GRANT_SIGNED_FIELDS, GeneratePayload, type GrantClaims, GrantRef, type GrantRefusal, HUB_FENCE, HUB_FENCE_CLAUSES, HeartbeatRequest, HeartbeatResponse, JOB_KINDS, JobKind, JobOutcome, JobPayload, JobRefused, JobResultCanceled, JobResultError, JobResultOk, JobState, JobStub, KindedPayload, Lease, MAX_CLOCK_SKEW_MS, MAX_ENVELOPE_BYTES, MAX_PURPOSES, MAX_SUCCESSION_CHAIN, MIN_PROTOCOL_VERSION, MUSTS, MUST_IDS, Manifest, type MatchDaemon, type MatchJob, MatchRefusal, type MatchResult, type Must, type MustEnforcer, type MustId, type MustVerification, type MustVerifiedBy, OFFER_SCOPES, OfferScope, PAYLOAD_LIMITS, PROTOCOL_PREFIX, PROTOCOL_VERSION, PairPollRequest, PairPollResponse, PairRequest, PairStartRequest, PairStartResponse, type PayloadFor, PublicIdentity, Purpose, PurposeRouting, REFUSAL_MESSAGES, REFUSAL_TEXT, RESERVED_PURPOSE, RETIREMENT_WINDOW_MS, RefusalReason, ReleaseRequest, ReleaseResponse, RequestSignature, ResultDisposition, ResultProvenance, ResultRequest, ResultResponse, RunMetadata, SIZE_CLASSES, SIZE_CLASS_LIMITS, SUCCESSION_CONTEXT, SUPPORTED_PROTOCOL_VERSIONS, SealedOutcome, type SignatureFailure, SignedGrant, SizeClass, type SpendConsent, type StopReason, StopReasonSchema, StoredKeys, Succession, type SuccessionFailure, type SuccessionWalk, TERMINAL_STATES, UPDATE_OFFER_SINCE, UPGRADE_COMMAND, type VersionRefusal, WireError, WireErrorCode, WithheldKind, backendDescriptor, backendName, canTransition, canonicalRequest, checkDaemonFloor, checkProtocolVersion, classifyCost, compareVersions, declaredVersion, describeBytes, effectiveOfferScope, envelopeBytes, grantStatement, isBackendId, isCloudTaggedModel, isJobKind, isLocalHost, isTerminal, kindsOf, matchAudience, mayOfferUpdate, mentionsWireField, mustsVerifiedBy, payloadTextLength, provenanceFor, resolveCost, routingOf, signGrant, signRequest, signSiteRequest, signSuccession, singlePurposeManifest, sizeClassCeiling, sizeClassOf, successionStatement, tooLargeMessage, updateOfferFor, verifyGrant, verifyLink, verifyRequest, verifySiteRequest, walkSuccession, withoutComments };