@nylorun/runtime 0.13.0-beta → 0.14.0-beta

package/dist/tenant/actions.js

@@ -1,21 +1,7 @@
-/**
- * The Action service and the executor registry: discover pending Actions, claim, heartbeat,
- * claim-scoped sandbox tool calls, and executor registration, listing and removal.
- *
- * A claim or heartbeat locks the Action's session and commits in one transaction; the
- * registry is updated only after the executors table commits.
- *
- * Later waves: Wave 2 / Y reads the executor `connected` flag from the work stream instead
- * of `executorStreams`.
- */
-import { randomUUID } from "node:crypto";
-import { ActionClaimRequestSchema, ActionHeartbeatRequestSchema, } from "@nylorun/core/contracts";
-import { assertExecutorCredential, hashToken, } from "../core/executors.js";
 import { SandboxRouteError, handleActionSandboxTool, } from "../core/sandbox-routes.js";
-import { lockedSession, sandboxLookup, sessionOf, } from "./context.js";
-import { fail, readBody, requestAborted } from "./http.js";
 import { scoped } from "./auth.js";
-import { endExecutorStreams, executorConnected } from "./live.js";
+import { sandboxLookup, sessionOf } from "./context.js";
+import { fail } from "./http.js";
 /** Session and Action lookups for the sandbox route handlers. */
 export function sandboxRouteDeps(ctx) {
     return {
@@ -27,19 +13,13 @@ export function sandboxRouteDeps(ctx) {
         getAction: (id) => ctx.store.tx((t) => t.get("actions", id)),
     };
 }
-/** `GET /v1/actions`: the pending Actions of the executor's agent. */
-export async function listPendingActions(ctx, executor) {
-    return {
-        actions: await ctx.store.tx((t) => t.pendingActions(executor.agentId)),
-    };
-}
-/** `POST /v1/actions/:id/sandbox/:tool`: a claim-scoped sandbox tool call. */
-export async function actionSandboxTool(ctx, scope, actionId, toolName, request) {
+/** `POST /v1/actions/:id/sandbox/:tool`: a sandbox tool call for the Action being delivered. */
+export async function actionSandboxTool(ctx, scope, actionId, toolName, body, signal) {
     const action = (await ctx.store.tx((t) => t.get("actions", actionId))) ??
         fail(404, "Action not found");
     scoped(scope, action);
     try {
-        return await handleActionSandboxTool(sandboxRouteDeps(ctx), actionId, toolName, await readBody(request), requestAborted(request));
+        return await handleActionSandboxTool(sandboxRouteDeps(ctx), actionId, toolName, await body(), signal, { generation: scope.generation });
     }
     catch (error) {
         if (error instanceof SandboxRouteError)
@@ -47,145 +27,3 @@ export async function actionSandboxTool(ctx, scope, actionId, toolName, request)
         throw error;
     }
 }
-/** `POST /v1/actions/:id/claim` and `/heartbeat`; anything else under the Action is a 404. */
-export function updateAction(ctx, scope, actionId, method, operation, body) {
-    return ctx.store.tx(async (t) => {
-        const found = (await t.get("actions", actionId)) ??
-            fail(404, "Action not found");
-        scoped(scope, found);
-        const s = await lockedSession(t, found.sessionId);
-        // Read again under the session lock.
-        const action = (await t.get("actions", actionId)) ??
-            fail(404, "Action not found");
-        if (method === "POST" && operation === "claim") {
-            ActionClaimRequestSchema.parse(body);
-            if (action.status !== "pending" ||
-                s.status === "cancelled" ||
-                s.activeTurnId !== action.turnId)
-                fail(409, "Action unavailable");
-            action.status = "claimed";
-            action.generation++;
-            action.claimId = randomUUID();
-            action.leaseExpiresAt = new Date(Date.now() + (ctx.config.leaseMs ?? 30000)).toISOString();
-            await t.put("actions", actionId, action);
-            await t.event(action.sessionId, action.turnId, "action.claimed", {
-                actionId,
-                generation: action.generation,
-                ...(action.agent ? { agent: action.agent } : {}),
-            });
-            return {
-                action,
-                claimId: action.claimId,
-                generation: action.generation,
-                leaseExpiresAt: action.leaseExpiresAt,
-            };
-        }
-        if (method === "POST" && operation === "heartbeat") {
-            const beat = ActionHeartbeatRequestSchema.parse(body);
-            if (s.activeTurnId !== action.turnId ||
-                action.status !== "claimed" ||
-                action.claimId !== beat.claimId ||
-                action.generation !== beat.generation ||
-                Date.parse(action.leaseExpiresAt) <= Date.now())
-                fail(409, "Stale or expired claim");
-            action.leaseExpiresAt = new Date(Date.now() + (ctx.config.leaseMs ?? 30000)).toISOString();
-            await t.put("actions", actionId, action);
-            return { leaseExpiresAt: action.leaseExpiresAt };
-        }
-        return fail(404, "Route not found");
-    });
-}
-/** `GET /v1/executors`. */
-export function listExecutors(ctx) {
-    return {
-        executors: ctx.registry.list().map((e) => ({
-            agentId: e.agentId,
-            implementationVersion: e.implementationVersion,
-            ...(e.manifestHash === undefined ? {} : { manifestHash: e.manifestHash }),
-            connected: executorConnected(ctx.live, e.tokenHash),
-            updatedAt: e.updatedAt,
-        })),
-    };
-}
-/** `PUT /v1/executors`: persist the batch, then update the registry and end rotated streams. */
-export async function registerExecutors(ctx, principalId, body) {
-    const { store, registry } = ctx;
-    // Credential rules are shared with startup validation, which throws plainly; on the
-    // wire a rejected registration is a bad request, not a server fault.
-    const applicationHashes = await store.tx((t) => t.applicationTokenHashes());
-    try {
-        for (const executor of body.executors)
-            assertExecutorCredential(executor, applicationHashes);
-    }
-    catch (error) {
-        fail(400, error instanceof Error ? error.message : String(error));
-    }
-    if (new Set(body.executors.map((e) => e.agentId)).size !==
-        body.executors.length ||
-        new Set(body.executors.map((e) => e.token)).size !== body.executors.length)
-        fail(400, "Executor registrations must be unique per agent and token");
-    const updatedAt = new Date().toISOString();
-    const records = body.executors.map((executor) => ({
-        agentId: executor.agentId,
-        implementationVersion: executor.implementationVersion,
-        ...(executor.manifestHash === undefined
-            ? {}
-            : { manifestHash: executor.manifestHash }),
-        tokenHash: hashToken(executor.token),
-        persisted: true,
-        updatedAt,
-        principalId,
-    }));
-    for (const record of records) {
-        const collision = registry.find(record.tokenHash);
-        if (collision && collision.agentId !== record.agentId)
-            fail(409, "Executor tokens must be unique");
-        // A token hash may not appear in both principals and executors (D3).
-        if (applicationHashes.includes(record.tokenHash))
-            fail(400, "Executor tokens require independent credentials and an agent id");
-    }
-    // Persist the whole batch first; the in-memory registry must never run ahead of the store.
-    await store.tx(async (t) => {
-        for (const record of records)
-            await t.putExecutor({
-                agentId: record.agentId,
-                tokenHash: record.tokenHash,
-                implementationVersion: record.implementationVersion,
-                ...(record.manifestHash === undefined
-                    ? {}
-                    : { manifestHash: record.manifestHash }),
-                principalId: record.principalId,
-                updatedAt,
-            });
-    });
-    const results = records.map((record) => {
-        const previous = registry.get(record.agentId);
-        const { rotated, previousHash } = registry.upsert(record);
-        if (rotated && previousHash)
-            endExecutorStreams(ctx.live, previousHash);
-        const replacedByDifferent = previous?.principalId !== undefined &&
-            previous.principalId !== principalId;
-        if (replacedByDifferent)
-            ctx.config.logger.warn("executor registration replaced by different application credential", {
-                agentId: record.agentId,
-                previousPrincipalId: previous.principalId,
-            });
-        return {
-            agentId: record.agentId,
-            implementationVersion: record.implementationVersion,
-            rotated,
-            ...(replacedByDifferent
-                ? { replacedBy: "different-credential" }
-                : {}),
-        };
-    });
-    return { executors: results };
-}
-/** `DELETE /v1/executors/:agentId`: forget the executor and end its streams. */
-export async function deleteExecutor(ctx, agentId) {
-    const existing = ctx.registry.get(agentId) ?? fail(404, "Executor not found");
-    await ctx.store.tx((t) => t.deleteExecutor(agentId));
-    ctx.registry.remove(agentId);
-    endExecutorStreams(ctx.live, existing.tokenHash);
-    return { agentId, deleted: true };
-}

package/dist/tenant/advance.js

@@ -35,6 +35,7 @@ import { aggregateWaits, cancelSiblingWork, isWorkflowManifest, wakeLinkedWorkfl
 import { isOwnershipLost, ownedTx } from "../store/ownership.js";
 import { linkedAgentOutput, rebaseSessionState, sessionToolsOf, turnManifestOf, } from "./session.js";
 import { prepareMcp, resolveEffect } from "./effects.js";
+import { slimModelEffects } from "./slim.js";
 import { command } from "./commands.js";
 import { usesFixtureModel } from "./model-setting.js";
 import { toolFixtureModel } from "../core/provider.js";
@@ -224,6 +225,9 @@ function startHeartbeat(ctx, lease, controller) {
         },
     };
 }
+/** Segment rollover defaults (Model Calls §10), well inside the advance deadline. */
+const ROLLOVER_STEPS = 50;
+const ROLLOVER_MS = 20 * 60_000;
 /** Runs one segment and settles it. Throws only `ownership.lost` and infrastructure errors. */
 async function runSegment(ctx, lease, started, signal) {
     const id = lease.sessionId;
@@ -258,6 +262,10 @@ async function runSegment(ctx, lease, started, signal) {
                 signal,
                 sessionTools: sessionToolsOf(current.mcpSnapshot),
                 host,
+                yieldAfter: {
+                    steps: ctx.config.rollover?.steps ?? ROLLOVER_STEPS,
+                    ms: ctx.config.rollover?.ms ?? ROLLOVER_MS,
+                },
             });
         // The engine turns an abort into a `cancelled` (agents) or `failed` (workflows) result;
         // only a user cancel may settle that, and it already did.
@@ -337,6 +345,28 @@ async function settle(ctx, lease, s, result) {
             await t.put("sessions", id, current);
             return siblings;
         }
+        if (result.status === "yielded") {
+            // The turn goes on in a new segment: same turn, next checkpoint, woken right away.
+            const finished = result.checkpoint;
+            current.state = result.result.state;
+            current.checkpoint = {
+                ...finished,
+                segment: finished.segment + 1,
+                input: { kind: "continue" },
+                state: current.state,
+            };
+            current.status = "runnable";
+            current.waits = undefined;
+            await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, finished.segment]), { checkpoint: finished, status: "yielded" });
+            await slimModelEffects(t, id, s.activeTurnId);
+            await t.put("sessions", id, current);
+            const segment = finished.segment + 1;
+            t.afterCommit(() => ctx.wake(id, {
+                reason: "rollover",
+                dedupeKey: `rollover:${s.activeTurnId}:${segment}`,
+            }));
+            return siblings;
+        }
         const flow = isWorkflowManifest(current.manifest);
         if (!flow) {
             current.state =
@@ -370,6 +400,7 @@ async function settle(ctx, lease, s, result) {
             current.activeTurnId = null;
             if (s.activeTurnId)
                 current.lastTurnId = s.activeTurnId;
+            await slimModelEffects(t, id, s.activeTurnId);
         }
         const type = `turn.${result.status}`;
         const payload = result.status === "completed"
@@ -430,6 +461,7 @@ async function settleFailure(ctx, lease, s, error) {
         current.error = error instanceof Error ? error.message : String(error);
         const payload = { message: current.error };
         await t.event(id, current.activeTurnId, "turn.failed", payload);
+        await slimModelEffects(t, id, current.activeTurnId);
         if (current.activeTurnId)
             current.lastTurnId = current.activeTurnId;
         current.activeTurnId = null;

package/dist/tenant/auth.d.ts

@@ -1,32 +1,34 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal or a registered executor; anything else is the opaque 404 (D5). An application
- * principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); `authorize` then
- * limits the request to the routes its scopes allow, decided from the route alone.
+ * principal, a subject token or a delivery token; anything else is the opaque 404 (D5).
+ * An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); a
+ * subject token names its subject itself. `authorize` limits both to the routes their scopes
+ * allow, decided from the route alone.
  */
 import type { IncomingMessage } from "node:http";
 import { type Action, type SubjectScope } from "@nylorun/core/contracts";
-import type { AuthScope, TenantContext } from "./context.js";
-export declare function authenticate(ctx: TenantContext, request: IncomingMessage): Promise<AuthScope>;
-/** What a subject needs for a route: any one of the scopes, or nothing grants it. */
-export type RouteAccess = readonly SubjectScope[] | "never";
+import type { AuthScope, SessionAccess, TenantContext } from "./context.js";
+import type { BrowserClient } from "./browser.js";
+export declare function authenticate(ctx: TenantContext, request: IncomingMessage, client?: BrowserClient): Promise<AuthScope>;
 /**
- * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
- * route that does not exist. Operator and executor routes are `never`: reset, config seed,
- * executors, actions and the sandbox tool routes.
+ * What a subject needs for a route: any one of the scopes, nothing grants it (`never`), or
+ * any caller may (`any`, public data such as the JWKS). Each route declares it
+ * (`api/http/define.ts`).
  */
-export declare function routeAccess(method: string | undefined, path: readonly string[]): RouteAccess | undefined;
+export type SubjectAccess = readonly SubjectScope[] | "never" | "any";
 /**
- * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
- * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
- * know is a 404 for a subject: new routes stay closed until they are added here. Application
- * and executor scopes pass through to the checks each route makes today.
+ * A subject, subject token or publishable key reaches a route only with one of the scopes it
+ * declares: `403 scope_required`, decided from the route alone before anything is read.
  */
-export declare function authorize(scope: AuthScope, method: string | undefined, path: readonly string[]): void;
+export declare function requireScopes(scope: AuthScope, access: SubjectAccess): void;
+export declare function accessOf(scope: AuthScope): SessionAccess | undefined;
 /** The subject whose sessions and vaults the request is limited to, if it acts for one. */
 export declare function ownerOf(scope: AuthScope): string | undefined;
 /** The application principal behind the request, acting for a subject or not. */
 export declare function requirePrincipal(scope: AuthScope): string;
-/** The executor scope must belong to the Action's agent. */
+/**
+ * The caller may act on `action`: only the delivery token minted for it. Whether its generation
+ * is still the Action's is checked by each callback.
+ */
 export declare function scoped(scope: AuthScope, action: Action): void;
 export declare function requireApplication(scope: AuthScope): string;

package/dist/tenant/auth.js

@@ -1,7 +1,11 @@
 import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
-import { parseSubjectHeaders, } from "@nylorun/core/contracts";
-import { hashToken } from "../core/executors.js";
+import { DELIVERY_TOKEN_TYPE, parseSubjectHeaders, } from "@nylorun/core/contracts";
+import { hashToken } from "../core/bearer.js";
 import { fail, failOpaque } from "./http.js";
+import { looksLikeToken, verifySubjectToken } from "./tokens.js";
+import { verifyDeliveryToken } from "./delivery-token.js";
+import { tokenType } from "./jwt.js";
+import { readPolicy } from "./access-policy.js";
 const SUBJECT_INVALID = { code: "subject_invalid" };
 /** One header's value, or `undefined`; a header sent twice is refused. */
 function singleHeader(request, name) {
@@ -14,19 +18,56 @@ function singleHeader(request, name) {
         return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
     return values[0];
 }
-export async function authenticate(ctx, request) {
+export async function authenticate(ctx, request, client) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
     if (!token || !header?.startsWith("Bearer ")) {
+        // A publishable key alone: what the policy grants `anon` (nothing by default).
+        if (client && header === undefined) {
+            const { anon } = await ctx.store.tx((t) => readPolicy(t));
+            return {
+                kind: "publishable",
+                keyId: client.keyId,
+                scopes: new Set(anon.scopes),
+                agents: anon.agents === "*" ? "*" : new Set(anon.agents),
+            };
+        }
         ctx.config.logger.warn("credential rejected", {
             reason: "missing_bearer",
         });
         return failOpaque();
     }
+    if (looksLikeToken(token) && tokenType(token) === DELIVERY_TOKEN_TYPE) {
+        // Delivery tokens come back from the application's server, never from a browser.
+        if (request.headers.origin !== undefined)
+            fail(403, "Delivery tokens are not accepted from browsers", { code: "origin_rejected" });
+        const scope = await verifyDeliveryToken(ctx, token);
+        if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
+            singleHeader(request, SCOPES_HEADER) !== undefined)
+            fail(403, "A delivery token cannot act for a subject");
+        return scope;
+    }
+    if (looksLikeToken(token)) {
+        const scope = await verifySubjectToken(ctx, token);
+        // Read only after verification, so an unknown token still sees the opaque 404.
+        if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
+            singleHeader(request, SCOPES_HEADER) !== undefined)
+            fail(403, "A subject token cannot act for another subject");
+        return scope;
+    }
+    // Application keys never come from a browser or a shipped app: refused before they are even
+    // looked up.
+    if (request.headers.origin !== undefined)
+        fail(403, "Application keys are not accepted from browsers", {
+            code: "origin_rejected",
+        });
+    if (client)
+        fail(400, "Nylorun-Key is for browser and mobile clients, not with a Tenant key", {
+            code: "invalid_request",
+        });
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
-    const executor = principal ? undefined : ctx.registry.find(tokenHash);
-    if (!principal && !executor) {
+    if (!principal) {
         ctx.config.logger.warn("credential rejected", {
             reason: "unknown_token",
         });
@@ -35,11 +76,6 @@ export async function authenticate(ctx, request) {
     // Read only after authentication, so an unknown caller sees the opaque 404 either way.
     const subject = singleHeader(request, SUBJECT_HEADER);
     const scopes = singleHeader(request, SCOPES_HEADER);
-    if (executor) {
-        if (subject !== undefined || scopes !== undefined)
-            fail(403, "An executor credential cannot act for a subject");
-        return { kind: "executor", executor };
-    }
     if (subject === undefined) {
         if (scopes !== undefined)
             fail(400, `${SCOPES_HEADER} requires ${SUBJECT_HEADER}`, SUBJECT_INVALID);
@@ -55,87 +91,17 @@ export async function authenticate(ctx, request) {
         scopes: parsed.scopes,
     };
 }
-const SESSIONS = ["sessions:own"];
-const VAULTS = ["vaults:own"];
-const SETTINGS = ["tenant:settings"];
 /**
- * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
- * route that does not exist. Operator and executor routes are `never`: reset, config seed,
- * executors, actions and the sandbox tool routes.
+ * A subject, subject token or publishable key reaches a route only with one of the scopes it
+ * declares: `403 scope_required`, decided from the route alone before anything is read.
  */
-export function routeAccess(method, path) {
-    const [v1, resource, id, sub] = path;
-    const n = path.length;
-    if (v1 !== "v1" || !resource)
-        return undefined;
-    switch (resource) {
-        case "executors":
-        case "actions":
-            return "never";
-        case "agents":
-            if (n === 2 && method === "GET")
-                return ["agents:read", "agents:write"];
-            if (n === 3 && method === "PUT")
-                return ["agents:write"];
-            return undefined;
-        case "sessions":
-            if (n === 2 && method === "GET")
-                return SESSIONS;
-            if (n === 3 && (method === "GET" || method === "PUT"))
-                return SESSIONS;
-            if (n === 4 && method === "GET" && (sub === "items" || sub === "events"))
-                return SESSIONS;
-            if (n === 4 && method === "POST" && sub === "commands")
-                return SESSIONS;
-            if (n === 5 && method === "POST" && sub === "sandbox")
-                return "never";
-            return undefined;
-        case "vaults":
-            if (n === 2)
-                return method === "GET" || method === "POST" ? VAULTS : undefined;
-            if (n === 3)
-                return method === "GET" || method === "DELETE" ? VAULTS : undefined;
-            if (sub !== "credentials")
-                return undefined;
-            if (n === 4)
-                return method === "GET" || method === "POST" ? VAULTS : undefined;
-            if (n === 5)
-                return method === "GET" || method === "POST" || method === "DELETE"
-                    ? VAULTS
-                    : undefined;
-            return undefined;
-        case "tenant":
-            if (n === 2 && method === "GET")
-                return SETTINGS;
-            if (n === 3 && id === "reset" && method === "POST")
-                return "never";
-            if (n === 4 && id === "config" && sub === "seed" && method === "PUT")
-                return "never";
-            if (n === 3 && method === "GET" && (id === "models" || id === "providers"))
-                return ["tenant:settings", "agents:write"];
-            if (n === 3 && method === "GET" && id === "sandbox")
-                return SETTINGS;
-            if (n === 3 && id === "model" && (method === "GET" || method === "PUT"))
-                return SETTINGS;
-            if (n === 4 && id === "model" && sub === "selection" && method === "PUT")
-                return SETTINGS;
-            return undefined;
-        default:
-            return undefined;
-    }
-}
-/**
- * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
- * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
- * know is a 404 for a subject: new routes stay closed until they are added here. Application
- * and executor scopes pass through to the checks each route makes today.
- */
-export function authorize(scope, method, path) {
-    if (scope.kind !== "subject")
+export function requireScopes(scope, access) {
+    if (scope.kind !== "subject" &&
+        scope.kind !== "token" &&
+        scope.kind !== "publishable")
+        return;
+    if (access === "any")
         return;
-    const access = routeAccess(method, path);
-    if (access === undefined)
-        fail(404, "Route not found");
     if (access === "never")
         fail(403, "This route is not available when acting for a subject", {
             code: "scope_required",
@@ -147,20 +113,51 @@ export function authorize(scope, method, path) {
             details: { scopes: access },
         });
 }
+export function accessOf(scope) {
+    switch (scope.kind) {
+        case "application":
+            return undefined;
+        case "subject":
+            return { owner: scope.subject };
+        case "token":
+            return {
+                owner: scope.subject,
+                ...(scope.agents === "*" ? {} : { agents: scope.agents }),
+            };
+        // A publishable key alone owns nothing: no session or vault is ever reachable.
+        case "publishable":
+        // Nor does a request with no credential, on a route that serves public data.
+        case "anonymous":
+            return fail(404, "Not found");
+        // A delivery token reaches its Action's callbacks, never a session or vault.
+        case "delivery":
+            return fail(404, "Not found");
+        default: {
+            const unknown = scope;
+            return fail(404, `Unknown credential ${String(unknown.kind)}`);
+        }
+    }
+}
 /** The subject whose sessions and vaults the request is limited to, if it acts for one. */
 export function ownerOf(scope) {
-    return scope.kind === "subject" ? scope.subject : undefined;
+    return accessOf(scope)?.owner;
 }
 /** The application principal behind the request, acting for a subject or not. */
 export function requirePrincipal(scope) {
-    if (scope.kind !== "executor")
+    if (scope.kind === "application" || scope.kind === "subject")
         return scope.principalId;
     return fail(403, "Application credential required");
 }
-/** The executor scope must belong to the Action's agent. */
+/**
+ * The caller may act on `action`: only the delivery token minted for it. Whether its generation
+ * is still the Action's is checked by each callback.
+ */
 export function scoped(scope, action) {
-    if (scope.kind !== "executor" || scope.executor.agentId !== action.agentId)
-        fail(403, "Executor scope does not authorize this action");
+    if (scope.kind === "delivery" &&
+        scope.actionId === action.actionId &&
+        scope.agentId === action.agentId)
+        return;
+    fail(403, "This delivery token is for another Action");
 }
 export function requireApplication(scope) {
     if (scope.kind === "application")

package/dist/tenant/browser.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Which client app a request comes from (Host feature `browser-access`), decided before the
+ * bearer is looked at. `Nylorun-Key` names a publishable key of this Tenant; an `Origin` must
+ * be on that key's allowlist, and only then does the response carry CORS headers. The
+ * allowlist protects browsers from other sites' pages; it is not authentication, since a
+ * non-browser can send any `Origin`: tokens authorize.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { TenantContext } from "./context.js";
+/** The client app of a request: its publishable key, and the origin when from a browser. */
+export interface BrowserClient {
+    readonly keyId: string;
+    readonly origin?: string;
+}
+export declare function identifyClient(ctx: TenantContext, request: IncomingMessage, response: ServerResponse): Promise<BrowserClient | undefined>;

package/dist/tenant/browser.js

@@ -0,0 +1,39 @@
+import { PUBLISHABLE_KEY_HEADER } from "@nylorun/core/compatibility";
+import { originAllowed } from "@nylorun/core/contracts";
+import { browserOrigin, setCorsHeaders } from "../host/cors.js";
+import { fail, failOpaque } from "./http.js";
+function single(request, name) {
+    const raw = request.headers[name.toLowerCase()];
+    return Array.isArray(raw) ? raw[0] : raw;
+}
+export async function identifyClient(ctx, request, response) {
+    const key = single(request, PUBLISHABLE_KEY_HEADER);
+    const hasOrigin = request.headers.origin !== undefined;
+    if (key === undefined) {
+        if (hasOrigin)
+            fail(403, `Browser requests need ${PUBLISHABLE_KEY_HEADER}`, {
+                code: "origin_rejected",
+            });
+        return undefined;
+    }
+    const row = await ctx.store.tx((t) => t.publishableKeyByKey(key));
+    if (!row || row.revokedAt !== null) {
+        ctx.config.logger.warn("credential rejected", {
+            reason: "publishable_key_rejected",
+        });
+        return failOpaque();
+    }
+    if (!hasOrigin)
+        return { keyId: row.id };
+    const origin = browserOrigin(request);
+    const origins = JSON.parse(row.originsJson);
+    if (origin === undefined || !originAllowed(origins, origin)) {
+        ctx.config.logger.warn("credential rejected", {
+            reason: "origin_not_allowed",
+            keyId: row.id,
+        });
+        return failOpaque();
+    }
+    setCorsHeaders(response, origin);
+    return { keyId: row.id, origin };
+}

package/dist/tenant/commands.d.ts

@@ -1,3 +1,19 @@
-import type { SessionCommand } from "@nylorun/core/contracts";
-import { type AuthScope, type TenantContext } from "./context.js";
+import type { Action, ActionOutcome, LiveEvent, SessionCommand } from "@nylorun/core/contracts";
+import type { Tx } from "../store/types.js";
+import { type AuthScope, type Session, type TenantContext } from "./context.js";
+/** `outcome`, or a failed one when a tool's output does not match its stored output schema. */
+export declare function acceptedOutcome(action: Action, outcome: ActionOutcome): ActionOutcome;
 export declare function command(ctx: TenantContext, id: string, input: SessionCommand, scope: AuthScope): Promise<unknown>;
+/**
+ * Completes a delivered Action with `outcome`, in the caller's transaction, which
+ * holds the lock of the Action's session `s`: the Action and its effect, the
+ * `action.completed` event (and `loop.verified` or `loop.decided`), the wake that resumes the
+ * turn, and queued workflow effects. The Action deliverer and the background-result callback
+ * both record outcomes here. It sets `s.status`; the caller writes `s`.
+ */
+export declare function recordActionOutcome(t: Tx, ctx: TenantContext, s: Session, action: Action, received: ActionOutcome, options?: {
+    requestId?: string;
+}): Promise<{
+    event: LiveEvent;
+    receipt: Record<string, unknown>;
+}>;