@fugood/buttress-server 2.25.0-beta.6 → 2.25.0-beta.63

package/README.md

@@ -20,50 +20,347 @@ npx bricks-buttress --config ./config.toml
 npx bricks-buttress
 ```
 
+## Workspace Binding (`bricks buttress`)
+
+By default, a buttress-server runs in **public mode**: any client on the LAN can connect, no auth required. To restrict access to a single BRICKS workspace and enable workspace-scoped JWT auth, **bind** the server with the `bricks buttress` CLI commands. Once bound, the server only accepts WebSocket / file-transfer requests carrying a valid access token signed by that workspace's issuer.
+
+The `bricks` CLI is the tool that performs the binding and writes the local state file. Install it first — see the [bricks-cli docs](https://docs.bricks.tools/cli) — then `bricks auth login` with the workspace owner's account before running the commands below.
+
+### Bind a server to a workspace
+
+```bash
+# Pair the local machine's buttress-server with the workspace of the current bricks-cli profile
+bricks buttress bind
+
+# Override the auto-detected server id, give it a friendly name, or write to a custom state dir
+bricks buttress bind --server-id buttress-mac-studio --name "Studio LLM" --state-dir /etc/buttress
+
+# For headless/remote setups: emit state.json to stdout instead of writing to disk
+bricks buttress bind --print > /etc/buttress/state.json
+```
+
+The state file (`~/.bricks-cli/buttress/state.json` by default, or `$BRICKS_BUTTRESS_STATE_DIR`) stores:
+
+- `workspace.id` / `workspace.name` — which workspace this server belongs to
+- `workspace.serverId` — the server's stable id (defaults to `buttress-<machineId>`)
+- `workspace.issuerPublicKey` + `workspace.kid` — Ed25519 SPKI used to verify access tokens
+
+**Restart `bricks-buttress` after binding** for the change to take effect — the state file is read once at startup.
+
+### Inspect bindings
+
+```bash
+# Show local state.json + the workspace-side bound list
+bricks buttress status
+
+# Same, JSON-formatted
+bricks buttress status --json
+```
+
+### Discover servers on the LAN
+
+```bash
+# UDP scan + HTTP /buttress/info verification (3s timeout by default)
+bricks buttress scan
+
+# UDP only (skip the /buttress/info round-trip)
+bricks buttress scan --udp-only
+
+# Machine-readable
+bricks buttress scan --json
+```
+
+`scan` lists every buttress-server visible on the LAN, including unbound (public) ones, with their version, auth state (`open` vs `JWT required` + kid), bound workspace, and per-generator hardware caps (`score`, GPU, usable memory). Servers whose workspace matches your current `bricks-cli` profile are highlighted; this is purely a discovery command and does not mint any tokens.
+
+### Unbind
+
+```bash
+# Remove the binding from the workspace and delete the local state.json
+bricks buttress unbind
+
+# Keep the local state file (useful if you only want to revoke server-side)
+bricks buttress unbind --keep-local
+```
+
+After unbinding, restart the server to return it to public mode.
+
+### Issue a long-lived access token
+
+For headless callers (CI, ctor agents) that already hold a workspace token, mint a long-lived buttress access token instead of relying on a per-launcher session token:
+
+```bash
+# Default 30-day TTL
+bricks buttress issue-token
+
+# Custom TTL (seconds), JSON output for scripting
+bricks buttress issue-token --ttl 3600 --json
+```
+
+The token claims `{ k: 'ba', w_id, st: 'ws', sid, jti, exp }` and any buttress-server bound to the same workspace will accept it.
+
 ## Configuration
 
-Configuration can be provided via:
-- `--config` / `-c` flag with TOML file path
+Configuration is loaded from a TOML file passed via `--config` / `-c`. Every top-level table is optional — missing sections fall back to defaults. See `config/sample.toml` for an end-to-end example.
 
-### Configuration Format (TOML)
+### Top-level sections
+
+| Section                   | Purpose                                                                                            |
+| ------------------------- | -------------------------------------------------------------------------------------------------- |
+| `[env]`                   | Environment variables exported into the process **only if not already set**                        |
+| `[server]`                | HTTP/RPC listener (port, log level, body limits)                                                   |
+| `[runtime]`               | Global defaults shared by every generator (most `[generators.model]` keys may live here too)       |
+| `[runtime.session_cache]` | KV-cache reuse store — see [Session State Cache](#session-state-cache)                             |
+| `[autodiscover]`          | LAN UDP / HTTP / mDNS discovery toggles                                                            |
+| `[openai_compat]`         | Enable `/oai-compat/v1/*` — see [Compatibility Endpoints](#compatibility-endpoints-experimental)   |
+| `[anthropic_messages]`    | Enable `/anthropic-messages` — see [Compatibility Endpoints](#compatibility-endpoints-experimental)|
+| `[[generators]]`          | Array of generator instances — one entry per loaded model                                          |
+
+### `[env]`
 
 ```toml
-# Environment variables (only set if not already defined in system)
 [env]
-HF_TOKEN = "your_huggingface_token_here"
+HUGGINGFACE_TOKEN = "hf_xxx"   # ggml backends read this; HF_TOKEN is not picked up automatically
 CUDA_VISIBLE_DEVICES = "0"
+```
 
-[server]
-port = 2080
-log_level = "info"
+Values here are exported only when the variable isn't already set in the process — see [Environment Variable Priority](#environment-variable-priority). For HuggingFace auth across all backends, `[runtime] huggingface_token = "hf_xxx"` works regardless of variable name.
+
+### `[server]`
+
+| Key               | Type           | Default                                                                |
+| ----------------- | -------------- | ---------------------------------------------------------------------- |
+| `id`              | string         | `buttress-<machineId>` — stable id used for autodiscover / binding     |
+| `name`            | string         | `Buttress Server (<short id>)` — display name                          |
+| `port`            | number         | `2080` (overridden by `--port`)                                        |
+| `log_level`       | `"debug"`/`"info"`/`"warn"`/`"error"` | unset                                          |
+| `max_body_size`   | string\|number | `"50MB"` — e.g. `"100MB"`, `"1GB"`, or raw bytes                       |
+| `session_timeout` | string\|number | `60000` ms — accepts ms numbers or duration strings (`"30s"`)          |
+| `temp_file_dir`   | string         | `$TMPDIR/.buttress`                                                    |
+
+### `[runtime]` — global generator defaults
+
+Most ggml-llm `[generators.model]` keys can also live in `[runtime]` as defaults. Per-generator values win; otherwise the runtime default applies.
+
+| Key                          | Type                          | Notes                                                                  |
+| ---------------------------- | ----------------------------- | ---------------------------------------------------------------------- |
+| `cache_dir`                  | string                        | Model + metadata cache root (default `~/.buttress/models`)             |
+| `huggingface_token`          | string                        | Falls back to `$HUGGINGFACE_TOKEN`                                     |
+| `http_headers`               | table                         | Extra headers attached to HF / HTTP downloads                          |
+| `context_release_delay_ms`   | number                        | Idle time before unloading a context (default `10000`; `0` = immediate)|
+| `prefer_variants`            | string[]                      | Override variant probe order (ggml backends)                           |
+| `n_threads`                  | number                        | CPU thread count                                                       |
+| `n_ctx`                      | number                        | Context window (per-model value wins; auto-capped at training context) |
+| `n_gpu_layers`               | number\|`"auto"`              | Layers offloaded to GPU (default `"auto"`)                             |
+| `n_batch` / `n_ubatch`       | number                        | Prompt batch / micro-batch size. **Note:** `n_batch` has a model-level default of `512` that shadows the runtime value unless `[generators.model] n_batch` is set explicitly. |
+| `n_parallel`                 | number                        | Parallel sequences (default `4`)                                       |
+| `n_cpu_moe`                  | number                        | MoE expert layers offloaded to CPU                                     |
+| `flash_attn_type`            | `"on"` / `"off"` / `"auto"`   | When a GPU backend is selected, defaults to `"auto"`; on CPU, defaults to `"off"`. Explicit `"on"` / `"off"` / `"auto"` overrides. |
+| `cache_type_k`, `cache_type_v` | string                      | KV-cache dtype (`f16`, `f32`, `q8_0`, `q4_0`, …)                       |
+| `kv_unified`                 | boolean                       | Use a unified KV cache across sequences                                |
+| `swa_full`                   | boolean                       | Materialize full attention even for sliding-window layers              |
+| `ctx_shift`                  | boolean                       | Allow llama.cpp's rolling context shift                                |
+| `use_mmap`, `use_mlock`      | boolean                       | Memory-mapping / locking                                               |
+| `no_extra_bufts`             | boolean                       | Disable extra compute buffer types                                     |
+| `cpu_mask`, `cpu_strict`     | string / boolean              | CPU affinity (advanced)                                                |
+| `devices`                    | string[]                      | Restrict to specific GGML devices                                      |
+| Speculative keys             | various                       | `speculative`, `spec_type`, `spec_draft_n_max/n_min/p_min/p_split`     |
+
+### `[autodiscover]`
+
+Set `autodiscover = true` for defaults, `false` (or omit) to disable, or a table for fine control:
 
-[runtime]
-cache_dir = "~/.buttress/models"
+```toml
+[autodiscover]
+udp.port = 8089
+udp.announcements = { enabled = true, interval = 5000 }
+udp.requests       = { enabled = true, responseDelay = 100 }
+http.enabled = true
+http.path    = "/buttress/info"
+http.cors    = true
+# mdns.enabled = false   # Bonjour/Avahi advertisement (optional)
+```
 
-# Session state cache for ggml-llm (saves KV cache to disk for prompt reuse)
-[runtime.session_cache]
-enabled = true
-max_size_bytes = "10GB"  # Supports string (e.g., "10GB", "500MB") or number
-max_entries = 1000
+### `[[generators]]`
+
+Every generator entry has a `type`, an optional `[generators.backend]` table, and a `[generators.model]` table:
+
+```toml
+[[generators]]
+type = "ggml-llm"        # or "ggml-stt" / "mlx-llm"
+
+[generators.backend]
+# (see per-type sections below)
+
+[generators.model]
+repo_id = "..."
+# (see per-type sections below)
+```
+
+#### Common `[generators.model]` keys
+
+Shared by **all** generator types:
+
+| Key                       | Type      | Notes                                                                            |
+| ------------------------- | --------- | -------------------------------------------------------------------------------- |
+| `repo_id` *(required)*    | string    | HuggingFace repo (`org/repo`)                                                    |
+| `revision`                | string    | Default `"main"`                                                                 |
+| `download`                | boolean   | Pre-download at server startup (default `false`)                                 |
+
+Additional keys honored by **ggml-llm** and **ggml-stt** (mlx-llm gets quantization from the repo itself and does not use these):
+
+| Key                       | Type      | Notes                                                                            |
+| ------------------------- | --------- | -------------------------------------------------------------------------------- |
+| `filename`                | string    | Pin a specific artifact in the repo                                              |
+| `url`                     | string    | Direct download URL (skips manifest lookup)                                      |
+| `quantization`            | string    | Preferred quant tag — e.g. `q4_0`, `q8_0`, `mxfp4`                               |
+| `preferred_quantizations` | string[]  | Ordered fallback list when `quantization` doesn't match (alias: `quantizations`) |
+| `allow_local_file`        | boolean   | Required to use `local_path` / `mmproj_local_path`                               |
+| `local_path`              | string    | Use a local file as the load path. Repo metadata is still resolved from HF, so `repo_id` is still required. |
+| `api_base`, `base_url`    | string    | Override HF API / blob hosts (mirrors / proxies)                                 |
+
+---
+
+### `ggml-llm` (llama.cpp via `@fugood/llama.node`)
+
+Loads a GGUF LLM. Runtime keys above can be overridden per-generator under `[generators.model]`; `[generators.backend]` only controls backend selection and resource planning.
+
+**`[generators.backend]`**
 
-# GGML LLM generator
+| Key                   | Type     | Default                                       | Notes                                                            |
+| --------------------- | -------- | --------------------------------------------- | ---------------------------------------------------------------- |
+| `variant`             | string   | auto                                          | Force `cuda` / `vulkan` / `snapdragon` / `default`               |
+| `variant_preference`  | string[] | `["cuda","vulkan","snapdragon","default"]`    | Probe order when `variant` is unset                              |
+| `gpu_memory_fraction` | number   | `0.85`                                        | Max GPU fraction the hardware guardrails may plan against        |
+| `cpu_memory_fraction` | number   | `0.5`                                         | Max RAM fraction for CPU-side buffers                            |
+
+**`[generators.model]`** — in addition to the common keys above:
+
+| Key                                                                           | Type             | Notes                                                                |
+| ----------------------------------------------------------------------------- | ---------------- | -------------------------------------------------------------------- |
+| `n_ctx`                                                                       | number           | Context window. Auto-capped at the model's training context.         |
+| `n_gpu_layers`                                                                | number\|`"auto"` | Layers offloaded to GPU (default `"auto"`)                           |
+| `n_batch`                                                                     | number           | Prompt batch size (default `512`)                                    |
+| `n_ubatch`, `n_threads`, `n_parallel`, `n_cpu_moe`                            | number           | Same semantics as the `[runtime]` defaults                           |
+| `flash_attn_type`, `cache_type_k`, `cache_type_v`, `kv_unified`, `swa_full`, `ctx_shift`, `use_mmap`, `use_mlock`, `no_extra_bufts`, `cpu_mask`, `cpu_strict`, `devices` | various | Per-model overrides for the `[runtime]` defaults |
+
+**Multimodal (mtmd)** — auto-downloads the matching `mmproj-*.gguf` from the same repo and calls `initMultimodal`:
+
+| Key                       | Type    | Notes                                                              |
+| ------------------------- | ------- | ------------------------------------------------------------------ |
+| `enable_mtmd`             | boolean | Default `false`                                                    |
+| `mmproj_filename`         | string  | Pin a specific projector file                                      |
+| `mmproj_url`              | string  | Direct URL override                                                |
+| `mmproj_local_path`       | string  | Local projector (requires `allow_local_file = true`)               |
+| `mmproj_use_gpu`          | boolean | `null` = auto (true when `n_gpu_layers > 0`)                       |
+| `mmproj_image_min_tokens` | number  | Min visual tokens (dynamic-resolution models; `-1` = unset)        |
+| `mmproj_image_max_tokens` | number  | Max visual tokens (`-1` = unset)                                   |
+
+**Speculative decoding**
+
+| Key                  | Type   | Notes                                              |
+| -------------------- | ------ | -------------------------------------------------- |
+| `speculative`        | string | Draft model identifier                             |
+| `spec_type`          | string | Strategy (backend-defined)                         |
+| `spec_draft_n_max`   | int    | Max drafted tokens per step                        |
+| `spec_draft_n_min`   | int    | Min drafted tokens                                 |
+| `spec_draft_p_min`   | number | Min acceptance probability                         |
+| `spec_draft_p_split` | number | Split threshold                                    |
+
+**Example**
+
+```toml
 [[generators]]
 type = "ggml-llm"
 [generators.backend]
 variant_preference = ["cuda", "vulkan", "default"]
+gpu_memory_fraction = 0.95
 [generators.model]
 repo_id = "ggml-org/gpt-oss-20b-GGUF"
 quantization = "mxfp4"
 n_ctx = 12800
+download = true
+```
+
+---
+
+### `ggml-stt` (whisper.cpp via `@fugood/whisper.node`)
 
-# GGML STT (Speech-to-Text) generator
+Loads a Whisper GGML model for speech-to-text.
+
+**`[generators.backend]`**
+
+| Key                   | Type     | Default                       | Notes                              |
+| --------------------- | -------- | ----------------------------- | ---------------------------------- |
+| `variant`             | string   | auto                          | `cuda` / `vulkan` / `default`      |
+| `variant_preference`  | string[] | `["cuda","vulkan","default"]` | Probe order                        |
+| `gpu_memory_fraction` | number   | `0.85`                        |                                    |
+| `cpu_memory_fraction` | number   | `0.5`                         |                                    |
+
+**`[generators.model]`** — common keys plus:
+
+| Key                       | Type                          | Default                          | Notes                                                |
+| ------------------------- | ----------------------------- | -------------------------------- | ---------------------------------------------------- |
+| `repo_id`                 | string                        | `"BricksDisplay/whisper-ggml"`   | Defaulted (unlike ggml-llm)                          |
+| `preferred_quantizations` | string[]                      | `["q8_0", <no-quant>, "q5_1"]`   | Default fallback chain                               |
+| `use_gpu`                 | boolean                       | `true`                           | Force-disable GPU even when available                |
+| `use_flash_attn`          | `"on"` / `"off"` / `"auto"` / boolean | `"auto"`                 | `"auto"` enables flash-attn when GPU is in use. `true`/`false` are accepted as shortcuts for `"on"`/`"off"`. |
+
+**Runtime extras** — under `[runtime]` for ggml-stt only:
+
+| Key           | Type   | Notes                                       |
+| ------------- | ------ | ------------------------------------------- |
+| `max_threads` | number | Caps the whisper.cpp thread count           |
+
+**Example**
+
+```toml
 [[generators]]
 type = "ggml-stt"
 [generators.backend]
-variant_preference = ["coreml", "default"]
+variant_preference = ["cuda", "vulkan", "default"]
 [generators.model]
 repo_id = "BricksDisplay/whisper-ggml"
-filename = "ggml-small.bin"
+filename = "ggml-large-v3-turbo-q8_0.bin"
+use_gpu = true
+use_flash_attn = "on"
+download = true
+```
+
+---
+
+### `mlx-llm` (Apple Silicon, Python `mlx-lm` / `mlx-vlm` bridge)
+
+Loads an MLX-format model on Apple Silicon. On first use, the backend creates a virtualenv at `{cache_dir}/mlx-env` and installs `mlx_lm_package`, `mlx_vlm_package`, plus `torch` and `torchvision` (required by some VLM processors). If an existing venv already has `mlx_vlm` and `torch` importable, the install step is skipped. There is no `[generators.backend]` section.
+
+**`[generators.model]`** — common `repo_id` / `revision` / `download` plus:
+
+| Key                | Type                | Default   | Notes                                                                         |
+| ------------------ | ------------------- | --------- | ----------------------------------------------------------------------------- |
+| `adapter_path`     | string              | —         | Local LoRA adapter directory                                                  |
+| `vlm`              | `"auto"` / boolean  | `"auto"`  | Force VLM (`true`) vs text-only (`false`); `"auto"` infers from the repo      |
+| `tokenizer_config` | table               | —         | Forwarded to `mlx_lm.load(..., tokenizer_config=...)`                         |
+| `model_config`     | table               | —         | Forwarded to `mlx_lm.load(..., model_config=...)`                             |
+
+`quantization`, `filename`, and `preferred_quantizations` are **not** used — the MLX repo itself determines the quantization.
+
+**Runtime extras** — under `[runtime]` for mlx-llm:
+
+| Key                 | Type   | Default                       | Notes                                                                |
+| ------------------- | ------ | ----------------------------- | -------------------------------------------------------------------- |
+| `mlx_env_dir`       | string | `{cache_dir}/mlx-env`         | Location of the auto-managed Python venv                             |
+| `mlx_lm_package`    | string | `"mlx-lm==0.31.1"`            | pip spec used when provisioning the venv                             |
+| `mlx_vlm_package`   | string | `"mlx-vlm==0.4.0"`            | pip spec used when provisioning the venv                             |
+| `session_cache.*`   | table  | enabled, `5GB`, 100 entries   | Separate cache from ggml-llm (lives in `{cache_dir}/mlx-session-cache`) |
+
+**Example**
+
+```toml
+[[generators]]
+type = "mlx-llm"
+[generators.model]
+repo_id = "mlx-community/Qwen2.5-VL-3B-Instruct-4bit"
+vlm = true
+download = true
 ```
 
 ### Programmatic Usage

package/config/sample.toml

@@ -11,18 +11,21 @@
 # HF_TOKEN = "your_huggingface_token_here"
 # CUDA_VISIBLE_DEVICES = "0"
 
+[autodiscover]
+enabled = true
+
 [server]
 port = 2080
 log_level = "info"
 # max_body_size = "100MB"  # Supports string (e.g., "100MB", "1GB") or number in bytes
 
 [openai_compat]
-# enabled = true
+enabled = true
 # cors_allowed_origins = ["http://localhost:3000", "https://example.com"]  # Restrict to specific origins
 # cors_allowed_origins = "*"  # Allow all origins (default)
 
 [anthropic_messages]
-# enabled = true
+enabled = true
 # cors_allowed_origins = ["http://localhost:3000", "https://example.com"]
 # cors_allowed_origins = "*"
 

package/lib/chunk-C7Qqr4sF.mjs

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+var e=Object.defineProperty,t=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,r=Object.prototype.hasOwnProperty,i=(e,t)=>()=>(e&&(t=e(e=0)),t),a=(e,t)=>()=>(t||e((t={exports:{}}).exports,t),t.exports),o=(t,n)=>{let r={};for(var i in t)e(r,i,{get:t[i],enumerable:!0});return n&&e(r,Symbol.toStringTag,{value:`Module`}),r},s=(i,a,o,s)=>{if(a&&typeof a==`object`||typeof a==`function`)for(var c=n(a),l=0,u=c.length,d;l<u;l++)d=c[l],!r.call(i,d)&&d!==o&&e(i,d,{get:(e=>a[e]).bind(null,d),enumerable:!(s=t(a,d))||s.enumerable});return i},c=t=>r.call(t,`module.exports`)?t[`module.exports`]:s(e({},`__esModule`,{value:!0}),t);export{c as i,i as n,o as r,a as t};

package/lib/index.d.mts

@@ -1,8 +1,17 @@
 
 import { AnyElysia, Elysia } from "elysia";
+import * as node_stream_web0 from "node:stream/web";
 import { ReadableStream } from "node:stream/web";
+import crypto from "node:crypto";
 import { EventEmitter } from "node:events";
+import { estimateOnnxRuntimeMemory as estimateRuntimeMemory } from "@fugood/buttress-hardware-guardrails";
 
+//#region ../buttress-backend-core/lib/types/test-caps-config.d.ts
+declare function createTestCapsDefaultConfigResolver(defaultConfig: any, type: any): {
+  globalDefaults: any;
+  resolveDefaultConfig: (modelRepoId: any) => {};
+};
+//#endregion
 //#region ../buttress-backend-core/lib/types/caps.d.ts
 declare function getCapabilities(type: any, currentClientCapabilities?: any, options?: {}): Promise<any>;
 //#endregion
@@ -100,8 +109,80 @@ declare function testGgmlSttCapabilities({
   modelId: string | null;
   defaultConfig: any | null;
 }): Promise<void>;
+//#endregion
+//#region ../buttress-backend-core/lib/types/utils/onnx.d.ts
+declare function resolveModelCacheDir(cacheDir: string, repoId: string, revision?: string): string;
+declare function estimateOnnxModelSize({
+  repoId,
+  revision,
+  modelType,
+  dtype,
+  cacheDir,
+  baseUrl,
+  subfolder,
+  headers,
+  configJson
+}: {
+  repoId: string;
+  revision?: string;
+  modelType?: string;
+  dtype?: string | Record<string, string>;
+  cacheDir?: string;
+  baseUrl?: string;
+  subfolder?: string;
+  headers?: Record<string, string>;
+  configJson?: Record<string, any>;
+}): Promise<{
+  totalBytes: number;
+  files: Array<{
+    name: string;
+    dtype: string;
+    bytes: number;
+  }>;
+  warnings: string[];
+  source: "local" | "remote";
+}>;
+declare function resolveOnnxDownloadManifest({
+  repoId,
+  revision,
+  modelType,
+  dtype,
+  cacheDir,
+  baseUrl,
+  subfolder,
+  headers,
+  configJson
+}: {
+  repoId: string;
+  revision?: string;
+  modelType?: string;
+  dtype?: string | Record<string, string>;
+  cacheDir: string;
+  baseUrl?: string;
+  subfolder?: string;
+  headers?: Record<string, string>;
+  configJson?: Record<string, any>;
+}): Promise<{
+  modelDir: string;
+  files: Array<{
+    rfilename: string;
+    url: string;
+    localPath: string;
+    size: number;
+  }>;
+  config: Record<string, any> | null;
+}>;
+declare function startOnnxModelDownload(config: object, globalDownloadManager: object, options?: {
+  onProgress?: (p: number) => void;
+  onComplete?: (info: object) => void;
+  onError?: (err: Error) => void;
+}): Promise<{
+  started: boolean;
+  localPath: string | null;
+  repoId: string | null;
+}>;
 declare namespace index_d_exports {
-  export { finalizeGenerator, generatorRegistry, getCapabilities, getModelIdentifier, ggmlLlm, ggmlStt, globalDownloadManager, mlxLlm, showModelsTable, showSttModelsTable, startGenerator, startModelDownload, status, testGgmlLlmCapabilities, testGgmlSttCapabilities };
+  export { createTestCapsDefaultConfigResolver, estimateOnnxModelSize, estimateRuntimeMemory, finalizeGenerator, generatorRegistry, getCapabilities, getModelIdentifier, ggmlLlm, ggmlStt, globalDownloadManager, mlxLlm, onnxStt, onnxTts, resolveModelCacheDir, resolveOnnxDownloadManifest, showModelsTable, showSttModelsTable, startGenerator, startModelDownload, startOnnxModelDownload, status, testGgmlLlmCapabilities, testGgmlSttCapabilities };
 }
 declare function startGenerator(type: any, config: any): Promise<{
   id: any;
@@ -131,8 +212,47 @@ declare namespace mlxLlm {
   function applyChatTemplate(id: any, property: any): Promise<any>;
   function releaseContext(id: any, property: any): Promise<any>;
 }
+declare namespace onnxStt {
+  function initContext(id: any, property: any): Promise<any>;
+  /**
+   * @returns {import('node:stream/web').ReadableStream}
+   */
+  function transcribe(id: any, property: any): node_stream_web0.ReadableStream;
+  function transcribeData(id: any, property: any): Promise<any>;
+  function releaseContext(id: any, property: any): Promise<any>;
+}
+declare namespace onnxTts {
+  function initContext(id: any, property: any): Promise<any>;
+  function addSpeaker(id: any, speaker: any): Promise<any>;
+  function synthesize(id: any, property: any): Promise<any>;
+  function releaseContext(id: any, property: any): Promise<any>;
+}
 declare namespace status {
-  export function getFullStatus(): any;
+  export function getFullStatus(): {
+    timestamp: string;
+    ggmlLlm: any;
+    ggmlStt: any;
+    mlxLlm: any;
+    onnxStt: any;
+    onnxTts: {
+      generators: {
+        id: any;
+        type: any;
+        refCount: any;
+        repoId: any;
+        dtype: any;
+        provider: any;
+        device: any;
+        modelBytes: any;
+        vocoderRepoId: any;
+        pipelines: any;
+      }[];
+      history: {
+        modelLoads: any[];
+        syntheses: any[];
+      };
+    };
+  };
   export function getGgmlLlmStatus(): any;
   export function getGgmlSttStatus(): any;
   export function getMlxLlmStatus(): any;
@@ -183,7 +303,7 @@ declare namespace globalDownloadManager {
  * The download will be tracked by the global download manager so that
  * initContext can wait for it if needed.
  *
- * @param {string} type - The generator type ('ggml-llm' or 'ggml-stt')
+ * @param {string} type - The generator type ('ggml-llm', 'ggml-stt', etc.)
  * @param {Object} config - The generator configuration
  * @param {Object} options - Options for the download
  * @param {function} options.onProgress - Progress callback (0-1)
@@ -222,7 +342,7 @@ type RuntimeConfig = {
   huggingface_token?: string;
   session_cache?: SessionCacheConfig;
 } & Record<string, any>;
-type GeneratorType = 'ggml-llm' | 'ggml-stt' | 'mlx-llm';
+type GeneratorType = 'ggml-llm' | 'ggml-stt' | 'mlx-llm' | 'onnx-stt' | 'onnx-tts';
 type GeneratorConfig = {
   type: GeneratorType;
 } & Record<string, any>;
@@ -279,24 +399,41 @@ type Config = {
   generators: GeneratorConfig[];
 };
 type GeneratorInfo = {
-  type: GeneratorType;
+  type: GeneratorType; /** Performance score 0–100 from buttress-hardware-guardrails. */
+  score?: number; /** Whether the host has an accelerator (GPU/Metal/etc) for this backend. */
+  hasGpu?: boolean; /** Usable memory in bytes for this backend (GPU when present, else CPU). */
+  usableBytes?: number;
 } & Record<string, any>;
 type ServerInfo = {
   id: string;
   name: string;
+  version: string;
   address: string;
+  addresses?: string[];
   port: number;
   url: string;
   generators: GeneratorInfo[];
   authentication: {
     required: boolean;
-    type: string;
+    type: string; /** Issuer key id (when type === 'workspace-jwt'). */
+    kid?: string; /** True when buttress is paired with a workspace. */
+    bound?: boolean;
+  }; /** Workspace identity (only present when paired). */
+  workspace?: {
+    id: string;
+    name?: string;
   };
 };
 //#endregion
 //#region src/autodiscover/types.d.ts
 type GetServerInfoFn = () => ServerInfo;
 //#endregion
+//#region src/autodiscover/sign.d.ts
+interface AnnounceSigner {
+  kid: string;
+  privateKey: crypto.KeyObject;
+}
+//#endregion
 //#region src/autodiscover/index.d.ts
 /**
  * Autodiscover service that manages discovery transports.
@@ -306,9 +443,10 @@ type GetServerInfoFn = () => ServerInfo;
 declare class AutodiscoverService {
   private config;
   private getServerInfo;
+  private signer;
   private transports;
   private started;
-  constructor(config: AutodiscoverConfig, getServerInfo: GetServerInfoFn);
+  constructor(config: AutodiscoverConfig, getServerInfo: GetServerInfoFn, signer: AnnounceSigner | null);
   start(): Promise<void>;
   stop(): Promise<void>;
 }