@byollm/server 0.1.0-alpha.7 → 0.1.0-alpha.70

package/dist/{store-Cj5b6A9j.d.ts → store-Cx2_bck1.d.ts}

@@ -1,4 +1,4 @@
-import { JobKind, JobPayload, Audience, SealedEnvelope, SizeClass, JobState, Lease, JobOutcome, ResultProvenance, Capability, PublicIdentity } from '@byollm/protocol';
+import { JobKind, PayloadFor, Audience, SealedEnvelope, SizeClass, JobState, Lease, JobOutcome, ResultProvenance, Capability, PublicIdentity } from '@byollm/protocol';
 
 /**
  * A job as the server stores it.
@@ -26,6 +26,14 @@ interface JobRecord {
     /** Fixed at enqueue, where the plaintext is. */
     readonly sizeClass: SizeClass;
     readonly audience: Audience;
+    /**
+     * The service the site named, if it named one — byollm_016 Phase B.
+     *
+     * Stored rather than derived, because the stub carries it to the router and
+     * the router matches on it. `undefined` means the owner's default answers,
+     * which is every job written before this field existed.
+     */
+    readonly purpose: string | undefined;
     /** The app's id for the user who enqueued it. */
     readonly owner: string;
     /** Server-side restriction on which runner owners may take a `named` job. */
@@ -34,6 +42,17 @@ interface JobRecord {
     readonly dependsOn: readonly string[];
     readonly state: JobState;
     readonly lease: Lease | null;
+    /**
+     * The grant that recorded this job's result — cloud_008 §3.6.
+     *
+     * Kept after `lease` is nulled, because "who finished this" outlives "who
+     * holds this" and the two are asked for different reasons. It is what lets
+     * a replay from the device that finished the job be answered *as a
+     * duplicate* rather than as a stale lease — and lets a replay from any
+     * other device be refused exactly as it would be for a job that is not
+     * terminal, so a job id is not a terminality probe.
+     */
+    readonly completedByLeaseId: string | null;
     readonly createdAt: number;
     /**
      * When the job became claimable — enqueue time for a job with no
@@ -66,8 +85,6 @@ interface RunnerRecord {
     readonly id: string;
     /** The app's id for the user this runner is bound to — exactly one. */
     readonly owner: string;
-    /** SHA-256 of the bearer token. The token itself is never stored. */
-    readonly tokenHash: string;
     readonly label: string;
     readonly platform: "darwin" | "linux" | "win32";
     readonly daemonVersion: string;
@@ -94,10 +111,19 @@ interface PairingRecord {
     readonly owner: string | null;
     readonly runnerId: string | null;
     /**
-     * The bearer token, held until the daemon's next poll collects it, then
-     * cleared. Delivered exactly once.
+     * Whether this approval has already been collected — cloud_008 §2.4.
+     *
+     * This was `runnerTokenOnce`, a bearer token held until the daemon's next
+     * poll and then nulled. The token is gone (finding 37: minted, hashed,
+     * written to two disks, never sent or compared), but the *deliver-once*
+     * property it carried is real and separate: a replayed device code must get
+     * nothing, or a code seen in a shell history is a second pairing.
+     *
+     * So the flag stays and the secret does not. Nulling a token to mean
+     * "collected" was one field doing two jobs, and only one of them was load
+     * bearing.
      */
-    readonly runnerTokenOnce: string | null;
+    readonly collected: boolean;
     readonly label: string;
     readonly platform: "darwin" | "linux" | "win32";
     readonly daemonVersion: string;
@@ -113,14 +139,70 @@ interface PairingRecord {
     readonly expiresAt: number;
     readonly createdAt: number;
 }
-/** What the app supplies to enqueue a job. */
-interface EnqueueInput {
-    readonly kind: JobKind;
+/**
+ * What the app supplies to enqueue a job.
+ *
+ * Generic over the kind, so the payload has to be the payload *for* that kind.
+ * These were independent — `kind: JobKind` beside `payload: JobPayload`, the
+ * union of both shapes — and the pairing was left to the author's memory. A
+ * chat job carrying a generate payload typechecked, built, shipped, and was
+ * refused at the relay's ingress with a precise sentence nobody sees until
+ * somebody clicks.
+ *
+ * `PayloadFor<K>` was already exported by the protocol when that happened, and
+ * `enqueue` did not use it. A wrong pairing is now a compile error at the call
+ * site, which is the only place that knows what it meant.
+ *
+ * A caller whose `kind` is a variable rather than a literal still gets the old
+ * permissive union — the conditional distributes — so nothing that was legal
+ * and correct stops compiling.
+ */
+interface EnqueueInput<K extends JobKind = JobKind> {
+    readonly kind: K;
     /** The work, in plaintext. The server seals it before it is stored. */
-    readonly payload: JobPayload;
+    readonly payload: PayloadFor<K>;
     readonly owner: string;
-    /** Defaults to `self` — the safe direction. */
+    /**
+     * Direct lane only. Refused on the cloud lane, where it is derived.
+     *
+     * On the cloud lane, who may serve a job comes from the person's own
+     * mapping — the service they chose, its owner, and that owner's offer scope
+     * — none of which a site is told, and all of which the hub holds at claim.
+     * A site declaring an audience there was a third vote cast by the one party
+     * the disclosure fence forbids from knowing the answer, and its `private`
+     * default silently disabled team sharing for every user who had a team.
+     *
+     * On the direct lane it still selects something real, which is why it stays
+     * rather than going in the same release: it is the switch that turns
+     * {@link EnqueueInput.audienceAllow} on. `private` is own-devices-only;
+     * `team` hands the decision to the allowlist. Without it there is no way to
+     * say "these runner owners, and no others", and supplier trust needs one.
+     *
+     * Defaults to `private` — the safe direction, and on this lane a direction
+     * a caller can meaningfully choose.
+     */
     readonly audience?: Audience;
+    /**
+     * Which of *your site's* declared purposes this job serves — Amendment L.
+     *
+     * **A need, never a name.** You declare purposes at registration —
+     * `"revenue"`, `"writing-assistant"` — and each of your users maps them to
+     * one of their own services on the consent screen. This field names the
+     * purpose; the mapping does the rest.
+     *
+     * There is no model field, no base URL, no flags, and — since Amendment L —
+     * no way to name a service either. Your vocabulary is your purposes; theirs
+     * is their services; the two never meet. You learn whether a slot was
+     * satisfiable and nothing else.
+     *
+     * Use the purpose **key**, not its label. Labels are prose for the consent
+     * screen and may change; a key travels on every job and is what mappings
+     * are stored against.
+     *
+     * Leave it out only in direct mode, which has no control plane to hold a
+     * mapping and answers by kind alone.
+     */
+    readonly purpose?: string;
     readonly audienceAllow?: readonly string[];
     readonly dependsOn?: readonly string[];
     /** Defaults to the server config's `defaultTtlMs`. */
@@ -228,7 +310,7 @@ interface JobStore {
     /** Jobs a runner currently holds — used to build the heartbeat cancel list. */
     listClaimedBy(runnerId: string): Promise<JobRecord[]>;
     /** Jobs awaiting cancellation that a given runner holds. */
-    listCancelRequests(runnerId: string): Promise<string[]>;
+    listCancelRequests(runnerId: string): Promise<LeaseRef[]>;
 }
 interface ClaimArgs {
     readonly runnerId: string;
@@ -276,8 +358,13 @@ interface RenewResult {
         jobId: string;
         expiresAt: number;
     }[];
-    /** Jobs the runner claimed to hold but no longer does. */
-    readonly lost: readonly string[];
+    /**
+     * Grants the runner claimed to hold but no longer does — V1-3.
+     *
+     * Both halves, because a job id is chosen per site: a daemon serving two
+     * sites that picked the same id cannot act on a bare one without guessing.
+     */
+    readonly lost: readonly LeaseRef[];
 }
 /**
  * Which grant is being completed — the `LEASE_HONORED` guard, as a shape.
@@ -305,6 +392,20 @@ type CompleteHolder = {
 };
 interface CompleteArgs {
     readonly jobId: string;
+    /**
+     * The authenticated caller — cloud_008 §3.6, and for the duplicate answer
+     * only.
+     *
+     * Never for authorisation: {@link CompleteHolder} decides whether this
+     * write may happen, and that has not changed. This decides which of two
+     * refusals a caller is owed once the write is refused.
+     *
+     * It exists because a *grant* is not a device. Scoping the duplicate answer
+     * to the lease id alone let a second daemon replay under a lease id it had
+     * learned and be told "already recorded" — which is both untrue and a
+     * terminality probe. Found by writing C010's third case.
+     */
+    readonly runnerId: string;
     /** Who claims to hold this job. Both variants are checked, never trusted. */
     readonly holder: CompleteHolder;
     readonly outcome: JobOutcome;
@@ -312,8 +413,22 @@ interface CompleteArgs {
     readonly now: number;
 }
 interface CompleteResult {
-    /** False when this submission lost an idempotency race or the lease was gone. */
+    /** False when this submission wrote nothing. */
     readonly accepted: boolean;
+    /**
+     * True when the caller is the device that already recorded this result.
+     *
+     * cloud_008 §3.6. `RESULT_IDEMPOTENT` used to hold as a *side effect* of
+     * `LEASE_HONORED`: `complete` nulls the lease on success, so a replay was
+     * refused for not holding the job and the idempotency branch was never
+     * reached. Deleting that branch failed no check.
+     *
+     * byollm_009 §4's case for signing requests rather than issuing nonces
+     * rests on every write being idempotent per the instance it names. A MUST
+     * that another MUST's security argument leans on cannot be one that holds
+     * only because a null happened to trip first.
+     */
+    readonly duplicate?: boolean;
     readonly job: JobRecord | null;
 }
 interface ReleaseArgs {
@@ -337,7 +452,6 @@ interface RunnerStore {
     denyPairing(userCode: string, now: number): Promise<void>;
     /** Clear the one-shot token after the daemon collects it. */
     consumePairingToken(deviceCodeHash: string): Promise<void>;
-    getRunnerByTokenHash(hash: string): Promise<RunnerRecord | null>;
     getRunner(runnerId: string): Promise<RunnerRecord | null>;
     /** Record a heartbeat: capabilities, version, pause state, liveness. */
     touchRunner(args: TouchArgs): Promise<RunnerRecord | null>;
@@ -370,8 +484,6 @@ interface ApproveArgs {
     /** From the approving user's session, never from the daemon. */
     readonly owner: string;
     readonly runnerId: string;
-    readonly runnerToken: string;
-    readonly tokenHash: string;
     readonly now: number;
 }
 interface TouchArgs {

package/dist/supabase/index.d.ts

@@ -1,6 +1,6 @@
 import { SupabaseClient } from '@supabase/supabase-js';
-import { B as ByollmStore } from '../store-Cj5b6A9j.js';
-import { P as PollingDeliveryDeps, R as ResultDelivery } from '../delivery-36nIe-b3.js';
+import { B as ByollmStore } from '../store-Cx2_bck1.js';
+import { P as PollingDeliveryDeps, R as ResultDelivery } from '../delivery-CaGbp0Tc.js';
 import '@byollm/protocol';
 
 /**

package/dist/supabase/index.js

@@ -1,7 +1,8 @@
 import {
   NoRunnerAvailableError,
-  ResultTimeoutError
-} from "../chunk-7RKXFPBZ.js";
+  ResultTimeoutError,
+  labelFallback
+} from "../chunk-I3ER27QG.js";
 
 // src/supabase/realtime.ts
 var DEFAULT_TIMEOUT_MS = 5 * 6e4;
@@ -21,7 +22,7 @@ var SupabaseRealtimeDelivery = class {
     const current = await this.#deps.read(jobId);
     if (current && isTerminal(current.state)) return current;
     const settled = Promise.withResolvers();
-    this.#resolve = settled.resolve;
+    this.#resolvers.set(jobId, settled.resolve);
     const channel = this.#client.channel(`byollm_job_${jobId}`).on(
       "postgres_changes",
       {
@@ -49,22 +50,46 @@ var SupabaseRealtimeDelivery = class {
     } finally {
       clearTimeout(timer);
       clearInterval(watcher);
+      this.#resolvers.delete(jobId);
       options.signal?.removeEventListener("abort", abort);
       await this.#client.removeChannel(channel);
     }
   }
-  #resolve;
+  /**
+   * One resolver per job in flight — P0, 2026-09-02.
+   *
+   * This was a single field, `#resolve`, assigned by every `waitFor`. One
+   * delivery object serves a whole app, so two concurrent waits meant the
+   * second assignment clobbered the first, and then:
+   *
+   *   1. `waitFor(A)` sets the resolver.
+   *   2. `waitFor(B)` overwrites it.
+   *   3. A's row event arrives, `#check(A)` reads A's result — and resolves
+   *      **B's** promise with it.
+   *   4. A never resolves and waits out its timeout.
+   *
+   * So an app awaiting two jobs at once got one answer under the wrong job
+   * id, with the wrong text, silently — and a spurious timeout beside it. No
+   * error anywhere; the failure is that the caller believes it.
+   *
+   * A map, and the entry is removed in the same `finally` that tears down the
+   * channel. A resolver that outlived its wait would be a leak that also
+   * resolves a promise nobody is holding.
+   */
+  #resolvers = /* @__PURE__ */ new Map();
   async #check(jobId) {
     const current = await this.#deps.read(jobId);
-    if (current && isTerminal(current.state)) this.#resolve?.(current);
+    if (current && isTerminal(current.state)) {
+      this.#resolvers.get(jobId)?.(current);
+    }
   }
   /** Poll runner liveness; there is no row event for "nothing is happening". */
   #watchAvailability(jobId, options, settled) {
     let noRunnerSince = null;
     return setInterval(() => {
       (async () => {
-        const availability = await this.#deps.availability(jobId);
-        if (availability.available || availability.blocked) {
+        const availability = await this.#deps.availability?.(jobId);
+        if (availability === void 0 || availability.available || availability.blocked) {
           noRunnerSince = null;
           return;
         }
@@ -72,8 +97,8 @@ var SupabaseRealtimeDelivery = class {
         if (Date.now() - noRunnerSince < NO_RUNNER_GRACE_MS) return;
         const reason = availability.reason ?? "no-runner-online";
         const substitute = await options.onNoRunner?.(reason);
-        if (substitute) {
-          settled.resolve(substitute);
+        if (substitute !== void 0) {
+          settled.resolve(labelFallback(jobId, substitute));
         } else {
           settled.reject(new NoRunnerAvailableError(jobId, reason));
         }
@@ -96,10 +121,12 @@ function toJob(row) {
     envelope: row.envelope,
     sizeClass: row.size_class,
     audience: row.audience,
+    purpose: row.purpose ?? void 0,
     owner: row.owner,
     audienceAllow: row.audience_allow ?? void 0,
     dependsOn: row.depends_on,
     state: row.state,
+    completedByLeaseId: row.completed_by_lease_id ?? null,
     lease: (
       // Keyed on the lease id, not the runner. A relayed grant has no runner
       // row to point at (see AdoptArgs), and reading the lease as absent
@@ -127,7 +154,6 @@ function toRunner(row) {
   return {
     id: row.id,
     owner: row.owner,
-    tokenHash: row.token_hash,
     label: row.label,
     platform: row.platform,
     daemonVersion: row.daemon_version,
@@ -146,7 +172,10 @@ function toPairing(row) {
     state: row.state,
     owner: row.owner,
     runnerId: row.runner_id,
-    runnerTokenOnce: row.runner_token_once,
+    // Collected when it has a timestamp. This was `runner_token_once ===
+    // null` — a nulled token standing in for a fact about delivery, which is
+    // one field doing two jobs (cloud_008 §2.4a).
+    collected: row.collected_at !== null,
     label: row.label,
     platform: row.platform,
     daemonVersion: row.daemon_version,
@@ -187,7 +216,8 @@ function supabaseStore(options) {
         kind: input.kind,
         envelope: input.envelope,
         size_class: input.sizeClass,
-        audience: input.audience ?? "self",
+        audience: input.audience ?? "private",
+        purpose: input.purpose ?? null,
         owner: input.owner,
         audience_allow: input.audienceAllow ? [...input.audienceAllow] : null,
         depends_on: dependsOn,
@@ -238,8 +268,9 @@ function supabaseStore(options) {
           jobId: row.id,
           expiresAt: args.now + args.leaseMs
         })),
-        // Anything the runner thinks it holds but did not renew is gone.
-        lost: args.leases.map((l) => l.jobId).filter((id) => !renewedIds.has(id))
+        // Anything the runner thinks it holds but did not renew is gone,
+        // named by the grant it asked about rather than by a bare id — V1-3.
+        lost: args.leases.filter((lease) => !renewedIds.has(lease.jobId))
       };
     },
     async adopt(args) {
@@ -265,6 +296,8 @@ function supabaseStore(options) {
         state,
         lease_runner: null,
         lease_expires_at: null,
+        // Which grant recorded it, kept after the lease is dropped — §3.6.
+        completed_by_lease_id: args.holder.by === "lease" ? args.holder.leaseId : null,
         outcome: args.outcome,
         provenance: args.provenance,
         updated_at: iso(args.now)
@@ -276,10 +309,9 @@ function supabaseStore(options) {
         const current = unwrapMaybe(
           await db.from("byollm_jobs").select().eq("id", args.jobId).maybeSingle()
         );
-        return {
-          accepted: false,
-          job: current === null ? null : toJob(current)
-        };
+        const job = current === null ? null : toJob(current);
+        const duplicate = job !== null && job.provenance?.runnerId === args.runnerId && (job.state === "ok" || job.state === "error" || job.state === "canceled") && args.holder.by === "lease" && job.completedByLeaseId !== null && job.completedByLeaseId === args.holder.leaseId;
+        return duplicate ? { accepted: false, duplicate: true, job } : { accepted: false, job };
       }
       return { accepted: true, job: toJob(written) };
     },
@@ -337,9 +369,12 @@ function supabaseStore(options) {
     },
     async listCancelRequests(runnerId) {
       const rows = unwrap(
-        await db.from("byollm_job_cancels").select("job_id, byollm_jobs!inner(lease_runner)").eq("byollm_jobs.lease_runner", runnerId)
+        await db.from("byollm_job_cancels").select("job_id, byollm_jobs!inner(lease_runner, lease_id)").eq("byollm_jobs.lease_runner", runnerId)
       );
-      return rows.map((row) => row.job_id);
+      return rows.filter((row) => row.byollm_jobs.lease_id !== null).map((row) => ({
+        jobId: row.job_id,
+        leaseId: row.byollm_jobs.lease_id ?? ""
+      }));
     },
     // -- pairing and runners -------------------------------------------------
     /**
@@ -408,7 +443,6 @@ function supabaseStore(options) {
       const runner = unwrap(
         await db.from("byollm_runners").insert({
           owner: args.owner,
-          token_hash: args.tokenHash,
           label: pairing.label,
           platform: pairing.platform,
           daemon_version: pairing.daemon_version,
@@ -425,7 +459,12 @@ function supabaseStore(options) {
         state: "approved",
         owner: args.owner,
         runner_id: runner.id,
-        runner_token_once: args.runnerToken
+        // Marks the approval collectable — cloud_008 §2.4. The column held
+        // a bearer token; it now holds a marker, and the next migration
+        // renames it. Written as a constant rather than left null because
+        // `collected` reads `=== null`, and a schema change and a code
+        // change landing in one step is how a rollback strands rows.
+        collected_at: null
       }).eq("device_code_hash", pairing.device_code_hash);
       if (error) throw new Error(`supabase: ${error.message}`);
       return toRunner(runner);
@@ -435,15 +474,9 @@ function supabaseStore(options) {
       if (error) throw new Error(`supabase: ${error.message}`);
     },
     async consumePairingToken(deviceCodeHash) {
-      const { error } = await db.from("byollm_pairings").update({ runner_token_once: null }).eq("device_code_hash", deviceCodeHash);
+      const { error } = await db.from("byollm_pairings").update({ collected_at: "now()" }).eq("device_code_hash", deviceCodeHash);
       if (error) throw new Error(`supabase: ${error.message}`);
     },
-    async getRunnerByTokenHash(hash) {
-      const row = unwrapMaybe(
-        await db.from("byollm_runners").select().eq("token_hash", hash).maybeSingle()
-      );
-      return row === null ? null : toRunner(row);
-    },
     async getRunner(runnerId) {
       const row = unwrapMaybe(
         await db.from("byollm_runners").select().eq("id", runnerId).maybeSingle()