byollm 0.1.0-alpha.21 → 0.1.0-alpha.23

package/README.md

@@ -1,5 +1,5 @@
 > [!WARNING]
-> **Alpha (`0.1.0-alpha.21`) — under active development. Don't use this yet.**
+> **Alpha (`0.1.0-alpha.23`) — under active development. Don't use this yet.**
 >
 > Install it deliberately: `npx byollm@alpha`, or `npm install byollm@alpha`.
 >
@@ -79,6 +79,18 @@
 > `byollm offer <backend> public --cap <cents>`. Local base URLs are
 > unaffected. `byollm backends` shows the cost class per route.
 
+<!-- release-note 0.1.0-alpha.21 -->
+> [!NOTE]
+> **`0.1.0-alpha.20` is not a complete release — do not pin it.** Four
+> packages published and `@byollm/server` did not: a Sigstore
+> transparency-log 409 on its provenance attestation. The workflow's
+> "already published" guard correctly refuses to resume a partial publish,
+> so `0.1.0-alpha.23` is that release, whole.
+>
+> If you run the Supabase adapter, `alpha.21` needs
+> `20260819010000_completed_by_lease_id.sql`: alpha.19 shipped §3.6's
+> ordering without the column it stores the grant in.
+
 # `byollm`
 
 What end users run. Connects **outbound** to an app you trust, claims only the

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   main
-} from "./chunk-ZGQPZK66.js";
+} from "./chunk-7EO6XN4N.js";
 
 // src/bin.ts
 process.exitCode = await main(process.argv.slice(2));

package/dist/{chunk-ZGQPZK66.js → chunk-7EO6XN4N.js}

@@ -1892,6 +1892,7 @@ var Runner = class {
   #capabilities = [];
   #paused = false;
   #revoked = false;
+  #awaitingConsent = false;
   #stopped = false;
   #lastError;
   #completed = 0;
@@ -2174,6 +2175,15 @@ var Runner = class {
       type: "heartbeat",
       capabilities: capabilities.length
     });
+    if (heartbeat.awaitingConsent === true) {
+      if (!this.#awaitingConsent) {
+        this.#awaitingConsent = true;
+        this.#options.onEvent?.({ type: "awaiting-consent" });
+      }
+    } else if (this.#awaitingConsent) {
+      this.#awaitingConsent = false;
+      this.#options.onEvent?.({ type: "consent-resumed" });
+    }
     if (heartbeat.revoked) {
       this.#revoked = true;
       this.cancelAll();
@@ -2276,12 +2286,21 @@ var Runner = class {
       // everything about it.
       plaintext: JSON.stringify({ outcome, ran }),
       senderKeys: keys,
-      recipientEncryptionPublic: identity.sitePinned.encryption,
+      // Back to the site that sent it, which is not necessarily the only
+      // site this machine serves. Sealing to `sitePinned` would send site B's
+      // answer to site A — unopenable there, and readable by nobody, which
+      // presents as a job that ran and never came back.
+      recipientEncryptionPublic: this.#pinFor(job).encryption,
       context: {
         jobId: job.id,
         senderKeyId: keyId(publicIdentityOf2(keys).identity),
-        recipientKeyId: keyId(identity.sitePinned.identity),
-        deadlineAt: Date.now() + ENVELOPE_MAX_AGE_MS,
+        recipientKeyId: keyId(this.#pinFor(job).identity),
+        // This runner's clock, not the process's — cloud_008 §31. The only
+        // `Date.now()` left in this class, in the one place that stamps a
+        // deadline somebody else enforces: a test that moves time moved every
+        // other clock here and not this one, so a sealed result carried an
+        // expiry from a different timeline than the lease it answered.
+        deadlineAt: this.#now() + ENVELOPE_MAX_AGE_MS,
         direction: "result"
       }
     });
@@ -2345,16 +2364,17 @@ var Runner = class {
       );
     }
     const keys = await identity.keys();
-    const pinnedKeyId = keyId(identity.sitePinned.identity);
-    if (job.site !== pinnedKeyId) {
+    const pinned = this.#pinFor(job);
+    const pinnedKeyId = keyId(pinned.identity);
+    if (envelope.senderKeyId !== job.site) {
       throw new Error(
-        `refusing job ${job.id}: it names site ${job.site}, but this machine is paired with ${pinnedKeyId}`
+        `refusing job ${job.id}: the stub names site ${job.site}, but the payload declares it was sealed by ${envelope.senderKeyId}`
       );
     }
     const opened = await open({
       envelope,
       recipientKeys: keys,
-      senderIdentityPublic: identity.sitePinned.identity,
+      senderIdentityPublic: pinned.identity,
       expected: {
         jobId: job.id,
         senderKeyId: pinnedKeyId,
@@ -2369,6 +2389,39 @@ var Runner = class {
     }
     return JSON.parse(opened.plaintext);
   }
+  /**
+   * The pinned key for the site a stub names — cloud_009 §5.
+   *
+   * One place, because both legs need it and they must agree: opening the
+   * payload with site A's key while sealing the answer to site B is a job
+   * that runs, produces something nobody can read, and reports success.
+   *
+   * A site the map does not hold is refused by name rather than falling back
+   * to any key at hand. The fallback is the failure this exists to prevent —
+   * the relay chooses `stub.site`, and a daemon that treats an unknown site
+   * as "probably the one I know" has handed the choice of which key verifies
+   * its work to the party the pinning is defending against.
+   */
+  #pinFor(job) {
+    const identity = this.#options.identity;
+    if (!identity) {
+      throw new Error("this daemon has no keys, so it has no site to pin");
+    }
+    const fromMap = identity.sites?.get(job.site);
+    if (fromMap) return fromMap;
+    if (job.site === keyId(identity.sitePinned.identity)) {
+      return identity.sitePinned;
+    }
+    const paired = [
+      .../* @__PURE__ */ new Set([
+        keyId(identity.sitePinned.identity),
+        ...identity.sites?.keys() ?? []
+      ])
+    ].sort();
+    throw new Error(
+      `refusing job ${job.id}: it names site ${job.site}, which this machine is not paired with (paired with ${paired.join(", ")})`
+    );
+  }
   /**
    * Report-and-forget.
    *
@@ -2695,6 +2748,19 @@ function report(origin, event, io) {
       break;
     case "revoked":
       io.out(`${at} ${host} this runner was revoked. Stopping.
+`);
+      break;
+    // Not a fault and not a revocation: the terms this machine runs under
+    // changed, and the person who has to read them is the one at this
+    // keyboard. The daemon keeps running and keeps its pairing.
+    case "awaiting-consent":
+      io.out(
+        `${at} ${host} paused \u2014 the terms changed and are waiting for you. Open your connections page to read them; nothing runs until you do.
+`
+      );
+      break;
+    case "consent-resumed":
+      io.out(`${at} ${host} resumed \u2014 thank you.
 `);
       break;
     case "error":
@@ -3158,7 +3224,7 @@ async function main(argv) {
 }
 
 // src/index.ts
-var DAEMON_VERSION = "0.1.0-alpha.21";
+var DAEMON_VERSION = "0.1.0-alpha.23";
 function daemonVersion() {
   return {
     daemon: DAEMON_VERSION,
@@ -3210,4 +3276,4 @@ export {
   runCli,
   main
 };
-//# sourceMappingURL=chunk-ZGQPZK66.js.map
+//# sourceMappingURL=chunk-7EO6XN4N.js.map