@nylorun/agents 0.9.0-beta → 0.11.0-beta

package/dist/delivery-token.js

@@ -0,0 +1,159 @@
+/**
+ * Verifies the delivery token on a request the Runtime sends to an Action endpoint: an ES256
+ * JWT signed with the Tenant's current signing key (design: Action endpoints §8.1). WebCrypto
+ * only, so the SDK takes no JWT dependency: a JWS ES256 signature is the raw `r || s` pair
+ * WebCrypto's ECDSA verifies.
+ */
+import { PROTOCOL_HEADER, PROTOCOL_VERSION, isTenantId } from "@nylorun/core/compatibility";
+import { DELIVERY_TOKEN_TYPE, subjectTokenIssuer } from "@nylorun/core/contracts";
+/** The issuer prefix of a Tenant's tokens: `urn:nylorun:tenant:<tenantId>`. */
+const ISSUER_PREFIX = subjectTokenIssuer("");
+/** Why a delivery was refused; `code` is sent back to the Runtime. */
+export class DeliveryVerificationError extends Error {
+    code;
+    name = "DeliveryVerificationError";
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+/** Clock skew tolerated on `iat` and `exp`, in seconds. */
+const SKEW_SECONDS = 30;
+const FORBIDDEN_HEADERS = ["jku", "jwk", "x5u", "x5c", "x5t", "x5t#S256", "crit"];
+/** The largest token accepted: well above a real one, well below a request limit. */
+const MAX_TOKEN_LENGTH = 4096;
+/**
+ * Verifies `token` against `body`. The keys are the installation's, so a valid signature already
+ * binds the issuer to its one Tenant: any `urn:nylorun:tenant:<id>` issuer is accepted (and
+ * returned in `iss`) unless `tenantId` names the one expected.
+ */
+export async function verifyDeliveryToken(token, options) {
+    if (!token)
+        throw new DeliveryVerificationError("signature_missing", "No delivery token");
+    const parts = token.length <= MAX_TOKEN_LENGTH ? token.split(".") : [];
+    if (parts.length !== 3)
+        throw invalid("Not a compact JWS");
+    const [encodedHeader, encodedPayload, encodedSignature] = parts;
+    const header = json(encodedHeader);
+    if (header.alg !== "ES256" ||
+        header.typ !== DELIVERY_TOKEN_TYPE ||
+        typeof header.kid !== "string" ||
+        FORBIDDEN_HEADERS.some((name) => name in header))
+        throw invalid("Unexpected token header");
+    const key = await options.keys(header.kid);
+    if (!key)
+        throw new DeliveryVerificationError("key_unknown", `Unknown signing key ${header.kid}`);
+    const signed = await crypto.subtle.verify({ name: "ECDSA", hash: "SHA-256" }, key, bytes(base64url(encodedSignature)), new TextEncoder().encode(`${encodedHeader}.${encodedPayload}`));
+    if (!signed)
+        throw invalid("Bad signature");
+    const claims = json(encodedPayload);
+    if (typeof claims.iss !== "string" ||
+        typeof claims.aud !== "string" ||
+        typeof claims.sub !== "string" ||
+        typeof claims.agt !== "string" ||
+        !Number.isInteger(claims.gen) ||
+        typeof claims.bdy !== "string" ||
+        typeof claims.iat !== "number" ||
+        typeof claims.exp !== "number" ||
+        typeof claims.jti !== "string")
+        throw invalid("Missing claims");
+    if (!claims.iss.startsWith(ISSUER_PREFIX) ||
+        !isTenantId(claims.iss.slice(ISSUER_PREFIX.length)))
+        throw invalid("The token was not issued by a Tenant");
+    if (options.tenantId !== undefined && claims.iss !== subjectTokenIssuer(options.tenantId))
+        throw invalid("The token is for another Tenant");
+    if (options.audience !== undefined && claims.aud !== options.audience)
+        throw invalid(`The token is for ${claims.aud}, not ${options.audience}`);
+    const now = (options.now ?? Date.now()) / 1000;
+    if (claims.exp < now - SKEW_SECONDS || claims.iat > now + SKEW_SECONDS)
+        throw new DeliveryVerificationError("token_expired", "The delivery token has expired");
+    if (claims.bdy !== (await bodyHash(options.body)))
+        throw invalid("The body does not match the token");
+    return claims;
+}
+/** base64url SHA-256 of `body`: the token's `bdy` claim. */
+export async function bodyHash(body) {
+    const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", bytes(body)));
+    return Buffer.from(digest).toString("base64url");
+}
+/**
+ * The Tenant's public keys, fetched from `GET /v1/access/jwks` and cached by `kid`. An
+ * unknown `kid` refetches once, at most every `refetchMs`, so forged tokens cannot make the
+ * endpoint call the Runtime on every request. Concurrent lookups share one in-flight fetch.
+ */
+export class JwksCache {
+    source;
+    refetchMs;
+    keys = new Map();
+    lastFetch = 0;
+    pending;
+    constructor(source, refetchMs = 5000) {
+        this.source = source;
+        this.refetchMs = refetchMs;
+    }
+    lookup = async (kid) => {
+        const known = this.keys.get(kid);
+        if (known)
+            return known;
+        // Wait for an in-flight fetch: stamping the cooldown at the start of `load` used
+        // to make a concurrent ping (register + smoke, or tsx watch restart) answer
+        // `key_unknown` before the keys arrived.
+        if (this.pending) {
+            await this.pending;
+            return this.keys.get(kid);
+        }
+        if (Date.now() - this.lastFetch < this.refetchMs && this.lastFetch > 0)
+            return undefined;
+        await (this.pending ??= this.load().finally(() => (this.pending = undefined)));
+        return this.keys.get(kid);
+    };
+    async load() {
+        const keys = "keys" in this.source ? this.source.keys : await this.fetchKeys(this.source);
+        this.lastFetch = Date.now();
+        for (const jwk of keys) {
+            const kid = jwk.kid;
+            if (typeof kid !== "string" || jwk.kty !== "EC" || jwk.crv !== "P-256")
+                continue;
+            if (this.keys.has(kid))
+                continue;
+            this.keys.set(kid, await crypto.subtle.importKey("jwk", { kty: jwk.kty, crv: jwk.crv, x: jwk.x, y: jwk.y }, { name: "ECDSA", namedCurve: "P-256" }, false, ["verify"]));
+        }
+    }
+    async fetchKeys(source) {
+        const headers = {
+            [PROTOCOL_HEADER]: String(PROTOCOL_VERSION),
+        };
+        if (source.key)
+            headers.Authorization = `Bearer ${source.key}`;
+        const response = await (source.fetch ?? globalThis.fetch)(`${source.url.replace(/\/$/, "")}/v1/access/jwks`, { headers, redirect: "error", signal: AbortSignal.timeout(10_000) });
+        if (!response.ok) {
+            await response.body?.cancel();
+            throw new Error(`The Runtime answered ${response.status} for its public keys (GET /v1/access/jwks)`);
+        }
+        const body = (await response.json());
+        return Array.isArray(body.keys) ? body.keys : [];
+    }
+}
+function invalid(message) {
+    return new DeliveryVerificationError("signature_invalid", message);
+}
+function base64url(value) {
+    return new Uint8Array(Buffer.from(value, "base64url"));
+}
+/** A copy backed by a plain `ArrayBuffer`, which WebCrypto's types require. */
+function bytes(value) {
+    const copy = new Uint8Array(value.byteLength);
+    copy.set(value);
+    return copy;
+}
+function json(segment) {
+    try {
+        const value = JSON.parse(Buffer.from(segment, "base64url").toString("utf8"));
+        if (value && typeof value === "object" && !Array.isArray(value))
+            return value;
+    }
+    catch {
+        /* fall through */
+    }
+    throw invalid("Malformed token");
+}

package/dist/execute-action.d.ts

@@ -8,3 +8,9 @@ export type ExecuteActionOptions = {
 };
 /** Executes code only after a host-issued claim. No engine dependency. */
 export declare function executeAction(action: Action, root: ExecutableDefinition, signal: AbortSignal, options?: ExecuteActionOptions): Promise<ActionOutcome>;
+/**
+ * True when `action` runs a tool marked `background` (`ToolDefinition.background`): an Action
+ * endpoint answers its delivery at once and posts the outcome later. False for anything it
+ * cannot find; `executeAction` reports those.
+ */
+export declare function runsInBackground(action: Action, root: ExecutableDefinition): boolean;

package/dist/execute-action.js

@@ -42,6 +42,30 @@ export async function executeAction(action, root, signal, options = {}) {
     const tool = normalizeToolDefinition(raw);
     return runTool(action, tool, ref, signal, sandbox);
 }
+/**
+ * True when `action` runs a tool marked `background` (`ToolDefinition.background`): an Action
+ * endpoint answers its delivery at once and posts the outcome later. False for anything it
+ * cannot find; `executeAction` reports those.
+ */
+export function runsInBackground(action, root) {
+    if (action.kind !== "tool")
+        return false;
+    try {
+        if (isBuiltWorkflow(root)) {
+            const key = action.key;
+            const impl = typeof key === "string" ? root.getBinding().nodes[key] : undefined;
+            return impl?.kind === "tool" && impl.tool.background === true;
+        }
+        if (!("capabilityId" in action))
+            return false;
+        const agent = action.agent ? delegatedAgent(root, action.agent.id) : root;
+        const raw = implementationsFor(agent)[action.capabilityId]?.tools?.[action.toolName];
+        return raw !== undefined && normalizeToolDefinition(raw).background === true;
+    }
+    catch {
+        return false;
+    }
+}
 async function executeWorkflowTool(action, binding, signal, sandbox) {
     const impl = binding.nodes[action.key];
     if (!impl || impl.kind !== "tool")

package/dist/http.d.ts

@@ -1,9 +1,25 @@
 import { type Compatibility, type ProtocolRange } from "@nylorun/core/compatibility";
+/**
+ * Subject tokens for a client that holds no Tenant key (a browser or an app; Host feature
+ * `subject-tokens`). `get` returns a current token and may fetch a new one; `invalidate`
+ * drops the cached one after the Runtime answered `401 token_expired`.
+ */
+export interface TokenSource {
+    get(signal?: AbortSignal): Promise<string>;
+    invalidate(): void;
+}
+/**
+ * Where a client sends its requests. Nothing names a Tenant: the Runtime at `url` serves one
+ * (protocol 5).
+ */
 export interface Destination {
     url?: string;
     key?: string;
-    tenant?: string;
     fetch?: typeof fetch;
+    /** Instead of `key`: subject tokens. The client then skips the `/health` check. */
+    token?: TokenSource;
+    /** A publishable key (Host feature `browser-access`): names the app and its origins. */
+    publishableKey?: string;
 }
 export declare function env(name: string): string | undefined;
 export declare class RuntimeError extends Error {
@@ -23,27 +39,42 @@ export declare class IncompatibleRuntimeError extends Error {
 }
 export declare class Transport {
     readonly url: string;
+    /** The Tenant key; empty for a client that uses subject tokens. */
     readonly key: string;
-    readonly tenant: string;
+    readonly token: TokenSource | undefined;
+    readonly publishableKey: string | undefined;
     readonly fetcher: typeof fetch;
     /** Sent on every request, e.g. `Nylorun-Subject` and `Nylorun-Scopes` (`withHeaders`). */
     readonly headers: Readonly<Record<string, string>>;
     private readonly check;
-    constructor(options?: Destination, role?: "server" | "executor");
+    constructor(options?: Destination);
     /**
      * The same destination with `headers` added to every request. The copy shares this
      * transport's compatibility check, so a copy made per request does not repeat `/health`.
      */
     withHeaders(headers: Readonly<Record<string, string>>): Transport;
+    /**
+     * The same destination with another bearer (a delivery token for an Action endpoint's
+     * callbacks). Like `withHeaders`, the copy shares this transport's compatibility check.
+     */
+    withKey(key: string): Transport;
     /** Clears the cached Host compatibility result (used after a 426). */
     clearCompatibilityCache(): void;
     private ensureCompatible;
+    /** Throws `IncompatibleRuntimeError` before anything is sent when the Host lacks `feature`. */
+    requireFeature(feature: string, signal?: AbortSignal): Promise<void>;
     /** The Host's protocol features, including optional ones, from its `/health`. */
     hostFeatures(signal?: AbortSignal): Promise<readonly string[]>;
     private authHeaders;
     request(path: string, init?: RequestInit, options?: {
         retried426?: boolean;
+        retried401?: boolean;
     }): Promise<Response>;
+    /**
+     * Sends a request with this client's credentials and returns the Runtime's response as it
+     * is, errors included (an app server passing a response through, e.g. the AG-UI handler).
+     */
+    forward(path: string, init?: RequestInit): Promise<Response>;
     json<T>(path: string, method?: string, body?: unknown, signal?: AbortSignal): Promise<T>;
 }
 export declare const id: () => `${string}-${string}-${string}-${string}-${string}`;

package/dist/http.js

@@ -1,4 +1,4 @@
-import { PROTOCOL_FEATURES, PROTOCOL_HEADER, PROTOCOL_VERSION, TENANT_HEADER, checkCompatibility, } from "@nylorun/core/compatibility";
+import { PROTOCOL_FEATURES, PROTOCOL_HEADER, PROTOCOL_VERSION, PUBLISHABLE_KEY_HEADER, checkCompatibility, } from "@nylorun/core/compatibility";
 export function env(name) {
     return typeof process !== "undefined" ? process.env[name] : undefined;
 }
@@ -54,28 +54,35 @@ function parseProtocolRange(value) {
 }
 export class Transport {
     url;
+    /** The Tenant key; empty for a client that uses subject tokens. */
     key;
-    tenant;
+    token;
+    publishableKey;
     fetcher;
     /** Sent on every request, e.g. `Nylorun-Subject` and `Nylorun-Scopes` (`withHeaders`). */
     headers = {};
     check = { compatible: false, features: [] };
-    constructor(options = {}, role = "server") {
+    constructor(options = {}) {
         const url = options.url ?? env("NYLORUN_RUNTIME_URL");
-        const key = options.key ??
-            env(role === "server" ? "NYLORUN_SERVER_KEY" : "NYLORUN_EXECUTOR_KEY");
-        const tenant = options.tenant ?? env("NYLORUN_TENANT");
-        if (!url || !key)
-            throw new Error(`Set Runtime url and ${role} key explicitly or via NYLORUN_RUNTIME_URL / NYLORUN_${role.toUpperCase()}_KEY`);
-        if (!tenant)
-            throw new Error("Set tenant explicitly or via NYLORUN_TENANT");
+        const token = options.token;
+        const key = token ? "" : options.key ?? env("NYLORUN_SERVER_KEY");
+        if (!url || (!token && !key))
+            throw new Error("Set Runtime url and server key explicitly or via NYLORUN_RUNTIME_URL / NYLORUN_SERVER_KEY");
+        if (token && options.key)
+            throw new Error("Use a Tenant key or subject tokens, not both");
         const parsed = new URL(url);
         if (!["http:", "https:"].includes(parsed.protocol))
             throw new Error("Runtime requires an HTTP(S) URL");
         this.url = url.replace(/\/$/, "");
         this.key = key;
-        this.tenant = tenant;
-        this.fetcher = options.fetch ?? globalThis.fetch;
+        this.token = token;
+        this.publishableKey = options.publishableKey;
+        // Browsers may not call `/health` (it refuses `Origin`); token clients rely on `426`.
+        if (token)
+            this.check.compatible = true;
+        // Called as a method on a page's window would otherwise lose `this`.
+        const fetcher = options.fetch ?? globalThis.fetch;
+        this.fetcher = options.fetch ? fetcher : (input, init) => fetcher(input, init);
     }
     /**
      * The same destination with `headers` added to every request. The copy shares this
@@ -87,6 +94,14 @@ export class Transport {
             headers: Object.freeze({ ...this.headers, ...headers }),
         });
     }
+    /**
+     * The same destination with another bearer (a delivery token for an Action endpoint's
+     * callbacks). Like `withHeaders`, the copy shares this transport's compatibility check.
+     */
+    withKey(key) {
+        const copy = Object.create(Transport.prototype);
+        return Object.assign(copy, this, { key });
+    }
     /** Clears the cached Host compatibility result (used after a 426). */
     clearCompatibilityCache() {
         this.check.compatible = false;
@@ -123,19 +138,35 @@ export class Transport {
         if (!result.ok)
             throw new IncompatibleRuntimeError(result);
         this.check.features = [...protocol.features];
+        this.check.range = protocol;
         this.check.compatible = true;
     }
+    /** Throws `IncompatibleRuntimeError` before anything is sent when the Host lacks `feature`. */
+    async requireFeature(feature, signal) {
+        const features = await this.hostFeatures(signal);
+        if (!features.includes(feature))
+            throw new IncompatibleRuntimeError({
+                ok: false,
+                reason: "feature",
+                missing: [feature],
+                host: this.check.range ?? { min: 0, max: 0, features },
+            });
+    }
     /** The Host's protocol features, including optional ones, from its `/health`. */
     async hostFeatures(signal) {
         await this.ensureCompatible(signal);
         return this.check.features;
     }
-    authHeaders(init = {}) {
+    async authHeaders(init = {}) {
         const headers = new Headers(init.headers);
         for (const [name, value] of Object.entries(this.headers))
             headers.set(name, value);
-        headers.set("Authorization", `Bearer ${this.key}`);
-        headers.set(TENANT_HEADER, this.tenant);
+        const bearer = this.token
+            ? await this.token.get(init.signal ?? undefined)
+            : this.key;
+        headers.set("Authorization", `Bearer ${bearer}`);
+        if (this.publishableKey)
+            headers.set(PUBLISHABLE_KEY_HEADER, this.publishableKey);
         headers.set(PROTOCOL_HEADER, String(PROTOCOL_VERSION));
         if (init.body)
             headers.set("Content-Type", "application/json");
@@ -145,9 +176,18 @@ export class Transport {
         await this.ensureCompatible(init.signal === null ? undefined : init.signal);
         const response = await this.fetcher(this.url + path, {
             ...init,
-            headers: this.authHeaders(init),
+            headers: await this.authHeaders(init),
             redirect: "error",
         });
+        // An expired or revoked subject token: get a new one and try once more.
+        if (response.status === 401 && this.token && !options.retried401) {
+            const body = (await response.clone().json().catch(() => undefined));
+            if (body?.code === "token_expired") {
+                await response.body?.cancel().catch(() => { });
+                this.token.invalidate();
+                return this.request(path, init, { ...options, retried401: true });
+            }
+        }
         if (response.status === 426) {
             this.clearCompatibilityCache();
             if (!options.retried426) {
@@ -185,6 +225,18 @@ export class Transport {
         }
         return response;
     }
+    /**
+     * Sends a request with this client's credentials and returns the Runtime's response as it
+     * is, errors included (an app server passing a response through, e.g. the AG-UI handler).
+     */
+    async forward(path, init = {}) {
+        await this.ensureCompatible(init.signal === null ? undefined : init.signal);
+        return this.fetcher(this.url + path, {
+            ...init,
+            headers: await this.authHeaders(init),
+            redirect: "error",
+        });
+    }
     async json(path, method = "GET", body, signal) {
         const response = await this.request(path, {
             method,

package/dist/index.d.ts

@@ -1,21 +1,24 @@
-export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, TENANT_HEADER, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
+export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
 export type { ProtocolFeature, ProtocolRange, Compatibility, ErrorCode, } from "@nylorun/core/compatibility";
 export { Agent, AgentBuilder } from "./builder.js";
 export { AgentBuildError, AgentLifecycleError, Loop, Chain, Switch, Parallel, Map, VerdictSchema, isVerdict, withInstructions, withoutTools, WorkflowBuildError, isBuiltWorkflow, capability, CapabilityBuilder, flow, tool, defineSchema, ToolError, } from "@nylorun/core/define";
 export type { FlowAgentBuilder, Flow, Named, StageArgs, NestedStageArgs, CapabilityIdentity, } from "@nylorun/core/define";
 export type { AgentOptions, AgentManifest, BuiltAgent, BuiltWorkflow, LoopOptions, LoopDecideArgs, LoopVerifyArgs, LoopDecision, ChainOptions, SwitchOptions, ParallelOptions, MapOptions, Verdict, WorkflowBinding, WorkflowManifest, ToolDefinition, ToolExecutionContext, ToolOutcome, Patch, Decision, TurnDecision, HookScope, BeforeHook, AfterHook, JsonValue, JsonObject, } from "@nylorun/core/define";
-export type { LiveEvent, SessionCommand, Action, ActionOutcome, CredentialInfo, CredentialSelection, VaultInfo, SubjectScope, } from "@nylorun/core/contracts";
+export type { LiveEvent, SessionEvent, SessionEventOf, EventType, SessionCommand, Action, ActionOutcome, CredentialInfo, CredentialSelection, VaultInfo, SubjectScope, } from "@nylorun/core/contracts";
 export { SUBJECT_SCOPES } from "@nylorun/core/contracts";
 export { AgentsClient, SessionClient, createClient } from "./client.js";
 export type { ActAsOptions, AgentSource, SessionView, CommandOptions, SessionSandbox, } from "./client.js";
-export { connectAgents } from "./executor.js";
-export type { ConnectOptions, AgentConnection } from "./executor.js";
+export { AccessClient, PublishableKeysClient, SigningKeysClient, TokensClient, } from "./access.js";
+export type { CreateTokenOptions } from "./access.js";
+export { createTokenEndpoint } from "./token-endpoint.js";
+export type { TokenEndpointOptions } from "./token-endpoint.js";
+export { createActionHandler } from "./action-handler.js";
+export type { ActionHandler, ActionHandlerOptions, RegisterOptions, } from "./action-handler.js";
 export type { ExecuteActionOptions, ExecutableDefinition, } from "./execute-action.js";
 export { resolveConnection, ConnectionError } from "./connection.js";
 export type { ResolvedConnection } from "./connection.js";
-export { deriveExecutorToken } from "./derived-credentials.js";
 export { RuntimeError, IncompatibleRuntimeError } from "./http.js";
-export type { Destination, IncompatibleReason } from "./http.js";
+export type { Destination, IncompatibleReason, TokenSource } from "./http.js";
 export { plugin } from "./plugins/plugin.js";
 export type { PluginCapability } from "./plugins/plugin.js";
 export { loadPlugin, PluginError } from "./plugins/load.js";
@@ -26,6 +29,5 @@ export { skills, loadSkillsFromDirectory, resolveSkillsRoot, parseSkill, SkillsE
 export type { SkillsCapability, SkillsOptions, SkillDiagnostic, } from "./skills/index.js";
 export { mcp, McpError } from "./mcp/index.js";
 export type { McpCapability, McpOptions, McpServerSpec } from "./mcp/index.js";
-export { sandbox, SandboxError } from "./sandbox/index.js";
-export type { SandboxCapability, SandboxCapabilityOptions, SandboxOptions, ActionSandbox, ActionSandboxToolResult, CreateActionSandboxOptions, } from "./sandbox/index.js";
+export type { ActionSandbox, ActionSandboxToolResult, CreateActionSandboxOptions, } from "./sandbox/index.js";
 export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./sandbox/index.js";

package/dist/index.js

@@ -1,17 +1,17 @@
 // Definition authoring and wire contracts are the only harness runtime imports.
-export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, TENANT_HEADER, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
+export { hashManifest, PROTOCOL_VERSION, PROTOCOL_FEATURES, HOST_PROTOCOL, DEFINITION_SCHEMA_VERSION, PROTOCOL_HEADER, SUBJECT_HEADER, SCOPES_HEADER, TENANT_ID_PATTERN, isTenantId, newTenantId, newPrincipalId, checkCompatibility, compareVersions, ERROR_CODES, } from "@nylorun/core/compatibility";
 export { Agent, AgentBuilder } from "./builder.js";
 export { AgentBuildError, AgentLifecycleError, Loop, Chain, Switch, Parallel, Map, VerdictSchema, isVerdict, withInstructions, withoutTools, WorkflowBuildError, isBuiltWorkflow, capability, CapabilityBuilder, flow, tool, defineSchema, ToolError, } from "@nylorun/core/define";
 export { SUBJECT_SCOPES } from "@nylorun/core/contracts";
 export { AgentsClient, SessionClient, createClient } from "./client.js";
-export { connectAgents } from "./executor.js";
+export { AccessClient, PublishableKeysClient, SigningKeysClient, TokensClient, } from "./access.js";
+export { createTokenEndpoint } from "./token-endpoint.js";
+export { createActionHandler } from "./action-handler.js";
 export { resolveConnection, ConnectionError } from "./connection.js";
-export { deriveExecutorToken } from "./derived-credentials.js";
 export { RuntimeError, IncompatibleRuntimeError } from "./http.js";
 export { plugin } from "./plugins/plugin.js";
 export { loadPlugin, PluginError } from "./plugins/load.js";
 export { prepareStdioLaunch, expandPluginPlaceholders } from "./plugins/launch.js";
 export { skills, loadSkillsFromDirectory, resolveSkillsRoot, parseSkill, SkillsError, formatSkillCatalog, SKILLS_USAGE, } from "./skills/index.js";
 export { mcp, McpError } from "./mcp/index.js";
-export { sandbox, SandboxError } from "./sandbox/index.js";
 export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./sandbox/index.js";

package/dist/sandbox/client.d.ts

@@ -1,6 +1,6 @@
 /**
- * Claim-scoped sandbox client for executor actions (`ctx.sandbox`).
- * Calls `POST /v1/actions/:id/sandbox/:tool` with the live claim.
+ * Action-scoped sandbox client (`ctx.sandbox`). Calls `POST /v1/actions/:id/sandbox/:tool`
+ * over a transport whose credential is the Action's delivery token.
  */
 import { type SandboxToolName } from "@nylorun/core/define";
 import { type Transport } from "../http.js";
@@ -45,13 +45,12 @@ export type ActionSandbox = {
     }) => Promise<ActionSandboxToolResult>;
 };
 export type CreateActionSandboxOptions = {
+    /** The transport's key is the delivery token, which names the Action and its generation. */
     readonly transport: Transport;
     readonly actionId: string;
-    readonly claimId: string;
-    readonly generation: number;
     readonly signal?: AbortSignal;
 };
-/** Build `ctx.sandbox` for one claimed action. Undefined callers skip when the session has none. */
+/** Build `ctx.sandbox` for one delivered action. Callers skip it when the session has none. */
 export declare function createActionSandbox(options: CreateActionSandboxOptions): ActionSandbox;
 export declare function isActionSandboxTool(name: string): name is SandboxToolName;
 /** True when the executable declares a sandbox the Runtime can share. */

package/dist/sandbox/client.js

@@ -1,16 +1,12 @@
 /**
- * Claim-scoped sandbox client for executor actions (`ctx.sandbox`).
- * Calls `POST /v1/actions/:id/sandbox/:tool` with the live claim.
+ * Action-scoped sandbox client (`ctx.sandbox`). Calls `POST /v1/actions/:id/sandbox/:tool`
+ * over a transport whose credential is the Action's delivery token.
  */
 import { SANDBOX_TOOL_NAMES, } from "@nylorun/core/define";
 import { segment } from "../http.js";
-/** Build `ctx.sandbox` for one claimed action. Undefined callers skip when the session has none. */
+/** Build `ctx.sandbox` for one delivered action. Callers skip it when the session has none. */
 export function createActionSandbox(options) {
-    const call = (tool, input) => options.transport.json(`/v1/actions/${segment(options.actionId)}/sandbox/${tool}`, "POST", {
-        claimId: options.claimId,
-        generation: options.generation,
-        ...input,
-    }, options.signal);
+    const call = (tool, input) => options.transport.json(`/v1/actions/${segment(options.actionId)}/sandbox/${tool}`, "POST", input, options.signal);
     const sandbox = {
         bash: (input) => call("bash", input),
         read: (input) => call("read", input),

package/dist/sandbox/index.d.ts

@@ -1,4 +1,2 @@
-export { sandbox, SandboxError } from "@nylorun/core/define";
-export type { SandboxCapability, SandboxCapabilityOptions, SandboxOptions, } from "@nylorun/core/define";
 export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./client.js";
 export type { ActionSandbox, ActionSandboxToolResult, CreateActionSandboxOptions, } from "./client.js";

package/dist/sandbox/index.js

@@ -1,2 +1 @@
-export { sandbox, SandboxError } from "@nylorun/core/define";
 export { createActionSandbox, definitionDeclaresSandbox, isActionSandboxTool, } from "./client.js";

package/dist/served-definitions.d.ts

@@ -0,0 +1,20 @@
+import { type BuiltWorkflow } from "@nylorun/core/define";
+import { type AgentSource } from "./client.js";
+import type { ExecutableDefinition } from "./execute-action.js";
+/** The implementation version to register: the option, `NYLORUN_IMPLEMENTATION_VERSION`, or `dev`. */
+export declare function implementationVersionOf(options: {
+    implementationVersion?: string;
+}): string;
+/** The ids among `agents` that are saved only as part of another definition. */
+export declare function embeddedIn(agents: Map<string, ExecutableDefinition>): ReadonlySet<string>;
+/**
+ * Every definition `sources` serves, by id: the agents and workflows passed in, the agents
+ * a v2 workflow embeds, and flow agents used as tools. `owner` names the caller in errors.
+ */
+export declare function buildAgents(sources: readonly (AgentSource | BuiltWorkflow)[], owner: string): Map<string, ExecutableDefinition>;
+/**
+ * The manifest hash served for a workflow's flow actions. A run is pinned to one workflow
+ * manifest, and its stage keys may shift between deploys, so flow actions for another hash
+ * are left for whoever serves it.
+ */
+export declare function flowManifestHash(agent: ExecutableDefinition): string | undefined;