@byollm/server 0.1.0-alpha.8 → 0.1.0-alpha.80

package/dist/{chunk-7RKXFPBZ.js → chunk-I3ER27QG.js}

@@ -41,15 +41,17 @@ var PollingDelivery = class {
       options.signal?.throwIfAborted();
       const current = await this.#deps.read(jobId);
       if (current && isTerminalState(current.state)) return current;
-      const availability = await this.#deps.availability(jobId);
-      if (availability.available || availability.blocked) {
+      const availability = await this.#deps.availability?.(jobId);
+      if (availability === void 0 || availability.available || availability.blocked) {
         noRunnerSince = null;
       } else {
         noRunnerSince ??= now();
         if (now() - noRunnerSince >= graceMs) {
           const reason = availability.reason ?? "no-runner-online";
           const substitute = await options.onNoRunner?.(reason);
-          if (substitute) return substitute;
+          if (substitute !== void 0) {
+            return labelFallback(jobId, substitute);
+          }
           throw new NoRunnerAvailableError(jobId, reason);
         }
       }
@@ -63,10 +65,22 @@ var PollingDelivery = class {
 function isTerminalState(state) {
   return state === "ok" || state === "error" || state === "canceled" || state === "expired";
 }
+function labelFallback(jobId, substitute) {
+  if (typeof substitute === "string") {
+    return {
+      jobId,
+      state: "ok",
+      outcome: { outcome: "ok", text: substitute },
+      fallback: true
+    };
+  }
+  return { ...substitute, fallback: true };
+}
 
 export {
   NoRunnerAvailableError,
   ResultTimeoutError,
-  PollingDelivery
+  PollingDelivery,
+  labelFallback
 };
-//# sourceMappingURL=chunk-7RKXFPBZ.js.map
+//# sourceMappingURL=chunk-I3ER27QG.js.map

package/dist/chunk-I3ER27QG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/delivery.ts"],"sourcesContent":["import type { DeliveredResult } from \"@byollm/protocol\";\n\n/** Why a wait ended without a result. */\nexport class NoRunnerAvailableError extends Error {\n  override readonly name = \"NoRunnerAvailableError\";\n  constructor(\n    readonly jobId: string,\n    readonly reason: string,\n  ) {\n    super(\n      `no runner is available to execute job ${jobId} (${reason}). ` +\n        `Fall back to a hosted model, or prompt the user to start their runner.`,\n    );\n  }\n}\n\n/** The wait exceeded its timeout while a runner was still plausibly working. */\nexport class ResultTimeoutError extends Error {\n  override readonly name = \"ResultTimeoutError\";\n  constructor(\n    readonly jobId: string,\n    readonly timeoutMs: number,\n  ) {\n    super(`job ${jobId} did not finish within ${String(timeoutMs)}ms`);\n  }\n}\n\nexport interface WaitOptions {\n  /** Give up after this long. Default 5 minutes. */\n  readonly timeoutMs?: number;\n  /**\n   * Called instead of throwing when no runner can take the job. Return a\n   * substitute and the wait resolves with it; return nothing and\n   * {@link NoRunnerAvailableError} is thrown.\n   *\n   * **A string is enough.** It is the app's own fallback answer — a hosted\n   * model's text, a cached reply — not wire data, and requiring a whole\n   * `DeliveredResult` for it was ceremony that invited invented shapes. The\n   * README's own example got it wrong, which is how this was found.\n   *\n   * **Whatever comes back is labelled `fallback: true` by the wait, not by\n   * the caller** — {@link MUSTS.FALLBACK_LABELED}. Work that did not come\n   * from the user's own compute must not be reportable as though it did, and\n   * that stays true whether an app returns a bare string or a full record it\n   * assembled itself. The stamp is applied after this function returns, so\n   * there is no shape an app can hand back that hides what it is.\n   */\n  readonly onNoRunner?: (\n    reason: string,\n  ) =>\n    | string\n    | DeliveredResult\n    | undefined\n    | Promise<string | DeliveredResult | undefined>;\n  /** Abort the wait. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * How an app learns a job finished.\n *\n * byollm_003 Rev 1 is explicit that this is a *channel* — webhook, Realtime\n * subscription, or poll — and never an implied in-request `await`. The\n * polling implementation below is the portable default; the Supabase adapter\n * substitutes Realtime for the same interface.\n */\nexport interface ResultDelivery {\n  waitFor(jobId: string, options?: WaitOptions): Promise<DeliveredResult>;\n}\n\nexport interface PollingDeliveryDeps {\n  /** Current state of the job, or null if unknown. */\n  readonly read: (jobId: string) => Promise<DeliveredResult | null>;\n  /**\n   * Whether a runner could still take this job — **when there is anybody to\n   * ask.**\n   *\n   * Optional since alpha.66, and its absence is the answer rather than a\n   * missing dependency. On the cloud lane nothing writes runners into this\n   * site's store: devices pair with the relay, so the question has no local\n   * answer and `runnerAvailability` refuses to invent one.\n   *\n   * The refusal was correct and it landed in a loop that asked every 500ms.\n   * `job.result()` threw on its first poll for every cloud-lane site — a\n   * refusal aimed at outsiders that our own delivery tripped over.\n   *\n   * Not fixed by catching the throw here. That is a swallowed error in\n   * costume, and a catch wide enough to hold it would also eat a store that\n   * had genuinely gone away. The instrument is simply not handed over on a\n   * lane where it cannot see, and this loop does not ask a question nobody\n   * can answer.\n   */\n  readonly availability?: (\n    jobId: string,\n  ) => Promise<{ available: boolean; reason?: string; blocked: boolean }>;\n  readonly sleep?: (ms: number) => Promise<void>;\n  /**\n   * Injectable clock. It must advance in step with {@link sleep}: a test that\n   * stubs one and not the other gets a loop whose grace window never elapses.\n   */\n  readonly now?: () => number;\n  /**\n   * How long a sustained no-runner signal must persist before it is believed.\n   * Defaults to {@link NO_RUNNER_GRACE_MS}.\n   */\n  readonly graceMs?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60_000;\nconst POLL_INTERVAL_MS = 500;\n/**\n * How long to let a job sit with no available runner before giving up.\n *\n * Not zero: a daemon restarting, or one whose heartbeat is momentarily late,\n * would otherwise fail every job in flight. The signal has to be sustained\n * before it is believed.\n */\nconst NO_RUNNER_GRACE_MS = 10_000;\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * The portable delivery channel: poll the store until the job is terminal.\n *\n * Correct everywhere and adequate for most apps. An adapter with a push\n * channel should replace it — see the Supabase adapter's Realtime delivery.\n */\nexport class PollingDelivery implements ResultDelivery {\n  readonly #deps: PollingDeliveryDeps;\n\n  constructor(deps: PollingDeliveryDeps) {\n    this.#deps = deps;\n  }\n\n  async waitFor(\n    jobId: string,\n    options: WaitOptions = {},\n  ): Promise<DeliveredResult> {\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const sleep = this.#deps.sleep ?? defaultSleep;\n    const now = this.#deps.now ?? Date.now;\n    const graceMs = this.#deps.graceMs ?? NO_RUNNER_GRACE_MS;\n    const started = now();\n    let noRunnerSince: number | null = null;\n\n    for (;;) {\n      options.signal?.throwIfAborted();\n\n      const current = await this.#deps.read(jobId);\n      if (current && isTerminalState(current.state)) return current;\n\n      /**\n       * The no-runner signal, when this deployment has one.\n       *\n       * With no instrument there is no sustained-absence signal and no\n       * `NoRunnerAvailableError` — the wait ends when the job reaches a\n       * terminal state or the timeout does. That is the honest behaviour on\n       * the cloud lane, where an unsatisfiable slot is refused at enqueue and\n       * a job with nowhere to run expires, both of which arrive through\n       * `read` as states rather than as guesses made here.\n       */\n      const availability = await this.#deps.availability?.(jobId);\n      if (\n        availability === undefined ||\n        availability.available ||\n        availability.blocked\n      ) {\n        // `blocked` means the job is waiting on a dependency, which is not the\n        // same event as \"nobody can run this\" ({@link MUSTS.NO_RUNNER_SIGNAL}).\n        noRunnerSince = null;\n      } else {\n        noRunnerSince ??= now();\n        if (now() - noRunnerSince >= graceMs) {\n          const reason = availability.reason ?? \"no-runner-online\";\n          const substitute = await options.onNoRunner?.(reason);\n          if (substitute !== undefined) {\n            return labelFallback(jobId, substitute);\n          }\n          throw new NoRunnerAvailableError(jobId, reason);\n        }\n      }\n\n      if (now() - started >= timeoutMs) {\n        throw new ResultTimeoutError(jobId, timeoutMs);\n      }\n      await sleep(POLL_INTERVAL_MS);\n    }\n  }\n}\n\nfunction isTerminalState(state: string): boolean {\n  return (\n    state === \"ok\" ||\n    state === \"error\" ||\n    state === \"canceled\" ||\n    state === \"expired\"\n  );\n}\n\n/**\n * Turn an app's fallback into a delivered result, marked as one.\n *\n * Exported because there are two delivery channels — polling here, Supabase\n * Realtime next door — and a label applied by one of them is a label an app\n * gets or does not get depending on which store it chose. That is exactly the\n * kind of divergence a \"delivery adapter must not change what a result means\"\n * rule exists to prevent.\n *\n * Two jobs, and the second is the one that matters. A string becomes the\n * obvious record — that is the sugar. Everything, string or record, gets\n * `fallback: true` — that is {@link MUSTS.FALLBACK_LABELED}, and it is\n * applied here rather than trusted from the caller because an app that\n * assembled its own record could otherwise return something indistinguishable\n * from a runner's answer. Spreading the caller's object first and the flag\n * second is deliberate: a supplied `fallback` cannot overwrite it.\n */\nexport function labelFallback(\n  jobId: string,\n  substitute: string | DeliveredResult,\n): DeliveredResult {\n  if (typeof substitute === \"string\") {\n    return {\n      jobId,\n      state: \"ok\",\n      outcome: { outcome: \"ok\", text: substitute },\n      fallback: true,\n    };\n  }\n  return { ...substitute, fallback: true };\n}\n"],"mappings":";AAGO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAEhD,YACW,OACA,QACT;AACA;AAAA,MACE,yCAAyC,KAAK,KAAK,MAAM;AAAA,IAE3D;AANS;AACA;AAAA,EAMX;AAAA,EAPW;AAAA,EACA;AAAA,EAHO,OAAO;AAU3B;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YACW,OACA,WACT;AACA,UAAM,OAAO,KAAK,0BAA0B,OAAO,SAAS,CAAC,IAAI;AAHxD;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAAA,EAHO,OAAO;AAO3B;AAmFA,IAAM,qBAAqB,IAAI;AAC/B,IAAM,mBAAmB;AAQzB,IAAM,qBAAqB;AAE3B,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAQ3C,IAAM,kBAAN,MAAgD;AAAA,EAC5C;AAAA,EAET,YAAY,MAA2B;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QACJ,OACA,UAAuB,CAAC,GACE;AAC1B,UAAM,YAAY,QAAQ,aAAa;AACvC,UAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,UAAM,MAAM,KAAK,MAAM,OAAO,KAAK;AACnC,UAAM,UAAU,KAAK,MAAM,WAAW;AACtC,UAAM,UAAU,IAAI;AACpB,QAAI,gBAA+B;AAEnC,eAAS;AACP,cAAQ,QAAQ,eAAe;AAE/B,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK;AAC3C,UAAI,WAAW,gBAAgB,QAAQ,KAAK,EAAG,QAAO;AAYtD,YAAM,eAAe,MAAM,KAAK,MAAM,eAAe,KAAK;AAC1D,UACE,iBAAiB,UACjB,aAAa,aACb,aAAa,SACb;AAGA,wBAAgB;AAAA,MAClB,OAAO;AACL,0BAAkB,IAAI;AACtB,YAAI,IAAI,IAAI,iBAAiB,SAAS;AACpC,gBAAM,SAAS,aAAa,UAAU;AACtC,gBAAM,aAAa,MAAM,QAAQ,aAAa,MAAM;AACpD,cAAI,eAAe,QAAW;AAC5B,mBAAO,cAAc,OAAO,UAAU;AAAA,UACxC;AACA,gBAAM,IAAI,uBAAuB,OAAO,MAAM;AAAA,QAChD;AAAA,MACF;AAEA,UAAI,IAAI,IAAI,WAAW,WAAW;AAChC,cAAM,IAAI,mBAAmB,OAAO,SAAS;AAAA,MAC/C;AACA,YAAM,MAAM,gBAAgB;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SACE,UAAU,QACV,UAAU,WACV,UAAU,cACV,UAAU;AAEd;AAmBO,SAAS,cACd,OACA,YACiB;AACjB,MAAI,OAAO,eAAe,UAAU;AAClC,WAAO;AAAA,MACL;AAAA,MACA,OAAO;AAAA,MACP,SAAS,EAAE,SAAS,MAAM,MAAM,WAAW;AAAA,MAC3C,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,UAAU,KAAK;AACzC;","names":[]}

package/dist/{delivery-36nIe-b3.d.ts → delivery-CaGbp0Tc.d.ts}

@@ -19,10 +19,22 @@ interface WaitOptions {
     readonly timeoutMs?: number;
     /**
      * Called instead of throwing when no runner can take the job. Return a
-     * substitute result (a hosted-model answer, say) and the wait resolves with
-     * it; return nothing and {@link NoRunnerAvailableError} is thrown.
+     * substitute and the wait resolves with it; return nothing and
+     * {@link NoRunnerAvailableError} is thrown.
+     *
+     * **A string is enough.** It is the app's own fallback answer — a hosted
+     * model's text, a cached reply — not wire data, and requiring a whole
+     * `DeliveredResult` for it was ceremony that invited invented shapes. The
+     * README's own example got it wrong, which is how this was found.
+     *
+     * **Whatever comes back is labelled `fallback: true` by the wait, not by
+     * the caller** — {@link MUSTS.FALLBACK_LABELED}. Work that did not come
+     * from the user's own compute must not be reportable as though it did, and
+     * that stays true whether an app returns a bare string or a full record it
+     * assembled itself. The stamp is applied after this function returns, so
+     * there is no shape an app can hand back that hides what it is.
      */
-    readonly onNoRunner?: (reason: string) => DeliveredResult | undefined | Promise<DeliveredResult | undefined>;
+    readonly onNoRunner?: (reason: string) => string | DeliveredResult | undefined | Promise<string | DeliveredResult | undefined>;
     /** Abort the wait. */
     readonly signal?: AbortSignal;
 }
@@ -40,8 +52,26 @@ interface ResultDelivery {
 interface PollingDeliveryDeps {
     /** Current state of the job, or null if unknown. */
     readonly read: (jobId: string) => Promise<DeliveredResult | null>;
-    /** Whether a runner could still take this job. */
-    readonly availability: (jobId: string) => Promise<{
+    /**
+     * Whether a runner could still take this job — **when there is anybody to
+     * ask.**
+     *
+     * Optional since alpha.66, and its absence is the answer rather than a
+     * missing dependency. On the cloud lane nothing writes runners into this
+     * site's store: devices pair with the relay, so the question has no local
+     * answer and `runnerAvailability` refuses to invent one.
+     *
+     * The refusal was correct and it landed in a loop that asked every 500ms.
+     * `job.result()` threw on its first poll for every cloud-lane site — a
+     * refusal aimed at outsiders that our own delivery tripped over.
+     *
+     * Not fixed by catching the throw here. That is a swallowed error in
+     * costume, and a catch wide enough to hold it would also eat a store that
+     * had genuinely gone away. The instrument is simply not handed over on a
+     * lane where it cannot see, and this loop does not ask a question nobody
+     * can answer.
+     */
+    readonly availability?: (jobId: string) => Promise<{
         available: boolean;
         reason?: string;
         blocked: boolean;

package/dist/{handlers-DgW0QNTf.d.ts → handlers-CTV3Jc6Q.d.ts}

@@ -1,5 +1,5 @@
 import { StoredKeys, Endpoint } from '@byollm/protocol';
-import { B as ByollmStore } from './store-Cj5b6A9j.js';
+import { B as ByollmStore } from './store-Cx2_bck1.js';
 
 /** Everything a mount needs to serve the protocol. */
 /**
@@ -70,6 +70,6 @@ declare class ByollmHandlers {
     handle(endpoint: Endpoint, body: unknown, auth: AuthContext): Promise<HandlerResult>;
 }
 /** The protocol version this build speaks. */
-declare const SERVED_PROTOCOL_VERSION: "0";
+declare const SERVED_PROTOCOL_VERSION: "1";
 
 export { ByollmHandlers as B, type HandlerConfig as H, SERVED_PROTOCOL_VERSION as S, type HandlerResult as a };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { StoredKeys, JobKind, DeliveredResult, Endpoint, Capability } from '@byollm/protocol';
-import { P as PollingDeliveryDeps, R as ResultDelivery, W as WaitOptions } from './delivery-36nIe-b3.js';
-export { N as NoRunnerAvailableError, a as PollingDelivery, b as ResultTimeoutError } from './delivery-36nIe-b3.js';
-import { B as ByollmStore, J as JobRecord, E as EnqueueInput, R as RunnerRecord, S as StoredJobInput, C as ClaimArgs, a as RenewArgs, b as RenewResult, A as AdoptArgs, c as CompleteArgs, d as CompleteResult, e as ReleaseArgs, P as PairingRecord, f as ApproveArgs, T as TouchArgs } from './store-Cj5b6A9j.js';
-export { g as CompleteHolder, h as JobStore, i as RunnerStore } from './store-Cj5b6A9j.js';
-import { H as HandlerConfig } from './handlers-DgW0QNTf.js';
-export { B as ByollmHandlers, a as HandlerResult, S as SERVED_PROTOCOL_VERSION } from './handlers-DgW0QNTf.js';
+import { StoredKeys, JobKind, Audience, DeliveredResult, Endpoint, Capability } from '@byollm/protocol';
+import { P as PollingDeliveryDeps, R as ResultDelivery, W as WaitOptions } from './delivery-CaGbp0Tc.js';
+export { N as NoRunnerAvailableError, a as PollingDelivery, b as ResultTimeoutError } from './delivery-CaGbp0Tc.js';
+import { B as ByollmStore, J as JobRecord, E as EnqueueInput, R as RunnerRecord, S as StoredJobInput, C as ClaimArgs, a as RenewArgs, b as RenewResult, A as AdoptArgs, c as CompleteArgs, d as CompleteResult, e as ReleaseArgs, P as PairingRecord, f as ApproveArgs, T as TouchArgs } from './store-Cx2_bck1.js';
+export { g as CompleteHolder, h as JobStore, i as RunnerStore } from './store-Cx2_bck1.js';
+import { H as HandlerConfig } from './handlers-CTV3Jc6Q.js';
+export { B as ByollmHandlers, a as HandlerResult, S as SERVED_PROTOCOL_VERSION } from './handlers-CTV3Jc6Q.js';
 
 /**
  * The cloud lane — cloud_004 §9.4.
@@ -49,6 +49,44 @@ interface CloudLaneOptions {
     readonly fetch?: typeof fetch;
 }
 /** What one pump cycle did, for logging and for tests. */
+/**
+ * A relay that could not answer this request — alpha.31.
+ *
+ * `retryable` is the whole point: a draining pod and a bad signature are both
+ * failures, and treating them alike is how a site either falls over on every
+ * deploy or stays silently disconnected for a week.
+ */
+declare class RelayUnavailable extends Error {
+    readonly retryable: boolean;
+    /** The protocol's own code, when the relay sent one. */
+    readonly code: string;
+    constructor(message: string, retryable: boolean, code: string);
+}
+/**
+ * The job was not queued, and waiting will not change that.
+ *
+ * Distinct from {@link RelayUnavailable} because it is the opposite situation:
+ * the relay answered, promptly and correctly, and the answer is that this job
+ * has nowhere to go. Catching "the relay is down" to handle "nobody has chosen
+ * a model" would retry forever against a fact.
+ *
+ * Two codes, and they belong to two different people.
+ *
+ * `purpose-not-declared` is the site's own manifest. It names the purpose and
+ * the remedy, because a developer reading their own logs is entitled to both
+ * and neither says anything about a person.
+ *
+ * `slot-unsatisfiable` is the person's own dashboard, and says only that.
+ * Which service, whose device, whether one exists at all — none of it travels,
+ * and the sentence is the same for everybody. A site learns *that* a slot
+ * cannot be satisfied, which is exactly what the README has always promised
+ * and what this class finally delivers.
+ */
+declare class EnqueueRefused extends Error {
+    /** `purpose-not-declared` or `slot-unsatisfiable`. */
+    readonly code: string;
+    constructor(message: string, code: string);
+}
 interface PumpReport {
     /** Jobs sealed to a claiming device this cycle. */
     readonly sealed: string[];
@@ -62,6 +100,20 @@ interface PumpReport {
      * exactly the case `awaiting-payload` exists to bound.
      */
     readonly refused: string[];
+    /**
+     * Why this cycle stopped early, when it did — alpha.31.
+     *
+     * A relay can legitimately say "ask me later": a pod draining through its
+     * `preStop` window answers `503 not-ready` to every routed call, and that
+     * happens on **every deploy**. Before this existed the lane read the body
+     * of that answer, found no `jobs` in it, and threw `TypeError: finished.jobs
+     * is not iterable` — a site falling over because its relay was polite.
+     *
+     * Absent on an ordinary cycle. Present, with the reason, when the lane
+     * deferred: a site that quietly did nothing and a site that was told to wait
+     * must not look the same in a log.
+     */
+    readonly deferred?: string;
 }
 declare class CloudLane {
     #private;
@@ -79,6 +131,19 @@ declare class CloudLane {
      * field on `JobStub` to put one in.
      */
     publish(record: JobRecord): Promise<void>;
+    /**
+     * Withdraw a job at the relay — cloud_008 §2.2.
+     *
+     * `app.cancel()` marks the site's own row terminal, which stops the *next*
+     * seal. It cannot stop a device that is already running the work, because
+     * on this lane the site is not the upstream: only the relay talks to the
+     * daemon, and it answered `cancel: []` unconditionally.
+     *
+     * So the cancellation has to travel. The relay marks the job, stops
+     * offering it, and names it to the holding device at its next heartbeat —
+     * the same path the direct plane has always had, arriving one hop later.
+     */
+    cancel(jobId: string): Promise<void>;
     /**
      * One cycle: seal for anything claimed, collect anything finished.
      *
@@ -91,7 +156,18 @@ declare class CloudLane {
 }
 
 /** Why a job cannot presently run. */
-type NoRunnerReason = "no-runner-paired" | "no-runner-online" | "no-matching-capability" | "audience-admits-nobody";
+type NoRunnerReason = "no-runner-paired" | "no-runner-online" | "no-matching-capability" | "audience-admits-nobody"
+/**
+ * The owner's default for this kind can never serve *this* requester —
+ * byollm_016's defaults-meet-audiences corner.
+ *
+ * The specimen: a default of `claude-cli`, self-locked by
+ * `SUBSCRIPTION_SELF_LOCK`, and a team member's unselected job. It resolves
+ * to something that will never run it. Reported rather than left to time
+ * out, because a wait that can never end is indistinguishable from one that
+ * has not ended yet, and only one of them is worth waiting through.
+ */
+ | "default-unusable";
 /**
  * The no-runner signal (byollm_001 Rev 1 §D).
  *
@@ -110,7 +186,7 @@ interface RunnerAvailability {
 interface AvailabilityQuery {
     readonly kind: JobKind;
     readonly owner: string;
-    readonly audience?: "self" | "named" | "public";
+    readonly audience?: Audience;
     readonly audienceAllow?: readonly string[];
 }
 interface ByollmAppOptions {
@@ -163,14 +239,6 @@ interface JobHandle {
     /** Ask the runner to stop. */
     cancel(): Promise<void>;
 }
-/**
- * The app-facing half of `@byollm/server`.
- *
- * The daemon talks to {@link ByollmHandlers}; the app talks to this. Keeping
- * them separate is what makes "one door per state write" hold — an app
- * enqueues and cancels through these methods and never writes job rows by
- * hand.
- */
 declare class ByollmApp {
     #private;
     /** Present only in the cloud lane; the site's side of the relay. */
@@ -183,7 +251,7 @@ declare class ByollmApp {
      * result comes back marked untrusted (see {@link ByollmApp.result}), and
      * the app is obliged to disclose that to whoever reads it.
      */
-    enqueue(input: EnqueueInput): Promise<JobHandle>;
+    enqueue<K extends JobKind>(input: EnqueueInput<K>): Promise<JobHandle>;
     /** Read a job's current state. */
     job(jobId: string): Promise<JobRecord | null>;
     /**
@@ -192,7 +260,7 @@ declare class ByollmApp {
      * Check `provenance.untrusted` before rendering. It is true for every
      * `named`/`public` job, because that text came from someone else's machine
      * and the app must not present it as its own AI's answer
-     * ({@link MUSTS.RESULT_PROVENANCE}).
+     * ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
      */
     result(jobId: string): Promise<DeliveredResult | null>;
     /** Ask a runner to stop. Queued jobs cancel at once; held jobs at the next heartbeat. */
@@ -315,8 +383,6 @@ declare function formatSiteKeys(keys: StoredKeys): string;
 
 /** A device code: the secret the daemon polls with. Never shown to a user. */
 declare function generateDeviceCode(): string;
-/** A runner bearer token. */
-declare function generateRunnerToken(): string;
 /** A runner id. */
 declare function generateRunnerId(): string;
 /** A job id. */
@@ -366,14 +432,16 @@ declare class MemoryStore implements ByollmStore {
     expireDue(now: number): Promise<JobRecord[]>;
     cancel(jobId: string, now: number): Promise<JobRecord | null>;
     listClaimedBy(runnerId: string): Promise<JobRecord[]>;
-    listCancelRequests(runnerId: string): Promise<string[]>;
+    listCancelRequests(runnerId: string): Promise<{
+        jobId: string;
+        leaseId: string;
+    }[]>;
     createPairing(record: PairingRecord): Promise<void>;
     getPairingByDeviceCodeHash(hash: string): Promise<PairingRecord | null>;
     getPairingByUserCode(userCode: string): Promise<PairingRecord | null>;
     approvePairing(args: ApproveArgs): Promise<RunnerRecord>;
     denyPairing(userCode: string, _now: number): Promise<void>;
     consumePairingToken(deviceCodeHash: string): Promise<void>;
-    getRunnerByTokenHash(hash: string): Promise<RunnerRecord | null>;
     getRunner(runnerId: string): Promise<RunnerRecord | null>;
     touchRunner(args: TouchArgs): Promise<RunnerRecord | null>;
     revokeRunner(runnerId: string, now: number): Promise<void>;
@@ -384,4 +452,4 @@ declare class MemoryStore implements ByollmStore {
 /** The capability that would serve a kind, if any. */
 declare function capabilityFor(capabilities: readonly Capability[], kind: string): Capability | undefined;
 
-export { AdoptArgs, ApproveArgs, type AvailabilityQuery, ByollmApp, type ByollmAppOptions, ByollmStore, ClaimArgs, CloudLane, type CloudLaneOptions, CompleteArgs, CompleteResult, EnqueueInput, HandlerConfig, type JobHandle, JobRecord, MemoryStore, type MemoryStoreOptions, type NoRunnerReason, PairingRecord, PollingDeliveryDeps, type PumpReport, ReleaseArgs, RenewArgs, RenewResult, ResultDelivery, type RunnerAvailability, RunnerRecord, TouchArgs, WaitOptions, capabilityFor, createFetchHandler, formatSiteKeys, generateDeviceCode, generateJobId, generateRunnerId, generateRunnerToken, generateSiteKeys, generateUserCode, hashSecret, normalizeUserCode, routeEndpoint, secretsMatch, signatureFrom, siteKeysFromEnv };
+export { AdoptArgs, ApproveArgs, type AvailabilityQuery, ByollmApp, type ByollmAppOptions, ByollmStore, ClaimArgs, CloudLane, type CloudLaneOptions, CompleteArgs, CompleteResult, EnqueueInput, EnqueueRefused, HandlerConfig, type JobHandle, JobRecord, MemoryStore, type MemoryStoreOptions, type NoRunnerReason, PairingRecord, PollingDeliveryDeps, type PumpReport, RelayUnavailable, ReleaseArgs, RenewArgs, RenewResult, ResultDelivery, type RunnerAvailability, RunnerRecord, TouchArgs, WaitOptions, capabilityFor, createFetchHandler, formatSiteKeys, generateDeviceCode, generateJobId, generateRunnerId, generateSiteKeys, generateUserCode, hashSecret, normalizeUserCode, routeEndpoint, secretsMatch, signatureFrom, siteKeysFromEnv };