@nylorun/runtime 0.13.0-beta → 0.15.0-beta

package/dist/tenant/advance.js

@@ -34,7 +34,9 @@ import { runDurable, runFlowDurable, } from "@nylorun/harness/run";
 import { aggregateWaits, cancelSiblingWork, isWorkflowManifest, wakeLinkedWorkflow, } from "../core/flow-host.js";
 import { isOwnershipLost, ownedTx } from "../store/ownership.js";
 import { linkedAgentOutput, rebaseSessionState, sessionToolsOf, turnManifestOf, } from "./session.js";
-import { prepareMcp, resolveEffect } from "./effects.js";
+import { isRemoteMcpEffect, prepareMcp, recoversMcpCalls, recoversModelCalls, resolveEffect, } from "./effects.js";
+import { slimModelEffects } from "./slim.js";
+import { checkParity, foldTranscript, leanState, transcriptOf, transcriptUpdates, withTranscript, } from "./history.js";
 import { command } from "./commands.js";
 import { usesFixtureModel } from "./model-setting.js";
 import { toolFixtureModel } from "../core/provider.js";
@@ -85,6 +87,7 @@ export async function advance(ctx, id, signal) {
     else
         signal.addEventListener("abort", forward, { once: true });
     ctx.work.running.set(id, controller);
+    ctx.work.runningTurns.set(id, taken.session.activeTurnId ?? null);
     const heartbeat = startHeartbeat(ctx, lease, controller);
     let result = DONE;
     try {
@@ -110,8 +113,10 @@ export async function advance(ctx, id, signal) {
     finally {
         heartbeat.stop();
         signal.removeEventListener("abort", forward);
-        if (ctx.work.running.get(id) === controller)
+        if (ctx.work.running.get(id) === controller) {
             ctx.work.running.delete(id);
+            ctx.work.runningTurns.delete(id);
+        }
         // Best effort: a release that fails leaves a lease that simply expires.
         await ctx.store
             .tx((t) => t.releaseOwnership(id, lease.owner, lease.epoch))
@@ -146,7 +151,10 @@ async function takeOwnership(ctx, id) {
         };
         const s = await t.assertEpoch(id, taken.epoch);
         if (taken.takeover)
-            await takeOver(t, s);
+            await takeOver(t, s, {
+                recoversModelCalls: recoversModelCalls(ctx),
+                recoversMcpCalls: recoversMcpCalls(ctx),
+            });
         if (!s.checkpoint || !["running", "runnable"].includes(s.status)) {
             await t.releaseOwnership(id, lease.owner, lease.epoch);
             return { status: "idle" };
@@ -158,13 +166,20 @@ async function takeOwnership(ctx, id) {
 }
 /**
  * Takeover (§10.5 step 2, §11.4), inside the transaction that took ownership: the dead
- * owner's `invoking` effects become `uncertain` and are never invoked again. When one belongs
+ * owner's `invoking` effects become `uncertain` and are never invoked again, except model
+ * calls when the gate recovers them (P1.2) and remote MCP calls when the Tool Gate does (F4.1
+ * G3): those stay `invoking`, and the replay re-sends them. When one belongs
  * to the active turn, the session becomes `uncertain` too, with an `effect.uncertain` event.
  * Mutates and writes `s`. Returns the effect ids it marked.
  */
-export async function takeOver(t, s) {
+export async function takeOver(t, s, options = {}) {
     const marked = [];
     for (const effect of await t.invokingEffects(s.id)) {
+        // Still running at the gate, or finished there: the replay re-sends it (P1.2).
+        if (options.recoversModelCalls && effect.request.kind === "model")
+            continue;
+        if (options.recoversMcpCalls && isRemoteMcpEffect(s, effect.request))
+            continue;
         effect.status = "uncertain";
         effect.error ??= "The Worker running this effect stopped before its outcome was recorded";
         await t.put("effects", effect.request.effectId, effect);
@@ -224,6 +239,9 @@ function startHeartbeat(ctx, lease, controller) {
         },
     };
 }
+/** Segment rollover defaults (Model Calls §10), well inside the advance deadline. */
+const ROLLOVER_STEPS = 50;
+const ROLLOVER_MS = 20 * 60_000;
 /** Runs one segment and settles it. Throws only `ownership.lost` and infrastructure errors. */
 async function runSegment(ctx, lease, started, signal) {
     const id = lease.sessionId;
@@ -234,12 +252,24 @@ async function runSegment(ctx, lease, started, signal) {
         const { current, fixtureModel } = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
             if (!isWorkflowManifest(current.manifest) && current.checkpoint) {
                 rebaseSessionState(current, current.checkpoint.manifestHash);
+                await adoptStoredTranscript(t, current);
                 const cp = current.checkpoint;
                 current.checkpoint = { ...cp, state: current.state };
                 await t.put("sessions", id, current);
             }
             return { current, fixtureModel: await usesFixtureModel(t) };
         });
+        // One history (P0.3): the engine resumes from the transcript folded from the record.
+        let startTranscript = [];
+        let engineCheckpoint = current.checkpoint;
+        if (!isWorkflowManifest(current.manifest) && current.checkpoint) {
+            const cp = current.checkpoint;
+            if (cp.state) {
+                startTranscript = await foldSession(ctx, current);
+                checkParity(id, startTranscript, transcriptOf(cp.state));
+                engineCheckpoint = { ...cp, state: withTranscript(cp.state, startTranscript) };
+            }
+        }
         const segment = fixtureModel ? { model: fixture } : {};
         const host = {
             resolveEffect: (e) => resolveEffect(ctx, e, signal, lease, segment),
@@ -254,10 +284,14 @@ async function runSegment(ctx, lease, started, signal) {
             })
             : await runDurable({
                 manifest: turnManifestOf(current),
-                checkpoint: current.checkpoint,
+                checkpoint: engineCheckpoint,
                 signal,
                 sessionTools: sessionToolsOf(current.mcpSnapshot),
                 host,
+                yieldAfter: {
+                    steps: ctx.config.rollover?.steps ?? ROLLOVER_STEPS,
+                    ms: ctx.config.rollover?.ms ?? ROLLOVER_MS,
+                },
             });
         // The engine turns an abort into a `cancelled` (agents) or `failed` (workflows) result;
         // only a user cancel may settle that, and it already did.
@@ -265,8 +299,15 @@ async function runSegment(ctx, lease, started, signal) {
         if (signal.reason instanceof AdvanceDeadlineError &&
             (result.status === "cancelled" || result.status === "failed"))
             await settleFailure(ctx, lease, started, signal.reason);
-        else
-            await settle(ctx, lease, started, result);
+        else {
+            const state = !isWorkflowManifest(current.manifest) &&
+                (result.status === "yielded" || result.status === "completed" || result.status === "paused") &&
+                "result" in result
+                ? result.result?.state
+                : undefined;
+            const updates = state ? transcriptUpdates(startTranscript, transcriptOf(state)) : [];
+            await settle(ctx, lease, started, result, updates);
+        }
     }
     catch (error) {
         if (isOwnershipLost(error) || error instanceof SegmentStopped)
@@ -304,7 +345,7 @@ async function wakeWorkflowOf(ctx, t, agent, turnId, type, payload) {
         });
 }
 /** Record a segment result, then cancel failed siblings and wake a linked workflow. */
-async function settle(ctx, lease, s, result) {
+async function settle(ctx, lease, s, result, updates = []) {
     const id = lease.sessionId;
     const siblingCancelIds = await ownedTx(ctx.store, id, lease.epoch, async (t, current) => {
         const siblings = [];
@@ -337,15 +378,38 @@ async function settle(ctx, lease, s, result) {
             await t.put("sessions", id, current);
             return siblings;
         }
+        if (result.status === "yielded") {
+            // The turn goes on in a new segment: same turn, next checkpoint, woken right away.
+            const finished = result.checkpoint;
+            await recordTranscript(t, id, s.activeTurnId, current, updates);
+            current.state = leanState(result.result.state);
+            current.checkpoint = {
+                ...finished,
+                segment: finished.segment + 1,
+                input: { kind: "continue" },
+                state: current.state,
+            };
+            current.status = "runnable";
+            current.waits = undefined;
+            await slimModelEffects(t, id, s.activeTurnId);
+            await t.put("sessions", id, current);
+            const segment = finished.segment + 1;
+            t.afterCommit(() => ctx.wake(id, {
+                reason: "rollover",
+                dedupeKey: `rollover:${s.activeTurnId}:${segment}`,
+            }));
+            return siblings;
+        }
         const flow = isWorkflowManifest(current.manifest);
         if (!flow) {
+            if (result.status !== "failed")
+                await recordTranscript(t, id, s.activeTurnId, current, updates);
             current.state =
                 result.status === "failed"
                     ? current.turnStartState
-                    : result.result.state;
+                    : leanState(result.result.state);
         }
-        current.checkpoint = result.checkpoint;
-        await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, result.checkpoint.segment]), { checkpoint: result.checkpoint, status: result.status });
+        current.checkpoint = leanCheckpoint(result.checkpoint);
         current.status = result.status;
         current.waits =
             result.status === "paused" ? result.result.pending : undefined;
@@ -370,6 +434,7 @@ async function settle(ctx, lease, s, result) {
             current.activeTurnId = null;
             if (s.activeTurnId)
                 current.lastTurnId = s.activeTurnId;
+            await slimModelEffects(t, id, s.activeTurnId);
         }
         const type = `turn.${result.status}`;
         const payload = result.status === "completed"
@@ -425,11 +490,10 @@ async function settleFailure(ctx, lease, s, error) {
             return;
         current.status = "failed";
         current.state = current.turnStartState;
-        if (current.checkpoint)
-            await t.put("checkpoints", JSON.stringify([id, s.activeTurnId, current.checkpoint.segment]), { checkpoint: current.checkpoint, status: "failed" });
         current.error = error instanceof Error ? error.message : String(error);
         const payload = { message: current.error };
         await t.event(id, current.activeTurnId, "turn.failed", payload);
+        await slimModelEffects(t, id, current.activeTurnId);
         if (current.activeTurnId)
             current.lastTurnId = current.activeTurnId;
         current.activeTurnId = null;
@@ -437,3 +501,50 @@ async function settleFailure(ctx, lease, s, error) {
         await wakeWorkflowOf(ctx, t, current, s.activeTurnId, "turn.failed", payload);
     });
 }
+/** `checkpoint` with its engine state stored lean (`history.ts`). */
+function leanCheckpoint(checkpoint) {
+    const state = checkpoint?.state;
+    if (!checkpoint || !state)
+        return checkpoint;
+    return { ...checkpoint, state: leanState(state) };
+}
+/** Appends a segment's transcript edits; a snapshot moves `history.snapshot`. */
+async function recordTranscript(t, id, turnId, s, updates) {
+    for (const update of updates) {
+        const event = await t.event(id, turnId, "transcript.updated", update);
+        if (update.keep === 0)
+            s.history = { from: s.history?.from ?? event.seq, snapshot: event.seq };
+    }
+}
+/**
+ * A session written before transcripts were recorded keeps its transcript on its row: record
+ * it once (the turn's starting transcript, then the turn so far), and store the row lean.
+ */
+async function adoptStoredTranscript(t, s) {
+    if (s.history)
+        return;
+    const now = transcriptOf(s.state);
+    const start = s.activeTurnId ? transcriptOf(s.turnStartState) : now;
+    if (now.length === 0 && start.length === 0)
+        return;
+    let first;
+    const write = async (turnId, updates) => {
+        for (const update of updates) {
+            const event = await t.event(s.id, turnId, "transcript.updated", update);
+            first ??= event.seq;
+        }
+    };
+    await write(null, transcriptUpdates([], start));
+    if (s.activeTurnId)
+        await write(s.activeTurnId, transcriptUpdates(start, now));
+    s.history = { from: first ?? 0, snapshot: first ?? 0 };
+    s.state = leanState(s.state);
+    s.turnStartState = leanState(s.turnStartState);
+}
+/** The session's transcript, folded from its record from `history.from`. */
+async function foldSession(ctx, s) {
+    const rows = await ctx.store
+        .record()
+        .readRange(ctx.store.tenantId, s.id, s.history?.from ?? 0, Number.MAX_SAFE_INTEGER);
+    return foldTranscript(rows.map((row) => row.body));
+}

package/dist/tenant/auth.d.ts

@@ -1,32 +1,34 @@
 /**
  * Tenant request authentication and authorization: a bearer token resolves to an application
- * principal or a registered executor; anything else is the opaque 404 (D5). An application
- * principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); `authorize` then
- * limits the request to the routes its scopes allow, decided from the route alone.
+ * principal, a subject token or a delivery token; anything else is the opaque 404 (D5).
+ * An application principal may act for a subject (`Nylorun-Subject`, `Nylorun-Scopes`); a
+ * subject token names its subject itself. `authorize` limits both to the routes their scopes
+ * allow, decided from the route alone.
  */
 import type { IncomingMessage } from "node:http";
 import { type Action, type SubjectScope } from "@nylorun/core/contracts";
-import type { AuthScope, TenantContext } from "./context.js";
-export declare function authenticate(ctx: TenantContext, request: IncomingMessage): Promise<AuthScope>;
-/** What a subject needs for a route: any one of the scopes, or nothing grants it. */
-export type RouteAccess = readonly SubjectScope[] | "never";
+import type { AuthScope, SessionAccess, TenantContext } from "./context.js";
+import type { BrowserClient } from "./browser.js";
+export declare function authenticate(ctx: TenantContext, request: IncomingMessage, client?: BrowserClient): Promise<AuthScope>;
 /**
- * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
- * route that does not exist. Operator and executor routes are `never`: reset, config seed,
- * executors, actions and the sandbox tool routes.
+ * What a subject needs for a route: any one of the scopes, nothing grants it (`never`), or
+ * any caller may (`any`, public data such as the JWKS). Each route declares it
+ * (`api/http/define.ts`).
  */
-export declare function routeAccess(method: string | undefined, path: readonly string[]): RouteAccess | undefined;
+export type SubjectAccess = readonly SubjectScope[] | "never" | "any";
 /**
- * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
- * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
- * know is a 404 for a subject: new routes stay closed until they are added here. Application
- * and executor scopes pass through to the checks each route makes today.
+ * A subject, subject token or publishable key reaches a route only with one of the scopes it
+ * declares: `403 scope_required`, decided from the route alone before anything is read.
  */
-export declare function authorize(scope: AuthScope, method: string | undefined, path: readonly string[]): void;
+export declare function requireScopes(scope: AuthScope, access: SubjectAccess): void;
+export declare function accessOf(scope: AuthScope): SessionAccess | undefined;
 /** The subject whose sessions and vaults the request is limited to, if it acts for one. */
 export declare function ownerOf(scope: AuthScope): string | undefined;
 /** The application principal behind the request, acting for a subject or not. */
 export declare function requirePrincipal(scope: AuthScope): string;
-/** The executor scope must belong to the Action's agent. */
+/**
+ * The caller may act on `action`: only the delivery token minted for it. Whether its generation
+ * is still the Action's is checked by each callback.
+ */
 export declare function scoped(scope: AuthScope, action: Action): void;
 export declare function requireApplication(scope: AuthScope): string;

package/dist/tenant/auth.js

@@ -1,7 +1,11 @@
 import { SCOPES_HEADER, SUBJECT_HEADER, } from "@nylorun/core/compatibility";
-import { parseSubjectHeaders, } from "@nylorun/core/contracts";
-import { hashToken } from "../core/executors.js";
+import { DELIVERY_TOKEN_TYPE, parseSubjectHeaders, } from "@nylorun/core/contracts";
+import { hashToken } from "../core/bearer.js";
 import { fail, failOpaque } from "./http.js";
+import { looksLikeToken, verifySubjectToken } from "./tokens.js";
+import { verifyDeliveryToken } from "./delivery-token.js";
+import { tokenType } from "./jwt.js";
+import { readPolicy } from "./access-policy.js";
 const SUBJECT_INVALID = { code: "subject_invalid" };
 /** One header's value, or `undefined`; a header sent twice is refused. */
 function singleHeader(request, name) {
@@ -14,19 +18,56 @@ function singleHeader(request, name) {
         return fail(400, `${name} must be sent once`, SUBJECT_INVALID);
     return values[0];
 }
-export async function authenticate(ctx, request) {
+export async function authenticate(ctx, request, client) {
     const header = request.headers.authorization;
     const token = header?.startsWith("Bearer ") ? header.slice(7) : "";
     if (!token || !header?.startsWith("Bearer ")) {
+        // A publishable key alone: what the policy grants `anon` (nothing by default).
+        if (client && header === undefined) {
+            const { anon } = await ctx.store.tx((t) => readPolicy(t));
+            return {
+                kind: "publishable",
+                keyId: client.keyId,
+                scopes: new Set(anon.scopes),
+                agents: anon.agents === "*" ? "*" : new Set(anon.agents),
+            };
+        }
         ctx.config.logger.warn("credential rejected", {
             reason: "missing_bearer",
         });
         return failOpaque();
     }
+    if (looksLikeToken(token) && tokenType(token) === DELIVERY_TOKEN_TYPE) {
+        // Delivery tokens come back from the application's server, never from a browser.
+        if (request.headers.origin !== undefined)
+            fail(403, "Delivery tokens are not accepted from browsers", { code: "origin_rejected" });
+        const scope = await verifyDeliveryToken(ctx, token);
+        if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
+            singleHeader(request, SCOPES_HEADER) !== undefined)
+            fail(403, "A delivery token cannot act for a subject");
+        return scope;
+    }
+    if (looksLikeToken(token)) {
+        const scope = await verifySubjectToken(ctx, token);
+        // Read only after verification, so an unknown token still sees the opaque 404.
+        if (singleHeader(request, SUBJECT_HEADER) !== undefined ||
+            singleHeader(request, SCOPES_HEADER) !== undefined)
+            fail(403, "A subject token cannot act for another subject");
+        return scope;
+    }
+    // Application keys never come from a browser or a shipped app: refused before they are even
+    // looked up.
+    if (request.headers.origin !== undefined)
+        fail(403, "Application keys are not accepted from browsers", {
+            code: "origin_rejected",
+        });
+    if (client)
+        fail(400, "Nylorun-Key is for browser and mobile clients, not with a Tenant key", {
+            code: "invalid_request",
+        });
     const tokenHash = hashToken(token);
     const principal = await ctx.store.tx((t) => t.principalByTokenHash(tokenHash));
-    const executor = principal ? undefined : ctx.registry.find(tokenHash);
-    if (!principal && !executor) {
+    if (!principal) {
         ctx.config.logger.warn("credential rejected", {
             reason: "unknown_token",
         });
@@ -35,11 +76,6 @@ export async function authenticate(ctx, request) {
     // Read only after authentication, so an unknown caller sees the opaque 404 either way.
     const subject = singleHeader(request, SUBJECT_HEADER);
     const scopes = singleHeader(request, SCOPES_HEADER);
-    if (executor) {
-        if (subject !== undefined || scopes !== undefined)
-            fail(403, "An executor credential cannot act for a subject");
-        return { kind: "executor", executor };
-    }
     if (subject === undefined) {
         if (scopes !== undefined)
             fail(400, `${SCOPES_HEADER} requires ${SUBJECT_HEADER}`, SUBJECT_INVALID);
@@ -55,87 +91,17 @@ export async function authenticate(ctx, request) {
         scopes: parsed.scopes,
     };
 }
-const SESSIONS = ["sessions:own"];
-const VAULTS = ["vaults:own"];
-const SETTINGS = ["tenant:settings"];
 /**
- * The scopes a subject needs for `method path` (`path` starts with `v1`). `undefined` for a
- * route that does not exist. Operator and executor routes are `never`: reset, config seed,
- * executors, actions and the sandbox tool routes.
+ * A subject, subject token or publishable key reaches a route only with one of the scopes it
+ * declares: `403 scope_required`, decided from the route alone before anything is read.
  */
-export function routeAccess(method, path) {
-    const [v1, resource, id, sub] = path;
-    const n = path.length;
-    if (v1 !== "v1" || !resource)
-        return undefined;
-    switch (resource) {
-        case "executors":
-        case "actions":
-            return "never";
-        case "agents":
-            if (n === 2 && method === "GET")
-                return ["agents:read", "agents:write"];
-            if (n === 3 && method === "PUT")
-                return ["agents:write"];
-            return undefined;
-        case "sessions":
-            if (n === 2 && method === "GET")
-                return SESSIONS;
-            if (n === 3 && (method === "GET" || method === "PUT"))
-                return SESSIONS;
-            if (n === 4 && method === "GET" && (sub === "items" || sub === "events"))
-                return SESSIONS;
-            if (n === 4 && method === "POST" && sub === "commands")
-                return SESSIONS;
-            if (n === 5 && method === "POST" && sub === "sandbox")
-                return "never";
-            return undefined;
-        case "vaults":
-            if (n === 2)
-                return method === "GET" || method === "POST" ? VAULTS : undefined;
-            if (n === 3)
-                return method === "GET" || method === "DELETE" ? VAULTS : undefined;
-            if (sub !== "credentials")
-                return undefined;
-            if (n === 4)
-                return method === "GET" || method === "POST" ? VAULTS : undefined;
-            if (n === 5)
-                return method === "GET" || method === "POST" || method === "DELETE"
-                    ? VAULTS
-                    : undefined;
-            return undefined;
-        case "tenant":
-            if (n === 2 && method === "GET")
-                return SETTINGS;
-            if (n === 3 && id === "reset" && method === "POST")
-                return "never";
-            if (n === 4 && id === "config" && sub === "seed" && method === "PUT")
-                return "never";
-            if (n === 3 && method === "GET" && (id === "models" || id === "providers"))
-                return ["tenant:settings", "agents:write"];
-            if (n === 3 && method === "GET" && id === "sandbox")
-                return SETTINGS;
-            if (n === 3 && id === "model" && (method === "GET" || method === "PUT"))
-                return SETTINGS;
-            if (n === 4 && id === "model" && sub === "selection" && method === "PUT")
-                return SETTINGS;
-            return undefined;
-        default:
-            return undefined;
-    }
-}
-/**
- * Limits a subject to the routes its scopes allow. Decided from the route alone, before any
- * lookup, so a refusal reveals nothing about which resources exist. A route the table does not
- * know is a 404 for a subject: new routes stay closed until they are added here. Application
- * and executor scopes pass through to the checks each route makes today.
- */
-export function authorize(scope, method, path) {
-    if (scope.kind !== "subject")
+export function requireScopes(scope, access) {
+    if (scope.kind !== "subject" &&
+        scope.kind !== "token" &&
+        scope.kind !== "publishable")
+        return;
+    if (access === "any")
         return;
-    const access = routeAccess(method, path);
-    if (access === undefined)
-        fail(404, "Route not found");
     if (access === "never")
         fail(403, "This route is not available when acting for a subject", {
             code: "scope_required",
@@ -147,20 +113,51 @@ export function authorize(scope, method, path) {
             details: { scopes: access },
         });
 }
+export function accessOf(scope) {
+    switch (scope.kind) {
+        case "application":
+            return undefined;
+        case "subject":
+            return { owner: scope.subject };
+        case "token":
+            return {
+                owner: scope.subject,
+                ...(scope.agents === "*" ? {} : { agents: scope.agents }),
+            };
+        // A publishable key alone owns nothing: no session or vault is ever reachable.
+        case "publishable":
+        // Nor does a request with no credential, on a route that serves public data.
+        case "anonymous":
+            return fail(404, "Not found");
+        // A delivery token reaches its Action's callbacks, never a session or vault.
+        case "delivery":
+            return fail(404, "Not found");
+        default: {
+            const unknown = scope;
+            return fail(404, `Unknown credential ${String(unknown.kind)}`);
+        }
+    }
+}
 /** The subject whose sessions and vaults the request is limited to, if it acts for one. */
 export function ownerOf(scope) {
-    return scope.kind === "subject" ? scope.subject : undefined;
+    return accessOf(scope)?.owner;
 }
 /** The application principal behind the request, acting for a subject or not. */
 export function requirePrincipal(scope) {
-    if (scope.kind !== "executor")
+    if (scope.kind === "application" || scope.kind === "subject")
         return scope.principalId;
     return fail(403, "Application credential required");
 }
-/** The executor scope must belong to the Action's agent. */
+/**
+ * The caller may act on `action`: only the delivery token minted for it. Whether its generation
+ * is still the Action's is checked by each callback.
+ */
 export function scoped(scope, action) {
-    if (scope.kind !== "executor" || scope.executor.agentId !== action.agentId)
-        fail(403, "Executor scope does not authorize this action");
+    if (scope.kind === "delivery" &&
+        scope.actionId === action.actionId &&
+        scope.agentId === action.agentId)
+        return;
+    fail(403, "This delivery token is for another Action");
 }
 export function requireApplication(scope) {
     if (scope.kind === "application")

package/dist/tenant/browser.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Which client app a request comes from (Host feature `browser-access`), decided before the
+ * bearer is looked at. `Nylorun-Key` names a publishable key of this Tenant; an `Origin` must
+ * be on that key's allowlist, and only then does the response carry CORS headers. The
+ * allowlist protects browsers from other sites' pages; it is not authentication, since a
+ * non-browser can send any `Origin`: tokens authorize.
+ */
+import type { IncomingMessage, ServerResponse } from "node:http";
+import type { TenantContext } from "./context.js";
+/** The client app of a request: its publishable key, and the origin when from a browser. */
+export interface BrowserClient {
+    readonly keyId: string;
+    readonly origin?: string;
+}
+export declare function identifyClient(ctx: TenantContext, request: IncomingMessage, response: ServerResponse): Promise<BrowserClient | undefined>;

package/dist/tenant/browser.js

@@ -0,0 +1,39 @@
+import { PUBLISHABLE_KEY_HEADER } from "@nylorun/core/compatibility";
+import { originAllowed } from "@nylorun/core/contracts";
+import { browserOrigin, setCorsHeaders } from "../host/cors.js";
+import { fail, failOpaque } from "./http.js";
+function single(request, name) {
+    const raw = request.headers[name.toLowerCase()];
+    return Array.isArray(raw) ? raw[0] : raw;
+}
+export async function identifyClient(ctx, request, response) {
+    const key = single(request, PUBLISHABLE_KEY_HEADER);
+    const hasOrigin = request.headers.origin !== undefined;
+    if (key === undefined) {
+        if (hasOrigin)
+            fail(403, `Browser requests need ${PUBLISHABLE_KEY_HEADER}`, {
+                code: "origin_rejected",
+            });
+        return undefined;
+    }
+    const row = await ctx.store.tx((t) => t.publishableKeyByKey(key));
+    if (!row || row.revokedAt !== null) {
+        ctx.config.logger.warn("credential rejected", {
+            reason: "publishable_key_rejected",
+        });
+        return failOpaque();
+    }
+    if (!hasOrigin)
+        return { keyId: row.id };
+    const origin = browserOrigin(request);
+    const origins = JSON.parse(row.originsJson);
+    if (origin === undefined || !originAllowed(origins, origin)) {
+        ctx.config.logger.warn("credential rejected", {
+            reason: "origin_not_allowed",
+            keyId: row.id,
+        });
+        return failOpaque();
+    }
+    setCorsHeaders(response, origin);
+    return { keyId: row.id, origin };
+}

package/dist/tenant/cause.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Why the Host's Tenant could not be opened (tenancy.md §5). A cause is about the Tenant's
+ * own data or files (its database is newer than this Runtime, its vault key is missing, the
+ * database has an old layout): the Host fails readiness, names the cause in
+ * `/v1/admin/status` and the logs, and answers Tenant requests with the opaque 404 until it is
+ * repaired and the Host restarted. A failure outside the Tenant (Postgres unreachable) is not
+ * a cause: it is `TenantUnavailableError`, and the next request tries again.
+ */
+import type { TenantCause, TenantEnvelope } from "@nylorun/core/contracts";
+export type { TenantCause };
+/** Thrown by migrations, the Tenant bootstrap and the Tenant Runtime when the Tenant cannot open. */
+export declare class TenantOpenError extends Error {
+    readonly code: TenantCause["code"];
+    readonly repair: string;
+    /** The Tenant, when it was read before opening failed (`/v1/admin/status` names it). */
+    envelope?: TenantEnvelope;
+    constructor(fields: TenantCause);
+    toCause(): TenantCause;
+}
+/** A `TenantOpenError` with the standard repair for `code`. */
+export declare function openError(code: TenantCause["code"], message: string): TenantOpenError;
+/** The cause an error carries, when it is a `TenantOpenError`. */
+export declare function causeOf(error: unknown): TenantCause | undefined;
+/** What an operator does about each cause. */
+export declare function repairFor(code: TenantCause["code"]): string;