@nylorun/runtime 0.11.0-beta → 0.13.0-beta

package/dist/vault/service.d.ts

@@ -46,6 +46,8 @@ export declare class VaultService {
     createVault(body: CreateVaultRequest): Promise<VaultInfo>;
     listVaults(ownerUserId: string): Promise<VaultInfo[]>;
     getVault(id: string): Promise<VaultInfo>;
+    /** Another owner's vault, or the host vault, is the same 404 as a missing one. */
+    assertOwner(id: string, ownerUserId: string): Promise<void>;
     deleteVault(id: string): Promise<{
         id: string;
     }>;
@@ -56,8 +58,13 @@ export declare class VaultService {
     deleteCredential(vaultId: string, id: string): Promise<{
         id: string;
     }>;
-    /** Checks a session's vaults and selections. Run in the session PUT transaction. */
-    assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[]): Promise<void>;
+    /**
+     * Checks a session's vaults and selections. Run in the session PUT transaction. `opaque`
+     * (a request acting for a subject) reports another owner's vault as the 404 of a missing one.
+     */
+    assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: {
+        opaque?: boolean;
+    }): Promise<void>;
     /** Writes the `attach` audit row. Run in the session PUT transaction. */
     recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>;
     authorize(input: {

package/dist/vault/service.js

@@ -14,6 +14,7 @@
  * createVault(body: CreateVaultRequest): Promise<VaultInfo>
  * listVaults(ownerUserId: string): Promise<VaultInfo[]>
  * getVault(id: string): Promise<VaultInfo>
+ * assertOwner(id: string, ownerUserId: string): Promise<void>
  * deleteVault(id: string): Promise<{ id: string }>
  * createCredential(vaultId: string, body: CreateCredentialRequest): Promise<CredentialInfo>
  * listCredentials(vaultId: string): Promise<CredentialInfo[]>
@@ -22,7 +23,7 @@
  * deleteCredential(vaultId: string, id: string): Promise<{ id: string }>
  *
  * // Attachment: run inside the caller's session PUT transaction.
- * assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[]): Promise<void>
+ * assertAttachment(t: Tx, ownerUserId: string, vaultIds: readonly string[], selections: readonly CredentialSelection[], options?: { opaque?: boolean }): Promise<void>
  * recordAttachment(t: Tx, sessionId: string, vaultIds: readonly string[]): Promise<void>
  *
  * // Use: opens its own transactions; never call it inside one.
@@ -104,6 +105,14 @@ export class VaultService {
     async getVault(id) {
         return this.store.tx((t) => this.vaultInfo(t, id));
     }
+    /** Another owner's vault, or the host vault, is the same 404 as a missing one. */
+    async assertOwner(id, ownerUserId) {
+        await this.store.tx(async (t) => {
+            const row = await t.getVault(id);
+            if (!row || row.scope !== "user" || row.ownerUserId !== ownerUserId)
+                throw new VaultError(404, "Vault not found");
+        });
+    }
     async deleteVault(id) {
         return this.store.tx(async (t) => {
             await this.vaultInfo(t, id);
@@ -210,8 +219,11 @@ export class VaultService {
         });
     }
     // --- attachment (caller's transaction) --------------------------------------
-    /** Checks a session's vaults and selections. Run in the session PUT transaction. */
-    async assertAttachment(t, ownerUserId, vaultIds, selections) {
+    /**
+     * Checks a session's vaults and selections. Run in the session PUT transaction. `opaque`
+     * (a request acting for a subject) reports another owner's vault as the 404 of a missing one.
+     */
+    async assertAttachment(t, ownerUserId, vaultIds, selections, options = {}) {
         if (new Set(vaultIds).size !== vaultIds.length)
             throw new VaultError(400, "Duplicate vault id");
         if (new Set(selections.map((item) => item.serverName)).size !== selections.length)
@@ -223,7 +235,9 @@ export class VaultService {
             if (vault.scope === "host")
                 throw new VaultError(400, "Host vault cannot be attached to a session");
             if (vault.ownerUserId !== ownerUserId)
-                throw new VaultError(403, "Vault belongs to another user");
+                throw options.opaque
+                    ? new VaultError(404, "Vault not found")
+                    : new VaultError(403, "Vault belongs to another user");
         }
         for (const selection of selections) {
             const row = await t.getCredential(selection.credentialId);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const RUNTIME_VERSION = "0.11.0-beta";
+export declare const RUNTIME_VERSION = "0.13.0-beta";

package/dist/version.js

@@ -1,3 +1,3 @@
 // Kept in step with package.json by runtime/scripts/check-package.mjs, which runs in npm run check.
 // release:prepare also rewrites this when it bumps @nylorun/runtime.
-export const RUNTIME_VERSION = "0.11.0-beta";
+export const RUNTIME_VERSION = "0.13.0-beta";

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@nylorun/runtime",
-  "version": "0.11.0-beta",
+  "version": "0.13.0-beta",
   "description": "Nylorun Runtime: the agent execution Host on Postgres, Restate and S2, and model providers.",
   "type": "module",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/nylorun/harness.git",
+    "url": "git+https://github.com/nylorun/agents.git",
     "directory": "runtime"
   },
   "engines": {
@@ -58,14 +58,15 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@earendil-works/pi-ai": "0.87.0",
     "@hono/node-server": "^2.1.1",
-    "@nylorun/harness": "0.19.1-beta",
-    "@nylorun/core": "0.6.0-beta",
+    "@nylorun/harness": "0.20.0-beta",
+    "@nylorun/core": "0.8.0-beta",
     "@restatedev/restate-sdk": "1.16.9",
     "@s2-dev/streamstore": "0.27.0",
     "just-bash": "3.4.2",
     "postgres": "^3.4.9"
   },
   "devDependencies": {
+    "@ag-ui/client": "1.0.0",
     "@types/node": "^26.5.0",
     "@typescript/native": "npm:typescript@^7.0.2",
     "hono": "^4.13.8",