@nylorun/runtime 0.13.0-beta → 0.14.0-beta

package/dist/tenant/sessions.js

@@ -7,9 +7,12 @@ import { DefinitionDocumentSchema, } from "@nylorun/core/contracts";
 import { hashManifest } from "@nylorun/core/compatibility";
 import { aggregateWaits, isWorkflowManifest } from "../core/flow-host.js";
 import { canonical } from "../store/canonical.js";
-import { newStreamIncarnation } from "../streams/types.js";
 import { validateSandboxAttach } from "../core/sandbox-routes.js";
-import { sandboxLookup } from "./context.js";
+import { resolveSandbox } from "../sandbox/resolve.js";
+import { withSandboxCapability } from "../sandbox/session-sandbox.js";
+import { declaredSandboxes, sandboxSpecOf, sessionSandboxSpec, } from "../sandbox/share.js";
+import { effectiveSandboxConfig, readSandboxConfig } from "../sandbox/tenant-config.js";
+import { sandboxLookup, } from "./context.js";
 import { fail } from "./http.js";
 /** A session's creation identity: everything but the request id and vault attachments. */
 const sessionIdentity = (value) => {
@@ -27,10 +30,31 @@ export async function listDefinitions(ctx) {
         })),
     };
 }
+/**
+ * The agents a subject token or publishable key may see: id, name and description only, never
+ * instructions, tools or MCP servers, and only the agents allowed.
+ */
+export async function listAgentsPublic(ctx, agents) {
+    const definitions = await ctx.store.tx((t) => t.listDefinitions());
+    return {
+        agents: definitions
+            .filter((d) => agents === "*" || agents.has(d.manifest.id))
+            .map((d) => ({
+            agentId: d.manifest.id,
+            ...(typeof d.manifest.name === "string" ? { name: d.manifest.name } : {}),
+            ...(typeof d.manifest.description === "string"
+                ? { description: d.manifest.description }
+                : {}),
+        })),
+    };
+}
 export async function putDefinition(ctx, agentId, body) {
     if (body.manifest.id !== agentId)
         fail(400, "Agent id mismatch");
     DefinitionDocumentSchema.parse(body.manifest);
+    const declared = declaredSandboxes(body.manifest);
+    if (declared.length > 0)
+        fail(400, `${declared.join(", ")} declares a sandbox. Agents no longer declare one: remove .sandbox() and open the session with it, createSession({ sandbox: { image, network: { allow }, resources } }), or set the Tenant's default sandbox. See MIGRATION.md.`);
     const definition = {
         ...body,
         manifestHash: hashManifest(body.manifest),
@@ -42,14 +66,20 @@ export async function putDefinition(ctx, agentId, body) {
         implementationVersion: body.implementationVersion,
     };
 }
-/** `owner`, when the request acts for a subject, limits the list to that subject's sessions. */
-export async function listSessions(ctx, agentId, owner) {
+/**
+ * `access`, when the request acts for a person, limits the list to that person's sessions of
+ * the agents they may use.
+ */
+export async function listSessions(ctx, agentId, access) {
     const sessions = await ctx.store.tx((t) => t.listSessions({
         ...(agentId === null ? {} : { agentId }),
-        ...(owner === undefined ? {} : { ownerUserId: owner }),
+        ...(access === undefined ? {} : { ownerUserId: access.owner }),
     }));
+    const allowed = access?.agents;
     return {
-        sessions: sessions.map((s) => ({
+        sessions: sessions
+            .filter((s) => allowed === undefined || allowed.has(s.agentId))
+            .map((s) => ({
             id: s.id,
             agentId: s.agentId,
             ownerUserId: s.ownerUserId,
@@ -63,24 +93,33 @@ export async function listSessions(ctx, agentId, owner) {
  * the request acts for a subject, must be the session's owner: another owner's session id is
  * the 404 of a missing one (not the 409 of a mismatch), and so are another owner's vaults and
  * sandboxes.
+ *
+ * The session's sandbox is decided here and fixed for its life (§5 of Sandboxes v3): shared
+ * with `{ session }`, none with `false`, inline, or the Tenant default when omitted. A definition
+ * that declares its own sandbox (`.sandbox()`) keeps it and takes no sandbox request.
  */
-export function putSession(ctx, id, body, owner) {
+export async function putSession(ctx, id, body, access, options = {}) {
     const vaultIds = body.vaultIds ?? [];
     const credentialSelections = body.credentialSelections ?? [];
-    const opaque = owner !== undefined;
-    if (opaque && body.ownerUserId !== owner)
+    const opaque = access !== undefined;
+    if (opaque && body.ownerUserId !== access.owner)
         fail(403, "ownerUserId must be the subject");
+    // An agent the subject may not use is the 404 of a missing definition.
+    if (access?.agents !== undefined && !access.agents.has(body.agentId))
+        fail(404, "Definition not found");
     return ctx.store.tx(async (t) => {
         const prior = await t.lockSession(id);
-        if (opaque && prior && prior.ownerUserId !== owner)
+        if (opaque &&
+            prior &&
+            (prior.ownerUserId !== access.owner ||
+                (access.agents !== undefined && !access.agents.has(prior.agentId))))
             fail(404, "Session not found");
-        const definition = prior === undefined || body.sandbox
-            ? (await t.get("definitions", body.agentId)) ??
-                fail(404, "Definition not found")
-            : undefined;
-        const sandboxOwnerId = body.sandbox
-            ? validateSandboxAttach(body, (definition ?? prior).manifest, await sandboxLookup(t, body.sandbox.session), { opaque })
-            : undefined;
+        if (prior && options.createOnly) {
+            if (prior.ownerUserId !== body.ownerUserId ||
+                prior.agentId !== body.agentId)
+                fail(404, "Session not found");
+            return prior;
+        }
         await ctx.vault.assertAttachment(t, body.ownerUserId, vaultIds, credentialSelections, { opaque });
         if (prior) {
             if (sessionIdentity(prior.creation) !== sessionIdentity(body))
@@ -88,18 +127,19 @@ export function putSession(ctx, id, body, owner) {
             prior.vaultIds = vaultIds;
             prior.credentialSelections = credentialSelections;
             prior.creation = body;
-            if (sandboxOwnerId !== undefined)
-                prior.sandboxOwnerId = sandboxOwnerId;
             await t.put("sessions", id, prior);
             await ctx.vault.recordAttachment(t, id, vaultIds);
             return prior;
         }
+        const definition = (await t.get("definitions", body.agentId)) ??
+            fail(404, "Definition not found");
+        const sandbox = await sessionSandbox(t, body, definition, { opaque });
         const created = {
             id,
             agentId: body.agentId,
             ownerUserId: body.ownerUserId,
-            manifest: definition.manifest,
-            manifestHash: definition.manifestHash,
+            manifest: sandbox.manifest ?? definition.manifest,
+            manifestHash: sandbox.manifestHash ?? definition.manifestHash,
             implementationVersion: definition.implementationVersion,
             info: body.info,
             status: "idle",
@@ -108,14 +148,66 @@ export function putSession(ctx, id, body, owner) {
             vaultIds,
             credentialSelections,
             pluginRoots: definition.pluginRoots ?? {},
-            ...(sandboxOwnerId !== undefined ? { sandboxOwnerId } : {}),
-            streamIncarnation: newStreamIncarnation(),
+            ...(sandbox.sandboxOwnerId !== undefined
+                ? { sandboxOwnerId: sandbox.sandboxOwnerId }
+                : {}),
+            ...(sandbox.spec !== undefined
+                ? { sandbox: sandbox.spec, sandboxSource: sandbox.source }
+                : {}),
         };
         await t.put("sessions", id, created);
         await ctx.vault.recordAttachment(t, id, vaultIds);
         return created;
     });
 }
+function isShare(value) {
+    return typeof value === "object" && value !== null && "session" in value;
+}
+/** Decide a new session's sandbox and, for an agent, the manifest that carries its tools. */
+async function sessionSandbox(t, body, definition, options) {
+    const request = body.sandbox;
+    const declared = sandboxSpecOf(definition.manifest) !== undefined;
+    if (isShare(request)) {
+        const lookup = await sandboxLookup(t, request.session);
+        const sandboxOwnerId = validateSandboxAttach(body, definition.manifest, lookup, {
+            opaque: options.opaque,
+            inherit: !declared,
+        });
+        if (declared || sandboxOwnerId === undefined)
+            return { sandboxOwnerId };
+        const spec = sessionSandboxSpec(lookup(request.session));
+        return { ...(await pin(definition, spec, "shared")), sandboxOwnerId };
+    }
+    if (declared) {
+        if (request !== undefined)
+            fail(400, `'${body.agentId}' declares its own sandbox with .sandbox(). Remove it from the agent to choose the sandbox when opening the session, or omit sandbox here.`);
+        return {};
+    }
+    const resolved = resolveSandbox({
+        request,
+        config: effectiveSandboxConfig(await readSandboxConfig(t)),
+        actingForSubject: options.opaque,
+    });
+    if (resolved.kind === "none")
+        return {};
+    if (resolved.kind === "error")
+        return fail(resolved.status, resolved.errors.join(" "));
+    return pin(definition, resolved.spec, resolved.source);
+}
+async function pin(definition, spec, source) {
+    // A workflow's manifest stays as registered: Action endpoints match workflow actions by its hash.
+    if (isWorkflowManifest(definition.manifest))
+        return { spec, source };
+    const sandboxed = withSandboxCapability(definition.manifest, spec);
+    if (!sandboxed.ok)
+        return fail(400, sandboxed.message);
+    return {
+        spec,
+        source,
+        manifest: sandboxed.manifest,
+        manifestHash: sandboxed.manifestHash,
+    };
+}
 /** The session resource returned by `GET`/`PUT /v1/sessions/:id`. */
 export async function sessionView(t, s) {
     let waits = Array.isArray(s.waits)
@@ -132,7 +224,7 @@ export async function sessionView(t, s) {
             waits = aggregated;
     }
     const actions = await t.actionsForSession(s.id, {
-        statuses: ["pending", "claimed", "uncertain"],
+        statuses: ["pending", "delivering", "uncertain"],
     });
     const uncertain = await t.effectsForSession(s.id, {
         statuses: ["uncertain"],
@@ -148,6 +240,8 @@ export async function sessionView(t, s) {
         vaultIds: s.vaultIds ?? [],
         credentialSelections: s.credentialSelections ?? [],
         sandboxOwnerId: s.sandboxOwnerId ?? null,
+        sandbox: s.sandbox ?? null,
+        ...(s.sandboxSource ? { sandboxSource: s.sandboxSource } : {}),
         mcpSnapshot: s.mcpSnapshot ?? null,
         mcpDiagnostics: s.mcpDiagnostics ?? [],
         waits,

package/dist/tenant/signing-keys.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
+ * id), like a credential.
+ *
+ * States: `standby` (published, not used yet), `current` (signs), `previous` (verifies only),
+ * `revoked`. The first use creates `current` and `standby`. Rotating moves standby → current →
+ * previous → revoked and makes a new standby; it is refused while the key it would revoke may
+ * still verify live tokens, so a rotation never signs anyone out (`force` skips that guard).
+ *
+ * Key states are read from the database on every use, so a revocation applies at once on
+ * every node. Only imported key objects are cached: public keys by id (immutable) and the
+ * current private key.
+ */
+import { importJWK } from "jose";
+import type { PublicJwk, SigningKeyView } from "@nylorun/core/contracts";
+import type { SigningKeyRow, Tx } from "../store/types.js";
+type KeyLike = Awaited<ReturnType<typeof importJWK>>;
+export interface SigningKeysOptions {
+    tenantId: string;
+    /** The vault KEK, created on first use. Resolve it before opening a transaction. */
+    kek(): Buffer;
+}
+export interface CurrentKey {
+    readonly id: string;
+    readonly key: KeyLike;
+}
+export declare class SigningKeys {
+    private readonly options;
+    private readonly publicKeys;
+    private current;
+    constructor(options: SigningKeysOptions);
+    kek(): Buffer;
+    private aad;
+    /** A new sealed key row in `state`. In-memory crypto only; safe inside a transaction. */
+    private create;
+    /** The current key row, creating `current` and `standby` if the Tenant has none. */
+    ensure(t: Tx, kek: Buffer): Promise<SigningKeyRow>;
+    /** The private key of `row` (the current key), imported once per key id. */
+    privateKey(row: SigningKeyRow, kek: Buffer): Promise<CurrentKey>;
+    /** The public key of `row`, imported once per key id. */
+    publicKey(row: SigningKeyRow): Promise<KeyLike>;
+    /**
+     * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
+     * with 409 while the previous key may still verify live tokens (retired less than the
+     * longest token lifetime, `maxTtlSeconds` or a delivery token's, plus a minute ago), unless
+     * `force`.
+     */
+    rotate(t: Tx, kek: Buffer, maxTtlSeconds: number, force: boolean): Promise<SigningKeyRow[]>;
+    /** Revokes a `previous` or `standby` key. The current key must be rotated first. */
+    revoke(t: Tx, id: string): Promise<SigningKeyRow>;
+}
+export declare function publicJwk(row: SigningKeyRow): PublicJwk;
+export declare function signingKeyView(row: SigningKeyRow): SigningKeyView;
+export {};

package/dist/tenant/signing-keys.js

@@ -0,0 +1,172 @@
+/**
+ * Tenant signing keys for subject tokens. Each key is an ES256 pair: the public JWK is stored
+ * as is, the PKCS#8 private key is sealed with the vault KEK (AAD bound to the Tenant and key
+ * id), like a credential.
+ *
+ * States: `standby` (published, not used yet), `current` (signs), `previous` (verifies only),
+ * `revoked`. The first use creates `current` and `standby`. Rotating moves standby → current →
+ * previous → revoked and makes a new standby; it is refused while the key it would revoke may
+ * still verify live tokens, so a rotation never signs anyone out (`force` skips that guard).
+ *
+ * Key states are read from the database on every use, so a revocation applies at once on
+ * every node. Only imported key objects are cached: public keys by id (immutable) and the
+ * current private key.
+ */
+import { exportJWK, exportPKCS8, generateKeyPair, importJWK, importPKCS8, } from "jose";
+import { newSigningKeyId, SIGNING_KEY_ID_PATTERN, } from "@nylorun/core/compatibility";
+import { DELIVERY_TOKEN_MAX_TTL_SECONDS } from "@nylorun/core/contracts";
+import { decryptSecret, encryptSecret } from "../vault/crypto.js";
+import { fail } from "./http.js";
+const ALG = "ES256";
+/** Grace added to the longest token lifetime before a previous key may be revoked. */
+const ROTATION_GRACE_MS = 60_000;
+export class SigningKeys {
+    options;
+    publicKeys = new Map();
+    current;
+    constructor(options) {
+        this.options = options;
+    }
+    kek() {
+        return this.options.kek();
+    }
+    aad(id) {
+        return Buffer.from(`nylorun.signing-key:${this.options.tenantId}:${id}`);
+    }
+    /** A new sealed key row in `state`. In-memory crypto only; safe inside a transaction. */
+    async create(kek, state, now) {
+        const id = newSigningKeyId();
+        const pair = await generateKeyPair(ALG, { extractable: true });
+        const jwk = await exportJWK(pair.publicKey);
+        const pkcs8 = await exportPKCS8(pair.privateKey);
+        const sealed = encryptSecret(kek, this.aad(id), Buffer.from(pkcs8, "utf8"));
+        return {
+            id,
+            state,
+            alg: ALG,
+            publicJwk: JSON.stringify({
+                kty: jwk.kty,
+                crv: jwk.crv,
+                x: jwk.x,
+                y: jwk.y,
+            }),
+            createdAt: now,
+            activatedAt: state === "current" ? now : null,
+            retiredAt: null,
+            revokedAt: null,
+            kekId: sealed.kekId,
+            nonce: sealed.nonce,
+            ciphertext: sealed.ciphertext,
+            wrappedDek: sealed.wrappedDek,
+        };
+    }
+    /** The current key row, creating `current` and `standby` if the Tenant has none. */
+    async ensure(t, kek) {
+        let live = await t.signingKeys(["standby", "current"]);
+        if (live.length < 2) {
+            // Concurrent first uses would both create keys: lock, then read what the winner made.
+            await t.lockSigningKeys();
+            live = await t.signingKeys(["standby", "current"]);
+        }
+        const now = new Date().toISOString();
+        let current = live.find((row) => row.state === "current");
+        if (!current) {
+            const standby = live.find((row) => row.state === "standby");
+            if (standby) {
+                await t.setSigningKeyState(standby.id, "standby", "current", now);
+                current = { ...standby, state: "current", activatedAt: now };
+            }
+            else {
+                current = await this.create(kek, "current", now);
+                await t.insertSigningKey(current);
+            }
+        }
+        if (!live.some((row) => row.state === "standby" && row.id !== current.id))
+            await t.insertSigningKey(await this.create(kek, "standby", now));
+        return current;
+    }
+    /** The private key of `row` (the current key), imported once per key id. */
+    async privateKey(row, kek) {
+        if (this.current?.id === row.id)
+            return this.current;
+        const pkcs8 = decryptSecret(kek, this.aad(row.id), Buffer.from(row.nonce), Buffer.from(row.ciphertext), Buffer.from(row.wrappedDek), row.kekId).toString("utf8");
+        const key = await importPKCS8(pkcs8, ALG);
+        this.current = { id: row.id, key };
+        return this.current;
+    }
+    /** The public key of `row`, imported once per key id. */
+    async publicKey(row) {
+        const cached = this.publicKeys.get(row.id);
+        if (cached)
+            return cached;
+        const key = await importJWK({ ...JSON.parse(row.publicJwk), alg: ALG }, ALG);
+        this.publicKeys.set(row.id, key);
+        return key;
+    }
+    /**
+     * Rotates: previous → revoked, current → previous, standby → current, new standby. Refused
+     * with 409 while the previous key may still verify live tokens (retired less than the
+     * longest token lifetime, `maxTtlSeconds` or a delivery token's, plus a minute ago), unless
+     * `force`.
+     */
+    async rotate(t, kek, maxTtlSeconds, force) {
+        await t.lockSigningKeys();
+        await this.ensure(t, kek);
+        const now = new Date();
+        const at = now.toISOString();
+        const [previous] = await t.signingKeys(["previous"]);
+        if (previous && !force) {
+            const retired = Date.parse(previous.retiredAt ?? previous.createdAt);
+            // Delivery tokens may outlive the policy's subject tokens.
+            const longest = Math.max(maxTtlSeconds, DELIVERY_TOKEN_MAX_TTL_SECONDS);
+            const until = retired + longest * 1000 + ROTATION_GRACE_MS;
+            if (until > now.getTime())
+                fail(409, "The previous key may still verify live tokens", {
+                    code: "request_rejected",
+                    details: { retryAfterSeconds: Math.ceil((until - now.getTime()) / 1000) },
+                });
+        }
+        if (previous)
+            await t.setSigningKeyState(previous.id, "previous", "revoked", at);
+        const [current] = await t.signingKeys(["current"]);
+        const [standby] = await t.signingKeys(["standby"]);
+        if (current)
+            await t.setSigningKeyState(current.id, "current", "previous", at);
+        if (standby)
+            await t.setSigningKeyState(standby.id, "standby", "current", at);
+        else
+            await t.insertSigningKey(await this.create(kek, "current", at));
+        await t.insertSigningKey(await this.create(kek, "standby", at));
+        return t.signingKeys();
+    }
+    /** Revokes a `previous` or `standby` key. The current key must be rotated first. */
+    async revoke(t, id) {
+        const row = SIGNING_KEY_ID_PATTERN.test(id)
+            ? await t.signingKey(id)
+            : undefined;
+        if (!row)
+            return fail(404, "Signing key not found");
+        if (row.state === "revoked")
+            return row;
+        if (row.state === "current")
+            return fail(409, "Rotate before revoking the current key");
+        const at = new Date().toISOString();
+        await t.setSigningKeyState(row.id, row.state, "revoked", at);
+        return { ...row, state: "revoked", revokedAt: at };
+    }
+}
+export function publicJwk(row) {
+    return { ...JSON.parse(row.publicJwk), kid: row.id, alg: ALG, use: "sig" };
+}
+export function signingKeyView(row) {
+    return {
+        id: row.id,
+        state: row.state,
+        alg: row.alg,
+        publicKey: publicJwk(row),
+        createdAt: row.createdAt,
+        activatedAt: row.activatedAt,
+        retiredAt: row.retiredAt,
+        revokedAt: row.revokedAt,
+    };
+}

package/dist/tenant/slim.d.ts

@@ -0,0 +1,8 @@
+import type { Tx } from "../store/types.js";
+/**
+ * Slim the completed model effects of a turn that ended (Model Calls §9): drop the prompt
+ * and the answer, which the transcript already holds, and keep the identity and status.
+ * Replay only ever reads the effects of a running segment. Tool, flow and uncertain rows
+ * are never touched: completed actions return their receipts, and status lists uncertain work.
+ */
+export declare function slimModelEffects(t: Tx, sessionId: string, turnId: string | null): Promise<void>;

package/dist/tenant/slim.js

@@ -0,0 +1,21 @@
+/**
+ * Slim the completed model effects of a turn that ended (Model Calls §9): drop the prompt
+ * and the answer, which the transcript already holds, and keep the identity and status.
+ * Replay only ever reads the effects of a running segment. Tool, flow and uncertain rows
+ * are never touched: completed actions return their receipts, and status lists uncertain work.
+ */
+export async function slimModelEffects(t, sessionId, turnId) {
+    if (!turnId)
+        return;
+    for (const effect of await t.effectsForTurn(sessionId, turnId, ["completed"])) {
+        if (effect.request?.kind !== "model" || effect.slimmed)
+            continue;
+        const { input: _input, ...request } = effect.request;
+        await t.put("effects", request.effectId, {
+            ...effect,
+            request,
+            outcome: {},
+            slimmed: true,
+        });
+    }
+}

package/dist/tenant/status.d.ts

@@ -1,6 +1,5 @@
 import type { SeedTenantConfigRequest, SeedTenantConfigResponse, TenantStatus } from "@nylorun/core/contracts";
 import type { SessionStore } from "../store/types.js";
-import type { ExecutorRegistry } from "../core/executors.js";
 import type { VaultService } from "../vault/service.js";
 import type { SandboxManager } from "../sandbox/manager.js";
 import type { TenantConfig } from "./types.js";
@@ -11,12 +10,10 @@ export interface TenantStatusContext {
     envelope: TenantEnvelope;
     config: TenantConfig;
     store: SessionStore;
-    registry: ExecutorRegistry;
     vault: VaultService;
     sandbox: SandboxManager;
     closing: boolean;
     modelConfigured: boolean;
-    executorStreams: Map<string, Set<unknown>>;
     /**
      * This Tenant's execution invocations that need an operator (`TenantExecution`). Absent
      * when the execution cannot report them.

package/dist/tenant/status.js

@@ -1,4 +1,5 @@
 import { FIXTURE_MODEL_SETTING, seedFixtureModel } from "./model-setting.js";
+import { SANDBOX_CONFIG_SETTING, writeSandboxConfig } from "../sandbox/tenant-config.js";
 /** How long status waits for the execution to list stuck invocations. */
 const STUCK_TIMEOUT_MS = 5000;
 /** `TenantStatus.execution`: paused and backing-off invocations, or why they are unknown. */
@@ -54,17 +55,13 @@ export async function buildTenantStatus(ctx) {
     const definitionIds = new Set(definitions
         .map((d) => d.manifest?.id)
         .filter((id) => typeof id === "string"));
-    const executorIds = new Set(ctx.registry.list().map((e) => e.agentId));
-    const agentIds = new Set([...definitionIds, ...executorIds]);
-    const agents = [...agentIds].sort().map((agentId) => {
-        const record = ctx.registry.get(agentId);
-        return {
-            agentId,
-            registered: definitionIds.has(agentId),
-            connected: !!record &&
-                (ctx.executorStreams.get(record.tokenHash)?.size ?? 0) > 0,
-        };
-    });
+    const endpointIds = new Set((await ctx.store.tx((t) => t.listEndpoints())).map((e) => e.agentId));
+    const agentIds = new Set([...definitionIds, ...endpointIds]);
+    const agents = [...agentIds].sort().map((agentId) => ({
+        agentId,
+        registered: definitionIds.has(agentId),
+        endpoint: endpointIds.has(agentId),
+    }));
     return {
         tenant: ctx.envelope,
         path: ctx.config.paths.root,
@@ -72,7 +69,7 @@ export async function buildTenantStatus(ctx) {
             store: health.schemaVersion > 0,
             scheduler: !ctx.closing,
             model: ctx.modelConfigured || modelView.configured,
-            executors: true,
+            endpoints: true,
             schema: health.ok,
         },
         model: modelView,
@@ -108,6 +105,16 @@ export async function seedTenantConfig(ctx, body) {
         });
         (inserted ? applied : kept).push("sandbox.backend");
     }
+    const sandboxConfig = body.sandbox?.config;
+    if (sandboxConfig) {
+        const inserted = await ctx.store.tx(async (t) => {
+            if ((await t.getSetting(SANDBOX_CONFIG_SETTING)) !== undefined)
+                return false;
+            await writeSandboxConfig(t, sandboxConfig);
+            return true;
+        });
+        (inserted ? applied : kept).push(SANDBOX_CONFIG_SETTING);
+    }
     if (body.fixtureModel) {
         const inserted = await ctx.store.tx((t) => seedFixtureModel(t));
         (inserted ? applied : kept).push(FIXTURE_MODEL_SETTING);