@nylorun/agents 0.12.0-beta → 0.14.0-beta

package/CHANGELOG.md

@@ -1,5 +1,77 @@
 # @nylorun/agents
 
+## 0.14.0-beta
+
+### Major Changes
+
+- bd478ee: **Subject tokens, browser keys and derived principals leave open source (F9 I3, protocol 7).** Upgrade these with the Runtime: they speak protocol 7, which this Runtime serves beside 4, 5 and 6; protocol 6 clients keep working on every route that remains. Browsers and apps present a trusted issuer's token (F9 I2), servers an operator key (F9 I1), and a person's own credentials come from the operator's credential resolver (F9 C1). See MIGRATION.md.
+
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): subject tokens are gone.** `POST /v1/tokens`, `POST /v1/access/revocations`, subject-token verification, revocation epochs and the `subject.revoked` stream signal are removed; the routes answer `404`, and a JWT no trusted issuer signed is the opaque `404`. A stream opened with a token now ends only at its expiry (`event: nylorun.closed`, reason `token_expired`; `StreamClosedFrame` loses `revoked`). Migration `0010_oss_auth_removals` drops the `subject_epochs`, `subject_usage` and `publishable_keys` tables. The `token` caller is a trusted issuer's token only: it loses `role`, `limits` and `epoch`, and `issuer` is always set; `GET /v1/me` no longer reports `via: token`. Core drops `SUBJECT_TOKEN_TYPE`, `SUBJECT_TOKEN_AUDIENCE`, `subjectTokenIssuer` (the Runtime's own tokens use `tenantTokenIssuer`, same value), `CreateTokenRequest`/`Response`, `RevokeSubject*`, `SubjectTokenClaims`, `TOKEN_TTL_MIN_SECONDS` and `TOKEN_TTL_DEFAULT_SECONDS`; `TOKEN_SCOPES` is `agents:read`, `sessions:own`, `sandboxes:write`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): the access policy and role limits are gone.** `GET`/`PUT /v1/access/policy` answer `404`, a turn is never refused with `429 limit_exceeded` for a role (limit requests at your proxy), and an existing `access.policy` setting is ignored. Core drops `AccessPolicy*`, `AccessRole*`, `RoleLimits*`, `DEFAULT_ACCESS_POLICY`, `PutAccessPolicyRequest` and `ROLE_NAME_PATTERN`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): publishable keys and the Runtime's CORS are gone.** `/v1/access/publishable-keys*` answer `404`, `Nylorun-Key` is ignored, `NYLORUN_BROWSER_ACCESS` and `browserAccess` (host.json, `createHost`, `startEphemeralRuntime`) are removed, and the Runtime sends no CORS headers. A request with `Origin` reaches the Tenant routes of the public listener with no toggle: a trusted issuer's token is served, an application key or delivery token is `403 origin_rejected`; admin routes, `/health`, `/ready` and the operator listener still refuse `Origin`. Any `OPTIONS` request is `204` with `Allow` and no CORS header: the operator's proxy answers preflights. Route declarations lose `browser` (`x-nylorun-browser` leaves the OpenAPI document) and the `publishable` credential; the token security scheme is `issuerToken`. Core drops `PUBLISHABLE_KEY_HEADER`, `PUBLISHABLE_KEY_PATTERN`, `PUBLISHABLE_KEY_ID_PATTERN`, `tenantOfPublishableKey`, `newPublishableKey`, `newPublishableKeyId`, `PublishableKey*`, `OriginEntrySchema`, `originAllowed` and `LOOPBACK_ORIGIN_WILDCARDS`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`, `@nylorun/agents`): vault routes are application-only, and `vaults:own` is retired.** Every `/v1/vaults` route takes an application key acting for no one (operator keys, Studio); a request acting for a subject or a trusted issuer's token gets `403 scope_required`. `vaults:own` leaves `SUBJECT_SCOPES`, `TOKEN_SCOPES` and the issuer scopes; `Nylorun-Scopes` may still name it and it grants nothing. Existing user vaults stay attachable to their own owner's sessions. `client.createVault` takes `{ scope: "installation" }` or `ownerUserId`, and `client.listVaults()` takes an optional owner.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`, `@nylorun/admin`, `nylorun`): derived principals are gone.** Only Studio's key is derived from the admin key. `NYLORUN_DERIVED_PRINCIPALS` is ignored and no longer written, `hostPrincipals` takes no `derived`, `startEphemeralRuntime` no `derivedPrincipals`, and `@nylorun/admin` drops `deriveTenantKey`, `PROJECT_PRINCIPAL_ID` and `admin.deriveTenantKey`. Keys an earlier Host derived stay in the database and keep working as ordinary keys; replace them with operator keys. Core renames `DERIVED_PRINCIPAL_ID_PATTERN` to `APPLICATION_KEY_ID_PATTERN`.
+  - **Breaking (`@nylorun/agents`):** `createTokenEndpoint`, `createBrowserClient` and the `@nylorun/agents/browser` entry, `client.tokens`, `TokensClient`, `PublishableKeysClient`, `client.access.getPolicy`/`putPolicy`/`revokeSubject`/`publishableKeys` and `Destination.publishableKey` are removed. `client.access.signingKeys` and `client.access.jwks()` stay, and `Destination.token` takes a trusted issuer's tokens.
+  - **Breaking (`@nylorun/cli`):** `nylo access policy|keys|revoke|token` are removed and name what replaces them; `nylo access signing-keys list|rotate|revoke` stays.
+  - **Breaking (`@nylorun/core`, `@nylorun/agents`, `@nylorun/studio`): the Studio embed message `open.babai` is now `open.session`** (`{ sessionId }`): it asks the embedding app to open that session in its own UI. Studio sends no such message itself.
+  - **Breaking (`nylorun`): Studio embedding is opt-in.** No origin may frame Studio by default; list your app's origins with `nylorun start --studio-embed-origin <origin>`. A Tenant's `.env` from an earlier nylorun keeps the origins it had until `--studio-embed-origin-reset`.
+  - `PROTOCOL_VERSION` is 7 and `HOST_PROTOCOL` 4–7; the Host features `subject-tokens`, `browser-access` and `derived-principals` are removed. `@nylorun/studio` and `@nylorun/create-agent` speak protocol 7.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [8773586]
+- Updated dependencies [e1bfb4b]
+- Updated dependencies [5cfaed9]
+- Updated dependencies [bd478ee]
+- Updated dependencies [c0b604e]
+  - @nylorun/core@0.13.0-beta
+
+## 0.13.0-beta
+
+### Major Changes
+
+- b352feb: **File artifacts, message parts and capability links (protocol 6).** Upgrade these with the Runtime: they speak protocol 6, which this Runtime serves beside 4 and 5. See MIGRATION.md.
+
+  - **`@nylorun/runtime`: file artifacts.** A file is an artifact: an `af_` id, a name and numbered immutable versions, with rows in the new `artifacts` and `artifact_versions` tables (migration `0004_artifacts`) and bytes in the Object store (`BlobStore`). `POST /v1/artifacts?name=&sessionId=` uploads a file in one streamed request and `POST /v1/artifacts/{id}/versions` adds a version, within the Tenant's limits (`GET`/`PUT /v1/tenant/artifacts`: 100 MiB per file and 10 GiB in all by default); a body past either is `413 limit_exceeded`, refused mid-stream with nothing stored. `GET /v1/artifacts` lists them (by session), `GET /v1/artifacts/{id}` reads one with its versions, `GET /v1/artifacts/{id}/versions/{n|latest}/content` downloads through the Runtime with HTTP Range (`206`, `Content-Range`, `416`), and `DELETE /v1/artifacts/{id}` deletes it with its bytes. A session's artifacts go with it on a sessions reset, and appear in its history as `artifact.created`, `artifact.version.created` and `artifact.deleted` (new in the event catalog). A subject reaches only the artifacts of their own sessions.
+  - **`@nylorun/runtime`: capability links.** `POST /v1/artifacts/{id}/links` mints a short-lived path, `/v1/artifact-links/<token>`, that downloads one version (with Range) with no credential and no `Nylorun-Protocol`: an ES256 JWT (`typ: nylorun-artifact+jwt`) signed with the Tenant's signing key, at most 15 minutes, and dead once the artifact is deleted. The Host logs its path without the token.
+  - **Breaking (`@nylorun/core`, `@nylorun/runtime`): message `parts`.** A user message may carry `parts`: `text`, and `file` by `artifactId` (and `version`, else the latest, pinned when the message is accepted). Model-gate reads the file from the Object store: an image goes to the model as image input, a text file as text, and any other file fails the call (`invalid_request`). The record and the transcript hold only the reference. The gateway builds its `BlobStore` from `NYLORUN_OBJECT_STORE_*` (the Tenant's `fs` store without it). `PROTOCOL_VERSION` is 6; `HOST_PROTOCOL` is 4–6 and protocol 6 clients require the feature `artifacts`.
+  - **`@nylorun/runtime`: `save_artifact`.** A session with a sandbox gets the `nylorun.artifacts` capability, whose `save_artifact` tool saves a sandbox file (`path`) or text (`content`) as an artifact of the session, carrying the turn and tool call on its event.
+  - **Breaking (`@nylorun/runtime`): `MediaStore` is removed.** `MediaStore` and `localMedia` leave `@nylorun/runtime/node`, and `piModel` takes `files` (a resolver from an artifact reference to its bytes) instead of `media`; images are file artifacts. The image checks (`decodeImageBase64`, `validateImageBytes`, `IMAGE_MEDIA_TYPES`, `MAX_IMAGE_BYTES`) stay.
+  - **`@nylorun/agents`:** `client.artifacts` (`upload`, `uploadVersion`, `list`, `get`, `download` with a range, `link`, `delete`), also on `BrowserClient`, and `session.inputParts(parts)`. A request with a body of its own type keeps it.
+  - `@nylorun/admin`, `@nylorun/cli`, `nylorun`, `@nylorun/studio`: speak protocol 6.
+
+### Minor Changes
+
+- 6077272: **Folder artifacts and the turn-end outputs export (F8.2).** Part of protocol 6, with file artifacts.
+
+  - **`@nylorun/runtime`: the turn-end export.** When an agent's turn completes, the Runtime reads `/workspace/outputs` of the session's sandbox and keeps it as a version of the session's folder artifact `outputs`: the first export creates it, and each later turn whose outputs changed adds a version (`artifact.created` / `artifact.version.created` with `kind: "folder"`, `source: "export"`, `fileCount` and `claimed: true`, since the listing and bytes are what the sandbox supplied). Nothing is exported without a sandbox or without outputs. An export past 10,000 files, 1 GiB, the per-file limit or the Tenant total stores nothing and records `artifact.export.skipped` with its reason; a failure records `artifact.export.failed`. Neither fails the turn. Core reads the workspace through one seam, `WorkspaceReader`, which the Harness API and pod sandboxes will implement later.
+  - **`@nylorun/runtime`: folder artifacts.** A folder version is a manifest of paths to content-addressed files: each file's bytes are stored once at `blobs/sha256/<hex>`, so an unchanged file is never stored again, and the Tenant total (`GET /v1/tenant/artifacts` `usedBytes`) counts it once. New routes: `GET /v1/artifacts/{id}/versions/{n|latest}/tree` (the manifest), `…/files/{path}` (one file by its percent-encoded path, with Range), `…/diff?from=n` (files added, removed and changed) and `…/zip` (a streamed zip). `POST /v1/artifacts/{id}/links` takes `file` to link one file of a folder; a folder's link without it opens the zip. A folder's `/content`, a new version uploaded to a folder, and a message part naming a folder are `400`. Deleting a folder removes the files no other version names. Migration `0006_folder_artifacts` allows the `folder` kind and adds the `artifact_content` table.
+  - **`@nylorun/core`:** `ArtifactKindSchema` (`file`, `folder`), the `export` source, `FolderEntrySchema`, `FolderManifestSchema`, `ArtifactTreeSchema`, `ArtifactDiffSchema`, the `artifact.export.skipped` and `artifact.export.failed` events, and `fileCount` and `claimed` on `artifact.created` / `artifact.version.created`.
+  - **`@nylorun/agents`:** `client.artifacts.tree()`, `file()`, `diff()` and `zip()`, and `link(id, { file })`.
+
+- 926711b: **Sandboxes are a resource (F7.1, blueprint D39; Host feature `sandboxes`).** A sandbox has its own id, a kind, a spec and labels, and outlives the sessions attached to it. Additive: protocol 5 is unchanged.
+
+  - `PUT /v1/sandboxes/{id}` creates a sandbox or finds the one with that id (get-or-create in one call); `GET /v1/sandboxes/{id}`, `GET /v1/sandboxes?label=key=value` (repeatable), `GET /v1/sandboxes/{id}/events` and `DELETE /v1/sandboxes/{id}`. Ids are `/`-separated segments (`team-a/proj-42`), sent percent-encoded as one path segment. Only kind `virtual` runs; `pod` is refused with `sandbox_unavailable`. The spec is resolved against the Tenant's limits and fixed once the sandbox exists; labels can change.
+  - A session attaches with `sandbox: { id }` and shares the sandbox's `/workspace` with every other session attached to it. Turns are serial per sandbox: a second session's turn is refused with `409 sandbox_busy` while another runs. Deleting a session (a sessions reset) only detaches it. Deleting a sandbox is refused while a turn runs in it; afterwards an attached session's next turn is refused with `sandbox_unavailable` until a sandbox with that id exists again.
+  - Subject tokens carry an `sbx` claim: `POST /v1/tokens` takes `sandboxes`, exact ids or prefixes ending in `/*` (at most 16). A token reaches only the sandboxes they match, checked when a session attaches and at every turn start (`403 sandbox_not_granted`); any other sandbox is the 404 of a missing one. The new scope `sandboxes:write` lets a role create and delete the sandboxes its grants reach. Application keys reach every sandbox.
+  - The Tenant holds at most `limits.sandboxes` sandboxes (`PUT /v1/tenant/sandbox`, default 100); one more is `409 limit_exceeded`.
+  - Lifecycle events (`sandbox.created`, `sandbox.attached`, `sandbox.detached`, `sandbox.deleted`) go to the sandbox's own stream in the record, through the record module; the session's log records `sandbox.attached`. The sandbox stream is not relayed to S2.
+  - New error codes `sandbox_not_granted`, `sandbox_busy` and `sandbox_unavailable`; the session view gains `sandboxId` and `sandboxSource: "sandbox"`. Migration `0004_sandbox_resources` adds `sandbox_resources`, `nylorun_streams.sandbox_events` and the sessions' `sandbox_id` column.
+  - `@nylorun/agents`: `client.sandboxes` with `ensure(id, spec)`, `get`, `list({ labels })`, `delete`, `events`, and `forSession({ session, spec })`, which creates a sandbox for one session, opens the session on it, and deletes it with `release()`. It replaces sharing through another session (`sandbox: { session }` and the view's `sandboxOwnerId`, now deprecated). `client.tokens.create` takes `sandboxes`.
+  - `nylorun sandbox ls [--label key=value]... [--json]` and `nylorun sandbox rm <id>` list and delete the running local Tenant's sandboxes.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [b352feb]
+- Updated dependencies [6077272]
+- Updated dependencies [b6bf1f5]
+- Updated dependencies [8ed4ea6]
+- Updated dependencies [678e085]
+- Updated dependencies [926711b]
+  - @nylorun/core@0.12.0-beta
+
 ## 0.12.0-beta
 
 ### Minor Changes

package/README.md

@@ -107,7 +107,7 @@ eval "$(npx @nylorun/cli env)"
 # → NYLORUN_RUNTIME_URL, NYLORUN_SERVER_KEY
 ```
 
-Every request sets `Nylorun-Protocol` (5) and no `Nylorun-Tenant`: the Runtime
+Every request sets `Nylorun-Protocol` (6) and no `Nylorun-Tenant`: the Runtime
 serves one Tenant. Before the first authenticated
 request, `Transport` fetches `/health` once, checks protocol compatibility, and
 throws `IncompatibleRuntimeError` / `incompatible_host` when the Host range or
@@ -156,7 +156,22 @@ const session = await client.createSession({
 
 The model gets `bash`, `read`, `write`, `edit`, `grep` and `glob` on a persistent `/workspace`. These tools run in the Runtime, not in your process, so sandbox-only agents need no Action endpoint. The Runtime decides where the sandbox runs: today an emulated shell in the Runtime process, which is not a VM boundary and takes no `image`.
 
-`sandbox` takes `false` for none, `{ session }` to share another session's sandbox, or an inline sandbox as above; omit it for the Tenant's default. The Runtime checks it against the Tenant's limits (`GET`/`PUT /v1/tenant/sandbox`: a network ceiling, a resource maximum, the idle timeout) and answers `400` with every problem it finds. A caller acting for a user (`app.as(...)`) can't define one inline; it gets the Tenant's default or `false`. Private networks, loopback, the host and cloud metadata endpoints are always blocked.
+`sandbox` takes `false` for none, `{ id }` to attach a sandbox resource (below), or an inline sandbox as above; omit it for the Tenant's default. `{ session }`, sharing another session's sandbox, still works and is deprecated. The Runtime checks it against the Tenant's limits (`GET`/`PUT /v1/tenant/sandbox`: a network ceiling, a resource maximum, the idle timeout) and answers `400` with every problem it finds. A caller acting for a user (`app.as(...)`) can't define one inline; it gets the Tenant's default or `false`. Private networks, loopback, the host and cloud metadata endpoints are always blocked.
+
+A sandbox can also be a resource with its own id, which outlives the sessions attached to it (Host feature `sandboxes`). Whether it serves one session, one person or a project is your choice:
+
+```ts
+// One per session: created with the session, deleted by release().
+const { session, release } = await client.sandboxes.forSession({
+  session: { agentId: "analyst", ownerUserId },
+  spec: { network: { allow: ["pypi.org"] } },
+});
+// One per person or project: get-or-create by id, then attach sessions to it.
+await client.sandboxes.ensure("team-a/proj-42", { labels: { project: "acme" } });
+await client.createSession({ agentId: "analyst", ownerUserId, sandbox: { id: "team-a/proj-42" } });
+```
+
+Sessions attached to one sandbox share its `/workspace`, and one turn runs in it at a time: a second session's turn is refused with `409 sandbox_busy` until the first ends. Deleting a session only detaches it. A spec is fixed once the sandbox exists; `labels` can change. `client.sandboxes.list({ labels })`, `get(id)` and `delete(id)` manage them, and `npx nylorun sandbox ls | rm` does the same on a local Tenant. A trusted issuer's token reaches only the sandboxes its issuer grants (the identity file's `sandboxes` templates, exact ids or prefixes ending in `/*`), checked at every turn start; creating and deleting through one needs `sandboxes:write`. The Tenant holds at most `limits.sandboxes` of them (`PUT /v1/tenant/sandbox`, default 100).
 
 Add an agent with `.subagents()` to let the model delegate to it:
 
@@ -263,7 +278,8 @@ directly and run as before; a flow agent can't be a child of them.
 
 The agents in a flow share one sandbox: open the flow's session with it,
 `createSession({ …, sandbox: { … } })`, and every agent, tool step and `verify` in the
-flow uses it. Share it with another session with `sandbox: { session }`, and call
+flow uses it. Share it with other sessions by opening them all on one sandbox resource
+(`sandbox: { id }`, see `client.sandboxes`), and call
 built-ins via `session.sandbox` (application) or `ctx.sandbox` (a tool).
 Observe with `session.observe({ follow: true })` to merge linked agent streams;
 `pending()` lists waits across the tree. Studio renders the manifest tree and
@@ -297,9 +313,10 @@ thread is one session per person, agent and thread. There are two ways in:
 - **From your own server**, with `@nylorun/agents/ag-ui` (below): your server
   signs people in and the handler forwards each request to the Runtime acting
   for that person. The browser never sees the Runtime.
-- **From the page itself**, with `@nylorun/agents/browser`'s `agUi()` and a
-  subject token ([In the browser](#in-the-browser)). No chat traffic passes
-  through your server.
+- **From the page itself**, with `@ag-ui/client`'s `HttpAgent` and a `fetch`
+  that sends your identity provider's token
+  ([In the browser](#in-the-browser)). No chat traffic passes through your
+  server.
 
 Both reach the same threads: one started through the handler continues from
 the page.
@@ -346,8 +363,7 @@ created, on its first run; later runs keep them. Whatever the browser sends in
 - A busy or paused thread ends the run with `RUN_ERROR` code `session_busy`.
 - The handler calls the Runtime as each person (`client.as(subject, { scopes })`,
   below), so the Runtime itself keeps one person out of another's threads.
-  `scopes` defaults to `["sessions:own"]`; add `"vaults:own"` when `session()`
-  attaches the person's vaults. A `subject` the Runtime cannot name (see below)
+  `scopes` defaults to `["sessions:own"]`. A `subject` the Runtime cannot name (see below)
   answers `500` (`subject_invalid`).
 - The handler needs a Runtime with the optional feature `ag-ui-endpoint` and
   answers `502` (`runtime_feature_missing`) without it. It loads no AG-UI
@@ -360,8 +376,8 @@ Limitations: assistant text arrives once per model step (no token streaming);
 no reasoning, state, activity or subagent events, and an agent used as a tool
 shows only its result; frontend tools in `RunAgentInput.tools` are rejected
 (`400`); one text part per user message; earlier messages cannot be edited or
-regenerated. A browser reaches the Runtime only with a subject token and a
-publishable key, never with a Tenant key.
+regenerated. A browser reaches the Runtime only with a trusted issuer's token,
+never with a Tenant key.
 
 ## A2A
 
@@ -426,6 +442,56 @@ What the Runtime answers (Host feature `a2a-endpoint`):
   no header the partner chose except `A2A-Version` and `A2A-Extensions`. Without
   `a2a-endpoint` on the Runtime it answers `502` (`runtime_feature_missing`).
 
+## Files: artifacts and message parts
+
+Files users upload or agents make are **artifacts** (protocol 6): an id, a name and
+numbered versions, kept by the Runtime. `client.artifacts` uploads a file in one
+streamed request, lists, downloads with Range, mints capability links and deletes;
+a message names files in its `parts`, and the model reads an image as an image and
+a text file as text:
+
+```ts
+const { artifact } = await client.artifacts.upload(file, { name: "room.png", sessionId });
+await session.inputParts(
+  [{ type: "text", text: "Redesign this room" }, { type: "file", artifactId: artifact.artifactId }],
+  { idempotencyKey: crypto.randomUUID() },
+);
+
+const files = await client.artifacts.list({ sessionId }); // what the user and the agent saved
+const part = await client.artifacts.download(files[0].artifactId, { range: { start: 0, end: 1023 } });
+const { url } = await client.artifacts.link(files[0].artifactId); // no credential needed, 5 minutes
+```
+
+A session with a sandbox gives the agent `save_artifact`, which saves a file it
+made as an artifact of the session; each new artifact or version appears in the
+session's events as `artifact.created` or `artifact.version.created`. The Tenant's
+limits (`PUT /v1/tenant/artifacts`: 100 MiB per file and 10 GiB in all by default)
+refuse a larger upload with `413 limit_exceeded`, and nothing is stored. Acting for
+a person (`as()`, or a trusted issuer's token), a client reaches only the artifacts of that
+person's sessions, and an upload names one of them.
+
+### Outputs: folder artifacts
+
+At the end of each turn, the Runtime exports the files the agent wrote into
+`/workspace/outputs` of its sandbox as a version of the session's **folder**
+artifact `outputs` (kind `folder`): the first export creates it, and each later
+turn whose outputs changed adds a version, announced by `artifact.created` or
+`artifact.version.created` with `source: "export"`. A file that did not change is
+stored once. Read a folder as a tree, one file by path, a diff or a zip:
+
+```ts
+const outputs = (await client.artifacts.list({ sessionId })).find((a) => a.kind === "folder");
+const { entries } = await client.artifacts.tree(outputs.artifactId); // [{ path, size, sha256, contentType }]
+const page = await client.artifacts.file(outputs.artifactId, "app/index.html", { range: { start: 0 } });
+const { added, removed, changed } = await client.artifacts.diff(outputs.artifactId, { from: 1 });
+const zip = await client.artifacts.zip(outputs.artifactId); // a streamed Response
+const { url } = await client.artifacts.link(outputs.artifactId, { file: "app/index.html" }); // or the zip without `file`
+```
+
+An export past a limit (10,000 files, 1 GiB, the per-file limit or the Tenant
+total) stores nothing and records `artifact.export.skipped`; the turn still
+completes.
+
 ## Acting for a person (app servers)
 
 A server that signs people in and calls the Runtime for them (an "app server")
@@ -437,147 +503,58 @@ import { createClient } from "@nylorun/agents";
 const app = createClient(); // the Tenant key, on the server only
 
 // Per request, after your own sign-in:
-const person = app.as(`app:${user.id}`, { scopes: ["sessions:own", "vaults:own"] });
+const person = app.as(`app:${user.id}`, { scopes: ["sessions:own"] });
 await person.createSession({ agentId: "support", ownerUserId: `app:${user.id}` });
 await person.listSessions(); // only this person's sessions
 ```
 
 `as()` sends `Nylorun-Subject` and `Nylorun-Scopes` on every call, event
 streams included, and the Runtime (optional feature `subject-headers`)
-enforces both: another person's sessions and vaults answer the same `404` as
-missing ones, and a route outside the scopes answers `403` (`scope_required`).
+enforces both: another person's sessions answer the same `404` as missing
+ones, and a route outside the scopes answers `403` (`scope_required`).
 Nothing is minted, cached or refreshed, and the copy shares the client's
 compatibility check, so calling `as()` per request is cheap.
 
 | Scope | Allows |
 | --- | --- |
-| `sessions:own` | The person's own sessions: create, list, read, stream, message, approve, respond, cancel |
-| `vaults:own` | The person's own vaults and credentials |
+| `sessions:own` | The person's own sessions: create, list, read, stream, message, approve, respond, cancel; and their artifacts |
 | `agents:read` | Listing the Tenant's agents |
 | `agents:write` | Saving agents; listing agents, models and providers |
 | `tenant:settings` | The Tenant's status, model provider and sandbox settings |
 
-No scope reaches Tenant reset, config seed, Action endpoints, actions or the sandbox
-tool routes; call those without `as()`. A subject is 1–200 visible ASCII
+No scope reaches Tenant reset, config seed, Action endpoints, actions, vaults or
+the sandbox tool routes; call those without `as()`. Vaults are the
+installation's (`createVault({ scope: "installation", … })`); a person's own
+credentials come from your credential resolver
+([DEPLOYMENT.md](../DEPLOYMENT.md#credentials)). A subject is 1–200 visible ASCII
 characters (spaces only inside) and `host` is reserved. Your server must drop
 any `Nylorun-*` header its own clients send, and only an application key can act
 for a subject.
 
-## Minting subject tokens (app servers)
-
-To let a person's browser or app call the Runtime directly, your server mints a
-short-lived **subject token** for them instead of carrying their requests
-(optional feature `subject-tokens`). What a token may do comes from the Tenant's
-access policy, not from the caller:
-
-```ts
-import { createClient } from "@nylorun/agents";
-
-const app = createClient(); // the Tenant key, on the server only
-
-// Once: roles, their agents and limits (or `nylo access policy init`).
-await app.access.putPolicy({
-  version: 1,
-  roles: {
-    user: {
-      scopes: ["sessions:own", "agents:read"],
-      agents: ["support"],
-      limits: { turnsPerHour: 60, concurrentTurns: 2 },
-    },
-  },
-  anon: { scopes: [], agents: [] },
-  tokens: { maxTtlSeconds: 600 },
-});
-
-// Per signed-in person, from a same-origin POST route:
-const { token, expiresAt } = await app.tokens.create({
-  subject: `app:${user.id}`,
-  role: "user",
-});
-```
-
-The client sends it as `Authorization: Bearer <token>`.
-Tokens carry only `sessions:own`, `vaults:own` and `agents:read`, live at most
-15 minutes, and see only `{ agentId, name, description }` of their role's
-agents. A token that expired or was revoked answers `401` with
-`code: "token_expired"`: fetch a new one and retry. Starting more turns than the
-role allows answers `429` with `code: "limit_exceeded"` and `Retry-After`.
-
-| Call | Does |
-| --- | --- |
-| `app.access.revokeSubject(subject)` | Ends every token minted so far for the person and their open event streams |
-| `app.access.signingKeys.rotate()` | Rotates the Tenant's signing keys without signing anyone out (`{ force: true }` for incidents) |
-| `app.access.signingKeys.list()`, `.revoke(kid)`, `app.access.jwks()` | Inspect and retire keys; the public keys |
-
-Keep tokens in memory on the client, never in `localStorage`, and serve the
-minting route without CORS. `nylo access …` does the same from the terminal.
-
-`createTokenEndpoint` is that route, ready to mount (Next.js, Hono or any
-`Request` → `Response` handler):
-
-```ts
-import { createTokenEndpoint } from "@nylorun/agents";
-
-export const POST = createTokenEndpoint({
-  client: app,
-  role: "user",
-  subject: (request) => userFromCookie(request)?.id,
-});
-```
+The Tenant's signing keys sign delivery tokens and capability links:
+`app.access.signingKeys.list()`, `.rotate()` (`{ force: true }` for incidents),
+`.revoke(kid)` and `app.access.jwks()`, or `nylo access signing-keys …` from the
+terminal.
 
 ## In the browser
 
-`@nylorun/agents/browser` calls the Runtime from a web page or an app with a
-publishable key and the token route above (optional feature `browser-access`).
-It loads no Node module.
-
-```ts
-import { createBrowserClient } from "@nylorun/agents/browser";
-
-const nylo = createBrowserClient({
-  url: "https://runtime.example.com",
-  publishableKey: "nr_pub_tn_…", // app.access.publishableKeys.create({ name, origins })
-  token: () => fetch("/api/nylorun/token", { method: "POST" }).then((r) => r.json()),
-});
-
-const session = await nylo.createSession({ agentId: "support" }); // owned by the token's subject
-await session.input("Where is my order?", { idempotencyKey: crypto.randomUUID() });
-for await (const event of session.observe()) console.log(event.type);
-```
-
-For a chat UI, `agUi()` gives `@ag-ui/client`'s `HttpAgent` a `fetch` with the
-key and a current token:
-
-```ts
-import { HttpAgent } from "@ag-ui/client";
-
-const { url, fetch } = nylo.agUi("support");
-const agent = new HttpAgent({
-  url,
-  fetch,
-  threadId,
-  initialMessages: await nylo.agUiHistory("support", threadId),
-});
-```
-
-When the Runtime ends a run's stream because the token expired or was revoked,
-that `fetch` reattaches from the last event with a new token, so the agent sees
-one run. A person's token may attach their own vaults to a new thread
-(`forwardedProps: { nylorun: { session: { vaultIds } } }`) but not set `info`.
-
-The client keeps the token in memory, fetches a new one a minute before it
-expires or when the Runtime answers `401 token_expired`, and never asks for two
-at once. Event streams that the Runtime ends at token expiry or revocation
-reconnect from their last event with a new token. Create a publishable key per
-app with the origins that serve it (`http://localhost:*` for development);
-requests from other origins get the opaque `404`.
+A web page or an app calls the Runtime directly with the JWT your identity
+provider gave the person: list the provider in the Runtime's identity file
+([Trusted issuers](../DEPLOYMENT.md#trusted-issuers)), and the Runtime takes the
+token's subject, scopes, agents and sandbox grants from it. Nylorun mints no
+token and ships no browser client: use your provider's SDK for sign-in and send
+the token as `Authorization: Bearer <token>` with `Nylorun-Protocol`, through a
+reverse proxy that answers CORS (the Runtime sends no CORS headers). An expired
+token answers `401` with `code: "token_expired"`; `GET /v1/me` shows what a token
+renders to. For a chat UI, give `@ag-ui/client`'s `HttpAgent` a `fetch` that adds
+those headers.
 
-The SDK depends only on core within the Nylorun packages; installing it does not install harness or any AG-UI or A2A package. Use `/define`, `/client`, `/ag-ui`, `/a2a` or `/browser` for focused imports, or the root for convenience. Studio uses `/client`. See [the adopted host contract](../harness/HOST_CONTRACT.md).
+The SDK depends only on core within the Nylorun packages; installing it does not install harness or any AG-UI or A2A package. Use `/define`, `/client`, `/ag-ui` or `/a2a` for focused imports, or the root for convenience. Studio uses `/client`. See [the adopted host contract](../harness/HOST_CONTRACT.md).
 
 ## Embedding Studio (desktop apps)
 
 `@nylorun/agents/studio-embed` is the contract between Studio and an app that
-shows it in an iframe, such as Babai. It exports the message schema
+shows it in an iframe. It exports the message schema
 (`StudioEmbedMessageSchema`, envelope `{ type: "nylorun.studio", protocol, kind }`),
 the login-token and session schemas, `STUDIO_EMBED_PROTOCOLS` and
 `parseFrameAncestors`.
@@ -596,4 +573,6 @@ window.addEventListener("message", (event) => {
 The embedder's backend mints the login token with the admin key
 (`mintStudioLoginToken` in `@nylorun/admin`) and the page passes it to Studio in
 `init`. No key reaches the page. Studio's origin allowlist is
-`NYLORUN_STUDIO_FRAME_ANCESTORS`.
+`NYLORUN_STUDIO_FRAME_ANCESTORS`, empty by default: list your app's origins with
+`nylorun start --studio-embed-origin <origin>`. The message `open.session`
+(`{ sessionId }`) asks the embedding app to open that session in its own UI.

package/dist/access.d.ts

@@ -1,30 +1,10 @@
 /**
- * Subject tokens and access management for app servers (Host feature `subject-tokens`), on the
- * application key. `client.tokens.create` mints a short-lived token for one signed-in person;
- * `client.access` manages the policy that decides what each role may do, the signing keys and
- * revocations. Each call checks the Host feature before sending anything.
+ * The Tenant's signing keys and public keys, for app servers on the application key. The
+ * Runtime signs delivery tokens (Action endpoints) and capability links with them; an Action
+ * endpoint verifies delivery tokens with the public keys (`jwks`).
  */
-import type { AccessPolicy, CreateTokenResponse, Jwks, PublishableKey, SigningKeyView, TokenScope } from "@nylorun/core/contracts";
+import type { Jwks, SigningKeyView } from "@nylorun/core/contracts";
 import { type Transport } from "./http.js";
-export interface CreateTokenOptions {
-    /** The person the token is for, e.g. `app:42`. */
-    subject: string;
-    /** A role of the Tenant's access policy. */
-    role: string;
-    /** Narrow the role's scopes. Default: all of the role's scopes. */
-    scopes?: readonly TokenScope[];
-    /** Narrow the role's agents. Default: all of the role's agents. */
-    agents?: readonly string[];
-    /** 60 to 900 seconds, at most the policy's `maxTtlSeconds`. Default: that maximum. */
-    ttlSeconds?: number;
-    signal?: AbortSignal;
-}
-export declare class TokensClient {
-    private readonly transport;
-    constructor(transport: Transport);
-    /** Mints a subject token. Only the application key may; never acting for a subject. */
-    create(options: CreateTokenOptions): Promise<CreateTokenResponse>;
-}
 export declare class SigningKeysClient {
     private readonly transport;
     constructor(transport: Transport);
@@ -33,7 +13,7 @@ export declare class SigningKeysClient {
     }): Promise<SigningKeyView[]>;
     /**
      * standby → current → previous → revoked, and a new standby. Refused while the previous key
-     * may still verify live tokens; `force` skips that and signs those tokens out.
+     * may still verify live tokens; `force` skips that and ends those tokens.
      */
     rotate(options?: {
         force?: boolean;
@@ -44,57 +24,11 @@ export declare class SigningKeysClient {
         signal?: AbortSignal;
     }): Promise<SigningKeyView>;
 }
-/**
- * Publishable keys (Host feature `browser-access`): shipped in a web page or an app, they name
- * the Tenant and the app, and list the origins a browser may use them from.
- */
-export declare class PublishableKeysClient {
-    private readonly transport;
-    constructor(transport: Transport);
-    list(options?: {
-        signal?: AbortSignal;
-    }): Promise<PublishableKey[]>;
-    /**
-     * A new key. `origins` are exact origins (`https://app.example.com`) or
-     * `http://localhost:*`; `[]` allows native apps only.
-     */
-    create(options: {
-        name: string;
-        origins: readonly string[];
-        signal?: AbortSignal;
-    }): Promise<PublishableKey>;
-    /** Replaces the key's origins. */
-    update(keyId: string, options: {
-        origins: readonly string[];
-        signal?: AbortSignal;
-    }): Promise<PublishableKey>;
-    /** Revokes the key: every request that sends it gets the opaque 404. */
-    revoke(keyId: string, options?: {
-        signal?: AbortSignal;
-    }): Promise<PublishableKey>;
-}
 export declare class AccessClient {
     private readonly transport;
     readonly signingKeys: SigningKeysClient;
-    readonly publishableKeys: PublishableKeysClient;
     constructor(transport: Transport);
-    getPolicy(options?: {
-        signal?: AbortSignal;
-    }): Promise<AccessPolicy>;
-    putPolicy(policy: AccessPolicy, options?: {
-        signal?: AbortSignal;
-    }): Promise<AccessPolicy>;
-    /**
-     * Ends every token minted so far for `subject` and its open streams. Running turns continue;
-     * cancel them separately if they must stop.
-     */
-    revokeSubject(subject: string, options?: {
-        signal?: AbortSignal;
-    }): Promise<{
-        subject: string;
-        epoch: number;
-    }>;
-    /** The public keys that verify the Tenant's subject tokens. */
+    /** The public keys that verify the Tenant's delivery tokens. */
     jwks(options?: {
         signal?: AbortSignal;
     }): Promise<Jwks>;

package/dist/access.js

@@ -1,111 +1,35 @@
 import { id, segment } from "./http.js";
-const FEATURE = "subject-tokens";
-export class TokensClient {
-    transport;
-    constructor(transport) {
-        this.transport = transport;
-    }
-    /** Mints a subject token. Only the application key may; never acting for a subject. */
-    async create(options) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        return this.transport.json("/v1/tokens", "POST", {
-            requestId: id(),
-            subject: options.subject,
-            role: options.role,
-            ...(options.scopes ? { scopes: [...options.scopes] } : {}),
-            ...(options.agents ? { agents: [...options.agents] } : {}),
-            ...(options.ttlSeconds === undefined ? {} : { ttlSeconds: options.ttlSeconds }),
-        }, options.signal);
-    }
-}
 export class SigningKeysClient {
     transport;
     constructor(transport) {
         this.transport = transport;
     }
     async list(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         const reply = await this.transport.json("/v1/access/signing-keys", "GET", undefined, options.signal);
         return reply.keys;
     }
     /**
      * standby → current → previous → revoked, and a new standby. Refused while the previous key
-     * may still verify live tokens; `force` skips that and signs those tokens out.
+     * may still verify live tokens; `force` skips that and ends those tokens.
      */
     async rotate(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         const reply = await this.transport.json("/v1/access/signing-keys/rotate", "POST", { requestId: id(), ...(options.force ? { force: true } : {}) }, options.signal);
         return reply.keys;
     }
     /** Revokes a previous or standby key; the current key must be rotated first. */
     async revoke(keyId, options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         return this.transport.json(`/v1/access/signing-keys/${segment(keyId)}/revoke`, "POST", { requestId: id() }, options.signal);
     }
 }
-/**
- * Publishable keys (Host feature `browser-access`): shipped in a web page or an app, they name
- * the Tenant and the app, and list the origins a browser may use them from.
- */
-export class PublishableKeysClient {
-    transport;
-    constructor(transport) {
-        this.transport = transport;
-    }
-    async list(options = {}) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        const reply = await this.transport.json("/v1/access/publishable-keys", "GET", undefined, options.signal);
-        return reply.keys;
-    }
-    /**
-     * A new key. `origins` are exact origins (`https://app.example.com`) or
-     * `http://localhost:*`; `[]` allows native apps only.
-     */
-    async create(options) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        return this.transport.json("/v1/access/publishable-keys", "POST", { requestId: id(), name: options.name, origins: [...options.origins] }, options.signal);
-    }
-    /** Replaces the key's origins. */
-    async update(keyId, options) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        return this.transport.json(`/v1/access/publishable-keys/${segment(keyId)}`, "PUT", { requestId: id(), origins: [...options.origins] }, options.signal);
-    }
-    /** Revokes the key: every request that sends it gets the opaque 404. */
-    async revoke(keyId, options = {}) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        return this.transport.json(`/v1/access/publishable-keys/${segment(keyId)}`, "DELETE", undefined, options.signal);
-    }
-}
 export class AccessClient {
     transport;
     signingKeys;
-    publishableKeys;
     constructor(transport) {
         this.transport = transport;
         this.signingKeys = new SigningKeysClient(transport);
-        this.publishableKeys = new PublishableKeysClient(transport);
-    }
-    async getPolicy(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        const reply = await this.transport.json("/v1/access/policy", "GET", undefined, options.signal);
-        return reply.policy;
-    }
-    async putPolicy(policy, options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        const reply = await this.transport.json("/v1/access/policy", "PUT", { requestId: id(), policy }, options.signal);
-        return reply.policy;
-    }
-    /**
-     * Ends every token minted so far for `subject` and its open streams. Running turns continue;
-     * cancel them separately if they must stop.
-     */
-    async revokeSubject(subject, options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        return this.transport.json("/v1/access/revocations", "POST", { requestId: id(), subject }, options.signal);
     }
-    /** The public keys that verify the Tenant's subject tokens. */
+    /** The public keys that verify the Tenant's delivery tokens. */
     async jwks(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         return this.transport.json("/v1/access/jwks", "GET", undefined, options.signal);
     }
 }