@byollm/relay 0.1.0-alpha.11 → 0.1.0-alpha.13

package/dist/index.js

@@ -8,121 +8,37 @@ import {
   ResultRequest,
   RequestSignature,
   keyId,
+  MAX_CLOCK_SKEW_MS,
   verifyRequest,
   verifyPublicIdentity,
   PublicIdentity
 } from "@byollm/protocol";
-import { randomUUID } from "crypto";
 import { z } from "zod";
-
-// src/state.ts
-var AWAITING_PAYLOAD_MS = 1e4;
-var RelayState = class {
-  #jobs = /* @__PURE__ */ new Map();
-  #presence = /* @__PURE__ */ new Map();
-  /**
-   * Take a stub for routing. The payload is not here and will not be.
-   *
-   * **Idempotent by job id, and that is a security property rather than a
-   * convenience.** Site-plane calls are authenticated by signature, and
-   * byollm_009 §4.2's argument for signing the request instead of a
-   * server-issued nonce rests entirely on every write being idempotent per the
-   * instance it names. This one was not: re-enqueueing a known id built a
-   * fresh `queued` job over the top of the old one, discarding a live claim,
-   * its lease and any payload the site had already sealed to a device. A
-   * replayed enqueue inside the two-minute freshness window was therefore a
-   * way to yank a job back from the machine running it — the `release` bug of
-   * §4.2, rediscovered on the other plane.
-   *
-   * So a known id returns what is already routing, unchanged. A site that
-   * restarts and republishes its queue is the normal case, and it must not
-   * disturb work in flight.
-   */
-  enqueue(input) {
-    const existing = this.#jobs.get(input.id);
-    if (existing) return existing;
-    const job = {
-      id: input.id,
-      siteId: input.siteId,
-      stub: input.stub,
-      state: "queued"
-    };
-    this.#jobs.set(job.id, job);
-    return job;
-  }
-  job(jobId) {
-    return this.#jobs.get(jobId);
-  }
-  jobs() {
-    return [...this.#jobs.values()];
-  }
-  /** Jobs a site must seal for, right now. */
-  awaiting(siteId) {
-    return this.jobs().filter(
-      (j) => j.siteId === siteId && j.state === "awaiting-payload"
-    );
-  }
-  /** Sealed results waiting to go home. */
-  finished(siteId) {
-    return this.jobs().filter(
-      (j) => j.siteId === siteId && j.state === "done" && j.result !== void 0
-    );
-  }
-  seen(presence) {
-    const existing = this.#presence.get(presence.runnerId);
-    if (existing) {
-      existing.lastSeenAt = presence.lastSeenAt;
-      return existing;
+var ok = (body) => ({ status: 200, body });
+var REFUSALS = {
+  "not-found": {
+    status: 404,
+    body: { error: "not-found", message: "unknown job" }
+  },
+  "not-holder": {
+    status: 403,
+    body: {
+      error: "unauthorized",
+      message: "this runner does not hold the job"
     }
-    const fresh = { ...presence, revoked: false };
-    this.#presence.set(presence.runnerId, fresh);
-    return fresh;
-  }
-  presence(runnerId) {
-    return this.#presence.get(runnerId);
-  }
-  everyone() {
-    return [...this.#presence.values()];
-  }
-  /**
-   * Return a job to the queue, forgetting the claim.
-   *
-   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is
-   * why the awaiting-payload timeout is cheap to fire: the worst case is that
-   * a device did nothing for ten seconds and another one gets a turn.
-   */
-  requeue(job) {
-    job.state = "queued";
-    delete job.claimedBy;
-    delete job.awaitingUntil;
-    delete job.payload;
-  }
-  /**
-   * Fire whatever the clock says is due, and report it.
-   *
-   * Returns the jobs it requeued so a caller can log or surface them — a
-   * timeout that fires invisibly is indistinguishable from a job that was
-   * never claimed, and those want very different debugging.
-   */
-  sweep(now) {
-    const requeued = [];
-    for (const job of this.#jobs.values()) {
-      if (job.state === "awaiting-payload" && (job.awaitingUntil ?? 0) <= now) {
-        this.requeue(job);
-        requeued.push(job);
-      }
-      const lease = job.claimedBy;
-      if (lease && (job.state === "ready" || job.state === "running") && lease.leaseExpiresAt <= now) {
-        this.requeue(job);
-        requeued.push(job);
-      }
+  },
+  "stale-lease": {
+    status: 403,
+    body: { error: "unauthorized", message: "that lease is no longer current" }
+  },
+  "not-ready": {
+    status: 409,
+    body: {
+      error: "not-ready",
+      message: "the site has not sealed this job yet"
     }
-    return requeued;
   }
 };
-
-// src/daemon-plane.ts
-var ok = (body) => ({ status: 200, body });
 var fail = (status, error, message) => ({
   status,
   body: { error, message }
@@ -142,7 +58,7 @@ var DaemonPlane = class {
    * relay that substituted its own identity here could inject work — and would
    * need a private key to do it, which is why it has none.
    */
-  pair(body) {
+  async pair(body) {
     const parsed = PairFixtureRequest.safeParse(body);
     if (!parsed.success) {
       return fail(400, "bad-request", "pair request failed schema validation");
@@ -175,11 +91,10 @@ var DaemonPlane = class {
       return fail(403, "unauthorized", "this device belongs to another owner");
     }
     const runnerId = approved.runnerId;
-    this.#deps.state.seen({
+    await this.#deps.state.seen({
       runnerId,
       owner: parsed.data.owner,
-      device: parsed.data.device,
-      lastSeenAt: this.#deps.now()
+      device: parsed.data.device
     });
     return ok({
       protocolVersion: PROTOCOL_VERSION,
@@ -189,12 +104,12 @@ var DaemonPlane = class {
     });
   }
   /** Every authenticated call: signature first, then consent, then work. */
-  #authed(input, body, schema, run, options = {}) {
+  async #authed(input, body, schema, run, options = {}) {
     const signature = RequestSignature.safeParse(input.signature);
     if (!signature.success) {
       return fail(401, "unauthorized", "this request is not signed");
     }
-    const known = this.#deps.state.presence(signature.data.runnerId);
+    const known = await this.#deps.state.presence(signature.data.runnerId);
     if (!known) {
       return fail(401, "unauthorized", "this runner is not recognised");
     }
@@ -205,6 +120,7 @@ var DaemonPlane = class {
       signature: signature.data,
       now: this.#deps.now()
     });
+    if (failure === "stale") return this.#clockSkew();
     if (failure) return fail(401, "unauthorized", "signature check failed");
     const revoked = this.#deps.projection.consentFor(known.owner, this.#deps.siteId) === null;
     if (revoked && options.allowRevoked !== true) {
@@ -217,42 +133,47 @@ var DaemonPlane = class {
     }
     return run(parsed.data, known);
   }
+  /**
+   * A clock too far from ours, said plainly and with the number to fix it by.
+   *
+   * Its own error code rather than a generic `unauthorized`, because it is the
+   * one refusal a retry can never fix and an `ntpdate` always can — the same
+   * reasoning `version-unsupported` already carries on the daemon side. A
+   * daemon that reports this as a generic rejection sends its owner looking at
+   * their network.
+   *
+   * `serverTime` is included so the far side can say *how far off* rather than
+   * *that something is wrong*. It is not a disclosure: the heartbeat response
+   * returns the same value, and so does every `Date` header.
+   */
+  #clockSkew() {
+    return {
+      status: 401,
+      body: {
+        error: "clock-skew",
+        message: "this request's timestamp is too far from the server's clock; check the machine's time and try again",
+        serverTime: this.#deps.now(),
+        maxSkewMs: MAX_CLOCK_SKEW_MS
+      }
+    };
+  }
   claim(auth, body) {
-    return this.#authed(auth, body, ClaimRequest, (request, device) => {
+    return this.#authed(auth, body, ClaimRequest, async (request, device) => {
       if (request.runnerId !== device.runnerId) {
         return fail(401, "unauthorized", "runner id does not match the key");
       }
-      const now = this.#deps.now();
-      this.#deps.state.sweep(now);
-      const kinds = new Set(request.capabilities.map((c) => c.kind));
-      const granted = [];
-      for (const job of this.#deps.state.jobs()) {
-        if (granted.length >= request.max) break;
-        if (job.state !== "queued") continue;
-        if (job.siteId !== this.#deps.siteId) continue;
-        if (!kinds.has(job.stub.kind)) continue;
-        if (!this.#deps.projection.mayRunFor(device.owner, job.stub.owner)) {
-          continue;
-        }
-        const leaseId = randomUUID();
-        job.state = "awaiting-payload";
-        job.claimedBy = {
-          runnerId: device.runnerId,
-          owner: device.owner,
-          device: device.device,
-          leaseId,
-          leaseExpiresAt: now + this.#deps.leaseMs
-        };
-        job.awaitingUntil = now + AWAITING_PAYLOAD_MS;
-        granted.push({
-          ...job.stub,
-          lease: {
-            id: leaseId,
-            runnerId: device.runnerId,
-            expiresAt: job.claimedBy.leaseExpiresAt
-          }
-        });
-      }
+      const granted = await this.#deps.state.claim({
+        runnerId: device.runnerId,
+        owner: device.owner,
+        device: device.device,
+        siteId: this.#deps.siteId,
+        kinds: new Set(request.capabilities.map((c) => c.kind)),
+        // The projection, collapsed to data the store can match on — a
+        // predicate does not travel.
+        owners: new Set(this.#deps.projection.ownersRunnableBy(device.owner)),
+        max: request.max,
+        leaseMs: this.#deps.leaseMs
+      });
       return ok({ jobs: granted, leaseMs: this.#deps.leaseMs });
     });
   }
@@ -267,20 +188,14 @@ var DaemonPlane = class {
    * awaiting-payload clock says otherwise.
    */
   fetch(auth, body) {
-    return this.#authed(auth, body, FetchRequest, (request, device) => {
-      const job = this.#deps.state.job(request.jobId);
-      if (!job) return fail(404, "not-found", "unknown job");
-      if (job.claimedBy?.runnerId !== device.runnerId) {
-        return fail(403, "unauthorized", "this runner does not hold the job");
-      }
-      if (job.claimedBy.leaseId !== request.leaseId) {
-        return fail(403, "unauthorized", "that lease is no longer current");
-      }
-      if (!job.payload) {
-        return fail(409, "not-ready", "the site has not sealed this job yet");
-      }
-      job.state = "running";
-      return ok({ envelope: job.payload });
+    return this.#authed(auth, body, FetchRequest, async (request, device) => {
+      const taken = await this.#deps.state.takePayload({
+        jobId: request.jobId,
+        runnerId: device.runnerId,
+        leaseId: request.leaseId
+      });
+      if ("refused" in taken) return REFUSALS[taken.refused];
+      return ok({ envelope: taken.envelope });
     });
   }
   /**
@@ -293,19 +208,15 @@ var DaemonPlane = class {
    * only verifiable there.
    */
   result(auth, body) {
-    return this.#authed(auth, body, ResultRequest, (request, device) => {
-      const job = this.#deps.state.job(request.jobId);
-      if (!job) return fail(404, "not-found", "unknown job");
-      if (job.claimedBy?.runnerId !== device.runnerId) {
-        return fail(403, "unauthorized", "this runner does not hold the job");
-      }
-      if (job.state === "done") {
-        return ok({ accepted: false, state: job.state });
-      }
-      job.result = request.envelope;
-      job.disposition = request.disposition;
-      job.state = "done";
-      return ok({ accepted: true, state: job.state });
+    return this.#authed(auth, body, ResultRequest, async (request, device) => {
+      const recorded = await this.#deps.state.complete({
+        jobId: request.jobId,
+        runnerId: device.runnerId,
+        envelope: request.envelope,
+        disposition: request.disposition
+      });
+      if ("refused" in recorded) return REFUSALS[recorded.refused];
+      return ok(recorded);
     });
   }
   heartbeat(auth, body) {
@@ -313,20 +224,20 @@ var DaemonPlane = class {
       auth,
       body,
       HeartbeatRequest,
-      (request, device) => {
+      async (request, device) => {
         const now = this.#deps.now();
-        this.#deps.state.sweep(now);
-        const known = this.#deps.state.presence(device.runnerId);
+        await this.#deps.state.sweep();
+        const known = await this.#deps.state.presence(device.runnerId);
         const consent = this.#deps.projection.consentFor(
           device.owner,
           this.#deps.siteId
         );
         const revoked = consent === null;
         if (known) known.revoked = revoked;
-        const lost = request.activeLeases.filter(({ jobId, leaseId }) => {
-          const job = this.#deps.state.job(jobId);
-          return job?.claimedBy?.leaseId !== leaseId;
-        }).map(({ jobId }) => jobId);
+        const lost = await this.#deps.state.lostLeases(
+          device.runnerId,
+          request.activeLeases
+        );
         return ok({
           revoked,
           cancel: [],
@@ -339,15 +250,11 @@ var DaemonPlane = class {
     );
   }
   release(auth, body) {
-    return this.#authed(auth, body, ReleaseRequest, (request, device) => {
-      const released = [];
-      for (const { jobId, leaseId } of request.leases) {
-        const job = this.#deps.state.job(jobId);
-        if (!job || job.claimedBy?.runnerId !== device.runnerId) continue;
-        if (job.claimedBy.leaseId !== leaseId) continue;
-        this.#deps.state.requeue(job);
-        released.push(jobId);
-      }
+    return this.#authed(auth, body, ReleaseRequest, async (request, device) => {
+      const released = await this.#deps.state.releaseLeases({
+        runnerId: device.runnerId,
+        leases: request.leases
+      });
       return ok({ released });
     });
   }
@@ -387,9 +294,9 @@ function jobRow(job, now) {
     <td>${job.result ? escape(job.disposition ?? "?") : "<span class='dim'>\u2014</span>"}</td>
   </tr>`;
 }
-function debugPage(state, now) {
-  const jobs = state.jobs();
-  const devices = state.everyone();
+async function debugPage(state, now) {
+  const jobs = await state.jobs();
+  const devices = await state.everyone();
   return `<!doctype html>
 <html><head><meta charset="utf-8"><title>byollm relay \u2014 debug</title>
 <meta http-equiv="refresh" content="1">
@@ -541,6 +448,37 @@ var Projection = class {
       (c) => c.owner === owner && c.siteId === siteId
     ) ?? null;
   }
+  /**
+   * Every owner whose work this device's owner may run, as a list.
+   *
+   * The same question {@link mayRunFor} answers, asked in the direction a
+   * *store* can use. That difference is the crux of making `claim` atomic
+   * (cloud_006 §3.2).
+   *
+   * Today `claim` scans every job and calls `mayRunFor` per candidate, which
+   * works because the projection is a local object. A shared routing store
+   * cannot do that: the filter has to travel to the store, and a predicate
+   * does not travel — you cannot send a closure to Valkey. So the projection
+   * is collapsed to **data** here and handed over as a set the store can
+   * match on.
+   *
+   * That the collapse is possible at all is a property of the design worth
+   * noticing: `mayRunFor` is a finite lookup over consent and rosters, not a
+   * computation over the jobs. If it ever became job-dependent — "may run
+   * work of this size", say — an atomic claim would stop being expressible,
+   * and that is the moment to argue rather than to add a parameter.
+   *
+   * The owner is always included: a device runs its owner's work, and the
+   * relay checks that before it checks a roster.
+   */
+  ownersRunnableBy(deviceOwner) {
+    const owners = /* @__PURE__ */ new Set([deviceOwner]);
+    for (const roster of this.#fixture.rosters) {
+      if (roster.owner !== deviceOwner) continue;
+      for (const member of roster.members) owners.add(member);
+    }
+    return [...owners];
+  }
   /**
    * May this device's owner run work belonging to `jobOwner`?
    *
@@ -608,7 +546,7 @@ var SitePlane = class {
    * stranger presence, claims and lease ids, and "who is online right now" is
    * exactly the fact a blind relay is otherwise so careful not to reveal.
    */
-  #authed(auth, body, schema, siteIdOf, run) {
+  async #authed(auth, body, schema, siteIdOf, run) {
     const signature = RequestSignature2.safeParse(auth.signature);
     if (!signature.success) {
       return fail2(401, "unauthorized", "this request is not signed");
@@ -644,8 +582,8 @@ var SitePlane = class {
       body,
       EnqueueRequest,
       (request) => request.siteId,
-      (request, siteId) => {
-        const job = this.#deps.state.enqueue({
+      async (request, siteId) => {
+        const job = await this.#deps.state.enqueue({
           id: request.stub.id,
           siteId,
           stub: request.stub
@@ -668,9 +606,9 @@ var SitePlane = class {
       { siteId },
       QueryRequest,
       (request) => request.siteId,
-      (_request, site) => {
-        this.#deps.state.sweep(this.#deps.now());
-        const jobs = this.#deps.state.awaiting(site).map((job) => ({
+      async (_request, site) => {
+        await this.#deps.state.sweep();
+        const jobs = (await this.#deps.state.awaiting(site)).map((job) => ({
           jobId: job.id,
           // Non-null by construction: `awaiting` only returns claimed jobs.
           // The optional chain is here so a future state-machine edit that
@@ -692,22 +630,20 @@ var SitePlane = class {
       body,
       PayloadRequest,
       (request) => request.siteId,
-      (request, siteId) => {
-        const job = this.#deps.state.job(request.jobId);
-        if (job?.siteId !== siteId) {
-          return fail2(404, "not-found", "unknown job");
-        }
-        if (job.state !== "awaiting-payload") {
-          return fail2(
+      async (request, siteId) => {
+        const sealed = await this.#deps.state.seal({
+          jobId: request.jobId,
+          siteId,
+          envelope: request.envelope
+        });
+        if ("refused" in sealed) {
+          return sealed.refused === "not-found" ? fail2(404, "not-found", "unknown job") : fail2(
             409,
             "too-late",
-            `job is ${job.state}, not awaiting payload`
+            `job is ${sealed.was ?? "gone"}, not awaiting payload`
           );
         }
-        job.payload = request.envelope;
-        job.state = "ready";
-        delete job.awaitingUntil;
-        return ok2({ jobId: job.id, state: job.state });
+        return ok2({ jobId: request.jobId, state: sealed.state });
       }
     );
   }
@@ -718,8 +654,8 @@ var SitePlane = class {
       { siteId },
       QueryRequest,
       (request) => request.siteId,
-      (_request, site) => {
-        const jobs = this.#deps.state.finished(site).map((job) => ({
+      async (_request, site) => {
+        const jobs = (await this.#deps.state.finished(site)).map((job) => ({
           jobId: job.id,
           envelope: job.result,
           disposition: job.disposition,
@@ -739,6 +675,248 @@ var SitePlane = class {
   }
 };
 
+// src/state.ts
+import { randomUUID } from "crypto";
+var AWAITING_PAYLOAD_MS = 1e4;
+var RelayState = class {
+  #jobs = /* @__PURE__ */ new Map();
+  #presence = /* @__PURE__ */ new Map();
+  #now;
+  constructor(options = {}) {
+    this.#now = options.now ?? Date.now;
+  }
+  /** The one clock every deadline in this store is stamped from. */
+  async now() {
+    return this.#now();
+  }
+  /**
+   * Take a stub for routing. The payload is not here and will not be.
+   *
+   * **Idempotent by job id, and that is a security property rather than a
+   * convenience.** Site-plane calls are authenticated by signature, and
+   * byollm_009 §4.2's argument for signing the request instead of a
+   * server-issued nonce rests entirely on every write being idempotent per the
+   * instance it names. This one was not: re-enqueueing a known id built a
+   * fresh `queued` job over the top of the old one, discarding a live claim,
+   * its lease and any payload the site had already sealed to a device. A
+   * replayed enqueue inside the two-minute freshness window was therefore a
+   * way to yank a job back from the machine running it — the `release` bug of
+   * §4.2, rediscovered on the other plane.
+   *
+   * So a known id returns what is already routing, unchanged. A site that
+   * restarts and republishes its queue is the normal case, and it must not
+   * disturb work in flight.
+   */
+  enqueue(input) {
+    const existing = this.#jobs.get(input.id);
+    if (existing) return Promise.resolve(existing);
+    const job = {
+      id: input.id,
+      siteId: input.siteId,
+      stub: input.stub,
+      state: "queued"
+    };
+    this.#jobs.set(job.id, job);
+    return Promise.resolve(job);
+  }
+  job(jobId) {
+    return Promise.resolve(this.#jobs.get(jobId));
+  }
+  jobs() {
+    return Promise.resolve([...this.#jobs.values()]);
+  }
+  /** Jobs a site must seal for, right now. */
+  async awaiting(siteId) {
+    return (await this.jobs()).filter(
+      (j) => j.siteId === siteId && j.state === "awaiting-payload"
+    );
+  }
+  /** Sealed results waiting to go home. */
+  async finished(siteId) {
+    return (await this.jobs()).filter(
+      (j) => j.siteId === siteId && j.state === "done" && j.result !== void 0
+    );
+  }
+  /**
+   * Claim work — one operation, because it has to be.
+   *
+   * Moved here wholesale from `DaemonPlane`, where it was a scan followed by
+   * per-job mutation. Nothing about the *decision* changed; what changed is
+   * that a store can now implement it, because the filter and the write are
+   * one call rather than a loop the caller drives.
+   *
+   * The order of the guards is worth preserving as-is when this becomes a Lua
+   * script: cheapest first, and `owners` last because it is the only one that
+   * needed the projection.
+   */
+  async claim(input) {
+    const now = await this.now();
+    await this.sweep();
+    const granted = [];
+    for (const job of this.#jobs.values()) {
+      if (granted.length >= input.max) break;
+      if (job.state !== "queued") continue;
+      if (job.siteId !== input.siteId) continue;
+      if (!input.kinds.has(job.stub.kind)) continue;
+      if (!input.owners.has(job.stub.owner)) continue;
+      const leaseId = randomUUID();
+      job.state = "awaiting-payload";
+      job.claimedBy = {
+        runnerId: input.runnerId,
+        owner: input.owner,
+        device: input.device,
+        leaseId,
+        leaseExpiresAt: now + input.leaseMs
+      };
+      job.awaitingUntil = now + AWAITING_PAYLOAD_MS;
+      granted.push({
+        ...job.stub,
+        lease: {
+          id: leaseId,
+          runnerId: input.runnerId,
+          expiresAt: job.claimedBy.leaseExpiresAt
+        }
+      });
+    }
+    return granted;
+  }
+  /**
+   * Hand over the sealed payload to the device that holds the lease.
+   *
+   * The read and the state transition are one operation for the same reason
+   * `claim` is: `running` must be set by whoever was told the envelope, or two
+   * replicas can both hand out the same work and both believe they were first.
+   */
+  takePayload(input) {
+    const job = this.#jobs.get(input.jobId);
+    if (!job) return Promise.resolve({ refused: "not-found" });
+    if (job.claimedBy?.runnerId !== input.runnerId) {
+      return Promise.resolve({ refused: "not-holder" });
+    }
+    if (job.claimedBy.leaseId !== input.leaseId) {
+      return Promise.resolve({ refused: "stale-lease" });
+    }
+    if (!job.payload) return Promise.resolve({ refused: "not-ready" });
+    job.state = "running";
+    return Promise.resolve({ envelope: job.payload });
+  }
+  /**
+   * Record a finished job.
+   *
+   * `RESULT_IDEMPOTENT` lives here rather than in the caller: a replayed
+   * result must be a no-op decided by the same operation that would have
+   * written it, or two replicas can both decide they were the first.
+   */
+  complete(input) {
+    const job = this.#jobs.get(input.jobId);
+    if (!job) return Promise.resolve({ refused: "not-found" });
+    if (job.claimedBy?.runnerId !== input.runnerId) {
+      return Promise.resolve({ refused: "not-holder" });
+    }
+    if (job.state === "done") {
+      return Promise.resolve({ accepted: false, state: job.state });
+    }
+    job.result = input.envelope;
+    job.disposition = input.disposition;
+    job.state = "done";
+    return Promise.resolve({ accepted: true, state: job.state });
+  }
+  /** Give back leases this runner holds, naming each grant it means. */
+  releaseLeases(input) {
+    const released = [];
+    for (const { jobId, leaseId } of input.leases) {
+      const job = this.#jobs.get(jobId);
+      if (!job || job.claimedBy?.runnerId !== input.runnerId) continue;
+      if (job.claimedBy.leaseId !== leaseId) continue;
+      this.#requeue(job);
+      released.push(jobId);
+    }
+    return Promise.resolve(released);
+  }
+  /**
+   * Take a site's sealed payload for a claimed job.
+   *
+   * Refuses anything not `awaiting-payload`, which is what makes the timeout
+   * mean something: a late seal must not land on a claim that has moved.
+   */
+  seal(input) {
+    const job = this.#jobs.get(input.jobId);
+    if (job?.siteId !== input.siteId) {
+      return Promise.resolve({ refused: "not-found" });
+    }
+    if (job.state !== "awaiting-payload") {
+      return Promise.resolve({ refused: "too-late", was: job.state });
+    }
+    job.payload = input.envelope;
+    job.state = "ready";
+    delete job.awaitingUntil;
+    return Promise.resolve({ state: job.state });
+  }
+  /** Which of these leases this runner no longer holds. */
+  lostLeases(runnerId, active) {
+    void runnerId;
+    return Promise.resolve(
+      active.filter(({ jobId, leaseId }) => {
+        const job = this.#jobs.get(jobId);
+        return job?.claimedBy?.leaseId !== leaseId;
+      }).map(({ jobId }) => jobId)
+    );
+  }
+  async seen(presence) {
+    const lastSeenAt = await this.now();
+    const existing = this.#presence.get(presence.runnerId);
+    if (existing) {
+      existing.lastSeenAt = lastSeenAt;
+      return existing;
+    }
+    const fresh = { ...presence, lastSeenAt, revoked: false };
+    this.#presence.set(presence.runnerId, fresh);
+    return fresh;
+  }
+  presence(runnerId) {
+    return Promise.resolve(this.#presence.get(runnerId));
+  }
+  everyone() {
+    return Promise.resolve([...this.#presence.values()]);
+  }
+  /**
+   * Return a job to the queue, forgetting the claim.
+   *
+   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is
+   * why the awaiting-payload timeout is cheap to fire: the worst case is that
+   * a device did nothing for ten seconds and another one gets a turn.
+   */
+  #requeue(job) {
+    job.state = "queued";
+    delete job.claimedBy;
+    delete job.awaitingUntil;
+    delete job.payload;
+  }
+  /**
+   * Fire whatever the clock says is due, and report it.
+   *
+   * Returns the jobs it requeued so a caller can log or surface them — a
+   * timeout that fires invisibly is indistinguishable from a job that was
+   * never claimed, and those want very different debugging.
+   */
+  async sweep() {
+    const now = await this.now();
+    const requeued = [];
+    for (const job of this.#jobs.values()) {
+      if (job.state === "awaiting-payload" && (job.awaitingUntil ?? 0) <= now) {
+        this.#requeue(job);
+        requeued.push(job);
+      }
+      const lease = job.claimedBy;
+      if (lease && (job.state === "ready" || job.state === "running") && lease.leaseExpiresAt <= now) {
+        this.#requeue(job);
+        requeued.push(job);
+      }
+    }
+    return requeued;
+  }
+};
+
 // src/index.ts
 var Relay = class {
   state;
@@ -748,7 +926,7 @@ var Relay = class {
   #now;
   #basePath;
   constructor(options) {
-    this.state = new RelayState();
+    this.state = options.store ?? new RelayState({ now: options.now ?? Date.now });
     this.projection = new Projection(options.fixture);
     this.#now = options.now ?? Date.now;
     this.#basePath = (options.basePath ?? "/byollm").replace(/\/+$/, "");
@@ -779,15 +957,16 @@ var Relay = class {
    * site vanished should return to the queue without waiting for someone to
    * ask about it.
    */
-  sweep() {
-    return { requeued: this.state.sweep(this.#now()).map((j) => j.id) };
+  async sweep() {
+    const requeued = await this.state.sweep();
+    return { requeued: requeued.map((j) => j.id) };
   }
   /** The whole HTTP surface. */
   async handle(request) {
     const url = new URL(request.url);
     const path = url.pathname;
     if (path === "/debug" || path === `${this.#basePath}/debug`) {
-      return new Response(debugPage(this.state, this.#now()), {
+      return new Response(await debugPage(this.state, this.#now()), {
         headers: { "content-type": "text/html; charset=utf-8" }
       });
     }
@@ -805,19 +984,25 @@ var Relay = class {
       signature: signatureFrom(request.headers, "x-byollm-site")
     };
     if (path === "/relay/site/enqueue") {
-      return json(this.#site.enqueue(siteAuth, body));
+      return json(await this.#site.enqueue(siteAuth, body));
     }
     if (path === "/relay/site/payload") {
-      return json(this.#site.payload(siteAuth, body));
+      return json(await this.#site.payload(siteAuth, body));
     }
     if (path === "/relay/site/pending") {
       return json(
-        this.#site.pending(siteAuth, url.searchParams.get("siteId") ?? "")
+        await this.#site.pending(
+          siteAuth,
+          url.searchParams.get("siteId") ?? ""
+        )
       );
     }
     if (path === "/relay/site/results") {
       return json(
-        this.#site.results(siteAuth, url.searchParams.get("siteId") ?? "")
+        await this.#site.results(
+          siteAuth,
+          url.searchParams.get("siteId") ?? ""
+        )
       );
     }
     if (!path.startsWith(`${this.#basePath}/`)) {
@@ -825,17 +1010,17 @@ var Relay = class {
     }
     switch (auth.endpoint) {
       case "pair":
-        return json(this.#daemon.pair(body));
+        return json(await this.#daemon.pair(body));
       case "claim":
-        return json(this.#daemon.claim(auth, body));
+        return json(await this.#daemon.claim(auth, body));
       case "fetch":
-        return json(this.#daemon.fetch(auth, body));
+        return json(await this.#daemon.fetch(auth, body));
       case "result":
-        return json(this.#daemon.result(auth, body));
+        return json(await this.#daemon.result(auth, body));
       case "heartbeat":
-        return json(this.#daemon.heartbeat(auth, body));
+        return json(await this.#daemon.heartbeat(auth, body));
       case "release":
-        return json(this.#daemon.release(auth, body));
+        return json(await this.#daemon.release(auth, body));
       default:
         return json({ status: 404, body: { error: "not-found" } });
     }