@nylorun/runtime 0.12.0-beta → 0.14.0-beta

package/dist/tenant/signing-keys.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
+ * id), like a credential.
+ *
+ * States: `standby` (published, not used yet), `current` (signs), `previous` (verifies only),
+ * `revoked`. The first use creates `current` and `standby`. Rotating moves standby → current →
+ * previous → revoked and makes a new standby; it is refused while the key it would revoke may
+ * still verify live tokens, so a rotation never signs anyone out (`force` skips that guard).
+ *
+ * Key states are read from the database on every use, so a revocation applies at once on
+ * every node. Only imported key objects are cached: public keys by id (immutable) and the
+ * current private key.
+ */
+import { importJWK } from "jose";
+import type { PublicJwk, SigningKeyView } from "@nylorun/core/contracts";
+import type { SigningKeyRow, Tx } from "../store/types.js";
+type KeyLike = Awaited<ReturnType<typeof importJWK>>;
+export interface SigningKeysOptions {
+    tenantId: string;
+    /** The vault KEK, created on first use. Resolve it before opening a transaction. */
+    kek(): Buffer;
+}
+export interface CurrentKey {
+    readonly id: string;
+    readonly key: KeyLike;
+}
+export declare class SigningKeys {
+    private readonly options;
+    private readonly publicKeys;
+    private current;
+    constructor(options: SigningKeysOptions);
+    kek(): Buffer;
+    private aad;
+    /** A new sealed key row in `state`. In-memory crypto only; safe inside a transaction. */
+    private create;
+    /** The current key row, creating `current` and `standby` if the Tenant has none. */
+    ensure(t: Tx, kek: Buffer): Promise<SigningKeyRow>;
+    /** The private key of `row` (the current key), imported once per key id. */
+    privateKey(row: SigningKeyRow, kek: Buffer): Promise<CurrentKey>;
+    /** The public key of `row`, imported once per key id. */
+    publicKey(row: SigningKeyRow): Promise<KeyLike>;
+    /**
+     * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
+     * with 409 while the previous key may still verify live tokens (retired less than the
+     * longest token lifetime, `maxTtlSeconds` or a delivery token's, plus a minute ago), unless
+     * `force`.
+     */
+    rotate(t: Tx, kek: Buffer, maxTtlSeconds: number, force: boolean): Promise<SigningKeyRow[]>;
+    /** Revokes a `previous` or `standby` key. The current key must be rotated first. */
+    revoke(t: Tx, id: string): Promise<SigningKeyRow>;
+}
+export declare function publicJwk(row: SigningKeyRow): PublicJwk;
+export declare function signingKeyView(row: SigningKeyRow): SigningKeyView;
+export {};

package/dist/tenant/signing-keys.js

@@ -0,0 +1,172 @@
+/**
+ * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
+ * id), like a credential.
+ *
+ * States: `standby` (published, not used yet), `current` (signs), `previous` (verifies only),
+ * `revoked`. The first use creates `current` and `standby`. Rotating moves standby → current →
+ * previous → revoked and makes a new standby; it is refused while the key it would revoke may
+ * still verify live tokens, so a rotation never signs anyone out (`force` skips that guard).
+ *
+ * Key states are read from the database on every use, so a revocation applies at once on
+ * every node. Only imported key objects are cached: public keys by id (immutable) and the
+ * current private key.
+ */
+import { exportJWK, exportPKCS8, generateKeyPair, importJWK, importPKCS8, } from "jose";
+import { newSigningKeyId, SIGNING_KEY_ID_PATTERN, } from "@nylorun/core/compatibility";
+import { DELIVERY_TOKEN_MAX_TTL_SECONDS } from "@nylorun/core/contracts";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+import { fail } from "./http.js";
+const ALG = "ES256";
+/** Grace added to the longest token lifetime before a previous key may be revoked. */
+const ROTATION_GRACE_MS = 60_000;
+export class SigningKeys {
+    options;
+    publicKeys = new Map();
+    current;
+    constructor(options) {
+        this.options = options;
+    }
+    kek() {
+        return this.options.kek();
+    }
+    aad(id) {
+        return Buffer.from(`nylorun.signing-key:${this.options.tenantId}:${id}`);
+    }
+    /** A new sealed key row in `state`. In-memory crypto only; safe inside a transaction. */
+    async create(kek, state, now) {
+        const id = newSigningKeyId();
+        const pair = await generateKeyPair(ALG, { extractable: true });
+        const jwk = await exportJWK(pair.publicKey);
+        const pkcs8 = await exportPKCS8(pair.privateKey);
+        const sealed = encryptSecret(kek, this.aad(id), Buffer.from(pkcs8, "utf8"));
+        return {
+            id,
+            state,
+            alg: ALG,
+            publicJwk: JSON.stringify({
+                kty: jwk.kty,
+                crv: jwk.crv,
+                x: jwk.x,
+                y: jwk.y,
+            }),
+            createdAt: now,
+            activatedAt: state === "current" ? now : null,
+            retiredAt: null,
+            revokedAt: null,
+            kekId: sealed.kekId,
+            nonce: sealed.nonce,
+            ciphertext: sealed.ciphertext,
+            wrappedDek: sealed.wrappedDek,
+        };
+    }
+    /** The current key row, creating `current` and `standby` if the Tenant has none. */
+    async ensure(t, kek) {
+        let live = await t.signingKeys(["standby", "current"]);
+        if (live.length < 2) {
+            // Concurrent first uses would both create keys: lock, then read what the winner made.
+            await t.lockSigningKeys();
+            live = await t.signingKeys(["standby", "current"]);
+        }
+        const now = new Date().toISOString();
+        let current = live.find((row) => row.state === "current");
+        if (!current) {
+            const standby = live.find((row) => row.state === "standby");
+            if (standby) {
+                await t.setSigningKeyState(standby.id, "standby", "current", now);
+                current = { ...standby, state: "current", activatedAt: now };
+            }
+            else {
+                current = await this.create(kek, "current", now);
+                await t.insertSigningKey(current);
+            }
+        }
+        if (!live.some((row) => row.state === "standby" && row.id !== current.id))
+            await t.insertSigningKey(await this.create(kek, "standby", now));
+        return current;
+    }
+    /** The private key of `row` (the current key), imported once per key id. */
+    async privateKey(row, kek) {
+        if (this.current?.id === row.id)
+            return this.current;
+        const pkcs8 = decryptSecret(kek, this.aad(row.id), Buffer.from(row.nonce), Buffer.from(row.ciphertext), Buffer.from(row.wrappedDek), row.kekId).toString("utf8");
+        const key = await importPKCS8(pkcs8, ALG);
+        this.current = { id: row.id, key };
+        return this.current;
+    }
+    /** The public key of `row`, imported once per key id. */
+    async publicKey(row) {
+        const cached = this.publicKeys.get(row.id);
+        if (cached)
+            return cached;
+        const key = await importJWK({ ...JSON.parse(row.publicJwk), alg: ALG }, ALG);
+        this.publicKeys.set(row.id, key);
+        return key;
+    }
+    /**
+     * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
+     * with 409 while the previous key may still verify live tokens (retired less than the
+     * longest token lifetime, `maxTtlSeconds` or a delivery token's, plus a minute ago), unless
+     * `force`.
+     */
+    async rotate(t, kek, maxTtlSeconds, force) {
+        await t.lockSigningKeys();
+        await this.ensure(t, kek);
+        const now = new Date();
+        const at = now.toISOString();
+        const [previous] = await t.signingKeys(["previous"]);
+        if (previous && !force) {
+            const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
+            // Delivery tokens may outlive the policy's subject tokens.
+            const longest = Math.max(maxTtlSeconds, DELIVERY_TOKEN_MAX_TTL_SECONDS);
+            const until = retired + longest * 1000 + ROTATION_GRACE_MS;
+            if (until > now.getTime())
+                fail(409, "The previous key may still verify live tokens", {
+                    code: "request_rejected",
+                    details: { retryAfterSeconds: Math.ceil((until - now.getTime()) / 1000) },
+                });
+        }
+        if (previous)
+            await t.setSigningKeyState(previous.id, "previous", "revoked", at);
+        const [current] = await t.signingKeys(["current"]);
+        const [standby] = await t.signingKeys(["standby"]);
+        if (current)
+            await t.setSigningKeyState(current.id, "current", "previous", at);
+        if (standby)
+            await t.setSigningKeyState(standby.id, "standby", "current", at);
+        else
+            await t.insertSigningKey(await this.create(kek, "current", at));
+        await t.insertSigningKey(await this.create(kek, "standby", at));
+        return t.signingKeys();
+    }
+    /** Revokes a `previous` or `standby` key. The current key must be rotated first. */
+    async revoke(t, id) {
+        const row = SIGNING_KEY_ID_PATTERN.test(id)
+            ? await t.signingKey(id)
+            : undefined;
+        if (!row)
+            return fail(404, "Signing key not found");
+        if (row.state === "revoked")
+            return row;
+        if (row.state === "current")
+            return fail(409, "Rotate before revoking the current key");
+        const at = new Date().toISOString();
+        await t.setSigningKeyState(row.id, row.state, "revoked", at);
+        return { ...row, state: "revoked", revokedAt: at };
+    }
+}
+export function publicJwk(row) {
+    return { ...JSON.parse(row.publicJwk), kid: row.id, alg: ALG, use: "sig" };
+}
+export function signingKeyView(row) {
+    return {
+        id: row.id,
+        state: row.state,
+        alg: row.alg,
+        publicKey: publicJwk(row),
+        createdAt: row.createdAt,
+        activatedAt: row.activatedAt,
+        retiredAt: row.retiredAt,
+        revokedAt: row.revokedAt,
+    };
+}

package/dist/tenant/slim.d.ts

@@ -0,0 +1,8 @@
+import type { Tx } from "../store/types.js";
+/**
+ * Slim the completed model effects of a turn that ended (Model Calls §9): drop the prompt
+ * and the answer, which the transcript already holds, and keep the identity and status.
+ * Replay only ever reads the effects of a running segment. Tool, flow and uncertain rows
+ * are never touched: completed actions return their receipts, and status lists uncertain work.
+ */
+export declare function slimModelEffects(t: Tx, sessionId: string, turnId: string | null): Promise<void>;

package/dist/tenant/slim.js

@@ -0,0 +1,21 @@
+/**
+ * Slim the completed model effects of a turn that ended (Model Calls §9): drop the prompt
+ * and the answer, which the transcript already holds, and keep the identity and status.
+ * Replay only ever reads the effects of a running segment. Tool, flow and uncertain rows
+ * are never touched: completed actions return their receipts, and status lists uncertain work.
+ */
+export async function slimModelEffects(t, sessionId, turnId) {
+    if (!turnId)
+        return;
+    for (const effect of await t.effectsForTurn(sessionId, turnId, ["completed"])) {
+        if (effect.request?.kind !== "model" || effect.slimmed)
+            continue;
+        const { input: _input, ...request } = effect.request;
+        await t.put("effects", request.effectId, {
+            ...effect,
+            request,
+            outcome: {},
+            slimmed: true,
+        });
+    }
+}

package/dist/tenant/status.d.ts

@@ -1,6 +1,5 @@
 import type { SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
-import type { ExecutorRegistry } from "../core/executors.js";
 import type { VaultService } from "../vault/service.js";
 import type { SandboxManager } from "../sandbox/manager.js";
 import type { TenantConfig } from "./types.js";
@@ -11,12 +10,10 @@ export interface TenantStatusContext {
     envelope: TenantEnvelope;
     config: TenantConfig;
     store: SessionStore;
-    registry: ExecutorRegistry;
     vault: VaultService;
     sandbox: SandboxManager;
     closing: boolean;
     modelConfigured: boolean;
-    executorStreams: Map<string, Set<unknown>>;
     /**
      * This Tenant's execution invocations that need an operator (`TenantExecution`). Absent
      * when the execution cannot report them.

package/dist/tenant/status.js

@@ -1,4 +1,5 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
+import { SANDBOX_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
 /** How long status waits for the execution to list stuck invocations. */
 const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
@@ -54,17 +55,13 @@ export async function buildTenantStatus(ctx) {
     const definitionIds = new Set(definitions
         .map((d) => d.manifest?.id)
         .filter((id) => typeof id === "string"));
-    const executorIds = new Set(ctx.registry.list().map((e) => e.agentId));
-    const agentIds = new Set([...definitionIds, ...executorIds]);
-    const agents = [...agentIds].sort().map((agentId) => {
-        const record = ctx.registry.get(agentId);
-        return {
-            agentId,
-            registered: definitionIds.has(agentId),
-            connected: !!record &&
-                (ctx.executorStreams.get(record.tokenHash)?.size ?? 0) > 0,
-        };
-    });
+    const endpointIds = new Set((await ctx.store.tx((t) => t.listEndpoints())).map((e) => e.agentId));
+    const agentIds = new Set([...definitionIds, ...endpointIds]);
+    const agents = [...agentIds].sort().map((agentId) => ({
+        agentId,
+        registered: definitionIds.has(agentId),
+        endpoint: endpointIds.has(agentId),
+    }));
     return {
         tenant: ctx.envelope,
         path: ctx.config.paths.root,
@@ -72,7 +69,7 @@ export async function buildTenantStatus(ctx) {
             store: health.schemaVersion > 0,
             scheduler: !ctx.closing,
             model: ctx.modelConfigured || modelView.configured,
-            executors: true,
+            endpoints: true,
             schema: health.ok,
         },
         model: modelView,
@@ -108,6 +105,16 @@ export async function seedTenantConfig(ctx, body) {
         });
         (inserted ? applied : kept).push("sandbox.backend");
     }
+    const sandboxConfig = body.sandbox?.config;
+    if (sandboxConfig) {
+        const inserted = await ctx.store.tx(async (t) => {
+            if ((await t.getSetting(SANDBOX_CONFIG_SETTING)) !== undefined)
+                return false;
+            await writeSandboxConfig(t, sandboxConfig);
+            return true;
+        });
+        (inserted ? applied : kept).push(SANDBOX_CONFIG_SETTING);
+    }
     if (body.fixtureModel) {
         const inserted = await ctx.store.tx((t) => seedFixtureModel(t));
         (inserted ? applied : kept).push(FIXTURE_MODEL_SETTING);

package/dist/tenant/streams.d.ts

@@ -1,5 +1,31 @@
+/**
+ * The Durable Streams seam of an open Tenant (Durable Streams §7–§9), wired by one
+ * `wireStreams(ctx, …)` call in the composition root:
+ *
+ * - **Record.** Every event is written to the record in its transaction (`Tx.event`). The
+ *   stream relay (`streams/relay/`) feeds the Tenant's basin from it. On a Host with S2, one
+ *   process-wide relay reads every Tenant's record over logical replication (`host/main.ts`);
+ *   otherwise (tests, a Host without S2) this module runs a relay of the Tenant's own commits,
+ *   which reconciles the record with the streams when it starts.
+ * - **Basin generations.** The Tenant's session streams live in its current basin generation
+ *   (`streams/basin.ts`). A reset moves it to the next one (`tenantReset`): the old basin gets
+ *   a `sessions.reset` signal, every process moves its readers, and the old basin is deleted
+ *   after a grace period (again when the Tenant opens, until it is gone).
+ * - **Basin.** The current basin is created with the Tenant (`createTenantStreams`) and
+ *   checked when it opens. A missing basin (S2 down at creation, a crash in between) is
+ *   repaired on first use: a failed `ensureTenant` retries in the background with backoff,
+ *   and `streamsStatus` reports the basin's state.
+ * - **Readers.** History and session SSE read the session's stream
+ *   (`tenant/session-streams.ts`). This module runs one `tenant/control` reader per Tenant per
+ *   process, on the current basin, which calls `ctx.abortLocal` for each `session.cancel`,
+ *   checks the session streams for each `sessions.reset`, and ends a subject's streams for
+ *   each `subject.revoked`.
+ *
+ * The caller passes the streams: the Host's S2 streams, or `MemoryStreams` for tests and a
+ * local development Host (not durable).
+ */
 import type { SessionStore } from "../store/types.js";
-import { type Relay } from "../streams/relay.js";
+import { type StreamRelay, type StreamRelayStatus } from "../streams/relay/core.js";
 import { type DurableStreams } from "../streams/types.js";
 import type { TenantContext } from "./context.js";
 export interface WireStreamsOptions {
@@ -8,10 +34,15 @@ export interface WireStreamsOptions {
     streams: DurableStreams;
     /** Close `streams` with the wiring (streams created for this Tenant alone). */
     ownsStreams?: boolean;
-    /** An existing relay to use instead of creating one; the caller closes it. */
-    relay?: Relay;
+    /**
+     * The Host runs the stream relay for every Tenant (logical replication). Otherwise the
+     * Tenant relays its own commits.
+     */
+    hostRelay?: boolean;
+    /** How long a retired basin is kept for readers still on it. Default 60 s. */
+    retireGraceMs?: number;
 }
-/** The state of the Tenant's basin as this process last saw it. */
+/** The state of the Tenant's current basin as this process last saw it. */
 export interface BasinStatus {
     /** `ensureTenant` succeeded and no append has failed since. */
     ready: boolean;
@@ -20,41 +51,27 @@ export interface BasinStatus {
     /** The last failure's message, cleared once the basin is ready. */
     lastError: string | null;
 }
-/** What one `collectSessionStreams` pass did. */
-export interface CollectResult {
-    /** Abandoned session streams deleted. */
-    deleted: number;
-    /** Session streams of existing sessions, kept. */
-    kept: number;
-    /** Deletions that failed; the collection stays pending. */
-    failed: number;
-}
-/** The handles `wireStreams` returns (also kept on `ctx.live.wiring`). */
+/** The handles `wireStreams` returns (also kept on `ctx.sessionStreams.wiring`). */
 export interface StreamsWiring {
     readonly streams: DurableStreams;
-    readonly relay: Relay;
-    /** The basin's state (`streamsStatus`). */
+    /** The Tenant's own relay; undefined when the Host relays. */
+    readonly relay: StreamRelay | undefined;
+    /** The current basin's state (`streamsStatus`). */
     basin(): BasinStatus;
-    /** Appends leftover outbox rows, at most `limit`; resolves with the number relayed. */
-    drain(limit?: number): Promise<number>;
-    /**
-     * Deletes abandoned session streams when a collection is pending; undefined when none was.
-     * One pass at a time.
-     */
-    collect(): Promise<CollectResult | undefined>;
-    /** Stops the readers, waits for in-flight relays, and closes what `wireStreams` created. */
+    /** Moves this process's readers and control reader to basin generation `generation`. */
+    moveTo(generation: number): void;
+    /** Deletes the basins of retired generations after the grace period. */
+    retire(generations: readonly number[]): void;
+    /** Stops the readers and the relay, and closes what `wireStreams` created. */
     close(): Promise<void>;
 }
-/** The Tenant setting that holds a pending collection's token ("" when none is pending). */
-export declare const COLLECT_SETTING = "streams.collect";
 /**
- * Wires the Tenant to Durable Streams: checks the basin, creates the relay (unless given),
- * starts the work and control readers, and records the handles on `ctx.live.wiring`. Call it
- * once, after `ctx` is built and before the Tenant serves requests.
+ * Wires the Tenant to Durable Streams: reads its basin generation, checks the basin, starts
+ * the Tenant's relay (unless the Host relays), the control reader and the retired basins'
+ * deletion, and records the handles on `ctx.sessionStreams.wiring`. Call it once, after
+ * `ctx` is built and before the Tenant serves requests.
  */
 export declare function wireStreams(ctx: TenantContext, options: WireStreamsOptions): Promise<StreamsWiring>;
-/** The Tenant sweep's outbox recovery: appends leftover rows, at most `limit`. */
-export declare function drainOutbox(ctx: TenantContext, limit?: number): Promise<number>;
 /**
  * Appends `session.cancel` for `sessionId` to `tenant/control`, so the process running its
  * advance aborts it. Call it from `t.afterCommit` after a cancel commits. A lost signal costs
@@ -63,49 +80,25 @@ export declare function drainOutbox(ctx: TenantContext, limit?: number): Promise
  */
 export declare function signalSessionCancel(ctx: TenantContext, sessionId: string): void;
 /**
- * Before a reset that deletes sessions: records a pending collection of their streams in the
- * Tenant settings, so it is retried by the sweep even if this process stops before it runs.
- */
-export declare function requestStreamCollection(ctx: TenantContext): Promise<void>;
-/**
- * After a reset deleted sessions: tells every process with the Tenant open to check its
- * session feeds (`sessions.reset`), and deletes the abandoned streams now, best effort.
- * Failures are logged; the sweep retries the collection.
- */
-export declare function sessionStreamsAbandoned(ctx: TenantContext): void;
-/**
- * Deletes the Tenant's session streams that no session uses any more: streams of deleted
- * sessions and of earlier incarnations. Runs only while a collection is pending
- * (`requestStreamCollection`), and clears it once every deletion succeeded, unless another
- * reset requested a new one meanwhile.
- *
- * Streams are listed before their sessions are read, so a session created meanwhile keeps
- * its stream: its row committed before the relay created the stream.
+ * After a reset deleted the Tenant's sessions and moved it to a new basin generation: tells
+ * every process with the Tenant open (`sessions.reset` on the old basin's control stream),
+ * moves this process's readers, and deletes the old basin after the grace period. Failures
+ * are logged; the periodic check and the next open finish the job.
  */
-export declare function collectSessionStreams(ctx: TenantContext, streams: DurableStreams): Promise<CollectResult | undefined>;
+export declare function tenantReset(ctx: TenantContext): Promise<void>;
 /** Tenant status of the streams seam (for `GET /v1/tenant` and the Admin API). */
 export interface StreamsStatus {
     /** The streams' service answered a probe (`probeStreams`) within the timeout. */
     reachable: boolean;
     basin: BasinStatus;
-    outbox: {
-        /** Events committed but not yet in their streams. */
-        depth: number;
-        /** Age of the oldest of them, or null when the outbox is empty. */
-        oldestAgeMs: number | null;
-    };
-    /** How far the relay is behind: the oldest unrelayed event's age, 0 when none is waiting. */
-    relayLagMs: number;
-    /** Abandoned session streams are waiting to be deleted. */
-    collectionPending: boolean;
+    /** The basin generation session streams are in. */
+    generation: number;
+    /** The Tenant's own relay; null when the Host's relay serves it. */
+    relay: StreamRelayStatus | null;
 }
-/**
- * The streams seam's status for an open Tenant: S2 reachability, the basin, outbox depth and
- * relay lag. Reads the Session Store and probes the streams (at most `probeTimeoutMs`).
- */
+/** The streams seam's status for an open Tenant: S2 reachability, the basin and the relay. */
 export declare function streamsStatus(ctx: TenantContext, options?: {
     probeTimeoutMs?: number;
-    now?: () => number;
 }): Promise<StreamsStatus>;
 /**
  * Creates a new Tenant's basin. Call it when the Tenant is created, after its schema commits;
@@ -116,8 +109,8 @@ export declare function createTenantStreams(streams: DurableStreams, tenantId: s
     attempts?: number;
 }): Promise<void>;
 /**
- * Deletes a Tenant's basin and every stream in it. Call it when the Tenant is deleted (never
- * on reset). Idempotent; retries transient failures, then throws.
+ * Deletes every basin of a Tenant and every stream in them. Call it when the Tenant is
+ * deleted. Idempotent; retries transient failures, then throws.
  */
 export declare function deleteTenantStreams(streams: DurableStreams, tenantId: string, options?: {
     attempts?: number;