@byollm/server 0.1.0-alpha.4 → 0.1.0-alpha.41

package/dist/{chunk-7RKXFPBZ.js → chunk-SAK63KNU.js}

@@ -49,7 +49,9 @@ var PollingDelivery = class {
         if (now() - noRunnerSince >= graceMs) {
           const reason = availability.reason ?? "no-runner-online";
           const substitute = await options.onNoRunner?.(reason);
-          if (substitute) return substitute;
+          if (substitute !== void 0) {
+            return labelFallback(jobId, substitute);
+          }
           throw new NoRunnerAvailableError(jobId, reason);
         }
       }
@@ -63,10 +65,22 @@ var PollingDelivery = class {
 function isTerminalState(state) {
   return state === "ok" || state === "error" || state === "canceled" || state === "expired";
 }
+function labelFallback(jobId, substitute) {
+  if (typeof substitute === "string") {
+    return {
+      jobId,
+      state: "ok",
+      outcome: { outcome: "ok", text: substitute },
+      fallback: true
+    };
+  }
+  return { ...substitute, fallback: true };
+}
 
 export {
   NoRunnerAvailableError,
   ResultTimeoutError,
-  PollingDelivery
+  PollingDelivery,
+  labelFallback
 };
-//# sourceMappingURL=chunk-7RKXFPBZ.js.map
+//# sourceMappingURL=chunk-SAK63KNU.js.map

package/dist/chunk-SAK63KNU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/delivery.ts"],"sourcesContent":["import type { DeliveredResult } from \"@byollm/protocol\";\n\n/** Why a wait ended without a result. */\nexport class NoRunnerAvailableError extends Error {\n  override readonly name = \"NoRunnerAvailableError\";\n  constructor(\n    readonly jobId: string,\n    readonly reason: string,\n  ) {\n    super(\n      `no runner is available to execute job ${jobId} (${reason}). ` +\n        `Fall back to a hosted model, or prompt the user to start their runner.`,\n    );\n  }\n}\n\n/** The wait exceeded its timeout while a runner was still plausibly working. */\nexport class ResultTimeoutError extends Error {\n  override readonly name = \"ResultTimeoutError\";\n  constructor(\n    readonly jobId: string,\n    readonly timeoutMs: number,\n  ) {\n    super(`job ${jobId} did not finish within ${String(timeoutMs)}ms`);\n  }\n}\n\nexport interface WaitOptions {\n  /** Give up after this long. Default 5 minutes. */\n  readonly timeoutMs?: number;\n  /**\n   * Called instead of throwing when no runner can take the job. Return a\n   * substitute and the wait resolves with it; return nothing and\n   * {@link NoRunnerAvailableError} is thrown.\n   *\n   * **A string is enough.** It is the app's own fallback answer — a hosted\n   * model's text, a cached reply — not wire data, and requiring a whole\n   * `DeliveredResult` for it was ceremony that invited invented shapes. The\n   * README's own example got it wrong, which is how this was found.\n   *\n   * **Whatever comes back is labelled `fallback: true` by the wait, not by\n   * the caller** — {@link MUSTS.FALLBACK_LABELED}. Work that did not come\n   * from the user's own compute must not be reportable as though it did, and\n   * that stays true whether an app returns a bare string or a full record it\n   * assembled itself. The stamp is applied after this function returns, so\n   * there is no shape an app can hand back that hides what it is.\n   */\n  readonly onNoRunner?: (\n    reason: string,\n  ) =>\n    | string\n    | DeliveredResult\n    | undefined\n    | Promise<string | DeliveredResult | undefined>;\n  /** Abort the wait. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * How an app learns a job finished.\n *\n * byollm_003 Rev 1 is explicit that this is a *channel* — webhook, Realtime\n * subscription, or poll — and never an implied in-request `await`. The\n * polling implementation below is the portable default; the Supabase adapter\n * substitutes Realtime for the same interface.\n */\nexport interface ResultDelivery {\n  waitFor(jobId: string, options?: WaitOptions): Promise<DeliveredResult>;\n}\n\nexport interface PollingDeliveryDeps {\n  /** Current state of the job, or null if unknown. */\n  readonly read: (jobId: string) => Promise<DeliveredResult | null>;\n  /** Whether a runner could still take this job. */\n  readonly availability: (\n    jobId: string,\n  ) => Promise<{ available: boolean; reason?: string; blocked: boolean }>;\n  readonly sleep?: (ms: number) => Promise<void>;\n  /**\n   * Injectable clock. It must advance in step with {@link sleep}: a test that\n   * stubs one and not the other gets a loop whose grace window never elapses.\n   */\n  readonly now?: () => number;\n  /**\n   * How long a sustained no-runner signal must persist before it is believed.\n   * Defaults to {@link NO_RUNNER_GRACE_MS}.\n   */\n  readonly graceMs?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60_000;\nconst POLL_INTERVAL_MS = 500;\n/**\n * How long to let a job sit with no available runner before giving up.\n *\n * Not zero: a daemon restarting, or one whose heartbeat is momentarily late,\n * would otherwise fail every job in flight. The signal has to be sustained\n * before it is believed.\n */\nconst NO_RUNNER_GRACE_MS = 10_000;\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * The portable delivery channel: poll the store until the job is terminal.\n *\n * Correct everywhere and adequate for most apps. An adapter with a push\n * channel should replace it — see the Supabase adapter's Realtime delivery.\n */\nexport class PollingDelivery implements ResultDelivery {\n  readonly #deps: PollingDeliveryDeps;\n\n  constructor(deps: PollingDeliveryDeps) {\n    this.#deps = deps;\n  }\n\n  async waitFor(\n    jobId: string,\n    options: WaitOptions = {},\n  ): Promise<DeliveredResult> {\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const sleep = this.#deps.sleep ?? defaultSleep;\n    const now = this.#deps.now ?? Date.now;\n    const graceMs = this.#deps.graceMs ?? NO_RUNNER_GRACE_MS;\n    const started = now();\n    let noRunnerSince: number | null = null;\n\n    for (;;) {\n      options.signal?.throwIfAborted();\n\n      const current = await this.#deps.read(jobId);\n      if (current && isTerminalState(current.state)) return current;\n\n      const availability = await this.#deps.availability(jobId);\n      if (availability.available || availability.blocked) {\n        // `blocked` means the job is waiting on a dependency, which is not the\n        // same event as \"nobody can run this\" ({@link MUSTS.NO_RUNNER_SIGNAL}).\n        noRunnerSince = null;\n      } else {\n        noRunnerSince ??= now();\n        if (now() - noRunnerSince >= graceMs) {\n          const reason = availability.reason ?? \"no-runner-online\";\n          const substitute = await options.onNoRunner?.(reason);\n          if (substitute !== undefined) {\n            return labelFallback(jobId, substitute);\n          }\n          throw new NoRunnerAvailableError(jobId, reason);\n        }\n      }\n\n      if (now() - started >= timeoutMs) {\n        throw new ResultTimeoutError(jobId, timeoutMs);\n      }\n      await sleep(POLL_INTERVAL_MS);\n    }\n  }\n}\n\nfunction isTerminalState(state: string): boolean {\n  return (\n    state === \"ok\" ||\n    state === \"error\" ||\n    state === \"canceled\" ||\n    state === \"expired\"\n  );\n}\n\n/**\n * Turn an app's fallback into a delivered result, marked as one.\n *\n * Exported because there are two delivery channels — polling here, Supabase\n * Realtime next door — and a label applied by one of them is a label an app\n * gets or does not get depending on which store it chose. That is exactly the\n * kind of divergence a \"delivery adapter must not change what a result means\"\n * rule exists to prevent.\n *\n * Two jobs, and the second is the one that matters. A string becomes the\n * obvious record — that is the sugar. Everything, string or record, gets\n * `fallback: true` — that is {@link MUSTS.FALLBACK_LABELED}, and it is\n * applied here rather than trusted from the caller because an app that\n * assembled its own record could otherwise return something indistinguishable\n * from a runner's answer. Spreading the caller's object first and the flag\n * second is deliberate: a supplied `fallback` cannot overwrite it.\n */\nexport function labelFallback(\n  jobId: string,\n  substitute: string | DeliveredResult,\n): DeliveredResult {\n  if (typeof substitute === \"string\") {\n    return {\n      jobId,\n      state: \"ok\",\n      outcome: { outcome: \"ok\", text: substitute },\n      fallback: true,\n    };\n  }\n  return { ...substitute, fallback: true };\n}\n"],"mappings":";AAGO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAEhD,YACW,OACA,QACT;AACA;AAAA,MACE,yCAAyC,KAAK,KAAK,MAAM;AAAA,IAE3D;AANS;AACA;AAAA,EAMX;AAAA,EAPW;AAAA,EACA;AAAA,EAHO,OAAO;AAU3B;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YACW,OACA,WACT;AACA,UAAM,OAAO,KAAK,0BAA0B,OAAO,SAAS,CAAC,IAAI;AAHxD;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAAA,EAHO,OAAO;AAO3B;AAiEA,IAAM,qBAAqB,IAAI;AAC/B,IAAM,mBAAmB;AAQzB,IAAM,qBAAqB;AAE3B,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAQ3C,IAAM,kBAAN,MAAgD;AAAA,EAC5C;AAAA,EAET,YAAY,MAA2B;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QACJ,OACA,UAAuB,CAAC,GACE;AAC1B,UAAM,YAAY,QAAQ,aAAa;AACvC,UAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,UAAM,MAAM,KAAK,MAAM,OAAO,KAAK;AACnC,UAAM,UAAU,KAAK,MAAM,WAAW;AACtC,UAAM,UAAU,IAAI;AACpB,QAAI,gBAA+B;AAEnC,eAAS;AACP,cAAQ,QAAQ,eAAe;AAE/B,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK;AAC3C,UAAI,WAAW,gBAAgB,QAAQ,KAAK,EAAG,QAAO;AAEtD,YAAM,eAAe,MAAM,KAAK,MAAM,aAAa,KAAK;AACxD,UAAI,aAAa,aAAa,aAAa,SAAS;AAGlD,wBAAgB;AAAA,MAClB,OAAO;AACL,0BAAkB,IAAI;AACtB,YAAI,IAAI,IAAI,iBAAiB,SAAS;AACpC,gBAAM,SAAS,aAAa,UAAU;AACtC,gBAAM,aAAa,MAAM,QAAQ,aAAa,MAAM;AACpD,cAAI,eAAe,QAAW;AAC5B,mBAAO,cAAc,OAAO,UAAU;AAAA,UACxC;AACA,gBAAM,IAAI,uBAAuB,OAAO,MAAM;AAAA,QAChD;AAAA,MACF;AAEA,UAAI,IAAI,IAAI,WAAW,WAAW;AAChC,cAAM,IAAI,mBAAmB,OAAO,SAAS;AAAA,MAC/C;AACA,YAAM,MAAM,gBAAgB;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SACE,UAAU,QACV,UAAU,WACV,UAAU,cACV,UAAU;AAEd;AAmBO,SAAS,cACd,OACA,YACiB;AACjB,MAAI,OAAO,eAAe,UAAU;AAClC,WAAO;AAAA,MACL;AAAA,MACA,OAAO;AAAA,MACP,SAAS,EAAE,SAAS,MAAM,MAAM,WAAW;AAAA,MAC3C,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,UAAU,KAAK;AACzC;","names":[]}

package/dist/{delivery-36nIe-b3.d.ts → delivery-C6VzgMgH.d.ts}

@@ -19,10 +19,22 @@ interface WaitOptions {
     readonly timeoutMs?: number;
     /**
      * Called instead of throwing when no runner can take the job. Return a
-     * substitute result (a hosted-model answer, say) and the wait resolves with
-     * it; return nothing and {@link NoRunnerAvailableError} is thrown.
+     * substitute and the wait resolves with it; return nothing and
+     * {@link NoRunnerAvailableError} is thrown.
+     *
+     * **A string is enough.** It is the app's own fallback answer — a hosted
+     * model's text, a cached reply — not wire data, and requiring a whole
+     * `DeliveredResult` for it was ceremony that invited invented shapes. The
+     * README's own example got it wrong, which is how this was found.
+     *
+     * **Whatever comes back is labelled `fallback: true` by the wait, not by
+     * the caller** — {@link MUSTS.FALLBACK_LABELED}. Work that did not come
+     * from the user's own compute must not be reportable as though it did, and
+     * that stays true whether an app returns a bare string or a full record it
+     * assembled itself. The stamp is applied after this function returns, so
+     * there is no shape an app can hand back that hides what it is.
      */
-    readonly onNoRunner?: (reason: string) => DeliveredResult | undefined | Promise<DeliveredResult | undefined>;
+    readonly onNoRunner?: (reason: string) => string | DeliveredResult | undefined | Promise<string | DeliveredResult | undefined>;
     /** Abort the wait. */
     readonly signal?: AbortSignal;
 }

package/dist/{handlers-CF3yE-t2.d.ts → handlers-BJYm2kdq.d.ts}

@@ -1,5 +1,5 @@
 import { StoredKeys, Endpoint } from '@byollm/protocol';
-import { B as ByollmStore } from './store-gFEEN1Dt.js';
+import { B as ByollmStore } from './store-Dno2fnHH.js';
 
 /** Everything a mount needs to serve the protocol. */
 /**

package/dist/index.d.ts

@@ -1,10 +1,134 @@
-import { JobKind, StoredKeys, DeliveredResult, Endpoint, Capability } from '@byollm/protocol';
-import { P as PollingDeliveryDeps, R as ResultDelivery, W as WaitOptions } from './delivery-36nIe-b3.js';
-export { N as NoRunnerAvailableError, a as PollingDelivery, b as ResultTimeoutError } from './delivery-36nIe-b3.js';
-import { B as ByollmStore, E as EnqueueInput, J as JobRecord, R as RunnerRecord, S as StoredJobInput, C as ClaimArgs, a as RenewArgs, b as RenewResult, c as CompleteArgs, d as CompleteResult, e as ReleaseArgs, P as PairingRecord, A as ApproveArgs, T as TouchArgs } from './store-gFEEN1Dt.js';
-export { f as JobStore, g as RunnerStore } from './store-gFEEN1Dt.js';
-import { H as HandlerConfig } from './handlers-CF3yE-t2.js';
-export { B as ByollmHandlers, a as HandlerResult, S as SERVED_PROTOCOL_VERSION } from './handlers-CF3yE-t2.js';
+import { StoredKeys, JobKind, DeliveredResult, Endpoint, Capability } from '@byollm/protocol';
+import { P as PollingDeliveryDeps, R as ResultDelivery, W as WaitOptions } from './delivery-C6VzgMgH.js';
+export { N as NoRunnerAvailableError, a as PollingDelivery, b as ResultTimeoutError } from './delivery-C6VzgMgH.js';
+import { B as ByollmStore, J as JobRecord, E as EnqueueInput, R as RunnerRecord, S as StoredJobInput, C as ClaimArgs, a as RenewArgs, b as RenewResult, A as AdoptArgs, c as CompleteArgs, d as CompleteResult, e as ReleaseArgs, P as PairingRecord, f as ApproveArgs, T as TouchArgs } from './store-Dno2fnHH.js';
+export { g as CompleteHolder, h as JobStore, i as RunnerStore } from './store-Dno2fnHH.js';
+import { H as HandlerConfig } from './handlers-BJYm2kdq.js';
+export { B as ByollmHandlers, a as HandlerResult, S as SERVED_PROTOCOL_VERSION } from './handlers-BJYm2kdq.js';
+
+/**
+ * The cloud lane — cloud_004 §9.4.
+ *
+ * `app.enqueue(...)` is identical in every lane; the lane picks the connection
+ * plane. In `direct` mode a daemon reaches the site's own handlers. In `cloud`
+ * mode it reaches a relay instead, and the site's side of that is this file.
+ *
+ * ## What actually changes, and what deliberately does not
+ *
+ * Enqueue does not change at all. The job is validated, sealed at rest to the
+ * site's own key and stored, exactly as before — jobs-at-rest encryption is a
+ * direct-mode property that the cloud lane inherits rather than replaces.
+ *
+ * What changes is *who asks for the payload and when*. On the direct plane the
+ * daemon asks, and the site answers synchronously because it is the upstream.
+ * Through a relay the site is not the upstream, so nobody asks: the site has to
+ * find out that a device claimed its job, and seal to that device. Hence a
+ * pump rather than a handler.
+ *
+ * ```
+ *  enqueue ──stub──▶ relay        (payload stays here, sealed at rest)
+ *                      │
+ *   pump ◀──who claimed it, and what key?
+ *        ──payload sealed to that device──▶
+ *   pump ◀──sealed result──  ──▶ store.complete → the app's delivery channel
+ * ```
+ *
+ * ## Why the site polls
+ *
+ * Everything in this product is outbound. A relay that called site webhooks
+ * would need every site publicly reachable, which is the connectivity problem
+ * the hub exists to remove — and a serverless site has nowhere to receive a
+ * webhook anyway. So the site polls, exactly as a daemon does.
+ */
+interface CloudLaneOptions {
+    /** Where the relay lives, e.g. `https://relay.byollm.cloud`. */
+    readonly relayOrigin: string;
+    /** This site's id at the relay. */
+    readonly siteId: string;
+    /** Injectable fetch, for tests and for proxies. */
+    readonly fetch?: typeof fetch;
+}
+/** What one pump cycle did, for logging and for tests. */
+/**
+ * A relay that could not answer this request — alpha.31.
+ *
+ * `retryable` is the whole point: a draining pod and a bad signature are both
+ * failures, and treating them alike is how a site either falls over on every
+ * deploy or stays silently disconnected for a week.
+ */
+declare class RelayUnavailable extends Error {
+    readonly retryable: boolean;
+    /** The protocol's own code, when the relay sent one. */
+    readonly code: string;
+    constructor(message: string, retryable: boolean, code: string);
+}
+interface PumpReport {
+    /** Jobs sealed to a claiming device this cycle. */
+    readonly sealed: string[];
+    /** Results opened, verified and written to the store. */
+    readonly completed: string[];
+    /**
+     * Jobs the relay offered that this site refused to seal for.
+     *
+     * Never silent: a site that cannot open its own at-rest envelope has a key
+     * problem, and a device waiting on a payload that will never come is
+     * exactly the case `awaiting-payload` exists to bound.
+     */
+    readonly refused: string[];
+    /**
+     * Why this cycle stopped early, when it did — alpha.31.
+     *
+     * A relay can legitimately say "ask me later": a pod draining through its
+     * `preStop` window answers `503 not-ready` to every routed call, and that
+     * happens on **every deploy**. Before this existed the lane read the body
+     * of that answer, found no `jobs` in it, and threw `TypeError: finished.jobs
+     * is not iterable` — a site falling over because its relay was polite.
+     *
+     * Absent on an ordinary cycle. Present, with the reason, when the lane
+     * deferred: a site that quietly did nothing and a site that was told to wait
+     * must not look the same in a log.
+     */
+    readonly deferred?: string;
+}
+declare class CloudLane {
+    #private;
+    constructor(deps: {
+        options: CloudLaneOptions;
+        store: ByollmStore;
+        siteKeys: StoredKeys;
+        now: () => number;
+    });
+    /**
+     * Publish a job's stub for routing.
+     *
+     * The stub and nothing else — byollm_009 §6 makes that exhaustive by
+     * construction, so this cannot leak a payload even by mistake: there is no
+     * field on `JobStub` to put one in.
+     */
+    publish(record: JobRecord): Promise<void>;
+    /**
+     * Withdraw a job at the relay — cloud_008 §2.2.
+     *
+     * `app.cancel()` marks the site's own row terminal, which stops the *next*
+     * seal. It cannot stop a device that is already running the work, because
+     * on this lane the site is not the upstream: only the relay talks to the
+     * daemon, and it answered `cancel: []` unconditionally.
+     *
+     * So the cancellation has to travel. The relay marks the job, stops
+     * offering it, and names it to the holding device at its next heartbeat —
+     * the same path the direct plane has always had, arriving one hop later.
+     */
+    cancel(jobId: string): Promise<void>;
+    /**
+     * One cycle: seal for anything claimed, collect anything finished.
+     *
+     * Idempotent and safe to call as often as you like. Exposed as a single
+     * cycle rather than hidden behind a timer so a caller decides its own
+     * cadence — a serverless site runs it on a cron, a long-lived one on an
+     * interval, and a test runs it exactly when it means to.
+     */
+    pump(): Promise<PumpReport>;
+}
 
 /** Why a job cannot presently run. */
 type NoRunnerReason = "no-runner-paired" | "no-runner-online" | "no-matching-capability" | "audience-admits-nobody";
@@ -53,6 +177,15 @@ interface ByollmAppOptions {
      * holds plaintext (byollm_009 §10).
      */
     readonly siteKeys: StoredKeys;
+    /**
+     * Which connection plane this site uses — cloud_004 §9.4.
+     *
+     * Omitted means `direct`: a daemon reaches this site's own handlers, and
+     * everything works as it always has. Supplying a relay switches the plane
+     * and nothing else — `enqueue` is identical in every lane, which is the
+     * property that lets the same app move between them by config.
+     */
+    readonly lane?: CloudLaneOptions;
 }
 /**
  * An enqueued job, with the delivery channel attached.
@@ -80,6 +213,8 @@ interface JobHandle {
  */
 declare class ByollmApp {
     #private;
+    /** Present only in the cloud lane; the site's side of the relay. */
+    readonly cloud: CloudLane | undefined;
     constructor(options: ByollmAppOptions);
     /**
      * Enqueue a job.
@@ -97,7 +232,7 @@ declare class ByollmApp {
      * Check `provenance.untrusted` before rendering. It is true for every
      * `named`/`public` job, because that text came from someone else's machine
      * and the app must not present it as its own AI's answer
-     * ({@link MUSTS.RESULT_PROVENANCE}).
+     * ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
      */
     result(jobId: string): Promise<DeliveredResult | null>;
     /** Ask a runner to stop. Queued jobs cancel at once; held jobs at the next heartbeat. */
@@ -220,8 +355,6 @@ declare function formatSiteKeys(keys: StoredKeys): string;
 
 /** A device code: the secret the daemon polls with. Never shown to a user. */
 declare function generateDeviceCode(): string;
-/** A runner bearer token. */
-declare function generateRunnerToken(): string;
 /** A runner id. */
 declare function generateRunnerId(): string;
 /** A job id. */
@@ -264,20 +397,23 @@ declare class MemoryStore implements ByollmStore {
     get(jobId: string): Promise<JobRecord | null>;
     claim(args: ClaimArgs): Promise<JobRecord[]>;
     renewLeases(args: RenewArgs): Promise<RenewResult>;
+    adopt(args: AdoptArgs): Promise<JobRecord | null>;
     complete(args: CompleteArgs): Promise<CompleteResult>;
     subscribe(jobId: string, onChange: () => void): () => void;
     release(args: ReleaseArgs): Promise<string[]>;
     expireDue(now: number): Promise<JobRecord[]>;
     cancel(jobId: string, now: number): Promise<JobRecord | null>;
     listClaimedBy(runnerId: string): Promise<JobRecord[]>;
-    listCancelRequests(runnerId: string): Promise<string[]>;
+    listCancelRequests(runnerId: string): Promise<{
+        jobId: string;
+        leaseId: string;
+    }[]>;
     createPairing(record: PairingRecord): Promise<void>;
     getPairingByDeviceCodeHash(hash: string): Promise<PairingRecord | null>;
     getPairingByUserCode(userCode: string): Promise<PairingRecord | null>;
     approvePairing(args: ApproveArgs): Promise<RunnerRecord>;
     denyPairing(userCode: string, _now: number): Promise<void>;
     consumePairingToken(deviceCodeHash: string): Promise<void>;
-    getRunnerByTokenHash(hash: string): Promise<RunnerRecord | null>;
     getRunner(runnerId: string): Promise<RunnerRecord | null>;
     touchRunner(args: TouchArgs): Promise<RunnerRecord | null>;
     revokeRunner(runnerId: string, now: number): Promise<void>;
@@ -288,4 +424,4 @@ declare class MemoryStore implements ByollmStore {
 /** The capability that would serve a kind, if any. */
 declare function capabilityFor(capabilities: readonly Capability[], kind: string): Capability | undefined;
 
-export { ApproveArgs, type AvailabilityQuery, ByollmApp, type ByollmAppOptions, ByollmStore, ClaimArgs, CompleteArgs, CompleteResult, EnqueueInput, HandlerConfig, type JobHandle, JobRecord, MemoryStore, type MemoryStoreOptions, type NoRunnerReason, PairingRecord, PollingDeliveryDeps, ReleaseArgs, RenewArgs, RenewResult, ResultDelivery, type RunnerAvailability, RunnerRecord, TouchArgs, WaitOptions, capabilityFor, createFetchHandler, formatSiteKeys, generateDeviceCode, generateJobId, generateRunnerId, generateRunnerToken, generateSiteKeys, generateUserCode, hashSecret, normalizeUserCode, routeEndpoint, secretsMatch, signatureFrom, siteKeysFromEnv };
+export { AdoptArgs, ApproveArgs, type AvailabilityQuery, ByollmApp, type ByollmAppOptions, ByollmStore, ClaimArgs, CloudLane, type CloudLaneOptions, CompleteArgs, CompleteResult, EnqueueInput, HandlerConfig, type JobHandle, JobRecord, MemoryStore, type MemoryStoreOptions, type NoRunnerReason, PairingRecord, PollingDeliveryDeps, type PumpReport, RelayUnavailable, ReleaseArgs, RenewArgs, RenewResult, ResultDelivery, type RunnerAvailability, RunnerRecord, TouchArgs, WaitOptions, capabilityFor, createFetchHandler, formatSiteKeys, generateDeviceCode, generateJobId, generateRunnerId, generateSiteKeys, generateUserCode, hashSecret, normalizeUserCode, routeEndpoint, secretsMatch, signatureFrom, siteKeysFromEnv };