@byollm/server 0.1.0-alpha.4 → 0.1.0-alpha.41

package/dist/index.js

@@ -2,35 +2,355 @@ import {
   ByollmHandlers,
   SERVED_PROTOCOL_VERSION,
   createFetchHandler,
+  deadlineFor,
   generateDeviceCode,
   generateJobId,
   generateLeaseId,
   generateRunnerId,
-  generateRunnerToken,
   generateUserCode,
   hashSecret,
+  resealForDevice,
   routeEndpoint,
   secretsMatch,
   signatureFrom
-} from "./chunk-MGJX6626.js";
+} from "./chunk-K5E6JS5A.js";
 import {
   NoRunnerAvailableError,
   PollingDelivery,
   ResultTimeoutError
-} from "./chunk-7RKXFPBZ.js";
+} from "./chunk-SAK63KNU.js";
 
 // src/app.ts
 import {
   ENVELOPE_MAX_AGE_MS,
   KindedPayload,
-  keyId,
+  keyId as keyId2,
   payloadTextLength,
-  publicIdentityOf,
+  publicIdentityOf as publicIdentityOf2,
   seal,
   sizeClassOf,
   backendDescriptor,
   matchAudience
 } from "@byollm/protocol";
+
+// src/cloud.ts
+import {
+  PROTOCOL_VERSION,
+  SealedOutcome,
+  keyId,
+  open,
+  publicIdentityOf,
+  provenanceFor,
+  signSiteRequest
+} from "@byollm/protocol";
+var RelayUnavailable = class extends Error {
+  retryable;
+  /** The protocol's own code, when the relay sent one. */
+  code;
+  constructor(message, retryable, code) {
+    super(message);
+    this.name = "RelayUnavailable";
+    this.retryable = retryable;
+    this.code = code;
+  }
+};
+var CloudLane = class {
+  #options;
+  #store;
+  #siteKeys;
+  #now;
+  #fetch;
+  constructor(deps) {
+    this.#options = deps.options;
+    this.#store = deps.store;
+    this.#siteKeys = deps.siteKeys;
+    this.#now = deps.now;
+    this.#fetch = deps.options.fetch ?? globalThis.fetch;
+  }
+  /**
+   * Publish a job's stub for routing.
+   *
+   * The stub and nothing else — byollm_009 §6 makes that exhaustive by
+   * construction, so this cannot leak a payload even by mistake: there is no
+   * field on `JobStub` to put one in.
+   */
+  async publish(record) {
+    const stub = {
+      id: record.id,
+      kind: record.kind,
+      owner: record.owner,
+      // This site, by its identity key id — Amendment A §A.3. The relay
+      // already knows which site it is routing for, so this discloses nothing
+      // new to it; what it adds is that the *daemon* can check the stub
+      // against the envelope's `senderKeyId` without asking the relay.
+      site: keyId(publicIdentityOf(this.#siteKeys).identity),
+      audience: record.audience,
+      // `audienceAllow` is deliberately **not** published — cloud_008 §0.2.
+      //
+      // It is a list of the people who may run this job, and on the direct
+      // plane that is unremarkable: the site authored the list and the site is
+      // the upstream, so the party receiving it already has it. Through a
+      // relay it is a third party, and byollm_009 §6's enumerated metadata —
+      // "exhaustive and normative… what an upstream can see, stated as a
+      // commitment" — does not include it. It was reaching the relay on every
+      // named-audience job.
+      //
+      // Nothing is lost by withholding it, which is why this is a Tier 0 fix
+      // rather than a trade. `matchAudience` treats it as a *narrowing*:
+      // `job.audienceAllow !== undefined && !includes(daemon.owner)` refuses,
+      // and its absence simply falls through to the checks that actually
+      // enforce — the daemon's own allowlist (`NAMED_LOCAL_ALLOWLIST`) and the
+      // backend's offer scope. On this lane the relay narrows too, from the
+      // control plane's rosters. The enforcement was never here.
+      sizeClass: record.sizeClass,
+      streaming: false,
+      // The relay needs *a* deadline to bound routing. A job without one gets
+      // the envelope's, which is the outer bound on how long the ciphertext
+      // is worth carrying — never longer than the work could possibly matter.
+      // The same fallback the direct plane uses — cloud_008 Tier 4, finding
+      // 31. This said `createdAt + ENVELOPE_TTL_FALLBACK`, a local constant
+      // whose value happened to equal `ENVELOPE_MAX_AGE_MS`; the direct plane
+      // said `(claimableAt ?? now) + ttlMs`. One field, two meanings, and a
+      // job that was blocked on a dependency got a deadline measured from
+      // when it was *created* on one lane and from when it became *claimable*
+      // on the other.
+      deadlineAt: deadlineFor(record, this.#now())
+    };
+    await this.#post("enqueue", {
+      siteId: this.#options.siteId,
+      stub
+    });
+  }
+  /**
+   * Withdraw a job at the relay — cloud_008 §2.2.
+   *
+   * `app.cancel()` marks the site's own row terminal, which stops the *next*
+   * seal. It cannot stop a device that is already running the work, because
+   * on this lane the site is not the upstream: only the relay talks to the
+   * daemon, and it answered `cancel: []` unconditionally.
+   *
+   * So the cancellation has to travel. The relay marks the job, stops
+   * offering it, and names it to the holding device at its next heartbeat —
+   * the same path the direct plane has always had, arriving one hop later.
+   */
+  async cancel(jobId) {
+    await this.#post("cancel", { siteId: this.#options.siteId, jobId });
+  }
+  /**
+   * One cycle: seal for anything claimed, collect anything finished.
+   *
+   * Idempotent and safe to call as often as you like. Exposed as a single
+   * cycle rather than hidden behind a timer so a caller decides its own
+   * cadence — a serverless site runs it on a cron, a long-lived one on an
+   * interval, and a test runs it exactly when it means to.
+   */
+  async pump() {
+    const sealed = [];
+    const refused = [];
+    const completed = [];
+    try {
+      return await this.#cycle(sealed, refused, completed);
+    } catch (error) {
+      if (error instanceof RelayUnavailable && error.retryable) {
+        return { sealed, completed, refused, deferred: error.message };
+      }
+      throw error;
+    }
+  }
+  async #cycle(sealed, refused, completed) {
+    const pending = await this.#get("pending");
+    for (const claim of pending.jobs) {
+      const record = await this.#store.get(claim.jobId);
+      if (!record) continue;
+      const resealed = await resealForDevice({
+        siteKeys: this.#siteKeys,
+        job: {
+          id: record.id,
+          envelope: record.envelope,
+          createdAt: record.createdAt
+        },
+        device: claim.device
+      });
+      if (!resealed.ok) {
+        refused.push(claim.jobId);
+        continue;
+      }
+      const adopted = await this.#store.adopt({
+        jobId: claim.jobId,
+        leaseId: claim.leaseId,
+        expiresAt: claim.leaseExpiresAt,
+        now: this.#now()
+      });
+      if (!adopted) {
+        refused.push(claim.jobId);
+        continue;
+      }
+      await this.#post("payload", {
+        siteId: this.#options.siteId,
+        jobId: claim.jobId,
+        envelope: resealed.envelope
+      });
+      sealed.push(claim.jobId);
+    }
+    const finished = await this.#get("results");
+    for (const done of finished.jobs) {
+      const record = await this.#store.get(done.jobId);
+      if (!record || record.state === "ok" || record.state === "error") {
+        continue;
+      }
+      const outcome = await this.#openResult(done);
+      if (!outcome) {
+        refused.push(done.jobId);
+        continue;
+      }
+      await this.#store.complete({
+        jobId: done.jobId,
+        // The relay named the device; the signature above proved it — §3.6.
+        runnerId: done.runnerId,
+        // The grant, not the machine: this site never paired with the device
+        // that ran it, and the signature it verified above is the stronger
+        // claim about who did.
+        holder: { by: "lease", leaseId: done.leaseId },
+        outcome: outcome.outcome,
+        provenance: provenanceFor({
+          audience: record.audience,
+          runnerId: done.runnerId,
+          // The owner, from the relay's own record of who claimed it — not a
+          // key id. cloud_008 §2.5: this said `keyId(device.identity)`, which
+          // put a key id where the direct plane puts a user id, so an app
+          // comparing provenance across lanes compared two namespaces and got
+          // `false` for the same person. The device's key is still what the
+          // signature was verified against, above; that is a different
+          // question from whose machine it is.
+          runnerOwner: done.runnerOwner,
+          // From the envelope, not invented — cloud_008 §2.5. These were
+          // hardcoded `"http"` and `"unknown"` because the daemon's declared
+          // values stopped at the relay, which is right: a blind relay acts
+          // on neither. Sealing them carries them past it untouched.
+          backendClass: outcome.ran.backendClass,
+          model: outcome.ran.model
+        }),
+        now: this.#now()
+      });
+      completed.push(done.jobId);
+    }
+    return { sealed, completed, refused };
+  }
+  /**
+   * Open a sealed result and verify it came from the device that claimed it.
+   *
+   * The relay says which device ran the job; this checks that claim against a
+   * signature the relay cannot produce. A relay that named the wrong device
+   * gets a refusal, not a stored result — which is what keeps `RELAY_BLIND`
+   * from quietly becoming `RELAY_TRUSTED`.
+   */
+  async #openResult(done) {
+    const opened = await open({
+      envelope: done.envelope,
+      recipientKeys: this.#siteKeys,
+      senderIdentityPublic: done.device.identity,
+      expected: {
+        jobId: done.jobId,
+        senderKeyId: keyId(done.device.identity),
+        recipientKeyId: keyId(publicIdentityOf(this.#siteKeys).identity),
+        direction: "result"
+      }
+    });
+    if (!opened.ok) return null;
+    let parsed;
+    try {
+      parsed = JSON.parse(opened.plaintext);
+    } catch {
+      return null;
+    }
+    const sealed = SealedOutcome.safeParse(parsed);
+    if (!sealed.success) return null;
+    if (sealed.data.outcome.outcome !== done.disposition) return null;
+    return sealed.data;
+  }
+  /**
+   * Sign a site-plane call with this site's identity key.
+   *
+   * The same scheme the daemon uses against an upstream, because the site is
+   * in the same position: an outbound caller whose key the relay already holds
+   * for other reasons. Nothing else authenticates this plane — a relay that
+   * took the `siteId` in a body at face value would let anyone enqueue work in
+   * a site's name and read who claimed it.
+   */
+  #headers(endpoint, rawBody) {
+    const signature = signSiteRequest(this.#siteKeys, {
+      endpoint,
+      siteId: this.#options.siteId,
+      issuedAt: this.#now(),
+      body: rawBody
+    });
+    return {
+      "x-byollm-site": this.#options.siteId,
+      "x-byollm-issued-at": String(signature.issuedAt),
+      "x-byollm-signature": signature.signature
+    };
+  }
+  /**
+   * A relay answer, checked before it is believed — alpha.31.
+   *
+   * The bug this closes is one line long and its shape is general: a response
+   * body used without looking at the status. The daemon's client has always
+   * done this properly (`client.ts` maps every status to a typed refusal); the
+   * site's lane parsed JSON and hoped.
+   *
+   * Two classes, because they need opposite handling. **Retryable** — 503 from
+   * a draining pod, 429, 5xx, and the protocol's own `not-ready` — means the
+   * work is still there and this cycle should end quietly. **Refused** — a bad
+   * signature, an unknown site, a version this relay does not speak — will
+   * still be true in five seconds, and swallowing it would leave a site
+   * silently disconnected from its own users.
+   */
+  async #answer(response, endpoint) {
+    if (response.ok) return response.json();
+    let code = "";
+    let message;
+    try {
+      const body = await response.json();
+      code = body.error ?? "";
+      message = body.message ?? "";
+    } catch {
+      message = `HTTP ${String(response.status)}`;
+    }
+    const retryable = response.status >= 500 || response.status === 429 || code === "not-ready" || code === "server-error";
+    throw new RelayUnavailable(
+      `${endpoint}: ${code || "refused"} \u2014 ${message}`,
+      retryable,
+      code
+    );
+  }
+  async #post(endpoint, body) {
+    const rawBody = JSON.stringify({
+      protocolVersion: PROTOCOL_VERSION,
+      ...body
+    });
+    const response = await this.#fetch(
+      `${this.#options.relayOrigin}/relay/site/${endpoint}`,
+      {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...this.#headers(endpoint, rawBody)
+        },
+        body: rawBody
+      }
+    );
+    return this.#answer(response, endpoint);
+  }
+  async #get(endpoint) {
+    const url = `${this.#options.relayOrigin}/relay/site/${endpoint}?siteId=${encodeURIComponent(this.#options.siteId)}&protocolVersion=${encodeURIComponent(PROTOCOL_VERSION)}`;
+    const response = await this.#fetch(url, {
+      headers: this.#headers(endpoint, "")
+    });
+    return this.#answer(response, endpoint);
+  }
+};
+
+// src/app.ts
 var DEFAULT_LIVENESS_MS = 35e3;
 var ByollmApp = class {
   #store;
@@ -38,11 +358,19 @@ var ByollmApp = class {
   #now;
   #livenessMs;
   #delivery;
+  /** Present only in the cloud lane; the site's side of the relay. */
+  cloud;
   constructor(options) {
     this.#store = options.store;
     this.#siteKeys = options.siteKeys;
     this.#now = options.now ?? Date.now;
     this.#livenessMs = options.livenessMs ?? DEFAULT_LIVENESS_MS;
+    this.cloud = options.lane === void 0 ? void 0 : new CloudLane({
+      options: options.lane,
+      store: options.store,
+      siteKeys: options.siteKeys,
+      now: this.#now
+    });
     const deps = {
       ...options.noRunnerGraceMs === void 0 ? {} : { graceMs: options.noRunnerGraceMs },
       read: (jobId) => this.result(jobId),
@@ -87,7 +415,7 @@ var ByollmApp = class {
     const createdAt = this.#now();
     const envelopeDeadlineAt = createdAt + ENVELOPE_MAX_AGE_MS;
     const jobId = input.id ?? generateJobId();
-    const senderKeyId = keyId(publicIdentityOf(this.#siteKeys).identity);
+    const senderKeyId = keyId2(publicIdentityOf2(this.#siteKeys).identity);
     const envelope = await seal({
       plaintext: JSON.stringify(parsed.data.payload),
       senderKeys: this.#siteKeys,
@@ -114,6 +442,7 @@ var ByollmApp = class {
       },
       createdAt
     );
+    await this.cloud?.publish(record);
     return {
       id: record.id,
       record,
@@ -134,7 +463,7 @@ var ByollmApp = class {
    * Check `provenance.untrusted` before rendering. It is true for every
    * `named`/`public` job, because that text came from someone else's machine
    * and the app must not present it as its own AI's answer
-   * ({@link MUSTS.RESULT_PROVENANCE}).
+   * ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
    */
   async result(jobId) {
     const job = await this.job(jobId);
@@ -148,7 +477,11 @@ var ByollmApp = class {
   }
   /** Ask a runner to stop. Queued jobs cancel at once; held jobs at the next heartbeat. */
   async cancel(jobId) {
-    return this.#store.cancel(jobId, this.#now());
+    const cancelled = await this.#store.cancel(jobId, this.#now());
+    if (cancelled && this.cloud) {
+      await this.cloud.cancel(jobId).catch(() => void 0);
+    }
+    return cancelled;
   }
   /**
    * Is there a live runner that could take a job of this shape?
@@ -226,13 +559,10 @@ var ByollmApp = class {
    * ({@link MUSTS.PAIR_ONE_USER}, {@link MUSTS.PAIR_INTERACTIVE}).
    */
   async approvePairing(args) {
-    const token = generateRunnerToken();
     return this.#store.approvePairing({
       userCode: normalizeUserCode(args.userCode),
       owner: args.owner,
       runnerId: generateRunnerId(),
-      runnerToken: token,
-      tokenHash: hashSecret(token),
       now: this.#now()
     });
   }
@@ -277,7 +607,7 @@ function normalizeUserCode(input) {
 }
 
 // src/keys.ts
-import { StoredKeys, generateKeys, publicIdentityOf as publicIdentityOf2 } from "@byollm/protocol";
+import { StoredKeys, generateKeys, publicIdentityOf as publicIdentityOf3 } from "@byollm/protocol";
 import { fingerprint } from "@byollm/protocol";
 var generateSiteKeys = (now = Date.now()) => generateKeys(now);
 function siteKeysFromEnv(variable = "BYOLLM_SITE_KEYS", env = process.env) {
@@ -305,13 +635,27 @@ function siteKeysFromEnv(variable = "BYOLLM_SITE_KEYS", env = process.env) {
 }
 function formatSiteKeys(keys) {
   const encoded = Buffer.from(JSON.stringify(keys)).toString("base64");
-  return `# Set this as BYOLLM_SITE_KEYS. It is a secret: it is this site's
-# identity, and anything holding it can be this site.
+  const pub = publicIdentityOf3(keys);
+  return `# \u2500\u2500 1. SECRET \u2014 set this on your server, and nowhere else \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# This is the site's identity. Anything holding it can *be* this site,
+# so it goes wherever your deployment keeps secrets \u2014 never in a repo,
+# never in a browser, never pasted into a dashboard.
 BYOLLM_SITE_KEYS=${encoded}
 
-# Fingerprint (not secret \u2014 show it to users so they can check what
-# their daemon pinned):
-# ${fingerprint(publicIdentityOf2(keys).identity)}
+# \u2500\u2500 2. PUBLIC \u2014 paste this line into the byollm dashboard \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# The public half. It proves signatures and seals nothing, so it is
+# safe to publish \u2014 which is the point: users pin it, and the relay
+# cannot forge work without the secret above.
+${JSON.stringify(pub)}
+
+# \u2500\u2500 3. Fingerprint \u2014 what a person compares by eye \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# A fingerprint is not secret. Show it on your site so somebody
+# connecting can check it against what their daemon printed.
+# The dashboard derives this itself, so there is nothing to paste.
+# ${fingerprint(pub.identity)}
 `;
 }
 
@@ -351,6 +695,7 @@ var MemoryStore = class {
       dependsOn,
       state: "queued",
       lease: null,
+      completedByLeaseId: null,
       createdAt: now,
       // The TTL clock starts here only if nothing blocks the job.
       claimableAt: blocked ? null : now,
@@ -440,11 +785,11 @@ var MemoryStore = class {
     for (const { jobId, leaseId } of args.leases) {
       const job = this.#jobs.get(jobId);
       if (!job || job.lease?.runnerId !== args.runnerId || job.lease.id !== leaseId) {
-        lost.push(jobId);
+        lost.push({ jobId, leaseId });
         continue;
       }
       if (job.state !== "claimed" && job.state !== "running") {
-        lost.push(jobId);
+        lost.push({ jobId, leaseId });
         continue;
       }
       const expiresAt = args.now + args.leaseMs;
@@ -459,16 +804,45 @@ var MemoryStore = class {
     }
     return Promise.resolve({ renewed, lost });
   }
+  adopt(args) {
+    const job = this.#jobs.get(args.jobId);
+    if (!job) return Promise.resolve(null);
+    if (job.state !== "queued" && job.state !== "claimed") {
+      return Promise.resolve(null);
+    }
+    if (job.lease && job.lease.id !== args.leaseId) {
+      return Promise.resolve(null);
+    }
+    const updated = {
+      ...job,
+      state: "claimed",
+      lease: {
+        id: args.leaseId,
+        // No runner: this site never paired with the machine holding it.
+        runnerId: "",
+        expiresAt: args.expiresAt
+      },
+      updatedAt: args.now
+    };
+    this.#write(updated.id, updated);
+    return Promise.resolve(updated);
+  }
   complete(args) {
     const job = this.#jobs.get(args.jobId);
     if (!job) return Promise.resolve({ accepted: false, job: null });
     if (job.state === "ok" || job.state === "error" || job.state === "canceled") {
+      const sameDevice = job.provenance?.runnerId !== void 0 && job.provenance.runnerId === args.runnerId;
+      const sameGrant = args.holder.by === "lease" && job.completedByLeaseId !== null && job.completedByLeaseId === args.holder.leaseId;
+      if (sameDevice && sameGrant) {
+        return Promise.resolve({ accepted: false, duplicate: true, job });
+      }
       return Promise.resolve({ accepted: false, job });
     }
     if (job.state === "expired") {
       return Promise.resolve({ accepted: false, job });
     }
-    if (job.lease?.runnerId !== args.runnerId) {
+    const holds = args.holder.by === "runner" ? job.lease?.runnerId === args.holder.runnerId : job.lease?.id === args.holder.leaseId;
+    if (!holds) {
       return Promise.resolve({ accepted: false, job });
     }
     const state = args.outcome.outcome === "ok" ? "ok" : args.outcome.outcome === "canceled" ? "canceled" : "error";
@@ -476,6 +850,8 @@ var MemoryStore = class {
       ...job,
       state,
       lease: null,
+      // The grant that recorded it, kept after the lease is dropped — §3.6.
+      completedByLeaseId: args.holder.by === "lease" ? args.holder.leaseId : job.lease?.id ?? null,
       outcome: args.outcome,
       provenance: args.provenance,
       updatedAt: args.now
@@ -564,6 +940,7 @@ var MemoryStore = class {
         ...job,
         state: "queued",
         lease: null,
+        completedByLeaseId: null,
         // Newly available again, so the TTL clock restarts here too.
         claimableAt: args.now,
         // A refusal is remembered, or the pair spins between claim and
@@ -593,6 +970,7 @@ var MemoryStore = class {
           ...job,
           state: "queued",
           lease: null,
+          completedByLeaseId: null,
           // The TTL clock restarts: it measures how long a job has waited
           // *unclaimed*, and this job has just become available again. Without
           // this, a job whose runner died would expire for time it spent being
@@ -615,6 +993,7 @@ var MemoryStore = class {
         ...job,
         state: "expired",
         lease: null,
+        completedByLeaseId: null,
         updatedAt: now
       };
       this.#write(job.id, expired);
@@ -630,6 +1009,7 @@ var MemoryStore = class {
         ...job,
         state: "canceled",
         lease: null,
+        completedByLeaseId: null,
         updatedAt: now
       };
       this.#write(jobId, canceled);
@@ -650,9 +1030,7 @@ var MemoryStore = class {
   }
   listCancelRequests(runnerId) {
     return Promise.resolve(
-      [...this.#cancelRequests].filter(
-        (jobId) => this.#jobs.get(jobId)?.lease?.runnerId === runnerId
-      )
+      [...this.#cancelRequests].map((jobId) => ({ jobId, lease: this.#jobs.get(jobId)?.lease })).filter((row) => row.lease?.runnerId === runnerId).map((row) => ({ jobId: row.jobId, leaseId: row.lease?.id ?? "" }))
     );
   }
   // -- pairing and runners -------------------------------------------------
@@ -683,7 +1061,6 @@ var MemoryStore = class {
     const runner = {
       id: args.runnerId,
       owner: args.owner,
-      tokenHash: args.tokenHash,
       // Carried from the pairing, not re-supplied at approval: the user
       // approved a specific machine, and the runner must be that machine.
       device: pairing.device,
@@ -702,7 +1079,7 @@ var MemoryStore = class {
       state: "approved",
       owner: args.owner,
       runnerId: runner.id,
-      runnerTokenOnce: args.runnerToken
+      collected: false
     });
     return Promise.resolve(runner);
   }
@@ -723,17 +1100,11 @@ var MemoryStore = class {
     if (pairing) {
       this.#pairings.set(deviceCodeHash, {
         ...pairing,
-        runnerTokenOnce: null
+        collected: true
       });
     }
     return Promise.resolve();
   }
-  getRunnerByTokenHash(hash) {
-    for (const runner of this.#runners.values()) {
-      if (runner.tokenHash === hash) return Promise.resolve(runner);
-    }
-    return Promise.resolve(null);
-  }
   getRunner(runnerId) {
     return Promise.resolve(this.#runners.get(runnerId) ?? null);
   }
@@ -775,9 +1146,11 @@ function capabilityFor(capabilities, kind) {
 export {
   ByollmApp,
   ByollmHandlers,
+  CloudLane,
   MemoryStore,
   NoRunnerAvailableError,
   PollingDelivery,
+  RelayUnavailable,
   ResultTimeoutError,
   SERVED_PROTOCOL_VERSION,
   capabilityFor,
@@ -786,7 +1159,6 @@ export {
   generateDeviceCode,
   generateJobId,
   generateRunnerId,
-  generateRunnerToken,
   generateSiteKeys,
   generateUserCode,
   hashSecret,