@nylorun/cli 0.12.0-beta → 0.13.0-beta

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # @nylorun/cli
 
+## 0.13.0-beta
+
+### Major Changes
+
+- cf5eb9c: **Protocol 9: the Runtime API is an OAuth 2.1 resource server for your identity provider's tokens.** Nylorun is still never the authorization server. Upgrade every package together; MIGRATION.md has the details.
+
+  - **Breaking (`@nylorun/runtime`): a refused credential is `401`, not the opaque `404`.** No `Authorization` is `401 credential_required`; an unknown key, or a token no trusted issuer signed or that fails a check, is `401 credential_invalid`. Each carries `WWW-Authenticate: Bearer` (OAuth 2.1 §5.3), naming the protected resource metadata (`resource_metadata`) on the Runtime API when the Runtime has trusted issuers; the Management API's challenge is a bare `Bearer`. `token_expired` and `issuer_unavailable` gain the challenge too. Another Tenant named, a Tenant that could not open and an unsigned capability link stay the opaque `404`.
+  - **Breaking (`@nylorun/runtime`): a request with neither `Nylorun-Protocol` nor `Authorization`** on an API route gets that route's `401` challenge instead of `426`, so a generic OAuth client learns where to sign in.
+  - `@nylorun/runtime`: a token without a route's scope still gets `403 scope_required`, now with `WWW-Authenticate: Bearer error="insufficient_scope", scope="…"`. The `Bearer` scheme is matched in any case (RFC 9110).
+  - `@nylorun/runtime`: `GET /.well-known/oauth-protected-resource` (RFC 9728) serves the resource (`NYLORUN_PUBLIC_URL`, else the request's origin), the identity file's issuers in order and their scopes, with no key or protocol; `404` without an identity file.
+  - **Breaking (`@nylorun/runtime`): the identity file drops `maxLifetime`.** The issuer sets its tokens' lifetimes; `exp` is required, `iat` no longer is. A key the file does not define, `maxLifetime` included, is ignored and logged (`identity_file_key_ignored`) instead of stopping the boot. `subject` defaults to `{sub}`, `scopes` to `{ claim: scope }` and `allowedScopes` to every token scope but `studio`.
+  - `@nylorun/core`: `PROTOCOL_VERSION` is 9 and `HOST_PROTOCOL` 4–9, with the required feature `resource-server`; `ERROR_CODES` adds `credential_required` and `credential_invalid`. `@nylorun/agents`, `@nylorun/admin` and `@nylorun/cli` send protocol 9.
+
+### Patch Changes
+
+- Pin agents to the tested release.
+- Pin admin to the tested release.
+- Updated dependencies [cf5eb9c]
+- Updated dependencies
+- Updated dependencies
+  - @nylorun/agents@0.17.0-beta
+  - @nylorun/admin@0.12.0-beta
+
+## 0.12.1-beta
+
+### Patch Changes
+
+- cb29dea: **READMEs for manifest-only agents.** Documentation only; no code changes.
+
+  - `@nylorun/agents`: the Flow agents example opens the PR with an `http()` tool stage instead of a code tool, and shows how to keep a person's approval: a flow stage cannot take `approval` yet (`flow.approval-unsupported`), so the HTTP tool goes to an agent stage with `approval: "always"`. Requests set `Nylorun-Protocol` 8. The subagents section says `ctx.state`, `ctx.agent` and `ctx.ask`/`ctx.approve` apply only to `tool({ run })` in the local engine.
+  - `@nylorun/cli`: no longer says `nylo endpoints` uses the Runtime API or replaces `nylo tenant endpoints`; it was removed with Action endpoints and exits 2.
+
+- Pin agents to the tested release.
+- Updated dependencies [cb29dea]
+  - @nylorun/agents@0.16.1-beta
+
 ## 0.12.0-beta
 
 ### Major Changes

package/README.md

@@ -28,13 +28,14 @@ credentials (below), or `NYLORUN_RUNTIME_URL` and `NYLORUN_SERVER_KEY` when the
 Project has no link. An installation serves one Tenant, so nothing selects it.
 `status`, `reset`, `access`, `configure` and `doctor` use the Management API
 with the Project's management key, or `NYLORUN_MANAGEMENT_KEY` (with
-`NYLORUN_RUNTIME_URL` when there is no link); `endpoints` uses the Runtime API
-with the application key.
+`NYLORUN_RUNTIME_URL` when there is no link); `env` prints the Runtime URL and
+the application key, for the Runtime API.
 
 Local Tenant commands (`up`, `down`, `start`, `stop`, `logs`, `studio`) exit 2
 naming `npx nylorun <command>`. `nylo tenant …` exits 2: `npx nylorun start`
-creates the project's Tenant and the link, and `nylo status|reset|endpoints`
-replace `nylo tenant status|reset|endpoints`. `nylorun dev` was removed: run
+creates the project's Tenant and the link, and `nylo status|reset` replace
+`nylo tenant status|reset`. `nylo endpoints` was removed with Action endpoints
+and exits 2. `nylorun dev` was removed: run
 `npx nylorun start` once, then the project's own `npm run dev`
 (`tsx watch src/main.ts`).
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nylorun/cli",
-  "version": "0.12.0-beta",
+  "version": "0.13.0-beta",
   "type": "module",
   "license": "Apache-2.0",
   "description": "Nylorun Runtime client: the linked installation's Tenant, its access and its model provider",
@@ -30,8 +30,8 @@
     "prepack": "npm run build"
   },
   "dependencies": {
-    "@nylorun/agents": "0.16.0-beta",
-    "@nylorun/admin": "0.11.1-beta",
+    "@nylorun/agents": "0.17.0-beta",
+    "@nylorun/admin": "0.12.0-beta",
     "@earendil-works/pi-ai": "0.99.1"
   },
   "devDependencies": {