@byollm/server 0.1.0-alpha.2 → 0.1.0-alpha.4

package/dist/next.d.ts

@@ -1,6 +1,6 @@
-import { H as HandlerConfig } from './handlers-D7lWfwno.js';
+import { H as HandlerConfig } from './handlers-CF3yE-t2.js';
 import '@byollm/protocol';
-import './store-D23N6iiP.js';
+import './store-gFEEN1Dt.js';
 
 /**
  * `@byollm/server/next` — the one-file Next.js mount.
@@ -9,20 +9,52 @@ import './store-D23N6iiP.js';
  *
  * ```ts
  * import { createHandler } from "@byollm/server/next";
- * import { store } from "@/lib/byollm";
+ * import { siteKeysFromEnv } from "@byollm/server";
+ * import { getStore } from "@/lib/byollm";
  *
- * export const { POST } = createHandler({
- *   store,
+ * export const { POST } = createHandler(() => ({
+ *   store: getStore(),
+ *   siteKeys: siteKeysFromEnv("BYOLLM_SITE_KEYS"),
  *   verificationUrl: "https://your-app.com/settings/runners",
- * });
+ *   // Next serves this route under /api, so say so. The handler matches the
+ *   // full path, not a suffix, and will 404 without it.
+ *   basePath: "/api/byollm",
+ * }));
  * ```
  *
+ * **Pass a function, not an object.** `next build` imports every route module
+ * to collect page data, in an environment that has no secrets — so a config
+ * *object* means the store and the site keys are constructed at build time,
+ * and the build fails on the credentials it cannot have. A function is not
+ * called until the first request, so importing this module does nothing.
+ *
+ * An object still works, for a store that needs no secrets to construct. It is
+ * the second form because it is the one that fails in production and not in
+ * development, which is the wrong way round for a default.
+ *
+ * **Then pair against that same path**: `byollm connect https://your-app.com/api`.
+ * The daemon appends `/byollm/<endpoint>` to whatever origin it is given, so
+ * connecting to the bare domain reaches `/byollm/claim` and finds nothing.
+ * This is the first thing an integrator gets wrong, and it used to fail as a
+ * silent 404 — the handler matched on the last path segment alone, so nothing
+ * ever checked where it was mounted.
+ *
+ * To serve at `/byollm` instead, move the route to
+ * `app/byollm/[...route]/route.ts`, drop `basePath`, and pair against the bare
+ * domain.
+ *
  * That is the whole protocol surface. The app-facing half — enqueue, approve
  * a pairing, read a result — is {@link ByollmApp} from `@byollm/server`.
  *
  * @packageDocumentation
  */
-declare function createHandler(config: HandlerConfig): {
+/** What this mount needs, plus where it is mounted. */
+type NextHandlerConfig = HandlerConfig & {
+    /** Where this route is mounted. Next users almost always want
+     * `"/api/byollm"`; see the example above. */
+    readonly basePath?: string;
+};
+declare function createHandler(config: NextHandlerConfig | (() => NextHandlerConfig)): {
     POST: (request: Request) => Promise<Response>;
     /** Present so a stray GET gets a clear 405 rather than a framework 404. */
     GET: (request: Request) => Promise<Response>;
@@ -30,4 +62,4 @@ declare function createHandler(config: HandlerConfig): {
     dynamic: "force-dynamic";
 };
 
-export { HandlerConfig, createHandler };
+export { HandlerConfig, type NextHandlerConfig, createHandler };

package/dist/next.js

@@ -1,10 +1,16 @@
 import {
   createFetchHandler
-} from "./chunk-HL6EYHQ7.js";
+} from "./chunk-MGJX6626.js";
 
 // src/next.ts
 function createHandler(config) {
-  const handler = createFetchHandler(config);
+  let built;
+  const handler = (request) => {
+    built ??= createFetchHandler(
+      typeof config === "function" ? config() : config
+    );
+    return built(request);
+  };
   return {
     POST: handler,
     GET: handler,

package/dist/next.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/next.ts"],"sourcesContent":["import { createFetchHandler } from \"./http.js\";\nimport type { HandlerConfig } from \"./handlers.js\";\n\n/**\n * `@byollm/server/next` — the one-file Next.js mount.\n *\n * Drop this in `app/api/byollm/[...route]/route.ts`:\n *\n * ```ts\n * import { createHandler } from \"@byollm/server/next\";\n * import { store } from \"@/lib/byollm\";\n *\n * export const { POST } = createHandler({\n *   store,\n *   verificationUrl: \"https://your-app.com/settings/runners\",\n * });\n * ```\n *\n * That is the whole protocol surface. The app-facing half — enqueue, approve\n * a pairing, read a result — is {@link ByollmApp} from `@byollm/server`.\n *\n * @packageDocumentation\n */\nexport function createHandler(config: HandlerConfig): {\n  POST: (request: Request) => Promise<Response>;\n  /** Present so a stray GET gets a clear 405 rather than a framework 404. */\n  GET: (request: Request) => Promise<Response>;\n  /** Route handlers must not be cached — every call mutates lease state. */\n  dynamic: \"force-dynamic\";\n} {\n  const handler = createFetchHandler(config);\n  return {\n    POST: handler,\n    GET: handler,\n    dynamic: \"force-dynamic\",\n  };\n}\n\nexport type { HandlerConfig };\n"],"mappings":";;;;;AAuBO,SAAS,cAAc,QAM5B;AACA,QAAM,UAAU,mBAAmB,MAAM;AACzC,SAAO;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,SAAS;AAAA,EACX;AACF;","names":[]}
+{"version":3,"sources":["../src/next.ts"],"sourcesContent":["import { createFetchHandler } from \"./http.js\";\nimport type { HandlerConfig } from \"./handlers.js\";\n\n/**\n * `@byollm/server/next` — the one-file Next.js mount.\n *\n * Drop this in `app/api/byollm/[...route]/route.ts`:\n *\n * ```ts\n * import { createHandler } from \"@byollm/server/next\";\n * import { siteKeysFromEnv } from \"@byollm/server\";\n * import { getStore } from \"@/lib/byollm\";\n *\n * export const { POST } = createHandler(() => ({\n *   store: getStore(),\n *   siteKeys: siteKeysFromEnv(\"BYOLLM_SITE_KEYS\"),\n *   verificationUrl: \"https://your-app.com/settings/runners\",\n *   // Next serves this route under /api, so say so. The handler matches the\n *   // full path, not a suffix, and will 404 without it.\n *   basePath: \"/api/byollm\",\n * }));\n * ```\n *\n * **Pass a function, not an object.** `next build` imports every route module\n * to collect page data, in an environment that has no secrets — so a config\n * *object* means the store and the site keys are constructed at build time,\n * and the build fails on the credentials it cannot have. A function is not\n * called until the first request, so importing this module does nothing.\n *\n * An object still works, for a store that needs no secrets to construct. It is\n * the second form because it is the one that fails in production and not in\n * development, which is the wrong way round for a default.\n *\n * **Then pair against that same path**: `byollm connect https://your-app.com/api`.\n * The daemon appends `/byollm/<endpoint>` to whatever origin it is given, so\n * connecting to the bare domain reaches `/byollm/claim` and finds nothing.\n * This is the first thing an integrator gets wrong, and it used to fail as a\n * silent 404 — the handler matched on the last path segment alone, so nothing\n * ever checked where it was mounted.\n *\n * To serve at `/byollm` instead, move the route to\n * `app/byollm/[...route]/route.ts`, drop `basePath`, and pair against the bare\n * domain.\n *\n * That is the whole protocol surface. The app-facing half — enqueue, approve\n * a pairing, read a result — is {@link ByollmApp} from `@byollm/server`.\n *\n * @packageDocumentation\n */\n/** What this mount needs, plus where it is mounted. */\nexport type NextHandlerConfig = HandlerConfig & {\n  /** Where this route is mounted. Next users almost always want\n   * `\"/api/byollm\"`; see the example above. */\n  readonly basePath?: string;\n};\n\nexport function createHandler(\n  config: NextHandlerConfig | (() => NextHandlerConfig),\n): {\n  POST: (request: Request) => Promise<Response>;\n  /** Present so a stray GET gets a clear 405 rather than a framework 404. */\n  GET: (request: Request) => Promise<Response>;\n  /** Route handlers must not be cached — every call mutates lease state. */\n  dynamic: \"force-dynamic\";\n} {\n  // Built on the first request and kept, not rebuilt per call: the handlers\n  // hold a store and a lease clock, and a fresh instance per request would be\n  // a new connection pool per request.\n  let built: ((request: Request) => Promise<Response>) | undefined;\n  const handler = (request: Request): Promise<Response> => {\n    built ??= createFetchHandler(\n      typeof config === \"function\" ? config() : config,\n    );\n    return built(request);\n  };\n\n  return {\n    POST: handler,\n    GET: handler,\n    dynamic: \"force-dynamic\",\n  };\n}\n\nexport type { HandlerConfig };\n"],"mappings":";;;;;AAwDO,SAAS,cACd,QAOA;AAIA,MAAI;AACJ,QAAM,UAAU,CAAC,YAAwC;AACvD,cAAU;AAAA,MACR,OAAO,WAAW,aAAa,OAAO,IAAI;AAAA,IAC5C;AACA,WAAO,MAAM,OAAO;AAAA,EACtB;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,KAAK;AAAA,IACL,SAAS;AAAA,EACX;AACF;","names":[]}

package/dist/{store-D23N6iiP.d.ts → store-gFEEN1Dt.d.ts}

@@ -1,4 +1,4 @@
-import { JobKind, JobPayload, Audience, JobState, Lease, JobOutcome, ResultProvenance, Capability } from '@byollm/protocol';
+import { JobKind, JobPayload, Audience, SealedEnvelope, SizeClass, JobState, Lease, JobOutcome, ResultProvenance, Capability, PublicIdentity } from '@byollm/protocol';
 
 /**
  * A job as the server stores it.
@@ -10,7 +10,21 @@ import { JobKind, JobPayload, Audience, JobState, Lease, JobOutcome, ResultProve
 interface JobRecord {
     readonly id: string;
     readonly kind: JobKind;
-    readonly payload: JobPayload;
+    /**
+     * The work, sealed to this site's own encryption key (byollm_009 §10).
+     *
+     * The store never holds plaintext. The app sees plaintext at enqueue and at
+     * result because the app *is* the endpoint; everything in between —
+     * database, backups, log aggregators, a support engineer with read access —
+     * sees ciphertext.
+     *
+     * This is not protection from the application the user deliberately sent
+     * their work to. It is protection from everything the application's storage
+     * touches, which is a longer list than most people picture.
+     */
+    readonly envelope: SealedEnvelope;
+    /** Fixed at enqueue, where the plaintext is. */
+    readonly sizeClass: SizeClass;
     readonly audience: Audience;
     /** The app's id for the user who enqueued it. */
     readonly owner: string;
@@ -63,6 +77,11 @@ interface RunnerRecord {
     readonly revokedAt: number | null;
     readonly lastHeartbeatAt: number;
     readonly createdAt: number;
+    /**
+     * The device's pinned public keys. What later signatures verify against —
+     * a runner id names a machine, this proves it.
+     */
+    readonly device: PublicIdentity;
 }
 /** An in-flight device-code pairing. */
 interface PairingRecord {
@@ -83,12 +102,21 @@ interface PairingRecord {
     readonly platform: "darwin" | "linux" | "win32";
     readonly daemonVersion: string;
     readonly capabilities: readonly Capability[];
+    /**
+     * The device's public keys, presented at pair start (byollm_009 §5).
+     *
+     * Kept on the pairing so the approving user is approving a *specific
+     * machine*, not a code that any machine could later redeem. It is copied
+     * onto the runner at approval.
+     */
+    readonly device: PublicIdentity;
     readonly expiresAt: number;
     readonly createdAt: number;
 }
 /** What the app supplies to enqueue a job. */
 interface EnqueueInput {
     readonly kind: JobKind;
+    /** The work, in plaintext. The server seals it before it is stored. */
     readonly payload: JobPayload;
     readonly owner: string;
     /** Defaults to `self` — the safe direction. */
@@ -101,6 +129,20 @@ interface EnqueueInput {
     /** Caller-supplied id, for idempotent enqueue. */
     readonly id?: string;
 }
+/**
+ * What the *store* is given — the sealed form.
+ *
+ * Distinct from {@link EnqueueInput} because the two are genuinely different
+ * things: an app hands over work in plaintext, and what gets written down is
+ * sealed. Collapsing them into one type would mean a field that is sometimes
+ * readable and sometimes not, which is the kind of ambiguity that ends with
+ * plaintext in a database.
+ */
+interface StoredJobInput extends Omit<EnqueueInput, "payload" | "id"> {
+    readonly id: string;
+    readonly envelope: SealedEnvelope;
+    readonly sizeClass: SizeClass;
+}
 
 /**
  * The adapter seam.
@@ -112,7 +154,7 @@ interface EnqueueInput {
  */
 interface JobStore {
     /** Create a job. Idempotent when `input.id` is supplied and already exists. */
-    create(input: EnqueueInput, now: number): Promise<JobRecord>;
+    create(input: StoredJobInput, now: number): Promise<JobRecord>;
     get(jobId: string): Promise<JobRecord | null>;
     /**
      * Atomically claim up to `max` jobs for a runner
@@ -176,9 +218,14 @@ interface ClaimArgs {
     readonly leaseMs: number;
     readonly now: number;
 }
+/** A lease named by its grant, not only by the job it covers. */
+interface LeaseRef {
+    readonly jobId: string;
+    readonly leaseId: string;
+}
 interface RenewArgs {
     readonly runnerId: string;
-    readonly jobIds: readonly string[];
+    readonly leases: readonly LeaseRef[];
     readonly leaseMs: number;
     readonly now: number;
 }
@@ -204,7 +251,7 @@ interface CompleteResult {
 }
 interface ReleaseArgs {
     readonly runnerId: string;
-    readonly jobIds: readonly string[];
+    readonly leases: readonly LeaseRef[];
     readonly reason: "shutdown" | "pause" | "revoked" | "backend-down" | "refused";
     readonly now: number;
 }
@@ -231,6 +278,25 @@ interface RunnerStore {
     revokeRunner(runnerId: string, now: number): Promise<void>;
     /** Live runners for an owner — used by the no-runner signal. */
     listRunners(owner?: string): Promise<RunnerRecord[]>;
+    /**
+     * Watch one job for state changes — the push seam (byollm_009 §8.3).
+     *
+     * **Required of every adapter, from day one, even though v1 uses it only
+     * for result readiness.** byollm_006 located streaming's real difficulty at
+     * the server→app leg: polling cannot carry deltas by construction. If the
+     * store contract were request/response only, adding streaming later would
+     * force a *second* adapter-breaking reshape — so the channel exists now and
+     * gets one more use later, rather than the interface changing twice.
+     *
+     * The handler is called after a change lands; it is a signal, not a
+     * payload, so a missed or duplicated call is survivable and the caller
+     * re-reads. That looseness is deliberate: it is the weakest contract every
+     * plausible backend can honour, and a stronger one would exclude adapters
+     * for no gain.
+     *
+     * Returns an unsubscribe function. Calling it twice MUST be safe.
+     */
+    subscribe(jobId: string, onChange: () => void): () => void;
 }
 interface ApproveArgs {
     readonly userCode: string;
@@ -252,4 +318,4 @@ interface TouchArgs {
 interface ByollmStore extends JobStore, RunnerStore {
 }
 
-export type { ApproveArgs as A, ByollmStore as B, ClaimArgs as C, EnqueueInput as E, JobRecord as J, PairingRecord as P, RunnerRecord as R, TouchArgs as T, RenewArgs as a, RenewResult as b, CompleteArgs as c, CompleteResult as d, ReleaseArgs as e, JobStore as f, RunnerStore as g };
+export type { ApproveArgs as A, ByollmStore as B, ClaimArgs as C, EnqueueInput as E, JobRecord as J, PairingRecord as P, RunnerRecord as R, StoredJobInput as S, TouchArgs as T, RenewArgs as a, RenewResult as b, CompleteArgs as c, CompleteResult as d, ReleaseArgs as e, JobStore as f, RunnerStore as g };

package/dist/supabase/index.d.ts

@@ -1,5 +1,5 @@
 import { SupabaseClient } from '@supabase/supabase-js';
-import { B as ByollmStore } from '../store-D23N6iiP.js';
+import { B as ByollmStore } from '../store-gFEEN1Dt.js';
 import { P as PollingDeliveryDeps, R as ResultDelivery } from '../delivery-36nIe-b3.js';
 import '@byollm/protocol';
 

package/dist/supabase/index.js

@@ -20,6 +20,8 @@ var SupabaseRealtimeDelivery = class {
     const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     const current = await this.#deps.read(jobId);
     if (current && isTerminal(current.state)) return current;
+    const settled = Promise.withResolvers();
+    this.#resolve = settled.resolve;
     const channel = this.#client.channel(`byollm_job_${jobId}`).on(
       "postgres_changes",
       {
@@ -29,13 +31,11 @@ var SupabaseRealtimeDelivery = class {
         filter: `id=eq.${jobId}`
       },
       () => {
-        void this.#check(jobId);
+        this.#check(jobId).catch(settled.reject);
       }
     );
-    const settled = Promise.withResolvers();
-    this.#resolve = settled.resolve;
     channel.subscribe();
-    void this.#check(jobId);
+    this.#check(jobId).catch(settled.reject);
     const timer = setTimeout(() => {
       settled.reject(new ResultTimeoutError(jobId, timeoutMs));
     }, timeoutMs);
@@ -62,7 +62,7 @@ var SupabaseRealtimeDelivery = class {
   #watchAvailability(jobId, options, settled) {
     let noRunnerSince = null;
     return setInterval(() => {
-      void (async () => {
+      (async () => {
         const availability = await this.#deps.availability(jobId);
         if (availability.available || availability.blocked) {
           noRunnerSince = null;
@@ -77,7 +77,7 @@ var SupabaseRealtimeDelivery = class {
         } else {
           settled.reject(new NoRunnerAvailableError(jobId, reason));
         }
-      })();
+      })().catch(settled.reject);
     }, 2e3);
   }
 };
@@ -93,13 +93,18 @@ function toJob(row) {
   return {
     id: row.id,
     kind: row.kind,
-    payload: row.payload,
+    envelope: row.envelope,
+    sizeClass: row.size_class,
     audience: row.audience,
     owner: row.owner,
     audienceAllow: row.audience_allow ?? void 0,
     dependsOn: row.depends_on,
     state: row.state,
-    lease: row.lease_runner !== null && leaseExpires !== null ? { runnerId: row.lease_runner, expiresAt: leaseExpires } : null,
+    lease: row.lease_runner !== null && leaseExpires !== null && row.lease_id !== null ? {
+      id: row.lease_id,
+      runnerId: row.lease_runner,
+      expiresAt: leaseExpires
+    } : null,
     createdAt: Date.parse(row.created_at),
     claimableAt: ms(row.claimable_at),
     ttlMs: row.ttl_ms,
@@ -111,6 +116,7 @@ function toJob(row) {
     updatedAt: Date.parse(row.updated_at)
   };
 }
+var leasePairs = (leases) => leases.map((l) => `and(id.eq.${l.jobId},lease_id.eq.${l.leaseId})`).join(",");
 function toRunner(row) {
   return {
     id: row.id,
@@ -120,6 +126,7 @@ function toRunner(row) {
     platform: row.platform,
     daemonVersion: row.daemon_version,
     capabilities: row.capabilities,
+    device: row.device,
     paused: row.paused,
     revokedAt: ms(row.revoked_at),
     lastHeartbeatAt: Date.parse(row.last_heartbeat_at),
@@ -138,6 +145,7 @@ function toPairing(row) {
     platform: row.platform,
     daemonVersion: row.daemon_version,
     capabilities: row.capabilities,
+    device: row.device,
     expiresAt: Date.parse(row.expires_at),
     createdAt: Date.parse(row.created_at)
   };
@@ -169,9 +177,10 @@ function supabaseStore(options) {
         claimableAt = allDone ? iso(now) : null;
       }
       const row = {
-        ...input.id === void 0 ? {} : { id: input.id },
+        id: input.id,
         kind: input.kind,
-        payload: input.payload,
+        envelope: input.envelope,
+        size_class: input.sizeClass,
         audience: input.audience ?? "self",
         owner: input.owner,
         audience_allow: input.audienceAllow ? [...input.audienceAllow] : null,
@@ -185,7 +194,7 @@ function supabaseStore(options) {
       );
       if (inserted) return toJob(inserted);
       const existing = unwrap(
-        await db.from("byollm_jobs").select().eq("id", input.id ?? "").single()
+        await db.from("byollm_jobs").select().eq("id", input.id).single()
       );
       return toJob(existing);
     },
@@ -208,14 +217,14 @@ function supabaseStore(options) {
     },
     async renewLeases(args) {
       await db.rpc("byollm_expire_due");
-      if (args.jobIds.length === 0) return { renewed: [], lost: [] };
+      if (args.leases.length === 0) return { renewed: [], lost: [] };
       const expiresAt = iso(args.now + args.leaseMs);
       const renewedRows = unwrap(
         await db.from("byollm_jobs").update({
           state: "running",
           lease_expires_at: expiresAt,
           updated_at: iso(args.now)
-        }).eq("lease_runner", args.runnerId).in("id", [...args.jobIds]).in("state", ["claimed", "running"]).select("id")
+        }).eq("lease_runner", args.runnerId).or(leasePairs(args.leases)).in("state", ["claimed", "running"]).select("id")
       );
       const renewedIds = new Set(renewedRows.map((row) => row.id));
       return {
@@ -224,7 +233,7 @@ function supabaseStore(options) {
           expiresAt: args.now + args.leaseMs
         })),
         // Anything the runner thinks it holds but did not renew is gone.
-        lost: args.jobIds.filter((id) => !renewedIds.has(id))
+        lost: args.leases.map((l) => l.jobId).filter((id) => !renewedIds.has(id))
       };
     },
     async complete(args) {
@@ -252,15 +261,16 @@ function supabaseStore(options) {
       return { accepted: true, job: toJob(written) };
     },
     async release(args) {
-      if (args.jobIds.length === 0) return [];
+      if (args.leases.length === 0) return [];
       const held = unwrap(
-        await db.from("byollm_jobs").select("id,refused_by").eq("lease_runner", args.runnerId).in("id", [...args.jobIds])
+        await db.from("byollm_jobs").select("id,refused_by").eq("lease_runner", args.runnerId).or(leasePairs(args.leases))
       );
       const released = [];
       for (const row of held) {
         const refusedBy = args.reason === "refused" ? [.../* @__PURE__ */ new Set([...row.refused_by, args.runnerId])] : row.refused_by;
         const { error } = await db.from("byollm_jobs").update({
           state: "queued",
+          lease_id: null,
           lease_runner: null,
           lease_expires_at: null,
           // Newly available again, so the TTL clock restarts.
@@ -309,9 +319,37 @@ function supabaseStore(options) {
       return rows.map((row) => row.job_id);
     },
     // -- pairing and runners -------------------------------------------------
+    /**
+     * The push seam (byollm_009 §8.3), over Postgres Realtime.
+     *
+     * Native here, which is the point of requiring it of every adapter: the
+     * backend that can push does, the one that cannot polls, and the
+     * interface does not change again when streaming arrives.
+     */
+    subscribe(jobId, onChange) {
+      const channel = db.channel(`byollm_job_${jobId}`).on(
+        "postgres_changes",
+        {
+          event: "UPDATE",
+          schema: "public",
+          table: "byollm_jobs",
+          filter: `id=eq.${jobId}`
+        },
+        () => {
+          onChange();
+        }
+      ).subscribe();
+      let live = true;
+      return () => {
+        if (!live) return;
+        live = false;
+        void db.removeChannel(channel).catch(() => void 0);
+      };
+    },
     async createPairing(record) {
       const { error } = await db.from("byollm_pairings").insert({
         device_code_hash: record.deviceCodeHash,
+        device: record.device,
         user_code: record.userCode,
         state: record.state,
         label: record.label,
@@ -351,7 +389,13 @@ function supabaseStore(options) {
           label: pairing.label,
           platform: pairing.platform,
           daemon_version: pairing.daemon_version,
-          capabilities: pairing.capabilities
+          capabilities: pairing.capabilities,
+          // Carried from the pairing, exactly as the SQL RPC does. There
+          // are two approval paths — this service-role one and
+          // `byollm_approve_pairing` for browser callers — and a field
+          // added to one and not the other produces a runner that is
+          // correct through one door and broken through the other.
+          device: pairing.device
         }).select().single()
       );
       const { error } = await db.from("byollm_pairings").update({