@nylorun/agents 0.9.0-beta → 0.10.0-beta

package/dist/session-client.d.ts

@@ -0,0 +1,282 @@
+/**
+ * The Tenant API client classes, with no Node-only imports so a browser bundle can load them
+ * (`@nylorun/agents/browser`). `client.ts` adds `createClient`, which resolves the
+ * connection from the environment or the Project link.
+ */
+import type { AgentManifest, BuiltAgent, BuiltWorkflow, JsonValue, SandboxToolName, WorkflowManifest } from "@nylorun/core/define";
+import { type SubjectScope, type CredentialInfo, type CredentialSelection, type SandboxRequest, type SessionCommand, type VaultInfo } from "@nylorun/core/contracts";
+import { AccessClient, TokensClient } from "./access.js";
+import { Transport, type Destination } from "./http.js";
+/** Application-principal access to a session's sandbox built-ins (workflows.md §8). */
+export type SessionSandbox = {
+    readonly [K in SandboxToolName]: (args: Record<string, unknown>) => Promise<unknown>;
+};
+export interface AgentSource {
+    readonly id: string;
+    readonly manifest: AgentManifest | WorkflowManifest;
+    build?(): BuiltAgent | BuiltWorkflow;
+    getBinding?: BuiltAgent["getBinding"] | BuiltWorkflow["getBinding"];
+}
+/** Closures stay on the live binding. The published manifest cannot name them. */
+export declare function assertNoMiddlewareClosures(agent: AgentSource): void;
+export interface SessionView {
+    id: string;
+    agentId: string;
+    ownerUserId: string;
+    status: string;
+    activeTurnId: string | null;
+    waits?: unknown;
+    [key: string]: unknown;
+}
+export interface ActAsOptions {
+    /** What the subject may do; the Runtime grants nothing else. Default `["sessions:own"]`. */
+    scopes?: readonly SubjectScope[];
+}
+export declare class AgentsClient {
+    readonly transport: Transport;
+    /** The subject this client acts for (`as`), or `undefined` for the principal itself. */
+    readonly subject: string | undefined;
+    constructor(destination?: Destination);
+    /**
+     * A client that acts for `subject`: every call sends `Nylorun-Subject` and
+     * `Nylorun-Scopes`, and the Runtime limits it to the scopes and to the subject's own sessions
+     * and vaults (Host feature `subject-headers`). For app servers, which authenticate the person
+     * themselves and hold the key; nothing is minted, cached or refreshed.
+     */
+    as(subject: string, options?: ActAsOptions): AgentsClient;
+    /**
+     * Mints subject tokens for signed-in people (Host feature `subject-tokens`), so their
+     * browser or app calls the Runtime directly. Application key only.
+     */
+    get tokens(): TokensClient;
+    /** The access policy, signing keys and revocations (Host feature `subject-tokens`). */
+    get access(): AccessClient;
+    /** The Runtime's protocol features, including optional ones such as `transcript-events`. */
+    hostFeatures(options?: {
+        signal?: AbortSignal;
+    }): Promise<readonly string[]>;
+    listAgents(options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        agents: {
+            manifest: AgentManifest;
+        }[];
+    }>;
+    listSessions(options?: {
+        agentId?: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        sessions: SessionView[];
+    }>;
+    saveAgent(agent: AgentSource | BuiltWorkflow, options: {
+        implementationVersion: string;
+        requestId?: string;
+    }): Promise<unknown>;
+    createSession(options: {
+        id?: string;
+        agentId: string;
+        ownerUserId: string;
+        info?: Record<string, unknown>;
+        requestId?: string;
+        vaultIds?: readonly string[];
+        credentialSelections?: readonly CredentialSelection[];
+        /**
+         * The session's sandbox: omit for the Tenant default, `false` for none, `{ session }` to share
+         * another session's, or an inline sandbox (`image`, `network.allow`, `resources`) checked
+         * against the Tenant's limits. Fixed once the session exists.
+         */
+        sandbox?: SandboxRequest;
+    }): Promise<SessionClient>;
+    createVault(options: {
+        name: string;
+        ownerUserId: string;
+        metadata?: Record<string, string>;
+        idempotencyKey: string;
+        requestId?: string;
+    }): Promise<VaultInfo>;
+    listVaults(ownerUserId: string, signal?: AbortSignal): Promise<{
+        vaults: VaultInfo[];
+    }>;
+    getVault(vaultId: string, signal?: AbortSignal): Promise<VaultInfo>;
+    deleteVault(vaultId: string): Promise<{
+        id: string;
+    }>;
+    createCredential(vaultId: string, options: {
+        name: string;
+        idempotencyKey: string;
+        requestId?: string;
+        auth: {
+            type: "bearer";
+            url: string;
+            token: string;
+        } | {
+            type: "oauth";
+            url: string;
+            accessToken: string;
+            expiresAt?: string | null;
+            refresh?: {
+                tokenEndpoint: string;
+                clientId: string;
+                refreshToken: string;
+                tokenEndpointAuth: {
+                    type: "none";
+                } | {
+                    type: "client_secret_basic";
+                    clientSecret: string;
+                } | {
+                    type: "client_secret_post";
+                    clientSecret: string;
+                };
+            };
+        };
+    }): Promise<CredentialInfo>;
+    listCredentials(vaultId: string, signal?: AbortSignal): Promise<{
+        credentials: CredentialInfo[];
+    }>;
+    getCredential(vaultId: string, credentialId: string, signal?: AbortSignal): Promise<CredentialInfo>;
+    rotateCredential(vaultId: string, credentialId: string, options: {
+        idempotencyKey: string;
+        requestId?: string;
+        auth: {
+            type: "bearer";
+            token: string;
+        } | {
+            type: "oauth";
+            accessToken: string;
+            expiresAt?: string | null;
+        };
+    }): Promise<CredentialInfo>;
+    deleteCredential(vaultId: string, credentialId: string): Promise<{
+        id: string;
+    }>;
+    session(sessionId: string): SessionClient;
+}
+export type CommandOptions = {
+    idempotencyKey: string;
+    requestId?: string;
+    signal?: AbortSignal;
+};
+export declare class SessionClient {
+    private readonly transport;
+    readonly id: string;
+    readonly sandbox: SessionSandbox;
+    constructor(transport: Transport, id: string);
+    private get path();
+    inspect(signal?: AbortSignal): Promise<SessionView>;
+    /** Pending waits / interactions from the session inspect view. */
+    pending(signal?: AbortSignal): Promise<{}>;
+    command(command: SessionCommand, signal?: AbortSignal): Promise<{
+        status: "accepted";
+        turnId: string | null;
+        cursor: string | null;
+        requestId: string;
+    }>;
+    /**
+     * Start a turn. Strings become `message.content`; any other JSON value becomes
+     * `message.data` (workflows.md §5).
+     */
+    input(value: string | JsonValue, options: CommandOptions): Promise<{
+        status: "accepted";
+        turnId: string | null;
+        cursor: string | null;
+        requestId: string;
+    }>;
+    approve(interactionId: string, approved: boolean, options: CommandOptions): Promise<{
+        status: "accepted";
+        turnId: string | null;
+        cursor: string | null;
+        requestId: string;
+    }>;
+    respond(interactionId: string, value: JsonValue, options: CommandOptions): Promise<{
+        status: "accepted";
+        turnId: string | null;
+        cursor: string | null;
+        requestId: string;
+    }>;
+    cancel(options: CommandOptions & {
+        reason?: string;
+    }): Promise<{
+        status: "accepted";
+        turnId: string | null;
+        cursor: string | null;
+        requestId: string;
+    }>;
+    /** `agent` narrows to one agent used as a tool: its delegationId or its path. */
+    history(options?: {
+        cursor?: string;
+        agent?: string;
+        signal?: AbortSignal;
+    }): Promise<{
+        items: ({
+            schema: "nylorun.event/2";
+            eventId: string;
+            tenantId: string;
+            sessionId: string;
+            runId: string | null;
+            turnId: string | null;
+            incarnation: number;
+            epoch: number;
+            seq: number;
+            cursor: string;
+            time: string;
+            schemaVersion: number;
+            source: {
+                kind: "api" | "controller" | "edge" | "egress-gate" | "evidence" | "harness" | "human" | "init" | "loop" | "model-gate" | "operator" | "sandboxd" | "supervisor" | "tool-gate";
+                id: string;
+            };
+            evidence: "asserted" | "attested" | "claimed" | "measured" | "observed";
+            trace?: {
+                traceId: string;
+                spanId: string;
+                parentSpanId?: string | undefined;
+            } | undefined;
+            visibility: "internal" | "public" | "restricted";
+            retention: "full" | "metadata";
+            type: string;
+            payload: unknown;
+        } | import("@nylorun/core/contracts").SessionEvent)[];
+        cursor: string | null;
+    }>;
+    observe(options?: {
+        cursor?: string;
+        signal?: AbortSignal;
+        follow?: boolean;
+    }): AsyncGenerator<{
+        schema: "nylorun.event/2";
+        eventId: string;
+        tenantId: string;
+        sessionId: string;
+        runId: string | null;
+        turnId: string | null;
+        incarnation: number;
+        epoch: number;
+        seq: number;
+        cursor: string;
+        time: string;
+        schemaVersion: number;
+        source: {
+            kind: "api" | "controller" | "edge" | "egress-gate" | "evidence" | "harness" | "human" | "init" | "loop" | "model-gate" | "operator" | "sandboxd" | "supervisor" | "tool-gate";
+            id: string;
+        };
+        evidence: "asserted" | "attested" | "claimed" | "measured" | "observed";
+        trace?: {
+            traceId: string;
+            spanId: string;
+            parentSpanId?: string | undefined;
+        } | undefined;
+        visibility: "internal" | "public" | "restricted";
+        retention: "full" | "metadata";
+        type: string;
+        payload: unknown;
+    }, void, unknown>;
+    private observeOne;
+    /**
+     * Own session stream plus linked agent sessions announced in `node.agent`
+     * events, merged by `time` then arrival order (workflows.md §11).
+     */
+    private observeFollowing;
+}
+export { RuntimeError, IncompatibleRuntimeError } from "./http.js";
+export type { Destination, IncompatibleReason } from "./http.js";
+export type { LiveEvent } from "@nylorun/core/contracts";
+export { AccessClient, PublishableKeysClient, SigningKeysClient, TokensClient, } from "./access.js";

package/dist/session-client.js

@@ -0,0 +1,375 @@
+import { SANDBOX_TOOL_NAMES, delegateOf, isBuiltWorkflow, isSandboxToolName, } from "@nylorun/core/define";
+import { z } from "zod";
+import { SCOPES_HEADER, SUBJECT_HEADER } from "@nylorun/core/compatibility";
+import { parseSessionEvent, parseSubjectHeaders, } from "@nylorun/core/contracts";
+import { AccessClient, TokensClient } from "./access.js";
+import { Transport, id, segment } from "./http.js";
+import { observeSSE } from "./sse.js";
+function sessionSandboxOf(transport, sessionId) {
+    const call = (tool, args) => transport.json(`/v1/sessions/${segment(sessionId)}/sandbox/${segment(tool)}`, "POST", args);
+    const sandbox = {};
+    for (const tool of SANDBOX_TOOL_NAMES) {
+        if (!isSandboxToolName(tool))
+            continue;
+        sandbox[tool] = (args) => call(tool, args);
+    }
+    return sandbox;
+}
+function linkedSessionId(event) {
+    if (event.type !== "node.agent")
+        return undefined;
+    const payload = event.payload;
+    if (!payload || typeof payload !== "object" || Array.isArray(payload))
+        return undefined;
+    const sessionId = payload.sessionId;
+    return typeof sessionId === "string" && sessionId.length > 0
+        ? sessionId
+        : undefined;
+}
+const middlewareClosure = "Hosted definitions support declarative capabilities and before/after hooks, not middleware closures";
+/** The agent's declarations, then those of each agent it uses as a tool, keyed `<child>/<capability>`. */
+function declarationsOf(agent) {
+    if (isBuiltWorkflow(agent) || agent.manifest.kind === "workflow")
+        return [];
+    const built = agent.build?.() ?? agent;
+    if (isBuiltWorkflow(built))
+        return [];
+    const binding = built.getBinding?.();
+    if (!binding || !("declarations" in binding))
+        return [];
+    const found = (binding.declarations ?? []).map((item) => ({ key: item.id, item }));
+    for (const tool of binding.tools ?? []) {
+        const delegate = delegateOf(tool);
+        const child = delegate?.agent;
+        for (const item of child?.getBinding().declarations ?? [])
+            found.push({ key: `${child.id}/${item.id}`, item });
+        // A flow agent used as a tool: its agents' declarations, keyed `<flow>/<agent>/<capability>`.
+        const flow = delegate?.workflow;
+        for (const leaf of Object.values(flow?.getBinding().agents ?? {}))
+            for (const item of leaf.declarations ?? [])
+                found.push({ key: `${flow.id}/${leaf.manifest.id}/${item.id}`, item });
+    }
+    return found;
+}
+function pluginRootsOf(agent) {
+    const roots = {};
+    for (const { key, item } of declarationsOf(agent))
+        if (item.pluginRoot)
+            roots[key] = item.pluginRoot;
+    return Object.keys(roots).length === 0 ? undefined : roots;
+}
+/** Closures stay on the live binding. The published manifest cannot name them. */
+export function assertNoMiddlewareClosures(agent) {
+    if (declarationsOf(agent).some(({ item }) => item.hasMiddleware))
+        throw new Error(middlewareClosure);
+}
+export class AgentsClient {
+    transport;
+    /** The subject this client acts for (`as`), or `undefined` for the principal itself. */
+    subject;
+    constructor(destination = {}) {
+        this.transport = new Transport(destination);
+        this.subject = undefined;
+    }
+    /**
+     * A client that acts for `subject`: every call sends `Nylorun-Subject` and
+     * `Nylorun-Scopes`, and the Runtime limits it to the scopes and to the subject's own sessions
+     * and vaults (Host feature `subject-headers`). For app servers, which authenticate the person
+     * themselves and hold the key; nothing is minted, cached or refreshed.
+     */
+    as(subject, options = {}) {
+        if (this.subject !== undefined)
+            throw new Error(`This client already acts for ${this.subject}`);
+        const scopes = [...(options.scopes ?? ["sessions:own"])].join(" ");
+        const parsed = parseSubjectHeaders(subject, scopes);
+        if (!parsed.ok)
+            throw new TypeError(parsed.message);
+        const client = Object.create(AgentsClient.prototype);
+        return Object.assign(client, {
+            transport: this.transport.withHeaders({
+                [SUBJECT_HEADER]: subject,
+                [SCOPES_HEADER]: [...parsed.scopes].join(" "),
+            }),
+            subject,
+        });
+    }
+    /**
+     * Mints subject tokens for signed-in people (Host feature `subject-tokens`), so their
+     * browser or app calls the Runtime directly. Application key only.
+     */
+    get tokens() {
+        return new TokensClient(this.transport);
+    }
+    /** The access policy, signing keys and revocations (Host feature `subject-tokens`). */
+    get access() {
+        return new AccessClient(this.transport);
+    }
+    /** The Runtime's protocol features, including optional ones such as `transcript-events`. */
+    hostFeatures(options = {}) {
+        return this.transport.hostFeatures(options.signal);
+    }
+    listAgents(options = {}) {
+        return this.transport.json("/v1/agents", "GET", undefined, options.signal);
+    }
+    listSessions(options = {}) {
+        const query = options.agentId
+            ? `?agentId=${encodeURIComponent(options.agentId)}`
+            : "";
+        return this.transport.json(`/v1/sessions${query}`, "GET", undefined, options.signal);
+    }
+    async saveAgent(agent, options) {
+        if (isBuiltWorkflow(agent) && agent.manifest.workflowSchemaVersion === 2) {
+            // A v2 workflow embeds its agents: one document, carrying their plugin roots.
+            const pluginRoots = {};
+            for (const binding of Object.values(agent.getBinding().agents)) {
+                const leaf = { id: binding.manifest.id, manifest: binding.manifest, getBinding: () => binding };
+                assertNoMiddlewareClosures(leaf);
+                for (const [key, root] of Object.entries(pluginRootsOf(leaf) ?? {}))
+                    pluginRoots[`${leaf.id}/${key}`] = root;
+            }
+            return this.transport.json(`/v1/agents/${segment(agent.id)}`, "PUT", {
+                requestId: options.requestId ?? id(),
+                manifest: agent.manifest,
+                implementationVersion: options.implementationVersion,
+                ...(Object.keys(pluginRoots).length === 0 ? {} : { pluginRoots }),
+            });
+        }
+        if (isBuiltWorkflow(agent)) {
+            for (const binding of Object.values(agent.getBinding().agents)) {
+                await this.saveAgent({
+                    id: binding.manifest.id,
+                    manifest: binding.manifest,
+                    getBinding: () => binding,
+                }, options);
+            }
+            return this.transport.json(`/v1/agents/${segment(agent.id)}`, "PUT", {
+                requestId: options.requestId ?? id(),
+                manifest: agent.manifest,
+                implementationVersion: options.implementationVersion,
+            });
+        }
+        assertNoMiddlewareClosures(agent);
+        const pluginRoots = pluginRootsOf(agent);
+        return this.transport.json(`/v1/agents/${segment(agent.id)}`, "PUT", {
+            requestId: options.requestId ?? id(),
+            manifest: agent.manifest,
+            implementationVersion: options.implementationVersion,
+            ...(pluginRoots === undefined ? {} : { pluginRoots }),
+        });
+    }
+    async createSession(options) {
+        const sessionId = options.id ?? id();
+        await this.transport.json(`/v1/sessions/${segment(sessionId)}`, "PUT", {
+            requestId: options.requestId ?? id(),
+            agentId: options.agentId,
+            ownerUserId: options.ownerUserId,
+            ...(options.info ? { info: options.info } : {}),
+            ...(options.vaultIds ? { vaultIds: options.vaultIds } : {}),
+            ...(options.credentialSelections
+                ? { credentialSelections: options.credentialSelections }
+                : {}),
+            ...(options.sandbox === undefined ? {} : { sandbox: options.sandbox }),
+        });
+        return this.session(sessionId);
+    }
+    createVault(options) {
+        return this.transport.json("/v1/vaults", "POST", {
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+            name: options.name,
+            ownerUserId: options.ownerUserId,
+            ...(options.metadata ? { metadata: options.metadata } : {}),
+        });
+    }
+    listVaults(ownerUserId, signal) {
+        return this.transport.json(`/v1/vaults?ownerUserId=${encodeURIComponent(ownerUserId)}`, "GET", undefined, signal);
+    }
+    getVault(vaultId, signal) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}`, "GET", undefined, signal);
+    }
+    deleteVault(vaultId) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}`, "DELETE");
+    }
+    createCredential(vaultId, options) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}/credentials`, "POST", {
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+            name: options.name,
+            auth: options.auth,
+        });
+    }
+    listCredentials(vaultId, signal) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}/credentials`, "GET", undefined, signal);
+    }
+    getCredential(vaultId, credentialId, signal) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}/credentials/${segment(credentialId)}`, "GET", undefined, signal);
+    }
+    rotateCredential(vaultId, credentialId, options) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}/credentials/${segment(credentialId)}`, "POST", {
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+            auth: options.auth,
+        });
+    }
+    deleteCredential(vaultId, credentialId) {
+        return this.transport.json(`/v1/vaults/${segment(vaultId)}/credentials/${segment(credentialId)}`, "DELETE");
+    }
+    session(sessionId) {
+        return new SessionClient(this.transport, sessionId);
+    }
+}
+export class SessionClient {
+    transport;
+    id;
+    sandbox;
+    constructor(transport, id) {
+        this.transport = transport;
+        this.id = id;
+        this.sandbox = sessionSandboxOf(transport, id);
+    }
+    get path() {
+        return `/v1/sessions/${segment(this.id)}`;
+    }
+    inspect(signal) {
+        return this.transport.json(this.path, "GET", undefined, signal);
+    }
+    /** Pending waits / interactions from the session inspect view. */
+    async pending(signal) {
+        const view = await this.inspect(signal);
+        return view.waits ?? [];
+    }
+    command(command, signal) {
+        return this.transport.json(`${this.path}/commands`, "POST", command, signal);
+    }
+    /**
+     * Start a turn. Strings become `message.content`; any other JSON value becomes
+     * `message.data` (workflows.md §5).
+     */
+    input(value, options) {
+        const base = {
+            type: "message",
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+        };
+        return this.command(typeof value === "string"
+            ? { ...base, content: value }
+            : { ...base, data: value }, options.signal);
+    }
+    approve(interactionId, approved, options) {
+        return this.command({
+            type: "approve",
+            interactionId,
+            approved,
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+        }, options.signal);
+    }
+    respond(interactionId, value, options) {
+        return this.command({
+            type: "respond",
+            interactionId,
+            value,
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+        }, options.signal);
+    }
+    cancel(options) {
+        return this.command({
+            type: "cancel",
+            requestId: options.requestId ?? id(),
+            idempotencyKey: options.idempotencyKey,
+            ...(options.reason ? { reason: options.reason } : {}),
+        }, options.signal);
+    }
+    /** `agent` narrows to one agent used as a tool: its delegationId or its path. */
+    async history(options = {}) {
+        const query = new URLSearchParams();
+        if (options.cursor)
+            query.set("cursor", options.cursor);
+        if (options.agent)
+            query.set("agent", options.agent);
+        const search = query.toString();
+        const page = z
+            .object({ items: z.array(z.unknown()), cursor: z.string().nullable() })
+            .parse(await this.transport.json(`${this.path}/items${search ? `?${search}` : ""}`, "GET", undefined, options.signal));
+        // Typed when the catalog knows the type; a newer Runtime's type stays a bare envelope.
+        return { items: page.items.map(parseSessionEvent), cursor: page.cursor };
+    }
+    async *observe(options = {}) {
+        if (!options.follow) {
+            yield* this.observeOne(this.id, options);
+            return;
+        }
+        yield* this.observeFollowing(options);
+    }
+    async *observeOne(sessionId, options) {
+        for await (const frame of observeSSE(this.transport, `/v1/sessions/${segment(sessionId)}/events`, options)) {
+            if (frame.event === "heartbeat" || frame.event === "ready")
+                continue;
+            yield parseSessionEvent(JSON.parse(frame.data));
+        }
+    }
+    /**
+     * Own session stream plus linked agent sessions announced in `node.agent`
+     * events, merged by `time` then arrival order (workflows.md §11).
+     */
+    async *observeFollowing(options) {
+        const signal = options.signal;
+        const linked = new Set();
+        const queue = [];
+        let wait;
+        let open = 1;
+        let failed;
+        const wake = () => {
+            wait?.();
+            wait = undefined;
+        };
+        const push = (event) => {
+            queue.push(event);
+            queue.sort((a, b) => {
+                const byTime = a.time.localeCompare(b.time);
+                return byTime !== 0 ? byTime : a.cursor.localeCompare(b.cursor);
+            });
+            wake();
+        };
+        const pump = async (sessionId, cursor) => {
+            try {
+                for await (const event of this.observeOne(sessionId, { cursor, signal })) {
+                    push(event);
+                    const link = linkedSessionId(event);
+                    if (link && link !== this.id && !linked.has(link)) {
+                        linked.add(link);
+                        open += 1;
+                        void pump(link).finally(() => {
+                            open -= 1;
+                            wake();
+                        });
+                    }
+                }
+            }
+            catch (error) {
+                if (!signal?.aborted)
+                    failed = error;
+            }
+        };
+        void pump(this.id, options.cursor).finally(() => {
+            open -= 1;
+            wake();
+        });
+        while (!signal?.aborted) {
+            if (failed)
+                throw failed;
+            if (queue.length) {
+                yield queue.shift();
+                continue;
+            }
+            if (open <= 0)
+                return;
+            await new Promise((resolve) => {
+                wait = resolve;
+            });
+        }
+    }
+}
+export { RuntimeError, IncompatibleRuntimeError } from "./http.js";
+export { AccessClient, PublishableKeysClient, SigningKeysClient, TokensClient, } from "./access.js";

package/dist/sse.js

@@ -65,7 +65,11 @@ export async function* observeSSE(transport, path, options = {}) {
     const signal = options.signal ?? controller.signal;
     let cursor = options.cursor;
     let retry = 250;
+    // The Runtime ended the stream because its subject token expired or was revoked: reconnect
+    // at once (the transport fetches a new token), but only once in a row.
+    let closedByRuntime = 0;
     while (!signal.aborted) {
+        let reconnectNow = false;
         try {
             const response = await transport.request(path, {
                 signal,
@@ -75,7 +79,13 @@ export async function* observeSSE(transport, path, options = {}) {
                 },
             });
             for await (const event of readSSE(response, signal)) {
+                if (event.event === "nylorun.closed") {
+                    closedByRuntime += 1;
+                    reconnectNow = closedByRuntime === 1;
+                    break;
+                }
                 retry = 250;
+                closedByRuntime = 0;
                 if (event.id)
                     cursor = event.id;
                 yield event;
@@ -90,6 +100,8 @@ export async function* observeSSE(transport, path, options = {}) {
                 ![408, 429].includes(error.status))
                 throw error;
         }
+        if (reconnectNow)
+            continue;
         if (!signal.aborted)
             await delay(retry, signal).catch(() => { });
         retry = Math.min(30000, retry * 2);