@byollm/server 0.1.0-alpha.9 → 0.1.0-alpha.91

package/dist/index.js

@@ -2,23 +2,24 @@ import {
   ByollmHandlers,
   SERVED_PROTOCOL_VERSION,
   createFetchHandler,
+  deadlineFor,
   generateDeviceCode,
   generateJobId,
   generateLeaseId,
   generateRunnerId,
-  generateRunnerToken,
   generateUserCode,
   hashSecret,
+  openSealedOutcome,
   resealForDevice,
   routeEndpoint,
   secretsMatch,
   signatureFrom
-} from "./chunk-4NIHWQAT.js";
+} from "./chunk-36Y77FUD.js";
 import {
   NoRunnerAvailableError,
   PollingDelivery,
   ResultTimeoutError
-} from "./chunk-7RKXFPBZ.js";
+} from "./chunk-I3ER27QG.js";
 
 // src/app.ts
 import {
@@ -35,13 +36,35 @@ import {
 
 // src/cloud.ts
 import {
-  JobOutcome,
+  PROTOCOL_VERSION,
   keyId,
   open,
   publicIdentityOf,
   provenanceFor,
   signSiteRequest
 } from "@byollm/protocol";
+var RelayUnavailable = class extends Error {
+  retryable;
+  /** The protocol's own code, when the relay sent one. */
+  code;
+  constructor(message, retryable, code) {
+    super(message);
+    this.name = "RelayUnavailable";
+    this.retryable = retryable;
+    this.code = code;
+  }
+};
+var EnqueueRefused = class extends Error {
+  /** `purpose-not-declared` or `slot-unsatisfiable`. */
+  code;
+  constructor(message, code) {
+    super(message);
+    this.name = "EnqueueRefused";
+    this.code = code;
+  }
+};
+var RETRYABLE_AT_ENQUEUE = /* @__PURE__ */ new Set(["not-ready"]);
+var ENQUEUE_ENDPOINT = "enqueue";
 var CloudLane = class {
   #options;
   #store;
@@ -67,20 +90,64 @@ var CloudLane = class {
       id: record.id,
       kind: record.kind,
       owner: record.owner,
+      // This site, by its identity key id — Amendment A §A.3. The relay
+      // already knows which site it is routing for, so this discloses nothing
+      // new to it; what it adds is that the *daemon* can check the stub
+      // against the envelope's `senderKeyId` without asking the relay.
+      site: keyId(publicIdentityOf(this.#siteKeys).identity),
       audience: record.audience,
-      ...record.audienceAllow === void 0 ? {} : { audienceAllow: [...record.audienceAllow] },
+      // `audienceAllow` is deliberately **not** published — cloud_008 §0.2.
+      //
+      // It is a list of the people who may run this job, and on the direct
+      // plane that is unremarkable: the site authored the list and the site is
+      // the upstream, so the party receiving it already has it. Through a
+      // relay it is a third party, and byollm_009 §6's enumerated metadata —
+      // "exhaustive and normative… what an upstream can see, stated as a
+      // commitment" — does not include it. It was reaching the relay on every
+      // named-audience job.
+      //
+      // Nothing is lost by withholding it, which is why this is a Tier 0 fix
+      // rather than a trade. `matchAudience` treats it as a *narrowing*:
+      // `job.audienceAllow !== undefined && !includes(daemon.owner)` refuses,
+      // and its absence simply falls through to the checks that actually
+      // enforce — the daemon's own allowlist (`NAMED_LOCAL_ALLOWLIST`) and the
+      // backend's offer scope. On this lane the relay narrows too, from the
+      // control plane's rosters. The enforcement was never here.
+      ...record.purpose === void 0 ? {} : { purpose: record.purpose },
       sizeClass: record.sizeClass,
       streaming: false,
       // The relay needs *a* deadline to bound routing. A job without one gets
       // the envelope's, which is the outer bound on how long the ciphertext
       // is worth carrying — never longer than the work could possibly matter.
-      deadlineAt: record.deadlineAt ?? record.createdAt + ENVELOPE_TTL_FALLBACK
+      // The same fallback the direct plane uses — cloud_008 Tier 4, finding
+      // 31. This said `createdAt + ENVELOPE_TTL_FALLBACK`, a local constant
+      // whose value happened to equal `ENVELOPE_MAX_AGE_MS`; the direct plane
+      // said `(claimableAt ?? now) + ttlMs`. One field, two meanings, and a
+      // job that was blocked on a dependency got a deadline measured from
+      // when it was *created* on one lane and from when it became *claimable*
+      // on the other.
+      deadlineAt: deadlineFor(record, this.#now())
     };
     await this.#post("enqueue", {
       siteId: this.#options.siteId,
       stub
     });
   }
+  /**
+   * Withdraw a job at the relay — cloud_008 §2.2.
+   *
+   * `app.cancel()` marks the site's own row terminal, which stops the *next*
+   * seal. It cannot stop a device that is already running the work, because
+   * on this lane the site is not the upstream: only the relay talks to the
+   * daemon, and it answered `cancel: []` unconditionally.
+   *
+   * So the cancellation has to travel. The relay marks the job, stops
+   * offering it, and names it to the holding device at its next heartbeat —
+   * the same path the direct plane has always had, arriving one hop later.
+   */
+  async cancel(jobId) {
+    await this.#post("cancel", { siteId: this.#options.siteId, jobId });
+  }
   /**
    * One cycle: seal for anything claimed, collect anything finished.
    *
@@ -93,6 +160,16 @@ var CloudLane = class {
     const sealed = [];
     const refused = [];
     const completed = [];
+    try {
+      return await this.#cycle(sealed, refused, completed);
+    } catch (error) {
+      if (error instanceof RelayUnavailable && error.retryable) {
+        return { sealed, completed, refused, deferred: error.message };
+      }
+      throw error;
+    }
+  }
+  async #cycle(sealed, refused, completed) {
     const pending = await this.#get("pending");
     for (const claim of pending.jobs) {
       const record = await this.#store.get(claim.jobId);
@@ -110,12 +187,16 @@ var CloudLane = class {
         refused.push(claim.jobId);
         continue;
       }
-      await this.#store.adopt({
+      const adopted = await this.#store.adopt({
         jobId: claim.jobId,
         leaseId: claim.leaseId,
-        expiresAt: claim.awaitingUntil,
+        expiresAt: claim.leaseExpiresAt,
         now: this.#now()
       });
+      if (!adopted) {
+        refused.push(claim.jobId);
+        continue;
+      }
       await this.#post("payload", {
         siteId: this.#options.siteId,
         jobId: claim.jobId,
@@ -136,17 +217,30 @@ var CloudLane = class {
       }
       await this.#store.complete({
         jobId: done.jobId,
+        // The relay named the device; the signature above proved it — §3.6.
+        runnerId: done.runnerId,
         // The grant, not the machine: this site never paired with the device
         // that ran it, and the signature it verified above is the stronger
         // claim about who did.
         holder: { by: "lease", leaseId: done.leaseId },
-        outcome,
+        outcome: outcome.outcome,
         provenance: provenanceFor({
           audience: record.audience,
           runnerId: done.runnerId,
-          runnerOwner: keyId(done.device.identity),
-          backendClass: "http",
-          model: "unknown"
+          // The owner, from the relay's own record of who claimed it — not a
+          // key id. cloud_008 §2.5: this said `keyId(device.identity)`, which
+          // put a key id where the direct plane puts a user id, so an app
+          // comparing provenance across lanes compared two namespaces and got
+          // `false` for the same person. The device's key is still what the
+          // signature was verified against, above; that is a different
+          // question from whose machine it is.
+          runnerOwner: done.runnerOwner,
+          // From the envelope, not invented — cloud_008 §2.5. These were
+          // hardcoded `"http"` and `"unknown"` because the daemon's declared
+          // values stopped at the relay, which is right: a blind relay acts
+          // on neither. Sealing them carries them past it untouched.
+          backendClass: outcome.ran.backendClass,
+          model: outcome.ran.model
         }),
         now: this.#now()
       });
@@ -175,16 +269,11 @@ var CloudLane = class {
       }
     });
     if (!opened.ok) return null;
-    let parsed;
-    try {
-      parsed = JSON.parse(opened.plaintext);
-    } catch {
-      return null;
-    }
-    const outcome = JobOutcome.safeParse(parsed);
-    if (!outcome.success) return null;
-    if (outcome.data.outcome !== done.disposition) return null;
-    return outcome.data;
+    const outcome = openSealedOutcome({
+      plaintext: opened.plaintext,
+      disposition: done.disposition
+    });
+    return outcome.ok ? outcome.value : null;
   }
   /**
    * Sign a site-plane call with this site's identity key.
@@ -208,8 +297,47 @@ var CloudLane = class {
       "x-byollm-signature": signature.signature
     };
   }
+  /**
+   * A relay answer, checked before it is believed — alpha.31.
+   *
+   * The bug this closes is one line long and its shape is general: a response
+   * body used without looking at the status. The daemon's client has always
+   * done this properly (`client.ts` maps every status to a typed refusal); the
+   * site's lane parsed JSON and hoped.
+   *
+   * Two classes, because they need opposite handling. **Retryable** — 503 from
+   * a draining pod, 429, 5xx, and the protocol's own `not-ready` — means the
+   * work is still there and this cycle should end quietly. **Refused** — a bad
+   * signature, an unknown site, a version this relay does not speak — will
+   * still be true in five seconds, and swallowing it would leave a site
+   * silently disconnected from its own users.
+   */
+  async #answer(response, endpoint) {
+    if (response.ok) return response.json();
+    let code = "";
+    let message;
+    try {
+      const body = await response.json();
+      code = body.error ?? "";
+      message = body.message ?? "";
+    } catch {
+      message = `HTTP ${String(response.status)}`;
+    }
+    const retryable = response.status >= 500 || response.status === 429 || code === "not-ready" || code === "server-error";
+    if (endpoint === ENQUEUE_ENDPOINT && response.status === 409 && !RETRYABLE_AT_ENQUEUE.has(code)) {
+      throw new EnqueueRefused(message, code);
+    }
+    throw new RelayUnavailable(
+      `${endpoint}: ${code || "refused"} \u2014 ${message}`,
+      retryable,
+      code
+    );
+  }
   async #post(endpoint, body) {
-    const rawBody = JSON.stringify(body);
+    const rawBody = JSON.stringify({
+      protocolVersion: PROTOCOL_VERSION,
+      ...body
+    });
     const response = await this.#fetch(
       `${this.#options.relayOrigin}/relay/site/${endpoint}`,
       {
@@ -221,20 +349,31 @@ var CloudLane = class {
         body: rawBody
       }
     );
-    return response.json();
+    return this.#answer(response, endpoint);
   }
   async #get(endpoint) {
-    const url = `${this.#options.relayOrigin}/relay/site/${endpoint}?siteId=${encodeURIComponent(this.#options.siteId)}`;
+    const url = `${this.#options.relayOrigin}/relay/site/${endpoint}?siteId=${encodeURIComponent(this.#options.siteId)}&protocolVersion=${encodeURIComponent(PROTOCOL_VERSION)}`;
     const response = await this.#fetch(url, {
       headers: this.#headers(endpoint, "")
     });
-    return response.json();
+    return this.#answer(response, endpoint);
   }
 };
-var ENVELOPE_TTL_FALLBACK = 24 * 60 * 6e4;
 
 // src/app.ts
 var DEFAULT_LIVENESS_MS = 35e3;
+var ENQUEUE_OPTIONS = Object.freeze({
+  kind: true,
+  payload: true,
+  owner: true,
+  audience: true,
+  purpose: true,
+  audienceAllow: true,
+  dependsOn: true,
+  ttlMs: true,
+  deadlineAt: true,
+  id: true
+});
 var ByollmApp = class {
   #store;
   #siteKeys;
@@ -257,28 +396,38 @@ var ByollmApp = class {
     const deps = {
       ...options.noRunnerGraceMs === void 0 ? {} : { graceMs: options.noRunnerGraceMs },
       read: (jobId) => this.result(jobId),
-      availability: async (jobId) => {
-        const job = await this.#store.get(jobId);
-        if (!job)
-          return { available: false, reason: "unknown-job", blocked: false };
-        if (job.claimableAt === null) {
-          return { available: true, blocked: true };
-        }
-        const availability = await this.runnerAvailability({
-          kind: job.kind,
-          owner: job.owner,
-          audience: job.audience,
-          ...job.audienceAllow === void 0 ? {} : { audienceAllow: job.audienceAllow }
-        });
-        return {
-          available: availability.available,
-          ...availability.reason === void 0 ? {} : { reason: availability.reason },
-          blocked: false
-        };
-      }
+      ...this.cloud !== void 0 ? {} : { availability: this.#availabilityFor() }
     };
     this.#delivery = options.delivery?.(deps) ?? new PollingDelivery(deps);
   }
+  /**
+   * The no-runner instrument, for a lane that can actually see runners.
+   *
+   * A method rather than an inline closure so the branch above reads as one
+   * decision — whether this deployment has the instrument at all — instead of
+   * a conditional wrapped around thirty lines of body.
+   */
+  #availabilityFor() {
+    return async (jobId) => {
+      const job = await this.#store.get(jobId);
+      if (!job)
+        return { available: false, reason: "unknown-job", blocked: false };
+      if (job.claimableAt === null) {
+        return { available: true, blocked: true };
+      }
+      const availability = await this.runnerAvailability({
+        kind: job.kind,
+        owner: job.owner,
+        audience: job.audience,
+        ...job.audienceAllow === void 0 ? {} : { audienceAllow: job.audienceAllow }
+      });
+      return {
+        available: availability.available,
+        ...availability.reason === void 0 ? {} : { reason: availability.reason },
+        blocked: false
+      };
+    };
+  }
   /**
    * Enqueue a job.
    *
@@ -287,6 +436,19 @@ var ByollmApp = class {
    * the app is obliged to disclose that to whoever reads it.
    */
   async enqueue(input) {
+    const unknown = Object.keys(input).filter(
+      (key) => !(key in ENQUEUE_OPTIONS)
+    );
+    if (unknown.length > 0) {
+      throw new Error(
+        `enqueue does not understand ${unknown.map((k) => `\`${k}\``).join(", ")}. An option this @byollm/server does not know is refused rather than ignored, because an ignored option is a job that runs differently than you asked with nothing to see \u2014 most often an SDK older than the code calling it. Upgrade @byollm/server, or remove the option.`
+      );
+    }
+    if (this.cloud !== void 0 && input.audience !== void 0) {
+      throw new Error(
+        "enqueue does not take `audience` on the cloud lane. Who may serve a job is derived from the person's own mapping \u2014 the service they chose, its owner, and that owner's sharing \u2014 which your site is not told and cannot compute. Remove `audience`; ask for the kind and the purpose, and their decision does the rest."
+      );
+    }
     const parsed = KindedPayload.safeParse({
       kind: input.kind,
       payload: input.payload
@@ -314,6 +476,27 @@ var ByollmApp = class {
     const record = await this.#store.create(
       {
         ...input,
+        /**
+         * Derived here, because on the cloud lane it is derivable and nowhere
+         * else knows the lane.
+         *
+         * Refusing the site's declaration is only half of "derived, never
+         * declared" — the stub still carries an audience to the relay, and a
+         * store that defaults it to `private` would keep every cloud job
+         * private no matter who was forbidden from saying so. The half that
+         * fixes anything is this one.
+         *
+         * `team` is the value that defers: it says a device whose owner
+         * admits this person may serve, and the hub then decides whether one
+         * does, from the mapping the person authored, its service's owner,
+         * that owner's offer scope, and the roster. Nothing is widened by
+         * saying it — both axes still have to agree, and the owner's scope is
+         * the other axis.
+         *
+         * Direct mode keeps the store's `private` default: there is no
+         * control plane there to derive from, and owner-only is the ruling.
+         */
+        ...this.cloud === void 0 ? {} : { audience: "team" },
         id: jobId,
         envelope,
         sizeClass: sizeClassOf(
@@ -346,7 +529,7 @@ var ByollmApp = class {
    * Check `provenance.untrusted` before rendering. It is true for every
    * `named`/`public` job, because that text came from someone else's machine
    * and the app must not present it as its own AI's answer
-   * ({@link MUSTS.RESULT_PROVENANCE}).
+   * ({@link MUSTS.PROVENANCE_NAMES_DEVICE}).
    */
   async result(jobId) {
     const job = await this.job(jobId);
@@ -360,7 +543,11 @@ var ByollmApp = class {
   }
   /** Ask a runner to stop. Queued jobs cancel at once; held jobs at the next heartbeat. */
   async cancel(jobId) {
-    return this.#store.cancel(jobId, this.#now());
+    const cancelled = await this.#store.cancel(jobId, this.#now());
+    if (cancelled && this.cloud) {
+      await this.cloud.cancel(jobId).catch(() => void 0);
+    }
+    return cancelled;
   }
   /**
    * Is there a live runner that could take a job of this shape?
@@ -369,6 +556,11 @@ var ByollmApp = class {
    * signal cannot promise a runner the claim would then refuse.
    */
   async runnerAvailability(query) {
+    if (this.cloud !== void 0) {
+      throw new Error(
+        "runnerAvailability cannot answer on the cloud lane. It counts runners this site knows about, and on the cloud lane devices pair with the relay rather than with you \u2014 so the answer would be `none` whatever the truth is. Enqueue the job: the result says whether it ran, and the person's own dashboard says why not."
+      );
+    }
     const now = this.#now();
     const all = await this.#store.listRunners();
     const live = all.filter(
@@ -382,37 +574,41 @@ var ByollmApp = class {
     }
     let capable = 0;
     let admitted = 0;
+    let lastRefusal;
     for (const runner of live) {
-      const capability = runner.capabilities.find((c) => c.kind === query.kind);
-      if (!capability) continue;
-      capable += 1;
-      const match = matchAudience(
-        {
-          owner: query.owner,
-          audience: query.audience ?? "self",
-          audienceAllow: query.audienceAllow
-        },
-        {
-          owner: runner.owner,
-          offerScope: capability.offerScope,
-          // A generic backend's cost depends on its base URL, which the
-          // server never sees; assume the expensive reading (byollm_007 §4).
-          cost: backendDescriptor(capability.backendId).cost ?? "metered",
-          // Consent is the daemon's to hold, and it has already applied it:
-          // the offer scope arriving here is the *effective* one, so a
-          // metered backend nobody agreed to share advertises `self` and is
-          // refused by the scope rule above. Re-deriving consent from
-          // `false` here would instead refuse every backend an owner
-          // deliberately shared, because the server has no way to learn they
-          // did — the signal would be wrong in the direction that breaks
-          // working setups.
-          spend: { acknowledged: true },
-          // Same conservative assumption the claim path makes: the server
-          // cannot see a remote daemon's local allowlist (protocol §4.2).
-          locallyAllows: () => true
-        }
-      );
-      if (match.ok) admitted += 1;
+      for (const capability of runner.capabilities.filter(
+        (c) => c.kind === query.kind
+      )) {
+        capable += 1;
+        const match = matchAudience(
+          {
+            owner: query.owner,
+            audience: query.audience ?? "private",
+            audienceAllow: query.audienceAllow
+          },
+          {
+            owner: runner.owner,
+            offerScope: capability.offerScope,
+            // A generic backend's cost depends on its base URL, which the
+            // server never sees; assume the expensive reading (byollm_007 §4).
+            cost: backendDescriptor(capability.backendId).cost ?? "metered",
+            // Consent is the daemon's to hold, and it has already applied it:
+            // the offer scope arriving here is the *effective* one, so a
+            // metered backend nobody agreed to share advertises `self` and is
+            // refused by the scope rule above. Re-deriving consent from
+            // `false` here would instead refuse every backend an owner
+            // deliberately shared, because the server has no way to learn they
+            // did — the signal would be wrong in the direction that breaks
+            // working setups.
+            spend: { acknowledged: true },
+            // Same conservative assumption the claim path makes: the server
+            // cannot see a remote daemon's local allowlist (protocol §4.2).
+            admits: () => true
+          }
+        );
+        if (match.ok) admitted += 1;
+        else lastRefusal = match.refusal;
+      }
     }
     if (capable === 0) {
       return {
@@ -422,9 +618,10 @@ var ByollmApp = class {
       };
     }
     if (admitted === 0) {
+      const ownersDoing = lastRefusal === "offer-scope-too-narrow" || lastRefusal === "subscription-self-lock" || lastRefusal === "metered-no-spend-consent" || lastRefusal === "metered-ceiling-reached";
       return {
         available: false,
-        reason: "audience-admits-nobody",
+        reason: ownersDoing ? "default-unusable" : "audience-admits-nobody",
         candidates: 0
       };
     }
@@ -438,13 +635,10 @@ var ByollmApp = class {
    * ({@link MUSTS.PAIR_ONE_USER}, {@link MUSTS.PAIR_INTERACTIVE}).
    */
   async approvePairing(args) {
-    const token = generateRunnerToken();
     return this.#store.approvePairing({
       userCode: normalizeUserCode(args.userCode),
       owner: args.owner,
       runnerId: generateRunnerId(),
-      runnerToken: token,
-      tokenHash: hashSecret(token),
       now: this.#now()
     });
   }
@@ -517,13 +711,27 @@ function siteKeysFromEnv(variable = "BYOLLM_SITE_KEYS", env = process.env) {
 }
 function formatSiteKeys(keys) {
   const encoded = Buffer.from(JSON.stringify(keys)).toString("base64");
-  return `# Set this as BYOLLM_SITE_KEYS. It is a secret: it is this site's
-# identity, and anything holding it can be this site.
+  const pub = publicIdentityOf3(keys);
+  return `# \u2500\u2500 1. SECRET \u2014 set this on your server, and nowhere else \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# This is the site's identity. Anything holding it can *be* this site,
+# so it goes wherever your deployment keeps secrets \u2014 never in a repo,
+# never in a browser, never pasted into a dashboard.
 BYOLLM_SITE_KEYS=${encoded}
 
-# Fingerprint (not secret \u2014 show it to users so they can check what
-# their daemon pinned):
-# ${fingerprint(publicIdentityOf3(keys).identity)}
+# \u2500\u2500 2. PUBLIC \u2014 paste this line into the byollm dashboard \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# The public half. It proves signatures and seals nothing, so it is
+# safe to publish \u2014 which is the point: users pin it, and the relay
+# cannot forge work without the secret above.
+${JSON.stringify(pub)}
+
+# \u2500\u2500 3. Fingerprint \u2014 what a person compares by eye \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
+#
+# A fingerprint is not secret. Show it on your site so somebody
+# connecting can check it against what their daemon printed.
+# The dashboard derives this itself, so there is nothing to paste.
+# ${fingerprint(pub.identity)}
 `;
 }
 
@@ -557,12 +765,14 @@ var MemoryStore = class {
       kind: input.kind,
       envelope: input.envelope,
       sizeClass: input.sizeClass,
-      audience: input.audience ?? "self",
+      audience: input.audience ?? "private",
+      purpose: input.purpose,
       owner: input.owner,
       audienceAllow: input.audienceAllow ? [...input.audienceAllow] : void 0,
       dependsOn,
       state: "queued",
       lease: null,
+      completedByLeaseId: null,
       createdAt: now,
       // The TTL clock starts here only if nothing blocks the job.
       claimableAt: blocked ? null : now,
@@ -640,7 +850,7 @@ var MemoryStore = class {
         // not pretend to (protocol §4.2). It admits the job here; the daemon
         // is the enforcing side and releases with `refused` if its own list
         // says no.
-        locallyAllows: () => true
+        admits: () => true
       }
     );
     return match.ok;
@@ -652,11 +862,11 @@ var MemoryStore = class {
     for (const { jobId, leaseId } of args.leases) {
       const job = this.#jobs.get(jobId);
       if (!job || job.lease?.runnerId !== args.runnerId || job.lease.id !== leaseId) {
-        lost.push(jobId);
+        lost.push({ jobId, leaseId });
         continue;
       }
       if (job.state !== "claimed" && job.state !== "running") {
-        lost.push(jobId);
+        lost.push({ jobId, leaseId });
         continue;
       }
       const expiresAt = args.now + args.leaseMs;
@@ -698,6 +908,11 @@ var MemoryStore = class {
     const job = this.#jobs.get(args.jobId);
     if (!job) return Promise.resolve({ accepted: false, job: null });
     if (job.state === "ok" || job.state === "error" || job.state === "canceled") {
+      const sameDevice = job.provenance?.runnerId !== void 0 && job.provenance.runnerId === args.runnerId;
+      const sameGrant = args.holder.by === "lease" && job.completedByLeaseId !== null && job.completedByLeaseId === args.holder.leaseId;
+      if (sameDevice && sameGrant) {
+        return Promise.resolve({ accepted: false, duplicate: true, job });
+      }
       return Promise.resolve({ accepted: false, job });
     }
     if (job.state === "expired") {
@@ -712,6 +927,8 @@ var MemoryStore = class {
       ...job,
       state,
       lease: null,
+      // The grant that recorded it, kept after the lease is dropped — §3.6.
+      completedByLeaseId: args.holder.by === "lease" ? args.holder.leaseId : job.lease?.id ?? null,
       outcome: args.outcome,
       provenance: args.provenance,
       updatedAt: args.now
@@ -800,6 +1017,7 @@ var MemoryStore = class {
         ...job,
         state: "queued",
         lease: null,
+        completedByLeaseId: null,
         // Newly available again, so the TTL clock restarts here too.
         claimableAt: args.now,
         // A refusal is remembered, or the pair spins between claim and
@@ -829,6 +1047,7 @@ var MemoryStore = class {
           ...job,
           state: "queued",
           lease: null,
+          completedByLeaseId: null,
           // The TTL clock restarts: it measures how long a job has waited
           // *unclaimed*, and this job has just become available again. Without
           // this, a job whose runner died would expire for time it spent being
@@ -851,6 +1070,7 @@ var MemoryStore = class {
         ...job,
         state: "expired",
         lease: null,
+        completedByLeaseId: null,
         updatedAt: now
       };
       this.#write(job.id, expired);
@@ -866,6 +1086,7 @@ var MemoryStore = class {
         ...job,
         state: "canceled",
         lease: null,
+        completedByLeaseId: null,
         updatedAt: now
       };
       this.#write(jobId, canceled);
@@ -886,9 +1107,7 @@ var MemoryStore = class {
   }
   listCancelRequests(runnerId) {
     return Promise.resolve(
-      [...this.#cancelRequests].filter(
-        (jobId) => this.#jobs.get(jobId)?.lease?.runnerId === runnerId
-      )
+      [...this.#cancelRequests].map((jobId) => ({ jobId, lease: this.#jobs.get(jobId)?.lease })).filter((row) => row.lease?.runnerId === runnerId).map((row) => ({ jobId: row.jobId, leaseId: row.lease?.id ?? "" }))
     );
   }
   // -- pairing and runners -------------------------------------------------
@@ -919,7 +1138,6 @@ var MemoryStore = class {
     const runner = {
       id: args.runnerId,
       owner: args.owner,
-      tokenHash: args.tokenHash,
       // Carried from the pairing, not re-supplied at approval: the user
       // approved a specific machine, and the runner must be that machine.
       device: pairing.device,
@@ -938,7 +1156,7 @@ var MemoryStore = class {
       state: "approved",
       owner: args.owner,
       runnerId: runner.id,
-      runnerTokenOnce: args.runnerToken
+      collected: false
     });
     return Promise.resolve(runner);
   }
@@ -959,17 +1177,11 @@ var MemoryStore = class {
     if (pairing) {
       this.#pairings.set(deviceCodeHash, {
         ...pairing,
-        runnerTokenOnce: null
+        collected: true
       });
     }
     return Promise.resolve();
   }
-  getRunnerByTokenHash(hash) {
-    for (const runner of this.#runners.values()) {
-      if (runner.tokenHash === hash) return Promise.resolve(runner);
-    }
-    return Promise.resolve(null);
-  }
   getRunner(runnerId) {
     return Promise.resolve(this.#runners.get(runnerId) ?? null);
   }
@@ -1012,9 +1224,11 @@ export {
   ByollmApp,
   ByollmHandlers,
   CloudLane,
+  EnqueueRefused,
   MemoryStore,
   NoRunnerAvailableError,
   PollingDelivery,
+  RelayUnavailable,
   ResultTimeoutError,
   SERVED_PROTOCOL_VERSION,
   capabilityFor,
@@ -1023,7 +1237,6 @@ export {
   generateDeviceCode,
   generateJobId,
   generateRunnerId,
-  generateRunnerToken,
   generateSiteKeys,
   generateUserCode,
   hashSecret,