@byollm/server 0.1.0-alpha.9 → 0.1.0-alpha.91

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.9`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.91`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npm install @byollm/server@alpha`.
 >
@@ -11,7 +11,67 @@
 > npm assigns `latest` on a first publish and won't let it be removed, so a
 > bare install resolves here too. This notice is the only guard — deliberately
 > not an npm deprecation, which would read as *abandoned* rather than *early*.
-> Ask for `@alpha` explicitly so your lockfile records that you meant to.
+> Ask for `@alpha` explicitly so your lockfile records that you meant to.>
+> **`alpha.15` is a breaking wire change, and it breaks daemons and relays —
+> not app authors.** If you call `app.enqueue(...)` and read results, nothing
+> in your code changes. If you run a daemon or an upstream, every package must
+> move together: a mixed pair refuses on both sides, because both ends parse
+> `.strict()`.
+>
+> What moved, all of it reconciling the frozen `byollm_009` with its code:
+> `JobStub` gains `site` (the site's identity key id) and loses
+> `audienceAllow`; `ResultRequest` gains `leaseId`; `HeartbeatResponse` loses
+> `leases`, which nothing read; `WireErrorCode` gains `not-ready`,
+> `clock-skew` and `forbidden`, and `403` is `forbidden` rather than
+> `unauthorized`. `RESULT_PROVENANCE` is superseded by
+> `PROVENANCE_NAMES_DEVICE`. See `byollm_009` Amendment A.>
+> **`alpha.16` is a breaking wire change — daemons and relays again, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together: both ends parse `.strict()`, so a mixed pair
+> refuses.
+>
+> What moved, all of it Tier 2 of `cloud_008`: `model`, `backendClass` and
+> `durationMs` come off `ResultRequest` and are sealed **inside** the result
+> envelope as `SealedOutcome = { outcome, ran }` — so a daemon can no longer
+> declare a model it did not sign, and a relay carries neither.
+> `HeartbeatResponse` loses `leases` (nothing read it) and now reports real
+> cancellations instead of an empty list. `WireErrorCode` gains `forbidden`
+> for 403, leaving `unauthorized` at exactly 401. The relay gained a
+> site-plane `cancel` endpoint, honours `stub.deadlineAt`, honours
+> `stub.audience`, and remembers a refusal.>
+> **`alpha.17` is additive** — no wire change. It exports `ReleaseReason`,
+> which `RoutingStore.releaseLeases` names and the package did not export, so
+> the interface was unimplementable outside this repo.>
+> **`alpha.18` is a breaking wire change — daemons and relays, not app
+> authors.** `app.enqueue(...)` and reading results are unchanged. All five
+> packages move together.
+>
+> The **bearer token is gone**: off `PairPollResponse`, off the runner row,
+> off the daemon's pairings file, out of the adapter's schema. It was minted,
+> hashed and stored on two disks and never sent, looked up or compared —
+> `REQUESTS_SIGNED_NOT_BEARER` was enforced by signatures the whole time. If
+> you run the Supabase adapter, apply
+> `20260819000000_drop_runner_token.sql`; `byollm_approve_pairing` now takes
+> one argument. A pairings file written by an older daemon still loads.
+>
+> `model`, `backendClass` and `durationMs` moved **inside** the sealed result
+> (`SealedOutcome = { outcome, ran }`), so a daemon cannot declare a model it
+> did not sign and a relay carries none of them. Writing a `RoutingStore`?
+> `releaseLeases` takes an optional `reason` and `complete` requires
+> `leaseId`, and **an implementation that ignores either still typechecks** —
+> run the store contract tests.>
+> **`alpha.19` is additive on the wire and a behaviour change in every
+> store.** `ResultResponse` gains an optional `duplicate`. Nothing is removed,
+> so an older daemon keeps working — but the *order* two rules are checked in
+> has changed, and a `RoutingStore` implementation must change with it.
+>
+> `complete` now checks **terminal state before holder**, scoped to the device
+> that finished the job: a replay from that device is answered `duplicate:
+> true` with a 2xx, and anyone else gets exactly the refusal they would get
+> for a job that is not terminal. Previously `RESULT_IDEMPOTENT` held only
+> because the lease is nulled on success, so the holder check tripped first —
+> deleting the idempotency branch failed no test. Run the store contract
+> tests; the compiler cannot see this.
 >
 > **`alpha.7` breaks nobody who is not implementing a relay.** `@byollm/relay`'s
 > projection gains `devices` — the device keys a control plane has approved —
@@ -39,6 +99,48 @@
 > Your store adapter is unaffected: payloads and results are sealed before they
 > reach it, and `JobStore` did not change.
 
+<!-- release-note 0.1.0-alpha.21 -->
+> [!NOTE]
+> **`0.1.0-alpha.20` is not a complete release — do not pin it.** Four
+> packages published and `@byollm/server` did not: a Sigstore
+> transparency-log 409 on its provenance attestation. The workflow's
+> "already published" guard correctly refuses to resume a partial publish,
+> so `0.1.0-alpha.21` is that release, whole.
+>
+> If you run the Supabase adapter, `alpha.21` needs
+> `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
+> ordering without the column it stores the grant in.
+
+<!-- release-note 0.1.0-alpha.40 -->
+**`byollm start` — stop keeping a terminal open.** The daemon can now run
+under your computer's own supervisor and restart itself if it stops: a launchd
+agent on macOS, a `systemd --user` unit on Linux, a logon task on Windows. All
+user-level — no root, no system directories, and `byollm stop` takes it
+away. `byollm status` gained a line saying whether it is actually supervised
+right now, including the state that matters most: installed but not running,
+which looks fine from an app's dashboard and serves nothing.
+
+If you are running via `npx`, install properly first (`npm install -g
+byollm@latest`) — `install` refuses to supervise a copy in npx's cache, because
+npm deletes that directory and the service would fail at some later boot.
+
+<!-- release-note 0.1.0-alpha.41 -->
+**`onNoRunner` takes a string.** Your fallback answer is your own value, not
+wire data, and handing back a whole result record for it was ceremony — the
+README's own example got the shape wrong, which is how this was found.
+
+```ts
+const { outcome, fallback } = await job.result({
+  onNoRunner: () => runOnHostedModel(transcript),
+});
+```
+
+Whatever you return, `result()` labels it `fallback: true` — the stamp is
+applied by the wait, not taken from you, so an answer that did not run on
+somebody's device cannot be reported as though it did (`FALLBACK_LABELED`).
+Both delivery channels do it, polling and Supabase Realtime. Records still
+work; they just get labelled too.
+
 # `@byollm/server`
 
 What app developers drop into their backend: framework-agnostic protocol
@@ -109,7 +211,7 @@ npx @byollm/server@alpha keygen   # prints BYOLLM_SITE_KEYS=...
 ```
 
 Once, not per deploy and never at startup — a daemon pins this identity when
-its owner approves the pairing, and regenerating it means every paired machine
+its owner approves the pairing, and regenerating it means every paired device
 must pair again. Generating at startup fails only under horizontal scale: each
 instance would have a different identity, and a daemon would be refused by
 whichever one it did not pair with.
@@ -119,21 +221,76 @@ whichever one it did not pair with.
 ```ts
 const job = await getApp().enqueue({
   kind: "llm.generate",
-  audience: "self", // this user's own machine only — the default
-  owner: userId,
+  audience: "private", // this user's own device only — the default
+  owner: ownerId, // who this is depends on your mode — see below
   payload: { prompt: `Summarize this transcript:\n\n${transcript}` },
 });
 
-const { outcome } = await job.result({
+const { outcome, fallback } = await job.result({
   timeoutMs: 120_000,
+  // A string is enough — it is your own fallback answer, not wire data.
   onNoRunner: () => runOnHostedModel(transcript),
 });
+
+// `fallback` is true when nobody's device ran it and this came from your
+// own substitute. Say so wherever you show the answer: work that did not run
+// on the user's compute must not be presented as though it did.
 ```
 
 `result()` is sugar over your delivery channel with a timeout and a
 `noRunnerAvailable` path — never a bare promise that hangs forever. If nobody
 is online to run the job, you find out and can fall back.
 
+## Who `owner` is — this differs by mode
+
+`owner` names the person whose devices should do the work, and the two
+connection modes do not use the same names for people. Getting this wrong is
+the one integration mistake that produces no error: the job enqueues, returns
+an id, and never routes.
+
+**Direct** — daemons reach your own handlers, and you are the only party who
+knows who anybody is. `owner` is your own user id, from your session, never
+from the client. That is what the example above shows.
+
+**Cloud** — daemons reach `hub.byollm.cloud`, which has its own identity
+space: rosters, consents and budgets all speak **BYOLLM ids**. Your user id
+means nothing there. `owner` must be the person's BYOLLM id.
+
+Ask them for it. Every signed-in person can read it on their byollm.cloud
+account page under **Your BYOLLM id**, with a copy button. Add a settings
+field, have them paste it, store it against your own user record.
+
+The id names them and authorises nothing — someone holding it can address work
+to a person and cannot deliver it, because the consent row is what opens the
+route. So a pasted id is not a credential you are being trusted with, and a
+wrong one is harmless. Two things still matter: it must come from the person's
+own account rather than being inferred by your app, and they must connect your
+site on byollm.cloud before anything routes.
+
+**A wrong id is silence, not an error.** The relay routes on a consented
+`(site, owner)` pair, so a mistyped id — or one belonging to somebody who has
+not connected your site — matches no route. The job waits, then expires. So
+check ids when you receive them rather than when you enqueue:
+
+```ts
+const { available } = await getApp().runnerAvailability({
+  kind: "llm.generate",
+  owner: pastedByollmId,
+});
+
+if (!available) {
+  // Existence-neutral, deliberately.
+  return "That id has no devices for you. Check it, or connect this site on byollm.cloud.";
+}
+```
+
+Keep that message vague on purpose. A typo'd id and an id belonging to somebody
+who has not connected you give the same answer, and that is the system working
+rather than a limitation to route around — telling them apart would make this
+call an account-existence oracle: probe a guess, sort the answers, enumerate.
+Never write "no such account". If you ever get an answer that *does*
+distinguish them, that is a bug worth reporting.
+
 ## The approval page
 
 Pairing is a device-code exchange, so you need one page where a signed-in user
@@ -147,7 +304,7 @@ const runner = await getApp().approvePairing({
 });
 ```
 
-`app.pendingPairing(code)` tells you what they are about to approve — machine
+`app.pendingPairing(code)` tells you what they are about to approve — device
 label, platform, and which models it is offering — so the page can show it.
 
 ## Stores
@@ -185,7 +342,7 @@ everything the browser does.
 ## Two things the API makes you confront
 
 **Community results are untrusted.** A `named`/`public` result came from
-someone else's machine and can be anything. Every result carries provenance,
+someone else's device and can be anything. Every result carries provenance,
 and `untrusted` is derived from the audience — you cannot mark volunteer
 output as first-party:
 
@@ -200,7 +357,7 @@ if (provenance?.untrusted) {
 **Jobs can depend on each other.** `dependsOn: [jobId]` keeps a job
 unclaimable until its dependencies are `ok`. One field and one claim
 predicate, not a DAG engine — so the two halves of a piece of work can land on
-two different people's machines, in order, without your app orchestrating the
+two different people's devices, in order, without your app orchestrating the
 wait.
 
 ## Certifying an adapter
@@ -213,3 +370,17 @@ A server is byollm-compatible when the kit passes. See
 [`@byollm/conformance`](../conformance).
 
 MIT
+
+<!-- family:start -->
+
+## The rest of byollm
+
+Six packages, and they are only interesting together:
+
+- [`byollm`](https://www.npmjs.com/package/byollm) — the daemon — runs models on your own machine and answers for it
+- [`@byollm/protocol`](https://www.npmjs.com/package/@byollm/protocol) — the wire: envelopes, signatures and the closed vocabularies both ends validate against
+- [`@byollm/relay`](https://www.npmjs.com/package/@byollm/relay) — the broker that holds jobs between a site and a device, and can read neither
+- [`@byollm/control-plane`](https://www.npmjs.com/package/@byollm/control-plane) — who may ask whom, and the policy store behind it
+- [`@byollm/conformance`](https://www.npmjs.com/package/@byollm/conformance) — the kit that proves an implementation is one — including a posture audit that holds nothing but a URL
+
+<!-- family:end -->

package/dist/{chunk-4NIHWQAT.js → chunk-36Y77FUD.js}

@@ -9,9 +9,6 @@ var USER_CODE_ALPHABET = "ABCDEFGHJKMNPQRTWXYZ2346789";
 function generateDeviceCode() {
   return randomBytes(32).toString("base64url");
 }
-function generateRunnerToken() {
-  return randomBytes(32).toString("base64url");
-}
 function generateRunnerId() {
   return `runner_${randomUUID()}`;
 }
@@ -41,10 +38,31 @@ function secretsMatch(aHex, bHex) {
 }
 var generateLeaseId = () => randomUUID();
 
+// src/sealed-outcome.ts
+import { SealedOutcome } from "@byollm/protocol";
+function openSealedOutcome(input) {
+  let parsed;
+  try {
+    parsed = JSON.parse(input.plaintext);
+  } catch {
+    return { ok: false, why: "the sealed result was not valid JSON" };
+  }
+  const sealed = SealedOutcome.safeParse(parsed);
+  if (!sealed.success) {
+    return { ok: false, why: "the sealed result was not an outcome" };
+  }
+  if (sealed.data.outcome.outcome !== input.disposition) {
+    return {
+      ok: false,
+      why: "the declared disposition is not the one that was sealed"
+    };
+  }
+  return { ok: true, value: sealed.data };
+}
+
 // src/handlers.ts
 import {
   FetchRequest,
-  JobOutcome,
   keyId as keyId2,
   open as open2,
   publicIdentityOf as publicIdentityOf2,
@@ -102,6 +120,11 @@ async function resealForDevice(input) {
   return { ok: true, envelope };
 }
 
+// src/records.ts
+function deadlineFor(job, now) {
+  return job.deadlineAt ?? (job.claimableAt ?? now) + job.ttlMs;
+}
+
 // src/handlers.ts
 var DEFAULTS = {
   leaseMs: 6e4,
@@ -130,6 +153,8 @@ var ByollmHandlers = class {
   #pollIntervalMs;
   #now;
   #siteKeys;
+  /** This site's identity key id — Amendment A's `stub.site`. Derived once. */
+  #siteKeyId;
   constructor(config) {
     this.#store = config.store;
     if (!verifyPublicIdentity(publicIdentityOf2(config.siteKeys))) {
@@ -138,6 +163,7 @@ var ByollmHandlers = class {
       );
     }
     this.#siteKeys = config.siteKeys;
+    this.#siteKeyId = keyId2(publicIdentityOf2(config.siteKeys).identity);
     this.#verificationUrl = config.verificationUrl;
     this.#leaseMs = config.leaseMs ?? DEFAULTS.leaseMs;
     this.#pairingTtlMs = config.pairingTtlMs ?? DEFAULTS.pairingTtlMs;
@@ -162,8 +188,7 @@ var ByollmHandlers = class {
           auth,
           body,
           HeartbeatRequest,
-          this.#heartbeat.bind(this),
-          { allowRevoked: true }
+          this.#heartbeat.bind(this)
         );
       case "fetch":
         return this.#authed(auth, body, FetchRequest, this.#fetch.bind(this));
@@ -264,7 +289,7 @@ var ByollmHandlers = class {
         state: "pending",
         owner: null,
         runnerId: null,
-        runnerTokenOnce: null,
+        collected: false,
         label: request.daemon.label,
         platform: request.daemon.platform,
         daemonVersion: request.daemon.version,
@@ -293,15 +318,19 @@ var ByollmHandlers = class {
     if (pairing.expiresAt <= now && pairing.state === "pending") {
       return ok({ status: "expired" });
     }
-    if (pairing.state === "approved" && pairing.runnerTokenOnce !== null && pairing.runnerId !== null && pairing.owner !== null) {
+    if (pairing.state === "approved" && !pairing.collected && pairing.runnerId !== null && pairing.owner !== null) {
       const response = {
         status: "approved",
-        runnerToken: pairing.runnerTokenOnce,
         runnerId: pairing.runnerId,
         owner: pairing.owner,
         // Only on approval: a pending or denied poll learns nothing, so an
         // unapproved code cannot be used to enumerate a site's keys.
-        site: publicIdentityOf2(this.#siteKeys)
+        //
+        // One entry, because a direct site *is* one site — the same shape a
+        // hub answers with rather than a special case (cloud_009 §5). The
+        // daemon's lookup is one map read on every lane, which is what keeps
+        // the two lanes one protocol.
+        sites: { [this.#siteKeyId]: publicIdentityOf2(this.#siteKeys) }
       };
       await this.#store.consumePairingToken(pairing.deviceCodeHash);
       return ok(response);
@@ -331,6 +360,17 @@ var ByollmHandlers = class {
         kind: job.kind,
         audience: job.audience,
         owner: job.owner,
+        // This site, named by its identity key id — Amendment A §A.3. The
+        // daemon pinned this exact value at pairing, so it can check the stub
+        // against the envelope it later opens rather than taking our word for
+        // which site sent it. On this plane that is redundant, which is the
+        // point: the direct and relayed stubs are the same shape, and a daemon
+        // serving both cannot tell which upstream it is talking to.
+        site: this.#siteKeyId,
+        // byollm_016 Phase B. Present only when the site named one, and
+        // omitted rather than sent as undefined — the stub is `.strict()` and
+        // an explicit undefined is not the same as an absent key.
+        ...job.purpose === void 0 ? {} : { purpose: job.purpose },
         // Bucketed, not measured: an exact size is a stronger fingerprint
         // than routing needs (byollm_009 §6).
         sizeClass: job.sizeClass,
@@ -339,8 +379,19 @@ var ByollmHandlers = class {
         // The stub's deadline bounds how long a captured envelope is worth
         // keeping, so it is always present — falling back to the TTL window
         // when the app named no absolute one.
-        deadlineAt: job.deadlineAt ?? (job.claimableAt ?? now) + job.ttlMs,
-        ...job.audienceAllow === void 0 ? {} : { audienceAllow: [...job.audienceAllow] },
+        deadlineAt: deadlineFor(job, now),
+        // `audienceAllow` is not sent — cloud_008 §0.2. The list stays on
+        // `JobRecord`, where `claim` already filtered candidates with it; the
+        // daemon's own allowlist is what decides `named` (byollm_001 Rev 1
+        // §B) and always was.
+        //
+        // Removing it from `JobStub` did **not** make this line a type error.
+        // A conditional spread is not excess-property-checked, so the field
+        // would have gone on being sent to a daemon whose `.strict()` parse
+        // now rejects the entire claim response — every daemon on the version
+        // pair, refusing all work, for a field nobody read. Worth stating
+        // where it happened: the schema is the contract, and the compiler
+        // does not enforce it through a spread.
         // No fallback. A job returned from `claim` holds a lease by
         // definition, and synthesising one here would hand the daemon a lease
         // id the store has never heard of — every later release naming it
@@ -358,18 +409,6 @@ var ByollmHandlers = class {
       return fail("unauthorized", "runner id does not match the signing key");
     }
     const now = this.#now();
-    const revoked = runner.revokedAt !== null;
-    if (revoked) {
-      const held = await this.#store.listClaimedBy(runner.id);
-      const response2 = {
-        revoked: true,
-        cancel: [],
-        leases: [],
-        lost: held.map((job) => job.id),
-        serverTime: now
-      };
-      return ok(response2);
-    }
     await this.#store.touchRunner({
       runnerId: runner.id,
       capabilities: request.capabilities,
@@ -377,7 +416,7 @@ var ByollmHandlers = class {
       paused: request.paused,
       now
     });
-    const { renewed, lost } = await this.#store.renewLeases({
+    const { lost } = await this.#store.renewLeases({
       runnerId: runner.id,
       leases: request.activeLeases,
       leaseMs: this.#leaseMs,
@@ -385,9 +424,11 @@ var ByollmHandlers = class {
     });
     const cancel = await this.#store.listCancelRequests(runner.id);
     const response = {
-      revoked: false,
-      cancel,
-      leases: renewed.map((r) => ({ jobId: r.jobId, expiresAt: r.expiresAt })),
+      sites: { [this.#siteKeyId]: publicIdentityOf2(this.#siteKeys) },
+      // A direct site has no disclosure of its own to go stale: consent to it
+      // *is* the pairing, and withdrawing it empties the set above.
+      awaitingConsent: [],
+      cancel: [...cancel],
       lost: [...lost],
       serverTime: now
     };
@@ -407,18 +448,35 @@ var ByollmHandlers = class {
       audience: job.audience,
       runnerId: runner.id,
       runnerOwner: runner.owner,
-      backendClass: request.backendClass,
-      model: request.model
+      // From the envelope the device signed, not from the request beside it
+      // — cloud_008 §2.5. A daemon can no longer seal one answer and declare
+      // it came from a different model.
+      backendClass: outcome.value.ran.backendClass,
+      model: outcome.value.ran.model
     });
-    const { accepted, job: updated } = await this.#store.complete({
+    const {
+      accepted,
+      duplicate,
+      job: updated
+    } = await this.#store.complete({
       jobId: request.jobId,
-      holder: { by: "runner", runnerId: runner.id },
-      outcome: outcome.value,
+      // Who is asking, for the duplicate answer only — §3.6. Authorisation
+      // is `holder`, below, and still is.
+      runnerId: runner.id,
+      // The grant, not the runner — cloud_008 §1.4a. `CompleteHolder`'s own
+      // docstring already called the lease "the more exact check anyway";
+      // this plane simply had no lease id to give it until now.
+      holder: { by: "lease", leaseId: request.leaseId },
+      outcome: outcome.value.outcome,
       provenance,
       now
     });
     const response = {
       accepted,
+      // Only when true — cloud_008 §3.6. Absent means "not a duplicate", and
+      // an optional field that is always present is a required one wearing a
+      // question mark.
+      ...duplicate === true ? { duplicate: true } : {},
       state: updated?.state ?? job.state
     };
     return ok(response);
@@ -453,18 +511,12 @@ var ByollmHandlers = class {
     if (!opened.ok) {
       return refuse("the result did not verify as coming from this device");
     }
-    let parsed;
-    try {
-      parsed = JSON.parse(opened.plaintext);
-    } catch {
-      return refuse("the sealed result was not valid JSON");
-    }
-    const outcome = JobOutcome.safeParse(parsed);
-    if (!outcome.success) return refuse("the sealed result was not an outcome");
-    if (outcome.data.outcome !== request.disposition) {
-      return refuse("the declared disposition is not the one that was sealed");
-    }
-    return { ok: true, value: outcome.data };
+    const outcome = openSealedOutcome({
+      plaintext: opened.plaintext,
+      disposition: request.disposition
+    });
+    if (!outcome.ok) return refuse(outcome.why);
+    return { ok: true, value: outcome.value };
   }
   // -- 5. release -----------------------------------------------------------
   async #release(request, runner) {
@@ -495,10 +547,13 @@ function leaseOf(job) {
 import {
   ENDPOINTS,
   ERROR_STATUS as ERROR_STATUS2,
+  MAX_ENVELOPE_BYTES,
+  tooLargeMessage,
   PROTOCOL_PREFIX,
   checkProtocolVersion
 } from "@byollm/protocol";
-var MAX_BODY_BYTES = 8 * 1024 * 1024;
+var MAX_BODY_BYTES = MAX_ENVELOPE_BYTES + 512 * 1024;
+var tooLarge = (bytes) => tooLargeMessage({ bytes, limit: MAX_BODY_BYTES });
 function normalizeBasePath(basePath) {
   const trimmed = basePath.endsWith("/") ? basePath.slice(0, -1) : basePath;
   if (!trimmed.startsWith("/")) {
@@ -548,7 +603,7 @@ function createFetchHandler(config) {
     if (declared !== null && Number(declared) > MAX_BODY_BYTES) {
       return json(400, {
         error: "bad-request",
-        message: "request body too large"
+        message: tooLarge(Number(declared))
       });
     }
     let body;
@@ -559,7 +614,7 @@ function createFetchHandler(config) {
       if (text.length > MAX_BODY_BYTES) {
         return json(400, {
           error: "bad-request",
-          message: "request body too large"
+          message: tooLarge(text.length)
         });
       }
       body = JSON.parse(text);
@@ -605,13 +660,14 @@ function json(status, body) {
 
 export {
   generateDeviceCode,
-  generateRunnerToken,
   generateRunnerId,
   generateJobId,
   generateUserCode,
   hashSecret,
   secretsMatch,
   generateLeaseId,
+  openSealedOutcome,
+  deadlineFor,
   resealForDevice,
   ByollmHandlers,
   SERVED_PROTOCOL_VERSION,
@@ -619,4 +675,4 @@ export {
   signatureFrom,
   createFetchHandler
 };
-//# sourceMappingURL=chunk-4NIHWQAT.js.map
+//# sourceMappingURL=chunk-36Y77FUD.js.map