@nylorun/agents 0.13.0-beta → 0.14.0-beta

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @nylorun/agents
 
+## 0.14.0-beta
+
+### Major Changes
+
+- bd478ee: **Subject tokens, browser keys and derived principals leave open source (F9 I3, protocol 7).** Upgrade these with the Runtime: they speak protocol 7, which this Runtime serves beside 4, 5 and 6; protocol 6 clients keep working on every route that remains. Browsers and apps present a trusted issuer's token (F9 I2), servers an operator key (F9 I1), and a person's own credentials come from the operator's credential resolver (F9 C1). See MIGRATION.md.
+
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): subject tokens are gone.** `POST /v1/tokens`, `POST /v1/access/revocations`, subject-token verification, revocation epochs and the `subject.revoked` stream signal are removed; the routes answer `404`, and a JWT no trusted issuer signed is the opaque `404`. A stream opened with a token now ends only at its expiry (`event: nylorun.closed`, reason `token_expired`; `StreamClosedFrame` loses `revoked`). Migration `0010_oss_auth_removals` drops the `subject_epochs`, `subject_usage` and `publishable_keys` tables. The `token` caller is a trusted issuer's token only: it loses `role`, `limits` and `epoch`, and `issuer` is always set; `GET /v1/me` no longer reports `via: token`. Core drops `SUBJECT_TOKEN_TYPE`, `SUBJECT_TOKEN_AUDIENCE`, `subjectTokenIssuer` (the Runtime's own tokens use `tenantTokenIssuer`, same value), `CreateTokenRequest`/`Response`, `RevokeSubject*`, `SubjectTokenClaims`, `TOKEN_TTL_MIN_SECONDS` and `TOKEN_TTL_DEFAULT_SECONDS`; `TOKEN_SCOPES` is `agents:read`, `sessions:own`, `sandboxes:write`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): the access policy and role limits are gone.** `GET`/`PUT /v1/access/policy` answer `404`, a turn is never refused with `429 limit_exceeded` for a role (limit requests at your proxy), and an existing `access.policy` setting is ignored. Core drops `AccessPolicy*`, `AccessRole*`, `RoleLimits*`, `DEFAULT_ACCESS_POLICY`, `PutAccessPolicyRequest` and `ROLE_NAME_PATTERN`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`): publishable keys and the Runtime's CORS are gone.** `/v1/access/publishable-keys*` answer `404`, `Nylorun-Key` is ignored, `NYLORUN_BROWSER_ACCESS` and `browserAccess` (host.json, `createHost`, `startEphemeralRuntime`) are removed, and the Runtime sends no CORS headers. A request with `Origin` reaches the Tenant routes of the public listener with no toggle: a trusted issuer's token is served, an application key or delivery token is `403 origin_rejected`; admin routes, `/health`, `/ready` and the operator listener still refuse `Origin`. Any `OPTIONS` request is `204` with `Allow` and no CORS header: the operator's proxy answers preflights. Route declarations lose `browser` (`x-nylorun-browser` leaves the OpenAPI document) and the `publishable` credential; the token security scheme is `issuerToken`. Core drops `PUBLISHABLE_KEY_HEADER`, `PUBLISHABLE_KEY_PATTERN`, `PUBLISHABLE_KEY_ID_PATTERN`, `tenantOfPublishableKey`, `newPublishableKey`, `newPublishableKeyId`, `PublishableKey*`, `OriginEntrySchema`, `originAllowed` and `LOOPBACK_ORIGIN_WILDCARDS`.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`, `@nylorun/agents`): vault routes are application-only, and `vaults:own` is retired.** Every `/v1/vaults` route takes an application key acting for no one (operator keys, Studio); a request acting for a subject or a trusted issuer's token gets `403 scope_required`. `vaults:own` leaves `SUBJECT_SCOPES`, `TOKEN_SCOPES` and the issuer scopes; `Nylorun-Scopes` may still name it and it grants nothing. Existing user vaults stay attachable to their own owner's sessions. `client.createVault` takes `{ scope: "installation" }` or `ownerUserId`, and `client.listVaults()` takes an optional owner.
+  - **Breaking (`@nylorun/runtime`, `@nylorun/core`, `@nylorun/admin`, `nylorun`): derived principals are gone.** Only Studio's key is derived from the admin key. `NYLORUN_DERIVED_PRINCIPALS` is ignored and no longer written, `hostPrincipals` takes no `derived`, `startEphemeralRuntime` no `derivedPrincipals`, and `@nylorun/admin` drops `deriveTenantKey`, `PROJECT_PRINCIPAL_ID` and `admin.deriveTenantKey`. Keys an earlier Host derived stay in the database and keep working as ordinary keys; replace them with operator keys. Core renames `DERIVED_PRINCIPAL_ID_PATTERN` to `APPLICATION_KEY_ID_PATTERN`.
+  - **Breaking (`@nylorun/agents`):** `createTokenEndpoint`, `createBrowserClient` and the `@nylorun/agents/browser` entry, `client.tokens`, `TokensClient`, `PublishableKeysClient`, `client.access.getPolicy`/`putPolicy`/`revokeSubject`/`publishableKeys` and `Destination.publishableKey` are removed. `client.access.signingKeys` and `client.access.jwks()` stay, and `Destination.token` takes a trusted issuer's tokens.
+  - **Breaking (`@nylorun/cli`):** `nylo access policy|keys|revoke|token` are removed and name what replaces them; `nylo access signing-keys list|rotate|revoke` stays.
+  - **Breaking (`@nylorun/core`, `@nylorun/agents`, `@nylorun/studio`): the Studio embed message `open.babai` is now `open.session`** (`{ sessionId }`): it asks the embedding app to open that session in its own UI. Studio sends no such message itself.
+  - **Breaking (`nylorun`): Studio embedding is opt-in.** No origin may frame Studio by default; list your app's origins with `nylorun start --studio-embed-origin <origin>`. A Tenant's `.env` from an earlier nylorun keeps the origins it had until `--studio-embed-origin-reset`.
+  - `PROTOCOL_VERSION` is 7 and `HOST_PROTOCOL` 4–7; the Host features `subject-tokens`, `browser-access` and `derived-principals` are removed. `@nylorun/studio` and `@nylorun/create-agent` speak protocol 7.
+
+### Patch Changes
+
+- Pin core to the tested release.
+- Updated dependencies [8773586]
+- Updated dependencies [e1bfb4b]
+- Updated dependencies [5cfaed9]
+- Updated dependencies [bd478ee]
+- Updated dependencies [c0b604e]
+  - @nylorun/core@0.13.0-beta
+
 ## 0.13.0-beta
 
 ### Major Changes

package/README.md

@@ -171,7 +171,7 @@ await client.sandboxes.ensure("team-a/proj-42", { labels: { project: "acme" } })
 await client.createSession({ agentId: "analyst", ownerUserId, sandbox: { id: "team-a/proj-42" } });
 ```
 
-Sessions attached to one sandbox share its `/workspace`, and one turn runs in it at a time: a second session's turn is refused with `409 sandbox_busy` until the first ends. Deleting a session only detaches it. A spec is fixed once the sandbox exists; `labels` can change. `client.sandboxes.list({ labels })`, `get(id)` and `delete(id)` manage them, and `npx nylorun sandbox ls | rm` does the same on a local Tenant. A subject token reaches only the sandboxes it is minted for, checked at every turn start: `client.tokens.create({ subject, role, sandboxes: ["team-a/*", "user-42"] })` takes exact ids or prefixes ending in `/*`. Creating and deleting through a subject token needs a role with `sandboxes:write`. The Tenant holds at most `limits.sandboxes` of them (`PUT /v1/tenant/sandbox`, default 100).
+Sessions attached to one sandbox share its `/workspace`, and one turn runs in it at a time: a second session's turn is refused with `409 sandbox_busy` until the first ends. Deleting a session only detaches it. A spec is fixed once the sandbox exists; `labels` can change. `client.sandboxes.list({ labels })`, `get(id)` and `delete(id)` manage them, and `npx nylorun sandbox ls | rm` does the same on a local Tenant. A trusted issuer's token reaches only the sandboxes its issuer grants (the identity file's `sandboxes` templates, exact ids or prefixes ending in `/*`), checked at every turn start; creating and deleting through one needs `sandboxes:write`. The Tenant holds at most `limits.sandboxes` of them (`PUT /v1/tenant/sandbox`, default 100).
 
 Add an agent with `.subagents()` to let the model delegate to it:
 
@@ -313,9 +313,10 @@ thread is one session per person, agent and thread. There are two ways in:
 - **From your own server**, with `@nylorun/agents/ag-ui` (below): your server
   signs people in and the handler forwards each request to the Runtime acting
   for that person. The browser never sees the Runtime.
-- **From the page itself**, with `@nylorun/agents/browser`'s `agUi()` and a
-  subject token ([In the browser](#in-the-browser)). No chat traffic passes
-  through your server.
+- **From the page itself**, with `@ag-ui/client`'s `HttpAgent` and a `fetch`
+  that sends your identity provider's token
+  ([In the browser](#in-the-browser)). No chat traffic passes through your
+  server.
 
 Both reach the same threads: one started through the handler continues from
 the page.
@@ -362,8 +363,7 @@ created, on its first run; later runs keep them. Whatever the browser sends in
 - A busy or paused thread ends the run with `RUN_ERROR` code `session_busy`.
 - The handler calls the Runtime as each person (`client.as(subject, { scopes })`,
   below), so the Runtime itself keeps one person out of another's threads.
-  `scopes` defaults to `["sessions:own"]`; add `"vaults:own"` when `session()`
-  attaches the person's vaults. A `subject` the Runtime cannot name (see below)
+  `scopes` defaults to `["sessions:own"]`. A `subject` the Runtime cannot name (see below)
   answers `500` (`subject_invalid`).
 - The handler needs a Runtime with the optional feature `ag-ui-endpoint` and
   answers `502` (`runtime_feature_missing`) without it. It loads no AG-UI
@@ -376,8 +376,8 @@ Limitations: assistant text arrives once per model step (no token streaming);
 no reasoning, state, activity or subagent events, and an agent used as a tool
 shows only its result; frontend tools in `RunAgentInput.tools` are rejected
 (`400`); one text part per user message; earlier messages cannot be edited or
-regenerated. A browser reaches the Runtime only with a subject token and a
-publishable key, never with a Tenant key.
+regenerated. A browser reaches the Runtime only with a trusted issuer's token,
+never with a Tenant key.
 
 ## A2A
 
@@ -467,7 +467,7 @@ made as an artifact of the session; each new artifact or version appears in the
 session's events as `artifact.created` or `artifact.version.created`. The Tenant's
 limits (`PUT /v1/tenant/artifacts`: 100 MiB per file and 10 GiB in all by default)
 refuse a larger upload with `413 limit_exceeded`, and nothing is stored. Acting for
-a person (`as()`, a subject token), a client reaches only the artifacts of that
+a person (`as()`, or a trusted issuer's token), a client reaches only the artifacts of that
 person's sessions, and an upload names one of them.
 
 ### Outputs: folder artifacts
@@ -503,147 +503,58 @@ import { createClient } from "@nylorun/agents";
 const app = createClient(); // the Tenant key, on the server only
 
 // Per request, after your own sign-in:
-const person = app.as(`app:${user.id}`, { scopes: ["sessions:own", "vaults:own"] });
+const person = app.as(`app:${user.id}`, { scopes: ["sessions:own"] });
 await person.createSession({ agentId: "support", ownerUserId: `app:${user.id}` });
 await person.listSessions(); // only this person's sessions
 ```
 
 `as()` sends `Nylorun-Subject` and `Nylorun-Scopes` on every call, event
 streams included, and the Runtime (optional feature `subject-headers`)
-enforces both: another person's sessions and vaults answer the same `404` as
-missing ones, and a route outside the scopes answers `403` (`scope_required`).
+enforces both: another person's sessions answer the same `404` as missing
+ones, and a route outside the scopes answers `403` (`scope_required`).
 Nothing is minted, cached or refreshed, and the copy shares the client's
 compatibility check, so calling `as()` per request is cheap.
 
 | Scope | Allows |
 | --- | --- |
 | `sessions:own` | The person's own sessions: create, list, read, stream, message, approve, respond, cancel; and their artifacts |
-| `vaults:own` | The person's own vaults and credentials |
 | `agents:read` | Listing the Tenant's agents |
 | `agents:write` | Saving agents; listing agents, models and providers |
 | `tenant:settings` | The Tenant's status, model provider and sandbox settings |
 
-No scope reaches Tenant reset, config seed, Action endpoints, actions or the sandbox
-tool routes; call those without `as()`. A subject is 1–200 visible ASCII
+No scope reaches Tenant reset, config seed, Action endpoints, actions, vaults or
+the sandbox tool routes; call those without `as()`. Vaults are the
+installation's (`createVault({ scope: "installation", … })`); a person's own
+credentials come from your credential resolver
+([DEPLOYMENT.md](../DEPLOYMENT.md#credentials)). A subject is 1–200 visible ASCII
 characters (spaces only inside) and `host` is reserved. Your server must drop
 any `Nylorun-*` header its own clients send, and only an application key can act
 for a subject.
 
-## Minting subject tokens (app servers)
-
-To let a person's browser or app call the Runtime directly, your server mints a
-short-lived **subject token** for them instead of carrying their requests
-(optional feature `subject-tokens`). What a token may do comes from the Tenant's
-access policy, not from the caller:
-
-```ts
-import { createClient } from "@nylorun/agents";
-
-const app = createClient(); // the Tenant key, on the server only
-
-// Once: roles, their agents and limits (or `nylo access policy init`).
-await app.access.putPolicy({
-  version: 1,
-  roles: {
-    user: {
-      scopes: ["sessions:own", "agents:read"],
-      agents: ["support"],
-      limits: { turnsPerHour: 60, concurrentTurns: 2 },
-    },
-  },
-  anon: { scopes: [], agents: [] },
-  tokens: { maxTtlSeconds: 600 },
-});
-
-// Per signed-in person, from a same-origin POST route:
-const { token, expiresAt } = await app.tokens.create({
-  subject: `app:${user.id}`,
-  role: "user",
-});
-```
-
-The client sends it as `Authorization: Bearer <token>`.
-Tokens carry only `sessions:own`, `vaults:own` and `agents:read`, live at most
-15 minutes, and see only `{ agentId, name, description }` of their role's
-agents. A token that expired or was revoked answers `401` with
-`code: "token_expired"`: fetch a new one and retry. Starting more turns than the
-role allows answers `429` with `code: "limit_exceeded"` and `Retry-After`.
-
-| Call | Does |
-| --- | --- |
-| `app.access.revokeSubject(subject)` | Ends every token minted so far for the person and their open event streams |
-| `app.access.signingKeys.rotate()` | Rotates the Tenant's signing keys without signing anyone out (`{ force: true }` for incidents) |
-| `app.access.signingKeys.list()`, `.revoke(kid)`, `app.access.jwks()` | Inspect and retire keys; the public keys |
-
-Keep tokens in memory on the client, never in `localStorage`, and serve the
-minting route without CORS. `nylo access …` does the same from the terminal.
-
-`createTokenEndpoint` is that route, ready to mount (Next.js, Hono or any
-`Request` → `Response` handler):
-
-```ts
-import { createTokenEndpoint } from "@nylorun/agents";
-
-export const POST = createTokenEndpoint({
-  client: app,
-  role: "user",
-  subject: (request) => userFromCookie(request)?.id,
-});
-```
+The Tenant's signing keys sign delivery tokens and capability links:
+`app.access.signingKeys.list()`, `.rotate()` (`{ force: true }` for incidents),
+`.revoke(kid)` and `app.access.jwks()`, or `nylo access signing-keys …` from the
+terminal.
 
 ## In the browser
 
-`@nylorun/agents/browser` calls the Runtime from a web page or an app with a
-publishable key and the token route above (optional feature `browser-access`).
-It loads no Node module.
-
-```ts
-import { createBrowserClient } from "@nylorun/agents/browser";
-
-const nylo = createBrowserClient({
-  url: "https://runtime.example.com",
-  publishableKey: "nr_pub_tn_…", // app.access.publishableKeys.create({ name, origins })
-  token: () => fetch("/api/nylorun/token", { method: "POST" }).then((r) => r.json()),
-});
-
-const session = await nylo.createSession({ agentId: "support" }); // owned by the token's subject
-await session.input("Where is my order?", { idempotencyKey: crypto.randomUUID() });
-for await (const event of session.observe()) console.log(event.type);
-```
-
-For a chat UI, `agUi()` gives `@ag-ui/client`'s `HttpAgent` a `fetch` with the
-key and a current token:
-
-```ts
-import { HttpAgent } from "@ag-ui/client";
-
-const { url, fetch } = nylo.agUi("support");
-const agent = new HttpAgent({
-  url,
-  fetch,
-  threadId,
-  initialMessages: await nylo.agUiHistory("support", threadId),
-});
-```
-
-When the Runtime ends a run's stream because the token expired or was revoked,
-that `fetch` reattaches from the last event with a new token, so the agent sees
-one run. A person's token may attach their own vaults to a new thread
-(`forwardedProps: { nylorun: { session: { vaultIds } } }`) but not set `info`.
-
-The client keeps the token in memory, fetches a new one a minute before it
-expires or when the Runtime answers `401 token_expired`, and never asks for two
-at once. Event streams that the Runtime ends at token expiry or revocation
-reconnect from their last event with a new token. Create a publishable key per
-app with the origins that serve it (`http://localhost:*` for development);
-requests from other origins get the opaque `404`.
+A web page or an app calls the Runtime directly with the JWT your identity
+provider gave the person: list the provider in the Runtime's identity file
+([Trusted issuers](../DEPLOYMENT.md#trusted-issuers)), and the Runtime takes the
+token's subject, scopes, agents and sandbox grants from it. Nylorun mints no
+token and ships no browser client: use your provider's SDK for sign-in and send
+the token as `Authorization: Bearer <token>` with `Nylorun-Protocol`, through a
+reverse proxy that answers CORS (the Runtime sends no CORS headers). An expired
+token answers `401` with `code: "token_expired"`; `GET /v1/me` shows what a token
+renders to. For a chat UI, give `@ag-ui/client`'s `HttpAgent` a `fetch` that adds
+those headers.
 
-The SDK depends only on core within the Nylorun packages; installing it does not install harness or any AG-UI or A2A package. Use `/define`, `/client`, `/ag-ui`, `/a2a` or `/browser` for focused imports, or the root for convenience. Studio uses `/client`. See [the adopted host contract](../harness/HOST_CONTRACT.md).
+The SDK depends only on core within the Nylorun packages; installing it does not install harness or any AG-UI or A2A package. Use `/define`, `/client`, `/ag-ui` or `/a2a` for focused imports, or the root for convenience. Studio uses `/client`. See [the adopted host contract](../harness/HOST_CONTRACT.md).
 
 ## Embedding Studio (desktop apps)
 
 `@nylorun/agents/studio-embed` is the contract between Studio and an app that
-shows it in an iframe, such as Babai. It exports the message schema
+shows it in an iframe. It exports the message schema
 (`StudioEmbedMessageSchema`, envelope `{ type: "nylorun.studio", protocol, kind }`),
 the login-token and session schemas, `STUDIO_EMBED_PROTOCOLS` and
 `parseFrameAncestors`.
@@ -662,4 +573,6 @@ window.addEventListener("message", (event) => {
 The embedder's backend mints the login token with the admin key
 (`mintStudioLoginToken` in `@nylorun/admin`) and the page passes it to Studio in
 `init`. No key reaches the page. Studio's origin allowlist is
-`NYLORUN_STUDIO_FRAME_ANCESTORS`.
+`NYLORUN_STUDIO_FRAME_ANCESTORS`, empty by default: list your app's origins with
+`nylorun start --studio-embed-origin <origin>`. The message `open.session`
+(`{ sessionId }`) asks the embedding app to open that session in its own UI.

package/dist/access.d.ts

@@ -1,35 +1,10 @@
 /**
- * Subject tokens and access management for app servers (Host feature `subject-tokens`), on the
- * application key. `client.tokens.create` mints a short-lived token for one signed-in person;
- * `client.access` manages the policy that decides what each role may do, the signing keys and
- * revocations. Each call checks the Host feature before sending anything.
+ * The Tenant's signing keys and public keys, for app servers on the application key. The
+ * Runtime signs delivery tokens (Action endpoints) and capability links with them; an Action
+ * endpoint verifies delivery tokens with the public keys (`jwks`).
  */
-import type { AccessPolicy, CreateTokenResponse, Jwks, PublishableKey, SigningKeyView, TokenScope } from "@nylorun/core/contracts";
+import type { Jwks, SigningKeyView } from "@nylorun/core/contracts";
 import { type Transport } from "./http.js";
-export interface CreateTokenOptions {
-    /** The person the token is for, e.g. `app:42`. */
-    subject: string;
-    /** A role of the Tenant's access policy. */
-    role: string;
-    /** Narrow the role's scopes. Default: all of the role's scopes. */
-    scopes?: readonly TokenScope[];
-    /** Narrow the role's agents. Default: all of the role's agents. */
-    agents?: readonly string[];
-    /**
-     * The sandboxes the token reaches (its `sbx` claim): exact ids, or prefixes ending in `/*`
-     * (`team-a/*`). Default: none (Host feature `sandboxes`).
-     */
-    sandboxes?: readonly string[];
-    /** 60 to 900 seconds, at most the policy's `maxTtlSeconds`. Default: that maximum. */
-    ttlSeconds?: number;
-    signal?: AbortSignal;
-}
-export declare class TokensClient {
-    private readonly transport;
-    constructor(transport: Transport);
-    /** Mints a subject token. Only the application key may; never acting for a subject. */
-    create(options: CreateTokenOptions): Promise<CreateTokenResponse>;
-}
 export declare class SigningKeysClient {
     private readonly transport;
     constructor(transport: Transport);
@@ -38,7 +13,7 @@ export declare class SigningKeysClient {
     }): Promise<SigningKeyView[]>;
     /**
      * standby → current → previous → revoked, and a new standby. Refused while the previous key
-     * may still verify live tokens; `force` skips that and signs those tokens out.
+     * may still verify live tokens; `force` skips that and ends those tokens.
      */
     rotate(options?: {
         force?: boolean;
@@ -49,57 +24,11 @@ export declare class SigningKeysClient {
         signal?: AbortSignal;
     }): Promise<SigningKeyView>;
 }
-/**
- * Publishable keys (Host feature `browser-access`): shipped in a web page or an app, they name
- * the Tenant and the app, and list the origins a browser may use them from.
- */
-export declare class PublishableKeysClient {
-    private readonly transport;
-    constructor(transport: Transport);
-    list(options?: {
-        signal?: AbortSignal;
-    }): Promise<PublishableKey[]>;
-    /**
-     * A new key. `origins` are exact origins (`https://app.example.com`) or
-     * `http://localhost:*`; `[]` allows native apps only.
-     */
-    create(options: {
-        name: string;
-        origins: readonly string[];
-        signal?: AbortSignal;
-    }): Promise<PublishableKey>;
-    /** Replaces the key's origins. */
-    update(keyId: string, options: {
-        origins: readonly string[];
-        signal?: AbortSignal;
-    }): Promise<PublishableKey>;
-    /** Revokes the key: every request that sends it gets the opaque 404. */
-    revoke(keyId: string, options?: {
-        signal?: AbortSignal;
-    }): Promise<PublishableKey>;
-}
 export declare class AccessClient {
     private readonly transport;
     readonly signingKeys: SigningKeysClient;
-    readonly publishableKeys: PublishableKeysClient;
     constructor(transport: Transport);
-    getPolicy(options?: {
-        signal?: AbortSignal;
-    }): Promise<AccessPolicy>;
-    putPolicy(policy: AccessPolicy, options?: {
-        signal?: AbortSignal;
-    }): Promise<AccessPolicy>;
-    /**
-     * Ends every token minted so far for `subject` and its open streams. Running turns continue;
-     * cancel them separately if they must stop.
-     */
-    revokeSubject(subject: string, options?: {
-        signal?: AbortSignal;
-    }): Promise<{
-        subject: string;
-        epoch: number;
-    }>;
-    /** The public keys that verify the Tenant's subject tokens. */
+    /** The public keys that verify the Tenant's delivery tokens. */
     jwks(options?: {
         signal?: AbortSignal;
     }): Promise<Jwks>;

package/dist/access.js

@@ -1,112 +1,35 @@
 import { id, segment } from "./http.js";
-const FEATURE = "subject-tokens";
-export class TokensClient {
-    transport;
-    constructor(transport) {
-        this.transport = transport;
-    }
-    /** Mints a subject token. Only the application key may; never acting for a subject. */
-    async create(options) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        return this.transport.json("/v1/tokens", "POST", {
-            requestId: id(),
-            subject: options.subject,
-            role: options.role,
-            ...(options.scopes ? { scopes: [...options.scopes] } : {}),
-            ...(options.agents ? { agents: [...options.agents] } : {}),
-            ...(options.sandboxes ? { sandboxes: [...options.sandboxes] } : {}),
-            ...(options.ttlSeconds === undefined ? {} : { ttlSeconds: options.ttlSeconds }),
-        }, options.signal);
-    }
-}
 export class SigningKeysClient {
     transport;
     constructor(transport) {
         this.transport = transport;
     }
     async list(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         const reply = await this.transport.json("/v1/access/signing-keys", "GET", undefined, options.signal);
         return reply.keys;
     }
     /**
      * standby → current → previous → revoked, and a new standby. Refused while the previous key
-     * may still verify live tokens; `force` skips that and signs those tokens out.
+     * may still verify live tokens; `force` skips that and ends those tokens.
      */
     async rotate(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         const reply = await this.transport.json("/v1/access/signing-keys/rotate", "POST", { requestId: id(), ...(options.force ? { force: true } : {}) }, options.signal);
         return reply.keys;
     }
     /** Revokes a previous or standby key; the current key must be rotated first. */
     async revoke(keyId, options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         return this.transport.json(`/v1/access/signing-keys/${segment(keyId)}/revoke`, "POST", { requestId: id() }, options.signal);
     }
 }
-/**
- * Publishable keys (Host feature `browser-access`): shipped in a web page or an app, they name
- * the Tenant and the app, and list the origins a browser may use them from.
- */
-export class PublishableKeysClient {
-    transport;
-    constructor(transport) {
-        this.transport = transport;
-    }
-    async list(options = {}) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        const reply = await this.transport.json("/v1/access/publishable-keys", "GET", undefined, options.signal);
-        return reply.keys;
-    }
-    /**
-     * A new key. `origins` are exact origins (`https://app.example.com`) or
-     * `http://localhost:*`; `[]` allows native apps only.
-     */
-    async create(options) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        return this.transport.json("/v1/access/publishable-keys", "POST", { requestId: id(), name: options.name, origins: [...options.origins] }, options.signal);
-    }
-    /** Replaces the key's origins. */
-    async update(keyId, options) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        return this.transport.json(`/v1/access/publishable-keys/${segment(keyId)}`, "PUT", { requestId: id(), origins: [...options.origins] }, options.signal);
-    }
-    /** Revokes the key: every request that sends it gets the opaque 404. */
-    async revoke(keyId, options = {}) {
-        await this.transport.requireFeature("browser-access", options.signal);
-        return this.transport.json(`/v1/access/publishable-keys/${segment(keyId)}`, "DELETE", undefined, options.signal);
-    }
-}
 export class AccessClient {
     transport;
     signingKeys;
-    publishableKeys;
     constructor(transport) {
         this.transport = transport;
         this.signingKeys = new SigningKeysClient(transport);
-        this.publishableKeys = new PublishableKeysClient(transport);
-    }
-    async getPolicy(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        const reply = await this.transport.json("/v1/access/policy", "GET", undefined, options.signal);
-        return reply.policy;
-    }
-    async putPolicy(policy, options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        const reply = await this.transport.json("/v1/access/policy", "PUT", { requestId: id(), policy }, options.signal);
-        return reply.policy;
-    }
-    /**
-     * Ends every token minted so far for `subject` and its open streams. Running turns continue;
-     * cancel them separately if they must stop.
-     */
-    async revokeSubject(subject, options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
-        return this.transport.json("/v1/access/revocations", "POST", { requestId: id(), subject }, options.signal);
     }
-    /** The public keys that verify the Tenant's subject tokens. */
+    /** The public keys that verify the Tenant's delivery tokens. */
     async jwks(options = {}) {
-        await this.transport.requireFeature(FEATURE, options.signal);
         return this.transport.json("/v1/access/jwks", "GET", undefined, options.signal);
     }
 }

package/dist/ag-ui/handler.d.ts

@@ -5,8 +5,8 @@
  * person, so the Runtime keeps one person out of another's threads and does all the protocol
  * work. The browser never sees the Tenant key, the Runtime's URL or the Tenant id.
  *
- * The same threads are reachable directly from a browser with a subject token: each thread is
- * one session per subject, agent and thread on both paths.
+ * The same threads are reachable directly from a browser with a trusted issuer's token (through
+ * the operator's proxy): each thread is one session per subject, agent and thread on both paths.
  */
 import { type SubjectScope } from "@nylorun/core/contracts";
 import type { BuiltWorkflow } from "@nylorun/core/define";
@@ -27,10 +27,7 @@ export interface AgUiHandlerOptions {
     basePath?: string;
     /** Application client. Default: `createClient()`, from the environment or the Project link. */
     client?: AgentsClient | Promise<AgentsClient>;
-    /**
-     * What each subject may do through this endpoint. Default `["sessions:own"]`; add
-     * `vaults:own` if `session()` attaches the person's vaults.
-     */
+    /** What each subject may do through this endpoint. Default `["sessions:own"]`. */
     scopes?: readonly SubjectScope[];
     /** Optional per-session parameters, e.g. the person's vault for connected accounts. */
     session?(subject: string, agentId: string): AgUiSessionOptions | Promise<AgUiSessionOptions>;

package/dist/ag-ui/handler.js

@@ -5,8 +5,8 @@
  * person, so the Runtime keeps one person out of another's threads and does all the protocol
  * work. The browser never sees the Tenant key, the Runtime's URL or the Tenant id.
  *
- * The same threads are reachable directly from a browser with a subject token: each thread is
- * one session per subject, agent and thread on both paths.
+ * The same threads are reachable directly from a browser with a trusted issuer's token (through
+ * the operator's proxy): each thread is one session per subject, agent and thread on both paths.
  */
 import { parseSubjectHeaders } from "@nylorun/core/contracts";
 import { createClient, } from "../client.js";

package/dist/artifacts.d.ts

@@ -9,7 +9,7 @@
  * session's sandbox as a version of its `outputs` folder. Read one as a tree, one file by path,
  * a diff between versions or a zip.
  *
- * Acting for a person (`client.as`, a subject token), only the artifacts of their own sessions.
+ * Acting for a person (`client.as`, or a trusted issuer's token), only the artifacts of their own sessions.
  */
 import type { ArtifactDiff, ArtifactLink, ArtifactTree, ArtifactView, DeleteArtifactResponse, UploadArtifactResponse } from "@nylorun/core/contracts";
 import { type Transport } from "./http.js";

package/dist/delivery-token.js

@@ -5,9 +5,9 @@
  * WebCrypto's ECDSA verifies.
  */
 import { PROTOCOL_HEADER, PROTOCOL_VERSION, isTenantId } from "@nylorun/core/compatibility";
-import { DELIVERY_TOKEN_TYPE, subjectTokenIssuer } from "@nylorun/core/contracts";
+import { DELIVERY_TOKEN_TYPE, tenantTokenIssuer } from "@nylorun/core/contracts";
 /** The issuer prefix of a Tenant's tokens: `urn:nylorun:tenant:<tenantId>`. */
-const ISSUER_PREFIX = subjectTokenIssuer("");
+const ISSUER_PREFIX = tenantTokenIssuer("");
 /** Why a delivery was refused; `code` is sent back to the Runtime. */
 export class DeliveryVerificationError extends Error {
     code;
@@ -60,7 +60,7 @@ export async function verifyDeliveryToken(token, options) {
     if (!claims.iss.startsWith(ISSUER_PREFIX) ||
         !isTenantId(claims.iss.slice(ISSUER_PREFIX.length)))
         throw invalid("The token was not issued by a Tenant");
-    if (options.tenantId !== undefined && claims.iss !== subjectTokenIssuer(options.tenantId))
+    if (options.tenantId !== undefined && claims.iss !== tenantTokenIssuer(options.tenantId))
         throw invalid("The token is for another Tenant");
     if (options.audience !== undefined && claims.aud !== options.audience)
         throw invalid(`The token is for ${claims.aud}, not ${options.audience}`);

package/dist/http.d.ts

@@ -1,8 +1,9 @@
 import { type Compatibility, type ProtocolRange } from "@nylorun/core/compatibility";
 /**
- * Subject tokens for a client that holds no Tenant key (a browser or an app; Host feature
- * `subject-tokens`). `get` returns a current token and may fetch a new one; `invalidate`
- * drops the cached one after the Runtime answered `401 token_expired`.
+ * Bearer tokens for a client that holds no Tenant key: a trusted issuer's tokens (Host feature
+ * `trusted-issuers`), from the operator's identity provider. `get` returns a current token and
+ * may fetch a new one; `invalidate` drops the cached one after the Runtime answered
+ * `401 token_expired`.
  */
 export interface TokenSource {
     get(signal?: AbortSignal): Promise<string>;
@@ -16,10 +17,8 @@ export interface Destination {
     url?: string;
     key?: string;
     fetch?: typeof fetch;
-    /** Instead of `key`: subject tokens. The client then skips the `/health` check. */
+    /** Instead of `key`: a trusted issuer's tokens. The client then skips the `/health` check. */
     token?: TokenSource;
-    /** A publishable key (Host feature `browser-access`): names the app and its origins. */
-    publishableKey?: string;
 }
 export declare function env(name: string): string | undefined;
 export declare class RuntimeError extends Error {
@@ -39,10 +38,9 @@ export declare class IncompatibleRuntimeError extends Error {
 }
 export declare class Transport {
     readonly url: string;
-    /** The Tenant key; empty for a client that uses subject tokens. */
+    /** The Tenant key; empty for a client that uses issuer tokens. */
     readonly key: string;
     readonly token: TokenSource | undefined;
-    readonly publishableKey: string | undefined;
     readonly fetcher: typeof fetch;
     /** Sent on every request, e.g. `Nylorun-Subject` and `Nylorun-Scopes` (`withHeaders`). */
     readonly headers: Readonly<Record<string, string>>;