@byollm/relay 0.1.0-alpha.9 → 0.1.0-alpha.91

package/README.md

@@ -1,14 +1,117 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.9`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.91`) — under active development. Don't use this yet.**
 >
 > This is a walking skeleton. It routes real jobs between real daemons and real
 > sites, and it is the fixture byollm_009 freezes against — but it keeps its
 > state in memory, serves one site, and has never run anywhere but a test.
+>
+> **`alpha.15` is a breaking wire change, and it breaks daemons and relays —
+> not app authors.** If you call `app.enqueue(...)` and read results, nothing
+> in your code changes. If you run a daemon or an upstream, every package must
+> move together: a mixed pair refuses on both sides, because both ends parse
+> `.strict()`.
+>
+> What moved, all of it reconciling the frozen `byollm_009` with its code:
+> `JobStub` gains `site` (the site's identity key id) and loses
+> `audienceAllow`; `ResultRequest` gains `leaseId`; `HeartbeatResponse` loses
+> `leases`, which nothing read; `WireErrorCode` gains `not-ready`,
+> `clock-skew` and `forbidden`, and `403` is `forbidden` rather than
+> `unauthorized`. `RESULT_PROVENANCE` is superseded by
+> `PROVENANCE_NAMES_DEVICE`. See `byollm_009` Amendment A.>
+> **`alpha.16` is a breaking wire change — daemons and relays again, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together: both ends parse `.strict()`, so a mixed pair
+> refuses.
+>
+> What moved, all of it Tier 2 of `cloud_008`: `model`, `backendClass` and
+> `durationMs` come off `ResultRequest` and are sealed **inside** the result
+> envelope as `SealedOutcome = { outcome, ran }` — so a daemon can no longer
+> declare a model it did not sign, and a relay carries neither.
+> `HeartbeatResponse` loses `leases` (nothing read it) and now reports real
+> cancellations instead of an empty list. `WireErrorCode` gains `forbidden`
+> for 403, leaving `unauthorized` at exactly 401. The relay gained a
+> site-plane `cancel` endpoint, honours `stub.deadlineAt`, honours
+> `stub.audience`, and remembers a refusal.>
+> **`alpha.17` is additive** — no wire change. It exports `ReleaseReason`,
+> which `RoutingStore.releaseLeases` names and the package did not export, so
+> the interface was unimplementable outside this repo.>
+> **`alpha.18` is a breaking wire change — daemons and relays, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together.
+>
+> The **bearer token is gone**: off `PairPollResponse`, off the runner row,
+> off the daemon's pairings file, out of the adapter's schema. It was minted,
+> hashed and stored on two disks and never sent, looked up or compared —
+> `REQUESTS_SIGNED_NOT_BEARER` was enforced by signatures the whole time. If
+> you run the Supabase adapter, apply
+> `20260819000000_drop_runner_token.sql`; `byollm_approve_pairing` now takes
+> one argument. A pairings file written by an older daemon still loads.
+>
+> `model`, `backendClass` and `durationMs` moved **inside** the sealed result
+> (`SealedOutcome = { outcome, ran }`), so a daemon cannot declare a model it
+> did not sign and a relay carries none of them. Writing a `RoutingStore`?
+> `releaseLeases` takes an optional `reason` and `complete` requires
+> `leaseId`, and **an implementation that ignores either still typechecks** —
+> run the store contract tests.>
+> **`alpha.19` is additive on the wire and a behaviour change in every
+> store.** `ResultResponse` gains an optional `duplicate`. Nothing is removed,
+> so an older daemon keeps working — but the *order* two rules are checked in
+> has changed, and a `RoutingStore` implementation must change with it.
+>
+> `complete` now checks **terminal state before holder**, scoped to the device
+> that finished the job: a replay from that device is answered `duplicate:
+> true` with a 2xx, and anyone else gets exactly the refusal they would get
+> for a job that is not terminal. Previously `RESULT_IDEMPOTENT` held only
+> because the lease is nulled on success, so the holder check tripped first —
+> deleting the idempotency branch failed no test. Run the store contract
+> tests; the compiler cannot see this.
+
+<!-- release-note 0.1.0-alpha.21 -->
+> [!NOTE]
+> **`0.1.0-alpha.20` is not a complete release — do not pin it.** Four
+> packages published and `@byollm/server` did not: a Sigstore
+> transparency-log 409 on its provenance attestation. The workflow's
+> "already published" guard correctly refuses to resume a partial publish,
+> so `0.1.0-alpha.21` is that release, whole.
+>
+> If you run the Supabase adapter, `alpha.21` needs
+> `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
+> ordering without the column it stores the grant in.
+
+<!-- release-note 0.1.0-alpha.40 -->
+**`byollm start` — stop keeping a terminal open.** The daemon can now run
+under your computer's own supervisor and restart itself if it stops: a launchd
+agent on macOS, a `systemd --user` unit on Linux, a logon task on Windows. All
+user-level — no root, no system directories, and `byollm stop` takes it
+away. `byollm status` gained a line saying whether it is actually supervised
+right now, including the state that matters most: installed but not running,
+which looks fine from an app's dashboard and serves nothing.
+
+If you are running via `npx`, install properly first (`npm install -g
+byollm@latest`) — `install` refuses to supervise a copy in npx's cache, because
+npm deletes that directory and the service would fail at some later boot.
+
+<!-- release-note 0.1.0-alpha.41 -->
+**`onNoRunner` takes a string.** Your fallback answer is your own value, not
+wire data, and handing back a whole result record for it was ceremony — the
+README's own example got the shape wrong, which is how this was found.
+
+```ts
+const { outcome, fallback } = await job.result({
+  onNoRunner: () => runOnHostedModel(transcript),
+});
+```
+
+Whatever you return, `result()` labels it `fallback: true` — the stamp is
+applied by the wait, not taken from you, so an answer that did not run on
+somebody's device cannot be reported as though it did (`FALLBACK_LABELED`).
+Both delivery channels do it, polling and Supabase Realtime. Records still
+work; they just get labelled too.
 
 # `@byollm/relay`
 
 The **reference relay**: it routes byollm jobs between a site and someone's
-machine while holding no key that can open either end's traffic.
+device while holding no key that can open either end's traffic.
 
 ```
   site ──stub──▶  relay  ◀──claim── daemon
@@ -19,7 +122,7 @@ machine while holding no key that can open either end's traffic.
 
 ## Why a relay can be blind
 
-A payload is encrypted to the machine that runs it. Nobody knows which machine
+A payload is encrypted to the device that runs it. Nobody knows which device
 that is until one claims the job — so the site publishes a **stub** first
 (byollm_009 §6: user, kind, size class, audience, deadline, streaming flag, and
 nothing else), a daemon claims it, and only then does the site seal the work to
@@ -80,14 +183,32 @@ daemons pin at pairing, verified against the `sites` half of the projection.
 Nothing here trusts a `siteId` in a body or a query string.
 
 That is newer than the rest of this package. The site plane took the caller's
-word for who it was until `0.1.0-alpha.9`, which on a relay reachable from the
-internet is an open enqueue endpoint into consenting users' machines and an
+word for who it was until `0.1.0-alpha.8`, which on a relay reachable from the
+internet is an open enqueue endpoint into consenting users' devices and an
 open read of who is online. It was blind the whole time — nothing could open a
 payload — and blind is not the same as safe.
 
 If you are running this: the site plane is authenticated but this is still a
 single-tenant relay with in-memory state. One site, one replica.
 
+## Breaking in `0.1.0-alpha.12`: `RelayState` is async
+
+Every method on `RelayState` now returns a `Promise`, and `Relay.sweep()` and
+`debugPage()` with it. `RelayState.requeue` is private — it was only ever a
+step inside another operation.
+
+Nothing about the behaviour changed. The shape did, and it had to before
+routing state can live anywhere but this process: a store on a network cannot
+offer a synchronous read, and — more importantly — cannot offer a *read the
+caller follows with a write*. So the operations are now decisions plus their
+writes (`claim`, `takePayload`, `complete`, `releaseLeases`, `seal`) rather
+than scans the caller mutates.
+
+`claim` is the one that matters. It was atomic for exactly one reason — Node
+is single-threaded and the Maps are local — and `CLAIM_ATOMIC` is a MUST. See
+`packages/relay/test/two-replicas.test.ts`, where the resulting race is a
+failing assertion waiting for the fix.
+
 ## Running it
 
 ```ts
@@ -111,4 +232,40 @@ const response = await relay.handle(request);
 `awaiting-payload` timer has left. It shows no prompt or result text — not
 because it filters them out, but because the relay does not have them.
 
+**Do not serve `/debug` on the internet.** It shows no payloads and it does
+show who is online, which device holds what, and every lease in flight — the
+same metadata the site plane's signatures exist to protect, through a
+different door. Whoever serves this package decides that, which is why the
+route is still here: refuse it at your gateway and reach it through an
+authenticated channel instead.
+
+## Auditing a deployment
+
+`@byollm/conformance` ships a posture audit that holds nothing but a URL,
+which is what an attacker has:
+
+```bash
+npx byollm-audit-deployment https://your-relay.example
+```
+
+It exists because eight of byollm_009's findings came from a suite in which
+nothing was ever a stranger — the site had a reference to the relay object and
+called it. A harness that invokes the system under test directly cannot see
+anything about how the system is *reached*, and the ninth finding was in that
+gap. Safe to run against production: nothing writes, nothing floods.
+
 MIT
+
+<!-- family:start -->
+
+## The rest of byollm
+
+Six packages, and they are only interesting together:
+
+- [`byollm`](https://www.npmjs.com/package/byollm) — the daemon — runs models on your own machine and answers for it
+- [`@byollm/protocol`](https://www.npmjs.com/package/@byollm/protocol) — the wire: envelopes, signatures and the closed vocabularies both ends validate against
+- [`@byollm/server`](https://www.npmjs.com/package/@byollm/server) — the SDK a site uses to ask a device for work
+- [`@byollm/control-plane`](https://www.npmjs.com/package/@byollm/control-plane) — who may ask whom, and the policy store behind it
+- [`@byollm/conformance`](https://www.npmjs.com/package/@byollm/conformance) — the kit that proves an implementation is one — including a posture audit that holds nothing but a URL
+
+<!-- family:end -->

package/dist/chunk-4ISUXCIO.js

@@ -0,0 +1,484 @@
+// src/state.ts
+import { randomUUID } from "crypto";
+var AWAITING_PAYLOAD_MS = 1e4;
+var UNSEALED_PER_PAIR = 2;
+var SEAL_ATTEMPTS_BEFORE_EVICTION = 3;
+var RETRY_AFTER_MS = 3e4;
+var routeKey = (siteId, owner) => `${siteId}\0${owner}`;
+var CHURN_EXPIRIES = 6;
+var CHURN_WINDOW_MS = 5 * 6e4;
+var CHURN_QUIET_MS = 60 * 6e4;
+var keyOf = (siteId, jobId) => `${siteId}\0${jobId}`;
+var RelayState = class {
+  /**
+   * Jobs by **(site, id)** — cloud_009 §3.
+   *
+   * A job id is a site's to choose, so two sites can choose the same one.
+   * Keyed by the bare id, the second site's enqueue returned the first
+   * site's job (cloud_008 finding 58), and the refusal that fixed it was a
+   * cross-tenant existence oracle. Keyed by the pair, the collision does not
+   * exist and there is nothing to refuse.
+   *
+   * `\u0000` as the separator, because a site id is a uuid and a job id is
+   * whatever a site chose — including, one day, a string with a colon in it.
+   * A separator that cannot appear in either half is the difference between
+   * a key and a parser.
+   */
+  #jobs = /* @__PURE__ */ new Map();
+  /**
+   * Grants by lease id, so a holder-scoped call needs no site — §3.
+   *
+   * `takePayload`, `complete`, `releaseLeases` and `renewLeases` carry a
+   * `leaseId` the relay minted, which is unique across every site. That is
+   * what lets those four signatures stay as they are: the caller names the
+   * grant, and the grant names the job. A daemon never has to know a site id
+   * to answer for work it holds.
+   */
+  #byLease = /* @__PURE__ */ new Map();
+  /**
+   * Jobs by bare id, across sites — the refusal path.
+   *
+   * The lease index alone answers the happy case and gets the refusals
+   * wrong: a **stale** lease finds nothing, so `LEASE_HONORED`'s "your grant
+   * ended" becomes "no such job", and a daemon that was slow is told
+   * something untrue about the work it was doing. Distinguishing
+   * `not-found`, `not-holder` and `stale-lease` needs the job even when the
+   * lease named is over, and that is what this is for.
+   *
+   * A list rather than a single value: two sites may choose one id, which is
+   * the whole reason `#jobs` is keyed by the pair.
+   */
+  #byJobId = /* @__PURE__ */ new Map();
+  /**
+   * The job a holder-scoped call is about, without a site id.
+   *
+   * The exact grant first, and **checked against the job the caller named**:
+   * a lease id belonging to another job would otherwise hand over that job's
+   * payload to somebody holding a valid-looking grant. Then the same job held
+   * by this runner under an older grant, which is what `stale-lease` is.
+   *
+   * And then nothing — V1-8. There used to be a third step: any job with that
+   * id, which produced `not-holder` where an absent job produces `not-found`.
+   * Since job ids are chosen per site, a runner could name a bare id it had
+   * no relationship with and learn from the status code whether some *other*
+   * tenant had a job by that name. Finding 58's existence oracle, through the
+   * holder door.
+   *
+   * The distinction it bought was never acted on: a daemon abandons the work
+   * either way. So a caller now learns about jobs it holds or held, and about
+   * nothing else.
+   */
+  #grantFor(jobId, runnerId, leaseId) {
+    const exact = this.#byLease.get(leaseId);
+    if (exact?.id === jobId) return exact;
+    const candidates = this.#byJobId.get(jobId) ?? [];
+    return candidates.find((job) => job.claimedBy?.runnerId === runnerId);
+  }
+  #index(job) {
+    const bare = this.#byJobId.get(job.id);
+    if (bare) {
+      if (!bare.includes(job)) bare.push(job);
+    } else {
+      this.#byJobId.set(job.id, [job]);
+    }
+  }
+  /**
+   * Record an unsealed grant expiring, and report a pair that keeps doing it.
+   *
+   * Reported at the crossing rather than on every expiry after it, and then
+   * quiet for {@link CHURN_QUIET_MS} — a walk produces one of these every ten
+   * seconds, and an alert per expiry is an alert somebody filters.
+   *
+   * The callback is never awaited and its throw is swallowed: a report is
+   * evidence ABOUT the sweep, not part of it, and a mail server being down
+   * must not stop jobs being requeued.
+   */
+  #noteChurn(siteId, owner, now) {
+    const report = this.#churnReport;
+    if (report === void 0) return;
+    const pair = routeKey(siteId, owner);
+    const seen = [...this.#churn.get(pair) ?? [], now].filter(
+      (at) => now - at <= CHURN_WINDOW_MS
+    );
+    this.#churn.set(pair, seen);
+    if (seen.length < CHURN_EXPIRIES) return;
+    const told = this.#churnReported.get(pair);
+    if (told !== void 0 && now - told < CHURN_QUIET_MS) return;
+    this.#churnReported.set(pair, now);
+    try {
+      report({
+        siteId,
+        owner,
+        expiries: seen.length,
+        windowMs: CHURN_WINDOW_MS
+      });
+    } catch {
+    }
+  }
+  #forget(job) {
+    this.#jobs.delete(keyOf(job.siteId, job.id));
+    const bare = (this.#byJobId.get(job.id) ?? []).filter((it) => it !== job);
+    if (bare.length === 0) this.#byJobId.delete(job.id);
+    else this.#byJobId.set(job.id, bare);
+    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);
+  }
+  /**
+   * When each pair's unsealed grants expired, and when it was last reported.
+   *
+   * Timestamps rather than a counter, because the threshold is "inside a
+   * window" — a counter would have to be reset by something, and whatever
+   * reset it would be the thing to get wrong. Trimmed on write, so it holds
+   * at most a window's worth per pair.
+   */
+  #churn = /* @__PURE__ */ new Map();
+  #churnReported = /* @__PURE__ */ new Map();
+  #presence = /* @__PURE__ */ new Map();
+  #now;
+  /** Kept whole rather than destructured: B187's report seam lives on it. */
+  #churnReport;
+  constructor(options = {}) {
+    this.#now = options.now ?? Date.now;
+    this.#churnReport = options.onUnsealedChurn;
+  }
+  /** The one clock every deadline in this store is stamped from. */
+  async now() {
+    return this.#now();
+  }
+  /**
+   * Take a stub for routing. The payload is not here and will not be.
+   *
+   * **Idempotent by job id, and that is a security property rather than a
+   * convenience.** Site-plane calls are authenticated by signature, and
+   * byollm_009 §4.2's argument for signing the request instead of a
+   * server-issued nonce rests entirely on every write being idempotent per the
+   * instance it names. This one was not: re-enqueueing a known id built a
+   * fresh `queued` job over the top of the old one, discarding a live claim,
+   * its lease and any payload the site had already sealed to a device. A
+   * replayed enqueue inside the two-minute freshness window was therefore a
+   * way to yank a job back from the machine running it — the `release` bug of
+   * §4.2, rediscovered on the other plane.
+   *
+   * So a known id returns what is already routing, unchanged. A site that
+   * restarts and republishes its queue is the normal case, and it must not
+   * disturb work in flight.
+   */
+  enqueue(input) {
+    const existing = this.#jobs.get(keyOf(input.siteId, input.id));
+    if (existing) return Promise.resolve(existing);
+    const job = {
+      id: input.id,
+      siteId: input.siteId,
+      stub: input.stub,
+      state: "queued",
+      refusedBy: []
+    };
+    this.#jobs.set(keyOf(job.siteId, job.id), job);
+    this.#index(job);
+    return Promise.resolve(job);
+  }
+  job(siteId, jobId) {
+    return Promise.resolve(this.#jobs.get(keyOf(siteId, jobId)));
+  }
+  jobs() {
+    return Promise.resolve([...this.#jobs.values()]);
+  }
+  /** Jobs a site must seal for, right now. */
+  async awaiting(siteId) {
+    return (await this.jobs()).filter(
+      (j) => j.siteId === siteId && j.state === "awaiting-payload"
+    );
+  }
+  /** Sealed results waiting to go home. */
+  async finished(siteId) {
+    return (await this.jobs()).filter(
+      (j) => j.siteId === siteId && j.state === "done" && j.result !== void 0
+    );
+  }
+  /**
+   * Claim work — one operation, because it has to be.
+   *
+   * Moved here wholesale from `DaemonPlane`, where it was a scan followed by
+   * per-job mutation. Nothing about the *decision* changed; what changed is
+   * that a store can now implement it, because the filter and the write are
+   * one call rather than a loop the caller drives.
+   *
+   * The order of the guards is worth preserving as-is when this becomes a Lua
+   * script: cheapest first, and `owners` last because it is the only one that
+   * needed the projection.
+   */
+  async claim(input) {
+    const now = await this.now();
+    await this.sweep();
+    const granted = [];
+    const unsealed = /* @__PURE__ */ new Map();
+    for (const job of this.#jobs.values()) {
+      if (job.state !== "awaiting-payload") continue;
+      const pair = routeKey(job.siteId, job.stub.owner);
+      unsealed.set(pair, (unsealed.get(pair) ?? 0) + 1);
+    }
+    for (const job of this.#jobs.values()) {
+      if (granted.length >= input.max) break;
+      if (job.state !== "queued") continue;
+      if (!input.routes.has(routeKey(job.siteId, job.stub.owner))) continue;
+      if (job.reofferTo !== void 0 && job.reofferTo !== input.runnerId) {
+        continue;
+      }
+      const pair = routeKey(job.siteId, job.stub.owner);
+      if ((unsealed.get(pair) ?? 0) >= UNSEALED_PER_PAIR) continue;
+      if (!input.kinds.has(job.stub.kind)) continue;
+      if (job.refusedBy.includes(input.runnerId)) continue;
+      if ((job.retryAfter?.[input.runnerId] ?? 0) > now) continue;
+      if (job.cancelled) continue;
+      if (job.stub.audience === "private" && job.stub.owner !== input.owner) {
+        continue;
+      }
+      const leaseId = randomUUID();
+      job.state = "awaiting-payload";
+      job.claimedBy = {
+        runnerId: input.runnerId,
+        owner: input.owner,
+        device: input.device,
+        leaseId,
+        leaseExpiresAt: now + input.leaseMs
+      };
+      job.awaitingUntil = now + AWAITING_PAYLOAD_MS;
+      unsealed.set(pair, (unsealed.get(pair) ?? 0) + 1);
+      this.#byLease.set(leaseId, job);
+      granted.push({
+        ...job.stub,
+        lease: {
+          id: leaseId,
+          runnerId: input.runnerId,
+          expiresAt: job.claimedBy.leaseExpiresAt
+        }
+      });
+    }
+    return granted;
+  }
+  /**
+   * Hand over the sealed payload to the device that holds the lease.
+   *
+   * The read and the state transition are one operation for the same reason
+   * `claim` is: `running` must be set by whoever was told the envelope, or two
+   * replicas can both hand out the same work and both believe they were first.
+   */
+  takePayload(input) {
+    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);
+    if (!job) return Promise.resolve({ refused: "not-found" });
+    if (job.claimedBy?.runnerId !== input.runnerId) {
+      return Promise.resolve({ refused: "not-holder" });
+    }
+    if (job.claimedBy.leaseId !== input.leaseId) {
+      return Promise.resolve({ refused: "stale-lease" });
+    }
+    if (!job.payload) return Promise.resolve({ refused: "not-ready" });
+    if (job.state !== "ready" && job.state !== "running") {
+      return Promise.resolve({ refused: "terminal" });
+    }
+    job.state = "running";
+    return Promise.resolve({ envelope: job.payload });
+  }
+  /**
+   * Record a finished job.
+   *
+   * `RESULT_IDEMPOTENT` lives here rather than in the caller: a replayed
+   * result must be a no-op decided by the same operation that would have
+   * written it, or two replicas can both decide they were the first.
+   */
+  complete(input) {
+    const job = this.#grantFor(input.jobId, input.runnerId, input.leaseId);
+    if (!job) return Promise.resolve({ refused: "not-found" });
+    if (job.claimedBy?.runnerId !== input.runnerId) {
+      return Promise.resolve({ refused: "not-holder" });
+    }
+    if (job.state === "done") {
+      const sameGrant = job.claimedBy.leaseId === input.leaseId;
+      return Promise.resolve(
+        sameGrant ? { accepted: false, duplicate: true, state: job.state } : { refused: "stale-lease" }
+      );
+    }
+    if (job.claimedBy.leaseId !== input.leaseId) {
+      return Promise.resolve({ refused: "stale-lease" });
+    }
+    job.result = input.envelope;
+    job.disposition = input.disposition;
+    job.state = "done";
+    return Promise.resolve({ accepted: true, state: job.state });
+  }
+  /** Give back leases this runner holds, naming each grant it means. */
+  releaseLeases(input) {
+    const released = [];
+    for (const { jobId, leaseId } of input.leases) {
+      const job = this.#grantFor(jobId, input.runnerId, leaseId);
+      if (!job || job.claimedBy?.runnerId !== input.runnerId) continue;
+      if (job.claimedBy.leaseId !== leaseId) continue;
+      if (job.state === "done") continue;
+      if (input.reason === "refused" && !job.refusedBy.includes(input.runnerId)) {
+        job.refusedBy.push(input.runnerId);
+      }
+      if (input.retryAfter !== void 0) {
+        job.retryAfter = {
+          ...job.retryAfter,
+          [input.runnerId]: input.retryAfter
+        };
+      }
+      this.#requeue(job);
+      released.push(jobId);
+    }
+    return Promise.resolve(released);
+  }
+  /**
+   * Take a site's sealed payload for a claimed job.
+   *
+   * Refuses anything not `awaiting-payload`, which is what makes the timeout
+   * mean something: a late seal must not land on a claim that has moved.
+   */
+  seal(input) {
+    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));
+    if (job?.siteId !== input.siteId) {
+      return Promise.resolve({ refused: "not-found" });
+    }
+    if (job.state !== "awaiting-payload") {
+      return Promise.resolve({ refused: "too-late", was: job.state });
+    }
+    job.payload = input.envelope;
+    job.state = "ready";
+    delete job.awaitingUntil;
+    delete job.sealAttempts;
+    return Promise.resolve({ state: job.state });
+  }
+  /** {@link RoutingStore.cancel} — the site withdraws a job. */
+  cancel(input) {
+    const job = this.#jobs.get(keyOf(input.siteId, input.jobId));
+    if (job?.siteId !== input.siteId) return Promise.resolve(false);
+    job.cancelled = true;
+    return Promise.resolve(true);
+  }
+  /** {@link RoutingStore.cancelRequests} — cancelled jobs this runner holds. */
+  cancelRequests(runnerId) {
+    return Promise.resolve(
+      [...this.#jobs.values()].filter(
+        (job) => job.cancelled === true && job.claimedBy?.runnerId === runnerId
+      ).map((job) => ({
+        jobId: job.id,
+        leaseId: job.claimedBy?.leaseId ?? ""
+      })).filter((grant) => grant.leaseId !== "")
+    );
+  }
+  /** {@link RoutingStore.renewLeases} — extend what is still held, name what is not. */
+  async renewLeases(input) {
+    const now = await this.now();
+    const renewed = [];
+    const lost = [];
+    for (const { jobId, leaseId } of input.leases) {
+      const job = this.#grantFor(jobId, input.runnerId, leaseId);
+      const held = job?.claimedBy;
+      if (!job || held?.leaseId !== leaseId || held.runnerId !== input.runnerId) {
+        lost.push({ jobId, leaseId });
+        continue;
+      }
+      const expiresAt = now + input.leaseMs;
+      job.claimedBy = { ...held, leaseExpiresAt: expiresAt };
+      renewed.push({ jobId, expiresAt });
+    }
+    return { renewed, lost };
+  }
+  async seen(presence) {
+    const lastSeenAt = await this.now();
+    const existing = this.#presence.get(presence.runnerId);
+    if (existing) {
+      existing.lastSeenAt = lastSeenAt;
+      existing.capabilities = presence.capabilities;
+      existing.withheld = presence.withheld;
+      return existing;
+    }
+    const fresh = { ...presence, lastSeenAt };
+    this.#presence.set(presence.runnerId, fresh);
+    return fresh;
+  }
+  presence(runnerId) {
+    return Promise.resolve(this.#presence.get(runnerId));
+  }
+  /**
+   * Lose a record, the way a real store does.
+   *
+   * A shared store drops presence for reasons this one never will — a TTL, a
+   * reschedule, a restart — and the interesting behaviour is what the relay
+   * does next. `ValkeyRoutingStore` has carried the same helper since
+   * finding 52; this is its memory twin, so the case can be written once
+   * against the implementation that is easy to reason about.
+   */
+  dropPresenceForTests(runnerId) {
+    this.#presence.delete(runnerId);
+    return Promise.resolve();
+  }
+  everyone() {
+    return Promise.resolve([...this.#presence.values()]);
+  }
+  /**
+   * Return a job to the queue, forgetting the claim.
+   *
+   * The stub survives; nothing is lost. That is `LEASE_RECLAIMABLE` and it is
+   * why the awaiting-payload timeout is cheap to fire: the worst case is that
+   * a device did nothing for ten seconds and another one gets a turn.
+   */
+  #requeue(job) {
+    job.state = "queued";
+    if (job.claimedBy) this.#byLease.delete(job.claimedBy.leaseId);
+    delete job.claimedBy;
+    delete job.awaitingUntil;
+    delete job.payload;
+  }
+  /**
+   * Fire whatever the clock says is due, and report it.
+   *
+   * Returns the jobs it requeued so a caller can log or surface them — a
+   * timeout that fires invisibly is indistinguishable from a job that was
+   * never claimed, and those want very different debugging.
+   */
+  async sweep() {
+    const now = await this.now();
+    const requeued = [];
+    const expired = [];
+    for (const job of this.#jobs.values()) {
+      if (job.stub.deadlineAt <= now) {
+        this.#forget(job);
+        expired.push(job);
+        continue;
+      }
+      if (job.state === "awaiting-payload" && (job.awaitingUntil ?? 0) <= now) {
+        this.#noteChurn(job.siteId, job.stub.owner, now);
+        const abandonedBy = job.claimedBy?.runnerId;
+        if (abandonedBy !== void 0) job.reofferTo ??= abandonedBy;
+        const attempts = (job.sealAttempts ?? 0) + 1;
+        if (attempts >= SEAL_ATTEMPTS_BEFORE_EVICTION) {
+          this.#forget(job);
+          expired.push(job);
+          continue;
+        }
+        job.sealAttempts = attempts;
+        this.#requeue(job);
+        requeued.push(job);
+      }
+      const lease = job.claimedBy;
+      if (lease && (job.state === "ready" || job.state === "running") && lease.leaseExpiresAt <= now) {
+        this.#requeue(job);
+        requeued.push(job);
+      }
+    }
+    return [...requeued, ...expired];
+  }
+};
+
+export {
+  AWAITING_PAYLOAD_MS,
+  UNSEALED_PER_PAIR,
+  SEAL_ATTEMPTS_BEFORE_EVICTION,
+  RETRY_AFTER_MS,
+  routeKey,
+  CHURN_EXPIRIES,
+  CHURN_WINDOW_MS,
+  CHURN_QUIET_MS,
+  RelayState
+};
+//# sourceMappingURL=chunk-4ISUXCIO.js.map