@byollm/server 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/chunk-36Y77FUD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/ids.ts","../src/sealed-outcome.ts","../src/handlers.ts","../src/reseal.ts","../src/records.ts","../src/http.ts"],"sourcesContent":["import {\n  createHash,\n  randomBytes,\n  randomUUID,\n  timingSafeEqual,\n} from \"node:crypto\";\n\n/**\n * Alphabet for the user-facing pairing code.\n *\n * Excludes `0/O`, `1/I/L`, `5/S` and `U/V` — a code is read aloud or copied\n * off a terminal into a browser, and a user who mistypes it gets a failure\n * they cannot diagnose. 27 symbols over 8 characters is ~38 bits, which is\n * ample for a code that lives ten minutes, is single-use, and is rate-limited.\n */\nconst USER_CODE_ALPHABET = \"ABCDEFGHJKMNPQRTWXYZ2346789\";\n\n/** A device code: the secret the daemon polls with. Never shown to a user. */\nexport function generateDeviceCode(): string {\n  return randomBytes(32).toString(\"base64url\");\n}\n\n/** A runner id. */\nexport function generateRunnerId(): string {\n  return `runner_${randomUUID()}`;\n}\n\n/** A job id. */\nexport function generateJobId(): string {\n  // A bare UUID, not a prefixed one.\n  //\n  // The app mints this now, because byollm_009 §6 binds the job id into the\n  // envelope's signature — so the id must exist before the row does. A\n  // `job_`-prefixed string is not a `uuid`, and the Supabase adapter's column\n  // is, so the prefix would have made every enqueue fail there while passing\n  // in memory. Ids are opaque to the protocol; the prefix was only ever\n  // decoration.\n  return randomUUID();\n}\n\n/**\n * A short code the user reads and confirms, formatted `XXXX-XXXX`.\n * Drawn with rejection sampling so the alphabet stays uniform.\n */\nexport function generateUserCode(): string {\n  const chars: string[] = [];\n  while (chars.length < 8) {\n    for (const byte of randomBytes(16)) {\n      // 256 % 28 !== 0, so bytes at or above the largest whole multiple are\n      // discarded rather than folded — folding would bias the low symbols.\n      const limit = 256 - (256 % USER_CODE_ALPHABET.length);\n      if (byte >= limit) continue;\n      const symbol = USER_CODE_ALPHABET[byte % USER_CODE_ALPHABET.length];\n      if (symbol === undefined) continue;\n      chars.push(symbol);\n      if (chars.length === 8) break;\n    }\n  }\n  return `${chars.slice(0, 4).join(\"\")}-${chars.slice(4).join(\"\")}`;\n}\n\n/** SHA-256, hex. Tokens and device codes are stored only as this. */\nexport function hashSecret(secret: string): string {\n  return createHash(\"sha256\").update(secret, \"utf8\").digest(\"hex\");\n}\n\n/**\n * Compare two hex digests without leaking their difference through timing.\n * Lengths are compared first because `timingSafeEqual` throws on a mismatch.\n */\nexport function secretsMatch(aHex: string, bHex: string): boolean {\n  if (aHex.length !== bHex.length) return false;\n  return timingSafeEqual(Buffer.from(aHex, \"hex\"), Buffer.from(bHex, \"hex\"));\n}\n\n/**\n * A fresh id for one lease grant.\n *\n * Not a secret and not guessed at — a daemon is told its lease id in the claim\n * response. It exists to distinguish *this* grant from the next one over the\n * same job by the same runner, which is what stops a replayed release landing\n * on a lease the sender never meant.\n */\nexport const generateLeaseId = (): string => randomUUID();\n","import { SealedOutcome, type JobOutcome } from \"@byollm/protocol\";\n\n/**\n * Open a sealed outcome, once, for both lanes — B064 step 4's prerequisite.\n *\n * `handlers.ts` and `cloud.ts` each did the same three things to a decrypted\n * envelope: parse the JSON, validate it as a {@link SealedOutcome}, and check\n * the clear-text disposition against what was sealed. Two copies of one\n * decision, and the only difference between them was how they reported a\n * failure — a refusal message on the direct lane, `null` on the cloud lane.\n *\n * **Extracted BEFORE the shape changes rather than after.** Step 4 adds a\n * field to what the daemon seals, and a field added to two independent\n * readers is a field added correctly to one of them: the direct lane and the\n * cloud lane would agree until the day they did not, and the lane that broke\n * is the one Kevin is on. Instruction 9 — one definition, both ends — and\n * here both ends are two files in the same package.\n *\n * The disposition check has to live inside this rather than beside it. It is\n * the reason the function exists at all: byollm_009 §6.1 puts it here because\n * **this is the only party that can open the envelope**, so it is the only\n * place the relay's clear-text routing hint can be checked against the truth.\n * Left to the callers it would be a step somebody forgets in the third lane.\n */\nexport type OpenedOutcome =\n  | { readonly ok: true; readonly value: SealedOutcome }\n  | { readonly ok: false; readonly why: string };\n\nexport function openSealedOutcome(input: {\n  /** The decrypted envelope body. */\n  readonly plaintext: string;\n  /**\n   * What the relay was told this job became.\n   *\n   * Checked, never trusted: it travelled in the clear and the sealed copy is\n   * the one the device signed.\n   */\n  readonly disposition: JobOutcome[\"outcome\"];\n}): OpenedOutcome {\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(input.plaintext);\n  } catch {\n    return { ok: false, why: \"the sealed result was not valid JSON\" };\n  }\n\n  const sealed = SealedOutcome.safeParse(parsed);\n  if (!sealed.success) {\n    return { ok: false, why: \"the sealed result was not an outcome\" };\n  }\n\n  if (sealed.data.outcome.outcome !== input.disposition) {\n    return {\n      ok: false,\n      why: \"the declared disposition is not the one that was sealed\",\n    };\n  }\n\n  return { ok: true, value: sealed.data };\n}\n","import { openSealedOutcome } from \"./sealed-outcome.js\";\nimport {\n  FetchRequest,\n  type SealedOutcome,\n  keyId,\n  open,\n  publicIdentityOf,\n  type FetchResponse,\n  RequestSignature,\n  verifyRequest,\n  verifyPublicIdentity,\n  type StoredKeys,\n  ClaimRequest,\n  type ClaimRequest as ClaimRequestType,\n  type HeartbeatRequest as HeartbeatRequestType,\n  type ReleaseRequest as ReleaseRequestType,\n  type ResultRequest as ResultRequestType,\n  ERROR_STATUS,\n  HeartbeatRequest,\n  PairRequest,\n  PROTOCOL_VERSION,\n  ReleaseRequest,\n  ResultRequest,\n  provenanceFor,\n  type ClaimResponse,\n  type Endpoint,\n  type HeartbeatResponse,\n  type PairPollResponse,\n  type PairStartResponse,\n  type ReleaseResponse,\n  type ResultResponse,\n  type WireErrorCode,\n} from \"@byollm/protocol\";\nimport { generateDeviceCode, generateUserCode, hashSecret } from \"./ids.js\";\nimport { resealForDevice } from \"./reseal.js\";\nimport { deadlineFor } from \"./records.js\";\nimport type { JobRecord, RunnerRecord } from \"./records.js\";\nimport type { ByollmStore } from \"./store.js\";\n\n/** Everything a mount needs to serve the protocol. */\n/**\n * What a transport must hand the handler to authenticate a call.\n *\n * `rawBody` is the exact bytes received, not a re-serialisation of the parsed\n * object: JSON.stringify does not round-trip byte-for-byte, and a signature\n * over re-serialised input verifies something the sender never signed.\n */\nexport interface AuthContext {\n  readonly endpoint: string;\n  readonly rawBody: string;\n  readonly signature: unknown;\n}\n\nexport interface HandlerConfig {\n  readonly store: ByollmStore;\n  /**\n   * Absolute URL of the page where a user approves a pairing. The device code\n   * is *not* appended — the user types the short code into the app's own\n   * authenticated page, which is what keeps pairing interactive.\n   */\n  readonly verificationUrl: string;\n  /** How long a lease lasts. Default 60s — six heartbeats of headroom. */\n  readonly leaseMs?: number;\n  /** How long an unapproved pairing code lives. Default 10 minutes. */\n  readonly pairingTtlMs?: number;\n  /** How often a daemon may poll for pairing approval. Default 2s. */\n  readonly pollIntervalMs?: number;\n  /** Injectable clock, so tests can move time without sleeping. */\n  readonly now?: () => number;\n  /**\n   * This site's keypairs (byollm_009 §5) — **supplied, never generated here.**\n   *\n   * A site is usually more than one process. Generating keys at startup would\n   * work perfectly in development and fail only in production, silently: each\n   * instance would have a different identity, a daemon would pin whichever\n   * one approved its pairing, and every request routed to a different\n   * instance would fail a signature check it had no way to explain. So this\n   * is a required input, and there is a `keygen` script that produces one.\n   */\n  readonly siteKeys: StoredKeys;\n}\n\nconst DEFAULTS = {\n  leaseMs: 60_000,\n  pairingTtlMs: 10 * 60_000,\n  pollIntervalMs: 2_000,\n} as const;\n\n/** A handled protocol call: a status and a JSON body. */\nexport interface HandlerResult {\n  readonly status: number;\n  readonly body: unknown;\n  /** Set for `rate-limited` and `server-error`. */\n  readonly retryAfterSeconds?: number;\n}\n\nfunction fail(\n  error: WireErrorCode,\n  message: string,\n  retryAfterSeconds?: number,\n): HandlerResult {\n  return {\n    status: ERROR_STATUS[error],\n    body: {\n      error,\n      message,\n      ...(retryAfterSeconds === undefined\n        ? {}\n        : { retryAfter: retryAfterSeconds }),\n    },\n    ...(retryAfterSeconds === undefined ? {} : { retryAfterSeconds }),\n  };\n}\n\nfunction ok(body: unknown): HandlerResult {\n  return { status: 200, body };\n}\n\n/**\n * The five protocol endpoints, over any {@link ByollmStore}.\n *\n * Transport-free on purpose: a mount adapts `Request`/`Response` (or Express,\n * or whatever) onto {@link ByollmHandlers.handle}, and everything the\n * protocol actually specifies lives here where the conformance kit can reach\n * it without an HTTP server in the way.\n */\nexport class ByollmHandlers {\n  readonly #store: ByollmStore;\n  readonly #verificationUrl: string;\n  readonly #leaseMs: number;\n  readonly #pairingTtlMs: number;\n  readonly #pollIntervalMs: number;\n  readonly #now: () => number;\n  readonly #siteKeys: StoredKeys;\n  /** This site's identity key id — Amendment A's `stub.site`. Derived once. */\n  readonly #siteKeyId: string;\n\n  constructor(config: HandlerConfig) {\n    this.#store = config.store;\n    // Fail at construction, not at the first pairing. A site whose keys are\n    // malformed should not start and then refuse its users one at a time.\n    if (!verifyPublicIdentity(publicIdentityOf(config.siteKeys))) {\n      throw new Error(\n        \"siteKeys are not internally consistent: the encryption key is not \" +\n          \"signed by the identity key. Generate a fresh pair with \" +\n          \"`npx @byollm/server keygen`.\",\n      );\n    }\n    this.#siteKeys = config.siteKeys;\n    this.#siteKeyId = keyId(publicIdentityOf(config.siteKeys).identity);\n    this.#verificationUrl = config.verificationUrl;\n    this.#leaseMs = config.leaseMs ?? DEFAULTS.leaseMs;\n    this.#pairingTtlMs = config.pairingTtlMs ?? DEFAULTS.pairingTtlMs;\n    this.#pollIntervalMs = config.pollIntervalMs ?? DEFAULTS.pollIntervalMs;\n    this.#now = config.now ?? Date.now;\n  }\n\n  /**\n   * Dispatch one protocol call.\n   *\n   * @param endpoint - which of the five, already routed from the path\n   * @param body - the parsed JSON request body, untrusted\n   * @param auth - the signature and the exact bytes it covers\n   */\n  async handle(\n    endpoint: Endpoint,\n    body: unknown,\n    auth: AuthContext,\n  ): Promise<HandlerResult> {\n    switch (endpoint) {\n      case \"pair\":\n        return this.#pair(body);\n      case \"claim\":\n        return this.#authed(auth, body, ClaimRequest, this.#claim.bind(this));\n      case \"heartbeat\":\n        // Heartbeat is the channel revocation travels on — and since V1-2 it\n        // travels as the refusal itself ({@link MUSTS.REVOCATION_HONORED}).\n        //\n        // It used to be answered with an empty site set, which the daemon\n        // read as \"revoked\". That reading is gone: an empty set now means\n        // \"nothing is consented right now\", because a projection can arrive\n        // empty by accident and the daemon's response to revocation is to\n        // delete its pairing. So the one call every daemon always makes — a\n        // daemon with no working backend never claims — carries the\n        // unambiguous version: 403 with `revoked`, which is a code and not an\n        // inference.\n        return this.#authed(\n          auth,\n          body,\n          HeartbeatRequest,\n          this.#heartbeat.bind(this),\n        );\n      case \"fetch\":\n        return this.#authed(auth, body, FetchRequest, this.#fetch.bind(this));\n      case \"result\":\n        return this.#authed(auth, body, ResultRequest, this.#result.bind(this));\n      case \"release\":\n        return this.#authed(\n          auth,\n          body,\n          ReleaseRequest,\n          this.#release.bind(this),\n        );\n    }\n  }\n\n  /**\n   * Shared preamble for the four authenticated endpoints: verify the\n   * signature, reject a revoked runner, and parse the body.\n   *\n   * Authentication happens before schema validation so a stranger probing the\n   * endpoint learns nothing about the wire format.\n   */\n  async #authed<T>(\n    auth: AuthContext,\n    body: unknown,\n    schema: { safeParse: (v: unknown) => { success: boolean; data?: T } },\n    run: (request: T, runner: RunnerRecord) => Promise<HandlerResult>,\n    options: { allowRevoked?: boolean } = {},\n  ): Promise<HandlerResult> {\n    const signature = RequestSignature.safeParse(auth.signature);\n    if (!signature.success) {\n      return fail(\"unauthorized\", \"this request is not signed\");\n    }\n\n    const runner = await this.#store.getRunner(signature.data.runnerId);\n    if (!runner) {\n      return fail(\"unauthorized\", \"this runner is not recognised\");\n    }\n\n    // Verified against the identity pinned when the user approved this\n    // machine — not against anything the request carries. A signature that\n    // authenticates itself authenticates nothing.\n    const failure = verifyRequest({\n      identityPublic: runner.device.identity,\n      endpoint: auth.endpoint,\n      body: auth.rawBody,\n      signature: signature.data,\n      now: this.#now(),\n    });\n    if (failure !== null) {\n      // Deliberately one message for both causes. Telling a caller whether\n      // their clock or their key is wrong tells an attacker which half of a\n      // forgery already works.\n      return fail(\"unauthorized\", \"this request's signature is not valid\");\n    }\n    if (runner.revokedAt !== null && options.allowRevoked !== true) {\n      // A distinct truth from \"unauthorized\": the daemon should stop and say\n      // so, not retry or re-pair silently.\n      return fail(\"revoked\", \"this runner has been revoked by its owner\");\n    }\n\n    const parsed = schema.safeParse(body);\n    if (!parsed.success || parsed.data === undefined) {\n      return fail(\"bad-request\", \"request body failed schema validation\");\n    }\n    return run(parsed.data, runner);\n  }\n\n  /**\n   * Hand over the payload for a lease this runner holds — byollm_009 §6.\n   *\n   * The second half of claim-then-fetch. A claim answers with a stub, and the\n   * work itself is collected separately by the device that took it, because a\n   * payload can only be sealed once its recipient is known.\n   *\n   * Scoped to the lease, not the job: answering for whatever lease happens to\n   * exist would hand the work to a runner whose grant had already been\n   * superseded.\n   */\n  async #fetch(\n    request: FetchRequest,\n    runner: RunnerRecord,\n  ): Promise<HandlerResult> {\n    const job = await this.#store.get(request.jobId);\n    if (\n      !job ||\n      job.lease?.runnerId !== runner.id ||\n      job.lease.id !== request.leaseId\n    ) {\n      // One answer for \"no such job\", \"not yours\" and \"a lease you no longer\n      // hold\". A caller who is allowed to know already knows which.\n      return fail(\"not-found\", \"no such lease on this job\");\n    }\n    // One implementation of open-and-reseal, shared with the cloud lane: the\n    // deadline and key ids are bound into a signature, and two copies of a\n    // bound value is the bug this codebase keeps finding.\n    const resealed = await resealForDevice({\n      siteKeys: this.#siteKeys,\n      job: { id: job.id, envelope: job.envelope, createdAt: job.createdAt },\n      device: runner.device,\n    });\n    if (!resealed.ok) {\n      return fail(\"server-error\", \"this job's payload could not be opened\");\n    }\n    return ok({ envelope: resealed.envelope } satisfies FetchResponse);\n  }\n\n  // -- 1. pair --------------------------------------------------------------\n\n  async #pair(body: unknown): Promise<HandlerResult> {\n    const parsed = PairRequest.safeParse(body);\n    if (!parsed.success) {\n      return fail(\"bad-request\", \"pair request failed schema validation\");\n    }\n    const request = parsed.data;\n    const now = this.#now();\n\n    if (request.action === \"start\") {\n      const deviceCode = generateDeviceCode();\n      const userCode = generateUserCode();\n      const expiresAt = now + this.#pairingTtlMs;\n\n      // The machine must prove its encryption key belongs to the identity it\n      // is presenting, before either is stored. Otherwise a caller could pair\n      // a real identity with an encryption key it holds the secret for, and\n      // read everything later sealed to that runner.\n      if (!verifyPublicIdentity(request.device)) {\n        return fail(\n          \"bad-request\",\n          \"the device's encryption key is not signed by the identity it was presented with\",\n        );\n      }\n\n      await this.#store.createPairing({\n        device: request.device,\n        deviceCodeHash: hashSecret(deviceCode),\n        userCode,\n        state: \"pending\",\n        owner: null,\n        runnerId: null,\n        collected: false,\n        label: request.daemon.label,\n        platform: request.daemon.platform,\n        daemonVersion: request.daemon.version,\n        capabilities: request.capabilities,\n        expiresAt,\n        createdAt: now,\n      });\n\n      const response: PairStartResponse = {\n        deviceCode,\n        userCode,\n        verificationUrl: this.#verificationUrl,\n        expiresAt,\n        pollIntervalMs: this.#pollIntervalMs,\n      };\n      return ok(response);\n    }\n\n    // action === \"poll\"\n    const pairing = await this.#store.getPairingByDeviceCodeHash(\n      hashSecret(request.deviceCode),\n    );\n    if (!pairing) {\n      return fail(\"not-found\", \"unknown device code\");\n    }\n    if (pairing.state === \"denied\") {\n      return ok({ status: \"denied\" } satisfies PairPollResponse);\n    }\n    // Expiry is checked before approval state so a code approved after it\n    // lapsed is still dead ({@link MUSTS.PAIR_CODE_EXPIRES}).\n    if (pairing.expiresAt <= now && pairing.state === \"pending\") {\n      return ok({ status: \"expired\" } satisfies PairPollResponse);\n    }\n    if (\n      pairing.state === \"approved\" &&\n      !pairing.collected &&\n      pairing.runnerId !== null &&\n      pairing.owner !== null\n    ) {\n      const response: PairPollResponse = {\n        status: \"approved\",\n        runnerId: pairing.runnerId,\n        owner: pairing.owner,\n        // Only on approval: a pending or denied poll learns nothing, so an\n        // unapproved code cannot be used to enumerate a site's keys.\n        //\n        // One entry, because a direct site *is* one site — the same shape a\n        // hub answers with rather than a special case (cloud_009 §5). The\n        // daemon's lookup is one map read on every lane, which is what keeps\n        // the two lanes one protocol.\n        sites: { [this.#siteKeyId]: publicIdentityOf(this.#siteKeys) },\n      };\n      // Delivered exactly once — a replayed device code gets nothing.\n      await this.#store.consumePairingToken(pairing.deviceCodeHash);\n      return ok(response);\n    }\n    if (pairing.state === \"approved\") {\n      return fail(\"not-found\", \"this pairing has already been collected\");\n    }\n    return ok({ status: \"pending\" } satisfies PairPollResponse);\n  }\n\n  // -- 2. claim -------------------------------------------------------------\n\n  async #claim(\n    request: ClaimRequestType,\n    runner: RunnerRecord,\n  ): Promise<HandlerResult> {\n    if (request.runnerId !== runner.id) {\n      return fail(\"unauthorized\", \"runner id does not match the signing key\");\n    }\n    const now = this.#now();\n\n    // Capabilities from *this* request, never the stored matrix — a daemon\n    // that just lost a backend must not be handed work for it\n    // ({@link MUSTS.CLAIM_REQUIRES_CAPABILITY}).\n    const jobs = await this.#store.claim({\n      runnerId: runner.id,\n      runnerOwner: runner.owner,\n      capabilities: request.capabilities,\n      max: request.max,\n      leaseMs: this.#leaseMs,\n      now,\n    });\n\n    const response: ClaimResponse = {\n      jobs: jobs.map((job) => ({\n        id: job.id,\n        kind: job.kind,\n        audience: job.audience,\n        owner: job.owner,\n        // This site, named by its identity key id — Amendment A §A.3. The\n        // daemon pinned this exact value at pairing, so it can check the stub\n        // against the envelope it later opens rather than taking our word for\n        // which site sent it. On this plane that is redundant, which is the\n        // point: the direct and relayed stubs are the same shape, and a daemon\n        // serving both cannot tell which upstream it is talking to.\n        site: this.#siteKeyId,\n        // byollm_016 Phase B. Present only when the site named one, and\n        // omitted rather than sent as undefined — the stub is `.strict()` and\n        // an explicit undefined is not the same as an absent key.\n        ...(job.purpose === undefined ? {} : { purpose: job.purpose }),\n        // Bucketed, not measured: an exact size is a stronger fingerprint\n        // than routing needs (byollm_009 §6).\n        sizeClass: job.sizeClass,\n        // Reserved for byollm_006; no job declares it yet.\n        streaming: false,\n        // The stub's deadline bounds how long a captured envelope is worth\n        // keeping, so it is always present — falling back to the TTL window\n        // when the app named no absolute one.\n        deadlineAt: deadlineFor(job, now),\n        // `audienceAllow` is not sent — cloud_008 §0.2. The list stays on\n        // `JobRecord`, where `claim` already filtered candidates with it; the\n        // daemon's own allowlist is what decides `named` (byollm_001 Rev 1\n        // §B) and always was.\n        //\n        // Removing it from `JobStub` did **not** make this line a type error.\n        // A conditional spread is not excess-property-checked, so the field\n        // would have gone on being sent to a daemon whose `.strict()` parse\n        // now rejects the entire claim response — every daemon on the version\n        // pair, refusing all work, for a field nobody read. Worth stating\n        // where it happened: the schema is the contract, and the compiler\n        // does not enforce it through a spread.\n        // No fallback. A job returned from `claim` holds a lease by\n        // definition, and synthesising one here would hand the daemon a lease\n        // id the store has never heard of — every later release naming it\n        // would silently match nothing. A store that returns an unleased job\n        // has broken its contract, and this says so.\n        lease: leaseOf(job),\n      })),\n      leaseMs: this.#leaseMs,\n    };\n    return ok(response);\n  }\n\n  // -- 3. heartbeat ---------------------------------------------------------\n\n  async #heartbeat(\n    request: HeartbeatRequestType,\n    runner: RunnerRecord,\n  ): Promise<HandlerResult> {\n    if (request.runnerId !== runner.id) {\n      return fail(\"unauthorized\", \"runner id does not match the signing key\");\n    }\n    const now = this.#now();\n    // No revoked branch here any more — V1-2. A revoked runner is refused by\n    // `#authed` before this handler is reached, on heartbeat as on every\n    // other endpoint, because \"revoked\" and \"nothing consented right now\"\n    // must not arrive as the same empty body.\n\n    await this.#store.touchRunner({\n      runnerId: runner.id,\n      capabilities: request.capabilities,\n      daemonVersion: request.daemonVersion,\n      paused: request.paused,\n      now,\n    });\n\n    // `renewed` is not reported back — cloud_008 §1.4b. The grants are still\n    // extended; the daemon simply never read the list, and `lost` is the\n    // signal it acts on.\n    const { lost } = await this.#store.renewLeases({\n      runnerId: runner.id,\n      leases: request.activeLeases,\n      leaseMs: this.#leaseMs,\n      now,\n    });\n\n    const cancel = await this.#store.listCancelRequests(runner.id);\n\n    const response: HeartbeatResponse = {\n      sites: { [this.#siteKeyId]: publicIdentityOf(this.#siteKeys) },\n      // A direct site has no disclosure of its own to go stale: consent to it\n      // *is* the pairing, and withdrawing it empties the set above.\n      awaitingConsent: [],\n      cancel: [...cancel],\n      lost: [...lost],\n      serverTime: now,\n    };\n    return ok(response);\n  }\n\n  // -- 4. result ------------------------------------------------------------\n\n  async #result(\n    request: ResultRequestType,\n    runner: RunnerRecord,\n  ): Promise<HandlerResult> {\n    if (request.runnerId !== runner.id) {\n      return fail(\"unauthorized\", \"runner id does not match the signing key\");\n    }\n    const now = this.#now();\n    const job = await this.#store.get(request.jobId);\n    if (!job) return fail(\"not-found\", \"unknown job\");\n\n    const outcome = await this.#openResult(request, runner);\n    if (!outcome.ok) return outcome.failure;\n\n    // Provenance is built here, from the job's audience and the authenticated\n    // runner — never from anything the daemon asserted\n    // ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).\n    const provenance = provenanceFor({\n      audience: job.audience,\n      runnerId: runner.id,\n      runnerOwner: runner.owner,\n      // From the envelope the device signed, not from the request beside it\n      // — cloud_008 §2.5. A daemon can no longer seal one answer and declare\n      // it came from a different model.\n      backendClass: outcome.value.ran.backendClass,\n      model: outcome.value.ran.model,\n    });\n\n    const {\n      accepted,\n      duplicate,\n      job: updated,\n    } = await this.#store.complete({\n      jobId: request.jobId,\n      // Who is asking, for the duplicate answer only — §3.6. Authorisation\n      // is `holder`, below, and still is.\n      runnerId: runner.id,\n      // The grant, not the runner — cloud_008 §1.4a. `CompleteHolder`'s own\n      // docstring already called the lease \"the more exact check anyway\";\n      // this plane simply had no lease id to give it until now.\n      holder: { by: \"lease\", leaseId: request.leaseId },\n      outcome: outcome.value.outcome,\n      provenance,\n      now,\n    });\n\n    const response: ResultResponse = {\n      accepted,\n      // Only when true — cloud_008 §3.6. Absent means \"not a duplicate\", and\n      // an optional field that is always present is a required one wearing a\n      // question mark.\n      ...(duplicate === true ? { duplicate: true } : {}),\n      state: updated?.state ?? job.state,\n    };\n    return ok(response);\n  }\n\n  /**\n   * Open a sealed result, or refuse it.\n   *\n   * The mirror of the daemon's `#openPayload`, and refuses for the same\n   * reason: an outcome that does not verify against the device's pinned key is\n   * an assertion by whoever relayed it, and storing it would let an\n   * intermediary write answers into the app.\n   *\n   * The clear-text `disposition` is checked here rather than trusted. It is on\n   * the wire so a relay can route without opening anything, which means the\n   * one thing it must not be is authoritative — a daemon that sealed an error\n   * and declared `ok` would otherwise have its declaration believed by\n   * everything upstream of this line.\n   */\n  async #openResult(\n    request: ResultRequestType,\n    runner: RunnerRecord,\n  ): Promise<\n    { ok: true; value: SealedOutcome } | { ok: false; failure: HandlerResult }\n  > {\n    const refuse = (why: string) =>\n      ({ ok: false as const, failure: fail(\"bad-request\", why) }) as const;\n\n    const opened = await open({\n      envelope: request.envelope,\n      recipientKeys: this.#siteKeys,\n      senderIdentityPublic: runner.device.identity,\n      expected: {\n        jobId: request.jobId,\n        senderKeyId: keyId(runner.device.identity),\n        recipientKeyId: keyId(publicIdentityOf(this.#siteKeys).identity),\n        direction: \"result\",\n      },\n    });\n    if (!opened.ok) {\n      return refuse(\"the result did not verify as coming from this device\");\n    }\n\n    /* One function, both lanes — see `sealed-outcome.ts`. The refusal\n       messages are the ones this lane already returned, now stated once. */\n    const outcome = openSealedOutcome({\n      plaintext: opened.plaintext,\n      disposition: request.disposition,\n    });\n    if (!outcome.ok) return refuse(outcome.why);\n    return { ok: true, value: outcome.value };\n  }\n\n  // -- 5. release -----------------------------------------------------------\n\n  async #release(\n    request: ReleaseRequestType,\n    runner: RunnerRecord,\n  ): Promise<HandlerResult> {\n    if (request.runnerId !== runner.id) {\n      return fail(\"unauthorized\", \"runner id does not match the signing key\");\n    }\n    const released = await this.#store.release({\n      runnerId: runner.id,\n      leases: request.leases,\n      reason: request.reason,\n      now: this.#now(),\n    });\n    const response: ReleaseResponse = { released };\n    return ok(response);\n  }\n}\n\n/** The protocol version this build speaks. */\nexport const SERVED_PROTOCOL_VERSION = PROTOCOL_VERSION;\n\n/** The lease a claimed job must have, or a loud failure. */\nfunction leaseOf(job: JobRecord): NonNullable<JobRecord[\"lease\"]> {\n  if (!job.lease) {\n    throw new Error(\n      `store returned job ${job.id} from claim with no lease — the store ` +\n        `contract requires a claimed job to hold one`,\n    );\n  }\n  return job.lease;\n}\n","import {\n  ENVELOPE_MAX_AGE_MS,\n  keyId,\n  open,\n  publicIdentityOf,\n  seal,\n  type PublicIdentity,\n  type SealedEnvelope,\n  type StoredKeys,\n} from \"@byollm/protocol\";\n\n/**\n * Open this site's own at-rest envelope and re-seal it to a claiming device.\n *\n * The single operation that makes byollm_009 §6 work, and it now has two\n * callers: {@link ByollmHandlers} answering `fetch` on the direct plane, and\n * the cloud lane answering the relay's \"who claimed it\" poll. Both do exactly\n * this, and the reason it lives in one file is the reason everything else in\n * this codebase does: the deadline, the key ids and the direction are all\n * bound into a signature, and two implementations of a bound value is the same\n * bug as two clock readings — it works until they disagree, and then nothing\n * opens.\n *\n * The plaintext exists for one statement and never reaches a wire, a store, or\n * a log. That is the whole guarantee: the site is an endpoint, so it is\n * entitled to read its own work, and it is the only party between the app and\n * the device that is.\n */\n\ntype ResealFailure = \"unopenable\";\n\nexport type ResealResult =\n  | { readonly ok: true; readonly envelope: SealedEnvelope }\n  | { readonly ok: false; readonly reason: ResealFailure };\n\nexport async function resealForDevice(input: {\n  siteKeys: StoredKeys;\n  /** The job's identity and its at-rest ciphertext. */\n  job: {\n    readonly id: string;\n    readonly envelope: SealedEnvelope;\n    readonly createdAt: number;\n  };\n  /** The device that claimed it, as the upstream reported. */\n  device: PublicIdentity;\n}): Promise<ResealResult> {\n  const senderKeyId = keyId(publicIdentityOf(input.siteKeys).identity);\n\n  const opened = await open({\n    envelope: input.job.envelope,\n    recipientKeys: input.siteKeys,\n    senderIdentityPublic: input.siteKeys.identityPublic,\n    expected: {\n      jobId: input.job.id,\n      senderKeyId,\n      recipientKeyId: senderKeyId,\n      direction: \"payload\",\n    },\n  });\n  if (!opened.ok) {\n    // The store holds something this site cannot open: rotated keys, a\n    // corrupted row, or someone else's envelope. Not the device's problem and\n    // not something a retry fixes.\n    return { ok: false, reason: \"unopenable\" };\n  }\n\n  const envelope = await seal({\n    plaintext: opened.plaintext,\n    senderKeys: input.siteKeys,\n    recipientEncryptionPublic: input.device.encryption,\n    context: {\n      jobId: input.job.id,\n      senderKeyId,\n      recipientKeyId: keyId(input.device.identity),\n      // From the record, never recomputed from a fresh clock read — the\n      // envelope's own deadline is what the signature bound.\n      deadlineAt: input.job.createdAt + ENVELOPE_MAX_AGE_MS,\n      direction: \"payload\",\n    },\n  });\n  return { ok: true, envelope };\n}\n","import type {\n  PayloadFor,\n  PublicIdentity,\n  Audience,\n  Capability,\n  JobKind,\n  JobOutcome,\n  SealedEnvelope,\n  SizeClass,\n  JobState,\n  Lease,\n  ResultProvenance,\n} from \"@byollm/protocol\";\n\n/**\n * A job as the server stores it.\n *\n * Adapters map this shape onto their own storage; the field meanings are\n * normative because the conformance kit asserts behaviour that depends on\n * them (TTL clock start, dependency gating, refusal tracking).\n */\nexport interface JobRecord {\n  readonly id: string;\n  readonly kind: JobKind;\n  /**\n   * The work, sealed to this site's own encryption key (byollm_009 §10).\n   *\n   * The store never holds plaintext. The app sees plaintext at enqueue and at\n   * result because the app *is* the endpoint; everything in between —\n   * database, backups, log aggregators, a support engineer with read access —\n   * sees ciphertext.\n   *\n   * This is not protection from the application the user deliberately sent\n   * their work to. It is protection from everything the application's storage\n   * touches, which is a longer list than most people picture.\n   */\n  readonly envelope: SealedEnvelope;\n  /** Fixed at enqueue, where the plaintext is. */\n  readonly sizeClass: SizeClass;\n  readonly audience: Audience;\n  /**\n   * The service the site named, if it named one — byollm_016 Phase B.\n   *\n   * Stored rather than derived, because the stub carries it to the router and\n   * the router matches on it. `undefined` means the owner's default answers,\n   * which is every job written before this field existed.\n   */\n  readonly purpose: string | undefined;\n  /** The app's id for the user who enqueued it. */\n  readonly owner: string;\n  /** Server-side restriction on which runner owners may take a `named` job. */\n  readonly audienceAllow: readonly string[] | undefined;\n  /** Job ids that must all be `ok` before this becomes claimable. */\n  readonly dependsOn: readonly string[];\n  readonly state: JobState;\n  readonly lease: Lease | null;\n  /**\n   * The grant that recorded this job's result — cloud_008 §3.6.\n   *\n   * Kept after `lease` is nulled, because \"who finished this\" outlives \"who\n   * holds this\" and the two are asked for different reasons. It is what lets\n   * a replay from the device that finished the job be answered *as a\n   * duplicate* rather than as a stale lease — and lets a replay from any\n   * other device be refused exactly as it would be for a job that is not\n   * terminal, so a job id is not a terminality probe.\n   */\n  readonly completedByLeaseId: string | null;\n  readonly createdAt: number;\n  /**\n   * When the job became claimable — enqueue time for a job with no\n   * dependencies, or the moment its last dependency reached `ok`.\n   *\n   * **The TTL clock starts here, not at `createdAt`.** Starting it at enqueue\n   * would expire a dependent job for the crime of waiting on a slow\n   * dependency (byollm_001 Rev 1 §D, TTL clock resolved in build review).\n   * `null` means still blocked.\n   */\n  readonly claimableAt: number | null;\n  /** How long an unclaimed job may wait once claimable. */\n  readonly ttlMs: number;\n  /** Optional absolute deadline, independent of the TTL. */\n  readonly deadlineAt: number | null;\n  /**\n   * Runners that released this job with reason `refused` — their local\n   * allowlist declined it. Never offered to them again\n   * ({@link MUSTS.REFUSAL_NOT_REOFFERED}).\n   */\n  readonly refusedBy: readonly string[];\n  /** How many times this job has been claimed, including lease-expiry retries. */\n  readonly attempts: number;\n  readonly outcome: JobOutcome | null;\n  readonly provenance: ResultProvenance | null;\n  readonly updatedAt: number;\n}\n\n/** A paired daemon as the server stores it. */\nexport interface RunnerRecord {\n  readonly id: string;\n  /** The app's id for the user this runner is bound to — exactly one. */\n  readonly owner: string;\n  readonly label: string;\n  readonly platform: \"darwin\" | \"linux\" | \"win32\";\n  readonly daemonVersion: string;\n  readonly capabilities: readonly Capability[];\n  readonly paused: boolean;\n  /** Set once; a revoked runner never un-revokes. */\n  readonly revokedAt: number | null;\n  readonly lastHeartbeatAt: number;\n  readonly createdAt: number;\n  /**\n   * The device's pinned public keys. What later signatures verify against —\n   * a runner id names a machine, this proves it.\n   */\n  readonly device: PublicIdentity;\n}\n\n/** An in-flight device-code pairing. */\nexport interface PairingRecord {\n  /** SHA-256 of the device code. The code itself is never stored. */\n  readonly deviceCodeHash: string;\n  /** The short code the user reads. Unique among live pairings. */\n  readonly userCode: string;\n  readonly state: \"pending\" | \"approved\" | \"denied\";\n  /** Set when approved — learned from the approving user's own session. */\n  readonly owner: string | null;\n  readonly runnerId: string | null;\n  /**\n   * Whether this approval has already been collected — cloud_008 §2.4.\n   *\n   * This was `runnerTokenOnce`, a bearer token held until the daemon's next\n   * poll and then nulled. The token is gone (finding 37: minted, hashed,\n   * written to two disks, never sent or compared), but the *deliver-once*\n   * property it carried is real and separate: a replayed device code must get\n   * nothing, or a code seen in a shell history is a second pairing.\n   *\n   * So the flag stays and the secret does not. Nulling a token to mean\n   * \"collected\" was one field doing two jobs, and only one of them was load\n   * bearing.\n   */\n  readonly collected: boolean;\n  readonly label: string;\n  readonly platform: \"darwin\" | \"linux\" | \"win32\";\n  readonly daemonVersion: string;\n  readonly capabilities: readonly Capability[];\n  /**\n   * The device's public keys, presented at pair start (byollm_009 §5).\n   *\n   * Kept on the pairing so the approving user is approving a *specific\n   * machine*, not a code that any machine could later redeem. It is copied\n   * onto the runner at approval.\n   */\n  readonly device: PublicIdentity;\n  readonly expiresAt: number;\n  readonly createdAt: number;\n}\n\n/**\n * What the app supplies to enqueue a job.\n *\n * Generic over the kind, so the payload has to be the payload *for* that kind.\n * These were independent — `kind: JobKind` beside `payload: JobPayload`, the\n * union of both shapes — and the pairing was left to the author's memory. A\n * chat job carrying a generate payload typechecked, built, shipped, and was\n * refused at the relay's ingress with a precise sentence nobody sees until\n * somebody clicks.\n *\n * `PayloadFor<K>` was already exported by the protocol when that happened, and\n * `enqueue` did not use it. A wrong pairing is now a compile error at the call\n * site, which is the only place that knows what it meant.\n *\n * A caller whose `kind` is a variable rather than a literal still gets the old\n * permissive union — the conditional distributes — so nothing that was legal\n * and correct stops compiling.\n */\nexport interface EnqueueInput<K extends JobKind = JobKind> {\n  readonly kind: K;\n  /** The work, in plaintext. The server seals it before it is stored. */\n  readonly payload: PayloadFor<K>;\n  readonly owner: string;\n  /**\n   * Direct lane only. Refused on the cloud lane, where it is derived.\n   *\n   * On the cloud lane, who may serve a job comes from the person's own\n   * mapping — the service they chose, its owner, and that owner's offer scope\n   * — none of which a site is told, and all of which the hub holds at claim.\n   * A site declaring an audience there was a third vote cast by the one party\n   * the disclosure fence forbids from knowing the answer, and its `private`\n   * default silently disabled team sharing for every user who had a team.\n   *\n   * On the direct lane it still selects something real, which is why it stays\n   * rather than going in the same release: it is the switch that turns\n   * {@link EnqueueInput.audienceAllow} on. `private` is own-devices-only;\n   * `team` hands the decision to the allowlist. Without it there is no way to\n   * say \"these runner owners, and no others\", and supplier trust needs one.\n   *\n   * Defaults to `private` — the safe direction, and on this lane a direction\n   * a caller can meaningfully choose.\n   */\n  readonly audience?: Audience;\n  /**\n   * Which of *your site's* declared purposes this job serves — Amendment L.\n   *\n   * **A need, never a name.** You declare purposes at registration —\n   * `\"revenue\"`, `\"writing-assistant\"` — and each of your users maps them to\n   * one of their own services on the consent screen. This field names the\n   * purpose; the mapping does the rest.\n   *\n   * There is no model field, no base URL, no flags, and — since Amendment L —\n   * no way to name a service either. Your vocabulary is your purposes; theirs\n   * is their services; the two never meet. You learn whether a slot was\n   * satisfiable and nothing else.\n   *\n   * Use the purpose **key**, not its label. Labels are prose for the consent\n   * screen and may change; a key travels on every job and is what mappings\n   * are stored against.\n   *\n   * Leave it out only in direct mode, which has no control plane to hold a\n   * mapping and answers by kind alone.\n   */\n  readonly purpose?: string;\n  readonly audienceAllow?: readonly string[];\n  readonly dependsOn?: readonly string[];\n  /** Defaults to the server config's `defaultTtlMs`. */\n  readonly ttlMs?: number;\n  readonly deadlineAt?: number;\n  /** Caller-supplied id, for idempotent enqueue. */\n  readonly id?: string;\n}\n\n/**\n * What the *store* is given — the sealed form.\n *\n * Distinct from {@link EnqueueInput} because the two are genuinely different\n * things: an app hands over work in plaintext, and what gets written down is\n * sealed. Collapsing them into one type would mean a field that is sometimes\n * readable and sometimes not, which is the kind of ambiguity that ends with\n * plaintext in a database.\n */\nexport interface StoredJobInput extends Omit<EnqueueInput, \"payload\" | \"id\"> {\n  readonly id: string;\n  readonly envelope: SealedEnvelope;\n  readonly sizeClass: SizeClass;\n}\n\n/**\n * When a job's ciphertext stops being worth carrying — cloud_008 §31.\n *\n * One function because it was two expressions. The direct plane computed\n * `job.deadlineAt ?? (job.claimableAt ?? now) + job.ttlMs`; the cloud lane\n * computed `record.deadlineAt ?? record.createdAt + <a local constant>`. The\n * first branch agreed and the fallback did not, so a job with no explicit\n * deadline got two different ones depending on which lane published it — and\n * the difference is largest exactly where it matters, for a job blocked on a\n * dependency, whose `claimableAt` may be hours after `createdAt`.\n *\n * The TTL clock starts when a job becomes *claimable*, which is the rule\n * `DEPENDS_ON_GATING` and `TTL_EXPIRY` already share: a dependent job must not\n * spend its life waiting for its dependency.\n */\nexport function deadlineFor(\n  job: Pick<JobRecord, \"deadlineAt\" | \"claimableAt\" | \"ttlMs\">,\n  now: number,\n): number {\n  return job.deadlineAt ?? (job.claimableAt ?? now) + job.ttlMs;\n}\n","import {\n  ENDPOINTS,\n  ERROR_STATUS,\n  MAX_ENVELOPE_BYTES,\n  tooLargeMessage,\n  PROTOCOL_PREFIX,\n  checkProtocolVersion,\n  type Endpoint,\n} from \"@byollm/protocol\";\nimport { ByollmHandlers, type HandlerConfig } from \"./handlers.js\";\n\n/**\n * Largest protocol request body accepted, before schema validation.\n *\n * Derived, not chosen. This was `8 * 1024 * 1024` beside a comment saying the\n * protocol caps a payload at 4 MB — true when it was written, and the cap has\n * since moved to {@link MAX_ENVELOPE_BYTES}, which is 6 MiB. So the direct\n * lane refused envelopes the protocol permits, and the hub — which derives\n * its own limit the same way this now does — accepted them.\n *\n * That is the failure this codebase keeps finding in other clothes: one rule\n * with two implementations, and only one of them moved. A site self-hosting\n * the SDK and a site on the hub must not disagree about whether a job is too\n * big, so neither of them gets to hold the number.\n *\n * The 512 KiB of headroom is for JSON overhead and a batch of results around\n * the envelope, matching the hub's `MAX_ENVELOPE_BYTES + 512 * 1024`.\n */\nconst MAX_BODY_BYTES = MAX_ENVELOPE_BYTES + 512 * 1024;\n\n/**\n * What a message that is too big is told — B061, Kevin's bisection.\n *\n * This said \"request body too large\" and nothing else, at both call sites,\n * with both numbers already in scope. Somebody who hits it learns that\n * something was too big and not what, not by how much, not whether the limit\n * is per-message or per-account, and not what to do — so the only way\n * forward is to bisect, which is exactly what Kevin did.\n *\n * The sentence and its rounding come from the protocol now — B072. The first\n * version of this copied the relay's WORDS and rediscovered the relay's bug\n * with them: `toFixed` rounds to nearest, so one byte over printed \"this\n * message is 10.5 MB and the limit is 10.5 MB\". The relay had already found\n * that, fixed it, and written the reasoning beside the fix. Copying a\n * sentence copies everything about it except the part that was learned.\n */\nconst tooLarge = (bytes: number): string =>\n  tooLargeMessage({ bytes, limit: MAX_BODY_BYTES });\n\n/**\n * Where the protocol endpoints are mounted.\n *\n * Defaults to {@link PROTOCOL_PREFIX}. Pass the real mount point when it is\n * anything else — a Next.js route at `app/api/byollm/[...route]/route.ts`\n * serves `/api/byollm/...`, so it needs `basePath: \"/api/byollm\"`.\n *\n * @throws if the path is not an absolute, single-segment-per-slash path. A\n * mount point is configuration, and a malformed one should fail at startup\n * rather than silently match nothing.\n */\nfunction normalizeBasePath(basePath: string): string {\n  const trimmed = basePath.endsWith(\"/\") ? basePath.slice(0, -1) : basePath;\n  if (!trimmed.startsWith(\"/\")) {\n    throw new Error(`basePath must start with \"/\": got ${basePath}`);\n  }\n  if (trimmed.includes(\"//\") || /[?#*]/.test(trimmed)) {\n    throw new Error(`basePath must be a plain path: got ${basePath}`);\n  }\n  return trimmed;\n}\n\n/**\n * Pull the endpoint name out of a URL path, or null if it isn't ours.\n *\n * The full path must match `<basePath>/<endpoint>` exactly. This used to\n * compare only the *last* segment, which meant `/anything/at/all/claim`\n * dispatched to `claim` and {@link PROTOCOL_PREFIX} was decorative — it\n * appeared in a 404 message and was never matched against. For the handler\n * that serves claim, result and heartbeat, dispatching on a suffix is a\n * looser rule than anyone reading the constant would assume, and loose\n * matching in a security surface should at least be a decision.\n *\n * The cost is that the mount point is now something a deployment has to state\n * rather than something that works by accident. That is the intended trade:\n * a 404 at startup naming the mount point beats a handler answering on paths\n * nobody meant to expose.\n */\nexport function routeEndpoint(\n  pathname: string,\n  basePath: string = PROTOCOL_PREFIX,\n): Endpoint | null {\n  const base = normalizeBasePath(basePath);\n  const path = pathname.endsWith(\"/\") ? pathname.slice(0, -1) : pathname;\n  if (!path.startsWith(`${base}/`)) return null;\n  const rest = path.slice(base.length + 1);\n  return (ENDPOINTS as readonly string[]).includes(rest)\n    ? (rest as Endpoint)\n    : null;\n}\n\n/**\n * Read the request signature from headers (byollm_009 §4.2).\n *\n * In headers rather than the body so the signature covers the body whole,\n * with no field to exclude from its own hash — a scheme that signs a body\n * minus one field has to agree, byte for byte, on how that field is removed.\n */\nexport function signatureFrom(headers: Headers): unknown {\n  const runnerId = headers.get(\"x-byollm-runner\");\n  const rawIssuedAt = headers.get(\"x-byollm-issued-at\");\n  const signature = headers.get(\"x-byollm-signature\");\n  if (runnerId === null || signature === null || rawIssuedAt === null) {\n    return undefined;\n  }\n  // Checked against null *before* Number(), because `Number(null)` is 0 —\n  // finite, plausible-looking, and wrong. A missing timestamp would have\n  // become a timestamp of the epoch, which the freshness check would then\n  // reject for the wrong reason.\n  const issuedAt = Number(rawIssuedAt);\n  if (!Number.isFinite(issuedAt)) return undefined;\n  return { runnerId, issuedAt, signature };\n}\n\n/**\n * A `Request` → `Response` handler for the whole protocol.\n *\n * Web-standard types, so this works unchanged in Next.js route handlers, Hono,\n * Bun, Deno, Cloudflare Workers, and anything else that speaks fetch.\n */\nexport function createFetchHandler(\n  config: HandlerConfig & {\n    /**\n     * Where these endpoints are mounted. Defaults to\n     * {@link PROTOCOL_PREFIX}; set it when the app serves them elsewhere.\n     */\n    readonly basePath?: string;\n  },\n): (request: Request) => Promise<Response> {\n  const handlers = new ByollmHandlers(config);\n  // Validate once, at construction: a bad mount point is a deployment bug and\n  // should surface when the server starts, not as a silent 404 per request.\n  const basePath = normalizeBasePath(config.basePath ?? PROTOCOL_PREFIX);\n\n  return async function handle(request: Request): Promise<Response> {\n    if (request.method !== \"POST\") {\n      return json(405, {\n        error: \"bad-request\",\n        message: \"protocol endpoints accept POST only\",\n      });\n    }\n\n    const endpoint = routeEndpoint(new URL(request.url).pathname, basePath);\n    if (endpoint === null) {\n      return json(404, {\n        error: \"not-found\",\n        message: `not a ${basePath} endpoint`,\n      });\n    }\n\n    const declared = request.headers.get(\"content-length\");\n    if (declared !== null && Number(declared) > MAX_BODY_BYTES) {\n      return json(400, {\n        error: \"bad-request\",\n        message: tooLarge(Number(declared)),\n      });\n    }\n\n    let body: unknown;\n    let rawBody: string;\n    try {\n      rawBody = await request.text();\n      const text = rawBody;\n      if (text.length > MAX_BODY_BYTES) {\n        return json(400, {\n          error: \"bad-request\",\n          message: tooLarge(text.length),\n        });\n      }\n      body = JSON.parse(text);\n    } catch {\n      // Deliberately not echoing the parse error: it would quote attacker\n      // input back into a response an operator later reads in a terminal.\n      return json(400, {\n        error: \"bad-request\",\n        message: \"request body is not valid JSON\",\n      });\n    }\n\n    // byollm_009 §4: version before anything else. A mismatch must name the\n    // disagreement and the fix, not surface as a generic bad-request from a\n    // schema literal buried in an endpoint — which is what happened before,\n    // and is why \"the connection is versionless\" was listed as a defect.\n    const refusal = checkProtocolVersion(body);\n    if (refusal) {\n      return json(ERROR_STATUS[refusal.error], refusal);\n    }\n\n    const result = await handlers.handle(endpoint, body, {\n      endpoint,\n      // The bytes as received. Re-serialising the parsed object would verify\n      // a signature over something the sender never sent.\n      rawBody,\n      signature: signatureFrom(request.headers),\n    });\n\n    const headers: Record<string, string> = {\n      \"content-type\": \"application/json\",\n      \"cache-control\": \"no-store\",\n    };\n    if (result.retryAfterSeconds !== undefined) {\n      headers[\"retry-after\"] = String(result.retryAfterSeconds);\n    }\n    return new Response(JSON.stringify(result.body), {\n      status: result.status,\n      headers,\n    });\n  };\n}\n\nfunction json(status: number, body: unknown): Response {\n  return new Response(JSON.stringify(body), {\n    status,\n    headers: {\n      \"content-type\": \"application/json\",\n      \"cache-control\": \"no-store\",\n    },\n  });\n}\n"],"mappings":";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAUP,IAAM,qBAAqB;AAGpB,SAAS,qBAA6B;AAC3C,SAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AAC7C;AAGO,SAAS,mBAA2B;AACzC,SAAO,UAAU,WAAW,CAAC;AAC/B;AAGO,SAAS,gBAAwB;AAStC,SAAO,WAAW;AACpB;AAMO,SAAS,mBAA2B;AACzC,QAAM,QAAkB,CAAC;AACzB,SAAO,MAAM,SAAS,GAAG;AACvB,eAAW,QAAQ,YAAY,EAAE,GAAG;AAGlC,YAAM,QAAQ,MAAO,MAAM,mBAAmB;AAC9C,UAAI,QAAQ,MAAO;AACnB,YAAM,SAAS,mBAAmB,OAAO,mBAAmB,MAAM;AAClE,UAAI,WAAW,OAAW;AAC1B,YAAM,KAAK,MAAM;AACjB,UAAI,MAAM,WAAW,EAAG;AAAA,IAC1B;AAAA,EACF;AACA,SAAO,GAAG,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;AACjE;AAGO,SAAS,WAAW,QAAwB;AACjD,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,MAAM,EAAE,OAAO,KAAK;AACjE;AAMO,SAAS,aAAa,MAAc,MAAuB;AAChE,MAAI,KAAK,WAAW,KAAK,OAAQ,QAAO;AACxC,SAAO,gBAAgB,OAAO,KAAK,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,KAAK,CAAC;AAC3E;AAUO,IAAM,kBAAkB,MAAc,WAAW;;;ACnFxD,SAAS,qBAAsC;AA4BxC,SAAS,kBAAkB,OAUhB;AAChB,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,MAAM,SAAS;AAAA,EACrC,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,KAAK,uCAAuC;AAAA,EAClE;AAEA,QAAM,SAAS,cAAc,UAAU,MAAM;AAC7C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,EAAE,IAAI,OAAO,KAAK,uCAAuC;AAAA,EAClE;AAEA,MAAI,OAAO,KAAK,QAAQ,YAAY,MAAM,aAAa;AACrD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,KAAK;AAAA,IACP;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,OAAO,OAAO,KAAK;AACxC;;;AC1DA;AAAA,EACE;AAAA,EAEA,SAAAA;AAAA,EACA,QAAAC;AAAA,EACA,oBAAAC;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OASK;;;AChCP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AA0BP,eAAsB,gBAAgB,OAUZ;AACxB,QAAM,cAAc,MAAM,iBAAiB,MAAM,QAAQ,EAAE,QAAQ;AAEnE,QAAM,SAAS,MAAM,KAAK;AAAA,IACxB,UAAU,MAAM,IAAI;AAAA,IACpB,eAAe,MAAM;AAAA,IACrB,sBAAsB,MAAM,SAAS;AAAA,IACrC,UAAU;AAAA,MACR,OAAO,MAAM,IAAI;AAAA,MACjB;AAAA,MACA,gBAAgB;AAAA,MAChB,WAAW;AAAA,IACb;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AAId,WAAO,EAAE,IAAI,OAAO,QAAQ,aAAa;AAAA,EAC3C;AAEA,QAAM,WAAW,MAAM,KAAK;AAAA,IAC1B,WAAW,OAAO;AAAA,IAClB,YAAY,MAAM;AAAA,IAClB,2BAA2B,MAAM,OAAO;AAAA,IACxC,SAAS;AAAA,MACP,OAAO,MAAM,IAAI;AAAA,MACjB;AAAA,MACA,gBAAgB,MAAM,MAAM,OAAO,QAAQ;AAAA;AAAA;AAAA,MAG3C,YAAY,MAAM,IAAI,YAAY;AAAA,MAClC,WAAW;AAAA,IACb;AAAA,EACF,CAAC;AACD,SAAO,EAAE,IAAI,MAAM,SAAS;AAC9B;;;ACkLO,SAAS,YACd,KACA,KACQ;AACR,SAAO,IAAI,eAAe,IAAI,eAAe,OAAO,IAAI;AAC1D;;;AFtLA,IAAM,WAAW;AAAA,EACf,SAAS;AAAA,EACT,cAAc,KAAK;AAAA,EACnB,gBAAgB;AAClB;AAUA,SAAS,KACP,OACA,SACA,mBACe;AACf,SAAO;AAAA,IACL,QAAQ,aAAa,KAAK;AAAA,IAC1B,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,GAAI,sBAAsB,SACtB,CAAC,IACD,EAAE,YAAY,kBAAkB;AAAA,IACtC;AAAA,IACA,GAAI,sBAAsB,SAAY,CAAC,IAAI,EAAE,kBAAkB;AAAA,EACjE;AACF;AAEA,SAAS,GAAG,MAA8B;AACxC,SAAO,EAAE,QAAQ,KAAK,KAAK;AAC7B;AAUO,IAAM,iBAAN,MAAqB;AAAA,EACjB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,QAAuB;AACjC,SAAK,SAAS,OAAO;AAGrB,QAAI,CAAC,qBAAqBC,kBAAiB,OAAO,QAAQ,CAAC,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR;AAAA,MAGF;AAAA,IACF;AACA,SAAK,YAAY,OAAO;AACxB,SAAK,aAAaC,OAAMD,kBAAiB,OAAO,QAAQ,EAAE,QAAQ;AAClE,SAAK,mBAAmB,OAAO;AAC/B,SAAK,WAAW,OAAO,WAAW,SAAS;AAC3C,SAAK,gBAAgB,OAAO,gBAAgB,SAAS;AACrD,SAAK,kBAAkB,OAAO,kBAAkB,SAAS;AACzD,SAAK,OAAO,OAAO,OAAO,KAAK;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,OACJ,UACA,MACA,MACwB;AACxB,YAAQ,UAAU;AAAA,MAChB,KAAK;AACH,eAAO,KAAK,MAAM,IAAI;AAAA,MACxB,KAAK;AACH,eAAO,KAAK,QAAQ,MAAM,MAAM,cAAc,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MACtE,KAAK;AAYH,eAAO,KAAK;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,WAAW,KAAK,IAAI;AAAA,QAC3B;AAAA,MACF,KAAK;AACH,eAAO,KAAK,QAAQ,MAAM,MAAM,cAAc,KAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MACtE,KAAK;AACH,eAAO,KAAK,QAAQ,MAAM,MAAM,eAAe,KAAK,QAAQ,KAAK,IAAI,CAAC;AAAA,MACxE,KAAK;AACH,eAAO,KAAK;AAAA,UACV;AAAA,UACA;AAAA,UACA;AAAA,UACA,KAAK,SAAS,KAAK,IAAI;AAAA,QACzB;AAAA,IACJ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,QACJ,MACA,MACA,QACA,KACA,UAAsC,CAAC,GACf;AACxB,UAAM,YAAY,iBAAiB,UAAU,KAAK,SAAS;AAC3D,QAAI,CAAC,UAAU,SAAS;AACtB,aAAO,KAAK,gBAAgB,4BAA4B;AAAA,IAC1D;AAEA,UAAM,SAAS,MAAM,KAAK,OAAO,UAAU,UAAU,KAAK,QAAQ;AAClE,QAAI,CAAC,QAAQ;AACX,aAAO,KAAK,gBAAgB,+BAA+B;AAAA,IAC7D;AAKA,UAAM,UAAU,cAAc;AAAA,MAC5B,gBAAgB,OAAO,OAAO;AAAA,MAC9B,UAAU,KAAK;AAAA,MACf,MAAM,KAAK;AAAA,MACX,WAAW,UAAU;AAAA,MACrB,KAAK,KAAK,KAAK;AAAA,IACjB,CAAC;AACD,QAAI,YAAY,MAAM;AAIpB,aAAO,KAAK,gBAAgB,uCAAuC;AAAA,IACrE;AACA,QAAI,OAAO,cAAc,QAAQ,QAAQ,iBAAiB,MAAM;AAG9D,aAAO,KAAK,WAAW,2CAA2C;AAAA,IACpE;AAEA,UAAM,SAAS,OAAO,UAAU,IAAI;AACpC,QAAI,CAAC,OAAO,WAAW,OAAO,SAAS,QAAW;AAChD,aAAO,KAAK,eAAe,uCAAuC;AAAA,IACpE;AACA,WAAO,IAAI,OAAO,MAAM,MAAM;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAM,OACJ,SACA,QACwB;AACxB,UAAM,MAAM,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK;AAC/C,QACE,CAAC,OACD,IAAI,OAAO,aAAa,OAAO,MAC/B,IAAI,MAAM,OAAO,QAAQ,SACzB;AAGA,aAAO,KAAK,aAAa,2BAA2B;AAAA,IACtD;AAIA,UAAM,WAAW,MAAM,gBAAgB;AAAA,MACrC,UAAU,KAAK;AAAA,MACf,KAAK,EAAE,IAAI,IAAI,IAAI,UAAU,IAAI,UAAU,WAAW,IAAI,UAAU;AAAA,MACpE,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO,KAAK,gBAAgB,wCAAwC;AAAA,IACtE;AACA,WAAO,GAAG,EAAE,UAAU,SAAS,SAAS,CAAyB;AAAA,EACnE;AAAA;AAAA,EAIA,MAAM,MAAM,MAAuC;AACjD,UAAM,SAAS,YAAY,UAAU,IAAI;AACzC,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,eAAe,uCAAuC;AAAA,IACpE;AACA,UAAM,UAAU,OAAO;AACvB,UAAM,MAAM,KAAK,KAAK;AAEtB,QAAI,QAAQ,WAAW,SAAS;AAC9B,YAAM,aAAa,mBAAmB;AACtC,YAAM,WAAW,iBAAiB;AAClC,YAAM,YAAY,MAAM,KAAK;AAM7B,UAAI,CAAC,qBAAqB,QAAQ,MAAM,GAAG;AACzC,eAAO;AAAA,UACL;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAEA,YAAM,KAAK,OAAO,cAAc;AAAA,QAC9B,QAAQ,QAAQ;AAAA,QAChB,gBAAgB,WAAW,UAAU;AAAA,QACrC;AAAA,QACA,OAAO;AAAA,QACP,OAAO;AAAA,QACP,UAAU;AAAA,QACV,WAAW;AAAA,QACX,OAAO,QAAQ,OAAO;AAAA,QACtB,UAAU,QAAQ,OAAO;AAAA,QACzB,eAAe,QAAQ,OAAO;AAAA,QAC9B,cAAc,QAAQ;AAAA,QACtB;AAAA,QACA,WAAW;AAAA,MACb,CAAC;AAED,YAAM,WAA8B;AAAA,QAClC;AAAA,QACA;AAAA,QACA,iBAAiB,KAAK;AAAA,QACtB;AAAA,QACA,gBAAgB,KAAK;AAAA,MACvB;AACA,aAAO,GAAG,QAAQ;AAAA,IACpB;AAGA,UAAM,UAAU,MAAM,KAAK,OAAO;AAAA,MAChC,WAAW,QAAQ,UAAU;AAAA,IAC/B;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,KAAK,aAAa,qBAAqB;AAAA,IAChD;AACA,QAAI,QAAQ,UAAU,UAAU;AAC9B,aAAO,GAAG,EAAE,QAAQ,SAAS,CAA4B;AAAA,IAC3D;AAGA,QAAI,QAAQ,aAAa,OAAO,QAAQ,UAAU,WAAW;AAC3D,aAAO,GAAG,EAAE,QAAQ,UAAU,CAA4B;AAAA,IAC5D;AACA,QACE,QAAQ,UAAU,cAClB,CAAC,QAAQ,aACT,QAAQ,aAAa,QACrB,QAAQ,UAAU,MAClB;AACA,YAAM,WAA6B;AAAA,QACjC,QAAQ;AAAA,QACR,UAAU,QAAQ;AAAA,QAClB,OAAO,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQf,OAAO,EAAE,CAAC,KAAK,UAAU,GAAGA,kBAAiB,KAAK,SAAS,EAAE;AAAA,MAC/D;AAEA,YAAM,KAAK,OAAO,oBAAoB,QAAQ,cAAc;AAC5D,aAAO,GAAG,QAAQ;AAAA,IACpB;AACA,QAAI,QAAQ,UAAU,YAAY;AAChC,aAAO,KAAK,aAAa,yCAAyC;AAAA,IACpE;AACA,WAAO,GAAG,EAAE,QAAQ,UAAU,CAA4B;AAAA,EAC5D;AAAA;AAAA,EAIA,MAAM,OACJ,SACA,QACwB;AACxB,QAAI,QAAQ,aAAa,OAAO,IAAI;AAClC,aAAO,KAAK,gBAAgB,0CAA0C;AAAA,IACxE;AACA,UAAM,MAAM,KAAK,KAAK;AAKtB,UAAM,OAAO,MAAM,KAAK,OAAO,MAAM;AAAA,MACnC,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA,MACpB,cAAc,QAAQ;AAAA,MACtB,KAAK,QAAQ;AAAA,MACb,SAAS,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AAED,UAAM,WAA0B;AAAA,MAC9B,MAAM,KAAK,IAAI,CAAC,SAAS;AAAA,QACvB,IAAI,IAAI;AAAA,QACR,MAAM,IAAI;AAAA,QACV,UAAU,IAAI;AAAA,QACd,OAAO,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOX,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA,QAIX,GAAI,IAAI,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,IAAI,QAAQ;AAAA;AAAA;AAAA,QAG5D,WAAW,IAAI;AAAA;AAAA,QAEf,WAAW;AAAA;AAAA;AAAA;AAAA,QAIX,YAAY,YAAY,KAAK,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAkBhC,OAAO,QAAQ,GAAG;AAAA,MACpB,EAAE;AAAA,MACF,SAAS,KAAK;AAAA,IAChB;AACA,WAAO,GAAG,QAAQ;AAAA,EACpB;AAAA;AAAA,EAIA,MAAM,WACJ,SACA,QACwB;AACxB,QAAI,QAAQ,aAAa,OAAO,IAAI;AAClC,aAAO,KAAK,gBAAgB,0CAA0C;AAAA,IACxE;AACA,UAAM,MAAM,KAAK,KAAK;AAMtB,UAAM,KAAK,OAAO,YAAY;AAAA,MAC5B,UAAU,OAAO;AAAA,MACjB,cAAc,QAAQ;AAAA,MACtB,eAAe,QAAQ;AAAA,MACvB,QAAQ,QAAQ;AAAA,MAChB;AAAA,IACF,CAAC;AAKD,UAAM,EAAE,KAAK,IAAI,MAAM,KAAK,OAAO,YAAY;AAAA,MAC7C,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,SAAS,KAAK;AAAA,MACd;AAAA,IACF,CAAC;AAED,UAAM,SAAS,MAAM,KAAK,OAAO,mBAAmB,OAAO,EAAE;AAE7D,UAAM,WAA8B;AAAA,MAClC,OAAO,EAAE,CAAC,KAAK,UAAU,GAAGA,kBAAiB,KAAK,SAAS,EAAE;AAAA;AAAA;AAAA,MAG7D,iBAAiB,CAAC;AAAA,MAClB,QAAQ,CAAC,GAAG,MAAM;AAAA,MAClB,MAAM,CAAC,GAAG,IAAI;AAAA,MACd,YAAY;AAAA,IACd;AACA,WAAO,GAAG,QAAQ;AAAA,EACpB;AAAA;AAAA,EAIA,MAAM,QACJ,SACA,QACwB;AACxB,QAAI,QAAQ,aAAa,OAAO,IAAI;AAClC,aAAO,KAAK,gBAAgB,0CAA0C;AAAA,IACxE;AACA,UAAM,MAAM,KAAK,KAAK;AACtB,UAAM,MAAM,MAAM,KAAK,OAAO,IAAI,QAAQ,KAAK;AAC/C,QAAI,CAAC,IAAK,QAAO,KAAK,aAAa,aAAa;AAEhD,UAAM,UAAU,MAAM,KAAK,YAAY,SAAS,MAAM;AACtD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAKhC,UAAM,aAAa,cAAc;AAAA,MAC/B,UAAU,IAAI;AAAA,MACd,UAAU,OAAO;AAAA,MACjB,aAAa,OAAO;AAAA;AAAA;AAAA;AAAA,MAIpB,cAAc,QAAQ,MAAM,IAAI;AAAA,MAChC,OAAO,QAAQ,MAAM,IAAI;AAAA,IAC3B,CAAC;AAED,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,KAAK;AAAA,IACP,IAAI,MAAM,KAAK,OAAO,SAAS;AAAA,MAC7B,OAAO,QAAQ;AAAA;AAAA;AAAA,MAGf,UAAU,OAAO;AAAA;AAAA;AAAA;AAAA,MAIjB,QAAQ,EAAE,IAAI,SAAS,SAAS,QAAQ,QAAQ;AAAA,MAChD,SAAS,QAAQ,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,IACF,CAAC;AAED,UAAM,WAA2B;AAAA,MAC/B;AAAA;AAAA;AAAA;AAAA,MAIA,GAAI,cAAc,OAAO,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,MAChD,OAAO,SAAS,SAAS,IAAI;AAAA,IAC/B;AACA,WAAO,GAAG,QAAQ;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,YACJ,SACA,QAGA;AACA,UAAM,SAAS,CAAC,SACb,EAAE,IAAI,OAAgB,SAAS,KAAK,eAAe,GAAG,EAAE;AAE3D,UAAM,SAAS,MAAME,MAAK;AAAA,MACxB,UAAU,QAAQ;AAAA,MAClB,eAAe,KAAK;AAAA,MACpB,sBAAsB,OAAO,OAAO;AAAA,MACpC,UAAU;AAAA,QACR,OAAO,QAAQ;AAAA,QACf,aAAaD,OAAM,OAAO,OAAO,QAAQ;AAAA,QACzC,gBAAgBA,OAAMD,kBAAiB,KAAK,SAAS,EAAE,QAAQ;AAAA,QAC/D,WAAW;AAAA,MACb;AAAA,IACF,CAAC;AACD,QAAI,CAAC,OAAO,IAAI;AACd,aAAO,OAAO,sDAAsD;AAAA,IACtE;AAIA,UAAM,UAAU,kBAAkB;AAAA,MAChC,WAAW,OAAO;AAAA,MAClB,aAAa,QAAQ;AAAA,IACvB,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,OAAO,QAAQ,GAAG;AAC1C,WAAO,EAAE,IAAI,MAAM,OAAO,QAAQ,MAAM;AAAA,EAC1C;AAAA;AAAA,EAIA,MAAM,SACJ,SACA,QACwB;AACxB,QAAI,QAAQ,aAAa,OAAO,IAAI;AAClC,aAAO,KAAK,gBAAgB,0CAA0C;AAAA,IACxE;AACA,UAAM,WAAW,MAAM,KAAK,OAAO,QAAQ;AAAA,MACzC,UAAU,OAAO;AAAA,MACjB,QAAQ,QAAQ;AAAA,MAChB,QAAQ,QAAQ;AAAA,MAChB,KAAK,KAAK,KAAK;AAAA,IACjB,CAAC;AACD,UAAM,WAA4B,EAAE,SAAS;AAC7C,WAAO,GAAG,QAAQ;AAAA,EACpB;AACF;AAGO,IAAM,0BAA0B;AAGvC,SAAS,QAAQ,KAAiD;AAChE,MAAI,CAAC,IAAI,OAAO;AACd,UAAM,IAAI;AAAA,MACR,sBAAsB,IAAI,EAAE;AAAA,IAE9B;AAAA,EACF;AACA,SAAO,IAAI;AACb;;;AG7oBA;AAAA,EACE;AAAA,EACA,gBAAAG;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAoBP,IAAM,iBAAiB,qBAAqB,MAAM;AAkBlD,IAAM,WAAW,CAAC,UAChB,gBAAgB,EAAE,OAAO,OAAO,eAAe,CAAC;AAalD,SAAS,kBAAkB,UAA0B;AACnD,QAAM,UAAU,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AACjE,MAAI,CAAC,QAAQ,WAAW,GAAG,GAAG;AAC5B,UAAM,IAAI,MAAM,qCAAqC,QAAQ,EAAE;AAAA,EACjE;AACA,MAAI,QAAQ,SAAS,IAAI,KAAK,QAAQ,KAAK,OAAO,GAAG;AACnD,UAAM,IAAI,MAAM,sCAAsC,QAAQ,EAAE;AAAA,EAClE;AACA,SAAO;AACT;AAkBO,SAAS,cACd,UACA,WAAmB,iBACF;AACjB,QAAM,OAAO,kBAAkB,QAAQ;AACvC,QAAM,OAAO,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC9D,MAAI,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,EAAG,QAAO;AACzC,QAAM,OAAO,KAAK,MAAM,KAAK,SAAS,CAAC;AACvC,SAAQ,UAAgC,SAAS,IAAI,IAChD,OACD;AACN;AASO,SAAS,cAAc,SAA2B;AACvD,QAAM,WAAW,QAAQ,IAAI,iBAAiB;AAC9C,QAAM,cAAc,QAAQ,IAAI,oBAAoB;AACpD,QAAM,YAAY,QAAQ,IAAI,oBAAoB;AAClD,MAAI,aAAa,QAAQ,cAAc,QAAQ,gBAAgB,MAAM;AACnE,WAAO;AAAA,EACT;AAKA,QAAM,WAAW,OAAO,WAAW;AACnC,MAAI,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO;AACvC,SAAO,EAAE,UAAU,UAAU,UAAU;AACzC;AAQO,SAAS,mBACd,QAOyC;AACzC,QAAM,WAAW,IAAI,eAAe,MAAM;AAG1C,QAAM,WAAW,kBAAkB,OAAO,YAAY,eAAe;AAErE,SAAO,eAAe,OAAO,SAAqC;AAChE,QAAI,QAAQ,WAAW,QAAQ;AAC7B,aAAO,KAAK,KAAK;AAAA,QACf,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,cAAc,IAAI,IAAI,QAAQ,GAAG,EAAE,UAAU,QAAQ;AACtE,QAAI,aAAa,MAAM;AACrB,aAAO,KAAK,KAAK;AAAA,QACf,OAAO;AAAA,QACP,SAAS,SAAS,QAAQ;AAAA,MAC5B,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,QAAQ,QAAQ,IAAI,gBAAgB;AACrD,QAAI,aAAa,QAAQ,OAAO,QAAQ,IAAI,gBAAgB;AAC1D,aAAO,KAAK,KAAK;AAAA,QACf,OAAO;AAAA,QACP,SAAS,SAAS,OAAO,QAAQ,CAAC;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,QAAI;AACJ,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAK;AAC7B,YAAM,OAAO;AACb,UAAI,KAAK,SAAS,gBAAgB;AAChC,eAAO,KAAK,KAAK;AAAA,UACf,OAAO;AAAA,UACP,SAAS,SAAS,KAAK,MAAM;AAAA,QAC/B,CAAC;AAAA,MACH;AACA,aAAO,KAAK,MAAM,IAAI;AAAA,IACxB,QAAQ;AAGN,aAAO,KAAK,KAAK;AAAA,QACf,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AAAA,IACH;AAMA,UAAM,UAAU,qBAAqB,IAAI;AACzC,QAAI,SAAS;AACX,aAAO,KAAKC,cAAa,QAAQ,KAAK,GAAG,OAAO;AAAA,IAClD;AAEA,UAAM,SAAS,MAAM,SAAS,OAAO,UAAU,MAAM;AAAA,MACnD;AAAA;AAAA;AAAA,MAGA;AAAA,MACA,WAAW,cAAc,QAAQ,OAAO;AAAA,IAC1C,CAAC;AAED,UAAM,UAAkC;AAAA,MACtC,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AACA,QAAI,OAAO,sBAAsB,QAAW;AAC1C,cAAQ,aAAa,IAAI,OAAO,OAAO,iBAAiB;AAAA,IAC1D;AACA,WAAO,IAAI,SAAS,KAAK,UAAU,OAAO,IAAI,GAAG;AAAA,MAC/C,QAAQ,OAAO;AAAA,MACf;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,KAAK,QAAgB,MAAyB;AACrD,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;AAAA,IACxC;AAAA,IACA,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;","names":["keyId","open","publicIdentityOf","publicIdentityOf","keyId","open","ERROR_STATUS","ERROR_STATUS"]}

package/dist/{chunk-7RKXFPBZ.js → chunk-I3ER27QG.js}

@@ -41,15 +41,17 @@ var PollingDelivery = class {
       options.signal?.throwIfAborted();
       const current = await this.#deps.read(jobId);
       if (current && isTerminalState(current.state)) return current;
-      const availability = await this.#deps.availability(jobId);
-      if (availability.available || availability.blocked) {
+      const availability = await this.#deps.availability?.(jobId);
+      if (availability === void 0 || availability.available || availability.blocked) {
         noRunnerSince = null;
       } else {
         noRunnerSince ??= now();
         if (now() - noRunnerSince >= graceMs) {
           const reason = availability.reason ?? "no-runner-online";
           const substitute = await options.onNoRunner?.(reason);
-          if (substitute) return substitute;
+          if (substitute !== void 0) {
+            return labelFallback(jobId, substitute);
+          }
           throw new NoRunnerAvailableError(jobId, reason);
         }
       }
@@ -63,10 +65,22 @@ var PollingDelivery = class {
 function isTerminalState(state) {
   return state === "ok" || state === "error" || state === "canceled" || state === "expired";
 }
+function labelFallback(jobId, substitute) {
+  if (typeof substitute === "string") {
+    return {
+      jobId,
+      state: "ok",
+      outcome: { outcome: "ok", text: substitute },
+      fallback: true
+    };
+  }
+  return { ...substitute, fallback: true };
+}
 
 export {
   NoRunnerAvailableError,
   ResultTimeoutError,
-  PollingDelivery
+  PollingDelivery,
+  labelFallback
 };
-//# sourceMappingURL=chunk-7RKXFPBZ.js.map
+//# sourceMappingURL=chunk-I3ER27QG.js.map

package/dist/chunk-I3ER27QG.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/delivery.ts"],"sourcesContent":["import type { DeliveredResult } from \"@byollm/protocol\";\n\n/** Why a wait ended without a result. */\nexport class NoRunnerAvailableError extends Error {\n  override readonly name = \"NoRunnerAvailableError\";\n  constructor(\n    readonly jobId: string,\n    readonly reason: string,\n  ) {\n    super(\n      `no runner is available to execute job ${jobId} (${reason}). ` +\n        `Fall back to a hosted model, or prompt the user to start their runner.`,\n    );\n  }\n}\n\n/** The wait exceeded its timeout while a runner was still plausibly working. */\nexport class ResultTimeoutError extends Error {\n  override readonly name = \"ResultTimeoutError\";\n  constructor(\n    readonly jobId: string,\n    readonly timeoutMs: number,\n  ) {\n    super(`job ${jobId} did not finish within ${String(timeoutMs)}ms`);\n  }\n}\n\nexport interface WaitOptions {\n  /** Give up after this long. Default 5 minutes. */\n  readonly timeoutMs?: number;\n  /**\n   * Called instead of throwing when no runner can take the job. Return a\n   * substitute and the wait resolves with it; return nothing and\n   * {@link NoRunnerAvailableError} is thrown.\n   *\n   * **A string is enough.** It is the app's own fallback answer — a hosted\n   * model's text, a cached reply — not wire data, and requiring a whole\n   * `DeliveredResult` for it was ceremony that invited invented shapes. The\n   * README's own example got it wrong, which is how this was found.\n   *\n   * **Whatever comes back is labelled `fallback: true` by the wait, not by\n   * the caller** — {@link MUSTS.FALLBACK_LABELED}. Work that did not come\n   * from the user's own compute must not be reportable as though it did, and\n   * that stays true whether an app returns a bare string or a full record it\n   * assembled itself. The stamp is applied after this function returns, so\n   * there is no shape an app can hand back that hides what it is.\n   */\n  readonly onNoRunner?: (\n    reason: string,\n  ) =>\n    | string\n    | DeliveredResult\n    | undefined\n    | Promise<string | DeliveredResult | undefined>;\n  /** Abort the wait. */\n  readonly signal?: AbortSignal;\n}\n\n/**\n * How an app learns a job finished.\n *\n * byollm_003 Rev 1 is explicit that this is a *channel* — webhook, Realtime\n * subscription, or poll — and never an implied in-request `await`. The\n * polling implementation below is the portable default; the Supabase adapter\n * substitutes Realtime for the same interface.\n */\nexport interface ResultDelivery {\n  waitFor(jobId: string, options?: WaitOptions): Promise<DeliveredResult>;\n}\n\nexport interface PollingDeliveryDeps {\n  /** Current state of the job, or null if unknown. */\n  readonly read: (jobId: string) => Promise<DeliveredResult | null>;\n  /**\n   * Whether a runner could still take this job — **when there is anybody to\n   * ask.**\n   *\n   * Optional since alpha.66, and its absence is the answer rather than a\n   * missing dependency. On the cloud lane nothing writes runners into this\n   * site's store: devices pair with the relay, so the question has no local\n   * answer and `runnerAvailability` refuses to invent one.\n   *\n   * The refusal was correct and it landed in a loop that asked every 500ms.\n   * `job.result()` threw on its first poll for every cloud-lane site — a\n   * refusal aimed at outsiders that our own delivery tripped over.\n   *\n   * Not fixed by catching the throw here. That is a swallowed error in\n   * costume, and a catch wide enough to hold it would also eat a store that\n   * had genuinely gone away. The instrument is simply not handed over on a\n   * lane where it cannot see, and this loop does not ask a question nobody\n   * can answer.\n   */\n  readonly availability?: (\n    jobId: string,\n  ) => Promise<{ available: boolean; reason?: string; blocked: boolean }>;\n  readonly sleep?: (ms: number) => Promise<void>;\n  /**\n   * Injectable clock. It must advance in step with {@link sleep}: a test that\n   * stubs one and not the other gets a loop whose grace window never elapses.\n   */\n  readonly now?: () => number;\n  /**\n   * How long a sustained no-runner signal must persist before it is believed.\n   * Defaults to {@link NO_RUNNER_GRACE_MS}.\n   */\n  readonly graceMs?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 5 * 60_000;\nconst POLL_INTERVAL_MS = 500;\n/**\n * How long to let a job sit with no available runner before giving up.\n *\n * Not zero: a daemon restarting, or one whose heartbeat is momentarily late,\n * would otherwise fail every job in flight. The signal has to be sustained\n * before it is believed.\n */\nconst NO_RUNNER_GRACE_MS = 10_000;\n\nconst defaultSleep = (ms: number): Promise<void> =>\n  new Promise((resolve) => setTimeout(resolve, ms));\n\n/**\n * The portable delivery channel: poll the store until the job is terminal.\n *\n * Correct everywhere and adequate for most apps. An adapter with a push\n * channel should replace it — see the Supabase adapter's Realtime delivery.\n */\nexport class PollingDelivery implements ResultDelivery {\n  readonly #deps: PollingDeliveryDeps;\n\n  constructor(deps: PollingDeliveryDeps) {\n    this.#deps = deps;\n  }\n\n  async waitFor(\n    jobId: string,\n    options: WaitOptions = {},\n  ): Promise<DeliveredResult> {\n    const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    const sleep = this.#deps.sleep ?? defaultSleep;\n    const now = this.#deps.now ?? Date.now;\n    const graceMs = this.#deps.graceMs ?? NO_RUNNER_GRACE_MS;\n    const started = now();\n    let noRunnerSince: number | null = null;\n\n    for (;;) {\n      options.signal?.throwIfAborted();\n\n      const current = await this.#deps.read(jobId);\n      if (current && isTerminalState(current.state)) return current;\n\n      /**\n       * The no-runner signal, when this deployment has one.\n       *\n       * With no instrument there is no sustained-absence signal and no\n       * `NoRunnerAvailableError` — the wait ends when the job reaches a\n       * terminal state or the timeout does. That is the honest behaviour on\n       * the cloud lane, where an unsatisfiable slot is refused at enqueue and\n       * a job with nowhere to run expires, both of which arrive through\n       * `read` as states rather than as guesses made here.\n       */\n      const availability = await this.#deps.availability?.(jobId);\n      if (\n        availability === undefined ||\n        availability.available ||\n        availability.blocked\n      ) {\n        // `blocked` means the job is waiting on a dependency, which is not the\n        // same event as \"nobody can run this\" ({@link MUSTS.NO_RUNNER_SIGNAL}).\n        noRunnerSince = null;\n      } else {\n        noRunnerSince ??= now();\n        if (now() - noRunnerSince >= graceMs) {\n          const reason = availability.reason ?? \"no-runner-online\";\n          const substitute = await options.onNoRunner?.(reason);\n          if (substitute !== undefined) {\n            return labelFallback(jobId, substitute);\n          }\n          throw new NoRunnerAvailableError(jobId, reason);\n        }\n      }\n\n      if (now() - started >= timeoutMs) {\n        throw new ResultTimeoutError(jobId, timeoutMs);\n      }\n      await sleep(POLL_INTERVAL_MS);\n    }\n  }\n}\n\nfunction isTerminalState(state: string): boolean {\n  return (\n    state === \"ok\" ||\n    state === \"error\" ||\n    state === \"canceled\" ||\n    state === \"expired\"\n  );\n}\n\n/**\n * Turn an app's fallback into a delivered result, marked as one.\n *\n * Exported because there are two delivery channels — polling here, Supabase\n * Realtime next door — and a label applied by one of them is a label an app\n * gets or does not get depending on which store it chose. That is exactly the\n * kind of divergence a \"delivery adapter must not change what a result means\"\n * rule exists to prevent.\n *\n * Two jobs, and the second is the one that matters. A string becomes the\n * obvious record — that is the sugar. Everything, string or record, gets\n * `fallback: true` — that is {@link MUSTS.FALLBACK_LABELED}, and it is\n * applied here rather than trusted from the caller because an app that\n * assembled its own record could otherwise return something indistinguishable\n * from a runner's answer. Spreading the caller's object first and the flag\n * second is deliberate: a supplied `fallback` cannot overwrite it.\n */\nexport function labelFallback(\n  jobId: string,\n  substitute: string | DeliveredResult,\n): DeliveredResult {\n  if (typeof substitute === \"string\") {\n    return {\n      jobId,\n      state: \"ok\",\n      outcome: { outcome: \"ok\", text: substitute },\n      fallback: true,\n    };\n  }\n  return { ...substitute, fallback: true };\n}\n"],"mappings":";AAGO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAEhD,YACW,OACA,QACT;AACA;AAAA,MACE,yCAAyC,KAAK,KAAK,MAAM;AAAA,IAE3D;AANS;AACA;AAAA,EAMX;AAAA,EAPW;AAAA,EACA;AAAA,EAHO,OAAO;AAU3B;AAGO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAE5C,YACW,OACA,WACT;AACA,UAAM,OAAO,KAAK,0BAA0B,OAAO,SAAS,CAAC,IAAI;AAHxD;AACA;AAAA,EAGX;AAAA,EAJW;AAAA,EACA;AAAA,EAHO,OAAO;AAO3B;AAmFA,IAAM,qBAAqB,IAAI;AAC/B,IAAM,mBAAmB;AAQzB,IAAM,qBAAqB;AAE3B,IAAM,eAAe,CAAC,OACpB,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AAQ3C,IAAM,kBAAN,MAAgD;AAAA,EAC5C;AAAA,EAET,YAAY,MAA2B;AACrC,SAAK,QAAQ;AAAA,EACf;AAAA,EAEA,MAAM,QACJ,OACA,UAAuB,CAAC,GACE;AAC1B,UAAM,YAAY,QAAQ,aAAa;AACvC,UAAM,QAAQ,KAAK,MAAM,SAAS;AAClC,UAAM,MAAM,KAAK,MAAM,OAAO,KAAK;AACnC,UAAM,UAAU,KAAK,MAAM,WAAW;AACtC,UAAM,UAAU,IAAI;AACpB,QAAI,gBAA+B;AAEnC,eAAS;AACP,cAAQ,QAAQ,eAAe;AAE/B,YAAM,UAAU,MAAM,KAAK,MAAM,KAAK,KAAK;AAC3C,UAAI,WAAW,gBAAgB,QAAQ,KAAK,EAAG,QAAO;AAYtD,YAAM,eAAe,MAAM,KAAK,MAAM,eAAe,KAAK;AAC1D,UACE,iBAAiB,UACjB,aAAa,aACb,aAAa,SACb;AAGA,wBAAgB;AAAA,MAClB,OAAO;AACL,0BAAkB,IAAI;AACtB,YAAI,IAAI,IAAI,iBAAiB,SAAS;AACpC,gBAAM,SAAS,aAAa,UAAU;AACtC,gBAAM,aAAa,MAAM,QAAQ,aAAa,MAAM;AACpD,cAAI,eAAe,QAAW;AAC5B,mBAAO,cAAc,OAAO,UAAU;AAAA,UACxC;AACA,gBAAM,IAAI,uBAAuB,OAAO,MAAM;AAAA,QAChD;AAAA,MACF;AAEA,UAAI,IAAI,IAAI,WAAW,WAAW;AAChC,cAAM,IAAI,mBAAmB,OAAO,SAAS;AAAA,MAC/C;AACA,YAAM,MAAM,gBAAgB;AAAA,IAC9B;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,SACE,UAAU,QACV,UAAU,WACV,UAAU,cACV,UAAU;AAEd;AAmBO,SAAS,cACd,OACA,YACiB;AACjB,MAAI,OAAO,eAAe,UAAU;AAClC,WAAO;AAAA,MACL;AAAA,MACA,OAAO;AAAA,MACP,SAAS,EAAE,SAAS,MAAM,MAAM,WAAW;AAAA,MAC3C,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,GAAG,YAAY,UAAU,KAAK;AACzC;","names":[]}

package/dist/{delivery-36nIe-b3.d.ts → delivery-CaGbp0Tc.d.ts}

@@ -19,10 +19,22 @@ interface WaitOptions {
     readonly timeoutMs?: number;
     /**
      * Called instead of throwing when no runner can take the job. Return a
-     * substitute result (a hosted-model answer, say) and the wait resolves with
-     * it; return nothing and {@link NoRunnerAvailableError} is thrown.
+     * substitute and the wait resolves with it; return nothing and
+     * {@link NoRunnerAvailableError} is thrown.
+     *
+     * **A string is enough.** It is the app's own fallback answer — a hosted
+     * model's text, a cached reply — not wire data, and requiring a whole
+     * `DeliveredResult` for it was ceremony that invited invented shapes. The
+     * README's own example got it wrong, which is how this was found.
+     *
+     * **Whatever comes back is labelled `fallback: true` by the wait, not by
+     * the caller** — {@link MUSTS.FALLBACK_LABELED}. Work that did not come
+     * from the user's own compute must not be reportable as though it did, and
+     * that stays true whether an app returns a bare string or a full record it
+     * assembled itself. The stamp is applied after this function returns, so
+     * there is no shape an app can hand back that hides what it is.
      */
-    readonly onNoRunner?: (reason: string) => DeliveredResult | undefined | Promise<DeliveredResult | undefined>;
+    readonly onNoRunner?: (reason: string) => string | DeliveredResult | undefined | Promise<string | DeliveredResult | undefined>;
     /** Abort the wait. */
     readonly signal?: AbortSignal;
 }
@@ -40,8 +52,26 @@ interface ResultDelivery {
 interface PollingDeliveryDeps {
     /** Current state of the job, or null if unknown. */
     readonly read: (jobId: string) => Promise<DeliveredResult | null>;
-    /** Whether a runner could still take this job. */
-    readonly availability: (jobId: string) => Promise<{
+    /**
+     * Whether a runner could still take this job — **when there is anybody to
+     * ask.**
+     *
+     * Optional since alpha.66, and its absence is the answer rather than a
+     * missing dependency. On the cloud lane nothing writes runners into this
+     * site's store: devices pair with the relay, so the question has no local
+     * answer and `runnerAvailability` refuses to invent one.
+     *
+     * The refusal was correct and it landed in a loop that asked every 500ms.
+     * `job.result()` threw on its first poll for every cloud-lane site — a
+     * refusal aimed at outsiders that our own delivery tripped over.
+     *
+     * Not fixed by catching the throw here. That is a swallowed error in
+     * costume, and a catch wide enough to hold it would also eat a store that
+     * had genuinely gone away. The instrument is simply not handed over on a
+     * lane where it cannot see, and this loop does not ask a question nobody
+     * can answer.
+     */
+    readonly availability?: (jobId: string) => Promise<{
         available: boolean;
         reason?: string;
         blocked: boolean;

package/dist/{handlers-DgW0QNTf.d.ts → handlers-CTV3Jc6Q.d.ts}

@@ -1,5 +1,5 @@
 import { StoredKeys, Endpoint } from '@byollm/protocol';
-import { B as ByollmStore } from './store-Cj5b6A9j.js';
+import { B as ByollmStore } from './store-Cx2_bck1.js';
 
 /** Everything a mount needs to serve the protocol. */
 /**
@@ -70,6 +70,6 @@ declare class ByollmHandlers {
     handle(endpoint: Endpoint, body: unknown, auth: AuthContext): Promise<HandlerResult>;
 }
 /** The protocol version this build speaks. */
-declare const SERVED_PROTOCOL_VERSION: "0";
+declare const SERVED_PROTOCOL_VERSION: "1";
 
 export { ByollmHandlers as B, type HandlerConfig as H, SERVED_PROTOCOL_VERSION as S, type HandlerResult as a };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { StoredKeys, JobKind, DeliveredResult, Endpoint, Capability } from '@byollm/protocol';
-import { P as PollingDeliveryDeps, R as ResultDelivery, W as WaitOptions } from './delivery-36nIe-b3.js';
-export { N as NoRunnerAvailableError, a as PollingDelivery, b as ResultTimeoutError } from './delivery-36nIe-b3.js';
-import { B as ByollmStore, J as JobRecord, E as EnqueueInput, R as RunnerRecord, S as StoredJobInput, C as ClaimArgs, a as RenewArgs, b as RenewResult, A as AdoptArgs, c as CompleteArgs, d as CompleteResult, e as ReleaseArgs, P as PairingRecord, f as ApproveArgs, T as TouchArgs } from './store-Cj5b6A9j.js';
-export { g as CompleteHolder, h as JobStore, i as RunnerStore } from './store-Cj5b6A9j.js';
-import { H as HandlerConfig } from './handlers-DgW0QNTf.js';
-export { B as ByollmHandlers, a as HandlerResult, S as SERVED_PROTOCOL_VERSION } from './handlers-DgW0QNTf.js';
+import { StoredKeys, JobKind, Audience, DeliveredResult, Endpoint, Capability } from '@byollm/protocol';
+import { P as PollingDeliveryDeps, R as ResultDelivery, W as WaitOptions } from './delivery-CaGbp0Tc.js';
+export { N as NoRunnerAvailableError, a as PollingDelivery, b as ResultTimeoutError } from './delivery-CaGbp0Tc.js';
+import { B as ByollmStore, J as JobRecord, E as EnqueueInput, R as RunnerRecord, S as StoredJobInput, C as ClaimArgs, a as RenewArgs, b as RenewResult, A as AdoptArgs, c as CompleteArgs, d as CompleteResult, e as ReleaseArgs, P as PairingRecord, f as ApproveArgs, T as TouchArgs } from './store-Cx2_bck1.js';
+export { g as CompleteHolder, h as JobStore, i as RunnerStore } from './store-Cx2_bck1.js';
+import { H as HandlerConfig } from './handlers-CTV3Jc6Q.js';
+export { B as ByollmHandlers, a as HandlerResult, S as SERVED_PROTOCOL_VERSION } from './handlers-CTV3Jc6Q.js';
 
 /**
  * The cloud lane — cloud_004 §9.4.
@@ -49,6 +49,44 @@ interface CloudLaneOptions {
     readonly fetch?: typeof fetch;
 }
 /** What one pump cycle did, for logging and for tests. */
+/**
+ * A relay that could not answer this request — alpha.31.
+ *
+ * `retryable` is the whole point: a draining pod and a bad signature are both
+ * failures, and treating them alike is how a site either falls over on every
+ * deploy or stays silently disconnected for a week.
+ */
+declare class RelayUnavailable extends Error {
+    readonly retryable: boolean;
+    /** The protocol's own code, when the relay sent one. */
+    readonly code: string;
+    constructor(message: string, retryable: boolean, code: string);
+}
+/**
+ * The job was not queued, and waiting will not change that.
+ *
+ * Distinct from {@link RelayUnavailable} because it is the opposite situation:
+ * the relay answered, promptly and correctly, and the answer is that this job
+ * has nowhere to go. Catching "the relay is down" to handle "nobody has chosen
+ * a model" would retry forever against a fact.
+ *
+ * Two codes, and they belong to two different people.
+ *
+ * `purpose-not-declared` is the site's own manifest. It names the purpose and
+ * the remedy, because a developer reading their own logs is entitled to both
+ * and neither says anything about a person.
+ *
+ * `slot-unsatisfiable` is the person's own dashboard, and says only that.
+ * Which service, whose device, whether one exists at all — none of it travels,
+ * and the sentence is the same for everybody. A site learns *that* a slot
+ * cannot be satisfied, which is exactly what the README has always promised
+ * and what this class finally delivers.
+ */
+declare class EnqueueRefused extends Error {
+    /** `purpose-not-declared` or `slot-unsatisfiable`. */
+    readonly code: string;
+    constructor(message: string, code: string);
+}
 interface PumpReport {
     /** Jobs sealed to a claiming device this cycle. */
     readonly sealed: string[];
@@ -62,6 +100,20 @@ interface PumpReport {
      * exactly the case `awaiting-payload` exists to bound.
      */
     readonly refused: string[];
+    /**
+     * Why this cycle stopped early, when it did — alpha.31.
+     *
+     * A relay can legitimately say "ask me later": a pod draining through its
+     * `preStop` window answers `503 not-ready` to every routed call, and that
+     * happens on **every deploy**. Before this existed the lane read the body
+     * of that answer, found no `jobs` in it, and threw `TypeError: finished.jobs
+     * is not iterable` — a site falling over because its relay was polite.
+     *
+     * Absent on an ordinary cycle. Present, with the reason, when the lane
+     * deferred: a site that quietly did nothing and a site that was told to wait
+     * must not look the same in a log.
+     */
+    readonly deferred?: string;
 }
 declare class CloudLane {
     #private;
@@ -79,6 +131,19 @@ declare class CloudLane {
      * field on `JobStub` to put one in.
      */
     publish(record: JobRecord): Promise<void>;
+    /**
+     * Withdraw a job at the relay — cloud_008 §2.2.
+     *
+     * `app.cancel()` marks the site's own row terminal, which stops the *next*
+     * seal. It cannot stop a device that is already running the work, because
+     * on this lane the site is not the upstream: only the relay talks to the
+     * daemon, and it answered `cancel: []` unconditionally.
+     *
+     * So the cancellation has to travel. The relay marks the job, stops
+     * offering it, and names it to the holding device at its next heartbeat —
+     * the same path the direct plane has always had, arriving one hop later.
+     */
+    cancel(jobId: string): Promise<void>;
     /**
      * One cycle: seal for anything claimed, collect anything finished.
      *
@@ -91,7 +156,18 @@ declare class CloudLane {
 }
 
 /** Why a job cannot presently run. */
-type NoRunnerReason = "no-runner-paired" | "no-runner-online" | "no-matching-capability" | "audience-admits-nobody";
+type NoRunnerReason = "no-runner-paired" | "no-runner-online" | "no-matching-capability" | "audience-admits-nobody"
+/**
+ * The owner's default for this kind can never serve *this* requester —
+ * byollm_016's defaults-meet-audiences corner.
+ *
+ * The specimen: a default of `claude-cli`, self-locked by
+ * `SUBSCRIPTION_SELF_LOCK`, and a team member's unselected job. It resolves
+ * to something that will never run it. Reported rather than left to time
+ * out, because a wait that can never end is indistinguishable from one that
+ * has not ended yet, and only one of them is worth waiting through.
+ */
+ | "default-unusable";
 /**
  * The no-runner signal (byollm_001 Rev 1 §D).
  *
@@ -110,7 +186,7 @@ interface RunnerAvailability {
 interface AvailabilityQuery {
     readonly kind: JobKind;
     readonly owner: string;
-    readonly audience?: "self" | "named" | "public";
+    readonly audience?: Audience;
     readonly audienceAllow?: readonly string[];
 }
 interface ByollmAppOptions {
@@ -163,14 +239,6 @@ interface JobHandle {
     /** Ask the runner to stop. */
     cancel(): Promise<void>;
 }
-/**
- * The app-facing half of `@byollm/server`.
- *
- * The daemon talks to {@link ByollmHandlers}; the app talks to this. Keeping
- * them separate is what makes "one door per state write" hold — an app
- * enqueues and cancels through these methods and never writes job rows by
- * hand.
- */
 declare class ByollmApp {
     #private;
     /** Present only in the cloud lane; the site's side of the relay. */
@@ -183,7 +251,7 @@ declare class ByollmApp {
      * result comes back marked untrusted (see {@link ByollmApp.result}), and
      * the app is obliged to disclose that to whoever reads it.
      */
-    enqueue(input: EnqueueInput): Promise<JobHandle>;
+    enqueue<K extends JobKind>(input: EnqueueInput<K>): Promise<JobHandle>;
     /** Read a job's current state. */
     job(jobId: string): Promise<JobRecord | null>;
     /**
@@ -192,7 +260,7 @@ declare class ByollmApp {
      * Check `provenance.untrusted` before rendering. It is true for every
      * `named`/`public` job, because that text came from someone else's machine
      * and the app must not present it as its own AI's answer
-     * ({@link MUSTS.RESULT_PROVENANCE}).
+     * ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
      */
     result(jobId: string): Promise<DeliveredResult | null>;
     /** Ask a runner to stop. Queued jobs cancel at once; held jobs at the next heartbeat. */
@@ -315,8 +383,6 @@ declare function formatSiteKeys(keys: StoredKeys): string;
 
 /** A device code: the secret the daemon polls with. Never shown to a user. */
 declare function generateDeviceCode(): string;
-/** A runner bearer token. */
-declare function generateRunnerToken(): string;
 /** A runner id. */
 declare function generateRunnerId(): string;
 /** A job id. */
@@ -366,14 +432,16 @@ declare class MemoryStore implements ByollmStore {
     expireDue(now: number): Promise<JobRecord[]>;
     cancel(jobId: string, now: number): Promise<JobRecord | null>;
     listClaimedBy(runnerId: string): Promise<JobRecord[]>;
-    listCancelRequests(runnerId: string): Promise<string[]>;
+    listCancelRequests(runnerId: string): Promise<{
+        jobId: string;
+        leaseId: string;
+    }[]>;
     createPairing(record: PairingRecord): Promise<void>;
     getPairingByDeviceCodeHash(hash: string): Promise<PairingRecord | null>;
     getPairingByUserCode(userCode: string): Promise<PairingRecord | null>;
     approvePairing(args: ApproveArgs): Promise<RunnerRecord>;
     denyPairing(userCode: string, _now: number): Promise<void>;
     consumePairingToken(deviceCodeHash: string): Promise<void>;
-    getRunnerByTokenHash(hash: string): Promise<RunnerRecord | null>;
     getRunner(runnerId: string): Promise<RunnerRecord | null>;
     touchRunner(args: TouchArgs): Promise<RunnerRecord | null>;
     revokeRunner(runnerId: string, now: number): Promise<void>;
@@ -384,4 +452,4 @@ declare class MemoryStore implements ByollmStore {
 /** The capability that would serve a kind, if any. */
 declare function capabilityFor(capabilities: readonly Capability[], kind: string): Capability | undefined;
 
-export { AdoptArgs, ApproveArgs, type AvailabilityQuery, ByollmApp, type ByollmAppOptions, ByollmStore, ClaimArgs, CloudLane, type CloudLaneOptions, CompleteArgs, CompleteResult, EnqueueInput, HandlerConfig, type JobHandle, JobRecord, MemoryStore, type MemoryStoreOptions, type NoRunnerReason, PairingRecord, PollingDeliveryDeps, type PumpReport, ReleaseArgs, RenewArgs, RenewResult, ResultDelivery, type RunnerAvailability, RunnerRecord, TouchArgs, WaitOptions, capabilityFor, createFetchHandler, formatSiteKeys, generateDeviceCode, generateJobId, generateRunnerId, generateRunnerToken, generateSiteKeys, generateUserCode, hashSecret, normalizeUserCode, routeEndpoint, secretsMatch, signatureFrom, siteKeysFromEnv };
+export { AdoptArgs, ApproveArgs, type AvailabilityQuery, ByollmApp, type ByollmAppOptions, ByollmStore, ClaimArgs, CloudLane, type CloudLaneOptions, CompleteArgs, CompleteResult, EnqueueInput, EnqueueRefused, HandlerConfig, type JobHandle, JobRecord, MemoryStore, type MemoryStoreOptions, type NoRunnerReason, PairingRecord, PollingDeliveryDeps, type PumpReport, RelayUnavailable, ReleaseArgs, RenewArgs, RenewResult, ResultDelivery, type RunnerAvailability, RunnerRecord, TouchArgs, WaitOptions, capabilityFor, createFetchHandler, formatSiteKeys, generateDeviceCode, generateJobId, generateRunnerId, generateSiteKeys, generateUserCode, hashSecret, normalizeUserCode, routeEndpoint, secretsMatch, signatureFrom, siteKeysFromEnv };