@byollm/server 0.1.0-alpha.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Of Tomorrow, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,146 @@
+> [!WARNING]
+> **Alpha 0.1.0 — under active development. Don't use this yet.**
+>
+> > Install it deliberately: `npm install @byollm/server@alpha`.
+> The protocol is v0 and **will** change without a deprecation path, this has
+> never run outside its own test suite, and nothing here has production miles.
+> Read it, take the ideas, tell us what's wrong — but don't put it in front of
+> your users.
+>
+> npm assigns `latest` on a first publish and won't let it be removed, so the
+> alpha is also `latest`; the version is marked deprecated so every install
+> says so out loud.
+
+# `@byollm/server`
+
+What app developers drop into their backend: framework-agnostic protocol
+handlers, a reference in-memory store, a Next.js mount, and a Supabase
+adapter.
+
+```bash
+npm install @byollm/server
+```
+
+## The three-file integration
+
+**1. Mount the protocol.**
+
+```ts
+// app/api/byollm/[...route]/route.ts
+import { createHandler } from "@byollm/server/next";
+import { store } from "@/lib/byollm";
+
+export const { POST } = createHandler({
+  store,
+  verificationUrl: "https://your-app.com/settings/runners",
+});
+```
+
+**2. Pick a store.**
+
+```ts
+// lib/byollm.ts
+import { ByollmApp, MemoryStore } from "@byollm/server";
+
+export const store = new MemoryStore();
+export const app = new ByollmApp({ store });
+```
+
+**3. Enqueue.**
+
+```ts
+const job = await app.enqueue({
+  kind: "llm.generate",
+  audience: "self", // this user's own machine only — the default
+  owner: userId,
+  payload: { prompt: `Summarize this transcript:\n\n${transcript}` },
+});
+
+const { outcome } = await job.result({
+  timeoutMs: 120_000,
+  onNoRunner: () => runOnHostedModel(transcript),
+});
+```
+
+`result()` is sugar over your delivery channel with a timeout and a
+`noRunnerAvailable` path — never a bare promise that hangs forever. If nobody
+is online to run the job, you find out and can fall back.
+
+## The approval page
+
+Pairing is a device-code exchange, so you need one page where a signed-in user
+types the code their daemon showed them:
+
+```ts
+// The owner comes from YOUR session. A daemon can never assert who it is.
+const runner = await app.approvePairing({
+  userCode: formData.get("code"),
+  owner: session.userId,
+});
+```
+
+`app.pendingPairing(code)` tells you what they are about to approve — machine
+label, platform, and which models it is offering — so the page can show it.
+
+## Stores
+
+| Store           | For                                                                                                              |
+| --------------- | ---------------------------------------------------------------------------------------------------------------- |
+| `MemoryStore`   | Tests, demos, single-process apps. The reference implementation the conformance kit certifies first.             |
+| `supabaseStore` | Postgres via Supabase: migrations, an RLS-scoped claim RPC with `FOR UPDATE SKIP LOCKED`, and Realtime delivery. |
+| yours           | Implement `JobStore` + `RunnerStore` and run `@byollm/conformance` against it.                                   |
+
+### Supabase
+
+```ts
+import {
+  supabaseStore,
+  supabaseRealtimeDelivery,
+} from "@byollm/server/supabase";
+
+const store = supabaseStore({ client: serviceRoleClient });
+const app = new ByollmApp({
+  store,
+  delivery: supabaseRealtimeDelivery(serviceRoleClient),
+});
+```
+
+Copy `supabase/migrations/*.sql` into your project's migrations. It ships the
+`byollm_*` tables, RLS policies, the atomic claim RPC, the dependency-unblock
+trigger and the expiry sweep.
+
+The protocol handler needs the **service role** key: a runner authenticates
+with its own bearer token, which is not a Supabase session. RLS still governs
+everything the browser does.
+
+## Two things the API makes you confront
+
+**Community results are untrusted.** A `named`/`public` result came from
+someone else's machine and can be anything. Every result carries provenance,
+and `untrusted` is derived from the audience — you cannot mark volunteer
+output as first-party:
+
+```ts
+const { outcome, provenance } = await app.result(jobId);
+if (provenance?.untrusted) {
+  // Do not render as trusted HTML. Do not feed to a privileged step.
+  // Disclose where it came from.
+}
+```
+
+**Jobs can depend on each other.** `dependsOn: [jobId]` keeps a job
+unclaimable until its dependencies are `ok`. One field and one claim
+predicate, not a DAG engine — so the two halves of a piece of work can land on
+two different people's machines, in order, without your app orchestrating the
+wait.
+
+## Certifying an adapter
+
+```bash
+npx byollm-certify ./my-target.js
+```
+
+A server is byollm-compatible when the kit passes. See
+[`@byollm/conformance`](../conformance).
+
+MIT

package/dist/chunk-7RKXFPBZ.js

@@ -0,0 +1,72 @@
+// src/delivery.ts
+var NoRunnerAvailableError = class extends Error {
+  constructor(jobId, reason) {
+    super(
+      `no runner is available to execute job ${jobId} (${reason}). Fall back to a hosted model, or prompt the user to start their runner.`
+    );
+    this.jobId = jobId;
+    this.reason = reason;
+  }
+  jobId;
+  reason;
+  name = "NoRunnerAvailableError";
+};
+var ResultTimeoutError = class extends Error {
+  constructor(jobId, timeoutMs) {
+    super(`job ${jobId} did not finish within ${String(timeoutMs)}ms`);
+    this.jobId = jobId;
+    this.timeoutMs = timeoutMs;
+  }
+  jobId;
+  timeoutMs;
+  name = "ResultTimeoutError";
+};
+var DEFAULT_TIMEOUT_MS = 5 * 6e4;
+var POLL_INTERVAL_MS = 500;
+var NO_RUNNER_GRACE_MS = 1e4;
+var defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+var PollingDelivery = class {
+  #deps;
+  constructor(deps) {
+    this.#deps = deps;
+  }
+  async waitFor(jobId, options = {}) {
+    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+    const sleep = this.#deps.sleep ?? defaultSleep;
+    const now = this.#deps.now ?? Date.now;
+    const graceMs = this.#deps.graceMs ?? NO_RUNNER_GRACE_MS;
+    const started = now();
+    let noRunnerSince = null;
+    for (; ; ) {
+      options.signal?.throwIfAborted();
+      const current = await this.#deps.read(jobId);
+      if (current && isTerminalState(current.state)) return current;
+      const availability = await this.#deps.availability(jobId);
+      if (availability.available || availability.blocked) {
+        noRunnerSince = null;
+      } else {
+        noRunnerSince ??= now();
+        if (now() - noRunnerSince >= graceMs) {
+          const reason = availability.reason ?? "no-runner-online";
+          const substitute = await options.onNoRunner?.(reason);
+          if (substitute) return substitute;
+          throw new NoRunnerAvailableError(jobId, reason);
+        }
+      }
+      if (now() - started >= timeoutMs) {
+        throw new ResultTimeoutError(jobId, timeoutMs);
+      }
+      await sleep(POLL_INTERVAL_MS);
+    }
+  }
+};
+function isTerminalState(state) {
+  return state === "ok" || state === "error" || state === "canceled" || state === "expired";
+}
+
+export {
+  NoRunnerAvailableError,
+  ResultTimeoutError,
+  PollingDelivery
+};
+//# sourceMappingURL=chunk-7RKXFPBZ.js.map

package/dist/chunk-7RKXFPBZ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/delivery.ts"],"sourcesContent":["import type { DeliveredResult } from \"@byollm/protocol\";\n\n/** Why a wait ended without a result. */\nexport class NoRunnerAvailableError extends Error {\n  override readonly name = \"NoRunnerAvailableError\";\n  constructor(\n    readonly jobId: string,\n    readonly reason: string,\n  ) {\n    super(\n      `no runner is available to execute job ${jobId} (${reason}). ` +\n        `Fall back to a hosted model, or prompt the user to start their runner.`,\n    );\n  }\n}\n\n/** The wait exceeded its timeout while a runner was still plausibly working. */\nexport class ResultTimeoutError extends Error {\n  override readonly name = \"ResultTimeoutError\";\n  constructor(\n    readonly jobId: string,\n    readonly timeoutMs: number,\n  ) {\n    super(`job ${jobId} did not finish within ${String(timeoutMs)}ms`);\n  }\n}\n\nexport interface WaitOptions {\n  /** Give up after this long. Default 5 minutes. */\n  readonly timeoutMs?: number;\n  /**\n   * Called instead of throwing when no runner can take the job. Return a\n   * substitute result (a hosted-model answer, say) and the wait resolves with\n   * it; return nothing and {@link NoRunnerAvailableError} is thrown.\n   */\n  readonly onNoRunner?: (\n    reason: string,\n  ) => DeliveredResult | undefined | Promise<DeliveredResult | undefined>;\n  /** Abort the wait. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * How an app learns a job finished.\n *\n * byollm_003 Rev 1 is explicit that this is a *channel* — webhook, Realtime\n * subscription, or poll — and never an implied in-request `await`. The\n * polling implementation below is the portable default; the Supabase adapter\n * substitutes Realtime for the same interface.\n */\nexport interface ResultDelivery {\n  waitFor(jobId: string, options?: WaitOptions): Promise<DeliveredResult>;\n}\n\nexport interface PollingDeliveryDeps {\n  /** Current state of the job, or null if unknown. */\n  readonly read: (jobId: string) => Promise<DeliveredResult | null>;\n  /** Whether a runner could still take this job. */\n  readonly availability: (\n    jobId: string,\n  ) => Promise<{ available: boolean; reason?: string; blocked: boolean }>;\n  readonly sleep?: (ms: number) => Promise<void>;\n  /**\n   * Injectable clock. It must advance in step with {@link sleep}: a test that\n   * stubs one and not the other gets a loop whose grace window never elapses.\n   */\n  readonly now?: () => number;\n  /**\n   * How long a sustained no-runner signal must persist before it is believed.\n   * Defaults to {@link NO_RUNNER_GRACE_MS}.\n   */\n  readonly graceMs?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60_000;\nconst POLL_INTERVAL_MS = 500;\n/**\n * How long to let a job sit with no available runner before giving up.\n *\n * Not zero: a daemon restarting, or one whose heartbeat is momentarily late,\n * would otherwise fail every job in flight. The signal has to be sustained\n * before it is believed.\n */\nconst NO_RUNNER_GRACE_MS = 10_000;\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * The portable delivery channel: poll the store until the job is terminal.\n *\n * Correct everywhere and adequate for most apps. An adapter with a push\n * channel should replace it — see the Supabase adapter's Realtime delivery.\n */\nexport class PollingDelivery implements ResultDelivery {\n  readonly #deps: PollingDeliveryDeps;\n\n  constructor(deps: PollingDeliveryDeps) {\n    this.#deps = deps;\n  }\n\n  async waitFor(\n    jobId: string,\n    options: WaitOptions = {},\n  ): Promise<DeliveredResult> {\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const sleep = this.#deps.sleep ?? defaultSleep;\n    const now = this.#deps.now ?? Date.now;\n    const graceMs = this.#deps.graceMs ?? NO_RUNNER_GRACE_MS;\n    const started = now();\n    let noRunnerSince: number | null = null;\n\n    for (;;) {\n      options.signal?.throwIfAborted();\n\n      const current = await this.#deps.read(jobId);\n      if (current && isTerminalState(current.state)) return current;\n\n      const availability = await this.#deps.availability(jobId);\n      if (availability.available || availability.blocked) {\n        // `blocked` means the job is waiting on a dependency, which is not the\n        // same event as \"nobody can run this\" ({@link MUSTS.NO_RUNNER_SIGNAL}).\n        noRunnerSince = null;\n      } else {\n        noRunnerSince ??= now();\n        if (now() - noRunnerSince >= graceMs) {\n          const reason = availability.reason ?? \"no-runner-online\";\n          const substitute = await options.onNoRunner?.(reason);\n          if (substitute) return substitute;\n          throw new NoRunnerAvailableError(jobId, reason);\n        }\n      }\n\n      if (now() - started >= timeoutMs) {\n        throw new ResultTimeoutError(jobId, timeoutMs);\n      }\n      await sleep(POLL_INTERVAL_MS);\n    }\n  }\n}\n\nfunction isTerminalState(state: string): boolean {\n  return (\n    state === \"ok\" ||\n    state === \"error\" ||\n    state === \"canceled\" ||\n    state === \"expired\"\n  );\n}\n"],"mappings":";AAGO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAEhD,YACW,OACA,QACT;AACA;AAAA,MACE,yCAAyC,KAAK,KAAK,MAAM;AAAA,IAE3D;AANS;AACA;AAAA,EAMX;AAAA,EAPW;AAAA,EACA;AAAA,EAHO,OAAO;AAU3B;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YACW,OACA,WACT;AACA,UAAM,OAAO,KAAK,0BAA0B,OAAO,SAAS,CAAC,IAAI;AAHxD;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAAA,EAHO,OAAO;AAO3B;AAiDA,IAAM,qBAAqB,IAAI;AAC/B,IAAM,mBAAmB;AAQzB,IAAM,qBAAqB;AAE3B,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAQ3C,IAAM,kBAAN,MAAgD;AAAA,EAC5C;AAAA,EAET,YAAY,MAA2B;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QACJ,OACA,UAAuB,CAAC,GACE;AAC1B,UAAM,YAAY,QAAQ,aAAa;AACvC,UAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,UAAM,MAAM,KAAK,MAAM,OAAO,KAAK;AACnC,UAAM,UAAU,KAAK,MAAM,WAAW;AACtC,UAAM,UAAU,IAAI;AACpB,QAAI,gBAA+B;AAEnC,eAAS;AACP,cAAQ,QAAQ,eAAe;AAE/B,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK;AAC3C,UAAI,WAAW,gBAAgB,QAAQ,KAAK,EAAG,QAAO;AAEtD,YAAM,eAAe,MAAM,KAAK,MAAM,aAAa,KAAK;AACxD,UAAI,aAAa,aAAa,aAAa,SAAS;AAGlD,wBAAgB;AAAA,MAClB,OAAO;AACL,0BAAkB,IAAI;AACtB,YAAI,IAAI,IAAI,iBAAiB,SAAS;AACpC,gBAAM,SAAS,aAAa,UAAU;AACtC,gBAAM,aAAa,MAAM,QAAQ,aAAa,MAAM;AACpD,cAAI,WAAY,QAAO;AACvB,gBAAM,IAAI,uBAAuB,OAAO,MAAM;AAAA,QAChD;AAAA,MACF;AAEA,UAAI,IAAI,IAAI,WAAW,WAAW;AAChC,cAAM,IAAI,mBAAmB,OAAO,SAAS;AAAA,MAC/C;AACA,YAAM,MAAM,gBAAgB;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SACE,UAAU,QACV,UAAU,WACV,UAAU,cACV,UAAU;AAEd;","names":[]}

package/dist/chunk-HL6EYHQ7.js

@@ -0,0 +1,422 @@
+// src/ids.ts
+import {
+  createHash,
+  randomBytes,
+  randomUUID,
+  timingSafeEqual
+} from "crypto";
+var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRTWXYZ2346789";
+function generateDeviceCode() {
+  return randomBytes(32).toString("base64url");
+}
+function generateRunnerToken() {
+  return randomBytes(32).toString("base64url");
+}
+function generateRunnerId() {
+  return `runner_${randomUUID()}`;
+}
+function generateJobId() {
+  return `job_${randomUUID()}`;
+}
+function generateUserCode() {
+  const chars = [];
+  while (chars.length < 8) {
+    for (const byte of randomBytes(16)) {
+      const limit = 256 - 256 % USER_CODE_ALPHABET.length;
+      if (byte >= limit) continue;
+      const symbol = USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length];
+      if (symbol === void 0) continue;
+      chars.push(symbol);
+      if (chars.length === 8) break;
+    }
+  }
+  return `${chars.slice(0, 4).join("")}-${chars.slice(4).join("")}`;
+}
+function hashSecret(secret) {
+  return createHash("sha256").update(secret, "utf8").digest("hex");
+}
+function secretsMatch(aHex, bHex) {
+  if (aHex.length !== bHex.length) return false;
+  return timingSafeEqual(Buffer.from(aHex, "hex"), Buffer.from(bHex, "hex"));
+}
+
+// src/handlers.ts
+import {
+  ClaimRequest,
+  ERROR_STATUS,
+  HeartbeatRequest,
+  PairRequest,
+  PROTOCOL_VERSION,
+  ReleaseRequest,
+  ResultRequest,
+  provenanceFor
+} from "@byollm/protocol";
+var DEFAULTS = {
+  leaseMs: 6e4,
+  pairingTtlMs: 10 * 6e4,
+  pollIntervalMs: 2e3
+};
+function fail(error, message, retryAfterSeconds) {
+  return {
+    status: ERROR_STATUS[error],
+    body: {
+      error,
+      message,
+      ...retryAfterSeconds === void 0 ? {} : { retryAfter: retryAfterSeconds }
+    },
+    ...retryAfterSeconds === void 0 ? {} : { retryAfterSeconds }
+  };
+}
+function ok(body) {
+  return { status: 200, body };
+}
+var ByollmHandlers = class {
+  #store;
+  #verificationUrl;
+  #leaseMs;
+  #pairingTtlMs;
+  #pollIntervalMs;
+  #now;
+  constructor(config) {
+    this.#store = config.store;
+    this.#verificationUrl = config.verificationUrl;
+    this.#leaseMs = config.leaseMs ?? DEFAULTS.leaseMs;
+    this.#pairingTtlMs = config.pairingTtlMs ?? DEFAULTS.pairingTtlMs;
+    this.#pollIntervalMs = config.pollIntervalMs ?? DEFAULTS.pollIntervalMs;
+    this.#now = config.now ?? Date.now;
+  }
+  /**
+   * Dispatch one protocol call.
+   *
+   * @param endpoint - which of the five, already routed from the path
+   * @param body - the parsed JSON request body, untrusted
+   * @param bearer - the `Authorization: Bearer` value, if any
+   */
+  async handle(endpoint, body, bearer) {
+    switch (endpoint) {
+      case "pair":
+        return this.#pair(body);
+      case "claim":
+        return this.#authed(bearer, body, ClaimRequest, this.#claim.bind(this));
+      case "heartbeat":
+        return this.#authed(
+          bearer,
+          body,
+          HeartbeatRequest,
+          this.#heartbeat.bind(this),
+          { allowRevoked: true }
+        );
+      case "result":
+        return this.#authed(
+          bearer,
+          body,
+          ResultRequest,
+          this.#result.bind(this)
+        );
+      case "release":
+        return this.#authed(
+          bearer,
+          body,
+          ReleaseRequest,
+          this.#release.bind(this)
+        );
+    }
+  }
+  /**
+   * Shared preamble for the four authenticated endpoints: resolve the bearer
+   * token to a runner, reject a revoked one, and parse the body.
+   *
+   * The token→runner lookup happens before schema validation so a stranger
+   * probing the endpoint learns nothing about the wire format.
+   */
+  async #authed(bearer, body, schema, run, options = {}) {
+    if (bearer === void 0 || bearer.length === 0) {
+      return fail("unauthorized", "a runner token is required");
+    }
+    const runner = await this.#store.getRunnerByTokenHash(hashSecret(bearer));
+    if (!runner) {
+      return fail("unauthorized", "this runner token is not recognised");
+    }
+    if (runner.revokedAt !== null && options.allowRevoked !== true) {
+      return fail("revoked", "this runner has been revoked by its owner");
+    }
+    const parsed = schema.safeParse(body);
+    if (!parsed.success || parsed.data === void 0) {
+      return fail("bad-request", "request body failed schema validation");
+    }
+    return run(parsed.data, runner);
+  }
+  // -- 1. pair --------------------------------------------------------------
+  async #pair(body) {
+    const parsed = PairRequest.safeParse(body);
+    if (!parsed.success) {
+      return fail("bad-request", "pair request failed schema validation");
+    }
+    const request = parsed.data;
+    const now = this.#now();
+    if (request.action === "start") {
+      const deviceCode = generateDeviceCode();
+      const userCode = generateUserCode();
+      const expiresAt = now + this.#pairingTtlMs;
+      await this.#store.createPairing({
+        deviceCodeHash: hashSecret(deviceCode),
+        userCode,
+        state: "pending",
+        owner: null,
+        runnerId: null,
+        runnerTokenOnce: null,
+        label: request.daemon.label,
+        platform: request.daemon.platform,
+        daemonVersion: request.daemon.version,
+        capabilities: request.capabilities,
+        expiresAt,
+        createdAt: now
+      });
+      const response = {
+        deviceCode,
+        userCode,
+        verificationUrl: this.#verificationUrl,
+        expiresAt,
+        pollIntervalMs: this.#pollIntervalMs
+      };
+      return ok(response);
+    }
+    const pairing = await this.#store.getPairingByDeviceCodeHash(
+      hashSecret(request.deviceCode)
+    );
+    if (!pairing) {
+      return fail("not-found", "unknown device code");
+    }
+    if (pairing.state === "denied") {
+      return ok({ status: "denied" });
+    }
+    if (pairing.expiresAt <= now && pairing.state === "pending") {
+      return ok({ status: "expired" });
+    }
+    if (pairing.state === "approved" && pairing.runnerTokenOnce !== null && pairing.runnerId !== null && pairing.owner !== null) {
+      const response = {
+        status: "approved",
+        runnerToken: pairing.runnerTokenOnce,
+        runnerId: pairing.runnerId,
+        owner: pairing.owner
+      };
+      await this.#store.consumePairingToken(pairing.deviceCodeHash);
+      return ok(response);
+    }
+    if (pairing.state === "approved") {
+      return fail("not-found", "this pairing has already been collected");
+    }
+    return ok({ status: "pending" });
+  }
+  // -- 2. claim -------------------------------------------------------------
+  async #claim(request, runner) {
+    if (request.runnerId !== runner.id) {
+      return fail("unauthorized", "runner id does not match the bearer token");
+    }
+    const now = this.#now();
+    const jobs = await this.#store.claim({
+      runnerId: runner.id,
+      runnerOwner: runner.owner,
+      capabilities: request.capabilities,
+      max: request.max,
+      leaseMs: this.#leaseMs,
+      now
+    });
+    const response = {
+      jobs: jobs.map((job) => ({
+        id: job.id,
+        kind: job.kind,
+        payload: job.payload,
+        audience: job.audience,
+        owner: job.owner,
+        ...job.audienceAllow === void 0 ? {} : { audienceAllow: [...job.audienceAllow] },
+        lease: job.lease ?? {
+          runnerId: runner.id,
+          expiresAt: now + this.#leaseMs
+        }
+      })),
+      leaseMs: this.#leaseMs
+    };
+    return ok(response);
+  }
+  // -- 3. heartbeat ---------------------------------------------------------
+  async #heartbeat(request, runner) {
+    if (request.runnerId !== runner.id) {
+      return fail("unauthorized", "runner id does not match the bearer token");
+    }
+    const now = this.#now();
+    const revoked = runner.revokedAt !== null;
+    if (revoked) {
+      const held = await this.#store.listClaimedBy(runner.id);
+      const response2 = {
+        revoked: true,
+        cancel: [],
+        leases: [],
+        lost: held.map((job) => job.id),
+        serverTime: now
+      };
+      return ok(response2);
+    }
+    await this.#store.touchRunner({
+      runnerId: runner.id,
+      capabilities: request.capabilities,
+      daemonVersion: request.daemonVersion,
+      paused: request.paused,
+      now
+    });
+    const { renewed, lost } = await this.#store.renewLeases({
+      runnerId: runner.id,
+      jobIds: request.activeJobIds,
+      leaseMs: this.#leaseMs,
+      now
+    });
+    const cancel = await this.#store.listCancelRequests(runner.id);
+    const response = {
+      revoked: false,
+      cancel,
+      leases: renewed.map((r) => ({ jobId: r.jobId, expiresAt: r.expiresAt })),
+      lost: [...lost],
+      serverTime: now
+    };
+    return ok(response);
+  }
+  // -- 4. result ------------------------------------------------------------
+  async #result(request, runner) {
+    if (request.runnerId !== runner.id) {
+      return fail("unauthorized", "runner id does not match the bearer token");
+    }
+    const now = this.#now();
+    const job = await this.#store.get(request.jobId);
+    if (!job) return fail("not-found", "unknown job");
+    const provenance = provenanceFor({
+      audience: job.audience,
+      runnerId: runner.id,
+      runnerOwner: runner.owner,
+      backendClass: request.backendClass,
+      model: request.model
+    });
+    const { accepted, job: updated } = await this.#store.complete({
+      jobId: request.jobId,
+      runnerId: runner.id,
+      outcome: request.outcome,
+      provenance,
+      now
+    });
+    const response = {
+      accepted,
+      state: updated?.state ?? job.state
+    };
+    return ok(response);
+  }
+  // -- 5. release -----------------------------------------------------------
+  async #release(request, runner) {
+    if (request.runnerId !== runner.id) {
+      return fail("unauthorized", "runner id does not match the bearer token");
+    }
+    const released = await this.#store.release({
+      runnerId: runner.id,
+      jobIds: request.jobIds,
+      reason: request.reason,
+      now: this.#now()
+    });
+    const response = { released };
+    return ok(response);
+  }
+};
+var SERVED_PROTOCOL_VERSION = PROTOCOL_VERSION;
+
+// src/http.ts
+import { ENDPOINTS, PROTOCOL_PREFIX } from "@byollm/protocol";
+var MAX_BODY_BYTES = 8 * 1024 * 1024;
+function routeEndpoint(pathname) {
+  const index = pathname.lastIndexOf("/");
+  const last = index === -1 ? pathname : pathname.slice(index + 1);
+  return ENDPOINTS.includes(last) ? last : null;
+}
+function bearerFrom(header) {
+  if (!header) return void 0;
+  const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
+  return match?.[1];
+}
+function createFetchHandler(config) {
+  const handlers = new ByollmHandlers(config);
+  return async function handle(request) {
+    if (request.method !== "POST") {
+      return json(405, {
+        error: "bad-request",
+        message: "protocol endpoints accept POST only"
+      });
+    }
+    const endpoint = routeEndpoint(new URL(request.url).pathname);
+    if (endpoint === null) {
+      return json(404, {
+        error: "not-found",
+        message: `not a ${PROTOCOL_PREFIX} endpoint`
+      });
+    }
+    const declared = request.headers.get("content-length");
+    if (declared !== null && Number(declared) > MAX_BODY_BYTES) {
+      return json(400, {
+        error: "bad-request",
+        message: "request body too large"
+      });
+    }
+    let body;
+    try {
+      const text = await request.text();
+      if (text.length > MAX_BODY_BYTES) {
+        return json(400, {
+          error: "bad-request",
+          message: "request body too large"
+        });
+      }
+      body = JSON.parse(text);
+    } catch {
+      return json(400, {
+        error: "bad-request",
+        message: "request body is not valid JSON"
+      });
+    }
+    const result = await handlers.handle(
+      endpoint,
+      body,
+      bearerFrom(request.headers.get("authorization"))
+    );
+    const headers = {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    };
+    if (result.retryAfterSeconds !== void 0) {
+      headers["retry-after"] = String(result.retryAfterSeconds);
+    }
+    return new Response(JSON.stringify(result.body), {
+      status: result.status,
+      headers
+    });
+  };
+}
+function json(status, body) {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: {
+      "content-type": "application/json",
+      "cache-control": "no-store"
+    }
+  });
+}
+
+export {
+  generateDeviceCode,
+  generateRunnerToken,
+  generateRunnerId,
+  generateJobId,
+  generateUserCode,
+  hashSecret,
+  secretsMatch,
+  ByollmHandlers,
+  SERVED_PROTOCOL_VERSION,
+  routeEndpoint,
+  bearerFrom,
+  createFetchHandler
+};
+//# sourceMappingURL=chunk-HL6EYHQ7.js.map