@nylorun/agents 0.10.0-beta → 0.12.0-beta

package/CHANGELOG.md

@@ -1,5 +1,58 @@
 # @nylorun/agents
 
+## 0.12.0-beta
+
+### Minor Changes
+
+- 4b9906f: **Breaking: "Tenant" replaces "stack", and `nylorun start` works anywhere.** Each local installation holds one Tenant, and its name is the Tenant's name, so help, output, errors and docs say Tenant. See MIGRATION.md.
+
+  - **Breaking (`nylorun`): selection.** Every command acts on the Tenant `--tenant <name>` names (replaces `--name`, which is removed), else `NYLORUN_TENANT` (replaces `NYLORUN_STACK`), else the Project link's `tenant`; `start` in a project names a new one after the project directory. Outside a project, or with `start --no-link`, commands act on the Tenant `default`. In a project without a link, commands other than `start` exit 2 and list the machine's Tenants. A name starting with `tn_` (a Tenant id) is refused.
+  - **Breaking (`nylorun`): files.** Host roots are under `~/.nylorun/tenants/<name>/` (was `~/.nylorun/stacks/<name>/`) with `tenant.json` (was `stack.json`); the `.env` key is `NYLORUN_TENANT_NAME` (was `NYLORUN_STACK_NAME`); `NYLORUN_COMPOSE_PROJECT` replaces `NYLORUN_STACK_PROJECT`. Compose projects stay `nylorun-<name>`. Every command first moves 0.4 Host roots from `~/.nylorun/stacks/` to `~/.nylorun/tenants/` (renaming `stack.json` and the `.env` key), so they keep their volumes and keys. `nylorun ls` lists only directories with `tenant.json`.
+  - **Breaking (`nylorun`): removed.** `nylorun legacy` and all handling of the single stack of releases before 0.4; the hidden `nylorun stack <cmd>` alias; `nylorun doctor stack|runtime`. Output says Tenant: `ls` prints `TENANT` and JSON `{ "tenants": [...] }`, `status` prints the Tenant id on its own line, and `doctor`'s row is `tenant`.
+  - **Breaking: Project link format 3.** `.nylorun/link.json` is `{ "format": 3, "tenant", "tenantId", "hostUrl", "hostId" }`; `tenant` replaces `stack`. `@nylorun/agents`, `@nylorun/cli` and `@nylorun/admin` refuse an older link and name `npx nylorun start`, which rewrites it. `@nylorun/core`'s `ProjectLinkFileSchema` parses formats 0–3 with `tenant`.
+  - **Breaking (`@nylorun/admin`):** `createAdmin({ tenant })` replaces `{ stack }`, `tenantHostRoot(name)` replaces `stackHostRoot(name)`, and local resolution reads `NYLORUN_TENANT` and the link's `tenant`.
+  - `@nylorun/cli`: `status` and `endpoints` drop the `stack` line and JSON key; messages say Tenant. `@nylorun/agents`: a Runtime too old for the client says "update the Runtime (npx nylorun@latest start)". `@nylorun/studio`: setup hints say Tenant. `@nylorun/create-agent`: the next steps describe `npx nylorun@beta start` as this project's Tenant and its link.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [4b9906f]
+  - @nylorun/core@0.11.0-beta
+
+## 0.11.0-beta
+
+### Major Changes
+
+- 5ca1923: **Clients for one Tenant per installation: a stack per project, nothing selects a Tenant.** Upgrade these with the Runtime; they speak protocol 5. Existing stacks are left as they are: see MIGRATION.md.
+
+  - **Breaking (`nylorun`): one stack per project.** `nylorun start` in a project creates the project's stack (named after the project directory, or `--name`; Host root `~/.nylorun/stacks/<name>/`, Compose project `nylorun-<name>`, its own free ports and volumes), waits for its Runtime to create the stack's Tenant, writes the Project link (`.nylorun/link.json` format 2: `stack`, `hostUrl`, `hostId`, `tenantId`) and `.nylorun/credentials.json` (the key of the derived principal `project`, derived from the stack's admin key), and seeds the model provider from the project's `.env`. `nylorun ls` lists the machine's stacks and `nylorun delete <name>` removes one with its volumes and Host root. `nylorun status` shows the stack's Tenant; `nylorun studio` opens it. The old single stack under `~/.nylorun` is never touched: `start` notes it, and `nylorun legacy stop|delete` handles it. Every stack command takes `--name <stack>` (or `NYLORUN_STACK`, or the Project link's stack); `start --no-link` starts a stack without linking the directory; `nylorun reset` resets the selected stack only. The runtime container's healthcheck is now `/health`, so a Tenant that cannot open is reported by `start` from the Admin status at once instead of after a 300 s wait. `NYLORUN_HOME` still overrides the Host root. Stacks start and stop only when you say so.
+  - **Breaking (`@nylorun/cli`): no Tenant commands.** `nylo tenant create|use|list|current|delete` are removed; `nylo status`, `nylo reset` and `nylo endpoints` replace `nylo tenant status|reset|endpoints` on the linked installation. `nylo env` prints `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` only. `nylo` no longer writes Project links.
+  - **Breaking (`@nylorun/agents`): no Tenant to name.** The `tenant` option (`createClient`, `Transport`, `resolveConnection`, `createActionHandler({ runtime })`, `JwksCache`) and `NYLORUN_TENANT` are gone, and no request sends `Nylorun-Tenant`; a connection is a URL and a key. A Project link of format 0 or 1 is refused with `connection_missing`, naming `npx nylorun start`. `verifyDeliveryToken`'s `tenantId` is optional: without it any Tenant issuer is accepted, since the installation's keys bind it. `TENANT_HEADER` is no longer re-exported.
+  - **Breaking (`@nylorun/admin`): status only.** `createTenant`, `listTenants`, `getTenant` and `deleteTenant` are removed; `status().tenant` names the Host's Tenant, and `deriveTenantKey` / `deriveStudioToken` derive its keys. Local Host resolution reads the stack's Host root (`stack` option, `NYLORUN_STACK`, or the Project link's `stack`); `NYLORUN_HOME` and `home` still override it. `stackHostRoot(name)` is exported.
+  - **Breaking (`@nylorun/studio`): Studio serves its installation's Tenant.** The Tenant picker, list and create are gone, with `/_studio/tenants`; `/` opens `/tenants/<id>`. The `/tenants/:tenant` routes and the login token's `tenant` claim stay for embedders and must name that Tenant. The proxy sends no `Nylorun-Tenant`.
+  - **`@nylorun/create-agent`:** the next steps are `npx nylorun start`, then `npm run dev`.
+  - `@nylorun/core`: `ProjectLinkFileSchema` accepts format 2 with `stack`, and `tenantId` is optional; `ERROR_CODES` loses `tenant_conflict` and `active_work`.
+
+- 5ca1923: **One Tenant per installation: a database per Tenant, protocol 5.** A Runtime serves exactly one Tenant, the one its Postgres database holds. Two Tenants are two installations.
+
+  - **Breaking: fresh start.** The Tenant's state is in the fixed schema `nylorun` of its own database and its record in `nylorun_streams`, keyed by session (no `tenant_id`). A database written by an earlier Runtime (`tenant_<id>` schemas, or a record keyed by Tenant) is refused: the Host stays up but not ready, and `/v1/admin/status` names the cause `database-layout-old`. Point the Runtime at a new database (with the local stack, a new stack); the old one is never changed.
+  - **The Host creates its Tenant** on first start, in the migration transaction: `NYLORUN_TENANT_ID` (default a new id), `NYLORUN_TENANT_NAME` (default `default`), the Studio principal and the derived principals of `NYLORUN_DERIVED_PRINCIPALS` (comma-separated, default `project`), whose keys the admin key derives (`deriveTenantKey`). Later starts open the same Tenant and add derived principals configured since.
+  - **Breaking: no Tenant catalog.** `/v1/admin/tenants` and `/v1/admin/tenants/{tenantId}` are gone (404). `AdminStatus.tenants[]` is replaced by `AdminStatus.tenant` (`id`, `name`, `state: open | unavailable`, `envelope`, and `cause` when it could not be opened). `CreateTenantRequestSchema`, `AdminTenantSchema`, `AdminTenantStatusSchema`, `AdminTenantListSchema` and `QuarantineSchema` leave `@nylorun/core`; `HostTenantSchema` and `TenantCauseSchema` replace them. `@nylorun/admin`'s `listTenants`, `getTenant`, `deleteTenant` and `createTenant` are removed (see below).
+  - **Readiness instead of quarantine.** A Tenant that cannot be opened (`schema-too-new`, `kek-missing`, `migration-failed`, `envelope-invalid`, `database-layout-old`, …) fails `/ready` (check `tenant`, which replaces `discovery`) and is reported with its repair in `/v1/admin/status` and the log; every Tenant request gets the opaque 404. A failure outside it (Postgres unreachable) is retried.
+  - **Protocol 5.** `PROTOCOL_VERSION = 5`; the Host serves protocols 4 and 5 for one release. Clients no longer require `runtime-tenants`; the Host still advertises it. No request needs `Nylorun-Tenant`: a request without it reaches the Host's Tenant, and one naming another Tenant (or a malformed one), or a publishable key of another Tenant, gets the opaque 404. The OpenAPI documents drop the header parameter and the Admin Tenant routes.
+  - **Paths.** The Tenant directory is `<Host root>/tenant/` (was `tenants/<id>/`); `trash/` and the SQLite move to it are gone. The gates service serves its database's Tenant, and its `Nylorun-Tenant` header is optional (when sent, it must name that Tenant).
+  - **Breaking: `startEphemeralRuntime` needs a database; the in-memory Session Store is removed.** `StartEphemeralRuntimeOptions.database` is required: a Postgres URL, for which the Runtime opens a pool and ends it on `close()`, or a pool the caller ends. It creates its Tenant in that database through the same bootstrap as a Host, or serves the Tenant the database already holds; the data stays after `close()`, so give each test Tenant a database of its own. Durable Streams and scheduling stay in process. See `MIGRATION.md`.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [fed780d]
+- Updated dependencies [fed780d]
+- Updated dependencies [7f4c3f1]
+- Updated dependencies [5ca1923]
+- Updated dependencies [5ca1923]
+  - @nylorun/core@0.10.0-beta
+
 ## 0.10.0-beta
 
 ### Major Changes

package/README.md

@@ -24,33 +24,39 @@ The Runtime delivers each tool call, hook and workflow function of these agents
 to `url`, signed with a short-lived **delivery token** that the handler checks
 (Tenant, URL, Action, generation and body) before any code runs. `register`
 saves the definitions, registers the URL and pings it through the Runtime. A
-process that only serves Actions needs no key: pass `runtime: { url, tenant }`
-and it reads the Tenant's public keys. Mark a long tool
+process that only serves Actions needs no key: pass `runtime: { url }` and it
+reads the Tenant's public keys. Mark a long tool
 `tool({ …, background: true })`: the handler answers at once, heartbeats and
-posts the result. `npx @nylorun/cli tenant endpoints` shows each endpoint and
-how its deliveries are doing.
+posts the result. `npx @nylorun/cli endpoints` shows each endpoint and how its
+deliveries are doing.
 
-The URL must be one the Runtime can reach: `localhost` on the local stack
+The URL must be one the Runtime can reach: `localhost` on a local Tenant
 (its Runtime runs in Docker and maps `localhost` to this machine), a public URL
 in production, or a tunnel (ngrok, Cloudflare Tunnel) for a remote Runtime.
 
 `connectAgents` and executors were removed in protocol 3: mount
 `createActionHandler` instead (see [MIGRATION.md](../MIGRATION.md)). The handler
-finds the Runtime through the three `NYLORUN_*` variables or the Project link
-that `npx @nylorun/cli tenant create` writes; with neither, `register` fails
-with `connection_missing` and names those steps. See [MIGRATION.md](../MIGRATION.md#runtime-clients-and-admin-api-breaking-beta)
+finds the Runtime through the two `NYLORUN_*` variables or the Project link
+that `npx nylorun start` writes; with neither, `register` fails with
+`connection_missing` and names those steps. See [MIGRATION.md](../MIGRATION.md#runtime-clients-and-admin-api-breaking-beta)
 for upgrading from `nylorun serve`.
 
 ## Connection resolution
 
 `resolveConnection` / `createClient()` / `createActionHandler({ agents })`:
 
-1. Explicit `{ url, tenant, key }`
-2. Environment — if any of `NYLORUN_RUNTIME_URL`, `NYLORUN_TENANT` or
-   `NYLORUN_SERVER_KEY` is set, all three must be present
-3. Project link — `.nylorun/link.json` + `credentials.json` (the application key)
+1. Explicit `{ url, key }`
+2. Environment — if `NYLORUN_RUNTIME_URL` or `NYLORUN_SERVER_KEY` is set, both
+   must be present
+3. Project link — `.nylorun/link.json` + `credentials.json` (the application
+   key), written by `npx nylorun start`. A link from an older nylorun
+   (format 0 to 2) fails with `connection_missing`: run `npx nylorun start` in
+   the project again.
 
-Sources never mix. Partial environment fails with `connection_missing`.
+Sources never mix. Partial environment fails with `connection_missing`. A
+Runtime serves one Tenant, so nothing names it: the `tenant` option is gone
+(protocol 5), and `NYLORUN_TENANT`, which picks a local Tenant for `nylorun`,
+is ignored.
 
 ```ts
 import { Agent, createActionHandler, createClient, tool } from "@nylorun/agents";
@@ -72,7 +78,6 @@ const assistant = Agent({ id: "assistant", name: "Assistant" })
 const client = createClient({
   url: process.env.NYLORUN_RUNTIME_URL,
   key: process.env.NYLORUN_SERVER_KEY,
-  tenant: process.env.NYLORUN_TENANT,
 });
 await client.saveAgent(assistant, { implementationVersion: "app-1" });
 const session = await client.createSession({
@@ -86,10 +91,7 @@ const history = await session.history();
 const actions = createActionHandler({
   agents: [assistant],
   implementationVersion: "app-1",
-  runtime: {
-    url: process.env.NYLORUN_RUNTIME_URL!,
-    tenant: process.env.NYLORUN_TENANT!,
-  },
+  runtime: { url: process.env.NYLORUN_RUNTIME_URL! },
   url: "https://app.example.com/nylorun/actions",
   onError: console.error,
 });
@@ -102,11 +104,11 @@ await createActionHandler({ agents: [assistant], client }).register({
 
 ```sh
 eval "$(npx @nylorun/cli env)"
-# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY, NYLORUN_TENANT
+# → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY
 ```
 
-Every request sets `Nylorun-Tenant` and `Nylorun-Protocol`. A `tenant` field in a
-body or query is never read from caller input. Before the first authenticated
+Every request sets `Nylorun-Protocol` (5) and no `Nylorun-Tenant`: the Runtime
+serves one Tenant. Before the first authenticated
 request, `Transport` fetches `/health` once, checks protocol compatibility, and
 throws `IncompatibleRuntimeError` / `incompatible_host` when the Host range or
 required features do not match. Re-exports include `PROTOCOL_FEATURES`,
@@ -494,7 +496,7 @@ const { token, expiresAt } = await app.tokens.create({
 });
 ```
 
-The client sends it as `Authorization: Bearer <token>` with `Nylorun-Tenant`.
+The client sends it as `Authorization: Bearer <token>`.
 Tokens carry only `sessions:own`, `vaults:own` and `agents:read`, live at most
 15 minutes, and see only `{ agentId, name, description }` of their role's
 agents. A token that expired or was revoked answers `401` with

package/dist/a2a/handler.js

@@ -45,7 +45,7 @@ export function createA2aHandler(options) {
             const client = await (options.client ?? createClient());
             const features = await client.hostFeatures();
             if (!features.includes(REQUIRED_FEATURE))
-                throw new Problem(502, `The Runtime does not support ${REQUIRED_FEATURE}; upgrade the stack (nylorun up).`, "runtime_feature_missing");
+                throw new Problem(502, `The Runtime does not support ${REQUIRED_FEATURE}; update the Runtime (npx nylorun@latest start).`, "runtime_feature_missing");
             return client;
         })();
         ready.catch(() => {

package/dist/action-handler.d.ts

@@ -16,7 +16,6 @@ export interface ActionHandlerOptions {
      */
     runtime?: {
         url: string;
-        tenant: string;
         fetch?: typeof fetch;
     };
     /** The Tenant's public keys, instead of reading them from the Runtime. */

package/dist/action-handler.js

@@ -41,13 +41,12 @@ export function createActionHandler(options) {
         if (request.method !== "POST")
             return answer(405, "method_not_allowed", "An Action endpoint accepts POST only");
         const body = new Uint8Array(await request.arrayBuffer());
-        const { tenant, url, fetch, keys } = await verificationOf();
+        const { url, fetch, keys } = await verificationOf();
         const token = request.headers.get(SIGNATURE_HEADER);
         let claims;
         try {
             claims = await verifyDeliveryToken(token, {
                 keys: keys.lookup,
-                tenantId: tenant,
                 body,
                 ...(audience === undefined ? {} : { audience }),
             });
@@ -96,7 +95,7 @@ export function createActionHandler(options) {
                 agent,
                 token: token,
                 sandbox: delivery.sandbox,
-                runtime: { url, tenant, ...(fetch ? { fetch } : {}) },
+                runtime: { url, ...(fetch ? { fetch } : {}) },
                 report,
             });
             options.waitUntil?.(work);
@@ -106,7 +105,7 @@ export function createActionHandler(options) {
             ? createActionSandbox({
                 transport: (callbacks = callbacks
                     ? callbacks.withKey(token)
-                    : new Transport({ url, tenant, key: token, ...(fetch ? { fetch } : {}) })),
+                    : new Transport({ url, key: token, ...(fetch ? { fetch } : {}) })),
                 actionId: action.actionId,
                 signal: request.signal,
             })
@@ -254,22 +253,19 @@ async function runInBackground(input) {
 }
 async function resolveVerification(options, clientOf) {
     if (options.runtime) {
-        const { url, tenant, fetch } = options.runtime;
+        const { url, fetch } = options.runtime;
         return {
-            tenant,
             url,
             ...(fetch ? { fetch } : {}),
-            keys: new JwksCache(options.jwks ?? { url, tenant, ...(fetch ? { fetch } : {}) }),
+            keys: new JwksCache(options.jwks ?? { url, ...(fetch ? { fetch } : {}) }),
         };
     }
     const { transport } = await clientOf();
     return {
-        tenant: transport.tenant,
         url: transport.url,
         fetch: transport.fetcher,
         keys: new JwksCache(options.jwks ?? {
             url: transport.url,
-            tenant: transport.tenant,
             key: transport.key,
             fetch: transport.fetcher,
         }),

package/dist/ag-ui/handler.js

@@ -65,7 +65,7 @@ export function createAgUiHandler(options) {
             const features = await client.hostFeatures();
             const missing = REQUIRED_FEATURES.filter((f) => !features.includes(f));
             if (missing.length > 0)
-                throw new Problem(502, `The Runtime does not support ${missing.join(", ")}; upgrade the stack (nylorun up).`, "runtime_feature_missing");
+                throw new Problem(502, `The Runtime does not support ${missing.join(", ")}; update the Runtime (npx nylorun@latest start).`, "runtime_feature_missing");
             return client;
         })();
         ready.catch(() => {

package/dist/client.js

@@ -2,15 +2,12 @@ export * from "./session-client.js";
 import { AgentsClient } from "./session-client.js";
 import { resolveConnection } from "./connection.js";
 export function createClient(destination = {}) {
-    if (destination.url !== undefined ||
-        destination.key !== undefined ||
-        destination.tenant !== undefined) {
+    if (destination.url !== undefined || destination.key !== undefined) {
         return new AgentsClient(destination);
     }
     return resolveConnection().then((connection) => new AgentsClient({
         url: connection.url,
         key: connection.key,
-        tenant: connection.tenant,
         ...(destination.fetch ? { fetch: destination.fetch } : {}),
     }));
 }

package/dist/connection.d.ts

@@ -1,7 +1,6 @@
 import type { ErrorCode } from "@nylorun/core/compatibility";
 export interface ResolvedConnection {
     url: string;
-    tenant: string;
     key: string;
     source: "options" | "environment" | "project-link";
 }
@@ -9,10 +8,12 @@ export declare class ConnectionError extends Error {
     readonly code: ErrorCode;
     constructor(message: string);
 }
-/** Resolve Tenant API connection: options → environment → project link (D§7.1). */
+/**
+ * Resolve Tenant API connection: options → environment → project link (D§7.1). A connection is a
+ * Runtime URL and a key: the Runtime serves one Tenant, so nothing names it.
+ */
 export declare function resolveConnection(options?: {
     url?: string;
-    tenant?: string;
     key?: string;
     cwd?: string;
 }): Promise<ResolvedConnection>;

package/dist/connection.js

@@ -11,8 +11,8 @@ export class ConnectionError extends Error {
 }
 function missing(tried) {
     throw new ConnectionError(`connection_missing: no Runtime connection found (tried ${tried.join(", ")}). ` +
-        `Start the local stack with "npx nylorun up" and link this project with "npx @nylorun/cli tenant create", ` +
-        `or set NYLORUN_RUNTIME_URL, NYLORUN_TENANT and NYLORUN_SERVER_KEY.`);
+        `Run "npx nylorun start" in this project to start its Tenant and link it, ` +
+        `or set NYLORUN_RUNTIME_URL and NYLORUN_SERVER_KEY.`);
 }
 function stripTrailingSlash(url) {
     return url.replace(/\/$/, "");
@@ -37,30 +37,31 @@ async function readProjectLink(startDir) {
             throw error;
         }
         const link = ProjectLinkFileSchema.parse(JSON.parse(linkRaw));
+        // Formats 0 to 2 are from older releases.
+        if (link.format < 3)
+            throw new ConnectionError(`connection_missing: the Project link at ${linkPath} is from an older nylorun. ` +
+                `Run "npx nylorun start" in this project to link it again.`);
         const credentials = ProjectCredentialsFileSchema.parse(JSON.parse(await readFile(join(nylorun, "credentials.json"), "utf8")));
         return {
             url: stripTrailingSlash(link.hostUrl),
-            tenant: link.tenantId,
             key: credentials.applicationKey,
             source: "project-link",
         };
     }
 }
-/** Resolve Tenant API connection: options → environment → project link (D§7.1). */
+/**
+ * Resolve Tenant API connection: options → environment → project link (D§7.1). A connection is a
+ * Runtime URL and a key: the Runtime serves one Tenant, so nothing names it.
+ */
 export async function resolveConnection(options) {
     const tried = [];
     const optionUrl = options?.url;
-    const optionTenant = options?.tenant;
     const optionKey = options?.key;
-    const anyOption = optionUrl !== undefined ||
-        optionTenant !== undefined ||
-        optionKey !== undefined;
     tried.push("options");
-    if (anyOption) {
-        if (optionUrl && optionTenant && optionKey) {
+    if (optionUrl !== undefined || optionKey !== undefined) {
+        if (optionUrl && optionKey) {
             return {
                 url: stripTrailingSlash(optionUrl),
-                tenant: optionTenant,
                 key: optionKey,
                 source: "options",
             };
@@ -68,17 +69,12 @@ export async function resolveConnection(options) {
         missing(tried.concat(["environment", "project-link"]));
     }
     const envUrl = env("NYLORUN_RUNTIME_URL");
-    const envTenant = env("NYLORUN_TENANT");
     const envServerKey = env("NYLORUN_SERVER_KEY");
-    const anyEnv = envUrl !== undefined ||
-        envTenant !== undefined ||
-        envServerKey !== undefined;
     tried.push("environment");
-    if (anyEnv) {
-        if (envUrl && envTenant && envServerKey) {
+    if (envUrl !== undefined || envServerKey !== undefined) {
+        if (envUrl && envServerKey) {
             return {
                 url: stripTrailingSlash(envUrl),
-                tenant: envTenant,
                 key: envServerKey,
                 source: "environment",
             };

package/dist/delivery-token.d.ts

@@ -22,9 +22,15 @@ export declare class DeliveryVerificationError extends Error {
 }
 /** Finds the public key for a `kid`, or `undefined` when the Tenant has none. */
 export type KeyLookup = (kid: string) => Promise<CryptoKey | undefined>;
+/**
+ * Verifies `token` against `body`. The keys are the installation's, so a valid signature already
+ * binds the issuer to its one Tenant: any `urn:nylorun:tenant:<id>` issuer is accepted (and
+ * returned in `iss`) unless `tenantId` names the one expected.
+ */
 export declare function verifyDeliveryToken(token: string | null, options: {
     keys: KeyLookup;
-    tenantId: string;
+    /** When set, `iss` must name this Tenant. */
+    tenantId?: string;
     body: Uint8Array;
     /** When set, `aud` must equal it: the URL this endpoint was registered with. */
     audience?: string;
@@ -45,7 +51,6 @@ export declare class JwksCache {
     private pending;
     constructor(source: {
         url: string;
-        tenant: string;
         key?: string;
         fetch?: typeof fetch;
     } | {

package/dist/delivery-token.js

@@ -4,8 +4,10 @@
  * only, so the SDK takes no JWT dependency: a JWS ES256 signature is the raw `r || s` pair
  * WebCrypto's ECDSA verifies.
  */
-import { PROTOCOL_HEADER, PROTOCOL_VERSION, TENANT_HEADER, } from "@nylorun/core/compatibility";
+import { PROTOCOL_HEADER, PROTOCOL_VERSION, isTenantId } from "@nylorun/core/compatibility";
 import { DELIVERY_TOKEN_TYPE, subjectTokenIssuer } from "@nylorun/core/contracts";
+/** The issuer prefix of a Tenant's tokens: `urn:nylorun:tenant:<tenantId>`. */
+const ISSUER_PREFIX = subjectTokenIssuer("");
 /** Why a delivery was refused; `code` is sent back to the Runtime. */
 export class DeliveryVerificationError extends Error {
     code;
@@ -20,6 +22,11 @@ const SKEW_SECONDS = 30;
 const FORBIDDEN_HEADERS = ["jku", "jwk", "x5u", "x5c", "x5t", "x5t#S256", "crit"];
 /** The largest token accepted: well above a real one, well below a request limit. */
 const MAX_TOKEN_LENGTH = 4096;
+/**
+ * Verifies `token` against `body`. The keys are the installation's, so a valid signature already
+ * binds the issuer to its one Tenant: any `urn:nylorun:tenant:<id>` issuer is accepted (and
+ * returned in `iss`) unless `tenantId` names the one expected.
+ */
 export async function verifyDeliveryToken(token, options) {
     if (!token)
         throw new DeliveryVerificationError("signature_missing", "No delivery token");
@@ -50,7 +57,10 @@ export async function verifyDeliveryToken(token, options) {
         typeof claims.exp !== "number" ||
         typeof claims.jti !== "string")
         throw invalid("Missing claims");
-    if (claims.iss !== subjectTokenIssuer(options.tenantId))
+    if (!claims.iss.startsWith(ISSUER_PREFIX) ||
+        !isTenantId(claims.iss.slice(ISSUER_PREFIX.length)))
+        throw invalid("The token was not issued by a Tenant");
+    if (options.tenantId !== undefined && claims.iss !== subjectTokenIssuer(options.tenantId))
         throw invalid("The token is for another Tenant");
     if (options.audience !== undefined && claims.aud !== options.audience)
         throw invalid(`The token is for ${claims.aud}, not ${options.audience}`);
@@ -111,7 +121,6 @@ export class JwksCache {
     }
     async fetchKeys(source) {
         const headers = {
-            [TENANT_HEADER]: source.tenant,
             [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
         };
         if (source.key)

package/dist/http.d.ts

@@ -8,14 +8,17 @@ export interface TokenSource {
     get(signal?: AbortSignal): Promise<string>;
     invalidate(): void;
 }
+/**
+ * Where a client sends its requests. Nothing names a Tenant: the Runtime at `url` serves one
+ * (protocol 5).
+ */
 export interface Destination {
     url?: string;
     key?: string;
-    tenant?: string;
     fetch?: typeof fetch;
     /** Instead of `key`: subject tokens. The client then skips the `/health` check. */
     token?: TokenSource;
-    /** A publishable key (Host feature `browser-access`); it also names the Tenant. */
+    /** A publishable key (Host feature `browser-access`): names the app and its origins. */
     publishableKey?: string;
 }
 export declare function env(name: string): string | undefined;
@@ -38,8 +41,6 @@ export declare class Transport {
     readonly url: string;
     /** The Tenant key; empty for a client that uses subject tokens. */
     readonly key: string;
-    /** The Tenant id; empty when a publishable key names it. */
-    readonly tenant: string;
     readonly token: TokenSource | undefined;
     readonly publishableKey: string | undefined;
     readonly fetcher: typeof fetch;

package/dist/http.js

@@ -1,4 +1,4 @@
-import { PROTOCOL_FEATURES, PROTOCOL_HEADER, PROTOCOL_VERSION, PUBLISHABLE_KEY_HEADER, TENANT_HEADER, checkCompatibility, } from "@nylorun/core/compatibility";
+import { PROTOCOL_FEATURES, PROTOCOL_HEADER, PROTOCOL_VERSION, PUBLISHABLE_KEY_HEADER, checkCompatibility, } from "@nylorun/core/compatibility";
 export function env(name) {
     return typeof process !== "undefined" ? process.env[name] : undefined;
 }
@@ -56,8 +56,6 @@ export class Transport {
     url;
     /** The Tenant key; empty for a client that uses subject tokens. */
     key;
-    /** The Tenant id; empty when a publishable key names it. */
-    tenant;
     token;
     publishableKey;
     fetcher;
@@ -68,19 +66,15 @@ export class Transport {
         const url = options.url ?? env("NYLORUN_RUNTIME_URL");
         const token = options.token;
         const key = token ? "" : options.key ?? env("NYLORUN_SERVER_KEY");
-        const tenant = options.tenant ?? (token ? undefined : env("NYLORUN_TENANT"));
         if (!url || (!token && !key))
             throw new Error("Set Runtime url and server key explicitly or via NYLORUN_RUNTIME_URL / NYLORUN_SERVER_KEY");
         if (token && options.key)
             throw new Error("Use a Tenant key or subject tokens, not both");
-        if (!tenant && !options.publishableKey)
-            throw new Error("Set tenant explicitly or via NYLORUN_TENANT");
         const parsed = new URL(url);
         if (!["http:", "https:"].includes(parsed.protocol))
             throw new Error("Runtime requires an HTTP(S) URL");
         this.url = url.replace(/\/$/, "");
         this.key = key;
-        this.tenant = tenant ?? "";
         this.token = token;
         this.publishableKey = options.publishableKey;
         // Browsers may not call `/health` (it refuses `Origin`); token clients rely on `426`.
@@ -171,8 +165,6 @@ export class Transport {
             ? await this.token.get(init.signal ?? undefined)
             : this.key;
         headers.set("Authorization", `Bearer ${bearer}`);
-        if (this.tenant)
-            headers.set(TENANT_HEADER, this.tenant);
         if (this.publishableKey)
             headers.set(PUBLISHABLE_KEY_HEADER, this.publishableKey);
         headers.set(PROTOCOL_HEADER, String(PROTOCOL_VERSION));

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, TENANT_HEADER, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
+export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
 export type { ProtocolFeature, ProtocolRange, Compatibility, ErrorCode, } from "@nylorun/core/compatibility";
 export { Agent, AgentBuilder } from "./builder.js";
 export { AgentBuildError, AgentLifecycleError, Loop, Chain, Switch, Parallel, Map, VerdictSchema, isVerdict, withInstructions, withoutTools, WorkflowBuildError, isBuiltWorkflow, capability, CapabilityBuilder, flow, tool, defineSchema, ToolError, } from "@nylorun/core/define";

package/dist/index.js

@@ -1,5 +1,5 @@
 // Definition authoring and wire contracts are the only harness runtime imports.
-export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, TENANT_HEADER, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
+export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
 export { Agent, AgentBuilder } from "./builder.js";
 export { AgentBuildError, AgentLifecycleError, Loop, Chain, Switch, Parallel, Map, VerdictSchema, isVerdict, withInstructions, withoutTools, WorkflowBuildError, isBuiltWorkflow, capability, CapabilityBuilder, flow, tool, defineSchema, ToolError, } from "@nylorun/core/define";
 export { SUBJECT_SCOPES } from "@nylorun/core/contracts";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/agents",
-  "version": "0.10.0-beta",
+  "version": "0.12.0-beta",
   "description": "Nylorun agent definitions, session client and Action endpoint",
   "type": "module",
   "license": "Apache-2.0",
@@ -47,7 +47,7 @@
     "test": "vitest run --passWithNoTests"
   },
   "dependencies": {
-    "@nylorun/core": "0.9.0-beta",
+    "@nylorun/core": "0.11.0-beta",
     "gray-matter": "^4.0.3"
   },
   "peerDependencies": {