@byollm/relay 0.1.0-alpha.17 → 0.1.0-alpha.18

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.17`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.18`) — under active development. Don't use this yet.**
 >
 > This is a walking skeleton. It routes real jobs between real daemons and real
 > sites, and it is the fixture byollm_009 freezes against — but it keeps its
@@ -31,7 +31,28 @@
 > cancellations instead of an empty list. `WireErrorCode` gains `forbidden`
 > for 403, leaving `unauthorized` at exactly 401. The relay gained a
 > site-plane `cancel` endpoint, honours `stub.deadlineAt`, honours
-> `stub.audience`, and remembers a refusal.
+> `stub.audience`, and remembers a refusal.>
+> **`alpha.17` is additive** — no wire change. It exports `ReleaseReason`,
+> which `RoutingStore.releaseLeases` names and the package did not export, so
+> the interface was unimplementable outside this repo.>
+> **`alpha.18` is a breaking wire change — daemons and relays, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together.
+>
+> The **bearer token is gone**: off `PairPollResponse`, off the runner row,
+> off the daemon's pairings file, out of the adapter's schema. It was minted,
+> hashed and stored on two disks and never sent, looked up or compared —
+> `REQUESTS_SIGNED_NOT_BEARER` was enforced by signatures the whole time. If
+> you run the Supabase adapter, apply
+> `20260819000000_drop_runner_token.sql`; `byollm_approve_pairing` now takes
+> one argument. A pairings file written by an older daemon still loads.
+>
+> `model`, `backendClass` and `durationMs` moved **inside** the sealed result
+> (`SealedOutcome = { outcome, ran }`), so a daemon cannot declare a model it
+> did not sign and a relay carries none of them. Writing a `RoutingStore`?
+> `releaseLeases` takes an optional `reason` and `complete` requires
+> `leaseId`, and **an implementation that ignores either still typechecks** —
+> run the store contract tests.
 
 # `@byollm/relay`
 
@@ -108,7 +129,7 @@ daemons pin at pairing, verified against the `sites` half of the projection.
 Nothing here trusts a `siteId` in a body or a query string.
 
 That is newer than the rest of this package. The site plane took the caller's
-word for who it was until `0.1.0-alpha.17`, which on a relay reachable from the
+word for who it was until `0.1.0-alpha.18`, which on a relay reachable from the
 internet is an open enqueue endpoint into consenting users' machines and an
 open read of who is online. It was blind the whole time — nothing could open a
 payload — and blind is not the same as safe.
@@ -116,7 +137,7 @@ payload — and blind is not the same as safe.
 If you are running this: the site plane is authenticated but this is still a
 single-tenant relay with in-memory state. One site, one replica.
 
-## Breaking in `0.1.0-alpha.17`: `RelayState` is async
+## Breaking in `0.1.0-alpha.18`: `RelayState` is async
 
 Every method on `RelayState` now returns a `Promise`, and `Relay.sweep()` and
 `debugPage()` with it. `RelayState.requeue` is private — it was only ever a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@byollm/relay",
-  "version": "0.1.0-alpha.17",
+  "version": "0.1.0-alpha.18",
   "type": "module",
   "description": "The reference relay: routes sealed byollm jobs between sites and daemons, holding no decryption keys by construction.",
   "license": "MIT",
@@ -27,16 +27,16 @@
   ],
   "dependencies": {
     "zod": "^4.1.13",
-    "@byollm/protocol": "0.1.0-alpha.17"
+    "@byollm/protocol": "0.1.0-alpha.18"
   },
   "publishConfig": {
     "access": "public"
   },
   "devDependencies": {
     "@supabase/supabase-js": "^2.112.2",
-    "@byollm/server": "0.1.0-alpha.17",
-    "byollm": "0.1.0-alpha.17",
-    "@byollm/conformance": "0.1.0-alpha.17"
+    "byollm": "0.1.0-alpha.18",
+    "@byollm/server": "0.1.0-alpha.18",
+    "@byollm/conformance": "0.1.0-alpha.18"
   },
   "scripts": {
     "build": "tsup"